chore(deps): lock file maintenance

.github/workflows/build-and-push.yml

@@ -33,16 +33,16 @@ jobs:
                 persist-credentials: false
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+              uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
             - name: Login to DockerHub
-              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                 username: ${{ secrets.DOCKER_USERNAME }}
                 password: ${{ secrets.DOCKER_PASSWORD }}
 
             - name: Login to GitHub Container Registry
-              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                 registry: ghcr.io
                 username: ${{ github.repository_owner }}
@@ -139,7 +139,7 @@ jobs:
                 echo "Generated tags: $TAGS"
 
             - name: Build and push Docker image
-              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+              uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
               with:
                 build-args: |
                     PHOTON_VERSION=${{ env.PHOTON_VERSION }}

.github/workflows/full-test-jsonl.yml

@@ -29,7 +29,7 @@ jobs:
                 persist-credentials: false
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+              uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
             - name: Read Photon version from .last_release
               id: photon_version
@@ -43,7 +43,7 @@ jobs:
                 echo "Photon Version: $PHOTON_VERSION"
 
             - name: Build test image
-              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+              uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
               with:
                 context: .
                 file: ./Dockerfile

.github/workflows/full-test.yml

@@ -29,7 +29,7 @@ jobs:
                 persist-credentials: false
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+              uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
             - name: Read Photon version from .last_release
               id: photon_version
@@ -43,7 +43,7 @@ jobs:
                 echo "Photon Version: $PHOTON_VERSION"
 
             - name: Build test image
-              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+              uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
               with:
                 context: .
                 file: ./Dockerfile

.github/workflows/lint.yml

@@ -27,10 +27,10 @@ jobs:
               with:
                 python-version-file: ".python-version"
 
-            - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+            - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
                 enable-cache: true
-                version: 0.12.3
+                version: 0.13.4
 
             - run: uv sync --locked
             - run: |
@@ -47,10 +47,10 @@ jobs:
               with:
                 python-version-file: ".python-version"
 
-            - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+            - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
                 enable-cache: true
-                version: 0.12.3
+                version: 0.13.4
 
             - run: uv sync --locked
             - run: uv run ty check
@@ -65,10 +65,10 @@ jobs:
               with:
                 python-version-file: ".python-version"
 
-            - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+            - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
                 enable-cache: true
-                version: 0.12.3
+                version: 0.13.4
 
             - run: uv sync --locked
             - run: uv run vulture --min-confidence 100 --exclude ".venv" .

.github/workflows/pytest.yml

@@ -30,10 +30,10 @@ jobs:
                 python-version-file: "pyproject.toml"
 
             - name: Install uv
-              uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+              uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
               with:
                 enable-cache: true
-                version: 0.12.3
+                version: 0.13.4
 
             - name: Install dependencies
               run: uv sync --locked
@@ -47,7 +47,7 @@ jobs:
                   | tee pytest-coverage.txt
 
             - name: Pytest coverage comment
-              uses: MishaKav/pytest-coverage-comment@09c28b6767e12a048e0b23e821ed03133ee48a1a # main
+              uses: MishaKav/pytest-coverage-comment@c772f8e59c8562befa8eabbbf7cfabd2e4d69f00 # main
               with:
                 pytest-coverage-path: ./pytest-coverage.txt
                 junitxml-path: ./pytest.xml

.github/workflows/release-drafter.yml

@@ -22,7 +22,7 @@ jobs:
 
             - name: Run Release Drafter
               id: release-drafter
-              uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7
+              uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7
               env:
                 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.pre-commit-config.yml

@@ -8,7 +8,7 @@ repos:
         - id: end-of-file-fixer
 
     - repo: https://github.com/astral-sh/ruff-pre-commit
-      rev: v0.15.4
+      rev: v0.17.1
       hooks:
         - id: ruff-check
           args: [--fix]
@@ -22,12 +22,12 @@ repos:
         - id: actionlint
 
     - repo: https://github.com/betterleaks/betterleaks
-      rev: v1.7.4
+      rev: v1.9.0
       hooks:
         - id: betterleaks
 
     - repo: https://github.com/renovatebot/pre-commit-hooks
-      rev: 44.14.10
+      rev: 44.173.1
       hooks:
         - id: renovate-config-validator
           files: renovate.json

