chore: require python 3.11+ and update dependencies

.github/dependabot.yml

@@ -0,0 +1,21 @@
+# Dependabot is intentionally scoped to GitHub Actions only.
+#
+# BANOS is a published, maintenance-only scientific package: its numerical
+# output must not change. Python dependencies are therefore pinned in
+# uv.lock and updated by hand, for security reasons only, and every update
+# is validated against the golden regression tests before it is merged.
+# Automatic pull requests on that ecosystem would work against this.
+#
+# GitHub Actions are a different matter. They execute with access to this
+# repository and to the OIDC identity used to publish on PyPI, and they
+# cannot influence any computed metric, so keeping them current carries no
+# scientific risk. Dependabot also keeps the pinned commit SHAs up to date,
+# which is what makes SHA pinning maintainable on a dormant project.
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "chore"

.github/workflows/ci.yml

@@ -8,21 +8,21 @@ on:
 
 permissions:
   contents: read
-  
+
 jobs:
   lint:
     name: Lint (ruff)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: "3.11"
 
       - name: Install dependencies
-        run: uv sync --dev
+        run: uv sync --locked --dev
 
       - name: Run ruff check
         run: uv run ruff check src/ tests/
@@ -36,18 +36,18 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: uv sync --dev
+        run: uv sync --locked --dev
 
       - name: Run tests
         run: uv run pytest tests/ --ignore=tests/test_parity.py -v

.github/workflows/publish.yml

@@ -15,15 +15,15 @@ jobs:
       contents: read   # Required for actions/checkout
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: "3.11"
 
       - name: Install dependencies
-        run: uv sync --dev
+        run: uv sync --locked --dev
 
       - name: Run tests before publishing
         run: uv run pytest tests/ --ignore=tests/test_parity.py --cov=banos --cov-fail-under=80
@@ -32,4 +32,4 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

README.md

@@ -9,7 +9,7 @@
 [![PyPI](https://img.shields.io/pypi/v/banos)](https://pypi.org/project/banos/)
 [![PyPI Downloads](https://static.pepy.tech/badge/banos)](https://pepy.tech/project/banos)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![CI](https://github.com/BelloneLab/BANOS/actions/workflows/ci.yml/badge.svg)](https://github.com/BelloneLab/BANOS/actions/workflows/ci.yml)
 [![MATLAB File Exchange](https://www.mathworks.com/matlabcentral/images/matlab-file-exchange.svg)](https://www.mathworks.com/matlabcentral/fileexchange/157916-banos)
 
@@ -52,7 +52,7 @@ BANOS addresses these questions with four complementary metrics.
 pip install banos
 ```
 
-Requires Python 3.9+. Core dependency: `pandas`. Optional: `scipy` (for
+Requires Python 3.11+. Core dependency: `pandas`. Optional: `scipy` (for
 `matching='optimal'`).
 
 ## Quick Start

SECURITY.md

@@ -37,3 +37,29 @@ BANOS is a pure-Python / MATLAB computation library. It:
 The attack surface is minimal. Security reports are most relevant to dependency
 vulnerabilities (e.g., malicious `pandas` or `scipy` releases) or unsafe handling of
 user-supplied CSV input.
+
+## Dependency Policy
+
+BANOS accompanies a peer-reviewed publication and is maintained in security-only mode.
+Dependency handling follows two rules.
+
+**Numerical results must not change.** Runtime dependencies are pinned in `uv.lock`.
+Every update is validated by the golden regression tests
+(`tests/test_regression.py`, tolerance `1e-10`) across the whole supported Python
+matrix before it is merged. An update that moves a metric is rejected — the golden
+fixtures are never regenerated to accommodate a dependency bump.
+
+**Updates are deliberate, never automatic.** Dependabot alerts are enabled for
+monitoring, but automatic security updates and version updates are disabled. Each
+alert is triaged by hand and remediated with a targeted `uv lock --upgrade-package`,
+never a blanket `uv lock --upgrade`.
+
+Dependabot itself is configured for GitHub Actions only (see
+[`.github/dependabot.yml`](.github/dependabot.yml)). Actions are pinned to commit
+SHAs: they run with access to this repository and to the OIDC identity used for PyPI
+publishing, and unlike Python packages they cannot affect a computed result.
+
+One caveat when reading alerts: Dependabot reports every entry of `uv.lock` as
+`runtime` scope. In practice the BANOS runtime closure is limited to `numpy`,
+`pandas`, `scipy`, `matplotlib` and `seaborn`. The `notebook` and `calms21` extras
+are optional tutorial environments and are not needed to import or use BANOS.

pyproject.toml

@@ -4,17 +4,17 @@ version = "0.2.3"
 description = "Behavior ANnOtation Score: ethological metrics for evaluating behavior annotation quality"
 readme = "README.md"
 license = { text = "MIT" }
-requires-python = ">=3.9"
+requires-python = ">=3.11"
 keywords = ["behavior", "annotation", "ethology", "video", "scoring", "metrics"]
 classifiers = [
   "Development Status :: 4 - Beta",
   "Intended Audience :: Science/Research",
   "License :: OSI Approved :: MIT License",
   "Programming Language :: Python :: 3",
-  "Programming Language :: Python :: 3.9",
-  "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
   "Topic :: Scientific/Engineering :: Bio-Informatics",
 ]
 dependencies = [