numpy 2.5.3 + manifold3d 3.5.3 (supersedes #516, #517) — the floors had to move in both files

[ibuilder]

What & why

Raises numpy to >=2.5.3 and manifold3d to >=3.5.3, and moves the lock to match. Supersedes #516 and #517, dependabot's PRs for these same two floors, both of which fail the API test gate and could never have passed alone.

Why neither dependabot PR could work

The reason is written in the file they were editing. services/api/requirements.in carries it on the numpy line itself:

numpy>=2.5.2 # floor raised WITH services/data/requirements.txt: pip-compile reads
# only this file, so a floor raised only there cannot move the lock

Dependabot edits services/data/requirements.txt. pip-compile never reads it. So the lock kept pinning numpy==2.5.2 / manifold3d==3.5.2, while test_lock_satisfies_requirements — which deliberately reads both requirements files, because the API image runs the data service's code while installing only the API's lock — kept failing on the mismatch.

That is structural, not incidental. No rebase, recreate or re-run could have fixed either PR; the floor had to move in both files at once.

What moved

Exactly two pins. Nothing added, nothing removed.

manifold3d  3.5.2 -> 3.5.3
numpy       2.5.2 -> 2.5.3

Predicted from a measurement before the change was made, then confirmed by CI: lockfile.yml's Verify step has passed on the committed bytes (run 34766807906), which is byte-identity against a fresh compile in python:3.12-slim.

Both versions were checked to exist on PyPI with cp312 manylinux wheels before relying on them.

A note on where the lock came from, because it reverses the previous PR

#546 took its lock bytes by transcribing CI's Verify diff, because a local resolve had produced an unrecognisable 34-package answer. This PR compiles locally. The reversal is deliberate and rests on the correction landed in #546: pip-compile treats an existing output file as constraints and moves only what the inputs force, while a fresh output path preserves nothing and re-resolves the world. Compiled in place, against the real lock, the local tool is the same tool CI runs — and Verify confirms it on a lock with hundreds of hash lines, not just alembic's two.

The clock said it before the diff did. The fresh-path compile took over forty minutes; the in-place compile took thirty-nine seconds, because it only fetched what actually moved. Two runs of "the same" command differing sixty-fold in cost were never the same command.

Transcription was not available here regardless: Verify prints head -60 of its diff, which alembic's two hashes fit inside and manifold3d's dozens of wheel hashes do not, and the artifact with the full file sits behind an egress block in this environment. Both routes end at the same gate, which is what makes either one safe.

Checklist (mirrors CONTRIBUTING.md)

• Backend: no Python source changed; test_lock_satisfies_requirements, test_declared_imports and test_desktop_paths pass locally
• Backend: affected test_*.py pass
• Web: untouched by this change
• No import cycles introduced (no source change)
• CHANGELOG.md entry added (newest at top)
• Version bump — not a release PR
• No secrets, no competitor names in shipped docs

🤖 Generated with Claude Code

https://claude.ai/code/session_01Tt2XKB83wwNt2nrMbK6eEA

---

Generated by Claude Code

Summary by CodeRabbit

• Documentation

  • Added changelog details covering recent maintenance updates, lock-file verification, CI comparisons, and known limitations in reproducing CI output.

• Maintenance

  • Updated supported package versions for the API and data services to ensure compatibility with the latest approved releases.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 19b8a07e-8163-4275-b61c-959060e4b434

📥 Commits

Reviewing files that changed from the base of the PR and between 1bd706a and 9ef9ed9.

⛔ Files ignored due to path filters (1)

• services/api/requirements.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• CHANGELOG.md
• services/api/requirements.in
• services/data/requirements.txt

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The dependency floors for NumPy and manifold3d were raised in the API and data requirements files. The changelog records the lock recompilation and verification details.

Changes

Dependency update

Layer / File(s)	Summary
Raise dependency floors services/api/requirements.in, services/data/requirements.txt	NumPy now requires at least 2.5.3, and manifold3d now requires at least 3.5.3 in both dependency files.
Record recompilation verification CHANGELOG.md	The changelog documents the corrected requirements, two-pin recompilation, local and CI lock verification, compile-time differences, and CI output limitations.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: claude

Merge Risk: ⚪ Minimal · up to 9ef9e

The dependency floors and lockfile updates are aligned and verified, with no actionable merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the two dependency floor changes and explains that both requirements files needed updates. It is somewhat long, but it remains specific and relevant.
Description check	✅ Passed	The description includes the required What & why section, explains the dependency and lockfile changes, documents the superseded PRs, and provides a completed checklist with appropriate exceptions for…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/codebase-audit-roadmap-45656d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 28 pull requests, surfaced 3 security issues (1 critical/high) and blocked 2 risky merges across this workspace.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing