GraphBLAS · eriknw · Mar 27, 2026 · Oct 14, 2025 · Oct 14, 2025 · Oct 15, 2025
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -14,8 +14,11 @@ jobs:
     name: pre-commit-hooks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
         with:
-          python-version: "3.10"
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
       - uses: pre-commit/action@v3.0.1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -18,12 +18,13 @@ jobs:
         source: ["conda-forge"]
         # os: ["ubuntu-latest"]
         # source: ["source"]
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: Conda
       uses: conda-incubator/setup-miniconda@v3
       with:

diff --git a/.github/workflows/update_graphblas.yml b/.github/workflows/update_graphblas.yml
@@ -27,11 +27,12 @@ jobs:
     if: github.repository == 'GraphBLAS/python-suitesparse-graphblas' || github.repository == 'alugowski/python-suitesparse-graphblas'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 
@@ -42,7 +43,7 @@ jobs:
         shell: bash
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           # See documentation: https://github.com/peter-evans/create-pull-request
           # Action behavior: https://github.com/peter-evans/create-pull-request#action-behaviour

diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
@@ -34,9 +34,10 @@ jobs:
     name: Build SDist
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Build SDist
         run: pipx run build --sdist
@@ -60,58 +61,43 @@ jobs:
           - os: windows-latest
             cibw_archs: "auto64"
 
-          # Linux x86 manylinux
+          # Linux x86_64 manylinux
           - os: ubuntu-latest
             cibw_archs: "x86_64"
-            # Python 3.12 wheel requires libffi-devel to be installed. manylinux container uses yum
-            cibw_before_build_linux: "yum install -y libffi-devel"
+            # manylinux_2_28 uses dnf (not yum). libffi-devel needed for Python 3.12+ cffi.
+            cibw_before_build_linux: "dnf install -y libffi-devel || yum install -y libffi-devel || true"
             # skip musllinux
             cibw_skip: "*musl*"
 
-          # Linux x86 musllinux
+          # Linux x86_64 musllinux
           # Separate runner for a Musl build of graphblas. The glibc build is not guaranteed to be compatible.
           - os: ubuntu-latest
             cibw_archs: "x86_64"
             arch_note: "musl"
-            # skip manylinux (built elsewhere), PyPy (no musl numpy wheels), CPython 3.8 (no musl numpy wheels)
-            cibw_skip: "*many* pp* cp38*"
+            # skip manylinux (built elsewhere)
+            cibw_skip: "*many*"
 
-          # Linux aarch64
-          # Separate runner because this requires emulation (only x86 runners are available) and is very slow.
-          - os: ubuntu-latest
-            cibw_archs: "aarch64"
-            # numpy wheels not available for aarch64 PyPy or musllinux
-            cibw_skip: "pp* *musl*"
+          # Linux aarch64 — native ARM runner (no QEMU emulation needed)
+          - os: ubuntu-24.04-arm
+            cibw_archs: "auto"
+            # numpy wheels not available for aarch64 musllinux
+            cibw_skip: "*musl*"
 
-          # macOS x86
-          # Note: keep as old as possible as due to libomp this will be the oldest supported macOS version.
-          - os: macos-13
+          # macOS x86_64 — macos-15-intel is the last Intel macOS runner.
+          # libomp from Homebrew determines the minimum supported macOS version.
+          - os: macos-15-intel
             cibw_archs: "x86_64"
 
           # macOS Apple Silicon
-          # Note: keep as old as possible as due to libomp this will be the oldest supported macOS version.
+          # Keep runner version as old as possible: libomp determines minimum macOS version.
           - os: macos-14
             cibw_archs: "arm64"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-
-      # aarch64 Linux builds are cross-compiled on x86 runners using emulation
-      # see https://cibuildwheel.readthedocs.io/en/stable/faq/#emulation
-      - name: Setup QEMU (for aarch64)
-        if: matrix.cibw_archs == 'aarch64'
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
-
-      - name: Setup env (for aarch64)
-        if: matrix.cibw_archs == 'aarch64'
-        # Ask suitesparse.sh to compile faster by optimizing fewer types. Otherwise, the build takes too long to finish
-        # in 6 hour limit.
-        run: |
-          echo "SUITESPARSE_FAST_BUILD=1" >> $GITHUB_ENV
+          persist-credentials: false
 
       - name: Setup for testing
         if: github.event_name == 'push' || github.event_name == 'pull_request'
@@ -145,19 +131,23 @@ jobs:
           brew fetch --retry libomp && brew reinstall libomp
           echo MACOSX_DEPLOYMENT_TARGET=$(otool -l $(brew --prefix libomp)/lib/libomp.dylib | grep minos | awk '{print $2}') >> $GITHUB_ENV
 
-      - uses: pypa/cibuildwheel@v2.22
+      - uses: pypa/cibuildwheel@v3.4
         with:
           output-dir: wheelhouse
         env:
           # very verbose
           CIBW_BUILD_VERBOSITY: 3
 
+          # cibuildwheel v3: PyPy no longer built by default; enable explicitly
+          # Note: cpython-freethreading not enabled because cffi doesn't support it yet
+          CIBW_ENABLE: "pypy"
+
           # Build SuiteSparse
           CIBW_BEFORE_ALL: bash suitesparse.sh ${{ env.GB_VERSION_REF }}
 
           CIBW_BEFORE_BUILD_LINUX: ${{ matrix.cibw_before_build_linux }}
 
-          CIBW_ENVIRONMENT_PASS_LINUX: SUITESPARSE_FAST_BUILD SUITESPARSE_FASTEST_BUILD
+          CIBW_ENVIRONMENT_PASS_LINUX: SUITESPARSE_FASTEST_BUILD
 
           # CMAKE_GNUtoMS=ON asks suitesparse.sh to build libraries in MSVC style on Windows.
           CIBW_ENVIRONMENT_WINDOWS: CMAKE_GNUtoMS=ON GRAPHBLAS_PREFIX="C:/GraphBLAS"
@@ -172,8 +162,7 @@ jobs:
           # Architectures to build specified in matrix
           CIBW_ARCHS: ${{ matrix.cibw_archs }}
 
-          # as of writing numpy does not support pypy 3.10
-          CIBW_SKIP: "${{ matrix.cibw_skip }} pp310*"
+          CIBW_SKIP: "${{ matrix.cibw_skip }}"
 
           # Use delvewheel on Windows.
           # This copies graphblas.dll into the wheel. "repair" in cibuildwheel parlance includes copying any shared
@@ -207,17 +196,17 @@ jobs:
     if: github.repository == 'GraphBLAS/python-suitesparse-graphblas' && ((github.event_name == 'release' && github.event.action == 'published') || (github.event_name == 'workflow_dispatch' && github.event.inputs.upload_dest != 'No Upload'))
 
     steps:
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           path: dist
           merge-multiple: true
 
       # Upload to PyPI
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@v1.13.0
         name: Upload to PyPI
         if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.upload_dest == 'PyPI')
         with:
@@ -227,7 +216,7 @@ jobs:
           password: ${{ secrets.PYPI_TOKEN }}
 
       # Upload to Test PyPI
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@v1.13.0
         name: Upload to Test PyPI
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.upload_dest == 'Test PyPI'
         with:

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -13,12 +13,12 @@ repos:
     hooks:
       - id: check-added-large-files
       - id: check-case-conflict
+      - id: check-executables-have-shebangs
       - id: check-illegal-windows-names
       - id: check-merge-conflict
       - id: check-ast
       - id: check-toml
       - id: check-yaml
-      # - id: check-executables-have-shebangs
       - id: check-vcs-permalinks
       - id: debug-statements
       - id: destroyed-symlinks
@@ -28,27 +28,29 @@ repos:
       - id: mixed-line-ending
         args: [--fix=lf]
       - id: trailing-whitespace
+      - id: name-tests-test
+        args: ["--pytest-test-first"]
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.24.1
+    rev: v0.25
     hooks:
       - id: validate-pyproject
         name: Validate pyproject.toml
   - repo: https://github.com/PyCQA/autoflake
-    rev: v2.3.1
+    rev: v2.3.3
     hooks:
       - id: autoflake
         args: [--in-place]
   - repo: https://github.com/pycqa/isort
-    rev: 6.0.1
+    rev: 8.0.1
     hooks:
       - id: isort
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.20.0
+    rev: v3.21.2
     hooks:
       - id: pyupgrade
-        args: [--py39-plus]
+        args: [--py311-plus]
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 25.1.0
+    rev: 26.3.1
     hooks:
       - id: black
   - repo: https://github.com/PyCQA/flake8
@@ -60,8 +62,8 @@ repos:
         # These versions need updated manually
         - flake8==7.3.0
         - flake8-comprehensions==3.17.0
-        - flake8-bugbear==24.12.12
-        # - flake8-simplify==0.21.0
+        - flake8-bugbear==25.11.29
+        # - flake8-simplify==0.22.0
   - repo: https://github.com/asottile/yesqa
     rev: v1.5.0
     hooks:
@@ -70,12 +72,24 @@ repos:
   # `pyroma` may help keep our package standards up to date if best practices change.
   # This is a "low value" check though and too slow to run as part of pre-commit.
   # - repo: https://github.com/regebro/pyroma
-  #   rev: "4.2"
+  #   rev: "5.0.1"
   #   hooks:
   #     - id: pyroma
   #       args: [-n, "10", .]
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: "v0.11.0.1"
+    hooks:
+      - id: shellcheck
+  - repo: https://github.com/pre-commit/pygrep-hooks
+    rev: v1.10.0
+    hooks:
+      - id: python-check-blanket-noqa
+      - id: python-check-blanket-type-ignore
+      - id: python-no-eval
+      - id: python-no-log-warn
+      - id: text-unicode-replacement-char
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.33.3
+    rev: 0.37.0
     hooks:
       - id: check-dependabot
       - id: check-github-workflows

diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-ARG BASE_CONTAINER=python:3.9-slim-buster
+ARG BASE_CONTAINER=python:3.10-slim-buster
 FROM ${BASE_CONTAINER} as suitesparse
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -24,7 +24,7 @@ ENV PYTHONUNBUFFERED 1
 
