fix(ml): corrige le build MLflow (psycopg2), le garde-fou Makefile, la doc et la fuite de mot de passe

fix(ml): applique les corrections de la review MLflow (securite, documentation, robustesse)
Merge remote-tracking branch 'origin/dev' into feat/registry-modele-prediction
2026-09-22 15:04:21 +02:00 · 2026-09-22 10:41:02 +02:00 · 2026-09-22 10:11:24 +02:00 · 2026-09-22 09:13:03 +02:00 · 2026-09-22 09:05:53 +02:00 · 2026-09-22 09:05:50 +02:00
36 changed files with 1062 additions and 1034 deletions
@@ -29,15 +29,18 @@ APP_MOCK_API_USERNAME=change_me
 APP_MOCK_API_PASSWORD=change_me
 APP_MOCK_API_TIMEOUT_SECONDS=10
-# Airflow (webserver + scheduler, LocalExecutor). Base de métadonnées dédiée `airflow` dans le
+# Airflow (api-server + scheduler + dag-processor, LocalExecutor). Base de métadonnées dédiée `airflow` dans le
 # même conteneur `db` (cf. db/init/120-airflow-database.sql), pas un conteneur de plus.
 AIRFLOW_PORT=8080
 # Chiffre les connexions/variables stockées par Airflow. Générer la vôtre :
 # python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
 AIRFLOW_FERNET_KEY=change_me
-# Clé Flask du webserver Airflow (signature de session), distincte de la précédente. Générer la
+# Clé de session de l'api-server Airflow, distincte de la précédente. Générer la
 # vôtre : python -c "import secrets; print(secrets.token_urlsafe(48))"
-AIRFLOW_WEBSERVER_SECRET_KEY=change_me
+AIRFLOW_API_SECRET_KEY=change_me
 # Secret des jetons JWT entre scheduler, tâches et api-server (conteneurs distincts, le secret
 # doit être partagé). Même générateur que ci-dessus.
 AIRFLOW_JWT_SECRET=change_me
 AIRFLOW_ADMIN_USERNAME=admin
 # Compte Airflow créé au premier démarrage (service `airflow-init`), sans rapport avec les
 # comptes `app_user` d'EnerVision.
@@ -10,6 +10,15 @@ updates:
      frontend-dependencies:
        patterns:
          - "*"
    ignore:
      # Pourquoi : @angular/build épingle typescript (>=6.0 <6.1) et vitest (^4). Une majeure
      # de l'un ou l'autre casse `npm ci` tant qu'Angular ne suit pas.
      - dependency-name: "typescript"
        update-types: ["version-update:semver-major"]
      - dependency-name: "vitest"
        update-types: ["version-update:semver-major"]
      - dependency-name: "@vitest/coverage-v8"
        update-types: ["version-update:semver-major"]
  # Backend — uv (lit pyproject.toml / uv.lock)
  - package-ecosystem: "uv"
@@ -1,8 +1,9 @@
 name: Airflow
 # Piège : la version de Python vient de etl/airflow/.python-version. C'est 3.12 et non 3.14
-# (contrairement à backend.yml et ml.yml) : apache-airflow 2.10 ne supporte pas 3.14. Le 3.14 de
+# (contrairement à backend.yml et ml.yml) : celui de l'image apache/airflow retenue, et les tests
-# ml/ ne vit que dans l'image Docker, dans son propre environnement (cf. etl/airflow/Dockerfile).
+# doivent tourner sur le même interpréteur qu'elle. Le 3.14 de ml/ ne vit que dans l'image
 # Docker, dans son propre environnement (cf. etl/airflow/Dockerfile).
 #
 # Piège : l'image COPY les fichiers de dépendances et le code de ml/ et de apps/backend/. Une
 # modification de l'un ou de l'autre peut donc casser sa construction, d'où ces chemins dans
@@ -47,10 +48,10 @@ jobs:
    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: etl/airflow/uv.lock
@@ -78,7 +79,7 @@ jobs:
    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
      - name: Construit l'image (contexte à la racine, elle COPY ml/ et apps/backend/)
        run: docker build -f etl/airflow/Dockerfile -t enervision-airflow:ci .
@@ -30,10 +30,10 @@ jobs:
    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -90,10 +90,10 @@ jobs:
    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -126,10 +126,10 @@ jobs:
    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -150,12 +150,12 @@ jobs:
    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
      # Pourquoi : pas de cache ici. uvx n'installe pas le projet, le verrou n'alimente donc
      # aucune clé de cache ; la seule roue téléchargée est celle de Bandit.
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
      # Pourquoi : le périmètre est `app`, le code livré. Les tests emploient légitimement des
      # secrets factices et des `assert` que Bandit signalerait sans qu'aucun n'atteigne la prod.
@@ -17,10 +17,10 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json
@@ -33,10 +33,10 @@ jobs:
    name: Audit des dépendances
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
      # Seuil high : une vulnérabilité moderate de devDependency ne doit pas bloquer une livraison.
      - run: npm audit --audit-level=high --package-lock-only
        working-directory: apps/frontend
@@ -45,10 +45,10 @@ jobs:
    needs: build
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json
      - name : Installation des dépendances (Front)
@@ -58,7 +58,7 @@ jobs:
        run: npm test --watch=false --code-coverage --coverageReporters=lcov
        working-directory: apps/frontend
      - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: frontend-coverage
          path: apps/frontend/coverage/frontend/lcov.info
@@ -30,10 +30,10 @@ jobs:
    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: ml/uv.lock
@@ -67,12 +67,12 @@ jobs:
    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
      # Pourquoi : pas de cache ici. uvx n'installe pas le projet, le verrou n'alimente donc
      # aucune clé de cache ; la seule roue téléchargée est celle de Bandit.
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
      - name: Analyse le code livré (bloquant à partir de MEDIUM)
        run: uvx bandit==1.9.4 --recursive enervision_ml --severity-level medium --confidence-level medium
@@ -24,10 +24,10 @@ jobs:
  build-front:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json
@@ -40,10 +40,10 @@ jobs:
    needs: build-front
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json
@@ -56,7 +56,7 @@ jobs:
        working-directory: apps/frontend
      - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: frontend-coverage
          path: apps/frontend/coverage/frontend/lcov.info
@@ -64,9 +64,9 @@ jobs:
  build-back:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -95,9 +95,9 @@ jobs:
    needs: build-back
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -107,7 +107,7 @@ jobs:
        working-directory: apps/backend
      - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: backend-coverage
          path: apps/backend/coverage.xml
@@ -115,9 +115,9 @@ jobs:
  test-ml:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: ml/uv.lock
@@ -135,7 +135,7 @@ jobs:
        working-directory: ml
      - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: ml-coverage
          path: ml/coverage.xml
@@ -143,23 +143,26 @@ jobs:
  sonarqube:
    needs: [build-front, build-back, test-front, test-back, test-ml]
    name: SonarQube
    # Pourquoi : GitHub ne fournit pas les secrets aux workflows lancés par dependabot[bot].
    # Sans SONAR_TOKEN le scan échoue sans rien analyser ; build et tests restent joués.
    if: github.actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Téléchargement du rapport de couverture (Front)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: frontend-coverage
          path: apps/frontend/coverage/frontend
      - name: Téléchargement du rapport de couverture (Back)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: backend-coverage
          path: apps/backend
      - name: Téléchargement du rapport de couverture (ML)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: ml-coverage
          path: ml
@@ -64,7 +64,8 @@ ml/models/*
 !ml/models/.gitkeep
 ml/mlruns/
 ml/mlartifacts/
-ml/mlflow.db
+ml/mlflow.db*
 ml/.env
 # Airflow : base sqlite locale generee par les tests d'integrite des DAGs (etl/airflow/tests)
 etl/airflow/tests/.airflow_home/
@@ -20,6 +20,8 @@ PG_USER := $(or $(strip $(call env-val,POSTGRES_USER)),enervision)
 PG_PASSWORD := $(or $(strip $(call env-val,POSTGRES_PASSWORD)),change_me)
 PG_DB := $(or $(strip $(call env-val,POSTGRES_DB)),enervision)
 PG_PORT := $(or $(strip $(call env-val,POSTGRES_PORT)),5433)
 ml-env-val = $(shell sed -n 's/^$(1)=//p' ml/.env 2>/dev/null | tail -1)
 ML_ENV_DB_PASSWORD := $(call ml-env-val,MLFLOW_DB_PASSWORD)
 AIRFLOW_PORT := $(or $(strip $(call env-val,AIRFLOW_PORT)),8080)
 MAILPIT_UI_PORT := $(or $(strip $(call env-val,MAILPIT_UI_PORT)),8025)
 ML_DATABASE_URL ?= postgresql+psycopg://$(PG_USER):$(PG_PASSWORD)@localhost:$(PG_PORT)/$(PG_DB)
@@ -35,7 +37,7 @@ DEMO_NOW ?= 2024-12-31T00:00:00Z
        lint format typecheck test test-cov test-integration check \
        openapi docker-build db-up db-down db-reset db-logs db-psql db-wait db-ensure-airflow \
        migrate bootstrap-admin services-up demo-data demo-data-force \
-        ml-lint ml-typecheck ml-test ml-check ml-train ml-score detect-alerts recommendations \
+        ml-lint ml-typecheck ml-test ml-check ml-train ml-score mlflow-up detect-alerts recommendations \
        airflow-lint airflow-test airflow-check airflow-up airflow-down airflow-logs \
        tls-selfsigned tls-acme tls-renew stack-up stack-down stack-logs
@@ -118,6 +120,14 @@ ml-train: ## Entraine le modele LightGBM. CSV=chemin optionnel, sinon lit ML_DAT
 ml-score: ## Score le prochain pas horaire et l'ecrit dans `prediction`. CSV= et NOW= optionnels
 	cd $(ML) && uv run python -m enervision_ml.score $(if $(CSV),--csv $(CSV),) $(if $(NOW),--now $(NOW),)
 mlflow-up: ## Démarre le serveur MLflow (tracking + registry) en conteneur. ml/.env requis
 	@test -n "$(strip $(ML_ENV_DB_PASSWORD))" \
 		|| { echo "MLFLOW_DB_PASSWORD absente de ml/.env (copier ml/.env.example)"; exit 1; }
 	@echo "$(ML_ENV_DB_PASSWORD)" | grep -qE '^[A-Za-z0-9]+$$' \
 		|| { echo "MLFLOW_DB_PASSWORD doit contenir uniquement lettres et chiffres (interpolee dans l'URI postgresql://)"; exit 1; }
 	cd $(ML) && docker compose -f docker-compose.mlflow.yml up -d --build
 	@echo "mlflow   -> http://localhost:5000"
 detect-alerts: ## Détecte les alertes internes depuis les lectures en base. SITE= et NOW= optionnels
 	cd $(BACKEND) && uv run python -m app.detection.internal_alerts $(if $(SITE),--site-id $(SITE),) $(if $(NOW),--now $(NOW),)
@@ -132,12 +142,12 @@ airflow-test: ## Verifie que les DAGs s'importent sans erreur et ont la structur
 airflow-check: airflow-lint airflow-test ## Chaîne de vérification complète des DAGs Airflow
-airflow-up: db-ensure-airflow ## Démarre Airflow (webserver + scheduler, LocalExecutor). db-up requis avant.
+airflow-up: db-ensure-airflow ## Démarre Airflow (api-server + scheduler + dag-processor, LocalExecutor). db-up requis avant.
-	docker compose up -d airflow-init airflow-webserver airflow-scheduler
+	docker compose up -d airflow-init airflow-apiserver airflow-scheduler airflow-dag-processor
 	@echo "airflow  -> http://localhost:$${AIRFLOW_PORT:-8080}"
-airflow-down: ## Arrête le webserver et le scheduler Airflow
+airflow-down: ## Arrête l'api-server, le scheduler et le dag-processor Airflow
-	docker compose stop airflow-webserver airflow-scheduler
+	docker compose stop airflow-apiserver airflow-scheduler airflow-dag-processor
 airflow-logs: ## Suit les journaux du scheduler Airflow (où tournent les tâches, LocalExecutor)
 	docker compose logs -f airflow-scheduler
@@ -9,8 +9,10 @@ series temporelles energetiques, deployee sur une machine on-premise.
 |-------|----------------------------------------------------------|
 | J1    | Valider la préparation de l'environnement et du repo     |
 | J2    | Valider le périmètre retenu et les choix technologiques  |
-| J3    | Valider l'architecture et la gestion de la sécurité      |
+| J3    | Ingestion & backend                                      |
-| J4    | Valider la robustesse et assurer les livrables           |
+| J4    | Architecture, sécurité & frontend                        |
 | J5    | Valider la robustesse et assurer les livrables           |
 | J6    | Amélioration possible                                    |
 Ce que la documentation apporte à chacun : [docs/architecture/00-vue-ensemble.md](docs/architecture/00-vue-ensemble.md).
