Release/1.2.5

.github/workflows/dependency-security.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    branches: [bugfix/dependabot]
   schedule:
     - cron: "17 9 * * 1"
   workflow_dispatch:
@@ -13,11 +13,28 @@ permissions:
   contents: read
 
 jobs:
+
+  ensure-branch:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Create bugfix branch if missing
+        run: |
+          if git ls-remote --exit-code --heads origin bugfix/dependabot > /dev/null; then
+            echo "bugfix/dependabot already exists"
+          else
+            git push origin origin/main:refs/heads/bugfix/dependabot
+          fi
+
   audit:
+    needs: ensure-branch
     name: Audit locked dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install uv with audit support
         uses: astral-sh/setup-uv@v7
@@ -60,7 +77,7 @@ jobs:
         run: uv export --locked --all-extras --all-groups --format cyclonedx1.5 --output-file dependency-sbom.cdx.json
 
       - name: Upload dependency SBOM
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dependency-sbom
           path: dependency-sbom.cdx.json

.github/workflows/lint.yml

@@ -12,7 +12,7 @@ jobs:
   ruff-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:

.github/workflows/publish.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:

.github/workflows/static.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
@@ -36,9 +36,9 @@ jobs:
       - name: Setup Pages
         uses: actions/configure-pages@v5
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           path: 'site'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/tests.yml

@@ -18,7 +18,7 @@ jobs:
         python-version: ["3.10", "3.12", "3.14"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7

CHANGELOG.md

@@ -39,6 +39,18 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 
 -->
+## [1.2.5] = 2026-10-21
+### Security
+- 🔐 Remediated Dependabot alerts by raising python minor and patch groups
+- 🔐 Updated pull_request target for Dependabot PRs to `bugfix/dependabot`
+- 🔐 Added weekly Dependabot updates and CI dependency auditing to prevent vulnerable dependency regressions.
+
+### Changed
+- ⚡ updated `OPENSAMPL_VERSION` in the Dockerfiles
+
+### Added
+- 🔥 ensure_branch job to the dependabot security review workflow
+
 ## [1.2.4] = 2026-10-12
 ### Security
 - 🔐 Remediated nine Dependabot alerts by raising the secure minimum versions of AnyIO, urllib3, PyMdown Extensions, Mako, and Material for MkDocs.

docs.Dockerfile

@@ -1,6 +1,6 @@
-FROM ghcr.io/astral-sh/uv:0.12.21 AS uv
+FROM ghcr.io/astral-sh/uv:0.13.1 AS uv
 
-FROM python:3.11 AS builder
+FROM python:3.14 AS builder
 WORKDIR /app
 COPY --from=uv /uv /uvx /bin/
 COPY . .

opensampl/server/backend/Dockerfile

@@ -1,5 +1,5 @@
-FROM python:3.12 AS base
-ARG OPENSAMPL_VERSION=1.1.5
+FROM python:3.14 AS base
+ARG OPENSAMPL_VERSION=1.2.5
 
 WORKDIR /tmp
 ENV ROUTE_TO_BACKEND=false

opensampl/server/migrations/Dockerfile

@@ -1,6 +1,6 @@
-FROM python:3.12
+FROM python:3.14
 
-ARG OPENSAMPL_VERSION=1.1.5
+ARG OPENSAMPL_VERSION=1.2.5
 
 WORKDIR /
 RUN pip install --no-cache-dir \

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "opensampl"
-version = "1.2.4"
+version = "1.2.5"
 description = "Python tools for adding clock data to a timescale db."
 license = {file = "LICENSE"}
 authors = [
@@ -50,7 +50,7 @@ dependencies = [
     "numpy>=1.26.4,<2; python_version < '3.13'",
     # NumPy 2.4 supports both Python 3.13 and 3.14 with published wheels.
     "numpy>=2.4.0,<3; python_version >= '3.13'",
-    "pytz~=2024.1",
+    "pytz>=2024.1,<2027.0",
     "requests>=2.32.4,<3",
     # requests permits a broad urllib3 range; keep published installs above the
     # fixes for GHSA-8988-9cw3-xx77, GHSA-vxq7-64xx-v4gw, and GHSA-gh4c-6fx4-qh6g.