[lhoupert]

Re-lands #289. It was merged into feat/281-scale-offset-codec after that branch had already merged (#287), so it never reached main. A second commit adds what main gained since, mainly the generic rechunker from #292. This also fixes eopf-geozarr --version (main prints 0.1.0) and the mkdocs build --strict failure.

For reviewers: the release workflow hunks are skipped (already on main via #290), and uv.lock was regenerated. Please confirm that #292 dropped the Sentinel-2 STAC scale fields on purpose.

[github-actions]

Security Audit Report

View workflow run

Bandit — Static Security Analysis (Security tab)

13 issue(s) found: 1 medium, 12 low

✅ No issues at or above HIGH severity.

1 medium, 12 low issue(s) below threshold not shown in table.

pip-audit — Dependency Vulnerabilities (Security tab)

Dependencies audited: 120, skipped: 0.

Package	Version	ID	Fix Versions	Description
aiohttp	3.14.3	CVE-2026-111064	3.14.4	### Summary The keepalive timeout was not used during the initial portion of a request. ### Impact An attacker could
aiohttp	3.14.3	GHSA-2g87-pp6c-29x5	3.14.4	### Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumpti
aiohttp	3.14.3	CVE-2026-111063	3.14.4	### Summary The Secure attribute was not being enforced for the shared cookie. ### Impact It may be possible to send
aiohttp	3.14.3	CVE-2026-111750	3.14.4	### Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. ### Impact If users are using t
aiohttp	3.14.3	CVE-2026-111066	3.14.4	### Summary An attacker can exhaust file descriptors with specially crafted multipart requests. ### Impact If a handl
aiohttp	3.14.3	CVE-2026-111749	3.14.4	### Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. ### Impact A user a
aiohttp	3.14.3	CVE-2026-111065	3.14.4	### Summary An overflow in Max-Age processing can skip closing a connection. ### Impact An attacker may be able to ex
aiohttp	3.14.3	CVE-2026-111748	3.14.4	### Summary An attacker sending an absolute-form request can spoof the scheme used. ### Impact If user code depends o
black	26.5.1	CVE-2026-114134	26.10.1	### Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if `use_pyproj
certifi	2026.7.22	PYSEC-2026-4320	2026.10.18	Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eig
certifi	2026.7.22	PYSEC-2026-4320	2026.10.19	Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eig
filelock	3.32.6	CVE-2026-112940	4.2.1	ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) hand SQLite a name they do not control.
filelock	3.32.6	CVE-2026-112913	4.2.1	On Windows, ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) connect SQLite to the lock d
filelock	3.32.6	CVE-2026-112907	4.2.1	On Windows the soft locks (SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock th
virtualenv	21.7.13	CVE-2026-113726	21.14.4	### Impact zsh users activate an environment with the bash activate script, which puts the environment name into `PS1
virtualenv	21.7.13	CVE-2026-113776	21.14.2	### Impact ViaTemplateActivator.instantiate_template replaces the placeholders in an activation template one key at a
virtualenv	21.7.13	CVE-2026-113732	21.14.2	### Impact FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns `shlex.quot
virtualenv	21.7.13	CVE-2026-113725	21.14.7	### Summary The bash activate script escapes the environment name for only one of the two passes bash makes over `PS1
virtualenv	21.7.13	CVE-2026-113722	21.14.9	## Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console la
virtualenv	21.7.13	CVE-2026-113714	21.14.9	## Summary Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip
virtualenv	21.7.13	CVE-2026-113723	21.14.9	## Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must inf
virtualenv	21.7.13	CVE-2026-113715	21.14.9	## Summary The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resultin
virtualenv	21.7.13	CVE-2026-113720	21.14.9	## Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current um
virtualenv	21.7.13	CVE-2026-113717	21.14.9	## Summary The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is
virtualenv	21.7.13	CVE-2026-113718	21.14.9	## Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must in

25 vulnerability/vulnerabilities found (25 fixable) across 5 package(s).

---

Result: ❌ Blocking issues found — see details above.