Modernize dependencies, CI, and Python support

.github/dependabot.yml

@@ -4,7 +4,6 @@
 # https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 
 version: 2
-enable-beta-ecosystems: true
 updates:
   - package-ecosystem: "cargo"
     directory: "/"
@@ -22,6 +21,22 @@ updates:
       actions:
         patterns:
           - "*"
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      pre-commit:
+        patterns:
+          - "*"
+  - package-ecosystem: "rust-toolchain"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      rust:
+        patterns:
+          - "*"
   - package-ecosystem: "uv"
     directory: "/"
     schedule:

.github/workflows/CI.yml

@@ -20,29 +20,57 @@
       fail-fast: false
       matrix:
         py:
+          - "3.14"
           - "3.13"
           - "3.12"
-          - "3.11"
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           python-version: ${{ matrix.py }}
-      - uses: dtolnay/rust-toolchain@1.91.0
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@ebb3d1676050bfd0971c36c1e215b5751473994d # 1.96.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: uv sync --extra test --locked
       - run: uv run pytest --benchmark-disable -vvv --durations=10
 
+  test-free-threaded:
+    name: test 3.14t
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: true
+          python-version: "3.14t"
+      - uses: dtolnay/rust-toolchain@ebb3d1676050bfd0971c36c1e215b5751473994d # 1.96.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - run: uv sync --extra test --locked
+      - name: Verify importing egglog keeps the GIL disabled
+        # PYTHON_GIL=0 would hide an extension that enables the GIL on import.
+        run: |
+          env -u PYTHON_GIL uv run --locked python - <<'PY'
+          import sys
+          import sysconfig
+
+          assert sysconfig.get_config_var("Py_GIL_DISABLED") == 1
+          assert not sys._is_gil_enabled()
+          import egglog.bindings
+          assert not sys._is_gil_enabled()
+          PY
+      - run: uv run --locked pytest --benchmark-disable -vvv --durations=10
+        env:
+          PYTHON_GIL: "0"
+
   mypy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-      - uses: dtolnay/rust-toolchain@1.91.0
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@ebb3d1676050bfd0971c36c1e215b5751473994d # 1.96.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: uv sync --extra test --locked
       - run: make mypy
       - run: make stubtest
@@ -52,40 +80,40 @@
     runs-on: ${{ matrix.runner }}
     strategy:
       matrix:
-        # Run on codspeed for walltime and ubuntu for instrumenentation
+        # Run on CodSpeed for walltime and Ubuntu for simulation.
         runner: [ ubuntu-latest, codspeed-macro ]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Work around import-time SciPy/sklearn segfaults on the codspeed ARM64 Python 3.13 runner.
           python-version: "3.12"
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           python-version: "3.12"
-      - uses: dtolnay/rust-toolchain@1.91.0
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@ebb3d1676050bfd0971c36c1e215b5751473994d # 1.96.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: |
           export UV_PROJECT_ENVIRONMENT="${pythonLocation}"
           uv sync --extra test --locked --python 3.12
-      - uses: CodSpeedHQ/action@v4.11.1
+      - uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
         with:
           token: ${{ secrets.CODSPEED_TOKEN }}
           # allow updating snapshots due to indeterministic benchmarks
           run: pytest -vvv --snapshot-update --durations=10 --codspeed-max-rounds=10 python/tests/test_array_api.py -k "test_jit or test_run_lda"
-          mode: ${{ matrix.runner == 'ubuntu-latest' && 'instrumentation' || 'walltime' }}
+          mode: ${{ matrix.runner == 'ubuntu-latest' && 'simulation' || 'walltime' }}
 
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
-      - uses: dtolnay/rust-toolchain@1.91.0
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@ebb3d1676050bfd0971c36c1e215b5751473994d # 1.96.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Install graphviz
         run: |
           sudo apt-get update

.github/workflows/update-changelog.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Get PR details
         id: pr-details
-        uses: actions/github-script@v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { data: pullRequest } = await github.rest.pulls.get({
@@ -30,14 +30,14 @@ jobs:
             core.setOutput('head_ref', pullRequest.head.ref);
 
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Checkout the PR head ref
           ref: ${{ steps.pr-details.outputs.head_ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
 
@@ -63,4 +63,4 @@ jobs:
           git config --local user.name "GitHub Action"
           git add docs/changelog.md
           git commit -m "Add changelog entry for PR #${{ steps.pr-details.outputs.number }}"
-          git push
+          git push

