Update to GraphBLAS 10.3.1, drop Python 3.10, modernize packaging and CI

- Update SuiteSparse:GraphBLAS from 10.1.1 to 10.3.1
  - Regenerate headers (GPU_ID -> GPU_IDS, add NGPUS, PRINT_FUNCTION)
- Drop Python 3.10 support (minimum now 3.11)
- PEP 639: license = "Apache-2.0" with license-files
- Bump setuptools >= 77, numpy >= 1.24
- Update CI: cibuildwheel v2 -> v3.4, checkout v6, QEMU v4, create-pull-request v8
  - Enable PyPy and free-threading explicitly (CIBW_ENABLE)
  - Fix manylinux_2_28 package manager (dnf instead of yum)
- Update pre-commit hooks (black 26.3.1, isort 8.0.1, pyupgrade 3.21.2, etc.)
  - Add shellcheck, pygrep-hooks; enable check-executables-have-shebangs
- Fix shellcheck warnings in docker_build.sh and suitesparse.sh

Author: eriknw

.github/workflows/lint.yml

@@ -14,11 +14,11 @@ jobs:
     name: pre-commit-hooks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.10"
+          python-version: "3.11"
       - uses: pre-commit/action@v3.0.1

.github/workflows/test.yml

@@ -18,10 +18,10 @@ jobs:
         source: ["conda-forge"]
         # os: ["ubuntu-latest"]
         # source: ["source"]
-        python-version: [ "3.10", "3.11", "3.12", "3.13", "3.14"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
     - name: Checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0
         persist-credentials: false

.github/workflows/update_graphblas.yml

@@ -27,7 +27,7 @@ jobs:
     if: github.repository == 'GraphBLAS/python-suitesparse-graphblas' || github.repository == 'alugowski/python-suitesparse-graphblas'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -43,7 +43,7 @@ jobs:
         shell: bash
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           # See documentation: https://github.com/peter-evans/create-pull-request
           # Action behavior: https://github.com/peter-evans/create-pull-request#action-behaviour

.github/workflows/wheels.yml

@@ -34,7 +34,7 @@ jobs:
     name: Build SDist
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -64,8 +64,8 @@ jobs:
           # Linux x86 manylinux
           - os: ubuntu-latest
             cibw_archs: "x86_64"
-            # Python 3.12 wheel requires libffi-devel to be installed. manylinux container uses yum
-            cibw_before_build_linux: "yum install -y libffi-devel"
+            # manylinux_2_28 uses dnf (not yum). libffi-devel needed for Python 3.12+ cffi.
+            cibw_before_build_linux: "dnf install -y libffi-devel || yum install -y libffi-devel || true"
             # skip musllinux
             cibw_skip: "*musl*"
 
@@ -74,15 +74,15 @@ jobs:
           - os: ubuntu-latest
             cibw_archs: "x86_64"
             arch_note: "musl"
-            # skip manylinux (built elsewhere), PyPy (no musl numpy wheels), CPython 3.8 (no musl numpy wheels)
-            cibw_skip: "*many* pp* cp38*"
+            # skip manylinux (built elsewhere)
+            cibw_skip: "*many*"
 
           # Linux aarch64
           # Separate runner because this requires emulation (only x86 runners are available) and is very slow.
           - os: ubuntu-latest
             cibw_archs: "aarch64"
-            # numpy wheels not available for aarch64 PyPy or musllinux
-            cibw_skip: "pp* *musl*"
+            # numpy wheels not available for aarch64 musllinux
+            cibw_skip: "*musl*"
 
           # macOS x86
           # Note: keep as old as possible as due to libomp this will be the oldest supported macOS version.
@@ -95,7 +95,7 @@ jobs:
             cibw_archs: "arm64"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -104,7 +104,7 @@ jobs:
       # see https://cibuildwheel.readthedocs.io/en/stable/faq/#emulation
       - name: Setup QEMU (for aarch64)
         if: matrix.cibw_archs == 'aarch64'
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64
 
