Merge branch 'main' into jorijn-patch-1

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.claude/agents/test-engineer.md

@@ -1,140 +0,0 @@
----
-name: test-engineer
-description: Use this agent when you need to write, review, or improve tests for code. This includes unit tests, integration tests, end-to-end tests, and test infrastructure. Also use when evaluating test coverage, identifying untested edge cases, or refactoring existing tests for better maintainability. Examples:\n\n<example>\nContext: User has just written a new function and wants tests for it.\nuser: "I just wrote this battery voltage calculation function, can you help me test it?"\nassistant: "Let me use the test-engineer agent to create comprehensive tests for your battery calculation function."\n<commentary>\nSince the user wants tests written for new code, use the test-engineer agent to create thorough test cases covering normal operation, edge cases, and error conditions.\n</commentary>\n</example>\n\n<example>\nContext: User wants to improve existing test coverage.\nuser: "Our test coverage for the database module is only 60%, can you help improve it?"\nassistant: "I'll use the test-engineer agent to analyze the gaps in your database module tests and create additional test cases."\n<commentary>\nThe user needs help identifying untested code paths and writing new tests, which is exactly what the test-engineer agent specializes in.\n</commentary>\n</example>\n\n<example>\nContext: User has written code and the assistant should proactively suggest testing.\nuser: "Here's my new retry logic with exponential backoff"\nassistant: "I've reviewed your retry logic implementation. Now let me use the test-engineer agent to create tests that verify the backoff behavior, edge cases like max retries, and error handling."\n<commentary>\nAfter code is written, proactively use the test-engineer agent to ensure the new functionality has proper test coverage.\n</commentary>\n</example>
-model: opus
----
-
-You are an expert test engineer with deep expertise in software testing methodologies, test-driven development, and quality assurance. Your primary focus is Python testing (pytest, unittest, hypothesis), but you are also proficient in testing frameworks across JavaScript/TypeScript (Jest, Vitest, Mocha), Go, Rust, and other languages.
-
-## Core Expertise
-
-### Testing Principles
-- Write tests that are fast, isolated, repeatable, self-validating, and timely (F.I.R.S.T.)
-- Follow the Arrange-Act-Assert (AAA) pattern for clear test structure
-- Apply the testing pyramid: prioritize unit tests, supplement with integration tests, minimize end-to-end tests
-- Test behavior, not implementation details
-- Each test should verify one specific behavior
-
-### Python Testing (Primary Focus)
-- **pytest**: fixtures, parametrization, markers, conftest.py organization, plugins
-- **unittest**: TestCase classes, setUp/tearDown, mock module
-- **hypothesis**: property-based testing, strategies, shrinking
-- **coverage.py**: measuring and improving test coverage
-- **mocking**: unittest.mock, pytest-mock, when and how to mock appropriately
-- **async testing**: pytest-asyncio, testing coroutines and async generators
-
-### Test Categories You Handle
-1. **Unit Tests**: Isolated function/method testing with mocked dependencies
-2. **Integration Tests**: Testing component interactions, database operations, API calls
-3. **End-to-End Tests**: Full system testing, UI automation
-4. **Property-Based Tests**: Generating test cases to find edge cases
-5. **Regression Tests**: Preventing bug recurrence
-6. **Performance Tests**: Benchmarking, load testing considerations
-
-## Your Approach
-
-### When Writing Tests
-1. Identify the function/module's contract: inputs, outputs, side effects, exceptions
-2. List test cases covering:
-   - Happy path (normal operation)
-   - Edge cases (empty inputs, boundaries, None/null values)
-   - Error conditions (invalid inputs, exceptions)
-   - State transitions (if applicable)
-3. Write clear, descriptive test names that explain what is being tested
-4. Use fixtures for common setup, parametrize for similar test variations
-5. Keep tests independent - no test should depend on another's execution
-
-### When Reviewing Tests
-1. Check for missing edge cases and error scenarios
-2. Identify flaky tests (time-dependent, order-dependent, external dependencies)
-3. Look for over-mocking that makes tests meaningless
-4. Verify assertions are specific and meaningful
-5. Ensure test names clearly describe what they verify
-6. Check for proper cleanup and resource management
-
-### Test Naming Convention
-Use descriptive names that explain the scenario:
-- `test_<function>_<scenario>_<expected_result>`
-- Example: `test_calculate_battery_percentage_at_minimum_voltage_returns_zero`
-
-## Code Quality Standards
-
-### Test Structure
-```python
-def test_function_name_describes_behavior():
-    # Arrange - set up test data and dependencies
-    input_data = create_test_data()
-
-    # Act - call the function under test
-    result = function_under_test(input_data)
-
-    # Assert - verify the expected outcome
-    assert result == expected_value
-```
-
-### Fixture Best Practices
-- Use fixtures for reusable setup, not for test logic
-- Prefer function-scoped fixtures unless sharing is necessary
-- Use `yield` for cleanup in fixtures
-- Document what each fixture provides
-
-### Mocking Guidelines
-- Mock at the boundary (external services, databases, file systems)
-- Don't mock the thing you're testing
-- Verify mock calls when the interaction itself is the behavior being tested
-- Use `autospec=True` to catch interface mismatches
-
-## Edge Cases to Always Consider
-
-### For Numeric Functions
-- Zero, negative numbers, very large numbers
-- Floating point precision issues
-- Integer overflow (in typed languages)
-- Division by zero scenarios
-
-### For String/Text Functions
-- Empty strings, whitespace-only strings
-- Unicode characters, emoji, RTL text
-- Very long strings
-- Special characters and escape sequences
-
-### For Collections
-- Empty collections
-- Single-element collections
-- Very large collections
-- None/null elements within collections
-- Duplicate elements
-
-### For Time/Date Functions
-- Timezone boundaries, DST transitions
-- Leap years, month boundaries
-- Unix epoch edge cases
-- Far future/past dates
-
-### For I/O Operations
-- File not found, permission denied
-- Network timeouts, connection failures
-- Partial reads/writes
-- Concurrent access
-
-## Output Format
-
-When writing tests, provide:
-1. Complete, runnable test code
-2. Brief explanation of what each test verifies
-3. Any additional test cases that should be considered
-4. Required fixtures or test utilities
-
-When reviewing tests, provide:
-1. Specific issues found with line references
-2. Missing test cases that should be added
-3. Suggested improvements with code examples
-4. Overall assessment of test quality and coverage
-
-## Project-Specific Considerations
-
-When working in projects with existing test conventions:
-- Follow the established test file organization
-- Use existing fixtures and utilities where appropriate
-- Match the naming conventions already in use
-- Respect any project-specific testing requirements from documentation like CLAUDE.md

