scverse · timtreis · Aug 7, 2026
diff --git a/.cruft.json b/.cruft.json
@@ -1,7 +1,7 @@
 {
   "template": "https://github.com/scverse/cookiecutter-scverse",
-  "commit": "6ff5b92b5d44ea6d8a88e47538475718d467db95",
-  "checkout": "v0.7.0",
+  "commit": "6518dfa1abde7379ea7255daf0ce09c23f2b4c94",
+  "checkout": "v0.8.0",
   "context": {
     "cookiecutter": {
       "project_name": "spatialdata-plot",
@@ -13,6 +13,7 @@
       "github_repo": "spatialdata-plot",
       "license": "BSD 3-Clause License",
       "ide_integration": false,
+      "issue_categorization": "",
       "_copy_without_render": [
         ".github/workflows/build.yaml",
         ".github/workflows/test.yaml",
@@ -36,7 +37,7 @@
         "trim_blocks": true
       },
       "_template": "https://github.com/scverse/cookiecutter-scverse",
-      "_commit": "6ff5b92b5d44ea6d8a88e47538475718d467db95"
+      "_commit": "6518dfa1abde7379ea7255daf0ce09c23f2b4c94"
     }
   },
   "directory": null

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -1,6 +1,6 @@
 name: Bug report
 description: Report something that is broken or incorrect
-type: Bug
+labels: bug
 body:
   - type: markdown
     attributes:
@@ -27,7 +27,7 @@ body:
         Which version of packages.
 
         Please install `session-info2`, run the following command in a notebook,
-        click the "Copy as Markdown" button, then paste the results into the text box below.
+        click the “Copy as Markdown” button, then paste the results into the text box below.
 
         ```python
         In[1]: import session_info2; session_info2.session_info(dependencies=True)
@@ -39,3 +39,55 @@ body:
         >>> import session_info2; print(session_info2.session_info(dependencies=True)._repr_mimebundle_()["text/markdown"])
         ```
       render: python
+      placeholder: |
+        anndata	0.11.3
+        ----	----
+        charset-normalizer	3.4.1
+        coverage	7.7.0
+        psutil	7.0.0
+        dask	2024.7.1
+        jaraco.context	5.3.0
+        numcodecs	0.15.1
+        jaraco.functools	4.0.1
+        Jinja2	3.1.6
+        sphinxcontrib-jsmath	1.0.1
+        sphinxcontrib-htmlhelp	2.1.0
+        toolz	1.0.0
+        session-info2	0.1.2
+        PyYAML	6.0.2
+        llvmlite	0.44.0
+        scipy	1.15.2
+        pandas	2.2.3
+        sphinxcontrib-devhelp	2.0.0
+        h5py	3.13.0
+        tblib	3.0.0
+        setuptools-scm	8.2.0
+        more-itertools	10.3.0
+        msgpack	1.1.0
+        sparse	0.15.5
+        wrapt	1.17.2
+        jaraco.collections	5.1.0
+        numba	0.61.0
+        pyarrow	19.0.1
+        pytz	2025.1
+        MarkupSafe	3.0.2
+        crc32c	2.7.1
+        sphinxcontrib-qthelp	2.0.0
+        sphinxcontrib-serializinghtml	2.0.0
+        zarr	2.18.4
+        asciitree	0.3.3
+        six	1.17.0
+        sphinxcontrib-applehelp	2.0.0
+        numpy	2.1.3
+        cloudpickle	3.1.1
+        sphinxcontrib-bibtex	2.6.3
+        natsort	8.4.0
+        jaraco.text	3.12.1
+        setuptools	76.1.0
+        Deprecated	1.2.18
+        packaging	24.2
+        python-dateutil	2.9.0.post0
+        ----	----
+        Python	3.13.2 | packaged by conda-forge | (main, Feb 17 2025, 14:10:22) [GCC 13.3.0]
+        OS	Linux-6.11.0-109019-tuxedo-x86_64-with-glibc2.39
+        Updated	2025-03-18 15:47
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -2,4 +2,4 @@ blank_issues_enabled: false
 contact_links:
   - name: Scverse Community Forum
     url: https://discourse.scverse.org/
-    about: If you have questions about "How to do X", please ask them here.
+    about: If you have questions about “How to do X”, please ask them here.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -10,16 +10,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   package:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           filter: blob:none
           fetch-depth: 0
+          persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - name: Build package
         run: uv build
       - name: Check package
@@ -28,14 +32,15 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: true
           fetch-depth: 0
+          persist-credentials: false
       - name: Pull latest notebooks
         # Match RTD: render whatever is on notebooks-repo main, not the pinned SHA.
         run: git submodule update --init --remote --recursive
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - name: Build docs
-        run: uvx --with="virtualenv<21" hatch run docs:build
+        run: uvx hatch run docs:build
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -4,43 +4,30 @@ on:
   release:
     types: [published]
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+# Use "trusted publishing", see https://docs.pypi.org/trusted-publishers/
+permissions: {}
 
