Update CI/dev tool dependencies.

.github/dependabot.yml

@@ -7,7 +7,7 @@ updates:
   - package-ecosystem: "pip"
     directory: "/requirements"
     schedule:
-      interval: "weekly"
+      interval: "quarterly"
     target-branch: "main"
     allow:
       - dependency-name: "scipp"

requirements/base.txt

@@ -9,30 +9,30 @@ asttokens==3.0.1
     # via stack-data
 comm==0.2.3
     # via ipywidgets
-contourpy==1.3.2
+contourpy==1.3.3
     # via matplotlib
 cycler==0.12.1
     # via matplotlib
 decorator==5.2.1
     # via ipython
 dill==0.3.5.1
     # via libpyvinyl
-exceptiongroup==1.3.1
-    # via ipython
 executing==2.2.1
     # via stack-data
 flexcache==0.3
     # via pint
 flexparser==0.4
     # via pint
-fonttools==4.61.1
+fonttools==4.62.1
     # via matplotlib
-h5py==3.15.1
+h5py==3.16.0
     # via
     #   -r base.in
     #   libpyvinyl
-ipython==8.38.0
+ipython==9.13.0
     # via ipywidgets
+ipython-pygments-lexers==1.1.1
+    # via ipython
 ipywidgets==8.1.8
     # via mcstasscript
 jedi==0.19.2
@@ -43,17 +43,17 @@ jsons==1.6.3
     # via libpyvinyl
 jupyterlab-widgets==3.0.16
     # via ipywidgets
-kiwisolver==1.4.9
+kiwisolver==1.5.0
     # via matplotlib
 libpyvinyl==1.3.0
     # via mcstasscript
-matplotlib==3.10.8
+matplotlib==3.10.9
     # via mcstasscript
 matplotlib-inline==0.2.1
     # via ipython
-mcstasscript==0.0.78
+mcstasscript==0.0.82
     # via -r base.in
-numpy==2.2.6
+numpy==2.4.4
     # via
     #   -r base.in
     #   contourpy
@@ -63,35 +63,39 @@ numpy==2.2.6
     #   mcstasscript
     #   scipp
     #   scipy
-packaging==26.0
+packaging==26.2
     # via matplotlib
-parso==0.8.5
+parso==0.8.6
     # via jedi
 pexpect==4.9.0
     # via ipython
-pillow==12.1.0
+pillow==12.2.0
     # via matplotlib
-pint==0.24.4
+pint==0.25.3
     # via libpyvinyl
-platformdirs==4.5.1
+platformdirs==4.9.6
     # via pint
 prompt-toolkit==3.0.52
     # via ipython
+psutil==7.2.2
+    # via ipython
 ptyprocess==0.7.0
     # via pexpect
 pure-eval==0.2.3
     # via stack-data
-pygments==2.19.2
-    # via ipython
+pygments==2.20.0
+    # via
+    #   ipython
+    #   ipython-pygments-lexers
 pyparsing==3.3.2
     # via matplotlib
 python-dateutil==2.9.0.post0
     # via matplotlib
 pyyaml==6.0.3
     # via mcstasscript
-scipp==25.5.1
+scipp==26.3.1
     # via -r base.in
-scipy==1.15.3
+scipy==1.17.1
     # via libpyvinyl
 six==1.17.0
     # via python-dateutil
@@ -104,14 +108,12 @@ traitlets==5.14.3
     #   matplotlib-inline
 typing-extensions==4.15.0
     # via
-    #   exceptiongroup
     #   flexcache
     #   flexparser
-    #   ipython
     #   pint
 typish==1.9.3
     # via jsons
-wcwidth==0.5.3
+wcwidth==0.6.0
     # via prompt-toolkit
 widgetsnbextension==4.0.15
     # via ipywidgets

requirements/basetest.txt

@@ -7,11 +7,11 @@
 #
 iniconfig==2.3.0
     # via pytest
-packaging==26.0
+packaging==26.2
     # via pytest
 pluggy==1.6.0
     # via pytest
-pygments==2.19.2
+pygments==2.20.0
     # via pytest
-pytest==9.0.2
+pytest==9.0.3
     # via -r basetest.in

requirements/ci.in

@@ -1,4 +1,4 @@
-gitpython
+gitpython>3.1.47 # command injection vulnerability patch
 packaging
 requests
 tox

