[maltekuehl]

This PR fixes the scverse repo-health checks that are still failing after #99 (template v0.8.0) and #104. Those two already pinned the actions, added top-level workflow permissions: and persist-credentials: false, and made the zizmor audit come back clean.

Changes

Check	Change
security/precommit-pinned	Pins each hook rev: to the commit its current tag points at, written as # frozen: vX. Hook versions do not change.
security/dependabot	Replaces .github/dependabot.yml with scanpy's configuration, copied verbatim. It now updates the pre-commit hooks as well as the GitHub Actions, weekly with a 7-day cooldown.
packaging/spec0-python	Sets requires-python = ">=3.13", drops the 3.12 classifier and moves the hatch test matrix (which generates the CI jobs) to 3.13 and 3.14. SPEC 0 dropped Python 3.12 on 2026-10-02, three years after its release.
SPEC 0 (no dashboard check)	Raises the core dependency minimums to the oldest releases still within SPEC 0's 24-month window: numpy 2.2, scipy 1.15, pandas 2.3, matplotlib 3.10, scikit-learn 1.6, networkx 3.5. anndata goes to 0.11 under the same window.

No library code changes. What changes is support: Python 3.12 is dropped, and environments with older versions of those dependencies will be upgraded.

Tests

• pytest on Python 3.13 with every direct dependency at its new lower bound (uv pip install --resolution lowest-direct): 31 passed.
• pytest on Python 3.14 with the latest releases (numpy 2.5.4, pandas 3.1.0, anndata 0.13.4, …): 31 passed.
• All pre-commit hooks pass, including zizmor.
• The docs build passes with -W.

The remaining dashboard items need repository or service settings, not code:

• branch rules on main (require PR, review and status checks);
• a read-only default workflow token;
• protection rules on the pypi environment;
• the pytometry.scverse.org docs domain;
• a release published through trusted publishing.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.69%. Comparing base (1dba141) to head (635fa4d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #105   +/-   ##
=======================================
  Coverage   76.69%   76.69%           
=======================================
  Files          15       15           
  Lines         618      618           
=======================================
  Hits          474      474           
  Misses        144      144           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[maltekuehl]

@grst @mbuttner would it be possible to get the docs onto the .scverse.org domain, too?

Since I am not core, I would need somebody else to email NumFocus, if Maren agrees on this move.

[grst]

If there's no rush, we can wait maybe 2 more weeks until we have the DNS records under our own control, then we don't have to put in a separate request

[maltekuehl]

@grst sure, I don't think there is any rush!