 jobs:
-  build:
+  release:
+    name: Upload release to PyPI
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/spatialdata_plot
+    permissions:
+      contents: read
+      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           filter: blob:none
           fetch-depth: 0
+          persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: false
       - name: Build package
         run: uv build
-      - name: Check package
-        run: uvx twine check --strict dist/*
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist
-          path: dist/
-
-  publish:
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write # for PyPI trusted publishing
-    environment:
-      name: pypi
-      url: https://pypi.org/p/spatialdata-plot
-    steps:
-      - name: Download build artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: dist
-          path: dist/
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -3,7 +3,6 @@ name: Test
 on:
   push:
     branches: [main]
-    tags: ["v*"]
   pull_request:
     branches: [main]
   schedule:
@@ -13,23 +12,27 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  MPLBACKEND: agg
+permissions:
+  contents: read
 
 jobs:
-  # Dynamically extract the test matrix from hatch so pyproject.toml is the single source of truth.
-  # See [[tool.hatch.envs.hatch-test.matrix]] in pyproject.toml.
+  # Get the test environment from hatch as defined in pyproject.toml.
+  # This ensures that the pyproject.toml is the single point of truth for test definitions and the same tests are
+  # run locally and on continuous integration.
+  # Check [[tool.hatch.envs.hatch-test.matrix]] in pyproject.toml and https://hatch.pypa.io/latest/environment/ for
+  # more details.
   get-environments:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     outputs:
       envs: ${{ steps.get-envs.outputs.envs }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           filter: blob:none
           fetch-depth: 0
+          persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - name: Get test environments
         id: get-envs
         run: |
@@ -44,10 +47,12 @@ jobs:
               )')
           echo "envs=${ENVS_JSON}" | tee $GITHUB_OUTPUT
 
+  # Run tests through hatch. Spawns a separate runner for each environment defined in the hatch matrix obtained above.
   test:
     needs: get-environments
     permissions:
       id-token: write # for codecov OIDC
+      contents: read
 
     strategy:
       fail-fast: false
@@ -57,23 +62,27 @@ jobs:
 
     name: ${{ matrix.env.label }}
     runs-on: ${{ matrix.os }}
-    continue-on-error: ${{ contains(matrix.env.name, 'pre') }}
+    continue-on-error: ${{ contains(matrix.env.name, 'pre') }} # make "all-green" pass even if pre-release job fails
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           filter: blob:none
           fetch-depth: 0
+          persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           python-version: ${{ matrix.env.python }}
       - name: Ensure figure directory exists
         run: mkdir -p tests/figures
       - name: Create hatch environment
         run: uvx hatch env create ${{ matrix.env.name }}
+      - name: List all installed package versions
+        run: uvx hatch run ${{ matrix.env.name }}:uv pip list
       - name: Run tests
         env:
+          MPLBACKEND: agg
           DISPLAY: ":42"
         run: >-
           uvx hatch run ${{ matrix.env.name }}:${{
@@ -88,19 +97,19 @@ jobs:
           uvx hatch run ${{ matrix.env.name }}:cov-report
       - name: Archive visual test figures
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: visual_test_results_${{ matrix.env.name }}
           path: tests/figures/*
       - name: Upload coverage
         if: matrix.env.name == 'hatch-test.py3.14-stable'
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           fail_ci_if_error: true
           use_oidc: true
 
-  # Single required check for branch protection.
-  # See https://github.com/re-actors/alls-green#why
+  # Check that all tests defined above pass. This makes it easy to set a single "required" test in branch
+  # protection instead of having to update it frequently. See https://github.com/re-actors/alls-green#why.
   check:
     name: Tests pass in all hatch environments
     if: always()
@@ -109,6 +118,6 @@ jobs:
       - test
     runs-on: ubuntu-latest
     steps:
-      - uses: re-actors/alls-green@release/v1
+      - uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
         with:
           jobs: ${{ toJSON(needs) }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -7,16 +7,16 @@ default_stages:
 minimum_pre_commit_version: 2.16.0
 repos:
   - repo: https://github.com/biomejs/pre-commit
-    rev: v2.4.14
+    rev: v2.5.3
     hooks:
       - id: biome-format
-        exclude: ^\.cruft\.json$ # inconsistent indentation with cruft
+        exclude: ^\.cruft\.json$ # inconsistent indentation with cruft - file never to be modified manually.
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: v2.21.1
+    rev: v2.25.3
     hooks:
       - id: pyproject-fmt
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.12
+    rev: v0.15.21
     hooks:
       - id: ruff-check
         types_or: [python, pyi, jupyter]
@@ -33,8 +33,16 @@ repos:
         args: [--fix=lf]
       - id: trailing-whitespace
       - id: check-case-conflict
+      # Check that there are no merge conflicts (could be generated by template sync)
       - id: check-merge-conflict
         args: [--assume-in-merge]
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.24.1
+    hooks:
+      - id: zizmor
+        args: [--no-progress, --fix]
+
   - repo: https://github.com/pre-commit/mirrors-mypy
     rev: v1.20.2
     hooks: