Merge branch 'main' into perf/prepared-write-v2

Author: ilan-gold

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,24 @@
-[Description of PR]
+<!-- The PR title becomes the squash-merge commit on main. Please use a descriptive,
+     Conventional Commits-style title, e.g. "fix: handle 0-d arrays in `save_array`".
+     This is the commit type (feat/fix/docs/chore/...), not the changelog category.
+     See https://www.conventionalcommits.org/en/v1.0.0/ -->
+
+## Summary
+
+[Describe what this PR changes and why, in your own words.]
+
+## For reviewers
+
+[What would you most value a second look at? What are you already confident in? For a refactor, say whether behavior is meant to be unchanged.]
+
+## Author attestation
+
+- [ ] I am a human, these are my changes, and I have reviewed and understood every change and can explain why each is correct.
+
+AI coding assistance is welcome, but a human must be the author and is responsible for the contents of the PR. The description and any review responses must be in your own words. Please read [AI-assisted contributions](https://zarr.readthedocs.io/en/stable/contributing/#ai-assisted-contributions) before opening.
+
+## TODO
 
-TODO:
 * [ ] Add unit tests and/or doctests in docstrings
 * [ ] Add docstrings and API docs for any new/modified user-facing classes and functions
 * [ ] New/modified features documented in `docs/user-guide/*.md`

.github/dependabot.yml

@@ -15,8 +15,14 @@ updates:
   # Keep the pinned dev tooling in pyproject.toml's [dependency-groups] and the
   # uv.lock current. Without this the exact pins (e.g. pytest) would never be
   # bumped automatically and would silently rot.
+  #
+  # `allow: dependency-type: direct` restricts updates to dependencies declared
+  # in pyproject.toml. Transitive deps in uv.lock are then only updated as a
+  # side effect of a direct bump, never via a standalone PR.
   - package-ecosystem: "uv"
     directory: "/"
+    allow:
+      - dependency-type: "direct"
     schedule:
       interval: "weekly"
     groups:

.github/workflows/check_changelogs.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/codspeed.yml

@@ -23,7 +23,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'benchmark'))
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -32,7 +32,7 @@ jobs:
       with:
         version: '1.16.5'
     - name: Run the benchmarks
-      uses: CodSpeedHQ/action@9d332c4d90b43981c3e55ae8e38e68709996240f # v4.17.0
+      uses: CodSpeedHQ/action@63f3e98b61959fe67f146a3ff022e4136fe9bb9c # v4.17.6
       with:
           mode: walltime
           run: hatch run test.py3.12-minimal:pytest tests/benchmarks --codspeed

.github/workflows/docs.yml

@@ -19,7 +19,7 @@ jobs:
     name: Check docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0

.github/workflows/downstream.yml

@@ -21,13 +21,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out zarr-python
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Check out xarray
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: pydata/xarray
           path: xarray
@@ -83,13 +83,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out zarr-python
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Check out numcodecs
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: zarr-developers/numcodecs
           fetch-depth: 0

.github/workflows/gpu_test.yml

@@ -34,7 +34,7 @@ jobs:
         python-version: ['3.12']
 
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         fetch-depth: 0  # grab all branches and tags
         persist-credentials: false

.github/workflows/hypothesis.yaml

@@ -39,7 +39,7 @@ jobs:
         dependency-set: ["optional"]
 
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
     - name: Set HYPOTHESIS_PROFILE based on trigger

.github/workflows/issue-metrics.yml

@@ -33,7 +33,7 @@ jobs:
         echo "last_month=$first_day..$last_day" >> "$GITHUB_ENV"
 
     - name: Run issue-metrics tool
-      uses: github-community-projects/issue-metrics@1e38d5e62363e14db8019ed7d106b9855bdba6cc # v4.2.7
+      uses: github-community-projects/issue-metrics@44173f9e0a3b2144a777a10a340e4c09a25ac9f8 # v4.2.8
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         SEARCH_QUERY: 'repo:zarr-developers/zarr-python is:issue created:${{ env.last_month }} -reason:"not planned"'

.github/workflows/lint.yml

@@ -19,7 +19,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Set up Python