@@ -18,15 +20,15 @@ Ce que la documentation apporte à chacun : [docs/architecture/00-vue-ensemble.m
 | Domaine    | Technologie                         | Emplacement         | Etat          |
 |------------|-------------------------------------|---------------------|---------------|
-| Backend    | FastAPI, Python 3.14                | `apps/backend`      | Initialise    |
+| Backend    | FastAPI, Python 3.14                | `apps/backend`      | En place    |
-| Frontend   | Angular 22, Node 24 LTS             | `apps/frontend`     | Tableau de bord |
+| Frontend   | Angular 22, Node 26                 | `apps/frontend`     | En place |
-| Base       | PostgreSQL 17 + TimescaleDB         | `db`                | Initialise    |
+| Base       | PostgreSQL 17 + TimescaleDB         | `db`                | En place    |
 | ETL        | Apache Airflow                      | `etl/airflow`       | Quatre DAGs   |
 | Infra      | Terraform (k3s single-node)         | `infra/terraform`   | Initialise    |
 | Reverse proxy | Nginx, TLS                       | `infra/proxy`       | En place      |
-| CI/CD      | GitHub Actions                      | `.github/workflows` | Backend en place |
+| CI/CD      | GitHub Actions                      | `.github/workflows` | En place |
 | Monitoring | Prometheus, Grafana, Alertmanager   | `monitoring`        | A initialiser |
-| ML         | LightGBM, MLflow                    | `ml`                | Entrainement initialise |
+| ML         | LightGBM, MLflow                    | `ml`                | En place |
 Le backend, la base et l'infrastructure (Terraform/k3s) sont initialises a ce stade. Le frontend
 sert un tableau de bord sur `/dashboard`, dont les données proviennent de fixtures : les endpoints
@@ -655,31 +655,31 @@ wheels = [
 [[package]]
 name = "pandas"
-version = "3.0.5"
+version = "3.0.6"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "numpy" },
    { name = "python-dateutil" },
    { name = "tzdata", marker = "sys_platform == 'emscripten' or sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/be/4f/5f3422a2afec5ffc46308b79e53291365a93748b498ac2e58bead0197916/pandas-3.0.5.tar.gz", hash = "sha256:dca3734d6ab7c906e6730f0788b0a1dbb9f2467731f9711f77995c8e9d62d712", size = 4658219, upload-time = "2026-07-22T22:19:28.819Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e2/17/d7b106e05bfa642e8694451e7d3d759c6a241c5386a5d962e4f66c047e06/pandas-3.0.6.tar.gz", hash = "sha256:66b07ef7315a31bfe1089cd3d71a7de781c9dca986762d0b4fe7c0ef17465d10", size = 4667686, upload-time = "2026-09-17T23:23:18.345Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/51/2f/cf6aae281264f4463f0875bcbb15fd2bb6d291cc535187dad1732475e4a9/pandas-3.0.5-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:2f264fc46911cc8131a7322a16199bbf8e353d27c10bb211f5bd0c814324dc36", size = 10390034, upload-time = "2026-07-22T22:18:49.818Z" },
+    { url = "https://files.pythonhosted.org/packages/75/55/1a8875395b05ccd572cbca0b9255dcd2db6e6508e632a558c1a6884b39ad/pandas-3.0.6-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:ee913a91669056c1de1a6b733fbfeab711de9e54e3bee2dfa5fe79d9457247d1", size = 10492213, upload-time = "2026-09-17T23:21:40.746Z" },
-    { url = "https://files.pythonhosted.org/packages/06/ec/5189518c7a7659c4bdcc6b1eb32c46c6f3c86b0661ffd84143d1112c7732/pandas-3.0.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:53730687fcd161883b24e10411c06d6a4c0f2275d2faf3bb2bc25deb4ba8007c", size = 9980065, upload-time = "2026-07-22T22:18:52.249Z" },
+    { url = "https://files.pythonhosted.org/packages/35/61/47ae13476995cc8a40cd609e93e7cf11f273d8692925c2903cb6d38aa0d1/pandas-3.0.6-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:ff51a4459ed036e93d1eb1bb5e6e7b28685d3cb6b7c12b91c05b31024e234729", size = 10156618, upload-time = "2026-09-17T23:21:44.142Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/f1/598503ce8d7e3c35601e0747ba288c7864baae66380725bc12f13f884dfe/pandas-3.0.5-cp314-cp314-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:960d3ebcf249f75206899fcd2c6de53f736b7265759ced0d3e559df0b8b709b0", size = 10545532, upload-time = "2026-07-22T22:18:54.813Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/f2/cc5f2adb8d6e86a85d9fb5128f8cf205a61189336f70d1f7faf0d1b53ec9/pandas-3.0.6-cp314-cp314-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:654aae059295dbba6ecd2328ca12712a2cf1676214c8699f1c29213f7ccf9c34", size = 10375479, upload-time = "2026-09-17T23:21:47.159Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/de/ceae2adf7034e07e9910299fe412e1819c4f0dd520700a888bcb03625448/pandas-3.0.5-cp314-cp314-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9e94c2c5ca43bd3ca32bf64d32308887b65e5f9bfd8023ea52755107a999f93b", size = 10963120, upload-time = "2026-07-22T22:18:57.42Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/ba/ffdcb19be4ff6bfe7d969e7cef2c567c633df5a3a1cc1053394ad053bca8/pandas-3.0.6-cp314-cp314-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:62f51d7f651c8054c5e82a69265c98082e795d1442df7ca6edc3a545d61214b1", size = 10783244, upload-time = "2026-09-17T23:21:50.367Z" },
-    { url = "https://files.pythonhosted.org/packages/66/25/86e0f4451874eb79e688deeebe3c451fec4557f8952005818d800ee8ac7e/pandas-3.0.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e819dd5f62966b481a8cb649d3299ebd886a1ea91ed5a99bf7ce77c98d18ab94", size = 11563178, upload-time = "2026-07-22T22:18:59.729Z" },
+    { url = "https://files.pythonhosted.org/packages/77/5b/e150075b2c6eb69fae896f2d9239bc6ed07db97735971d53d66de6553460/pandas-3.0.6-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:22172a92e7ee678ec0140c7af4fc9366b55413834a1cd86af78b3caa0b0574de", size = 11382223, upload-time = "2026-09-17T23:21:53.355Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/45/8643daa3b4147e433adfcccefdd0380d3aad79d86b15d8999730fe1944d5/pandas-3.0.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:3c5ed2e7c06e91d340dfd091d7934f9bc82e4a36b95f647f090b9d1c9ac649da", size = 12028708, upload-time = "2026-07-22T22:19:02.164Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/8a/b441c587dc7355bf6e1f68a91b4f76a6c29740f0c23be3acc5d4ebbeea6d/pandas-3.0.6-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:583be68728a31d0d750d5b8d9e00f02b153df0d4655f858bde93cb84cfc4227c", size = 11854881, upload-time = "2026-09-17T23:21:56.342Z" },
-    { url = "https://files.pythonhosted.org/packages/96/58/ad979ae617615576e8aafd569c9d4b62f1191d896e38f51d66ba06f3b89a/pandas-3.0.5-cp314-cp314-win_amd64.whl", hash = "sha256:cd8f7c6dc98527058ee6264219343f5392240a6f1bfa654fc5d79023020d0c92", size = 9951806, upload-time = "2026-07-22T22:19:04.596Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/e9/f43410fada510b43fec09993c08f552086c3d247d3ee801a678f3cb10ea5/pandas-3.0.6-cp314-cp314-win_amd64.whl", hash = "sha256:77ccbe5057aece6fc172b9b77f19c04335af6882bc2e10c8f3ee4e6bfb3da553", size = 9791672, upload-time = "2026-09-17T23:21:59.332Z" },
-    { url = "https://files.pythonhosted.org/packages/69/32/7ac03886b304049a9d2625ee88f59af760d8a93bd30ed9239bce7b9869a8/pandas-3.0.5-cp314-cp314-win_arm64.whl", hash = "sha256:5183427f5a8156d480f30333777bc978be93650a49a7c01db26adffe95b31e85", size = 9238297, upload-time = "2026-07-22T22:19:06.836Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/9e/db14c059c21f9baa1907d436f8bf30e0c76c6288225c5e8b79a08ba8b2c5/pandas-3.0.6-cp314-cp314-win_arm64.whl", hash = "sha256:fb625f426b375bcc96e3a04c5d5d266cd7be6ae5d6866e0e703382ab5164068c", size = 9121246, upload-time = "2026-09-17T23:22:02.123Z" },
-    { url = "https://files.pythonhosted.org/packages/be/ed/1d1f2ee5547d5167face2376d11c8b2a4c7bfff5a416ee7a9046891fab1e/pandas-3.0.5-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:303da736987d481074ca720ada325f8bd80c64ebc2d45ed79b29df3aaa4a26ca", size = 10849690, upload-time = "2026-07-22T22:19:09.391Z" },
+    { url = "https://files.pythonhosted.org/packages/67/ba/bad0f8dac020ab38a8637fddab01a57a82da7a496a6e6f19590aad53ab62/pandas-3.0.6-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:9e492cd4bdba6778de4fe0df7f4590c012161ebcf9902dce01b01dc683105514", size = 10920612, upload-time = "2026-09-17T23:22:05.404Z" },
-    { url = "https://files.pythonhosted.org/packages/57/55/17e17152e98fbb0c4b1e562bc65387a2f20a80db0f4a86bf8d3a0e4248d4/pandas-3.0.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:3b2801bbb049d0136f6c213eae02b5fca969384fc2064dd728d8620552aa49da", size = 10509945, upload-time = "2026-07-22T22:19:11.773Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/a9/b500982e9aac6d52a58da4ad3f11e14168a315b06906b3f397c427878065/pandas-3.0.6-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:d7dcd21238cbb4828ff148481ba01cac8946dc5121457b5aeba28636f8f99a60", size = 10570213, upload-time = "2026-09-17T23:22:08.44Z" },
-    { url = "https://files.pythonhosted.org/packages/88/90/817d44dbf83facf9556f33576d9af0a241981e7bb5c00606c0bcb5df8dda/pandas-3.0.5-cp314-cp314t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cce3a9d11d2b1f82c69a27ec1f4948a170e2c403c4bbfa8cca62e3fdebe2ef3a", size = 10392197, upload-time = "2026-07-22T22:19:14.024Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/fa/e6ecd0073c98be8f840ac3125b955272835d7d9fd69f5944383b164deb5e/pandas-3.0.6-cp314-cp314t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6ff482fa91fa2bafd92e8fe66ce3645c851824310f295c1f0a2f96e928fc4541", size = 10252356, upload-time = "2026-09-17T23:22:11.302Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/da/889f00c0a6f5aa1545add70abbf01502dff87ab577adb855bd631c54d2f2/pandas-3.0.5-cp314-cp314t-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ef01af4d8dc6cd2c8d6c7736f149574ef93fe043811eeb5e445f2647154b5040", size = 10862726, upload-time = "2026-07-22T22:19:16.351Z" },
+    { url = "https://files.pythonhosted.org/packages/04/f5/001e230a7a7803590d9275a1a3f7e1bb605e3a495cfe5e8d3a532090621b/pandas-3.0.6-cp314-cp314t-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:db7ec631f26223beee8e5c9e0b8f23c24d8197bbd1d982421d4e3188bea51965", size = 10655952, upload-time = "2026-09-17T23:22:14.283Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/98/f1e934fb3c98fce859c6147c6785816c7b5b9ab7821115c5d8c4de9842b9/pandas-3.0.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e2759e890db96dfcffdbd9b86c3c2cb6afaf58def482820317e06163ec1066cd", size = 11414864, upload-time = "2026-07-22T22:19:18.981Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/ab/bab587148a3852c96aae26c4b5f9e04ce2221801ad94e166b4fbf969ede0/pandas-3.0.6-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:bd75ed0c840f709fc2ae26ddd9534ac77ca1a48ac0cce521a74acaa85f3340a7", size = 11274177, upload-time = "2026-09-17T23:22:17.352Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/be/d448af7d657d82e1888dd8551f79c6d6fb161080b5b9752d84d910ec2319/pandas-3.0.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:b58b1b39d46a5862e3fb18f50d1a201398619d16a0f9f73f57eea5583cf0e63c", size = 11925105, upload-time = "2026-07-22T22:19:21.515Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/32/74b48d87df2b80892d713c149abfe36d5db4de41b4eccb042a2bc07dafc1/pandas-3.0.6-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:ef738d71d1059245b6bb03e312be06d8b3821326a83486c1ad03b9aba3710e44", size = 11719041, upload-time = "2026-09-17T23:22:20.227Z" },
