chore: update dependencies

Author: reneleonhardt

.github/dependabot.yml

@@ -1,6 +1,19 @@
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates#setting-up-a-cooldown-period-for-dependency-updates
+
 version: 2
 updates:
-  - package-ecosystem: "pip"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups: # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#groups--
+      actions:
+        patterns: ["*"] # Combine all images of last week
+  - package-ecosystem: "uv"
     directory: "/"
     schedule:
       interval: "daily"

.github/workflows/ci.yaml

@@ -11,6 +11,7 @@ on:
 env:
   CI: true
   COLUMNS: 120
+  PYTHON_VERSION: "3.13"
 
 permissions:
   contents: read
@@ -23,7 +24,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5.4.1
         with:
-          python-version: "3.12"
+          python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Install dependencies
         run: uv sync --frozen --all-extras --all-packages
@@ -44,7 +45,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5.4.1
         with:
-          python-version: "3.12"
+          python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Install dependencies
         run: uv sync --frozen --all-extras --all-packages
@@ -94,7 +95,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5.4.1
         with:
-          python-version: "3.12"
+          python-version: ${{ env.PYTHON_VERSION }}
 
       - run: uv sync --frozen
       - run: uv run --frozen coverage combine coverage
@@ -134,7 +135,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5.4.1
         with:
-          python-version: "3.12"
+          python-version: ${{ env.PYTHON_VERSION }}
 
       - name: check GITHUB_REF matches package version
         uses: samuelcolvin/check-python-version@758a13b52c26833cffda0f2ed4f3c9e54d9186d9 # v4.1

.github/workflows/update-uv-lock.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5.4.1
         with:
-          python-version: "3.12"
+          python-version: "3.10" # stay compatible with requires-python
       - run: uv lock
       - uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5.1.0
         with:

Dockerfile

@@ -1,5 +1,5 @@
 # Build stage with explicit platform specification
-FROM ghcr.io/astral-sh/uv:python3.12-alpine AS uv
+FROM ghcr.io/astral-sh/uv:python3.13-alpine AS uv
 
 # Install the project into /app
 WORKDIR /app
@@ -23,7 +23,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-dev --no-editable
 
 # Final stage with explicit platform specification
-FROM python:3.12-alpine
+FROM python:3.13-alpine
 
 COPY --from=uv --chown=app:app /app/.venv /app/.venv