perf: autobump conda envs

[johanneskoester]

Automated changes by create-pull-request GitHub action

Summary by CodeRabbit

• Chores
  • Added explicit conda environment pin files for deterministic environment recreation across multiple analysis workflows
  • Updated dependency versions including Python, scientific packages (pandas, scipy, scikit-learn, statsmodels), and bioinformatics tools (bcftools, samtools, vembrane, picard, pysam, rtg-tools)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 178b939b-5a4e-4b09-aca0-ae3524d14382

📥 Commits

Reviewing files that changed from the base of the PR and between 2995a54 and daa372d.

📒 Files selected for processing (10)

• workflow/envs/picard.linux-64.pin.txt
• workflow/envs/pysam.linux-64.pin.txt
• workflow/envs/pysam.yaml
• workflow/envs/rtg-tools.linux-64.pin.txt
• workflow/envs/stats.linux-64.pin.txt
• workflow/envs/stats.yaml
• workflow/envs/tools.linux-64.pin.txt
• workflow/envs/tools.yaml
• workflow/envs/vembrane.linux-64.pin.txt
• workflow/envs/vembrane.yaml

✅ Files skipped from review due to trivial changes (8)

• workflow/envs/tools.yaml
• workflow/envs/pysam.yaml
• workflow/envs/picard.linux-64.pin.txt
• workflow/envs/tools.linux-64.pin.txt
• workflow/envs/rtg-tools.linux-64.pin.txt
• workflow/envs/stats.linux-64.pin.txt
• workflow/envs/pysam.linux-64.pin.txt
• workflow/envs/vembrane.linux-64.pin.txt

🚧 Files skipped from review as they are similar to previous changes (2)

• workflow/envs/vembrane.yaml
• workflow/envs/stats.yaml

---

📝 Walkthrough

Walkthrough

Adds explicit linux-64 Conda environment pin files and updates several environment YAMLs with dependency version bumps for pysam, stats, tools, and vembrane workflows.

Changes

Cohort / File(s)	Summary
Linux-64 Environment Pins workflow/envs/picard.linux-64.pin.txt, workflow/envs/pysam.linux-64.pin.txt, workflow/envs/rtg-tools.linux-64.pin.txt, workflow/envs/stats.linux-64.pin.txt, workflow/envs/tools.linux-64.pin.txt, workflow/envs/vembrane.linux-64.pin.txt	Added @EXPLICIT conda pin files listing fully-qualified package URLs and hashes for deterministic linux-64 environment creation.
YAML Environment Specs workflow/envs/pysam.yaml, workflow/envs/stats.yaml, workflow/envs/tools.yaml, workflow/envs/vembrane.yaml	Bumped dependency versions (Python and select packages: pandas, scipy, scikit-learn, statsmodels, bcftools/samtools, vembrane, dnaio) and normalized file endings/newlines.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• perf: update tools in conda environments #132: Modifies the same environment configs and adds/aligns explicit linux-64 pin files.
• chore: add autobump actions #148: Adds tooling/automation that updates/pins workflow/envs/*.yaml files—closely related to these env updates.

Suggested reviewers

• famosab
• BiancaStoecker

Poem

🐰 I hopped through pins with whiskers all aglow,
URLs and hashes lined up in a row,
Envs locked and tidy for linux-64 cheer,
Repro steps ready — the pathway is clear,
A rabbit's small clap for builds that now flow.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'perf: autobump conda envs' accurately summarizes the main change: automated version bumping of conda environment specifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch perf/autobump-envs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[famosab]

@johanneskoester do we need the *.linux-64.pin.txt files that are automatically created by this action?

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@workflow/envs/vembrane.linux-64.pin.txt`:
- Around line 1-75: The cyvcf2 package is pinned to 0.31.1 in the `@EXPLICIT`
list; update the cyvcf2 entry (the line containing "cyvcf2-0.31.1-...") to
reference version 0.31.4 instead and replace the archived filename and checksum
with the correct 0.31.4 artifact from Bioconda so the explicit environment
installs the newer release; ensure the updated artifact is the linux-64 (or
noarch) build that is compatible with Python 3.12.12.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

Python 3.12.12 release security status

💡 Result:

Python 3.12.12 (released October 9, 2025) is explicitly a security release for the legacy Python 3.12 series. [1]

Lifecycle / support status (upstream CPython):

• Python 3.12 is in “security fixes only” mode (no regular bugfix releases). [1][2]
• Releases are source-only and irregular (i.e., no official binary installers for 3.12.x security releases). [1][2]
• This security-fixes-only period is expected to run until October 2028. [1][2]

Security content called out for 3.12.12 (examples):

• Bundled libexpat upgraded to 2.7.3 to fix CVE-2025-59375. [1]
• Security hardening/fixes in zipfile/ZIP64 handling, tarfile validation, and xml.parsers.expat behavior. [1][3]

Sources: Python.org 3.12.12 release page [1], PEP 693 release schedule/lifecycle [2], Python 3.12.12 changelog [3].

