From 786ecfb6e786d8adaf83216211bd4d4d438b1fb8 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Mon, 6 May 2024 12:17:53 -0400
Subject: [PATCH 1/4] pin deps for stability/security

---
 .github/workflows/bump-version.yml |  2 +-
 .github/workflows/main.yml         |  8 ++++----
 .github/workflows/publish-pypi.yml |  2 +-
 .github/workflows/tag-testpypi.yml |  2 +-
 environment.yml                    |  8 ++++----
 pyproject.toml                     | 10 +++++-----
 tox.ini                            |  8 ++++----
 7 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index 943c9311b..d6f002ef5 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -60,7 +60,7 @@ jobs:
           echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
       - name: Install bump-my-version
         run: |
-          python -m pip install bump-my-version
+          python -m pip install bump-my-version==0.21.0
       - name: Conditional Bump
         id: bump
         run: |
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index eab9cb1c5..523d51724 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -59,7 +59,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install pip, pylint, and tox
         run: |
-          python -m pip install flit pip~=24.0 pylint tox~=4.0
+          python -m pip install flit==3.9 pip==24.0 pylint==3.1 tox==4.15
       - name: Run pylint
         run: |
           python -m pylint --rcfile=.pylintrc.toml --disable=import-error --exit-zero xclim
@@ -98,7 +98,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install tox
         run: |
-          python -m pip install flit pip~=24.0 tox~=4.0
+          python -m pip install flit==3.9 pip==24.0 tox==4.15
       - name: Test with tox
         run: |
           python -m tox -e ${{ matrix.tox-env }}
@@ -181,7 +181,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install tox
         run: |
-          python -m pip install flit pip~=24.0 tox~=4.0 tox-gh
+          python -m pip install flit==3.9 pip==24.0 tox==4.15 tox-gh==1.3.1
       - name: Test with tox
         run: |
           python -m tox -e ${{ matrix.tox-env }} -- ${{ matrix.markers }}
@@ -279,7 +279,7 @@ jobs:
     steps:
       - name: Coveralls Finished
         run: |
-          python -m pip install --upgrade coveralls
+          python -m pip install --upgrade coveralls==4.0
           python -m coveralls --finish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 0126991b1..b62d6ab1c 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -34,7 +34,7 @@ jobs:
           python-version: "3.x"
       - name: Install packaging libraries
         run: |
-          python -m pip install flit
+          python -m pip install flit==3.9.0
       - name: Build a binary wheel and a source tarball
         run: |
           python -m flit build
diff --git a/.github/workflows/tag-testpypi.yml b/.github/workflows/tag-testpypi.yml
index 108d5d01e..5aa99298e 100644
--- a/.github/workflows/tag-testpypi.yml
+++ b/.github/workflows/tag-testpypi.yml
@@ -34,7 +34,7 @@ jobs:
           python-version: "3.x"
       - name: Install packaging libraries
         run: |
-          python -m pip install flit
+          python -m pip install flit==3.9.0
       - name: Build a binary wheel and a source tarball
         run: |
           python -m flit build
diff --git a/environment.yml b/environment.yml
index 4db610902..5285bbea4 100644
--- a/environment.yml
+++ b/environment.yml
@@ -39,7 +39,7 @@ dependencies:
   - filelock
   - flake8
   - flake8-rst-docstrings
-  - flit
+  - flit >=3.9.0
   - furo >=2023.9.10
   - h5netcdf
   - ipykernel
@@ -57,9 +57,9 @@ dependencies:
   - pandas-stubs
   - platformdirs
   - pooch
-  - pre-commit
+  - pre-commit >=3.7
   - pybtex
-  - pylint
+  - pylint >=3.1
   - pytest <8.0  # Pinned due to breakage with xdoctest. See: https://github.com/Erotemic/xdoctest/issues/151
   - pytest-cov
   - pytest-socket
@@ -73,7 +73,7 @@ dependencies:
   - sphinx-mdinclude
   - sphinxcontrib-bibtex
   - tokenize-rt
-  - tox >=4.0
+  - tox >=4.15.0
 #  - tox-conda  # Will be added when a tox@v4.0+ compatible plugin is released.
   - vulture # ==2.11  # The conda-forge version is out of date.
   - xdoctest
diff --git a/pyproject.toml b/pyproject.toml
index 1bd27965c..bc7909eaf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,5 +1,5 @@
 [build-system]
-requires = ["flit_core >=3.8,<4"]
+requires = ["flit_core >=3.9,<4"]
 build-backend = "flit_core.buildapi"
 