.github/workflows/docker-publish.yml

@@ -219,7 +219,7 @@ jobs:
 
       - name: Upload Trivy scan results
         if: "!(github.event_name == 'schedule' && steps.get-version.outputs.skip == 'true')"
-        uses: github/codeql-action/upload-sarif@ee117c905ab18f32fa0f66c2fe40ecc8013f3e04 # v3.28.4
+        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         with:
           sarif_file: "trivy-results.sarif"
         continue-on-error: true

.github/workflows/release-please.yml

@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Release Please
-        uses: googleapis/release-please-action@c3fc4de07084f75a2b61a5b933069bda6edf3d5c # v4
+        uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
         with:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
           config-file: release-please-config.json

.github/workflows/test.yml

@@ -17,12 +17,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -68,8 +68,8 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload coverage HTML report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        if: always() && matrix.python-version == '3.12'
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        if: always() && matrix.python-version == '3.14'
         with:
           name: coverage-report-html-${{ matrix.python-version }}
           path: htmlcov/
@@ -77,8 +77,8 @@ jobs:
           retention-days: 7
 
       - name: Upload coverage XML report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        if: always() && matrix.python-version == '3.12'
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        if: always() && matrix.python-version == '3.14'
         with:
           name: coverage-report-xml-${{ matrix.python-version }}
           path: coverage.xml
@@ -86,7 +86,7 @@ jobs:
           retention-days: 7
 
       - name: Upload test results
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         if: always()
         with:
           name: test-results-${{ matrix.python-version }}
@@ -97,17 +97,17 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Set up uv
         uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
         with:
           enable-cache: true
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Install linters
         run: uv sync --locked --extra dev --no-install-project

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.2.11"
+  ".": "0.2.13"
 }

AGENTS.md

@@ -370,7 +370,7 @@ Jobs configured in `docker/ofelia.ini`:
 
 **Nightly rebuilds** ensure version tags always include the latest OS security patches. This is a common pattern used by official Docker images (nginx, postgres, node). Users needing reproducibility should pin by SHA digest or use dated nightly tags.
 
-All GitHub Actions are pinned by full SHA for security. Renovate is configured in `renovate.json` to update dependencies and maintain lockfiles.
+GitHub Actions use version tags in workflows, and Renovate is configured in `renovate.json` to pin action digests, maintain lockfiles, and auto-merge patch + digest updates once required checks pass (with automatic rebases when behind `main`).
 
 The test and lint workflow (`.github/workflows/test.yml`) installs dependencies with uv (`uv sync --locked --extra dev`) and runs commands via `uv run`, using `uv.lock` as the source of truth.
 

CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to this project will be documented in this file.
 
