Fix CI: remove nbqa hooks, migrate to Python 3.11 + uv, update vulnerable dependencies

.github/workflows/code_checks.yml

@@ -7,9 +7,8 @@ on:
     paths:
       - .pre-commit-config.yaml
       - .github/workflows/code_checks.yml
-      - .github/workflows/integration_tests.yml
       - '**.py'
-      - poetry.lock
+      - uv.lock
       - pyproject.toml
       - '**.ipynb'
   pull_request:
@@ -19,7 +18,7 @@ on:
       - .pre-commit-config.yaml
       - .github/workflows/code_checks.yml
       - '**.py'
-      - poetry.lock
+      - uv.lock
       - pyproject.toml
       - '**.ipynb'
 
@@ -28,24 +27,47 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4.2.2
-      - name: Install and configure Poetry
-        uses: snok/install-poetry@v1
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.3.2
         with:
-          virtualenvs-create: true
-          virtualenvs-in-project: true
-      - uses: actions/setup-python@v5.5.0
-        with:
-          python-version: '3.10'
-          cache: 'poetry'
+          enable-cache: true
+          python-version: '3.11'
       - name: Install dependencies and check code
         run: |
-          poetry env use '3.10'
+          uv sync --no-default-groups --group test --all-extras
           source .venv/bin/activate
-          poetry install --with test --all-extras
           pre-commit run --all-files
       - name: pip-audit (gh-action-pip-audit)
         uses: pypa/gh-action-pip-audit@v1.1.0
         with:
           virtual-environment: .venv/
+          # The ignored vulnerabilities below cannot be fixed while alibi and
+          # alibi-detect cap pillow (<11) and transformers (<5), cycquery
+          # caps pyarrow (<18), and pybtex needs pkg_resources (removed in
+          # setuptools 81+). Revisit when those libraries relax their
+          # constraints.
           ignore-vulns: |
             GHSA-pg7h-5qx3-wjr3
+            PYSEC-2026-3447
+            PYSEC-2026-165
+            PYSEC-2026-2249
+            PYSEC-2026-2250
+            PYSEC-2026-2252
+            PYSEC-2026-2253
+            PYSEC-2026-2254
+            PYSEC-2026-2255
+            PYSEC-2026-2256
+            PYSEC-2026-2257
+            PYSEC-2026-2874
+            PYSEC-2026-3451
+            PYSEC-2026-3453
+            PYSEC-2026-3454
+            PYSEC-2026-3493
+            PYSEC-2026-3494
+            PYSEC-2026-3495
+            PYSEC-2026-3496
+            PYSEC-2026-113
+            PYSEC-2025-217
+            PYSEC-2026-2288
+            PYSEC-2026-2289
+            PYSEC-2026-2290

.github/workflows/docker.yml

@@ -25,6 +25,7 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Log in to Docker Hub
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -41,6 +42,6 @@ jobs:
         with:
           context: .
           file: ./Dockerfile
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/docs.yml

@@ -14,22 +14,18 @@ jobs:
           submodules: 'true'
           fetch-depth: 0
 
-      - name: Install poetry
-        run: python3 -m pip install --upgrade pip && python3 -m pip install poetry
-
-      - uses: actions/setup-python@v5.5.0
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.3.2
         with:
-          python-version: '3.10'
-          cache: 'poetry'
+          enable-cache: true
+          python-version: '3.11'
 
       - name: Install dependencies
-        run: |
-          poetry env use '3.10'
-          poetry install --with docs,test --all-extras
+        run: uv sync --no-default-groups --group docs --group test --all-extras
 
       - name: Build docs
         run: |
-          source $(poetry env info --path)/bin/activate
+          source .venv/bin/activate
           cd docs
           rm -rf source/reference/api/_autosummary
           if [[ "${{ github.event_name == 'pull_request' && github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release') }}" == "true" ]]; then

.github/workflows/package.yml

@@ -8,7 +8,7 @@ on:
       - .pre-commit-config.yaml
       - .github/workflows/package.yml
       - '**.py'
-      - poetry.lock
+      - uv.lock
       - pyproject.toml
       - '**.ipynb'
   pull_request:
@@ -18,7 +18,7 @@ on:
       - .pre-commit-config.yaml
       - .github/workflows/package.yml
       - '**.py'
-      - poetry.lock
+      - uv.lock
       - pyproject.toml
       - '**.ipynb'
 
@@ -31,7 +31,7 @@ jobs:
         run: python3 -m pip install --upgrade pip
       - uses: actions/setup-python@v5.5.0
         with:
-          python-version: '3.10'
+          python-version: '3.11'
       - name: Install package and test import
         run: |
           pip install -e .

