[PatrickHenkel1]

physXAI 0.3.0. It supports Python 3.11–3.13 and closes the 76 open Dependabot alerts on main (2 critical, 47 high, 24 moderate, 3 low).

Why a minor release

Python 3.9 is no longer available on the GitHub runners (The version '3.9' with architecture 'x64' was not found for Ubuntu 26.04), so every PR on main failed. Python 3.9 has been end of life since 2025-10 and 3.10 since 2026-10. The patched keras 3.15 also requires Python 3.11.

Python 3.11 stays supported (end of life 2027-10), the same range as physXAI 1.0.

Python 3.14 is not possible yet. The only TensorFlow with cp314 wheels is the release candidate 2.22.0rc0, which depends on keras-nightly. Python 3.14 can be added once TensorFlow 2.22 is final.

Changes

• Python 3.11–3.13: requires-python = ">=3.11", the classifiers, and the matrices of pytest_coverage.yml, verify_installation.yml and verify_executables.yml. copilot-instructions.md is updated too.

• pyproject.toml: keras>=3.15.0 (older versions have known vulnerabilities when loading .keras models) and GitPython>=3.2.1.

• requirements.txt: regenerated from a fresh install of this branch, the way the CI installs it. tensorflow 2.21.0 supports Python 3.13; 2.19 did not. numpy and scipy are pinned per Python version, because numpy 2.5 and scipy 1.18 require Python 3.12:

  • Python 3.11: numpy 2.4.6, scipy 1.17.1
  • Python ≥ 3.12: numpy 2.5.4, scipy 1.18.1

  Every version is at or above the first patched release of all advisories: GitPython 3.2.1, keras 3.15.1, urllib3 2.8.0, protobuf 7.36.2, requests 2.34.2, certifi 2026.10.23, idna 3.20, Pygments 2.21.0, setuptools 84.2.1, wheel 0.48.0. tensorboard, and with it Werkzeug and Markdown, is no longer a dependency of tensorflow 2.21.

Verification

• Fresh venv (Windows, Python 3.12): pip install . and pip check are clean. pytest unittests: 12 passed. unittests/verify_installation.py: OK.
• requirements.txt resolves for Python 3.11, 3.12 and 3.13 on Windows and Linux (uv pip compile --python-version … --python-platform …; pip cannot evaluate the markers of another Python version).
• Python 3.11 and 3.13 were not run locally; the CI of this PR covers them.

After the merge

Create the tag v0.3.0 on the merge commit. The version comes from the tag (setuptools-scm).

Relation to 1.0.0

The merge of refactoring_v1.0.0 into main will conflict in two places:

• requirements.txt: 1.0 deletes the file. Keep the deletion; 1.0 has constraints.txt.
• pyproject.toml and the workflows: take the 1.0 version.

PR #84 fixes the same numpy/scipy issue for Python 3.11 in the constraints.txt of 1.0.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.