From 2919eb84b54a2e31667125b69ef852e06d24f1ba Mon Sep 17 00:00:00 2001
From: Dave Walker <david.walker5@icloud.com>
Date: Sat, 5 Sep 2026 08:28:23 +0100
Subject: [PATCH] Apply dependabot-recommended security updates

---
 .github/dependabot.yml | 18 ++++++++++++++++++
 LICENSE                |  2 +-
 pyproject.toml         |  2 +-
 reports/README.md      | 10 ++++++++++
 reports/pyproject.toml |  4 +++-
 5 files changed, 33 insertions(+), 3 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..062a331
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directories:
+      - "/"
+      - "/reports"
+      - "/docs"
+    schedule:
+      interval: "weekly"
+    # Keep this configuration focused on security updates.
+    open-pull-requests-limit: 0
+    allow:
+      - dependency-type: "all"
+    groups:
+      pip:
+        applies-to: "security-updates"
+        patterns:
+          - "*"
diff --git a/LICENSE b/LICENSE
index 350eb51..72484ef 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 Dave Walker
+Copyright (c) 2021-2026 Dave Walker
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pyproject.toml b/pyproject.toml
index e6dede3..6af11aa 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "nature_recorder"
-version = "1.27.0"
+version = "1.28.0"
 description = "Wildlife sightings database"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/reports/README.md b/reports/README.md
index 14c983f..f5e825d 100644
--- a/reports/README.md
+++ b/reports/README.md
@@ -33,6 +33,16 @@ To build the virtual environment, run the following command:
 ./make_venv.sh
 ```
 
+To apply dependency updates to an existing reporting environment, run from this folder:
+
+```bash
+venv/bin/python -m pip install --upgrade -e .
+venv/bin/python -m pip check
+```
+
+`pyproject.toml` includes an explicit minimum version for Tornado, a transitive
+Jupyter dependency, to ensure installations receive the security update.
+
 ## Running a Report in Visual Studio Code
 
 - Open the Jupyter notebook for the report of interest
diff --git a/reports/pyproject.toml b/reports/pyproject.toml
index 6c55370..a712dde 100644
--- a/reports/pyproject.toml
+++ b/reports/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "nature-recorder-reports"
-version = "1.27.0"
+version = "1.28.0"
 description = "Jupyter notebook reports for Nature Recorder"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -19,6 +19,8 @@ dependencies = [
     "scipy>=1,<2",
     "seaborn>=0.13,<1",
     "sqlparse>=0.5,<1",
+    # Security floor for Jupyter's transitive dependency.
+    "tornado>=6.5.8,<7",
 ]
 
 [tool.setuptools]