Chore: upgrade dependencies, add upgrade sklill (#56)

Author: voj

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.4.0
+current_version = 0.4.1
 commit = True
 tag = False
 

.claude/skills/python-upgrade/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: python-upgrade
+description: Audit and upgrade Python dependencies to fix vulnerabilities and apply patch-level updates, with test verification.
+allowed-tools: Bash, Read, Edit, Write, Agent, WebFetch, WebSearch
+user-invocable: true
+---
+
+Our Python dependencies have vulnerabilities that we want to fix by upgrading.
+
+## Setup
+
+Switch to git branch "chore/upgrade", creating it if it doesn't exist.
+Start with `poetry sync --with dev` to be up to date with the lock file.
+
+## Auditing
+
+- Run `poetry run pip-audit` to list vulnerabilities.
+- Run `poetry show --outdated` to see packages that can be upgraded in general.
+
+## Upgrading
+
+- Use `poetry update <package-name>` to upgrade a dependency within the version range in pyproject.toml.
+- Use `poetry add <package>` to upgrade a package to something outside the version range in pyproject.toml.
+- Avoid code changes unless the fix is trivial (e.g., an import path change). If code changes are needed, note them in the summary.
+- Transitive dependencies can be upgraded if they have a security vulnerability. Note any upgraded transitive dependencies in the summary.
+- Ask before upgrading pinned versions.
+
+## Severity lookup
+
+Severity information for each vulnerability can be found like so https://github.com/advisories?query=CVE-2025-14009. Look up each advisory to determine its severity (critical, high, medium, low).
+
+## Upgrade strategy
+
+1. Run `pip-audit` and collect all vulnerabilities.
+2. Look up the severity of each vulnerability.
+3. Display a plan as a table showing each vulnerability with: package name, current version, fixed version, advisory ID, severity, depndency group (for exmaple "dev"), and the semantic version increase required.
+4. Sort the plan by: severity (critical first), then by smallest semantic version increase first.
+5. Perform all upgrades in the plan.
+6. Run `poetry run pytest` to see if the upgrades were successful.
+7. If all tests passed, perform all other outstanding upgrades if they are at patch level and within pyproject.toml ranges.
+8. Run `poetry run pytest` to see if all upgrades were successful.
+9. If any upgrade fails or if any test fails, roll back all changes with `git checkout -- poetry.lock pyproject.toml && poetry sync --with dev` and use the "Careful Upgrade Strategy".
+
+## Careful Upgrade Strategy
+
+1. Use this strategy if the general upgrade strategy fails.
+2. Use the plan created by the general upgrade strategy.
+3. Upgrade dependencies **one by one**, running `poetry run pytest` after each upgrade to ensure everything still works.
+4. If a test fails after an upgrade, revert that upgrade and move on to the next one. Note which upgrades were skipped and why.
+5. It might not be possible to upgrade all dependencies. Use your best effort.
+
+Think hard about dependency interactions and potential breaking changes.
+
+## Integration test
+
+After all achievable upgrades are complete, run a final integration test by starting the local server and sending a test GraphQL query:
+
+1. Run `yarn install` if node_modules are not present.
+2. Temporarily change `pythonBin: python3` to `pythonBin: python` in `serverless.yml` (needed for Windows compatibility).
+3. Start the server in the background, wait for it to be ready, then send a query:
+
+```bash
+ENABLE_METRICS=0 poetry run yarn sls wsgi serve > /tmp/server.log 2>&1 &
+SERVER_PID=$!
+```
+
+Then in a separate command, poll the log file until the server is ready before sending the query. The server is ready when the log contains "Serving on". Retry up to 10 times with 3-second sleeps:
+
+```bash
+for i in $(seq 1 10); do
+  if grep -q "Serving on" /tmp/server.log 2>/dev/null; then
+    echo "Server is ready"
+    break
+  fi
+  echo "Waiting for server... (attempt $i)"
+  sleep 3
+done
+
+cat /tmp/server.log
+
+curl -s -X POST http://localhost:5000/graphql \
+  -H "Content-Type: application/json" \
+  -d '{"query": "{ version about get_models { version } }"}' 2>&1
+```
+
+If the server log does not contain "Serving on" after all retries, print the log contents and report the failure instead of sending the query.
+
+Then clean up:
+
+```bash
+kill $SERVER_PID 2>/dev/null
+```
+
+4. Verify the response contains valid `version`, `about`, and `get_models` data.
+5. Revert the `pythonBin` change in `serverless.yml` back to `python3`.
+
+## Bump version
+
+When done, create a commit and bump the version with
+
+```bash
+poetry run bump2version patch
+```