Dockerfile

@@ -7,7 +7,7 @@ RUN apt-get update \
     python3.12 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=ghcr.io/astral-sh/uv:0.12.5@sha256:e85be844203885286c60ffad8a858d48afb6c5a5c237ca0e67f12e74b8f174b1 /uv /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:0.13.5@sha256:32a7bb39b496babbd997b0a39a4d66c126bdaf5661b302bf6f06abda8deca6ff /uv /usr/local/bin/
 
 WORKDIR /build
 
@@ -21,7 +21,7 @@ ENV UV_PYTHON=/usr/bin/python3.12 \
 RUN uv sync --locked --no-dev --no-install-project
 
 
-FROM eclipse-temurin:21.0.9_10-jre-noble@sha256:d3eb69add1874bc785382d6282db53a67841f602a1139dee6c4a1221d8c56568
+FROM eclipse-temurin:21.0.12_8-jre-noble@sha256:d35199d74a3b2dff1bfb435d9adde4ef974e74a7d2a4fcb3079063c55926edb5
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG PHOTON_VERSION
@@ -34,6 +34,7 @@ RUN apt-get update \
     gosu \
     python3.12 \
     curl \
+    ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 RUN groupadd -g ${PGID} -o photon && \

mise.toml

@@ -1,11 +1,11 @@
 #:schema https://mise.jdx.dev/schema/mise.json
 
 [tools]
-uv = "0.12.3"
+uv = "0.13.4"
 python = "3.14.7"
-betterleaks = "1.7.4"
-prek = "0.4.13"
-zizmor = "1.29.0"
+betterleaks = "1.9.0"
+prek = "0.5.7"
+zizmor = "1.31.1"
 
 [deps]
 uv = { auto = true }

pyproject.toml

@@ -9,9 +9,9 @@ dependencies = [
     "apprise>=1.9.3",
     "psutil>=5.9.0",
     "python-dateutil>=2.9.0.post0",
-    "requests==2.33.1",
+    "requests==2.34.2",
     "schedule>=1.2.2",
-    "tqdm==4.67.3",
+    "tqdm==4.70.1",
     "zstandard>=0.23.0",
 ]
 

tests/test_importer.py

@@ -156,20 +156,26 @@ def fake_popen(cmd, cwd, stdin):
 def test_run_jsonl_import_uses_parent_region_and_country_codes_for_multi_region(monkeypatch):
     process = RecordingProcess()
     download_args = []
+    import_args = []
 
     def fake_download(region):
         download_args.append(region)
         return "/photon/data/temp/europe.jsonl.zst"
 
+    def fake_start_import(input_source, country_codes=None):
+        import_args.append({"input_source": input_source, "country_codes": country_codes})
+        return process
+
     monkeypatch.setattr(config, "REGION", "andorra,luxemburg")
     monkeypatch.setattr(importer, "download_jsonl", fake_download)
     monkeypatch.setattr(importer, "stream_decompress", lambda path: [b'{"type":"Place"}\n'])
-    monkeypatch.setattr(importer, "_start_photon_import", lambda input_source, country_codes=None: process)
+    monkeypatch.setattr(importer, "_start_photon_import", fake_start_import)
     monkeypatch.setattr(importer, "clear_temp_dir", lambda: None)
 
     importer.run_jsonl_import()
 
     assert download_args == ["europe"]
+    assert import_args == [{"input_source": "-", "country_codes": ["AD", "LU"]}]
 
 
 def test_run_jsonl_import_uses_single_region_without_country_codes(monkeypatch):

tests/test_process_manager.py

@@ -396,8 +396,15 @@ def test_run_update_notifies_when_health_check_fails_after_swap(
 def test_run_pending_jobs_survives_job_exception(
     manager: process_manager.PhotonManager, monkeypatch: pytest.MonkeyPatch
 ):
-    monkeypatch.setattr(process_manager.schedule, "run_pending", MagicMock(side_effect=RuntimeError("job boom")))
+    run_pending = MagicMock(side_effect=[RuntimeError("job boom"), None])
+    monkeypatch.setattr(process_manager.schedule, "run_pending", run_pending)
+
+    manager._run_pending_jobs()
+    run_pending.assert_called_once_with()
+
+    run_pending.reset_mock()
     manager._run_pending_jobs()
+    run_pending.assert_called_once_with()
 