requirements/ci.txt

@@ -1,52 +1,58 @@
-# SHA1:6344d52635ea11dca331a3bc6eb1833c4c64d585
+# SHA1:133d3824466495820a44bdb62b03323f9053363a
 #
 # This file was generated by pip-compile-multi.
 # To update, run:
 #
 #    requirements upgrade
 #
-cachetools==7.0.0
+cachetools==7.0.6
     # via tox
-certifi==2026.1.4
+certifi==2026.4.22
     # via requests
-chardet==5.2.0
-    # via tox
-charset-normalizer==3.4.4
+charset-normalizer==3.4.7
     # via requests
 colorama==0.4.6
     # via tox
 distlib==0.4.0
     # via virtualenv
-filelock==3.20.3
+filelock==3.29.0
     # via
+    #   python-discovery
     #   tox
     #   virtualenv
 gitdb==4.0.12
     # via gitpython
-gitpython==3.1.46
+gitpython==3.1.49
     # via -r ci.in
-idna==3.11
+idna==3.13
     # via requests
-packaging==26.0
+packaging==26.2
     # via
     #   -r ci.in
     #   pyproject-api
     #   tox
-platformdirs==4.5.1
+platformdirs==4.9.6
     # via
+    #   python-discovery
     #   tox
     #   virtualenv
 pluggy==1.6.0
     # via tox
 pyproject-api==1.10.0
     # via tox
-requests==2.32.5
+python-discovery==1.2.2
+    # via
+    #   tox
+    #   virtualenv
+requests==2.33.1
     # via -r ci.in
-smmap==5.0.2
+smmap==5.0.3
     # via gitdb
-tox==4.34.1
+tomli-w==1.2.0
+    # via tox
+tox==4.53.0
     # via -r ci.in
 urllib3==2.6.3
     # via requests
-virtualenv==20.36.1
+virtualenv==21.3.0
     # via tox

requirements/dev.txt

@@ -14,7 +14,7 @@
 -r wheels.txt
 annotated-types==0.7.0
     # via pydantic
-anyio==4.12.1
+anyio==4.13.0
     # via
     #   httpx
     #   jupyter-server
@@ -24,17 +24,17 @@ argon2-cffi-bindings==25.1.0
     # via argon2-cffi
 arrow==1.4.0
     # via isoduration
-async-lru==2.1.0
+async-lru==2.3.0
     # via jupyterlab
 cffi==2.0.0
     # via argon2-cffi-bindings
-click==8.3.1
+click==8.3.3
     # via
     #   pip-compile-multi
     #   pip-tools
-copier==9.11.3
+copier==9.14.3
     # via -r dev.in
-dunamai==1.25.0
+dunamai==1.26.1
     # via copier
 fqdn==1.5.1
     # via jsonschema
@@ -50,18 +50,18 @@ isoduration==20.11.0
     # via jsonschema
 jinja2-ansible-filters==1.3.2
     # via copier
-json5==0.13.0
+json5==0.14.0
     # via jupyterlab-server
-jsonpointer==3.0.0
+jsonpointer==3.1.1
     # via jsonschema
 jsonschema[format-nongpl]==4.26.0
     # via
     #   jupyter-events
     #   jupyterlab-server
     #   nbformat
-jupyter-events==0.12.0
+jupyter-events==0.12.1
     # via jupyter-server
-jupyter-lsp==2.3.0
+jupyter-lsp==2.3.1
     # via jupyterlab
 jupyter-server==2.17.0
     # via
@@ -71,31 +71,29 @@ jupyter-server==2.17.0
     #   notebook-shim
 jupyter-server-terminals==0.5.4
     # via jupyter-server
-jupyterlab==4.5.3
+jupyterlab==4.5.6
     # via -r dev.in
 jupyterlab-server==2.28.0
     # via jupyterlab
 lark==1.3.1
     # via rfc3987-syntax
 notebook-shim==0.2.4
     # via jupyterlab
-overrides==7.7.0
-    # via jupyter-server
-pip-compile-multi==3.2.2
+pip-compile-multi==3.3.1
     # via -r dev.in
-pip-tools==7.5.2
+pip-tools==7.5.3
     # via pip-compile-multi
 plumbum==1.10.0
     # via copier
-prometheus-client==0.24.1
+prometheus-client==0.25.0
     # via jupyter-server
 pycparser==3.0
     # via cffi
-pydantic==2.12.5
+pydantic==2.13.3
     # via copier
-pydantic-core==2.41.5
+pydantic-core==2.46.3
     # via pydantic
-python-json-logger==4.0.0
+python-json-logger==4.1.0
     # via jupyter-events
 questionary==2.1.1
     # via copier
@@ -119,15 +117,15 @@ toposort==1.10
     # via pip-compile-multi
 typing-inspection==0.4.2
     # via pydantic
-tzdata==2025.3
+tzdata==2026.2
     # via arrow
 uri-template==1.3.0
     # via jsonschema
 webcolors==25.10.0
     # via jsonschema
 websocket-client==1.9.0
     # via jupyter-server
-wheel==0.46.3
+wheel==0.47.0
     # via pip-tools
 
 # The following packages are considered to be unsafe in a requirements file:

requirements/docs.in

@@ -11,4 +11,4 @@ sphinx-design
 matplotlib
 plopp[all]
 pythreejs  # For instrument view.
-tornado>=6.5
+tornado>=6.5.5