.github/workflows/publish.yml

@@ -13,13 +13,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install libcurl4-openssl-dev libssl-dev
       - uses: actions/checkout@v4.2.2
-      - name: Install poetry
-        run: python3 -m pip install --upgrade pip && python3 -m pip install poetry
-      - uses: actions/setup-python@v5.5.0
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.3.2
         with:
-          python-version: '3.10'
+          python-version: '3.11'
       - name: Build package
-        run: poetry build
+        run: uv build
       - name: Publish package
         uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc
         with:

.github/workflows/unit_tests.yml

@@ -6,43 +6,38 @@ on:
       - main
     paths:
       - .github/workflows/unit_tests.yml
-      - .github/workflows/integration_tests.yml
       - '**.py'
       - '**.html'
       - '**.jinja'
       - '**.js'
-      - poetry.lock
+      - uv.lock
       - pyproject.toml
   pull_request:
     branches:
       - main
     paths:
       - .github/workflows/unit_tests.yml
-      - .github/workflows/integration_tests.yml
       - '**.py'
       - '**.html'
       - '**.jinja'
       - '**.js'
-      - poetry.lock
+      - uv.lock
       - pyproject.toml
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4.2.2
-      - name: Install dependencies, run unit tests and coverage report
-        run: python3 -m pip install --upgrade pip && python3 -m pip install poetry
-      - uses: actions/setup-python@v5.5.0
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.3.2
         with:
-          python-version: '3.10'
-          cache: 'poetry'
-      - run: |
-          python3 -m pip install --upgrade pip && python3 -m pip install poetry
-          poetry env use '3.10'
-          source $(poetry env info --path)/bin/activate
-          poetry install --with test --all-extras
-          pytest -m "not integration_test" --cov-report term --cov-report xml:./coverage.xml --cov=cyclops -n auto --dist loadscope
+          enable-cache: true
+          python-version: '3.11'
+      - name: Install dependencies, run unit tests and coverage report
+        run: |
+          uv sync --no-default-groups --group test --all-extras
+          uv run --no-sync pytest -m "not integration_test" --cov-report term --cov-report xml:./coverage.xml --cov=cyclops -n auto --dist loadscope
       - name: Upload coverage to Codecov
         uses: Wandalen/wretry.action@v3.8.0
         with:

.gitignore

@@ -31,3 +31,4 @@ _autosummary
 *dummy_reports*
 .mypy_cache
 *code-workspace*
+.venv/

.pre-commit-config.yaml

@@ -40,13 +40,6 @@ repos:
       language: system
       entry: python3 -m nbstripout
 
-  - repo: https://github.com/nbQA-dev/nbQA
-    rev: 1.9.1
-    hooks:
-    - id: nbqa-black
-    - id: nbqa-ruff
-      args: [--fix, --exit-non-zero-on-fix]
-
   - repo: local
     hooks:
     - id: doctest

Dockerfile

@@ -1,20 +1,16 @@
-FROM python:3.9.7
-
+FROM python:3.11
 
 WORKDIR /app/cyclops
 ARG DEBIAN_FRONTEND=noninteractive
-ENV LANG C.UTF-8
-
+ENV LANG=C.UTF-8
 
 RUN apt-get update \
-    && apt-get install -y git software-properties-common \
+    && apt-get install -y git \
     && rm -rf /var/lib/apt/lists/*
 
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
-RUN python3 -m pip install --upgrade pip
-RUN pip install poetry
-
+COPY . /app/cyclops/
+RUN uv sync --frozen --no-default-groups --group test --group docs
 
-COPY * /app/cyclops/
-RUN poetry config virtualenvs.create false \
-   && poetry install --no-interaction --no-ansi --with test,docs
+ENV PATH="/app/cyclops/.venv/bin:$PATH"

README.md

@@ -53,29 +53,29 @@ below.
 
 ## 🧑🏿‍💻 Developing
 
-### Using poetry
+### Using uv
 
 The development environment can be set up using
-[poetry](https://python-poetry.org/docs/#installation). Hence, make sure it is
+[uv](https://docs.astral.sh/uv/getting-started/installation/). Hence, make sure it is
 installed and then run:
 
 ```bash
-python3 -m poetry install
-source $(poetry env info --path)/bin/activate
+uv sync
+source .venv/bin/activate
 ```
 
 In order to install dependencies for testing (codestyle, unit tests, integration tests),
 run:
 
 ```bash
-python3 -m poetry install --with test
+uv sync --group test
 ```
 
 API documentation is built using [Sphinx](https://www.sphinx-doc.org/en/master/) and
 can be locally built by:
 
 ```bash
-python3 -m poetry install --with docs
+uv sync --group docs
 cd docs
 make html SPHINXOPTS="-D nbsphinx_allow_errors=True"
 ```
@@ -89,7 +89,7 @@ guidelines.
 
 ## 📚 [Documentation](https://vectorinstitute.github.io/cyclops/)
 
-If you need to build the documentations locally, make sure to install ``Pandoc`` in addition to ``docs`` poetry group.
+If you need to build the documentations locally, make sure to install ``Pandoc`` in addition to ``docs`` dependency group.
 
 
 ## 📓 Notebooks

cyclops/data/aggregate.py

@@ -761,4 +761,4 @@ def timestamp_ffill_agg(
     if fill_nan is not None:
         arr = np.nan_to_num(arr, nan=fill_nan)
 
-    return arr
+    return np.asarray(arr)

cyclops/data/utils.py

@@ -13,7 +13,7 @@
 )
 
 import pandas as pd
-import PIL
+import PIL.Image
 import psutil
 from datasets import Dataset, DatasetDict
 from datasets.features import (