-    { url = "https://files.pythonhosted.org/packages/29/c1/ccb4238212c8c4f496c584f3044d94e0c030ed8e1d68999db46c91c2242f/pandas-3.0.5-cp314-cp314t-win_amd64.whl", hash = "sha256:1c10461f6eeb35d8f05b6184c65c8b9991663b66c46b1d559b682cb34ae7c6ea", size = 10387612, upload-time = "2026-07-22T22:19:24.257Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/c6/d64b72d64d7eb0fad9fe424d34138e45dee70ddbea1360dcd0adf30e28f6/pandas-3.0.6-cp314-cp314t-win_amd64.whl", hash = "sha256:429d9df32731ab01383ed98f2baa7a60368090d1a94fc06019a12062510e8630", size = 10191388, upload-time = "2026-09-17T23:22:23.524Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/cf/6a51b2c38980e04c279fd2fa908a1b0982064e860444acfca4ec2e2c8359/pandas-3.0.5-cp314-cp314t-win_arm64.whl", hash = "sha256:3c5015fd1730fbf883647e88068176c839c102cea883ba1769a6f4593bfc1f8c", size = 9509776, upload-time = "2026-07-22T22:19:26.694Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/30/5e5b2ccabeca73ae2b03fc82bca3eabb7466cf43737f05ac08d591665d47/pandas-3.0.6-cp314-cp314t-win_arm64.whl", hash = "sha256:a4dbd4dc65cbe645b92b8785d0f96dd7311010dc6606cf620e51b07b8788a12a", size = 9387796, upload-time = "2026-09-17T23:22:26.64Z" },
 ]
 [[package]]
@@ -936,27 +936,27 @@ wheels = [
 [[package]]
 name = "ruff"
-version = "0.16.7"
+version = "0.16.8"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/82/bb/5a449b9162e49b139d72f61672bd3ac1d790221f796d3304e2241fff4c58/ruff-0.16.7.tar.gz", hash = "sha256:5f71d004ac1263b22fa39462ac5ae618a4b77d58981af2cc79bf79a29c12b1a6", size = 4924184, upload-time = "2026-09-10T18:04:06.336Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ba/78/449cb84790bd5cc3823b2652ee405a4558856e5c4195aee3a16bf7b3eb5d/ruff-0.16.8.tar.gz", hash = "sha256:9247bf92b5f04d825c8639a4fe423ec2e4222acd9222e58412b0dab7e442798b", size = 4938814, upload-time = "2026-09-16T15:54:46.688Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/b2/c80aeeb7f9e469c0d63a85d2f1ab6e1ebfbe10ea7a8d2438b7e09e3ff09e/ruff-0.16.7-py3-none-linux_armv6l.whl", hash = "sha256:727307773e7c7f9181d3ed3a2484186e56c1fa1874255911c74585eb2c7c19f9", size = 10048917, upload-time = "2026-09-10T18:03:30.28Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/25/6071aabc530e9be7e2c195e8fe3f7aea2735405b6cf447212832d7811831/ruff-0.16.8-py3-none-linux_armv6l.whl", hash = "sha256:6ffbd6d87383c1edf5f6fa890f10200950240d7c1a16052a19a09d3a2307dd38", size = 10048966, upload-time = "2026-09-16T15:53:57.605Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/96/20bb7bcae008004df52afcb7ac83432d4a467f2c17b672fe46d26be231c5/ruff-0.16.7-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:9d61c258deabf58f34c67bd4bb4d939c7f2e6b5f0e59c1cdd1cf771b11cde929", size = 10242929, upload-time = "2026-09-10T18:03:32.706Z" },
+    { url = "https://files.pythonhosted.org/packages/54/98/07f90ecbc74dd5fb5764f11f2bc774d6a7cffef92d2ff5f5b4e9e23c754e/ruff-0.16.8-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:42ed6b878ed61e3acca92f2730a17acff39286944ea82398544696366a6f925e", size = 10165498, upload-time = "2026-09-16T15:54:01.14Z" },
-    { url = "https://files.pythonhosted.org/packages/90/b2/f184b0d5abec02db69cfd7e49b688ae0237554528ca777136c613bf36bee/ruff-0.16.7-py3-none-macosx_11_0_arm64.whl", hash = "sha256:7ab81118df8945e0193d0240712aa4496573595b75185c3636ed825592a0f728", size = 9847245, upload-time = "2026-09-10T18:03:34.509Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/1f/e6a712e3b47cad4a40600134105ed193cb773f618a42eb7ba323cb812cc0/ruff-0.16.8-py3-none-macosx_11_0_arm64.whl", hash = "sha256:7ea781c7f2afba8c6a505ea0fb3f994020249e0c450635f5381286fea6b46170", size = 9830004, upload-time = "2026-09-16T15:54:03.998Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/2d/db1633a641866ed801e34cc6b60ef236c5e16f9b2124ab1d49cc24a5fe4f/ruff-0.16.7-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4c196c968874fc8019da8e7163de7a1a370f111e2309b4b7dfea0fce950198d0", size = 9961780, upload-time = "2026-09-10T18:03:36.618Z" },
+    { url = "https://files.pythonhosted.org/packages/23/f2/311a08776d75d81c7676e20b6b020ae63cbe881fcdc7a8dd64e6e18bdd93/ruff-0.16.8-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8efeae3bbe414a5efefda11a792dfb51ef90ac48d50c4830de2f644caf3e8659", size = 9986558, upload-time = "2026-09-16T15:54:06.804Z" },
-    { url = "https://files.pythonhosted.org/packages/4d/98/edea21e1a3e38dbbc3bf6bb068b863b3b06184cf8533a4c7dbbe208a89d5/ruff-0.16.7-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:ac8c3bd0a7e10ad31e6ce51e7a99f3cb772e69aecdd6b9ea7e99b362f62a62c0", size = 9866337, upload-time = "2026-09-10T18:03:38.805Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/ed/37b6cb3d3ba8c73e68ae3eb1d502383beb5aa05a582bb7bb3a922f929f54/ruff-0.16.8-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3a79b795469fef7fc6e908b218eed2eb17332afd85031db6480dc864560e69b2", size = 9877332, upload-time = "2026-09-16T15:54:09.552Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/11/a15e60d4c87b214646f116ca9d204475bf993ee1047459bc9a360fd4d6d1/ruff-0.16.7-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:398d3988edde000b5c75dc1b3f584708da9bc990de069c18909142580fec1af9", size = 10562512, upload-time = "2026-09-10T18:03:40.71Z" },
+    { url = "https://files.pythonhosted.org/packages/22/cc/40873a8f36ad084cc540d55fcca7077264d5b13b24659e9180c176fb2b08/ruff-0.16.8-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3fdc5563cdc50555e6fba39322850860e9267c1b3d12c26a74729d8604c3c812", size = 10507125, upload-time = "2026-09-16T15:54:12.152Z" },
-    { url = "https://files.pythonhosted.org/packages/29/42/eaff4c9b6d0c7cdf56df313a17e89ae854f5bbc0b0c8f9cce19be0ab7a8f/ruff-0.16.7-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ce05b62b770a8217c4646a9c4139fca00efe8fe5d71f87df2b243ff20d4584d1", size = 11302938, upload-time = "2026-09-10T18:03:42.607Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/e4/fc91a642b78ccbab6b9477720f3644ae7a10a9bcce69a934679cd64f62bc/ruff-0.16.8-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:34508983c70665578dab88f5223d8e6228307e1135398ca8bfc8b7e9501e282b", size = 11336694, upload-time = "2026-09-16T15:54:15.489Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/43/c75aa59a4ec181fe2ec06cab30e198c1c6d107229a9f008ae3a7c16cabd8/ruff-0.16.7-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:af1b576fddb9d9ef2ececfb5fadcd6a624b25070ed85e3cfcfe449fc3ff6a7b9", size = 10840857, upload-time = "2026-09-10T18:03:44.604Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/3d/bbd2a9a600a4e73dc3e7548a249c8d1671273464b55822c6fae50f602dff/ruff-0.16.8-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:644bb578569e0ffc575741232bd385dacdd6fbe123f1a729e7a225f54aa3957f", size = 10774448, upload-time = "2026-09-16T15:54:18.16Z" },
-    { url = "https://files.pythonhosted.org/packages/21/33/81f3da371942ea031105ba679d8d6e28ec1660ccd690a45f42d381161356/ruff-0.16.7-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9ce7f8f22df67c93ed96c717f9128eadb797144ac2bad475cf536f31d6100c55", size = 10370001, upload-time = "2026-09-10T18:03:46.706Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/41/d83af9879a7b6e8bf5fe16b1da0b134049d2f5d3afac12defb0897cb84bd/ruff-0.16.8-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:15e7d226246961db9235098333caa13063906d3851136b84c2900b82f5daa1df", size = 10323796, upload-time = "2026-09-16T15:54:20.743Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/0b/6345fb4dbf6dd0ed1cfe5d18391dc9c3f59cc81622a7b0a65b84b3e730ba/ruff-0.16.7-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:06d0e93d04f392996435ebd600c153f65b47d73fbec2415aa99c5ee5756b3a5f", size = 10548735, upload-time = "2026-09-10T18:03:48.658Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/2c/cefd07bfe914b84943ea769ade8d607bd22750b965d3228eefd7cebd15d0/ruff-0.16.8-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:a2bf6bc3e9ebdd4449abc6f06cf64b98051a2c61cf94d2fe9596518c881f1a1e", size = 10514115, upload-time = "2026-09-16T15:54:23.497Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/4d/c5576adf511f92a328e5569dda190ecdd430da51f1a649f3a4a2fd73e21e/ruff-0.16.7-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:142151a5e7b93c1b11111337142f89dd2fbfee92161225c99a97222f22e32656", size = 10108496, upload-time = "2026-09-10T18:03:50.563Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/9d/76a2e26c79a23be6e6e3664c57bec9e9fc8de155cfb9e4b67ea91b64f9d7/ruff-0.16.8-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:6ca111ba0849539165e9e59d2b442542f3c1e8060ebbdea82494f1ffbccb1e1f", size = 10072582, upload-time = "2026-09-16T15:54:26.185Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/8c/667d83c16199a17a56adc6b0bd4c3beb5b767a2babcd16a56f76f9be7fd6/ruff-0.16.7-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:e6651f97a342d8b35d54d8991544ca22169b86dc54111cb604666940c431b750", size = 9860136, upload-time = "2026-09-10T18:03:52.621Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/d4/f42edddb39668af1a559ceafa3823aedd65633a48dc9768e775485faa2c1/ruff-0.16.8-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:359a1e5b495448ee1e91018064382ebc86f90e8aac2fed222c7d0e4e8df85fd2", size = 9879644, upload-time = "2026-09-16T15:54:29.278Z" },
-    { url = "https://files.pythonhosted.org/packages/99/75/78d401106731999a1dd20cc5a6961e37e1eb9397a3b589f73f3a5ce146a3/ruff-0.16.7-py3-none-musllinux_1_2_i686.whl", hash = "sha256:ef140c6eb935fa9a84c9c607dfb2cb1b85843c192e79265b0c54f35f557ea8e5", size = 10286290, upload-time = "2026-09-10T18:03:55.207Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/d4/913e3195d95e0378786c6656945c865f534a3560e29139da4882aff630d1/ruff-0.16.8-py3-none-musllinux_1_2_i686.whl", hash = "sha256:59e8f5681349474110b24d62e93cfda6593f5fa3473446ca3705200cac1a08b9", size = 10231569, upload-time = "2026-09-16T15:54:32.036Z" },
