1.4.0

Release notes for pkpdutils 1.4.0

Minor release of pkpdutils which makes the analysis stricter about its input, consistent in its units and bounded in its memory (#115, #116), guards the terminal regression of simulated profiles against the noise of the integrator (#117), and updates the dependencies, among them the security fixes of Pillow, filelock and virtualenv. Analyses which were valid before give the same results; input which was silently ignored or misread before now raises.

Breaking changes

• Unknown analysis options, malformed numeric cells, invalid additional-dose counts and invalid model bounds or fixed values now raise instead of being ignored or silently changing the calculation. Exchange readers continue to accept blank cells and . as missing values; ADNCA rejects inconsistent row units (#115).
• Sparse multi-column sample identifiers retain observed combinations along _sample by default. Use sample_layout="dense" to request the Cartesian layout explicitly (#115).
• acceptability_table returns None when no finite ratio can be evaluated. study_report derives methods from the settings saved with the result, rejects conflicting options, and requires explicit options for older results without that record (#115).
• Dose and curve models reject unknown fields and nonfinite dosing inputs. Normalization rejects zero doses and nonfinite references. PKNCA result imports retain missing profiles and reject ambiguous duplicates unless first-value selection is explicitly requested (#116).

Non-compartmental analysis

• NCAOptions.lloq_relative provides a per-curve cutoff for simulated concentrations, combined with the absolute limit through the existing BLQ rules. Terminal fits below 1e-8 * Cmax now carry TERMINAL_LOW_CONCENTRATION and log a warning without changing estimates; TerminalPhase.relative_warning configures or disables the diagnostic. The documentation explains BEST_FIT versus ALL_AFTER_TMAX for ICG-PDR workflows (#110, #117).
• Named partial AUCs use the same BLQ rules as the main analysis and include bootstrap or delta uncertainty. Terminal regression remains stable for large time offsets and small elimination rates (#115).
• Delta uncertainty uses representable finite-difference steps and stable norm accumulation, avoiding spurious zero or missing errors at extreme scales. Log-normal bootstrap and statistics avoid unnecessary overflow, and trapezoid areas retain finite results when the concentration sum overflows (#116).
• Fitting converts explicit uncertainty units before weighting, reports dimensional RMSE, residuals and optimization costs, shares float64 input views, and rejects custom model names that overwrite diagnostics (#116).
• Confidence levels are validated consistently. Meta-analysis scales inverse-variance weights to preserve finite results for very small variances (#116).

Reliability and resource use

• Statistical comparisons, ratios, bioequivalence and effect sizes convert compatible sample units and reject incompatible units, including summary data. Benjamini-Hochberg adjustment preserves missing p-values without discarding valid results (#115).
• Bootstrap reduces each block before processing the next; delta uncertainty generates bounded perturbation blocks instead of quadratic input arrays. Ragged means aggregate directly over observed times, permutation tests use configurable batches, and large Hodges-Lehmann estimates select exact order statistics with linear memory (#115).
• Dose expansion is bounded by max_expanded_doses (default 1,000,000). Analyses lease worker pools so idle caches stay bounded without interrupting concurrent work, and fitting shares common input arrays through broadcast views (#115).
• Markdown reports escape data fields and raw HTML. The benchmark script includes irregular times, sparse identifiers, long uncertainty curves and changing worker counts, and reports first-call as well as warmed timing (#115).
• Sampling times, subject counts and uncertainty spreads are validated consistently across input paths. Mixed batches preserve available uncertainty with missing values for curves that lack it. Means drop conflicting dosing metadata instead of attaching the first subject's protocol (#116).
• Event readers validate EVID, MDV and SS flags with row and subject context. An EVID 1 row is dose-only even when DV is present; a simultaneous observation needs its own EVID 0 row (#116).
• Report writers stream table rows instead of holding formatted copies of the entire document. Mann-Whitney null counts use exact integer intermediates, and Hodges-Lehmann averages and medians avoid unnecessary overflow for large finite values (#116).

Dependencies and security

• pillow>=13.0.0 is a dependency of its own (#124): Pillow reaches every user through matplotlib, and 13.0.0 fixes the advisories of the versions before it, among them the critical GHSA-332p-7hrc-92wf, GHSA-8g5g-8vmr-9782, GHSA-v9pv-5gc8-w2m6, GHSA-w889-685w-c8fh and GHSA-5x8w-8jj5-q52h.
• The lock of the development environment moves to filelock 4.2.6 (#119, #124; GHSA-v4x8-3wr5-3wq8 and further advisories of 4.1.0) and virtualenv 21.15.2 (GHSA-vxj4-q4g9-crj7, GHSA-394h-qwmc-48pf, GHSA-6w3r-xr62-4xcp, GHSA-c978-59m8-c77v and further advisories of 21.14.6), which only the development tools use.
• The lock moves to the newest releases of the dependencies and the development tools (#121, #124), among them numpy 2.5.4, pandas 3.1.0, pint 0.26.2, pydantic 2.14.2 and scipy 1.18.1; tox 4.67.5 is excluded from the dev extra, it refuses its package staging directory when it was created under umask 002 (tox-dev/tox#4357). Continuous integration moves to astral-sh/setup-uv 10.3.3 (#108, #120).
• The fit result sets its flag type without narrowing the class variable of its base, which ty 0.0.95 reports as an invalid override (#122).

Development

• uv.lock is committed: the local environment, the documentation build and the ruff version of continuous integration resolve from it, and dependabot keeps it current with a grouped pull request (#111).
• Continuous integration runs python 3.14 on linux, macos and windows, python 3.13 and 3.15 are tested locally with tox run-parallel; every workflow cancels a superseded run, and dependabot proposes its updates monthly (#114).
• The version bump keeps the cff-version of CITATION.cff, and the issue templates point to pkpdutils (#113).

Documentation

• The sections of the documentation are reorganized (#107).
• The release notes of 1.3.0 again describe 1.3.0 only; the changes since, which had been added to them, are listed here.