 
 @pytest.mark.parametrize("interval", ["3d", "12h", "30m"])

tests/test_update.py

@@ -1,7 +1,7 @@
 import hashlib
 import subprocess
 from pathlib import Path
-from unittest.mock import patch
+from unittest.mock import Mock, call, patch
 
 import pytest
 
@@ -239,9 +239,31 @@ def _make_pipeline_patches(monkeypatch: pytest.MonkeyPatch):
 
 def test_run_update_happy_path(fake_dirs: Path, monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setattr(config, "SKIP_MD5_CHECK", False)
-    _make_pipeline_patches(monkeypatch)
+    fake_index = str(Path(config.TEMP_DIR) / "index.tar.bz2")
+    fake_md5 = fake_index + ".md5"
+    pipeline = Mock()
+    pipeline.download_index.return_value = fake_index
+    pipeline.download_md5.return_value = fake_md5
+    pipeline.verify_checksum.return_value = True
+    pipeline.attach_mock(Mock(wraps=update.clear_temp_dir), "clear_temp_dir")
+    monkeypatch.setattr(update, "get_download_url", lambda: "https://example.com/x")
+    monkeypatch.setattr(update, "get_remote_file_size", lambda _: 1024)
+    monkeypatch.setattr(update, "check_disk_space_requirements", lambda *_, **__: True)
+    for name in ("download_index", "download_md5", "verify_checksum", "extract_index", "clear_temp_dir"):
+        monkeypatch.setattr(update, name, getattr(pipeline, name))
+    monkeypatch.setattr(update.index, "activate", pipeline.activate)
+
     update.run_update("PARALLEL")
-    assert Path(config.TEMP_DIR).exists()
+
+    assert pipeline.mock_calls == [
+        call.download_index(),
+        call.download_md5(),
+        call.verify_checksum(fake_md5, fake_index),
+        call.extract_index(fake_index),
+        call.activate(str(Path(config.TEMP_DIR) / "photon_data")),
+        call.clear_temp_dir(),
+    ]
+    assert not Path(config.TEMP_DIR).exists()
 
 
 def test_run_update_passes_strategy_to_space_check(fake_dirs: Path, monkeypatch: pytest.MonkeyPatch):
@@ -290,11 +312,16 @@ def test_run_update_skip_space_check_proceeds_on_size_error(fake_dirs: Path, mon
     monkeypatch.setattr(config, "SKIP_MD5_CHECK", True)
     _make_pipeline_patches(monkeypatch)
 
-    def boom(_url):
-        raise RemoteFileSizeError("no size")
+    with (
+        patch.object(update, "get_remote_file_size", side_effect=RemoteFileSizeError("no size")) as size,
+        patch.object(update, "download_index", wraps=update.download_index) as download,
+        patch.object(update.index, "activate") as activate,
+    ):
+        update.run_update("PARALLEL")
 
-    monkeypatch.setattr(update, "get_remote_file_size", boom)
-    update.run_update("PARALLEL")
+    size.assert_called_once_with("https://example.com/x")
+    download.assert_called_once_with()
+    activate.assert_called_once_with(str(Path(config.TEMP_DIR) / "photon_data"))
 
 
 def test_run_update_raises_on_size_error_without_skip(fake_dirs: Path, monkeypatch: pytest.MonkeyPatch):
@@ -436,20 +463,6 @@ def always_mismatch(*_):
     assert notify.call_count == 1
 
 
-def test_run_update_verifies_before_extracting(fake_dirs: Path, monkeypatch: pytest.MonkeyPatch):
-    monkeypatch.setattr(config, "SKIP_MD5_CHECK", False)
-    monkeypatch.setattr(config, "CHECKSUM_MAX_RETRIES", "1")
-    _make_pipeline_patches(monkeypatch)
-
-    order: list[str] = []
-    monkeypatch.setattr(update, "verify_checksum", lambda *_: order.append("verify") or True)
-    monkeypatch.setattr(update, "extract_index", lambda _: order.append("extract"))
-
-    update.run_update("PARALLEL")
-
-    assert order == ["verify", "extract"]
-
-
 def test_run_update_extraction_failure_prevents_activation(fake_dirs: Path, monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setattr(config, "SKIP_MD5_CHECK", True)
     _make_pipeline_patches(monkeypatch)