-    { url = "https://files.pythonhosted.org/packages/68/49/56f9c3a8b755df93a0ad318b2147bf4ef5dae9a7e5ec61c460109c67957f/ruff-0.16.7-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:53e39506a730fadeee0d998ed5946f30671f0db240c6c7c73bdabbe33604bb6f", size = 10745048, upload-time = "2026-09-10T18:03:57.299Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c4/8aa6ea0bdcedbd1bf87397e2fc4ed8406448ea5842f8660bc6e5f163039d/ruff-0.16.8-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:efa3e7a16d1baaa79957888dfdf8be9ef2e44db81cb032af06d76632ab59e773", size = 10663666, upload-time = "2026-09-16T15:54:34.838Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/ea/7f9b938a63ece4bec677ad7f9f7fa02df3383db1949ed93a382441c09a87/ruff-0.16.7-py3-none-win32.whl", hash = "sha256:2ea3470fcebcbc5df2fb0c6f3b90333fa9084c534e0111c038fa4a6ab9f1c4b7", size = 10059082, upload-time = "2026-09-10T18:03:59.632Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/02/7f10ef4700bc223c30a3fdd10631a29830c45524b810a3c7ed947af64591/ruff-0.16.8-py3-none-win32.whl", hash = "sha256:55793ba85c69921e89be061426d91a78652d6e50317c962240922747a4eb713f", size = 10093472, upload-time = "2026-09-16T15:54:37.47Z" },
-    { url = "https://files.pythonhosted.org/packages/39/11/480a6973a927aa653e1cead6a6416008640e03a99d05b34c0434b8c6c366/ruff-0.16.7-py3-none-win_amd64.whl", hash = "sha256:7ac26aca826e9e21d0f1cb25b54ac660760a9fdd094d3e4df9848232be98cfc6", size = 10593368, upload-time = "2026-09-10T18:04:01.999Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/5d/a509c07d714b6da88f2c518b4637cf6f1d46b074be8f0f1e5fb9ff5126fe/ruff-0.16.8-py3-none-win_amd64.whl", hash = "sha256:a6b85621fd3c81e31fc5f5add09c9c078b430db3595ca632efafdec9e64ebfaa", size = 10586899, upload-time = "2026-09-16T15:54:40.488Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/4b/51327018d056f0dad2c2238f26d1fb0f53707a9d91b75dea6d1b3039f136/ruff-0.16.7-py3-none-win_arm64.whl", hash = "sha256:aab7f39e2c9df6c596216070f98eef1207b94f8516cca20c808826974971855b", size = 10412401, upload-time = "2026-09-10T18:04:04.098Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/a0/50787329e4f20bf9dc9f6230015d46ec69c51a97ace5bc202dae4755365d/ruff-0.16.8-py3-none-win_arm64.whl", hash = "sha256:d075e820af612102ce217f07cc93e69f9490b10ec13ea85fa87bd03d996cef8a", size = 10386316, upload-time = "2026-09-16T15:54:43.332Z" },
 ]
 [[package]]
@@ -3,7 +3,7 @@
 # ==================
 # Image pour frontend
-FROM node:24-alpine3.22 AS builder
+FROM node:26-alpine3.22 AS builder
 WORKDIR /app
@@ -23,7 +23,7 @@ RUN npm run build
 # ==================
-FROM nginx:1.28-alpine AS runner
+FROM nginx:1.31-alpine AS runner
 # Copie de la configuration de nginx
 COPY --chown=root:root --chmod=755 nginx.conf /etc/nginx/nginx.conf
@@ -8,12 +8,12 @@
      "name": "frontend",
      "version": "0.0.0",
      "dependencies": {
-        "@angular/common": "^22.1.0",
+        "@angular/common": "^22.1.7",
-        "@angular/compiler": "^22.1.0",
+        "@angular/compiler": "^22.1.7",
-        "@angular/core": "^22.1.0",
+        "@angular/core": "^22.1.7",
-        "@angular/forms": "^22.1.0",
+        "@angular/forms": "^22.1.7",
-        "@angular/platform-browser": "^22.1.0",
+        "@angular/platform-browser": "^22.1.7",
-        "@angular/router": "^22.1.0",
+        "@angular/router": "^22.1.7",
        "chart.js": "^4.5.1",
        "rxjs": "~7.8.0",
        "tslib": "^2.3.0"
@@ -21,21 +21,14 @@
      "devDependencies": {
        "@angular/build": "^22.1.8",
        "@angular/cli": "^22.1.8",
-        "@angular/compiler-cli": "^22.1.0",
+        "@angular/compiler-cli": "^22.1.7",
        "@vitest/coverage-v8": "^4.1.11",
-        "jsdom": "^28.0.0",
+        "jsdom": "^30.1.0",
-        "prettier": "^3.8.1",
+        "prettier": "^3.9.8",
        "typescript": "~6.0.2",
-        "vitest": "^4.0.8"
+        "vitest": "^4.1.11"
      }
    },
    "node_modules/@acemir/cssom": {
      "version": "0.9.31",
      "resolved": "https://registry.npmjs.org/@acemir/cssom/-/cssom-0.9.31.tgz",
      "integrity": "sha512-ZnR3GSaH+/vJ0YlHau21FjfLYjMpYVIzTD8M8vIEQvIGxeOXyXdzCI140rrCY862p/C/BbzWsjc1dgnM9mkoTA==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@ampproject/remapping": {
      "version": "2.3.0",
      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz",
@@ -255,9 +248,9 @@
      }
    },
    "node_modules/@angular/common": {
-      "version": "22.1.6",
+      "version": "22.1.7",
-      "resolved": "https://registry.npmjs.org/@angular/common/-/common-22.1.6.tgz",
+      "resolved": "https://registry.npmjs.org/@angular/common/-/common-22.1.7.tgz",
-      "integrity": "sha512-giuH+jJvo6YbBxbKofJCXvq6k8g1Z/xCAvh4piNFSSS6/toXTLCeZ+snr6Stw5b2wRbArM5Q5nDeuto3NqVPnQ==",
+      "integrity": "sha512-SLW4AdH2Y8G9SM/iFRNpCQtkmvq55RcIQWsADT9ypZ7FxxcnJRsr4Q/WnbUBbuCslsCkrgzU1i9WDiW0m7gcnw==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.3.0"
@@ -266,14 +259,14 @@
        "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
      },
      "peerDependencies": {
-        "@angular/core": "22.1.6",
+        "@angular/core": "22.1.7",
        "rxjs": "^6.5.3 || ^7.4.0"
      }
    },
    "node_modules/@angular/compiler": {
-      "version": "22.1.6",
+      "version": "22.1.7",
-      "resolved": "https://registry.npmjs.org/@angular/compiler/-/compiler-22.1.6.tgz",
+      "resolved": "https://registry.npmjs.org/@angular/compiler/-/compiler-22.1.7.tgz",
-      "integrity": "sha512-JjOUm/qD338+fGfZvxSNn/vTUiVqNwOiPzacInVUq1eVp7Jev+cnvEwXA2cFJkYZoy3Imz6wHoMvTUZNN8cbKQ==",
+      "integrity": "sha512-qhoHAByh805nT4Xy4Wd2kE5FvkTc7wcg8Qps+EH6+z4KRfwGiL5cwdgooGWjTAldFCeqTgJ0BO/0dB6GHZjdkQ==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.3.0"
@@ -283,9 +276,9 @@
      }
    },
    "node_modules/@angular/compiler-cli": {
-      "version": "22.1.6",
+      "version": "22.1.7",
-      "resolved": "https://registry.npmjs.org/@angular/compiler-cli/-/compiler-cli-22.1.6.tgz",
+      "resolved": "https://registry.npmjs.org/@angular/compiler-cli/-/compiler-cli-22.1.7.tgz",
-      "integrity": "sha512-C1fQuaSLnibhfbb7Im/vurdBEcfQk+/GqPkY4+dgEKd4EPleO0xWlD+k5DwyNFX8a9w7HebWfo0Zl66HuaEwOQ==",
+      "integrity": "sha512-VGg8Kyt0YymQfnUUFk79vFaM+x5xmIMHy+BZh3P2Lh/uxqCXTWhJJH8kOHKtIGGH5/wKhBEmSy2CezdcIuM9xg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -306,7 +299,7 @@
        "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
      },
      "peerDependencies": {
-        "@angular/compiler": "22.1.6",
+        "@angular/compiler": "22.1.7",
        "typescript": ">=6.0 <6.1"
      },
      "peerDependenciesMeta": {
@@ -316,9 +309,9 @@
      }
    },
    "node_modules/@angular/core": {
-      "version": "22.1.6",
+      "version": "22.1.7",
-      "resolved": "https://registry.npmjs.org/@angular/core/-/core-22.1.6.tgz",
+      "resolved": "https://registry.npmjs.org/@angular/core/-/core-22.1.7.tgz",
-      "integrity": "sha512-3Ln9YYOhsaU2vPufnpcu6C4dlmX4e/nJTlggVcKMT7bGZH5KlEtw3h0uh9YfANv8YhQCEk1AcuRI7KpBnh5ing==",
+      "integrity": "sha512-T9bt1PIgoN7n+TxGHTUgu0EsomlGMQ84YMXbMB+N6HhD8C1qZxn0uCbnAtCUjcecg1am8ioKxNTO0eII9ouioQ==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.3.0"
@@ -327,7 +320,7 @@
        "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
      },
      "peerDependencies": {
-        "@angular/compiler": "22.1.6",
+        "@angular/compiler": "22.1.7",
        "rxjs": "^6.5.3 || ^7.4.0",
        "zone.js": "~0.15.0 || ~0.16.0"
      },
@@ -341,9 +334,9 @@
      }
    },
    "node_modules/@angular/forms": {
-      "version": "22.1.6",
+      "version": "22.1.7",
-      "resolved": "https://registry.npmjs.org/@angular/forms/-/forms-22.1.6.tgz",
+      "resolved": "https://registry.npmjs.org/@angular/forms/-/forms-22.1.7.tgz",
-      "integrity": "sha512-rfV4G4UB4l69yXSRvhaHPzTMIruvBlRO+ak9NtTcYMnsoj8O5ZCyPv0ledGIrLTBwGSI3X1j4nr9aoV+Rj/n+Q==",
+      "integrity": "sha512-oc0DT39C3ZboJpDx8xKUCltgn56LHi0kbv+ThNK/dCSZLgjF2nd+muMMRYF+amdljQp2q7+hm2ORmhON3CNFog==",
      "license": "MIT",
      "dependencies": {
        "@standard-schema/spec": "^1.0.0",
@@ -354,16 +347,16 @@
        "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
      },
      "peerDependencies": {
-        "@angular/common": "22.1.6",
+        "@angular/common": "22.1.7",
-        "@angular/core": "22.1.6",
+        "@angular/core": "22.1.7",
-        "@angular/platform-browser": "22.1.6",
+        "@angular/platform-browser": "22.1.7",
        "rxjs": "^6.5.3 || ^7.4.0"
      }
    },
    "node_modules/@angular/platform-browser": {
-      "version": "22.1.6",
+      "version": "22.1.7",
-      "resolved": "https://registry.npmjs.org/@angular/platform-browser/-/platform-browser-22.1.6.tgz",
+      "resolved": "https://registry.npmjs.org/@angular/platform-browser/-/platform-browser-22.1.7.tgz",
-      "integrity": "sha512-jrRi6zpdz+jOle5l0OW7QL0a8xPgdnxWT5FrJabbiNKfYzQfqKcaAu02l8uJoJxtGb8fLQ8pbjkPpZEvKO2z+w==",
+      "integrity": "sha512-4dT3qGw3ZHVQUcHKALzMx9MTo+pxAMzHIPxc8HUESklqXfq6GRaIIfFMvE0RsquI9iqu6admD6lOAEzLWS8DxA==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.3.0"
@@ -372,9 +365,9 @@
        "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
      },
      "peerDependencies": {
-        "@angular/animations": "22.1.6",
+        "@angular/animations": "22.1.7",
-        "@angular/common": "22.1.6",
+        "@angular/common": "22.1.7",
-        "@angular/core": "22.1.6"
+        "@angular/core": "22.1.7"
      },
      "peerDependenciesMeta": {
        "@angular/animations": {
@@ -383,9 +376,9 @@
      }
    },
    "node_modules/@angular/router": {
-      "version": "22.1.6",
+      "version": "22.1.7",
-      "resolved": "https://registry.npmjs.org/@angular/router/-/router-22.1.6.tgz",
+      "resolved": "https://registry.npmjs.org/@angular/router/-/router-22.1.7.tgz",
-      "integrity": "sha512-ex0vrkcVyJJdn7NzZXun+5ctaPPLTZJ/gE7A3g1dun7BM3g4Z6zT738mODFeJgtPtJNf4bTs2gpgvyegvzWH7w==",
+      "integrity": "sha512-CxYa2Ym5L0WmqToHU2I0Z4VEpocdryLlvx5svLfo9M3uOaP3/9icB/gjS/vXPbbQxV8/GZ59E/7/LF14anIoRg==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.3.0"
@@ -394,60 +387,45 @@
        "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
      },
      "peerDependencies": {
-        "@angular/common": "22.1.6",
+        "@angular/common": "22.1.7",
-        "@angular/core": "22.1.6",
+        "@angular/core": "22.1.7",
-        "@angular/platform-browser": "22.1.6",
+        "@angular/platform-browser": "22.1.7",
        "rxjs": "^6.5.3 || ^7.4.0"
      }