.github/workflows/version.yml

@@ -35,7 +35,7 @@
     outputs:
       version: ${{ steps.bump.outputs.version }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: |
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
@@ -59,20 +59,20 @@
     needs: [bump]
     if: ${{ always() }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ needs.bump.result == 'success' }}
         with:
           ref: version-${{ needs.bump.outputs.version }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ needs.bump.result == 'skipped' }}
-      - uses: PyO3/maturin-action@v1.49.4
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           target: ${{ matrix.target }}
           manylinux: auto
           command: build
-          args: --release --sdist -o dist --find-interpreter
+          args: --release --locked --sdist -o dist -i python3.12 python3.13 python3.14 python3.14t
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-linux-${{ matrix.target }}
           path: dist
@@ -83,66 +83,81 @@
     needs: [bump]
     if: ${{ always() }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ needs.bump.result == 'success' }}
         with:
           ref: version-${{ needs.bump.outputs.version }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ needs.bump.result == 'skipped' }}
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v3
-      - uses: PyO3/maturin-action@v1.49.4
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           manylinux: auto
           command: build
-          args: --release --sdist -o dist --find-interpreter
+          args: --release --locked --sdist -o dist -i python3.12 python3.13 python3.14 python3.14t
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-linux
           path: dist
 
   windows:
-    name: build windows
+    name: build windows ${{ matrix.python }}
     runs-on: windows-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.12", "3.13", "3.14", "3.14t"]
     needs: [bump]
     if: ${{ always() }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ needs.bump.result == 'success' }}
         with:
           ref: version-${{ needs.bump.outputs.version }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ needs.bump.result == 'skipped' }}
-      - uses: PyO3/maturin-action@v1.49.4
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python }}
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           command: build
-          args: --release -o dist --find-interpreter
+          args: --release --locked -o dist -i python
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: wheels-windows
+          name: wheels-windows-${{ matrix.python }}
           path: dist
 
   macos:
     name: build macos
     runs-on: macos-latest
     needs: [bump]
     if: ${{ always() }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ needs.bump.result == 'success' }}
         with:
           ref: version-${{ needs.bump.outputs.version }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: ${{ needs.bump.result == 'skipped' }}
-      - uses: PyO3/maturin-action@v1.49.4
+      - name: Set up supported Python interpreters
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: |
+            3.12
+            3.13
+            3.14
+            3.14t
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           command: build
           target: universal2-apple-darwin
-          args: --release -o dist --find-interpreter
+          args: --release --locked -o dist -i python3.12 python3.13 python3.14 python3.14t
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-macos
           path: dist
@@ -153,12 +168,12 @@
     if: startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch')
     needs: [macos, windows, linux, linux-cross, bump]
     steps:
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: wheels-*
           merge-multiple: true
       - name: Publish to PyPI
-        uses: PyO3/maturin-action@v1.49.4
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         env:
           MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
         with:
@@ -169,7 +184,7 @@
     permissions: write-all
     needs: [release, bump]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: version-${{ needs.bump.outputs.version }}
       - run: |

.pre-commit-config.yaml

@@ -1,12 +1,12 @@
 exclude: ^python/tests/__snapshots__/
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.3
+    rev: v0.16.8
     hooks:
       - id: ruff-check
         args: [--fix]
       - id: ruff-format
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.9.7
+    rev: 0.12.17
     hooks:
       - id: uv-lock

.python-version

@@ -1 +1 @@
-3.13
+3.14

.readthedocs.yaml

@@ -5,23 +5,20 @@
 # Required
 version: 2
 
-# Set the version of Python and other tools you might need
 build:
-  os: ubuntu-24.04
+  os: ubuntu-26.04
   tools:
-    python: "3.12"
-    #     # You can also specify other tool versions:
-    #     # nodejs: "16"
-    rust: "1.91"
-  # golang: "1.17"
+    python: "3.14"
+    rust: "1.96"
   apt_packages:
     - graphviz
-  commands:
-    - asdf plugin add uv
-    - asdf install uv latest
-    - asdf global uv latest
-    - uv sync --extra docs --frozen
-    - uv run -m sphinx -T -b html -d docs/_build/doctrees -D language=en docs $READTHEDOCS_OUTPUT/html
+
+python:
+  install:
+    - method: uv
+      command: sync
+      extras:
+        - docs
 
 # Build documentation in the docs/ directory with Sphinx
 sphinx: