views-datafactory 1.12.0

The Python floor drops to 3.11. src/ is untouched — the wheel is byte-identical to v1.11.0 apart from metadata — but the metadata is the point.

Why

views-datafactory was the only repo on the platform above 3.11. The views-models conda environments run 3.11.14 / 3.11.15, so pip install views-datafactory failed in all four and 28 requirements files could not use the package at all.

The floor was never chosen. ADR-030 set >=3.12 in May because "tifffile's current releases require it" — a fact about a vendor at a moment, not an architectural need. 3.11 was never considered; the string does not appear in that ADR. Nothing in this codebase requires 3.12, verified by running the suite, ruff, mypy and compileall at 3.11.13 before deciding.

ADR-030 is amended, not superseded — the tooling decision (tifffile now, Rust long-term) was never in question.

The cost, which is permanent

uv.lock now forks. Under 3.11 the raster stack resolves tifffile 2026.3.3 / imagecodecs 2026.3.6; under >=3.12 it stays 2026.5.15 / 2026.5.10. Both upstreams dropped 3.11 deliberately — tifffile adopted PEP 695 syntax, imagecodecs ships cp312-abi3 wheels only — so a 3.11 consumer is pinned to the March-2026 raster line for good.

The required CI check runs the floor and therefore exercises the older decoder than the server does. A non-required test-py313 job covers the production line (C-347).

What it exposed rather than caused

imagecodecs decodes every GHS-POP and GHS-BUILT-S GeoTIFF — all LZW — is imported by nothing under src/, and until this release no test in this repository had ever written a compressed TIFF. An import-graph audit would have called the dependency removable, and removing it would have broken every production raster read while leaving the suite green. Now covered.

Also in this release

• C-331 — the heartbeat URL moves off the curl command line onto stdin. It is a capability URL and /proc/<pid>/cmdline is world-readable.
• C-343 — refresh_pipeline.sh's header no longer claims that deploying is one step. It is three, and believing otherwise left the server on v1.10.0 for five days while the tag file said v1.11.0.
• C-351 — serving-freshness.yml had failed every run since 2026-08-03; gh could not infer the repository in a job with no checkout.
• Deploy gates now run in CI rather than only where someone typed pytest; a version gate that could not fail was deleted; the dependency-floor guard now sees every fork in a multi-version lock.

Upgrading

pip install --upgrade views-datafactory   # now installs on Python 3.11

Operators: this release changes scripts/refresh_pipeline.sh (46 lines). A redeploy needs all three steps in server_quickref.md — the tag file, the git fetch/checkout, and uv sync. The tag file alone is not a deploy.