    },
    "node_modules/@asamuzakjp/css-color": {
-      "version": "5.1.11",
+      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-5.1.11.tgz",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-7.0.0.tgz",
-      "integrity": "sha512-KVw6qIiCTUQhByfTd78h2yD1/00waTmm9uy/R7Ck/ctUyAPj+AEDLkQIdJW0T8+qGgj3j5bpNKK7Q3G+LedJWg==",
+      "integrity": "sha512-IxddtGnnoidVSO6O/aiTueptbTThHvi2qGHu9/AWuD1J7i86Ox+jl+Y5SXcDH1RixzQlP2cjH/PjnlImZiAurQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@asamuzakjp/generational-cache": "^1.0.1",
+        "@csstools/css-calc": "^3.3.0",
-        "@csstools/css-calc": "^3.2.0",
+        "@csstools/css-color-parser": "^4.2.0",
        "@csstools/css-color-parser": "^4.1.0",
        "@csstools/css-parser-algorithms": "^4.0.0",
-        "@csstools/css-tokenizer": "^4.0.0"
+        "@csstools/css-tokenizer": "^4.0.0",
        "lru-cache": "^11.5.2"
      },
      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
      }
    },
    "node_modules/@asamuzakjp/dom-selector": {
-      "version": "6.8.1",
+      "version": "9.1.4",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-6.8.1.tgz",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-9.1.4.tgz",
-      "integrity": "sha512-MvRz1nCqW0fsy8Qz4dnLIvhOlMzqDVBabZx6lH+YywFDdjXhMY37SmpV1XFX3JzG5GWHn63j6HX6QPr3lZXHvQ==",
+      "integrity": "sha512-ynDE7RDZM1z+YuSU+iGhRp8WcSXHqK9+G32ZEzsL35TKSoy72fYR7VfrJCQkWe3ciiIWGSTAIBc9XB5jVpqyTw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@asamuzakjp/nwsapi": "^2.3.9",
+        "bidi-js": "^1.1.0",
-        "bidi-js": "^1.0.3",
+        "css-tree": "^3.2.1",
        "css-tree": "^3.1.0",
        "is-potential-custom-element-name": "^1.0.1",
-        "lru-cache": "^11.2.6"
+        "lru-cache": "^11.5.2"
-      }
+      },
    },
    "node_modules/@asamuzakjp/generational-cache": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/@asamuzakjp/generational-cache/-/generational-cache-1.0.1.tgz",
      "integrity": "sha512-wajfB8KqzMCN2KGNFdLkReeHncd0AslUSrvHVvvYWuU8ghncRJoA50kT3zP9MVL0+9g4/67H+cdvBskj9THPzg==",
      "dev": true,
      "license": "MIT",
      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
      }
    },
    "node_modules/@asamuzakjp/nwsapi": {
      "version": "2.3.9",
      "resolved": "https://registry.npmjs.org/@asamuzakjp/nwsapi/-/nwsapi-2.3.9.tgz",
      "integrity": "sha512-n8GuYSrI9bF7FFZ/SjhwevlHc8xaVlb/7HmHelnc/PZXBD2ZR49NnN9sMMuDdEGPeeRQ5d0hqlSlEpgCX3Wl0Q==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@babel/code-frame": {
      "version": "8.0.0",
      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-8.0.0.tgz",
@@ -854,9 +832,9 @@
      }
    },
    "node_modules/@csstools/css-syntax-patches-for-csstree": {
-      "version": "1.1.13",
+      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.13.tgz",
+      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.14.tgz",
-      "integrity": "sha512-i9ZylF5QNhmNfPA9l0vHAWK4kPrbIp6g9lKgaiIFsIBz2F/WNB7OLrzlNNcCOm+h42bkaSD2v1PG+IBPHhc3ZA==",
+      "integrity": "sha512-HpbVXyrofRXpHpgkNIjU/3EWR4WJvOkO3emNK/L6X/mTJU7bGUI3AkkpoTNXznQLp0KRjLHELTGeKI5dIkI9JQ==",
      "dev": true,
      "funding": [
        {
@@ -879,9 +857,9 @@
      }
    },
    "node_modules/@csstools/css-tokenizer": {
-      "version": "4.0.0",
+      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.1.tgz",
-      "integrity": "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA==",
+      "integrity": "sha512-bPlN9S9O1A0euCpEWE4qnvB5YDuyYVsUTrxSgmAM1Is0j4tICHoVyOVAXfWMP/kS9ZrjvyIXWV2PmomiAXXqOw==",
      "dev": true,
      "funding": [
        {
@@ -4490,22 +4468,6 @@
        "url": "https://github.com/sponsors/fb55"
      }
    },
    "node_modules/cssstyle": {
      "version": "6.2.0",
      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-6.2.0.tgz",
      "integrity": "sha512-Fm5NvhYathRnXNVndkUsCCuR63DCLVVwGOOwQw782coXFi5HhkXdu289l59HlXZBawsyNccXfWRYvLzcDCdDig==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@asamuzakjp/css-color": "^5.0.1",
        "@csstools/css-syntax-patches-for-csstree": "^1.0.28",
        "css-tree": "^3.1.0",
        "lru-cache": "^11.2.6"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/data-urls": {
      "version": "7.0.0",
      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-7.0.0.tgz",
@@ -5283,30 +5245,6 @@
        "url": "https://opencollective.com/express"
      }
    },
    "node_modules/http-proxy-agent": {
      "version": "7.0.2",
      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "agent-base": "^7.1.0",
        "debug": "^4.3.4"
      },
      "engines": {
        "node": ">= 14"
      }
    },
    "node_modules/http-proxy-agent/node_modules/agent-base": {
      "version": "7.1.4",
      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 14"
      }
    },
    "node_modules/https-proxy-agent": {
      "version": "9.1.0",
      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-9.1.0.tgz",
@@ -5529,39 +5467,38 @@
      "license": "MIT"
    },
    "node_modules/jsdom": {
-      "version": "28.1.0",
+      "version": "30.1.0",
-      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-28.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-30.1.0.tgz",
-      "integrity": "sha512-0+MoQNYyr2rBHqO1xilltfDjV9G7ymYGlAUazgcDLQaUf8JDHbuGwsxN6U9qWaElZ4w1B2r7yEGIL3GdeW3Rug==",
+      "integrity": "sha512-h/Q+H+KmlGf49ITw3TrykSVbg04S75S2O7ZtJc9gMGOWBrQRZmx5AJIKLtJ01e6Kszl+/tpFthCVqxNifxhoqg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@acemir/cssom": "^0.9.31",
+        "@asamuzakjp/css-color": "^7.0.0",
-        "@asamuzakjp/dom-selector": "^6.8.1",
+        "@asamuzakjp/dom-selector": "^9.1.2",
        "@bramus/specificity": "^2.4.2",
-        "@exodus/bytes": "^1.11.0",
+        "@csstools/css-syntax-patches-for-csstree": "^1.1.13",
-        "cssstyle": "^6.0.1",
+        "@exodus/bytes": "^1.15.1",
        "css-tree": "^3.2.1",
        "data-urls": "^7.0.0",
        "decimal.js": "^10.6.0",
        "html-encoding-sniffer": "^6.0.0",
        "http-proxy-agent": "^7.0.2",
        "https-proxy-agent": "^7.0.6",
        "is-potential-custom-element-name": "^1.0.1",
-        "parse5": "^8.0.0",
+        "lru-cache": "^11.5.2",
        "parse5": "^8.0.1",
        "saxes": "^6.0.0",
-        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^6.0.2",
-        "tough-cookie": "^6.0.0",
+        "undici": "^8.10.2",
        "undici": "^7.21.0",
        "w3c-xmlserializer": "^5.0.0",
        "webidl-conversions": "^8.0.1",
        "whatwg-mimetype": "^5.0.0",
-        "whatwg-url": "^16.0.0",
+        "whatwg-url": "^17.1.1",
        "xml-name-validator": "^5.0.0"
      },
      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
      },
      "peerDependencies": {
-        "canvas": "^3.0.0"
+        "canvas": "^3.2.3"
      },
      "peerDependenciesMeta": {
        "canvas": {
@@ -5569,28 +5506,19 @@
        }
      }
    },
-    "node_modules/jsdom/node_modules/agent-base": {
+    "node_modules/jsdom/node_modules/whatwg-url": {
-      "version": "7.1.4",
+      "version": "17.1.1",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-17.1.1.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "integrity": "sha512-ohjk1mdUebJVadRt3bAhQhx8lSnISq+GDttK79LFl8EHQkAPvzwctoasC4hs8tBt6kLAncBWWyq1N52qEfKvDw==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">= 14"
      }
    },
    "node_modules/jsdom/node_modules/https-proxy-agent": {
      "version": "7.0.6",
      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "agent-base": "^7.1.2",
+        "@exodus/bytes": "^1.15.1",
-        "debug": "4"
+        "tr46": "^6.0.0",
        "webidl-conversions": "^8.0.1"
      },
      "engines": {
-        "node": ">= 14"
+        "node": "^22.14.0 || >=24.0.0"
      }
    },
    "node_modules/jsesc": {
@@ -6708,9 +6636,9 @@
      }
    },
    "node_modules/prettier": {
-      "version": "3.9.6",
+      "version": "3.9.8",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.6.tgz",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.8.tgz",
-      "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==",
+      "integrity": "sha512-WRFq3Wn3WId7LLROfMLdH7xaFr2jR62wU8nLO6rQUOLOxNZUviyJQs1M0iIhLexSFy+L+w0ch66wtoO2jRjG0A==",
      "dev": true,
      "license": "MIT",
      "bin": {
@@ -7308,13 +7236,6 @@
        "node": ">=8"
      }
    },
    "node_modules/symbol-tree": {
      "version": "3.2.4",
      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/tinybench": {
      "version": "2.9.0",
      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -7469,13 +7390,13 @@
      }
    },
    "node_modules/undici": {
-      "version": "7.29.1",
+      "version": "8.10.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.2.tgz",
-      "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==",
+      "integrity": "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ==",
      "dev": true,
      "license": "MIT",
      "engines": {
-        "node": ">=20.18.1"
+        "node": ">=22.19.0"
      }
    },
    "node_modules/unpipe": {
@@ -12,12 +12,12 @@
  "private": true,
  "packageManager": "npm@11.19.0",
  "dependencies": {
-    "@angular/common": "^22.1.0",
+    "@angular/common": "^22.1.7",
-    "@angular/compiler": "^22.1.0",
+    "@angular/compiler": "^22.1.7",
-    "@angular/core": "^22.1.0",
+    "@angular/core": "^22.1.7",
-    "@angular/forms": "^22.1.0",
+    "@angular/forms": "^22.1.7",
-    "@angular/platform-browser": "^22.1.0",
+    "@angular/platform-browser": "^22.1.7",
-    "@angular/router": "^22.1.0",
+    "@angular/router": "^22.1.7",
    "chart.js": "^4.5.1",
    "rxjs": "~7.8.0",
    "tslib": "^2.3.0"
@@ -25,11 +25,11 @@
  "devDependencies": {
    "@angular/build": "^22.1.8",
    "@angular/cli": "^22.1.8",
-    "@angular/compiler-cli": "^22.1.0",
+    "@angular/compiler-cli": "^22.1.7",
    "@vitest/coverage-v8": "^4.1.11",
-    "jsdom": "^28.0.0",
+    "jsdom": "^30.1.0",
-    "prettier": "^3.8.1",
+    "prettier": "^3.9.8",
    "typescript": "~6.0.2",
-    "vitest": "^4.0.8"
+    "vitest": "^4.1.11"
  }
 }
@@ -1,4 +1,4 @@
-- Base de metadonnees Airflow (webserver + scheduler, LocalExecutor). Separee de la base
+-- Base de metadonnees Airflow (api-server + scheduler + dag-processor, LocalExecutor). Separee de la base
 -- applicative : les tables internes d'Airflow (dag_run, task_instance, ...) n'ont rien a faire
 -- dans le schema metier. Meme conteneur Postgres que `enervision`/`enervision_test` plutot qu'un
 -- service dedie, pour ne pas ajouter un conteneur de plus (issue #115).
