[jan rathfelder (janrth)]

Summary

This PR drops Python 3.10 support and updates the locked dependencies, so that every open Dependabot alert on uv.lock is resolved. It mirrors Nixtla/mlforecast#812 and Nixtla/nixtla#929.

Pillow 13.0.0, the first patched Pillow release, requires Python 3.11. While 3.10 was supported, the lock kept Pillow 12.3.0 for 3.10, so the Pillow alerts could not close. Python 3.10 reached end of life in October 2026.

This is a user-facing change and should be called out in the next release notes.

Changes

Python 3.10 dropped

• pyproject.toml: requires-python = ">=3.11". The stale 3.9 and 3.10 classifiers are removed, and the missing 3.14 classifier is added, since CI already tests 3.14.
• pytest.yml: the test matrix is now 3.11–3.14 on Linux, macOS and Windows.
• build-docs.yaml and release.yml now use 3.11 instead of 3.10.
• CONTRIBUTING.md states the new minimum version.

Dependencies

Only the five alerted packages were upgraded in the lock (uv lock --upgrade-package ...). The other changes come from dropping the 3.10 lock fork: contourpy, distlib, numpy and scipy each collapse to a single version, and exceptiongroup is removed.

Package	Locked version	Alerts
pillow	12.3.0 → 13.0.0	79–87, 93–111, 115–125, 128, 129
virtualenv	21.7.13 → 21.14.13	89–92, 112–114, 126, 131–137
filelock	3.32.7 → 4.2.4	130, 138, 139
certifi	2026.1.4 → 2026.10.23	88
setuptools	83.0.0 → 84.2.1	127

Python 3.15 is not part of this PR

Adding Python 3.15 to CI was investigated and left out, because utilsforecast needs pandas 3 and polars 2 compatibility work first.

• The current lock does not install on 3.15. The locked scipy 1.17.0 has no 3.15 wheel and fails to build from source. The newest releases do install on 3.15: scipy 1.18, numba 0.68, pandas 3.1, polars 2.1 and dask 2026.8, with PyYAML building from source.
• pandas 2.x has no 3.15 wheels, so 3.15 means pandas 3. With pandas 3:
  • 36 fill_gaps tests fail on quarterly frequencies ('QS-FEB' == <QuarterBegin: startingMonth=11>).
  • 4 offset_times tests fail around daylight-saving changes.
  • A few concat and time-dtype checks also fail.
• polars 1.x is broken on 3.15, so 3.15 also means polars 2. On 3.15, polars 1.x datetime accessors return None. With the polars extra's current cap (<=1.31), the 3.15 run has 338 failures and 2 errors. With polars 2.1, the removed get_categories and other API changes cause the remaining polars failures. mlforecast's polars-on-3.15 failures partly come from this utilsforecast code.
• Python 3.15 itself breaks nothing. The latest stack on 3.15 gives 47 failures and 2,090 passes, and the identical 47 tests fail on Python 3.11 with the same pandas 3.1 and polars 2.1.

Suggested follow-up: make utilsforecast compatible with pandas 3 and polars 2, lift the polars<=1.31 cap, and then add 3.15 to the matrix.

These numbers were measured on Python 3.15.0rc2. CI would use 3.15.1.

Testing

• uv lock --check passes. All five alerted packages resolve at or above their patched versions.
• Full test suite on Python 3.11 with the new lock: 2,329 passed and 26 skipped. One Spark test (test_distributed_evaluate) failed only because Java is not installed locally. CI covers it.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T16:03:38.114739Z	4d8f406	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.