@@ -147,13 +147,16 @@ jobs:
           brew fetch --retry libomp && brew reinstall libomp
           echo MACOSX_DEPLOYMENT_TARGET=$(otool -l $(brew --prefix libomp)/lib/libomp.dylib | grep minos | awk '{print $2}') >> $GITHUB_ENV
 
-      - uses: pypa/cibuildwheel@v2.22
+      - uses: pypa/cibuildwheel@v3.4
         with:
           output-dir: wheelhouse
         env:
           # very verbose
           CIBW_BUILD_VERBOSITY: 3
 
+          # cibuildwheel v3: PyPy and free-threading no longer built by default
+          CIBW_ENABLE: "pypy cpython-freethreading"
+
           # Build SuiteSparse
           CIBW_BEFORE_ALL: bash suitesparse.sh ${{ env.GB_VERSION_REF }}
 
@@ -174,8 +177,7 @@ jobs:
           # Architectures to build specified in matrix
           CIBW_ARCHS: ${{ matrix.cibw_archs }}
 
-          # as of writing numpy does not support pypy 3.10
-          CIBW_SKIP: "${{ matrix.cibw_skip }} pp310*"
+          CIBW_SKIP: "${{ matrix.cibw_skip }}"
 
           # Use delvewheel on Windows.
           # This copies graphblas.dll into the wheel. "repair" in cibuildwheel parlance includes copying any shared
@@ -219,7 +221,7 @@ jobs:
           merge-multiple: true
 
       # Upload to PyPI
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@v1.13.0
         name: Upload to PyPI
         if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.upload_dest == 'PyPI')
         with:
@@ -229,7 +231,7 @@ jobs:
           password: ${{ secrets.PYPI_TOKEN }}
 
       # Upload to Test PyPI
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@v1.13.0
         name: Upload to Test PyPI
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.upload_dest == 'Test PyPI'
         with:

.pre-commit-config.yaml

@@ -13,12 +13,12 @@ repos:
     hooks:
       - id: check-added-large-files
       - id: check-case-conflict
+      - id: check-executables-have-shebangs
       - id: check-illegal-windows-names
       - id: check-merge-conflict
       - id: check-ast
       - id: check-toml
       - id: check-yaml
-      # - id: check-executables-have-shebangs
       - id: check-vcs-permalinks
       - id: debug-statements
       - id: destroyed-symlinks
@@ -31,26 +31,26 @@ repos:
       - id: name-tests-test
         args: ["--pytest-test-first"]
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.24.1
+    rev: v0.25
     hooks:
       - id: validate-pyproject
         name: Validate pyproject.toml
   - repo: https://github.com/PyCQA/autoflake
-    rev: v2.3.1
+    rev: v2.3.3
     hooks:
       - id: autoflake
         args: [--in-place]
   - repo: https://github.com/pycqa/isort
-    rev: 7.0.0
+    rev: 8.0.1
     hooks:
       - id: isort
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.21.0
+    rev: v3.21.2
     hooks:
       - id: pyupgrade
-        args: [--py310-plus]
+        args: [--py311-plus]
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 25.9.0
+    rev: 26.3.1
     hooks:
       - id: black
   - repo: https://github.com/PyCQA/flake8
@@ -62,7 +62,7 @@ repos:
         # These versions need updated manually
         - flake8==7.3.0
         - flake8-comprehensions==3.17.0
-        - flake8-bugbear==24.12.12
+        - flake8-bugbear==25.11.29
         # - flake8-simplify==0.22.0
   - repo: https://github.com/asottile/yesqa
     rev: v1.5.0
@@ -72,12 +72,24 @@ repos:
   # `pyroma` may help keep our package standards up to date if best practices change.
   # This is a "low value" check though and too slow to run as part of pre-commit.
   # - repo: https://github.com/regebro/pyroma
-  #   rev: "5.0"
+  #   rev: "5.0.1"
   #   hooks:
   #     - id: pyroma
   #       args: [-n, "10", .]
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: "v0.11.0.1"
+    hooks:
+      - id: shellcheck
+  - repo: https://github.com/pre-commit/pygrep-hooks
+    rev: v1.10.0
+    hooks:
+      - id: python-check-blanket-noqa
+      - id: python-check-blanket-type-ignore
+      - id: python-no-eval
+      - id: python-no-log-warn
+      - id: text-unicode-replacement-char
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.34.1
+    rev: 0.37.0
     hooks:
       - id: check-dependabot
       - id: check-github-workflows

