chore: require python 3.11+ and update dependencies

[BenoitJT-GIRARD]

Security maintenance. No change to metric computation: src/banos/ and the golden fixtures are untouched.

Python 3.11 minimum

3.9 has been end of life since October 2025 and 3.10 reaches it in October 2026. Supporting them forced uv.lock to carry a second resolution branch pinned to old releases, and that is where most of the Dependabot alerts came from — the same advisory was reported twice, once per branch:

GHSA-m8wh-29wm-52mv  keras  >= 3.13.0, < 3.15.0   <- py>=3.11 branch
GHSA-m8wh-29wm-52mv  keras  < 3.12.3              <- py<3.11 branch

The lock drops from 207 to 165 entries (1102 kB to 563 kB).

Refreshed lock

Targeted uv lock --upgrade-package on the vulnerable packages only — Jupyter stack, Keras, Pillow, Mistune, Tornado, urllib3, requests, setuptools, pygments, idna, soupsieve, bleach, nbconvert, pytest. No blanket uv lock --upgrade.

numpy, pandas, scipy, matplotlib and seaborn resolve to the same versions as before on Python 3.11+, so nothing numerical moves. The only change inside the runtime closure is Pillow 12.1.1 to 12.3.0, which matplotlib uses for image output and no metric depends on.

Actions pinned to commit SHAs

Workflow actions run with access to this repository and to the OIDC identity used to publish on PyPI, and a floating tag can be rewritten upstream without any change here. pypa/gh-action-pypi-publish was referenced by moving branch (release/v1) and carries an advisory below 1.13.0. Dependabot is configured to keep the pinned SHAs current, for GitHub Actions only.

CI installs with uv sync --locked

The committed lock had drifted: it still declared version 0.2.0 and an incomplete dev group, so CI was silently re-resolving instead of testing what is committed.

Verification

83 passed on each of Python 3.11, 3.12, 3.13 and 3.14, coverage 99.4%, golden regression tests green at their 1e-10 tolerance.

Matrix is now 3.11 / 3.12 / 3.13 / 3.14. The required status checks on main still list Test (Python 3.9) and Test (Python 3.10), which no longer exist, so the ruleset needs updating before this can merge.