Relax dependency bounds and enable Dependabot

[bernalde]

Summary

• Move Assimulo out of the core install and into the optional assimulo extra.
• Replace blanket pins with lower bounds for NumPy, SciPy, matplotlib, and pandas.
• Migrate Commons.integration from scipy.integrate.simps to simpson so current SciPy releases are installable.
• Add DEPENDENCIES.md, requirements-assimulo.txt, and weekly Dependabot groups for pip and GitHub Actions.
• Update CI to install the package through python -m pip install -e ".[test]".

Traceability

Closes #9.
Depends on #92 / #8 and is stacked on packaging/pyproject-metadata.
Refs #1, #2, CryPTSys#106, and CryPTSys#107.

Verification

• python -m pip install -e ".[test]"
• pytest --collect-only
• pytest tests/ -m "not assimulo"
• python -m build (rerun with network access for isolated setuptools/wheel build requirements)

Actions

GitHub Actions should run on this PR through the stacked CI workflow from #91.

[bernalde]

Maintainer review — PR #93 @ 0f6b8bc (COMMENT)

I authored this PR and it is a draft, so this is a COMMENT (GitHub rejects author APPROVE/REQUEST_CHANGES). Since this branch was cut, #92 and #96 have merged to master, and this PR now conflicts.

Verified locally in a clean worktree at the head, with assimulo not installed:

• pip install -e ".[test]" resolved numpy 2.5.0 / scipy 1.17.1 — the relaxed bounds work against the modern stack.
• pytest tests/test_optional_dependencies.py tests/ -m "not assimulo" -> 2 passed, 6 deselected.
• simps -> simpson(row, x=time) is the correct replacement and the optional TerminateSimulation import guard lets PharmaPy.Commons import without assimulo.

Blocking — conflicts with master; branch cut from a stale base

mergeStateStatus is DIRTY / CONFLICTING. This branch descends from 6d27b40, before #92's follow-up df4eebd and #96 landed on master. A test merge into master conflicts in:

• pyproject.toml ([project.dependencies] block) — resolve by keeping this PR's new bounds + the assimulo extra.
• .github/workflows/ci.yml (install step) — resolve by keeping this PR's pip install -e ".[test]".

Update the branch from master (append-only merge or rebase) and resolve both. Watch one thing: this branch still declares build-system.requires = ["setuptools>=61", "wheel"], but master already moved to setuptools>=77 (from #92). The 3-way merge keeps >=77 automatically because this PR doesn't touch that line — just confirm >=77 survives after resolving. Expected for a draft, but it blocks merge.

Summary

• Blocking: merge conflict vs master (stale base) — must update and resolve pyproject.toml + ci.yml.
• Nonblocking: core-dependency list is duplicated across requirements.txt / requirements-assimulo.txt / pyproject.toml (inline); Dependabot has no ignore for the intentionally-pinned assimulo/cython (inline).
• Questions: none.
• Tests: relaxed bounds verified with numpy 2.5.0 / scipy 1.17.1; optional-deps + not-assimulo suite pass (2 passed, 6 deselected) with no assimulo. GitHub Core tests pass on the PR head — but that is head-only; the merge result currently conflicts and has not been CI-tested.
• Linked issue: Closes #9 is appropriate — #9's acceptance criteria (documented bounds in DEPENDENCIES.md, grouped Dependabot, suite green under relaxed bounds) are met and the base is master, so it will auto-close. #10 (full solver interface / scipy fallback) remains open and is correctly not claimed.
• Merge-readiness: draft + author -> COMMENT only; this review does not satisfy branch-protection approval. Resolve the conflict and mark ready; if approval is required an eligible maintainer's APPROVE is needed (no gate currently reported).

I would not merge this until the blocking conflict above is resolved.

[bernalde]

Nonblocking: core dependencies are now declared in three places — requirements.txt, requirements-assimulo.txt, and pyproject.toml ([project.dependencies] + the assimulo extra). That is three lists to keep in sync, and bounds can silently drift. Consider making pyproject.toml the single source of truth and noting in DEPENDENCIES.md that requirements*.txt are convenience mirrors (or generate them from the project metadata).

[bernalde]

Addressed in 5d188f0: DEPENDENCIES.md now states that pyproject.toml is the install-metadata source of truth and that requirements.txt / requirements-assimulo.txt are convenience mirrors. I also verified the mirror lists match the project metadata.

[bernalde]

Nonblocking: assimulo==3.4.3 (exact pin) and cython>=0.29,<3 (capped) are intentionally constrained — per DEPENDENCIES.md, until the Assimulo job proves a broader stack — but there is no ignore here, so Dependabot will open PRs bumping assimulo (which cannot build without SUNDIALS) and raising the cython cap. Add an ignore block for assimulo (and cython major bumps), or group and document them, to avoid failing/no-op update PRs.

[bernalde]

Addressed in 5d188f0: .github/dependabot.yml now ignores assimulo updates and Cython major-version updates, and DEPENDENCIES.md documents why those solver-stack constraints stay in place.

[bernalde]

Addressed the review feedback on the current head 5d188f06e50b62b9a04bfe408eda897067ac2794.

Commits pushed:

• 5d188f0 - merge origin/master into the PR branch and resolve the dependency/CI conflicts.

Main changes:

• Resolved the merge-conflict-stale-base blocking finding by merging master, keeping setuptools>=77, the relaxed runtime bounds, the assimulo optional extra, and the editable pip install -e ".[test]" CI install.
• Documented pyproject.toml as the dependency source of truth and requirements*.txt as convenience mirrors in DEPENDENCIES.md.
• Added Dependabot ignores for assimulo and Cython major-version updates, with the policy documented next to the solver-stack bounds.

Verification:

• python -m pip install -e ".[test]" passed locally on Python 3.13.5 with numpy 2.5.0 / scipy 1.17.1.
• pytest --collect-only passed, collecting 8 tests.
• pytest tests/ -m "not assimulo" passed: 2 passed, 6 deselected.
• Dependency mirror check passed: pyproject.toml matches requirements.txt and the assimulo extra matches requirements-assimulo.txt.
• GitHub Actions Core tests passed for this head: https://github.com/SECQUOIA/PharmaPy/actions/runs/28602896298

Comments intentionally not addressed: none.

Remaining gates: the PR is still draft, and the author COMMENT review does not provide an eligible maintainer approval if branch protection later requires one. Current merge state is CLEAN and CI is green.