Add sum() to the extended stdlib, refresh dependencies and modernise CI (#39)

Closes #14 by adding `sum` to cel.stdlib's core library (Kubernetes list-library
semantics: int/uint/double plus duration, sum([]) == 0, bools rejected, no mixing
of numbers and durations), and documents why fold/reduce must come from cel-rust
instead: functions receive evaluated arguments, and the comprehension macros are
expanded by the parser from a fixed, non-extensible table.

Dependencies refreshed within their existing ranges (cel 0.14.3, PyO3 0.29.2,
regex 1.13.1, serde 1.0.229, serde_json 1.0.151, thiserror 2.0.20, uuid 1.24.1),
with uv.lock now committed so CI resolves what local development does.

CI: adds Python 3.13 and 3.14, pins ruff to the 0.16 line and excludes Markdown
from the formatter (ruff 0.16 began formatting docs code blocks, which would have
failed the lint job on the next push to main), moves the security scan to
`uvx safety scan`, and updates claude-code-action from @beta to @v1.

Also documents the Python callback boundary's two lossy conversions — uint returns
as int, durations are microsecond-resolution — with tests pinning both.

Author: hardbyte

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.11", "3.12"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@v5
 

.github/workflows/claude.yml

@@ -30,7 +30,7 @@ jobs:
           fetch-depth: 1
 
       - name: Run Claude PR Action
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           # Or use OAuth token instead:

.github/workflows/security.yml

@@ -42,9 +42,9 @@ jobs:
         run: uv sync --dev
 
       - name: Run Python security scan
-        run: |
-          uv add --dev safety
-          uv run safety check --ignore 70612
+        # `safety check` is retired in favour of `safety scan`; run it with uvx so
+        # the scanner is not added to this project's dev dependencies.
+        run: uvx safety scan --detailed-output
         continue-on-error: true  # Don't fail CI on security advisories, just report
 
   codeql:

.gitignore

@@ -8,9 +8,6 @@ htmlcov/
 # Rust
 target/
 
-# UV
-uv.lock
-
 # Project specific
 site/
 *.so

CHANGELOG.md

@@ -7,6 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- `cel.stdlib`'s `core` library gains `sum`, completing the aggregation trio
+  (`min`, `max`, `sum`) requested in
+  [#14](https://github.com/hardbyte/python-common-expression-language/issues/14).
+  It follows Kubernetes' CEL list library: `int`, `uint`, `double` and `duration`
+  are supported; `sum([])` is `0`; booleans are rejected rather than counted as
+  `1`/`0`; numbers and durations cannot be mixed. As with every `cel.stdlib`
+  function, results cross the Python callback boundary, so a `uint` sum returns
+  an `int` and durations are microsecond-resolution — both now documented. As with the rest of the
+  extended stdlib it works in both call forms — `sum([1, 2, 3])` and
+  `items.map(i, i.weight).sum()`.
+  `fold`/`reduce` remain unavailable: they need a parser-level comprehension
+  macro, which has to come from [cel-rust](https://github.com/cel-rust/cel-rust)
+  rather than this wrapper.
+
+### Updated
+
+- Refreshed the locked Rust dependencies within their existing ranges: cel
+  0.14.0 to 0.14.3, PyO3 0.29.0 to 0.29.2, plus transitive bumps (regex 1.13.1,
+  serde 1.0.229, serde_json 1.0.151, thiserror 2.0.20, uuid 1.24.1).
+- `uv.lock` is now committed so CI resolves the same Python dependencies as
+  local development; refresh it with `uv lock --upgrade`.
+- CI tests Python 3.13 and 3.14 in addition to 3.11 and 3.12.
+- Pinned ruff to the 0.16 line and excluded Markdown from `ruff format`, so
+  formatter releases no longer change what CI expects of the docs.
+- The security workflow runs `safety scan` via `uvx` (the retired `safety check`
+  command no longer works, and the scanner is no longer added to this project's
+  dev dependencies), and the Claude workflow uses
+  `anthropics/claude-code-action@v1` instead of the deprecated `@beta` tag.
+
 ## [0.7.0] - 2026-07-04
 
 Upgrades to cel-rust 0.14, ships an extended standard library that mirrors