 COPY --from=suitesparse  /usr/include/GraphBLAS.h /usr/local/include/
 COPY --from=suitesparse /usr/lib/x86_64-linux-gnu/libgraphblas* /usr/lib/x86_64-linux-gnu/
-COPY --from=suitesparse /build/pycparser/utils/fake_libc_include/* /usr/local/lib/python3.9/site-packages/pycparser/utils/fake_libc_include/
+COPY --from=suitesparse /build/pycparser/utils/fake_libc_include/* /usr/local/lib/python3.10/site-packages/pycparser/utils/fake_libc_include/
 
 RUN apt-get update && apt-get install -yq build-essential git
 RUN pip3 install numpy cffi pytest cython
@@ -44,4 +44,4 @@ RUN apt-get -y --purge remove git python3-pip && apt-get clean
 FROM ${BASE_CONTAINER}
 COPY --from=suitesparse /usr/lib/x86_64-linux-gnu/libgraphblas* /usr/lib/x86_64-linux-gnu/
 COPY --from=suitesparse /usr/lib/x86_64-linux-gnu/libgomp* /usr/lib/x86_64-linux-gnu/
-COPY --from=psg /usr/local/lib/python3.9/site-packages /usr/local/lib/python3.9/site-packages
+COPY --from=psg /usr/local/lib/python3.10/site-packages /usr/local/lib/python3.10/site-packages
diff --git a/GB_VERSION.txt b/GB_VERSION.txt
@@ -1 +1 @@
-10.1.1
+10.3.1
diff --git a/build_graphblas_cffi.py b/build_graphblas_cffi.py
@@ -13,7 +13,7 @@
 # GraphBLAS_ROOT env var can point to the root directory of GraphBLAS to link against.
 # Expected subdirectories: include/ (contains GraphBLAS.h), lib/, and bin/ (on Windows only)
 # Otherwise fallback to default system folders.
-graphblas_root = os.environ.get("GraphBLAS_ROOT", None)
+graphblas_root = os.environ.get("GraphBLAS_ROOT")
 
 if not graphblas_root:
     # Windows wheels.yml configures suitesparse.sh to install GraphBLAS to "C:\\GraphBLAS".

diff --git a/docker_build.sh b/docker_build.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 if [ $# -eq 0 ]
     then
         echo "Usage: ./docker_build.sh SUITESPARSE_BRANCH VERSION [BRANCH LOCATION PUSH]
@@ -21,29 +22,29 @@ COMPACT=${COMPACT:-0}
 if [ "$LOCATION" = "clone" ]
 then
     TMPDIR=$(mktemp -d)
-    if [ ! -e $TMPDIR ]; then
+    if [ ! -e "$TMPDIR" ]; then
         >&2 echo "Failed to create temp directory"
         exit 1
     fi
     trap "exit 1"           HUP INT PIPE QUIT TERM
     trap 'rm -rf "$TMPDIR"' EXIT
 
-    cd $TMPDIR
-    git clone --branch $BRANCH https://github.com/GraphBLAS/python-suitesparse-graphblas.git
-    cd python-suitesparse-graphblas
+    cd "$TMPDIR" || exit
+    git clone --branch "$BRANCH" https://github.com/GraphBLAS/python-suitesparse-graphblas.git
+    cd python-suitesparse-graphblas || exit
 fi
 
 docker build \
-       --build-arg SUITESPARSE=${SUITESPARSE} \
-       --build-arg VERSION=${VERSION} \
-       --build-arg COMPACT=${COMPACT} \
-       -t $IMAGE:$VERSION \
+       --build-arg SUITESPARSE="${SUITESPARSE}" \
+       --build-arg VERSION="${VERSION}" \
+       --build-arg COMPACT="${COMPACT}" \
+       -t "$IMAGE:$VERSION" \
        .
 
-docker tag $IMAGE:$VERSION $IMAGE:latest
+docker tag "$IMAGE:$VERSION" "$IMAGE:latest"
 
 if [ "$PUSH" = "push" ]
 then
-    docker push $IMAGE:$VERSION
-    docker push $IMAGE:latest
+    docker push "$IMAGE:$VERSION"
+    docker push "$IMAGE:latest"
 fi