Apply dependabot-recommended security updates

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directories:
+      - "/"
+      - "/reports"
+      - "/docs"
+    schedule:
+      interval: "weekly"
+    # Keep this configuration focused on security updates.
+    open-pull-requests-limit: 0
+    allow:
+      - dependency-type: "all"
+    groups:
+      pip:
+        applies-to: "security-updates"
+        patterns:
+          - "*"

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 Dave Walker
+Copyright (c) 2021-2026 Dave Walker
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "nature_recorder"
-version = "1.27.0"
+version = "1.28.0"
 description = "Wildlife sightings database"
 readme = "README.md"
 requires-python = ">=3.11"

reports/README.md

@@ -33,6 +33,16 @@ To build the virtual environment, run the following command:
 ./make_venv.sh
 ```
 
+To apply dependency updates to an existing reporting environment, run from this folder:
+
+```bash
+venv/bin/python -m pip install --upgrade -e .
+venv/bin/python -m pip check
+```
+
+`pyproject.toml` includes an explicit minimum version for Tornado, a transitive
+Jupyter dependency, to ensure installations receive the security update.
+
 ## Running a Report in Visual Studio Code
 
 - Open the Jupyter notebook for the report of interest

reports/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "nature-recorder-reports"
-version = "1.27.0"
+version = "1.28.0"
 description = "Jupyter notebook reports for Nature Recorder"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -19,6 +19,8 @@ dependencies = [
     "scipy>=1,<2",
     "seaborn>=0.13,<1",
     "sqlparse>=0.5,<1",
+    # Security floor for Jupyter's transitive dependency.
+    "tornado>=6.5.8,<7",
 ]
 
 [tool.setuptools]