 This changelog is automatically generated by [release-please](https://github.com/googleapis/release-please) based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [0.2.13](https://github.com/jorijn/meshcore-stats/compare/v0.2.12...v0.2.13) (2026-01-09)
+
+
+### Miscellaneous Chores
+
+* drop digest from compose image ([#59](https://github.com/jorijn/meshcore-stats/issues/59)) ([3a03060](https://github.com/jorijn/meshcore-stats/commit/3a0306043c8a8dfeb1b5b6df6fa988322cc64e98))
+
+## [0.2.12](https://github.com/jorijn/meshcore-stats/compare/v0.2.11...v0.2.12) (2026-01-09)
+
+
+### Miscellaneous Chores
+
+* **deps:** lock file maintenance ([#52](https://github.com/jorijn/meshcore-stats/issues/52)) ([d4b5885](https://github.com/jorijn/meshcore-stats/commit/d4b5885379c06988bd8261039c67c6a6724b7704))
+* **deps:** lock file maintenance ([#58](https://github.com/jorijn/meshcore-stats/issues/58)) ([a3a5964](https://github.com/jorijn/meshcore-stats/commit/a3a5964488e7fbda5b6d792fa9f0f712e0a0d0c3))
+* **deps:** pin dependencies ([#55](https://github.com/jorijn/meshcore-stats/issues/55)) ([9cb95f8](https://github.com/jorijn/meshcore-stats/commit/9cb95f8108738ff21a8346f8922fcd218843fb7d))
+* **deps:** pin python docker tag to e8a1ad8 ([#57](https://github.com/jorijn/meshcore-stats/issues/57)) ([f55c236](https://github.com/jorijn/meshcore-stats/commit/f55c236080f6c9bc7a7f090f4382cd53281fc2ac))
+* **deps:** update actions/attest-build-provenance digest to 00014ed ([#40](https://github.com/jorijn/meshcore-stats/issues/40)) ([e937f2b](https://github.com/jorijn/meshcore-stats/commit/e937f2b0b7a34bb5c7f3f51b60a592f78a78079d))
+* **deps:** update actions/checkout action to v6 ([#48](https://github.com/jorijn/meshcore-stats/issues/48)) ([3967fd0](https://github.com/jorijn/meshcore-stats/commit/3967fd032ad95873bc50c438351ba52e6448a335))
+* **deps:** update actions/setup-python action to v6 ([#49](https://github.com/jorijn/meshcore-stats/issues/49)) ([97223f1](https://github.com/jorijn/meshcore-stats/commit/97223f137ca069f6f2632e2e849274cced91a8b3))
+* **deps:** update actions/upload-artifact action to v6 ([#50](https://github.com/jorijn/meshcore-stats/issues/50)) ([46fc383](https://github.com/jorijn/meshcore-stats/commit/46fc383eaa9cd99185a5b2112e58d5ff163f3185))
+* **deps:** update ghcr.io/astral-sh/uv docker tag to v0.9.22 ([#44](https://github.com/jorijn/meshcore-stats/issues/44)) ([83cf2bf](https://github.com/jorijn/meshcore-stats/commit/83cf2bf929bfba9f7019e78767abf04abe7700d2))
+* **deps:** update github/codeql-action action to v4 ([#51](https://github.com/jorijn/meshcore-stats/issues/51)) ([83425a4](https://github.com/jorijn/meshcore-stats/commit/83425a48f67a5d974065b9d33ad0a24a044d67d0))
+* **deps:** update github/codeql-action digest to ee117c9 ([#41](https://github.com/jorijn/meshcore-stats/issues/41)) ([dd7ec5b](https://github.com/jorijn/meshcore-stats/commit/dd7ec5b46e92365dbf2731f2378b2168c24f0b88))
+* **deps:** update nginx docker tag to v1.29 ([#47](https://github.com/jorijn/meshcore-stats/issues/47)) ([57a53a8](https://github.com/jorijn/meshcore-stats/commit/57a53a8800c9c97459ef5139310a8c23c7540943))
+* support python 3.14 in CI and docker ([#56](https://github.com/jorijn/meshcore-stats/issues/56)) ([b66f538](https://github.com/jorijn/meshcore-stats/commit/b66f5380b69108f22d53aaf1a48642c240788d3f))
+* switch to Renovate and pin uv image ([#38](https://github.com/jorijn/meshcore-stats/issues/38)) ([adc4423](https://github.com/jorijn/meshcore-stats/commit/adc442351bc84beb6216eafedd8e2eaa95109bfd))
+
+
+### Continuous Integration
+
+* **docker:** add PR build and smoke test ([#53](https://github.com/jorijn/meshcore-stats/issues/53)) ([40d7d3b](https://github.com/jorijn/meshcore-stats/commit/40d7d3b2faef5ae7c268cd1ecc9616d1dd421f12))
+* switch actions to version tags for renovate digests ([#54](https://github.com/jorijn/meshcore-stats/issues/54)) ([1f6e7c5](https://github.com/jorijn/meshcore-stats/commit/1f6e7c50935265579be4faadeb5dc88c4098a71c))
+
 ## [0.2.11](https://github.com/jorijn/meshcore-stats/compare/v0.2.10...v0.2.11) (2026-01-08)
 