@@ -22,7 +22,7 @@ services:
    ports: !override
      - "127.0.0.1:${MAILPIT_UI_PORT:-8025}:8025"
-  airflow-webserver:
+  airflow-apiserver:
    ports: !override
      - "127.0.0.1:${AIRFLOW_PORT:-8080}:8080"
    environment:
@@ -51,7 +51,7 @@ services:
    ports: !reset null
  proxy:
-    image: nginx:1.28-alpine
+    image: nginx:1.31-alpine
    depends_on:
      backend:
        condition: service_healthy
@@ -5,9 +5,9 @@
 name: enervision
-# Piege : LocalExecutor fait tourner les taches comme sous-processus du scheduler, jamais du
+# Piege : LocalExecutor fait tourner les taches comme sous-processus du scheduler, jamais de
-# webserver. `airflow_ml_state` (modele entraine, magasin MLflow) n'a donc besoin d'etre monte
+# l'api-server. `airflow_ml_state` (modele entraine, magasin MLflow) n'a donc besoin d'etre monte
-# que sur `airflow-scheduler` en pratique, mais reste partage avec le webserver pour que ce
+# que sur `airflow-scheduler` en pratique, mais reste partage avec l'api-server pour que ce
 # dernier puisse au besoin l'inspecter sans en devenir dependant.
 x-airflow-common: &airflow-common
  build:
@@ -19,9 +19,16 @@ x-airflow-common: &airflow-common
    # Piege : pas de `:?` sur les secrets Airflow. Compose interpole le fichier entier avant de
    # filtrer les services : une variable requise manquante casserait aussi `make db-up`,
    # `make dev`... pour quiconque n'a pas encore complete son `.env`. Le refus est porte par
-    # `airflow-init` (ci-dessous), dont `webserver` et `scheduler` dependent.
+    # `airflow-init` (ci-dessous), dont `api-server`, `dag-processor` et `scheduler` dependent.
    AIRFLOW__CORE__FERNET_KEY: ${AIRFLOW_FERNET_KEY:-}
-    AIRFLOW__WEBSERVER__SECRET_KEY: ${AIRFLOW_WEBSERVER_SECRET_KEY:-}
+    AIRFLOW__API__SECRET_KEY: ${AIRFLOW_API_SECRET_KEY:-}
    # Signe les jetons entre scheduler, tâches et api-server. Conteneurs distincts : un secret
    # généré au démarrage ne serait pas partagé, il doit venir du .env.
    AIRFLOW__API_AUTH__JWT_SECRET: ${AIRFLOW_JWT_SECRET:-}
    AIRFLOW__CORE__EXECUTION_API_SERVER_URL: http://airflow-apiserver:8080/execution/
    # FabAuthManager plutôt que le SimpleAuthManager par défaut d'Airflow 3 : seul le provider
    # FAB sait créer le compte admin que `airflow-init` pose via `_AIRFLOW_WWW_USER_*`.
    AIRFLOW__CORE__AUTH_MANAGER: airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager
    AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/airflow
    # Role `enervision_ml` dedie pas encore provisionne (dette assumee, cf. ADR 0003) :
    # memes identifiants que le backend en attendant.
@@ -111,11 +118,11 @@ services:
  # Conteneur unique, jamais redemarre. La migration et la creation du premier compte sont
  # portees par l'entrypoint de l'image (`_AIRFLOW_DB_MIGRATE`, `_AIRFLOW_WWW_USER_*`), qui porte
  # aussi leur code de sortie : une migration ratee (ex. base `airflow` absente sur un volume
-  # `pgdata` deja peuple) fait echouer ce service, et `webserver`/`scheduler`, qui attendent son
+  # `pgdata` deja peuple) fait echouer ce service, et api-server, dag-processor et scheduler,
-  # succes, ne demarrent pas sur une base non migree. Le mot de passe passe par l'environnement,
+  # qui attendent son succes, ne demarrent pas sur une base non migree. Le mot de passe passe
-  # jamais par `argv` (ni `ps`, ni `docker compose config`).
+  # par l'environnement, jamais par `argv` (ni `ps`, ni `docker compose config`).
  # Sans mot de passe, l'entrypoint refuse lui-meme de creer le compte ; la commande ci-dessous
-  # refuse en plus les deux cles de chiffrement vides.
+  # refuse en plus les cles et secrets vides.
  airflow-init:
    <<: *airflow-common
    restart: "no"
@@ -135,13 +142,14 @@ services:
      - |
        set -euo pipefail
        : "$${AIRFLOW__CORE__FERNET_KEY:?AIRFLOW_FERNET_KEY manquant dans .env}"
-        : "$${AIRFLOW__WEBSERVER__SECRET_KEY:?AIRFLOW_WEBSERVER_SECRET_KEY manquant dans .env}"
+        : "$${AIRFLOW__API__SECRET_KEY:?AIRFLOW_API_SECRET_KEY manquant dans .env}"
        : "$${AIRFLOW__API_AUTH__JWT_SECRET:?AIRFLOW_JWT_SECRET manquant dans .env}"
        : "$${APP_SECRET_KEY:?AIRFLOW_APP_SECRET_KEY manquant dans .env}"
        exec airflow version
-  airflow-webserver:
+  airflow-apiserver:
    <<: *airflow-common
-    command: webserver
+    command: api-server
    ports:
      - "${AIRFLOW_PORT:-8080}:8080"
    depends_on:
@@ -150,7 +158,7 @@ services:
      airflow-init:
        condition: service_completed_successfully
    healthcheck:
-      test: ["CMD", "curl", "--fail", "http://localhost:8080/health"]
+      test: ["CMD", "curl", "--fail", "http://localhost:8080/api/v2/monitor/health"]
      interval: 30s
      timeout: 10s
      retries: 5
@@ -165,6 +173,16 @@ services:
      airflow-init:
        condition: service_completed_successfully
  # Obligatoire depuis Airflow 3 : le scheduler ne parse plus les fichiers de dags/ lui-même.
  airflow-dag-processor:
    <<: *airflow-common
    command: dag-processor
    depends_on:
      db:
        condition: service_healthy
      airflow-init:
        condition: service_completed_successfully
 volumes:
  pgdata:
  airflow_logs:
@@ -9,6 +9,7 @@ quel contexte, quelles décisions sont arrêtées, et ce qui manque encore entre
 | Docker Compose plus reverse proxy | Déployer sur la machine on-premise | `Fait` |
 | Deux projets Compose sur la VM ENI, recette et production | Déploiement continu depuis GitHub | `En cours` |
 | k3s single-node | Cible à terme | `En cours` |
 | MLflow (`ml/`) | Tracker les expériences et le registre de modèles en local | `Fait`, non relié aux autres topologies |
 ## Poste de développement
@@ -49,20 +50,28 @@ Trois pièges sont documentés en tête du `docker-compose.yml`, ils ne se devin
 - `db/init` est monté **fichier par fichier**. Monter le dossier masquerait les scripts d'init de
  l'image, dont `timescaledb-tune`. Ajouter un fichier dans `db/init/` impose donc une ligne dans
  le compose. Voir [`db/README.md`](../../db/README.md).
- `LocalExecutor` exécute les tâches comme sous-processus du **scheduler**, jamais du webserver :
+- `LocalExecutor` exécute les tâches comme sous-processus du **scheduler**, jamais de l'api-server :
  c'est le scheduler qui a besoin du volume `airflow_ml_state` (modèle, magasin MLflow).
 ### Airflow (issues #115, #116 et #119)
-Trois services, `docker compose profiles` non utilisés (démarrage explicite via `make
+Quatre services (Airflow 3.3), `docker compose profiles` non utilisés (démarrage explicite via `make
 airflow-up`, pas dans `make dev`) :
 | Service | Rôle | Points notables |
 |---|---|---|
-| `airflow-init` | Migre la base de métadonnées, crée le compte admin | Conteneur jetable (`restart: "no"`), ne redémarre jamais. `webserver`/`scheduler` attendent qu'il se termine avec succès |
+| `airflow-init` | Migre la base de métadonnées, crée le compte admin | Conteneur jetable (`restart: "no"`), ne redémarre jamais. `api-server`, `dag-processor` et `scheduler` attendent qu'il se termine avec succès |
-| `airflow-webserver` | UI, port `8080` | `LocalExecutor` : n'exécute aucune tâche lui-même |
+| `airflow-apiserver` | UI et API REST (`/api/v2`), port `8080` | `LocalExecutor` : n'exécute aucune tâche lui-même. Sert aussi l'Execution API que les tâches appellent, d'où le secret JWT partagé |
 | `airflow-dag-processor` | Parse `dags/` et publie les DAGs sérialisés | Composant à part entière depuis Airflow 3 : le scheduler ne lit plus les fichiers de DAG |
 | `airflow-scheduler` | Planifie et **exécute** les tâches (`LocalExecutor`) | Les DAGs y tournent en sous-processus (`uv run --no-sync python -m ...`), c'est lui qui a besoin du volume `airflow_ml_state` |
 Airflow 3 impose deux choses que le compose reflète : les tâches ne touchent plus la base de
 métadonnées et passent par l'Execution API de l'`api-server`, avec un jeton signé par
 `AIRFLOW_JWT_SECRET` (secret partagé entre conteneurs, jamais celui généré au démarrage) ; et
 l'authentification par défaut (`SimpleAuthManager`) ne sait pas créer de compte, d'où le
 `FabAuthManager` qui garde le compte admin posé par `airflow-init`. Pas de `triggerer` : aucun
 opérateur déférable dans les DAGs.
 Construits depuis `etl/airflow/Dockerfile`, contexte `.` (racine du repo, pas `etl/airflow/`) :
 l'image doit pouvoir `COPY` les sources de `ml/` **et** de `apps/backend/` pour se synchroniser
 deux environnements Python **3.14** (`/opt/ml/.venv` et `/opt/backend/.venv`, `uv sync --locked` à
@@ -102,14 +111,14 @@ rend contraignant.
 `airflow-init` s'appuie sur l'entrypoint de l'image (`_AIRFLOW_DB_MIGRATE`,
 `_AIRFLOW_WWW_USER_*`) plutôt que sur un script maison : l'entrypoint porte le code de sortie, une
 migration ratée (typiquement la base `airflow` absente, cf. ci-dessous) fait échouer le service et
-`webserver`/`scheduler` ne démarrent pas sur une base non migrée. Le mot de passe du compte admin
+`api-server`, `dag-processor` et `scheduler` ne démarrent pas sur une base non migrée. Le mot de passe du compte admin
 passe par l'environnement, jamais par `argv` (ni `ps`, ni `docker compose config`).
