ONSdigital · MebinAbraham · Jul 10, 2026 · Jul 10, 2026 · Jul 10, 2026
diff --git a/README.md b/README.md
@@ -422,8 +422,8 @@ There are many alternatives to the tools used in this template, and you may pref
 - Extend test suite
 - Add more documentation and developer guidance
 - Add support for pre-commit hooks
+- Update GitHub repo set up to use latest best practices - rulesets etc vs legacy branch protection.
 - Further customisation options for the template:
-    - Ability to choose your own Package Manager (Poetry, Pipenv, PDM, etc.)
     - Ability to choose your own Linting/Formatting tools
     - Ability to choose your own Type Checking tools
     - Ability to configure the GitHub repo setting post-generation via GitHub Template feature.

diff --git a/poetry.lock b/poetry.lock
diff --git a/project_template/.github/workflows/{% if is_public_repo %}codeql.yml{% endif %} b/project_template/.github/workflows/{% if is_public_repo %}codeql.yml{% endif %}
@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.
@@ -51,7 +51,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -66,7 +66,7 @@ jobs:
       # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -79,6 +79,6 @@ jobs:
       #     ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: /language:${{matrix.language}}
diff --git a/project_template/{% if pipenv_copier %}Pipfile.lock{% endif %}.jinja b/project_template/{% if pipenv_copier %}Pipfile.lock{% endif %}.jinja
diff --git a/project_template/{% if pipenv_no_copier %}Pipfile.lock{% endif %}.jinja b/project_template/{% if pipenv_no_copier %}Pipfile.lock{% endif %}.jinja
diff --git a/project_template/{% if poetry_copier %}poetry.lock{% endif %}.jinja b/project_template/{% if poetry_copier %}poetry.lock{% endif %}.jinja
diff --git a/project_template/{% if poetry_copier %}pyproject.toml{% endif %}.jinja b/project_template/{% if poetry_copier %}pyproject.toml{% endif %}.jinja
@@ -18,6 +18,6 @@ pylint = "^4.0.6"
 black = "^26.5.1"
 pytest = "^9.1.1"
 pytest-xdist = "^3.8.0"
-ruff = "^0.15.20"
+ruff = "^0.15.21"
 pytest-cov = "^7.1.0"
-mypy = "^2.1.0"
+mypy = "^2.2.0"
diff --git a/project_template/{% if poetry_no_copier %}poetry.lock{% endif %}.jinja b/project_template/{% if poetry_no_copier %}poetry.lock{% endif %}.jinja
diff --git a/project_template/{% if poetry_no_copier %}pyproject.toml{% endif %}.jinja b/project_template/{% if poetry_no_copier %}pyproject.toml{% endif %}.jinja
@@ -17,6 +17,6 @@ pylint = "^4.0.6"
 black = "^26.5.1"
 pytest = "^9.1.1"
 pytest-xdist = "^3.8.0"
-ruff = "^0.15.20"
+ruff = "^0.15.21"
 pytest-cov = "^7.1.0"
-mypy = "^2.1.0"
+mypy = "^2.2.0"
diff --git a/project_template/{% if uv_copier %}pyproject.toml{% endif %}.jinja b/project_template/{% if uv_copier %}pyproject.toml{% endif %}.jinja
@@ -15,10 +15,10 @@ dev = [
     # :TODO: Remove pylint when ruff supports all pylint rules
     # :TODO: Remove black when ruff supports all black rules
     "copier>=9.16.0",
-    "mypy>=2.1.0",
+    "mypy>=2.2.0",
     "pylint>=4.0.6",
     "pytest>=9.1.1",
     "pytest-cov>=7.1.0",
     "pytest-xdist>=3.8.0",
-    "ruff>=0.15.20",
+    "ruff>=0.15.21",
 ]
diff --git a/project_template/{% if uv_copier %}uv.lock{% endif %}.jinja b/project_template/{% if uv_copier %}uv.lock{% endif %}.jinja
diff --git a/project_template/{% if uv_no_copier %}pyproject.toml{% endif %}.jinja b/project_template/{% if uv_no_copier %}pyproject.toml{% endif %}.jinja
@@ -14,10 +14,10 @@ dev = [
     "black>=26.5.1",
     # :TODO: Remove pylint when ruff supports all pylint rules
     # :TODO: Remove black when ruff supports all black rules
-    "mypy>=2.1.0",
+    "mypy>=2.2.0",
     "pylint>=4.0.6",
     "pytest>=9.1.1",
     "pytest-cov>=7.1.0",
     "pytest-xdist>=3.8.0",
-    "ruff>=0.15.20",
+    "ruff>=0.15.21",
 ]
diff --git a/project_template/{% if uv_no_copier %}uv.lock{% endif %}.jinja b/project_template/{% if uv_no_copier %}uv.lock{% endif %}.jinja
diff --git a/pyproject.toml b/pyproject.toml
@@ -10,19 +10,17 @@ package-mode = false
 [tool.poetry.dependencies]
 python = "^3.11"
 copier = "^9.16.0"
-# Pinned to fix low severity vulnerability GHSA-5239-wwwm-4pmq (transitive dep via copier/pytest)
-pygments = "^2.20.0"
 
 [tool.poetry.group.dev.dependencies]
 # :TODO: Remove pylint when ruff supports all pylint rules
 pylint = "^4.0.6"
 # :TODO: Remove black when ruff supports all black rules
 black = "^26.5.1"
 pytest = "^9.1.1"
-pytest-xdist = "^3.6.1"
-ruff = "^0.15.20"
+pytest-xdist = "^3.8.0"
+ruff = "^0.15.21"
 pytest-cov = "^7.1.0"
-mypy = "^2.1.0"
+mypy = "^2.2.0"
 
 [build-system]
 requires = ["poetry-core"]