.gitignore

@@ -114,5 +114,7 @@ ENV/
 
 # mkdocs build dir
 site/
+
 node_modules
-node_modules
+.yarn/install-state.gz
+.claude/settings.local.json

CLAUDE.md

@@ -0,0 +1,74 @@
+# CLAUDE.md
+
+## Project Overview
+
+A GraphQL API exposing New Zealand Seismic Hazard Model (NSHM) data via AWS Lambda. Built with Python/Flask/Graphene, deployed using Serverless Framework v4.
+
+## Common Commands
+
+```bash
+# Install dependencies
+yarn install
+poetry install
+
+# Run tests
+poetry run pytest
+poetry run pytest tests/test_schema_models.py          # single test file
+poetry run pytest tests/test_schema_models.py::test_fn  # single test function
+poetry run pytest --cov                                 # with coverage
+
+# Lint & format
+poetry run black nshm_model_graphql_api tests
+poetry run isort nshm_model_graphql_api tests
+poetry run flake8 nshm_model_graphql_api tests
+poetry run mypy nshm_model_graphql_api tests
+
+# Full CI suite via tox
+tox                    # all environments: audit, py312, format, lint, build
+tox -e py312           # tests only
+tox -e lint            # lint only
+
+# Local dev server (port 5000)
+ENABLE_METRICS=0 poetry run yarn sls wsgi serve
+
+# Deploy
+AWS_PROFILE=<profile> poetry run yarn sls deploy --region ap-southeast-2 --stage dev
+```
+
+## Architecture
+
+**Query-only GraphQL API** — no mutations. The API wraps the `nzshm-model` Python library, which contains the actual NSHM data.
+
+### Schema Structure (`nshm_model_graphql_api/schema/`)
+
+- `schema_root.py` — Root query type with top-level resolvers (`get_models`, `get_model`, `current_model_version`, `about`, `version`, `node`)
+- `nshm_model_schema.py` — `NshmModel` type with nested `source_logic_tree` and `gmm_logic_tree`
+- `nshm_model_sources_schema.py` — Source logic tree types: `SourceLogicTree` → `SourceBranchSet` → `SourceBranch` → `InversionSource`/`DistributedSource`
+- `nshm_model_gmms_schema.py` — Ground motion model logic tree types: `GmmLogicTree` → `GmmBranchSet` → `GmmBranch`
+
+All types implement Relay's `Node` interface for global ID-based lookups. Resolvers use `@functools.lru_cache` for expensive data fetches.
+
+### Flask App
+
+`nshm_model_graphql_api/nshm_model_graphql_api.py` — Flask app factory. Serves GraphQL at `/graphql` (POST for queries, GET for GraphiQL interface).
+
+### Deployment
+
+Serverless Framework v4 deploys to AWS Lambda (Python 3.12, 2048MB, 10s timeout) in `ap-southeast-2`. API Gateway provides HTTP endpoints with API key auth on POST.
+
+- `serverless.yml` — Lambda functions, API Gateway routes, WSGI config
+- `package.json` — Serverless CLI and plugins (serverless-wsgi, serverless-plugin-warmup)
+
+## Tech Stack
+
+- **Runtime**: Python 3.12, Node 22 (for Serverless CLI)
+- **Package managers**: Poetry (Python), Yarn v4 (Node)
+- **Testing**: pytest with Graphene test Client
+- **CI/CD**: GitHub Actions (`.github/workflows/`) — tests on PR, deploy on merge to main
+- **Version management**: bump2version syncs version across `pyproject.toml`, `package.json`, `__init__.py`
+
+## Configuration
+
+- `pyproject.toml` — Poetry dependencies and project metadata
+- `setup.cfg` — pytest, coverage, flake8, mypy, tox, isort settings
+- `.bumpversion.cfg` — version bump targets

nshm_model_graphql_api/__init__.py

@@ -2,4 +2,4 @@
 
 __author__ = """GNS Science"""
 __email__ = "nshm@gns.cri.nz"
-__version__ = "0.4.0"
+__version__ = "0.4.1"

package.json

@@ -1,6 +1,6 @@
 {
     "name": "nshm-model-graphql-api",
-    "version": "0.4.0",
+    "version": "0.4.1",
     "description": "A graphql API for NSHM seismic models",
     "scripts": {
         "test": "echo \"Error: no test specified\" && exit 1",