---

🌐 Web query:

vembrane latest version PyPI

💡 Result:

The latest vembrane release on PyPI is 2.4.0 (uploaded Sep 27, 2025). [1]

---

🌐 Web query:

cyvcf2 latest version PyPI

💡 Result:

The latest cyvcf2 release on PyPI is 0.31.4 (released Oct 13, 2025). [1]

---

🌐 Web query:

pysam latest version PyPI

💡 Result:

The latest pysam release on PyPI is 0.23.3 (uploaded June 10, 2025). [1]

---

Update cyvcf2 to 0.31.4 — Python 3.12.12 is current and secure (Oct 2025 security release), and vembrane 2.4.0 and pysam 0.23.3 are at their latest versions. However, cyvcf2 is pinned at 0.31.1 while the latest version is 0.31.4 (Oct 2025). Update the cyvcf2 entry to use 0.31.4.

🤖 Prompt for AI Agents

In `@workflow/envs/vembrane.linux-64.pin.txt` around lines 1 - 75, The cyvcf2
package is pinned to 0.31.1 in the `@EXPLICIT` list; update the cyvcf2 entry (the
line containing "cyvcf2-0.31.1-...") to reference version 0.31.4 instead and
replace the archived filename and checksum with the correct 0.31.4 artifact from
Bioconda so the explicit environment installs the newer release; ensure the
updated artifact is the linux-64 (or noarch) build that is compatible with
Python 3.12.12.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@workflow/envs/pysam.yaml`:
- Around line 6-9: The environment bumps pandas to 3.0.1 which introduces
breaking changes; audit any code that imports/uses pandas (calls to
pandas.read_csv / read_excel, DataFrame assignments/chained indexing, dtype
checks like .dtype or astype, datetime/timedelta parsing, timezone handling, and
any use of offset aliases 'M','Q','Y') and either adjust the code to the new
behaviors (avoid chained assignment or use .copy(), handle default string dtype
and mixed-type columns, adapt datetime resolution and zoneinfo tz handling,
replace offset aliases with 'ME','QE','YE', and ensure IO readers receive proper
file-like objects instead of raw bytes/strings) or pin pandas back to a 2.x
release in pysam.yaml; update tests that assert dtype/tz/offset behavior
accordingly.

---

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8711d42 and 2995a54.

📒 Files selected for processing (10)

• workflow/envs/picard.linux-64.pin.txt
• workflow/envs/pysam.linux-64.pin.txt
• workflow/envs/pysam.yaml
• workflow/envs/rtg-tools.linux-64.pin.txt
• workflow/envs/stats.linux-64.pin.txt
• workflow/envs/stats.yaml
• workflow/envs/tools.linux-64.pin.txt
• workflow/envs/tools.yaml
• workflow/envs/vembrane.linux-64.pin.txt
• workflow/envs/vembrane.yaml

🚧 Files skipped from review as they are similar to previous changes (7)

• workflow/envs/vembrane.linux-64.pin.txt
• workflow/envs/picard.linux-64.pin.txt
• workflow/envs/pysam.linux-64.pin.txt
• workflow/envs/tools.linux-64.pin.txt
• workflow/envs/rtg-tools.linux-64.pin.txt
• workflow/envs/stats.linux-64.pin.txt
• workflow/envs/stats.yaml

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

pandas 3.0 release breaking changes API

💡 Result:

Key pandas 3.0.0 (released Jan 21, 2026) breaking / behavior-changing API changes (non-exhaustive, but the big ones): [3]

Big semantic defaults that can break code

• Copy-on-Write (CoW) is now the default (and effectively the rule): any indexing/subsetting or method returning a new Series/DataFrame behaves like a copy from the user’s perspective; chained assignment will no longer work, and SettingWithCopyWarning is removed. pd.options.mode.copy_on_write no longer changes behavior. [1][2]
• Default string dtype changed: string-like data is now inferred as the dedicated str dtype (not object) when constructing/reading data; can break code that checks dtype == object, relies on mixed-object string columns, or assumes specific missing-value sentinels. [1][2]

