[policyengine]

Fixes #4100

Summary

Automated relock of uv.lock by .github/workflows/relock-dependencies.yml, which runs daily. Every locked package is upgraded to the newest version that pyproject.toml allows, except the PolicyEngine .py bundle and the packages its extras pin. CI on this pull request tests the relocked versions.

Each run rebuilds auto/relock-dependencies from master and replaces it, so commits pushed to this branch by hand are lost on the next run.

Version changes

• aiofiles: no longer locked (was 25.1.0)
• aiohappyeyeballs: 2.6.1 → 2.7.1
• aiohttp: 3.13.5 → 3.14.5
• alembic: 1.19.0 → 1.20.1
• altair: 6.1.0 → 6.3.0
• annotated-doc: 0.0.4 → 0.0.6
• annotated-types: 0.7.0 → 0.8.0
• anyio: 4.13.0 → 4.16.0
• assertpy: 1.1 → 2.36.0
• asttokens: 3.0.1 → 3.0.2
• blosc2: 4.1.2 → 4.15.0
• build: 1.4.4 → 1.6.1
• cachelib: 0.13.0 → 0.17.2
• cachetools: no longer locked (was 7.0.6)
• census: 0.8.26 → 0.8.27
• certifi: 2026.10.19 → 2026.10.23
• cffi: 2.0.0 → 2.1.1
• charset-normalizer: 3.4.7 → 3.5.2
• click: 8.3.3 → 8.5.1
• cloud-sql-python-connector: 1.20.2 → 1.24.0
• coverage: 6.5.0 → 7.17.2
• croniter: 6.2.2 → 7.0.0
• cryptography: 47.0.0 → 50.0.2
• decorator: 5.2.1 → 5.3.1
• distro: no longer locked (was 1.9.0)
• dnspython: 2.8.0 → 2.9.2
• executing: 2.2.1 → 2.3.0
• faiss-cpu: 1.13.2 → 1.16.0
• fastapi: 0.138.2 → 0.162.5
• filelock: 3.29.0 → 4.2.10
• flask-caching: 2.4.0 → 2.5.1
• fsspec: 2026.4.0 → 2026.9.0
• gitdb: no longer locked (was 4.0.12)
• gitpython: no longer locked (was 3.1.49)
• google-api-core: 2.30.3 → 2.44.0
• google-auth: 2.49.2 → 2.62.2
• google-cloud-appengine-logging: 1.9.0 → 1.11.0
• google-cloud-audit-log: 0.5.0 → 0.6.3
• google-cloud-bigquery: 3.46.2 → 3.47.0
• google-cloud-core: 2.5.1 → 2.8.0
• google-cloud-logging: 3.15.0 → 3.17.0
• google-cloud-secret-manager: 2.27.0 → 2.32.0
• google-cloud-sql: newly locked at 0.1.4
• googleapis-common-protos: 1.74.0 → 1.76.0
• greenlet: no longer locked (was 3.5.0)
• grimp: 3.18 → 3.19
• grpc-google-iam-v1: 0.14.4 → 0.14.6
• grpcio: 1.80.0 → 1.85.1
• grpcio-status: 1.80.0 → 1.85.1
• gunicorn: 25.3.0 → 27.0.0
• h2: newly locked at 4.4.1
• hf-xet: 1.4.3 → 1.8.0
• hpack: newly locked at 4.2.0
• httpcore2: newly locked at 2.16.0
• httptools: 0.7.1 → 0.9.0
• httpx2: newly locked at 2.16.0
• httpx2-jsfetch: newly locked at 1.0
• huggingface-hub: 1.12.2 → 1.33.0
• hyperframe: newly locked at 6.1.0
• idna: 3.13 → 3.20
• import-linter: 2.15 → 2.16
• iniconfig: 2.3.0 → 2.3.1
• jedi: 0.19.2 → 0.20.1
• jellyfish: 1.2.1 → 1.3.0
• jiter: 0.14.0 → 0.19.0
• jsonpickle: 4.1.1 → 4.1.4
• librt: 0.15.0 → 0.16.0
• mako: 1.4.1 → 1.4.3
• markdown-it-py: 4.0.0 → 4.3.0
• markupsafe: 3.0.3 → 3.0.4
• matplotlib-inline: 0.2.1 → 0.2.2
• microdf-python: 1.3.0 → 1.3.10
• msgpack: 1.1.2 → 1.2.4
• multidict: 6.7.1 → 7.2.1
• mypy-extensions: 1.1.0 → 1.2.0
• narwhals: 2.20.0 → 2.28.0
• networkx: 3.6.1 → 3.6.1, 3.7
• numexpr: 2.14.1 → 2.14.2
• numpy: 2.4.4 → 2.4.6, 2.5.4
• openai: 2.33.0 → 3.49.0
• opentelemetry-api: 1.44.0 → 1.45.2
