DAS-2466: Address vulnerabilities in urllib3

.github/workflows/publish_release.yml

@@ -78,10 +78,10 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
-      - name: Set up Python 3.11
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: '3.11'
+          python-version: '3.12'
 
       - name: Install build package
         run: |

.pre-commit-config.yaml

@@ -2,15 +2,15 @@ ci:
   autofix_prs: false
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-json
       - id: check-yaml
       - id: check-added-large-files
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.0
+    rev: v0.14.10
     hooks:
       - id: ruff
         args: ["--fix", "--show-fixes"]

.snyk

@@ -1,4 +1,4 @@
 # Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
 version: v1.25.0
 language-settings:
-  python: "3.11"
+  python: "3.12"

CHANGELOG.md

@@ -4,14 +4,16 @@ HyBIG follows semantic versioning. All notable changes to this project will be
 documented in this file. The format is based on [Keep a
 Changelog](http://keepachangelog.com/en/1.0.0/).
 
-## [vX.Y.Z] - Unreleased
+## [v2.5.1] - 2026-01-06
 
 ### Changed
 
 * GitHub release notes for HyBIG will now include the commit history for that
   release.
 
-## [v2.5.0] - Unreleased
+* Service libraries updated to address vulnerabilities.
+
+## [v2.5.0] - 2026-12-03
 
 ### Changed
 
@@ -144,6 +146,9 @@ For more information on internal releases prior to NASA open-source approval,
 see legacy-CHANGELOG.md.
 
 [unreleased]: https://github.com/nasa/harmony-browse-image-generator/
+[v2.5.1]: https://github.com/nasa/harmony-browse-image-generator/releases/tag/2.5.1
+[v2.5.0]: https://github.com/nasa/harmony-browse-image-generator/releases/tag/2.5.0
+[v2.4.2]: https://github.com/nasa/harmony-browse-image-generator/releases/tag/2.4.2
 [v2.4.1]: https://github.com/nasa/harmony-browse-image-generator/releases/tag/2.4.1
 [v2.4.0]: https://github.com/nasa/harmony-browse-image-generator/releases/tag/2.4.0
 [v2.3.0]: https://github.com/nasa/harmony-browse-image-generator/releases/tag/2.3.0

README.md

@@ -249,6 +249,7 @@ also with units of degrees.
 ## Repository structure:
 
 ```
+|- .snyk
 |- 📂 bin
 |- 📂 docker
 |- 📂 docs
@@ -267,6 +268,12 @@ also with units of degrees.
 
 ```
 
+* `.snyk` - A file used by the Snyk webhook to ensure the correct version of
+  Python is used when installing the full dependency tree for the project. This
+  file is duplicated in each directory that contains a requirements
+  file. (`./docs`, `./tests`) **This file, and all copies, must be updated when
+  the version of Python is updated in the service Docker image.**
+
 * `bin` - A directory containing utility scripts to build the service and test
   images. A script to extract the release notes for the most recent version, as
   contained in `CHANGELOG.md` is also in this directory.
@@ -336,7 +343,7 @@ independent of the main Harmony application:
 
 
 ```
-> conda create --name hybig-env python==3.11
+> conda create --name hybig-env python==3.12
 > pip install -r pip_requirements.txt -r pip_requirements_skip_snyk.txt
 > pip install -r dev-requirements.txt
 

docker/service_version.txt

@@ -1 +1 @@
-2.5.0
+2.5.1

docs/.snyk

@@ -0,0 +1,4 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.0
+language-settings:
+  python: "3.12"

docs/requirements.txt

@@ -1,2 +1,2 @@
-notebook==7.2.2
-harmony-py~=0.4.14
+notebook~=7.5.1
+harmony-py~=1.3.3

pip_requirements.txt

@@ -1,4 +1,4 @@
-harmony-service-lib~=2.0.0
+harmony-service-lib~=2.11.0
 matplotlib==3.9.0
 numpy==1.26.4
 pillow==10.4.0

tests/.snyk

@@ -0,0 +1,4 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.0
+language-settings:
+  python: "3.12"