build(deps): update available dependencies

[frankbuckley]

Note

Drafted by a LLM-based AI tool (Codex/GPT-6).

Update Python dependencies and contributor tools to the latest stable releases that satisfy the current compatibility requirements. Keep the interpreter pin at Python 3.14, Ruff's target at py314, and Node.js at 24.

Changes

Raise the declared minimum versions and regenerate uv.lock. The lockfile updates 23 packages, including these seven direct dependencies.

Package	Previous minimum	New minimum
NumPy	2.5.3	2.5.4
PyArrow	25.0.1	26.0.0
orjson	3.12.0	3.13.0
Polars	1.44.2	2.0.0
Ruff	0.16.10	0.17.0
SHAP	0.52.0	0.53.0
Zarr	3.4.0	3.4.1

Update SHAP in both boosting extras. Update pnpm from 12.10.1 to 12.11.2 and Prettier from 3.9.9 to 3.9.10, refresh their lockfile, and update the setup instructions. The npm lockfile also updates fast-equals and smol-toml.

Update actions/setup-node from v7.0.0 to v7.1.0 and astral-sh/setup-uv from v10.2.0 to v10.3.0. Advance the vendored design-token pin from tokens/2026.3.0 to tokens/2026.3.1; the released research colours have the same SHA-256 hash and bytes.

Compatibility

Retain Numba 0.67.0 because PyTensor 3.3.3 requires Numba <=0.67.0. That Numba version requires llvmlite <0.50 and NumPy <2.6. Retain cachetools 6.2.6 because PyMC 6.3.2 requires cachetools <7. These are the only installed Python packages for which the registry reports a newer stable version after the update. Cspell, the other CI actions, and the .NET 10 SDK pin are current.

Polars 2.0 changes the default lazy-query engine and removes deprecated APIs. SHAP 0.53 matches KernelExplainer DataFrame columns by name and rejects duplicate column names. This repository has no direct use of those APIs. Consuming projects must check their own code and saved-fit compatibility when they adopt these requirements.

Validation

• Install the updated environment with uv sync --locked on Python 3.14.8.
• Check uv lock --check and uv pip check.
• Run the full pytest suite on Windows x64 with a temporary folder outside the checkout: 1,210 passed, 15 skipped. The skips cover Windows-specific limits on filenames, wider floating-point types, permissions and symlinks.
• Run uv run --no-sync ruff check src/python and uv run --no-sync ruff format --check src/python.
• Build the source distribution and wheel with uv build --package dse-research-utils; inspect the wheel's requirements and design-token pin.
• Check nullable Arrow/Polars conversion, Parquet and Zarr round trips, JSON serialization, and SHAP explanation additivity.
• Run pnpm install --frozen-lockfile, pnpm run format:check, and pnpm run spellcheck --exclude '_temp/**' with Node.js 24.21.0 and pnpm 12.11.2. The exclusion skips only the local tool downloads and caches.