• opentelemetry-exporter-otlp-common: newly locked at 0.66b2
• opentelemetry-exporter-otlp-proto-common: 1.44.0 → 1.45.2
• opentelemetry-exporter-otlp-proto-grpc: 1.44.0 → 1.45.2
• opentelemetry-proto: 1.44.0 → 1.45.2
• opentelemetry-sdk: 1.44.0 → 1.45.2
• opentelemetry-semantic-conventions: 0.65b0 → 0.66b2
• packaging: 26.2 → 26.3
• pandas: 3.0.2 → 3.1.1
• parso: 0.8.6 → 0.8.7
• pillow: 12.2.0 → 13.0.0
• pluggy: 1.6.0 → 1.7.0
• policyengine-observability: 3.0.3 → 3.0.7
• prompt-toolkit: 3.0.52 → 3.0.53
• propcache: 0.4.1 → 0.5.4
• proto-plus: 1.27.2 → 1.29.0
• protobuf: 6.33.6 → 7.36.2
• psycopg: 3.3.4 → 3.3.8
• psycopg-binary: 3.3.4 → 3.3.8
• pure-eval: 0.2.3 → 0.2.4
• pyarrow: 24.0.0 → 26.0.1
• pyasn1: 0.6.3 → 0.6.5
• pycparser: 3.0 → 3.12
• pydantic: 2.13.3 → 2.14.3
• pydantic-core: 2.46.3 → 2.50.4
• pydeck: 0.9.2 → 0.9.3
• pygments: 2.20.0 → 2.21.0
• pymysql: 1.1.2 → 1.2.4
• pyopenssl: no longer locked (was 26.2.0)
• pyproject-hooks: 1.2.0 → 1.3.3
• pytest: 8.4.2 → 9.2.0
• python-dotenv: 1.2.2 → 1.2.4
• python-multipart: 0.0.27 → 0.0.33
• redis: 7.4.0 → 8.1.0
• requests: 2.33.1 → 2.34.2
• rpds-py: 0.30.0 → 2026.9.1
• rq: 2.8.0 → 3.0.0
• ruff: 0.15.12 → 0.17.4
• shellingham: no longer locked (was 1.5.4)
• smmap: no longer locked (was 5.0.3)
• sqlalchemy: 2.0.49 → 2.1.8
• sqlmodel: 0.0.39 → 0.0.49
• starlette: 1.0.0 → 1.10.0
• streamlit: 1.57.0 → 1.67.0
• tenacity: 9.1.4 → 9.2.1
• threadpoolctl: newly locked at 3.8.0
• toml: no longer locked (was 0.10.2)
• towncrier: 25.8.0 → 26.9.0
• tqdm: 4.67.3 → 4.70.1
• traitlets: 5.14.3 → 5.16.1
• truststore: newly locked at 0.10.5
• typer: no longer locked (was 0.25.0)
• typing-extensions: 4.15.0 → 4.16.0
• typing-inspection: 0.4.2 → 0.4.5
• tzdata: 2026.2 → 2026.6
• urllib3: 2.6.3 → 2.8.0
• us: 3.2.0 → 4.0.0
• uvicorn: 0.46.0 → 0.54.0
• uvloop: 0.22.1 → 0.23.0
• watchdog: 6.0.0 → 7.1.0
• watchfiles: 1.2.0 → 1.3.0
• wcwidth: 0.6.0 → 0.9.4
• websockets: 16.0 → 17.4
• werkzeug: 3.1.8 → 3.1.9
• wheel: 0.47.0 → 0.48.0
• yarl: 1.23.0 → 1.25.1

Held for the bundle update workflow

These packages change only through the PolicyEngine bundle update workflow (update-policyengine-bundle.yaml), whose pull requests check that the simulation API supports the bundle:

• policyengine 6.17.1
• policyengine-core 3.33.3
• policyengine-uk 2.174.1
• policyengine-us 2.2.1
• spm-calculator 1.0.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.27%. Comparing base (cd513da) to head (eb361a1).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4101      +/-   ##
==========================================
+ Coverage   92.69%   93.27%   +0.58%     
==========================================
  Files         329      329              
  Lines       18783    18783              
  Branches     3114     3114              
==========================================
+ Hits        17410    17520     +110     
  Misses        818      818              
+ Partials      555      445     -110     

Flag	Coverage Δ
integration	54.40% <ø> (+0.63%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.