Merge branch 'main' into main

Author: seshan18

.github/actions/setup-chrome-for-pytest/action.yml

@@ -5,7 +5,7 @@ runs:
   steps:
     - name: Set up Chrome
       id: setup-chrome
-      uses: browser-actions/setup-chrome@4f8e94349a351df0f048634f25fec36c3c91eded  # v2.1.1
+      uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
       with:
         install-chromedriver: true
     - name: Set BROWSER env var

.github/dependabot.yml

@@ -0,0 +1,53 @@
+version: 2
+
+updates:
+  # Update package versions pinned in uv.lock.
+  # Note that these updates only affect what dependency versions we use in the CI;
+  # they have no effect on the release artifacts.
+  # Still, it's important that we run our CI against the latest dependency versions
+  # in order to catch any potential issues early.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      uv-dependencies:
+        patterns:
+          - "*"
+    labels: ["no-changelog"]
+    cooldown:
+      default-days: 3  # Should match tool.uv.exclude-newer option in pyproject.toml
+
+  # Update pinned versions for third-party GitHub Actions workflows
+  - package-ecosystem: "github-actions"
+    directories:
+      - "/"                   # Only covers .github/workflows/
+      - "/.github/actions/*"  # Covers all subdirectories under .github/actions/
+    schedule:
+      interval: "weekly"
+    groups:
+      actions-dependencies:
+        patterns:
+          - "*"
+    labels: ["no-changelog"]
+    cooldown:
+      default-days: 3
+
+  # Update version for JavaScript dependencies for Jupyter widget.
+  # Note: If the dependency update results in a changed build artifact,
+  # the `check-js-build` workflow will fail on the resulting PR.
+  # As currently configured, this will require a manual push of the
+  # updated build artifacts to resolve.
+  - package-ecosystem: "npm"
+    directory: "/js"
+    schedule:
+      interval: "monthly"
+    groups:
+      javascript-dependencies:
+        patterns:
+          - "*"
+    labels: ["no-changelog"]
+    cooldown:
+      default-days: 3
+    ignore:
+      - dependency-name: "plotly.js"  # We want to handle plotly.js updates manually

.github/workflows/build-doc.yml

@@ -7,14 +7,17 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   build-doc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           python-version: "3.9"
 
@@ -42,8 +45,13 @@ jobs:
           cd doc
           source .venv/bin/activate
           make -kj8 || make -kj8
-          curl https://raw.githubusercontent.com/plotly/graphing-library-docs/master/front-matter-ci.py > front-matter-ci.py
-          curl https://raw.githubusercontent.com/plotly/graphing-library-docs/master/check-or-enforce-order.py > check-or-enforce-order.py
+          # Fetch scripts from plotly/graphing-library-docs, pinned to a specific commit SHA 
+          # to guard against unauthorized changes in that repo. If changes are made to the
+          # below-referenced scripts in plotly/graphing-library-docs, update DOCS_CI_REF
+          # accordingly to point to the latest commit SHA.
+          DOCS_CI_REF=e05eaed1ae800139df084e0587762aa273a4f19d
+          curl -fsSL https://raw.githubusercontent.com/plotly/graphing-library-docs/$DOCS_CI_REF/front-matter-ci.py > front-matter-ci.py
+          curl -fsSL https://raw.githubusercontent.com/plotly/graphing-library-docs/$DOCS_CI_REF/check-or-enforce-order.py > check-or-enforce-order.py
           python front-matter-ci.py build/html
           python check-or-enforce-order.py build/html
 
@@ -55,7 +63,7 @@ jobs:
 
       - name: Create GitHub App token
         if: github.ref_name == 'doc-prod' && github.event_name == 'push'
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3  # v3.1.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
         id: app-token
         with:
           app-id: ${{ vars.GRAPHING_LIBRARIES_CI_GHAPP_ID }}
@@ -65,7 +73,7 @@ jobs:
 
       - name: Checkout plotly.py-docs (built)
         if: github.ref_name == 'doc-prod' && github.event_name == 'push'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: plotly/plotly.py-docs
           ref: built
@@ -86,7 +94,7 @@ jobs:
 
       - name: Checkout plotly.py-docs (built_ipynb)
         if: github.ref_name == 'doc-prod' && github.event_name == 'push'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: plotly/plotly.py-docs
           ref: built_ipynb
@@ -105,7 +113,7 @@ jobs:
 