GB_VERSION.txt

@@ -1 +1 @@
-10.1.1
+10.3.1

docker_build.sh

@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 if [ $# -eq 0 ]
     then
         echo "Usage: ./docker_build.sh SUITESPARSE_BRANCH VERSION [BRANCH LOCATION PUSH]
@@ -21,29 +22,29 @@ COMPACT=${COMPACT:-0}
 if [ "$LOCATION" = "clone" ]
 then
     TMPDIR=$(mktemp -d)
-    if [ ! -e $TMPDIR ]; then
+    if [ ! -e "$TMPDIR" ]; then
         >&2 echo "Failed to create temp directory"
         exit 1
     fi
     trap "exit 1"           HUP INT PIPE QUIT TERM
     trap 'rm -rf "$TMPDIR"' EXIT
 
-    cd $TMPDIR
-    git clone --branch $BRANCH https://github.com/GraphBLAS/python-suitesparse-graphblas.git
-    cd python-suitesparse-graphblas
+    cd "$TMPDIR" || exit
+    git clone --branch "$BRANCH" https://github.com/GraphBLAS/python-suitesparse-graphblas.git
+    cd python-suitesparse-graphblas || exit
 fi
 
 docker build \
-       --build-arg SUITESPARSE=${SUITESPARSE} \
-       --build-arg VERSION=${VERSION} \
-       --build-arg COMPACT=${COMPACT} \
-       -t $IMAGE:$VERSION \
+       --build-arg SUITESPARSE="${SUITESPARSE}" \
+       --build-arg VERSION="${VERSION}" \
+       --build-arg COMPACT="${COMPACT}" \
+       -t "$IMAGE:$VERSION" \
        .
 
-docker tag $IMAGE:$VERSION $IMAGE:latest
+docker tag "$IMAGE:$VERSION" "$IMAGE:latest"
 
 if [ "$PUSH" = "push" ]
 then
-    docker push $IMAGE:$VERSION
-    docker push $IMAGE:latest
+    docker push "$IMAGE:$VERSION"
+    docker push "$IMAGE:latest"
 fi

pyproject.toml

@@ -1,8 +1,7 @@
 [build-system]
 build-backend = "setuptools.build_meta"
 requires = [
-    # setuptools<74 until PyPy vendors cffi 1.15.1
-    "setuptools >=64, <74",
+    "setuptools >=77",
     "setuptools-git-versioning",
     "wheel",
     "cffi>=1.11",
@@ -17,8 +16,9 @@ name = "suitesparse-graphblas"
 dynamic = ["version"]
 description = "SuiteSparse:GraphBLAS Python bindings."
 readme = "README.md"
-requires-python = ">=3.10"
-license = {file = "LICENSE"}
+requires-python = ">=3.11"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
 authors = [
     {name = "Erik Welch", email = "erik.n.welch@gmail.com"},
     {name = "Jim Kitchen"},
@@ -47,13 +47,11 @@ keywords = [
 ]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
-    "License :: OSI Approved :: Apache Software License",
     "Operating System :: MacOS :: MacOS X",
     "Operating System :: POSIX :: Linux",
     "Operating System :: Microsoft :: Windows",
     "Programming Language :: Python",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -70,7 +68,7 @@ classifiers = [
 ]
 dependencies = [
     "cffi>=1.15",
-    "numpy>=1.23",
+    "numpy>=1.24",
 ]
 [project.urls]
 homepage = "https://github.com/GraphBLAS/python-suitesparse-graphblas"
@@ -96,7 +94,7 @@ dirty_template = "{tag}+{ccount}.g{sha}.dirty"
 
 [tool.black]
 line-length = 100
-target-version = ["py310", "py311", "py312", "py313", "py314"]
+target-version = ["py311", "py312", "py313", "py314"]
 
