Release notes for sbmlutils 0.17.1

We are pleased to release the next version of sbmlutils including the following changes. This is a dependency and security release: the examples extra requires pillow>=13.0.0, which fixes the advisories of pillow 12.3.0, and the lock moves the development tools virtualenv and filelock to fixed releases and every other package to its newest release.

Security

• pillow>=13.0.0 is a dependency of the examples extra: matplotlib writes its images with pillow, which reaches a user of sbmlutils[examples], and pillow 13.0.0 fixes the advisories of 12.3.0 (GHSA-332p-7hrc-92wf, GHSA-8g5g-8vmr-9782, GHSA-v9pv-5gc8-w2m6, GHSA-w889-685w-c8fh and 25 more); the lock has pillow 13.0.0 instead of 12.3.0 (#518)
• the lock of the development environment, uv.lock, has virtualenv 21.15.2 instead of 21.14.1, which fixes the advisories of virtualenv before 21.14.9 (GHSA-394h-qwmc-48pf, GHSA-43mp-35q3-x3fq, GHSA-5vjq-rrrf-7h2q and more), and filelock 4.2.6 instead of 4.0.7, which fixes the advisories of filelock before 4.2.1 (GHSA-v4x8-3wr5-3wq8, GHSA-j8f7-rjxc-mr56 and more); both reach only the development environment, through tox, virtualenv and pre-commit, so the dependencies of sbmlutils are unchanged (#514, #518)

Packaging and development

• dependency updates in the lock: pymetadata 0.8.3, antimony 3.3.0, sbmlode 0.3.1, pint 0.26.2, numpy 2.5.4, certifi 2026.10.23, libroadrunner 2.11.0, ruff 0.17.3, ty 0.0.95, pytest 9.2.0, pre-commit 4.7.0, bump-my-version 1.8.1, zensical 0.0.74, mkdocstrings-python 2.0.10 and the newest releases of the other packages; the lower bounds in pyproject.toml are unchanged except for pillow (#514, #517, #518)
• the dev extra excludes tox 4.67.5 (tox>=4.61.2,!=4.67.5), the lock keeps tox 4.67.4: tox 4.67.5 refuses its package staging directory when tox created it under umask 002, so every environment of tox run-parallel fails with an internal error (tox-dev/tox#4357)
• the pre-commit hooks of ruff and ty follow the locked versions, ruff 0.17.3 and ty 0.0.95 (#516, #518)
• continuous integration uses the newest releases of its github actions (#515)