       - name: Checkout graphing-library-docs
         if: github.ref_name == 'doc-prod' && github.event_name == 'push'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: plotly/graphing-library-docs
           ref: master
@@ -134,7 +142,7 @@ jobs:
 
       - name: Checkout plotly.py-docs (gh-pages)
         if: github.ref_name == 'doc-prod' && github.event_name == 'push'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: plotly/plotly.py-docs
           ref: gh-pages

.github/workflows/build-package.yml

@@ -7,27 +7,30 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   plotlyjs-dev-build:
     name: plotly.js dev build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.12"
       - name: Set up Node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: "22"
       - name: Set up uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
       - name: Install dependencies
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_optional
+          uv sync --locked --extra dev_optional
       - name: Update plotly.js to dev
         run: |
           source .venv/bin/activate
@@ -39,7 +42,7 @@ jobs:
       - name: Build source distribution packages
         run: |
           source .venv/bin/activate
-          uv sync --extra dev_build
+          uv sync --locked --extra dev_build
           python -m build --sdist --wheel -o dist
       - name: Upload dist artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -52,22 +55,22 @@ jobs:
     name: Full prod build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.12"
       - name: Set up Node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: "22"
       - name: Set up uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
       - name: PyPI Build
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_build
+          uv sync --locked --extra dev_build
           cd js
           npm ci
           npm run build

.github/workflows/check-changelog.yml

@@ -0,0 +1,32 @@
+name: Check changelog
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled, ready_for_review]
+
+concurrency:
+  group: check-changelog-${{ github.event.pull_request.number }}
+  cancel-in-progress: true  
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  check-changelog:
+    name: Check if CHANGELOG.md was updated
+    if: ${{ !github.event.pull_request.draft }}
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+      HAS_SKIP_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'no-changelog') }}
+    steps:
+      - run: |
+          if [ "$HAS_SKIP_LABEL" = true ]; then
+            echo "::notice::This PR has the 'no-changelog' label, so a change to CHANGELOG.md is not required."
+          elif gh api "repos/${{ github.repository }}/pulls/${{ github.event.number }}/files" --paginate --jq '.[].filename' | grep -qx CHANGELOG.md; then
+            echo "::notice::CHANGELOG.md was updated."
+          else
+            echo "::error::CHANGELOG.md was not updated. Either add a changelog entry, or add the 'no-changelog' label to this PR if a changelog entry is not needed."
+            exit 1
+          fi

.github/workflows/check-codegen.yml

@@ -7,26 +7,29 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check-python-codegen:
     name: Check Python codegen
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
     - name: Set up Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: "3.x"
 
     - name: Set up uv
-      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
 
     - name: Install dependencies
       run: |
         uv venv
         source .venv/bin/activate
         uv lock --check
-        uv sync --extra dev_codegen
+        uv sync --locked --extra dev_codegen
     - name: Run codegen
       run: |
         source .venv/bin/activate

.github/workflows/check-formatting.yml

@@ -7,23 +7,26 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check-code-formatting:
     name: Run ruff check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.12"
       - name: Set up uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
       - name: Install dependencies
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_core
+          uv sync --locked --extra dev_core
       - name: Check handwritten code with ruff
         run: |
           source .venv/bin/activate

.github/workflows/check-js-build.yml

@@ -3,21 +3,24 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, reopened]
+    types: [opened, reopened, synchronize]
     paths:
       - 'js/**'
       - 'plotly/labextension/**'
 
 name: Check JS build
 
+permissions:
+  contents: read
+
 jobs:
   check-js-build:
     name: Check JS version number and build artifacts
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
     - name: Set up Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: "3.x"
 
@@ -34,12 +37,12 @@ jobs:
           echo "✅ Version number $JSPROJECT_VERSION in $PKGJSON_PATH matches version number $PYPROJECT_VERSION in $PYPROJECT_PATH"
         fi
     - name: Install Node
-      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
       with:
         node-version: '22'
 
     - name: Set up uv
-      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
+      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
 
     - name: Copy current files to a temporary directory
       run: |
@@ -51,7 +54,7 @@ jobs:
         source .venv/bin/activate
         # Technically, we only need the `jupyter-builder` package, but using the dev_build extra
         # keeps build behavior consistent across all CI jobs
-        uv sync --extra dev_build
+        uv sync --locked --extra dev_build
         cd js
         npm ci
         npm run build