update python 3.13, mongo 7, urllib, requests, werkzeug across docker and project

.github/workflows/tests.yml

@@ -41,25 +41,26 @@ jobs:
     services:
       # Label used to access the service container
       mongodb:
-        image: mongo:5.0  # DockerHub
+        image: mongo:7.0  # DockerHub
         ports:
           - "27017:27017"
     strategy:
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.10", "3.11", "3.12"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
         allow-failure: [false]
         test-case: [test-unit-only, test-func-only]
         include:
           # experimental python
-          - os: ubuntu-latest
-            python-version: "3.13"
-            allow-failure: true
-            test-case: test-unit-only
-          - os: ubuntu-latest
-            python-version: "3.13"
-            allow-failure: true
-            test-case: test-func-only
+          # not yet ready due to pywps->fiona dependency missing (https://github.com/Toblerity/Fiona/issues/1504)
+          #- os: ubuntu-latest
+          #  python-version: "3.14"
+          #  allow-failure: true
+          #  test-case: test-unit-only
+          #- os: ubuntu-latest
+          #  python-version: "3.14"
+          #  allow-failure: true
+          #  test-case: test-func-only
           # linter tests
           # limitation with nested f-string quote styles changed in Python 3.12 (https://peps.python.org/pep-0701/)
           # forces us to pin Python 3.11 during linting checks in order to evaluate backward-compatible code styles

CHANGES.rst

@@ -12,7 +12,12 @@ Changes
 
 Changes:
 --------
-- No change.
+- Update docker with Python 3.13.
+- Add Python 3.13 to CI and project setup. Python 3.14 tentatively added to CI but unsupported from by dependencies.
+- Unpin `cwltool==3.1.20241217163858` to provide future Python 3.14 support and adjust ranges for last Python 3.9.
+- Pin ``pywps==4.7.0``.
+- Use Mongo v7 in CI and tests.
+- Update security dependencies for ``pip``, ``pyyaml``, ``requests``, ``urllib`` and ``werkzeug``.
 
 Fixes:
 ------

docker/Dockerfile-base

@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM python:3.13-slim
 LABEL description.short="Weaver Base"
 LABEL description.long="Workflow Execution Management Service (EMS); Application, Deployment and Execution Service (ADES)"
 LABEL maintainer="Francis Charette-Migneault <francis.charette-migneault@crim.ca>"

docker/docker-compose.yml.example

@@ -118,7 +118,7 @@ services:
     #    constraints: [node.role == manager]
 
   mongodb:
-    image: mongo:5.0
+    image: mongo:7.0
     container_name: mongodb
     volumes:
       - /data/mongodb_persist:/data/db

docs/source/conf.py

@@ -123,7 +123,7 @@ def doc_redirect_include(file_path):
     }
 }]
 # must use next version (2.x-alpha) because default 1.x does not support OpenAPIv3
-redoc_uri = "https://cdn.jsdelivr.net/npm/redoc@next/bundles/redoc.standalone.js"
+redoc_uri = "https://cdn.jsdelivr.net/npm/redoc@2.5.2/bundles/redoc.standalone.js"
 
 autoapi_type = "python"
 autoapi_dirs = [DOC_PKG_ROOT]

requirements-sys.txt

@@ -1,3 +1,3 @@
-pip>=22.0.4  # pyup: ignore
+pip>=25.3  # pyup: ignore
 setuptools>=78.1.1
 packaging>=22.0

requirements.txt

@@ -42,7 +42,8 @@ cryptography>=44.0.1
 # use cwltool gpu-enabled support until integrated within the original tool
 # (https://github.com/common-workflow-language/common-workflow-language/issues/587)
 ### git+https://github.com/crim-ca/cwltool@docker-gpu#egg=cwltool
-cwltool==3.1.20241217163858
+cwltool>=3.1.20241217163858,<3.2  # first version that provides CWLProv, required across all Python versions
+cwltool>=3.1.20250925164626; python_version >= "3.14"  # first version available
 # for some reason, not the same release number,
 # but same code as https://github.com/common-workflow-language/cwlprov/tree/0.6.0
 cwlprov==0.1.1
@@ -106,10 +107,10 @@ pystac_client
 python-box
 python-dateutil
 pytz
-pywps==4.6.0
-pyyaml>=5.2
+pywps==4.7.0
+pyyaml>=5.4
 rdflib>=5  # pyup: ignore
-requests>=2.32.4
+requests>=2.32.5
 requests_file
 # FIXME: https://github.com/requests/toolbelt/pull/380
 requests_toolbelt @ git+https://github.com/crim-ca/requests-toolbelt.git@patch-multipart
@@ -120,9 +121,9 @@ schema-salad>=8.3.20221209165047,<9
 shapely
 simplejson
 # urllib3 not directly required, pinned by Snyk to avoid CVE-2024-37891
-urllib3>=2.5.0
+urllib3>=2.6.0
 urlmatch
 xmltodict
 webob
-werkzeug>=3.0.3,<3.1
+werkzeug>=3.1.4
 zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability

setup.py

@@ -110,7 +110,6 @@ def _parse_requirements(file_path, requirements, links):
         "Operating System :: POSIX",
         "Programming Language :: Python",
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
         "Programming Language :: Python :: 3.12",