Datetime / timezones

• Datetime/timedelta resolution is now inferred instead of always forcing nanoseconds: e.g. string parsing defaults to microseconds unless nanosecond precision is present; affects constructors and to_datetime, to_timedelta, date_range, Timestamp, etc. [1]
• Timezone objects from strings now default to zoneinfo (stdlib). pytz is optional and is no longer returned by default when you pass timezone strings. [1]
• Offset alias removals enforced: aliases like M, Q, Y, etc. are removed in favor of ME, QE, YE, etc. [1]
• pd.offsets.Day behavior changed: now always represents a calendar day across DST transitions (preserves local time-of-day), not a fixed 24-hour span. [1]

DataFrame/Series behavior changes

• pd.concat(..., sort=False) no longer ignores sort in certain DatetimeIndex cases (can change output ordering), and related internal concat sorting inconsistencies were fixed. [1]
• DataFrame.value_counts(sort=False) / GroupBy.value_counts(sort=False) ordering changed (more consistent “within-group” ordering; can change result order). [1]
• Nullable floating / pyarrow-backed NA handling changed: arithmetic-produced NaN in numpy-nullable/pyarrow floating dtypes is treated as missing (often becoming <NA>), and an experimental future option pd.options.future.distinguish_nan_and_na was introduced. [1]

Packaging / compatibility

• Python >= 3.11 required (dropping older versions). [1]
• __module__ for public API objects now points to public modules (can break doctests/introspection that compare __module__). [1]

Notable removals / stricter APIs (examples)

• Several IO readers (read_excel/read_json/read_html/read_xml) no longer accept raw string/bytes data directly; wrap with StringIO/BytesIO. [1]
• Series.__getitem__ / __setitem__ with integer keys now always treats integers as labels (not positional), aligning with DataFrame behavior. [1]
• read_csv(..., delim_whitespace=...) removed (use sep=r"\s+"). [1]

For the authoritative full list, see the “Backwards incompatible API changes” + “Removal of prior version deprecations/changes” sections in the 3.0.0 release notes. [1]

---

🌐 Web query:

Python 3.13.12 release

💡 Result:

Python 3.13.12 (the 12th maintenance/bugfix release in the Python 3.13 series) was released on February 3, 2026. [1][3]

Key details:

• It’s a bugfix / maintenance release (Python.org notes ~240 fixes/docs/build changes since 3.13.11). [1]
• The 3.13.12 final changelog entries are in the 3.13 docs changelog (e.g., fixes for Windows/PyREPL and tooling/tests). [5]
• Official downloads (Windows/macOS installers and source tarballs) are provided on the Python.org Python 3.13.12 release page. [1]

---

🌐 Web query:

pysam 0.23.3 Python 3.13 compatibility

💡 Result:

Yes—pysam 0.23.3 is compatible with Python 3.13.

• The 0.23.3 release notes (dated June 10, 2025) state it was tested with Python 3.8 through 3.13, and that PyPI wheels are available for all those versions. [1]
• PyPI’s file list for pysam 0.23.3 includes CPython 3.13 wheels (cp313) for manylinux_2_28 (x86_64, aarch64), musllinux_1_2 (x86_64, aarch64), and macOS (x86_64, arm64). [2]

Note: As of 0.23.3, wheels are provided for Linux and macOS; if you’re on Windows, you may need to build from source. [1]

Sources: [1] [2]

---

Review code for pandas 3.0 breaking changes.

pandas 3.0.1 is a major version bump (2.x → 3.x) with significant API changes that require code review:

• Copy-on-Write (CoW) is now default, breaking chained assignment patterns
• Default string dtype changed from object to str (affects dtype checks and mixed-type columns)
• Datetime/timedelta resolution now inferred instead of always nanoseconds
• Timezone objects default to zoneinfo instead of pytz
• Offset aliases removed (M, Q, Y → ME, QE, YE)
• IO readers (read_csv, read_excel, etc.) no longer accept raw strings/bytes directly

Verify any workflow scripts using this environment are compatible with these changes. Python 3.13.12 and pysam 0.23.3 are compatible with no issues.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@workflow/envs/pysam.yaml` around lines 6 - 9, The environment bumps pandas to
3.0.1 which introduces breaking changes; audit any code that imports/uses pandas
(calls to pandas.read_csv / read_excel, DataFrame assignments/chained indexing,
dtype checks like .dtype or astype, datetime/timedelta parsing, timezone
handling, and any use of offset aliases 'M','Q','Y') and either adjust the code
to the new behaviors (avoid chained assignment or use .copy(), handle default
string dtype and mixed-type columns, adapt datetime resolution and zoneinfo tz
handling, replace offset aliases with 'ME','QE','YE', and ensure IO readers
receive proper file-like objects instead of raw bytes/strings) or pin pandas
back to a 2.x release in pysam.yaml; update tests that assert dtype/tz/offset
behavior accordingly.