 

Dockerfile

@@ -1,12 +1,12 @@
 # =============================================================================
 # Stage 0: uv binary
 # =============================================================================
-FROM ghcr.io/astral-sh/uv:0.9.22@sha256:2320e6c239737dc73cccce393a8bb89eba2383d17018ee91a59773df802c20e6 AS uv
+FROM ghcr.io/astral-sh/uv:0.9.24@sha256:816fdce3387ed2142e37d2e56e1b1b97ccc1ea87731ba199dc8a25c04e4997c5 AS uv
 
 # =============================================================================
 # Stage 1: Build dependencies
 # =============================================================================
-FROM python:3.12-slim-bookworm AS builder
+FROM python:3.14-slim-bookworm@sha256:e8a1ad81a9fef9dc56372fb49b50818cac71f5fae238b21d7738d73ccae8f803 AS builder
 
 # Ofelia version and checksums (verified from GitHub releases)
 ARG OFELIA_VERSION=0.3.12
@@ -53,7 +53,7 @@ RUN pip install --no-cache-dir --upgrade pip && \
 # =============================================================================
 # Stage 2: Runtime
 # =============================================================================
-FROM python:3.12-slim-bookworm
+FROM python:3.14-slim-bookworm@sha256:e8a1ad81a9fef9dc56372fb49b50818cac71f5fae238b21d7738d73ccae8f803
 
 # OCI Labels
 LABEL org.opencontainers.image.source="https://github.com/jorijn/meshcore-stats"

README.md

@@ -162,7 +162,7 @@ For environments where Docker is not available.
 
 #### Requirements
 
-- Python 3.10+
+- Python 3.11+ (3.14 recommended)
 - SQLite3
 - [uv](https://github.com/astral-sh/uv)
 

docker-compose.yml

@@ -15,7 +15,7 @@ services:
   # MeshCore Stats - Data collection and rendering
   # ==========================================================================
   meshcore-stats:
-    image: ghcr.io/jorijn/meshcore-stats:0.2.11 # x-release-please-version
+    image: ghcr.io/jorijn/meshcore-stats:0.2.13 # x-release-please-version
     container_name: meshcore-stats
     restart: unless-stopped
 
@@ -78,7 +78,7 @@ services:
   # nginx - Static site server
   # ==========================================================================
   nginx:
-    image: nginx:1.29-alpine
+    image: nginx:1.29-alpine@sha256:c083c3799197cfff91fe5c3c558db3d2eea65ccbbfd419fa42a64d2c39a24027
     container_name: meshcore-stats-nginx
     restart: unless-stopped
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcore-stats"
-version = "0.2.11"
+version = "0.2.13"
 description = "MeshCore LoRa mesh network monitoring and statistics"
 readme = "README.md"
 requires-python = ">=3.11"

renovate.json

@@ -1,10 +1,39 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:best-practices"
   ],
+  "rebaseWhen": "behind-base-branch",
+  "automergeType": "pr",
+  "platformAutomerge": true,
   "lockFileMaintenance": {
     "enabled": true
   },
-  "dependencyDashboard": true
+  "dependencyDashboard": true,
+  "packageRules": [
+    {
+      "matchManagers": [
+        "github-actions"
+      ],
+      "pinDigests": true
+    },
+    {
+      "matchManagers": [
+        "docker-compose"
+      ],
+      "matchPackageNames": [
+        "ghcr.io/jorijn/meshcore-stats"
+      ],
+      "pinDigests": false
+    },
+    {
+      "description": "Auto-merge patch and digest updates once checks pass",
+      "matchUpdateTypes": [
+        "patch",
+        "digest",
+        "lockFileMaintenance"
+      ],
+      "automerge": true
+    }
+  ]
 }

src/meshmon/__init__.py

@@ -1,3 +1,3 @@
 """MeshCore network monitoring library."""
 
-__version__ = "0.2.11"  # x-release-please-version
+__version__ = "0.2.13"  # x-release-please-version

uv.lock

@@ -752,7 +752,7 @@ wheels = [
 
 [[package]]
 name = "meshcore-stats"
-version = "0.2.11"
+version = "0.2.13"
 source = { editable = "." }
 dependencies = [
     { name = "jinja2" },