 [tool.isort]
 sections = ["FUTURE", "STDLIB", "THIRDPARTY", "FIRSTPARTY", "LOCALFOLDER"]

suitesparse.sh

@@ -10,9 +10,9 @@ elif [[ $1 =~ refs/tags/([0-9]*\.[0-9]*\.[0-9]*)\..*$ ]]; then
     VERSION=${BASH_REMATCH[1]}
 else
     echo "Specify a SuiteSparse version, such as: $0 refs/tags/7.4.3.0 (got: $1)"
-    exit -1
+    exit 1
 fi
-echo VERSION: $VERSION
+echo VERSION: "$VERSION"
 
 NPROC="$(nproc)"
 if [ -z "${NPROC}" ]; then
@@ -27,7 +27,8 @@ if [ -n "${BREW_LIBOMP}" ]; then
     cmake_params+=(-DOpenMP_C_FLAGS="-Xclang -fopenmp -I$(brew --prefix libomp)/include")
     cmake_params+=(-DOpenMP_C_LIB_NAMES="libomp")
     cmake_params+=(-DOpenMP_libomp_LIBRARY="omp")
-    export LDFLAGS="-L$(brew --prefix libomp)/lib"
+    LDFLAGS="-L$(brew --prefix libomp)/lib"
+    export LDFLAGS
 
     if [ -n "${SUITESPARSE_MACOS_ARCH}" ]; then
         export CFLAGS="-arch ${SUITESPARSE_MACOS_ARCH}"
@@ -50,12 +51,13 @@ if [ -n "${GRAPHBLAS_PREFIX}" ]; then
     cmake_params+=(-DCMAKE_INSTALL_PREFIX="${GRAPHBLAS_PREFIX}")
 fi
 
-curl -L https://github.com/DrTimothyAldenDavis/GraphBLAS/archive/refs/tags/v${VERSION}.tar.gz | tar xzf -
-cd GraphBLAS-${VERSION}/build
+curl -L "https://github.com/DrTimothyAldenDavis/GraphBLAS/archive/refs/tags/v${VERSION}.tar.gz" | tar xzf -
+cd "GraphBLAS-${VERSION}/build" || exit
 
 # Disable optimizing some rarely-used types for significantly faster builds and significantly smaller wheel size.
 # Also the build with all types enabled sometimes stalls on GitHub Actions. Probably due to exceeded resource limits.
 # These can still be used, they'll just have reduced performance (AFAIK similar to UDTs).
+# shellcheck disable=SC2129
 # echo "#define GxB_NO_BOOL      1" >> ../Source/GB_control.h #
 # echo "#define GxB_NO_FP32      1" >> ../Source/GB_control.h #
 # echo "#define GxB_NO_FP64      1" >> ../Source/GB_control.h #
@@ -74,6 +76,7 @@ if [ -n "${SUITESPARSE_FAST_BUILD}" ]; then
     echo "suitesparse.sh: Fast build requested."
     # Disable optimizing even more types. This is for builds that don't finish in runner resource limits,
     # such as emulated aarm64.
+    # shellcheck disable=SC2129
 
 #    echo "#define GxB_NO_BOOL      1" >> ../Source/GB_control.h
 #    echo "#define GxB_NO_FP32      1" >> ../Source/GB_control.h
@@ -93,6 +96,7 @@ fi
 if [ -n "${SUITESPARSE_FASTEST_BUILD}" ]; then
     echo "suitesparse.sh: Fastest build requested."
     # Fastest build possible. For use in development and automated tests that do not depend on performance.
+    # shellcheck disable=SC2129
 
     echo "#define GxB_NO_BOOL      1" >> ../Source/GB_control.h
     echo "#define GxB_NO_FP32      1" >> ../Source/GB_control.h
@@ -137,7 +141,7 @@ else
 fi
 
 cmake .. -DCMAKE_BUILD_TYPE=Release -G 'Unix Makefiles' "${cmake_params[@]}"
-make -j$NPROC
+make -j"$NPROC"
 $SUDO make install
 
 if [ -n "${CMAKE_GNUtoMS}" ]; then