 Les variables `AIRFLOW_*` ne sont volontairement pas en `${VAR:?}` : Compose interpole le fichier
 entier avant de filtrer les services, une variable requise manquante casserait `make db-up`,
 `make dev`... pour tout poste dont le `.env` est antérieur. Elles valent `${VAR:-}` et c'est
-`airflow-init` qui refuse de démarrer (clé Fernet, clé Flask, mot de passe ou
+`airflow-init` qui refuse de démarrer (clé Fernet, clé de session de l'API, secret JWT, mot de
-`AIRFLOW_APP_SECRET_KEY` vides).
+passe ou `AIRFLOW_APP_SECRET_KEY` vides).
 Le conteneur reçoit deux variables du backend en plus de `ML_DATABASE_URL` : `DATABASE_URL`, en
 dialecte asyncpg, et `APP_SECRET_KEY`, alimentée par `AIRFLOW_APP_SECRET_KEY`. Cette dernière est
@@ -139,6 +148,34 @@ est minimale et n'embarque pas la runtime OpenMP dont LightGBM a besoin, sans qu
 (`OSError: libgomp.so.1`) n'apparaît qu'à la première tâche réellement exécutée, pas à la
 construction de l'image.
 ### MLflow (`ml/`)
 Statut : `Fait`, en local uniquement. Défini par `ml/docker-compose.mlflow.yml`, indépendant
 du `docker-compose.yml` principal (réseau, volumes et démarrage séparés).
 | Service | Image | Points notables |
 |---|---|---|
 | `mlflow-db` | `postgres:17` | Stocke le tracking store MLflow. Mot de passe obligatoire via `MLFLOW_DB_PASSWORD` |
 | `mlflow` | Construite depuis `ml/` | Expose l'UI et l'API MLflow sur `127.0.0.1:5000`. Artefacts sur volume `mlflow-artifacts`, tracking store sur `mlflow-db` |
 Portée actuelle : environnement de tracking et de registre de modèles pour le développement
 local uniquement. Ce compose n'est relié ni à `docker-compose.prod.yml`, ni aux deux
 environnements Compose de la VM ENI, ni à la cible k3s. Le magasin utilisé par Airflow pour
 `ml_train`/`ml_score` (SQLite, volume `airflow_ml_state`) en est distinct — les deux MLflow ne
 se voient pas tant que `MLFLOW_TRACKING_URI` n'est pas posé côté Airflow.
 Limite connue : le DAG Airflow `ml_train` enregistre lui aussi une version a chaque execution
 via `registered_model_name` (magasin SQLite du volume `airflow_ml_state`, distinct de ce
 serveur). Versions et artefacts s'y accumulent sans politique de nettoyage -- fonctionne en
 l'etat, mais a surveiller si les entrainements deviennent frequents.
 Pour relier les runs Airflow (`ml_train`, magasin SQLite local) a ce serveur MLflow, positionner
 `MLFLOW_TRACKING_URI=http://mlflow:5000` dans l'environnement du service `airflow-scheduler` (ou
 `http://host.docker.internal:5000` si le serveur MLflow tourne hors du reseau Compose principal),
 et s'assurer que le conteneur Airflow peut joindre le service `mlflow` -- ce qui suppose de les
 rapprocher sur le meme reseau Docker ou d'exposer MLflow autrement qu'en `127.0.0.1` uniquement
 (cf. point 1 sur l'exposition du port). Non fait a ce jour : aucun besoin de centraliser les runs
 d'entrainement Airflow et locaux n'a encore ete identifie.
 ## Machine cible, exécution Docker
 Statut : `Fait`. Défini par l'overlay `docker-compose.prod.yml`, appliqué par-dessus le
@@ -277,7 +314,7 @@ Ces arbitrages sont pris. Ils ne vivaient jusqu'ici que dans des commentaires de
 | Base applicative | `enervision` | Variable `POSTGRES_DB` |
 | Base de test | `enervision_test` | Créée par `db/init/110-test-database.sql`, nom attendu en dur par `apps/backend/tests/conftest.py` |
 | Base de métadonnées Airflow | `airflow` | Créée par `db/init/120-airflow-database.sql`, même conteneur `db` |
-| Webserver Airflow | `8080` | `make airflow-up`. Scheduler et webserver ne publient que ce port ; les tâches (`LocalExecutor`) tournent côté scheduler, sans port propre |
+| API server Airflow | `8080` | `make airflow-up`. Api-server, scheduler et dag-processor ne publient que ce port ; les tâches (`LocalExecutor`) tournent côté scheduler, sans port propre |
 ## Le trou vers k3s
@@ -287,6 +287,10 @@ Chaque table remplit un rôle précis dans le traitement et l'exploitation des d
 | `alert` | Enregistrer les alertes, leur type, leur gravité et leur message | API Mock `/alerts` et détections EnerVision |
 | `recommendation` | Proposer des actions et expliquer la règle qui les motive | Règles métier d'EnerVision |
 Le scoring (`ml_score`) charge le modèle depuis un fichier local (`models/lightgbm-consumption.txt`)
 et trace son empreinte SHA-256 dans `prediction.model_reference`. Il ne lit aucune version depuis
 le Model Registry MLflow (`ml/`) : ce registre sert aujourd'hui à la traçabilité des
 entraînements, pas au déploiement du modèle de scoring.
 Les anomalies historiques décrites dans les JSON sont conservées dans `dataset.metadata`.
 Elles servent à l'analyse des données et ne sont pas considérées comme des alertes actuelles.
@@ -90,9 +90,10 @@ rien changer), mais ce serait à borner sur un dépôt à forte fréquence de pu
 `backend.yml`, `ml.yml` et `airflow.yml` déclarent en plus un groupe de concurrence par référence
 git avec `cancel-in-progress`, ce qui annule un run devenu obsolète par un push plus récent.
-**Piège de version** : `etl/airflow` tourne en **Python 3.12** et non 3.14, parce qu'Airflow 2.10
+**Piège de version** : `etl/airflow` tourne en **Python 3.12** et non 3.14 : c'est l'interpréteur
-ne supporte pas encore 3.14. Le 3.14 du module ML ne vit, dans ce contexte, que dans l'image
+de l'image `apache/airflow:3.3.2-python3.12` retenue, et les tests d'intégrité doivent tourner sur
-Docker et son propre environnement.
+le même. Le 3.14 du module ML ne vit, dans ce contexte, que dans l'image Docker et son propre
 environnement.
 ## Déploiement
@@ -1,9 +1,9 @@
 # Image Airflow EnerVision : ajoute ml/ et apps/backend/ dans leurs propres environnements Python
-# 3.14, distincts du Python 3.12 qui fait tourner Airflow lui-meme (apache-airflow 2.10 ne supporte
+# 3.14, distincts du Python 3.12 de l'image de base qui fait tourner Airflow lui-meme, pour que
-# pas 3.14), pour que les DAGs puissent lancer `uv run python -m enervision_ml.train`/`.score`,
+# les DAGs puissent lancer `uv run python -m enervision_ml.train`/`.score`,
 # `app.detection.internal_alerts` et `app.cli` en sous-processus. Airflow ne devient jamais un
 # consommateur direct de LightGBM, de MLflow ou du SQLAlchemy du backend. Cf. ADR 0008.
-FROM apache/airflow:2.10.4-python3.12
+FROM apache/airflow:3.3.2-python3.12
 # LightGBM est compile contre libgomp (OpenMP), absent de l'image de base (minimale, sans
 # toolchain de compilation). Sans lui : `OSError: libgomp.so.1: cannot open shared object file`
@@ -21,9 +21,8 @@ RUN apt-get update \
 RUN mkdir -p /opt/ml/state /opt/backend && chown -R airflow:root /opt/ml /opt/backend
 USER airflow
-# L'image de base embarque deja un `uv`, mais trop ancien (0.4.29) pour le format de verrou de
+# L'image de base embarque deja un `uv`, mais pas celui que le depot epingle par ailleurs
-# `ml/uv.lock`. On le remplace par la version deja pinnee ailleurs dans le depot
+# (apps/backend/Dockerfile) : on aligne, pour que le format de verrou lu soit le meme partout.
 # (apps/backend/Dockerfile).
 COPY --from=ghcr.io/astral-sh/uv:0.11.26 /uv /home/airflow/.local/bin/uv
 # Piege : pas de `UV_PROJECT_ENVIRONMENT` global. Il vaudrait pour les deux projets, et `uv run`
@@ -15,8 +15,8 @@ from __future__ import annotations
 from datetime import datetime, timedelta
-from airflow.models.dag import DAG
+from airflow.providers.standard.operators.bash import BashOperator
-from airflow.operators.bash import BashOperator
+from airflow.sdk import DAG
 # Le backend a son propre environnement uv dans l'image (ADR 0008). `--no-sync` et
 # `env -u VIRTUAL_ENV` : cf. `ml_train.py`, même raisonnement.
@@ -1,45 +1,45 @@
-"""DAG d'import du dataset historique EnerVision (issue #119).
+"""DAG d'import du dataset historique EnerVision (issue #119).
-
+
-Orchestre le pipeline existant `app.etl.historical_import` sans dupliquer sa logique ETL.
+Orchestre le pipeline existant `app.etl.historical_import` sans dupliquer sa logique ETL.
-Le dataset historique sert à initialiser l'environnement : le DAG reste donc manuel.
+Le dataset historique sert à initialiser l'environnement : le DAG reste donc manuel.
-
+
-Le backend est exécuté dans l'environnement `/opt/backend` embarqué dans l'image Airflow,
+Le backend est exécuté dans l'environnement `/opt/backend` embarqué dans l'image Airflow,
-sur le même patron que le DAG `alertes` (ADR 0008).
+sur le même patron que le DAG `alertes` (ADR 0008).
-"""
+"""
-
+
-from __future__ import annotations
+from __future__ import annotations
-
+
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta
-
+
-from airflow.models.dag import DAG
+from airflow.providers.standard.operators.bash import BashOperator
-from airflow.operators.bash import BashOperator
+from airflow.sdk import DAG
-
+
-COMMANDE_BACKEND = "cd /opt/backend && env -u VIRTUAL_ENV uv run --no-sync python -m"
+COMMANDE_BACKEND = "cd /opt/backend && env -u VIRTUAL_ENV uv run --no-sync python -m"
-
+
-CSV_PATH = "/opt/data/raw/all_sites_combined.csv"
+CSV_PATH = "/opt/data/raw/all_sites_combined.csv"
-METADATA_PATH = "/opt/data/raw/dataset_metadata.json"
+METADATA_PATH = "/opt/data/raw/dataset_metadata.json"
-SOURCE_TIMEZONE = "UTC"
+SOURCE_TIMEZONE = "UTC"
-BATCH_SIZE = 1000
+BATCH_SIZE = 1000
-
+
-with DAG(
+with DAG(
-    dag_id="historical_import",
+    dag_id="historical_import",
-    description="Importe le dataset historique CSV/JSON dans dataset, site et reading.",
+    description="Importe le dataset historique CSV/JSON dans dataset, site et reading.",
-    schedule=None,
+    schedule=None,
-    start_date=datetime(2026, 1, 1),
+    start_date=datetime(2026, 1, 1),
-    catchup=False,
+    catchup=False,
-    max_active_runs=1,
+    max_active_runs=1,
-    tags=["etl", "historical"],
+    tags=["etl", "historical"],
-) as dag:
+) as dag:
-    BashOperator(
+    BashOperator(
-        task_id="import_historical",
+        task_id="import_historical",
-        bash_command=(
+        bash_command=(
-            f"{COMMANDE_BACKEND} app.etl.historical_import "
+            f"{COMMANDE_BACKEND} app.etl.historical_import "
-            f"--csv {CSV_PATH} "
+            f"--csv {CSV_PATH} "
-            f"--metadata {METADATA_PATH} "
+            f"--metadata {METADATA_PATH} "
-            "--source-timezone UTC "
+            "--source-timezone UTC "
-            "--batch-size 1000"
+            "--batch-size 1000"
-        ),
+        ),
-        retries=1,
+        retries=1,
-        retry_delay=timedelta(minutes=2),
+        retry_delay=timedelta(minutes=2),
-        execution_timeout=timedelta(minutes=30),
+        execution_timeout=timedelta(minutes=30),
-    )
+    )
@@ -10,8 +10,8 @@ from __future__ import annotations
 from datetime import datetime, timedelta
-from airflow.models.dag import DAG
+from airflow.providers.standard.operators.bash import BashOperator
-from airflow.operators.bash import BashOperator
+from airflow.sdk import DAG
 MODEL_PATH = "/opt/ml/state/models/lightgbm-consumption.txt"
@@ -11,8 +11,8 @@ from __future__ import annotations
 from datetime import datetime, timedelta
-from airflow.models.dag import DAG
+from airflow.providers.standard.operators.bash import BashOperator
-from airflow.operators.bash import BashOperator
+from airflow.sdk import DAG
 MODEL_PATH = "/opt/ml/state/models/lightgbm-consumption.txt"
 MLFLOW_TRACKING_URI = "sqlite:////opt/ml/state/mlflow.db"
@@ -4,7 +4,7 @@ version = "0.1.0"
 description = "DAGs d'orchestration EnerVision (Airflow)"
 requires-python = ">=3.12,<3.13"
 dependencies = [
-    "apache-airflow==2.10.4",
+    "apache-airflow==3.3.2",
 ]
 [dependency-groups]
@@ -5,8 +5,8 @@ from datetime import timedelta
 from pathlib import Path
 import pytest
-from airflow.models.baseoperator import BaseOperator
+from airflow.dag_processing.dagbag import DagBag
-from airflow.models.dagbag import DagBag
+from airflow.sdk import BaseOperator
 DAGS_FOLDER = Path(__file__).resolve().parent.parent / "dags"
@@ -22,7 +22,7 @@ TACHES = [
@pytest.fixture(scope="module")
 def dagbag() -> DagBag:
-    return DagBag(dag_folder=str(DAGS_FOLDER), include_examples=False)
+    return DagBag(dag_folder=str(DAGS_FOLDER))
 def test_dags_folder_has_no_import_error(dagbag: DagBag) -> None:
@@ -34,22 +34,22 @@ def test_every_expected_dag_is_discovered(dagbag: DagBag) -> None:
 def test_ml_train_has_no_schedule(dagbag: DagBag) -> None:
-    assert dagbag.dags["ml_train"].timetable.summary == "None"
+    assert dagbag.dags["ml_train"].schedule is None
 def test_ml_score_runs_every_hour(dagbag: DagBag) -> None:
-    # `@hourly` est un alias Airflow pour ce cron, c'est sous cette forme que `.summary` le rend.
+    # `@hourly` est un alias Airflow pour ce cron, c'est sous cette forme que la timetable le rend.
-    assert dagbag.dags["ml_score"].timetable.summary == "0 * * * *"
+    assert dagbag.dags["ml_score"].timetable.expression == "0 * * * *"
 def test_alertes_runs_after_the_hourly_scoring(dagbag: DagBag) -> None:
    # Le decalage n'est pas cosmetique : la regle `anomaly` compare une lecture a la `prediction`
    # du meme instant, que `ml_score` ecrit a l'heure pile.
-    assert dagbag.dags["alertes"].timetable.summary == "15 * * * *"
+    assert dagbag.dags["alertes"].timetable.expression == "15 * * * *"
 def test_historical_import_has_no_schedule(dagbag: DagBag) -> None:
-    assert dagbag.dags["historical_import"].timetable.summary == "None"
+    assert dagbag.dags["historical_import"].schedule is None
 def test_ml_train_task_calls_the_training_module(dagbag: DagBag) -> None:
@@ -9,7 +9,7 @@ Terminaison TLS et routage de la stack déployée. Seul composant publié sur le
 - `tls/` : les deux fichiers que nginx lit, `fullchain.pem` et `privkey.pem`. Ignorés par git.
 - `acme-deploy-hook.sh` : recopie le résultat de certbot dans `tls/`.
-Pas de `Dockerfile` : l'image officielle `nginx:1.28-alpine` est utilisée telle quelle et la
+Pas de `Dockerfile` : l'image officielle `nginx:1.31-alpine` est utilisée telle quelle et la
 configuration est montée en volume par `docker-compose.prod.yml`.
 L'overlay emploie les marqueurs `!override` et `!reset`, qui demandent **Docker Compose 2.24.4
@@ -88,7 +88,7 @@ docker run --rm \
  -v "$PWD/infra/proxy/nginx.conf:/etc/nginx/nginx.conf:ro" \
  -v "$PWD/infra/proxy/conf.d:/etc/nginx/conf.d:ro" \
  -v "$PWD/infra/proxy/tls:/etc/nginx/tls:ro" \
-  nginx:1.28-alpine nginx -t
+  nginx:1.31-alpine nginx -t
 ```
 Monter `infra/proxy/` entier sur `/etc/nginx` échouerait : `mime.types` vient de l'image.
@@ -0,0 +1,6 @@
 .venv
 data
 mlruns
 mlflow.db*
 models
 .env
@@ -0,0 +1 @@
 MLFLOW_DB_PASSWORD=change-me
@@ -0,0 +1,7 @@
 FROM python:3.14-slim
 RUN pip install --no-cache-dir --only-binary :all: mlflow==3.16.1 psycopg2-binary==2.9.13
 RUN useradd --create-home --uid 1000 mlflow \
    && mkdir /mlartifacts \
    && chown mlflow /mlartifacts
 USER mlflow
 EXPOSE 5000
@@ -57,6 +57,50 @@ validation. La coupure est **chronologique**, jamais un tirage aleatoire de lign
 aleatoire laisserait des lignes de validation "voir" des lignes d'entrainement via leurs
 lags/moyennes glissantes, une fuite qui masquerait un surapprentissage.
 ## Serveur MLflow (conteneur)
 Premiere utilisation : copier `.env.example` en `.env` et y choisir un mot de passe PostgreSQL
 (lettres et chiffres uniquement). Le fichier `.env` est ignore par git.
 ```bash
 cp .env.example .env
 ```
 Un serveur MLflow (PostgreSQL pour les metadonnees, volume pour les artefacts) se lance avec
 Docker. Prerequis : Docker Desktop demarre.
 ```bash
 make mlflow-up
 ```
 La cible vérifie que `MLFLOW_DB_PASSWORD` (définie dans `ml/.env`) ne contient que des lettres et
 des chiffres avant de démarrer le serveur : ce mot de passe est interpolé directement dans l'URI
 PostgreSQL (`postgresql://mlflow:${MLFLOW_DB_PASSWORD}@...`), un caractère spécial la rendrait
 invalide sans message d'erreur clair.
 Interface : http://localhost:5000. Entrainer vers ce serveur :
 ```
 uv run python -m enervision_ml.train --csv data/all_sites_combined.csv --mlflow-tracking-uri http://localhost:5000
 ```
 Arreter : `docker compose -f docker-compose.mlflow.yml down` (ajouter `-v` pour effacer aussi les
 runs et les modeles).
 Pour voir les runs dans l'interface (MLflow 3.x) :
 - Passer le selecteur en haut a gauche sur **Model training**. Le mode **GenAI** affiche des
  traces LLM et reste vide pour un entrainement LightGBM.
 - **Runs** liste les entrainements, **Models** les artefacts de modele de chaque run (tous nommes
  `model`), et **Model registry** les versions numerotees de `consumption-forecast-lightgbm`.
 Limites : l'identifiant PostgreSQL du compose est fixe a `mlflow`, le mot de passe vient de la
 variable obligatoire `MLFLOW_DB_PASSWORD` (aucune valeur par defaut, le compose refuse de
 demarrer sans elle) -- ce mot de passe est choisi lors de la copie de `.env.example`, il ne
 convient donc qu'au developpement local tel quel. Un deploiement partage demandera des secrets,
 de l'authentification et un stockage d'artefacts dedie (S3/MinIO). Le port 5000 doit etre libre : arreter `mlflow ui` avant,
 ou changer le mapping (`"5001:5000"`) dans le compose.
 ## Scoring
 ```bash
@@ -83,6 +127,13 @@ section 2 :
 fichier : `train.py` reecrit toujours le meme chemin a chaque entrainement, donc le nom seul ne
 distinguerait pas deux versions du modele.
 **Le scoring ne lit pas le Model Registry.** Le fichier charge par `--model` est local
 (`models/lightgbm-consumption.txt`), independant des versions enregistrees dans le
 **Model registry** MLflow (`consumption-forecast-lightgbm`). `train.py` enregistre bien une
 version a chaque entrainement (tracabilite), mais aucun alias (`champion` par exemple) n'est
 pose, et `enervision_ml.score` ne les lit pas. Le registre sert aujourd'hui a la tracabilite des
 entrainements, pas au deploiement du modele utilise en scoring.
 En mode `--csv`, rien n'est ecrit en base : c'est un instantane historique fige (l'heure "future"
 calculee a partir de la fin du CSV n'existe dans aucune base reelle), utile pour valider le
 pipeline sans base joignable.
@@ -0,0 +1,32 @@
 services:
  mlflow-db:
    image: postgres:17
    environment:
      POSTGRES_USER: mlflow
      POSTGRES_PASSWORD: ${MLFLOW_DB_PASSWORD:?definir MLFLOW_DB_PASSWORD dans ml/.env}
      POSTGRES_DB: mlflow
    volumes:
      - mlflow-db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U mlflow"]
      interval: 5s
      retries: 10
  mlflow:
    build: .
    depends_on:
      mlflow-db:
        condition: service_healthy
    ports:
      - "127.0.0.1:5000:5000"
    volumes:
      - mlflow-artifacts:/mlartifacts
    environment:
      MLFLOW_DB_PASSWORD: ${MLFLOW_DB_PASSWORD}
    entrypoint: [ "/bin/sh", "-c" ]
    command:
      - exec mlflow server --host 0.0.0.0 --port 5000 --backend-store-uri "postgresql://mlflow:$$MLFLOW_DB_PASSWORD@mlflow-db:5432/mlflow" --artifacts-destination /mlartifacts --serve-artifacts
 volumes:
  mlflow-db-data:
  mlflow-artifacts:
@@ -181,7 +181,11 @@ def _log_to_mlflow(
        )
        mlflow.log_metrics({f"model_{cle}": valeur for cle, valeur in model_metrics.items()})
        mlflow.log_metrics({f"baseline_{cle}": valeur for cle, valeur in baseline_metrics.items()})
-        mlflow.lightgbm.log_model(booster, name="model")
+        mlflow.lightgbm.log_model(
            booster,
            name="model",
            registered_model_name="consumption-forecast-lightgbm",
        )
        mlflow.log_artifact(str(model_output))
@@ -3,6 +3,7 @@ from pathlib import Path
 import numpy as np
 import pandas as pd
 import pytest
 from enervision_ml.features import TARGET_COLUMN, build_features, feature_columns
 from enervision_ml.train import chronological_split, prepare_dataset, train
@@ -74,3 +75,19 @@ def test_train_runs_end_to_end_on_synthetic_data_and_beats_a_dummy_baseline(
    assert model_metrics["n_observations"] > 0
    assert model_metrics["mae"] >= 0
    assert baseline_metrics["n_observations"] == model_metrics["n_observations"]
    assert model_metrics["mae"] < baseline_metrics["mae"]
 def test_train_raises_when_the_validation_window_is_empty(tmp_path: Path) -> None:
    depart = datetime(2026, 1, 1, tzinfo=UTC)
    frame = make_frame("site-a", heures=50, depart=depart)  # trop court pour un lag de 168h
    csv_path = tmp_path / "trop_court.csv"
    frame.to_csv(csv_path, index=False)
    with pytest.raises(ValueError, match="Fenetre d'entrainement ou de validation vide"):
        train(
            csv_path=csv_path,
            model_output=tmp_path / "model.txt",
            test_fraction=0.2,
            tracking_uri=f"sqlite:///{tmp_path / 'mlflow.db'}",
        )