[policyengine]

Fixes #4100

Summary

Automated relock of uv.lock by .github/workflows/relock-dependencies.yml, which runs daily. Every locked package is upgraded to the newest version that pyproject.toml allows, except the PolicyEngine .py bundle and the packages its extras pin. CI on this pull request tests the relocked versions.

Each run rebuilds auto/relock-dependencies from master and replaces it, so commits pushed to this branch by hand are lost on the next run.

Version changes

• aiofiles: no longer locked (was 25.1.0)
• aiohappyeyeballs: 2.6.1 → 2.7.1
• aiohttp: 3.13.5 → 3.14.5
• alembic: 1.19.0 → 1.20.1
• altair: 6.1.0 → 6.3.0
• annotated-doc: 0.0.4 → 0.0.5
• annotated-types: 0.7.0 → 0.8.0
• anyio: 4.13.0 → 4.16.0
• assertpy: 1.1 → 2.36.0
• asttokens: 3.0.1 → 3.0.2
• blosc2: 4.1.2 → 4.14.1
• build: 1.4.4 → 1.6.1
• cachelib: 0.13.0 → 0.17.0
• cachetools: no longer locked (was 7.0.6)
• census: 0.8.26 → 0.8.27
• certifi: 2026.10.19 → 2026.10.23
• cffi: 2.0.0 → 2.1.1
• charset-normalizer: 3.4.7 → 3.5.2
• click: 8.3.3 → 8.5.0
• cloud-sql-python-connector: 1.20.2 → 1.23.0
• coverage: 6.5.0 → 7.17.2
• croniter: 6.2.2 → 6.2.4
• cryptography: 47.0.0 → 50.0.2
• decorator: 5.2.1 → 5.3.1
• distro: no longer locked (was 1.9.0)
• dnspython: 2.8.0 → 2.9.2
• executing: 2.2.1 → 2.3.0
• faiss-cpu: 1.13.2 → 1.15.1
• fastapi: 0.138.2 → 0.162.0
• filelock: 3.29.0 → 4.2.9
• flask-caching: 2.4.0 → 2.5.1
• fsspec: 2026.4.0 → 2026.9.0
• gitdb: no longer locked (was 4.0.12)
• gitpython: no longer locked (was 3.1.49)
• google-api-core: 2.30.3 → 2.44.0
• google-auth: 2.49.2 → 2.62.1
• google-cloud-appengine-logging: 1.9.0 → 1.11.0
• google-cloud-audit-log: 0.5.0 → 0.6.3
• google-cloud-bigquery: 3.46.2 → 3.47.0
• google-cloud-core: 2.5.1 → 2.8.0
• google-cloud-logging: 3.15.0 → 3.17.0
• google-cloud-secret-manager: 2.27.0 → 2.32.0
• google-cloud-sql: newly locked at 0.1.4
• googleapis-common-protos: 1.74.0 → 1.76.0
• greenlet: no longer locked (was 3.5.0)
• grpc-google-iam-v1: 0.14.4 → 0.14.6
• grpcio: 1.80.0 → 1.85.1
• grpcio-status: 1.80.0 → 1.85.1
• gunicorn: 25.3.0 → 26.2.0
• h2: newly locked at 4.4.1
• hf-xet: 1.4.3 → 1.8.0
• hpack: newly locked at 4.2.0
• httpcore2: newly locked at 2.16.0
• httptools: 0.7.1 → 0.9.0
• httpx2: newly locked at 2.16.0
• httpx2-jsfetch: newly locked at 1.0
• huggingface-hub: 1.12.2 → 1.33.0
• hyperframe: newly locked at 6.1.0
• idna: 3.13 → 3.20
• iniconfig: 2.3.0 → 2.3.1
• jedi: 0.19.2 → 0.20.1
• jellyfish: 1.2.1 → 1.3.0
• jiter: 0.14.0 → 0.18.0
• jsonpickle: 4.1.1 → 4.1.4
• librt: 0.15.0 → 0.16.0
• mako: 1.4.1 → 1.4.3
• markdown-it-py: 4.0.0 → 4.2.0
• markupsafe: 3.0.3 → 3.0.4
• matplotlib-inline: 0.2.1 → 0.2.2
• microdf-python: 1.3.0 → 1.3.10
• msgpack: 1.1.2 → 1.2.4
• multidict: 6.7.1 → 7.2.1
• mypy-extensions: 1.1.0 → 1.2.0
• narwhals: 2.20.0 → 2.28.0
• networkx: 3.6.1 → 3.6.1, 3.7
• numexpr: 2.14.1 → 2.14.2
• numpy: 2.4.4 → 2.4.6, 2.5.4
• openai: 2.33.0 → 3.46.0
• opentelemetry-api: 1.44.0 → 1.45.2
• opentelemetry-exporter-otlp-common: newly locked at 0.66b2