 [project]
@@ -60,7 +60,7 @@ dev = [
   "bump-my-version >=0.17.1",
   "codespell",
   "coverage[toml]",
-  "flake8",
+  "flake8 >=7.0.0",
   "flake8-alphabetize",
   "flake8-rst-docstrings",
   "h5netcdf",
@@ -71,11 +71,11 @@ dev = [
   "nbqa",
   "nbval",
   "netCDF4 >=1.4",
-  "pandas-stubs>=2.2",
+  "pandas-stubs >=2.2",
   "platformdirs >=3.2",
-  "pre-commit >=2.9",
+  "pre-commit >=3.7",
   "pybtex",
-  "pylint",
+  "pylint >=3.1",
   "pytest <8.0", # Pinned due to breakage with xdoctest. See: https://github.com/Erotemic/xdoctest/issues/151
   "pytest-cov",
   "pytest-socket",
diff --git a/tox.ini b/tox.ini
index 5bdf4d89e..165ee58dc 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-min_version = 4.5
+min_version = 4.15
 env_list =
     lint
     docs
@@ -13,7 +13,7 @@ labels =
     test = py39, py310-upstream-doctest, py311, notebooks_doctests, offline-prefetch
 requires =
     pip >= 24.0
-    flit
+    flit >=3.9
 opts = -vv
 
 [gh]
@@ -29,10 +29,10 @@ skip_install = True
 extras =
 deps =
     codespell
-    flake8
+    flake8 ==7.0.0
     flake8-alphabetize
     flake8-rst-docstrings
-    black[jupyter]==24.4.1
+    black[jupyter]==24.4.2
     blackdoc==0.3.9
     isort==5.13.2
     nbqa

From c0b876aadeb2fabc47e394df7432d0d359ceeb2d Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Mon, 6 May 2024 12:19:25 -0400
Subject: [PATCH 2/4] add latest coveralls

---
 environment.yml | 1 +
 pyproject.toml  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/environment.yml b/environment.yml
index 5285bbea4..e88940081 100644
--- a/environment.yml
+++ b/environment.yml
@@ -35,6 +35,7 @@ dependencies:
   - cairosvg
   - codespell
   - coverage
+  - coveralls >=4.0.0
   - distributed >=2.0
   - filelock
   - flake8
diff --git a/pyproject.toml b/pyproject.toml
index bc7909eaf..7ed6eda4f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -60,6 +60,7 @@ dev = [
   "bump-my-version >=0.17.1",
   "codespell",
   "coverage[toml]",
+  "coveralls >=4.0.0",
   "flake8 >=7.0.0",
   "flake8-alphabetize",
   "flake8-rst-docstrings",

From dd73085c5e53efbc01dd34e0bc238af01c5d09df Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Wed, 8 May 2024 18:00:53 -0400
Subject: [PATCH 3/4] address review comments

---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index 165ee58dc..8aeecb455 100644
--- a/tox.ini
+++ b/tox.ini
@@ -29,7 +29,7 @@ skip_install = True
 extras =
 deps =
     codespell
-    flake8 ==7.0.0
+    flake8 >=7.0.0
     flake8-alphabetize
     flake8-rst-docstrings
     black[jupyter]==24.4.2

From 5fb3c5861177aaaa7cecc16de7dcc9ce18dbcb51 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Wed, 8 May 2024 18:06:53 -0400
Subject: [PATCH 4/4] updated CHANGES.rst

---
 CHANGES.rst | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGES.rst b/CHANGES.rst
index d8c05c2a5..6eafde626 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -2,6 +2,14 @@
 Changelog
 =========
 
+v0.50.0 (unreleased)
+--------------------
+Contributors to this version: Trevor James Smith (:user:`Zeitsperre`).
+
+Internal changes
+^^^^^^^^^^^^^^^^
+* Synchronized tooling versions across ``pyproject.toml`` and ``tox.ini`` and pinned them to the latest stable releases in GitHub Workflows. (:pull:`1744`).
+
 v0.49.0 (2024-05-02)
 --------------------
 Contributors to this version: Trevor James Smith (:user:`Zeitsperre`), Pascal Bourgault (:user:`aulemahal`), Juliette Lavoie (:user:`juliettelavoie`), David Huard (:user:`huard`), Gabriel Rondeau-Genesse (:user:`RondeauG`), Javier Diez-Sierra (:user:`JavierDiezSierra`), Sarah Gammon (:user:`SarahG-579462`), Éric Dupuis (:user:`coxipi`).