• opentelemetry-exporter-otlp-proto-common: 1.44.0 → 1.45.2
• opentelemetry-exporter-otlp-proto-grpc: 1.44.0 → 1.45.2
• opentelemetry-proto: 1.44.0 → 1.45.2
• opentelemetry-sdk: 1.44.0 → 1.45.2
• opentelemetry-semantic-conventions: 0.65b0 → 0.66b2
• packaging: 26.2 → 26.3
• pandas: 3.0.2 → 3.1.1
• parso: 0.8.6 → 0.8.7
• pillow: 12.2.0 → 13.0.0
• pluggy: 1.6.0 → 1.7.0
• policyengine-observability: 3.0.3 → 3.0.6
• prompt-toolkit: 3.0.52 → 3.0.53
• propcache: 0.4.1 → 0.5.4
• proto-plus: 1.27.2 → 1.29.0
• protobuf: 6.33.6 → 7.36.2
• psycopg: 3.3.4 → 3.3.8
• psycopg-binary: 3.3.4 → 3.3.8
• pure-eval: 0.2.3 → 0.2.4
• pyarrow: 24.0.0 → 26.0.1
• pyasn1: 0.6.3 → 0.6.5
• pycparser: 3.0 → 3.12
• pydantic: 2.13.3 → 2.14.3
• pydantic-core: 2.46.3 → 2.50.4
• pydeck: 0.9.2 → 0.9.3
• pygments: 2.20.0 → 2.21.0
• pymysql: 1.1.2 → 1.2.3
• pyopenssl: no longer locked (was 26.2.0)
• pyproject-hooks: 1.2.0 → 1.3.3
• pytest: 8.4.2 → 9.2.0
• python-dotenv: 1.2.2 → 1.2.4
• python-multipart: 0.0.27 → 0.0.33
• redis: 7.4.0 → 8.1.0
• requests: 2.33.1 → 2.34.2
• rpds-py: 0.30.0 → 2026.9.1
• rq: 2.8.0 → 3.0.0
• ruff: 0.15.12 → 0.17.4
• shellingham: no longer locked (was 1.5.4)
• smmap: no longer locked (was 5.0.3)
• sqlalchemy: 2.0.49 → 2.1.8
• sqlmodel: 0.0.39 → 0.0.48
• starlette: 1.0.0 → 1.10.0
• streamlit: 1.57.0 → 1.67.0
• tenacity: 9.1.4 → 9.2.1
• threadpoolctl: newly locked at 3.8.0
• toml: no longer locked (was 0.10.2)
• towncrier: 25.8.0 → 26.9.0
• tqdm: 4.67.3 → 4.70.1
• traitlets: 5.14.3 → 5.16.1
• truststore: newly locked at 0.10.5
• typer: no longer locked (was 0.25.0)
• typing-extensions: 4.15.0 → 4.16.0
• typing-inspection: 0.4.2 → 0.4.5
• tzdata: 2026.2 → 2026.6
• urllib3: 2.6.3 → 2.8.0
• us: 3.2.0 → 4.0.0
• uvicorn: 0.46.0 → 0.54.0
• uvloop: 0.22.1 → 0.23.0
• watchdog: 6.0.0 → 7.1.0
• watchfiles: 1.2.0 → 1.3.0
• wcwidth: 0.6.0 → 0.9.4
• websockets: 16.0 → 17.4
• werkzeug: 3.1.8 → 3.1.9
• wheel: 0.47.0 → 0.48.0
• yarl: 1.23.0 → 1.25.1

Held for the bundle update workflow

These packages change only through the PolicyEngine bundle update workflow (update-policyengine-bundle.yaml), whose pull requests check that the simulation API supports the bundle:

• policyengine 6.12.1
• policyengine-core 3.33.3
• policyengine-uk 2.151.0
• policyengine-us 2.2.1
• spm-calculator 1.0.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.71%. Comparing base (e4b3848) to head (16d5910).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4101      +/-   ##
==========================================
+ Coverage   92.14%   92.71%   +0.56%     
==========================================
  Files         297      297              
  Lines       16673    16673              
  Branches     2719     2719              
==========================================
+ Hits        15364    15458      +94     
  Misses        792      792              
+ Partials      517      423      -94     

Flag	Coverage Δ
integration	52.89% <ø> (+0.62%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.