CI TESTING

.github/workflows/build_and_test.yml

@@ -2,9 +2,9 @@ name: build and test
 
 on:
   push:
-    branches: [ master ]
+    branches: [ master, 3.0 ]
   pull_request:
-    branches: [ master ]
+    branches: [ master, 3.0 ]
 
 jobs:
   test:
@@ -91,7 +91,7 @@ jobs:
           TOMVIZ_REQUIRE_PYXRF: true
       run: |
         cd tomviz-build
-        export TOMVIZ_TEST_PYTHON_EXECUTABLE=$(which python3)
+        export TOMVIZ_TEST_PYTHON_EXECUTABLE=$(which python)
         ctest --output-on-failure
 
     - name: Upload CTest Log (On Failure Only)

.github/workflows/build_requirements.txt

@@ -8,3 +8,4 @@ libxml2-devel=2.14*
 gtest
 # This is needed for installing stuff on Python3.13
 setuptools
+pip

.github/workflows/pyxrf_requirements.txt

@@ -12,6 +12,7 @@ hatchling
 # it gets fixed and a new release comes out.
 # See: https://github.com/NSLS-II-SRX/xrf-tomo/pull/10
 pandas<3.0
-# This is required for running pyxrf-utils on Python3.11
-# Setuptools was removed in versions 80+
-setuptools<80
+# Setuptools comes in transitively, but keep a floor here to stay clear of
+# CVE-2026-59890. The previous "setuptools<80" ceiling is no longer needed,
+# since the pyxrf imports now work without pkg_resources.
+setuptools>=83

CMakeLists.txt

@@ -54,8 +54,12 @@ set(tomviz_js_binary_path "${tomviz_html_binary_dir}/tomviz.js")
 set(tomviz_html_binary_path "${tomviz_html_binary_dir}/tomviz.html")
 set(tomviz_web_install_dir "${INSTALL_DATA_DIR}/tomviz/web")
 
-# Centrally set the grand exception for macOS...
 if(APPLE)
+  option(TOMVIZ_MACOSX_BUNDLE "Build a macOS app bundle" ON)
+endif()
+
+# Centrally set the grand exception for macOS...
+if(APPLE AND TOMVIZ_MACOSX_BUNDLE)
   set(MACOSX_BUNDLE_NAME "tomviz")
   set(prefix "Applications/${MACOSX_BUNDLE_NAME}.app/Contents")
   set(INSTALL_INCLUDE_DIR "${prefix}/${INSTALL_INCLUDE_DIR}")
@@ -100,21 +104,34 @@ include(tomvizDetermineVersion)
 include(Git)
 
 determine_version("${tomviz_SOURCE_DIR}" "${GIT_EXECUTABLE}" "tomviz")
-# Hard coded for source tarballs, releases, etc.
-set(tomviz_version_major 2)
+# The version being developed here. Authoritative, because "git
+# describe" keeps reporting the previous release until the matching tag
+# is created, and a 3.0 build must not label itself 2.3.1. Also what
+# source tarballs (no git at all) fall back on.
+set(tomviz_version_major 3)
 set(tomviz_version_minor 0)
 set(tomviz_version_patch 0)
 set(tomviz_version_extra)
 set(tomviz_version
   "${tomviz_version_major}.${tomviz_version_minor}.${tomviz_version_patch}")
-if(tomviz_VERSION)
-  set(tomviz_version_major ${tomviz_VERSION_MAJOR})
-  set(tomviz_version_minor ${tomviz_VERSION_MINOR})
-  set(tomviz_version_patch ${tomviz_VERSION_PATCH})
+
+# git describe refines that in two ways: it supplies the commit-count
+# and sha suffix that distinguishes a development build from the release
+# (empty when sitting exactly on the tag), and once a tag newer than the
+# version above exists it takes over the number too, so tagging 3.0.1
+# needs no edit here. Packaging that builds outside a git checkout can
+# pass -DTOMVIZ_GIT_DESCRIBE=<version> to drive both.
+if(tomviz_VERSION_FULL)
   set(tomviz_version_extra ${tomviz_VERSION_PATCH_EXTRA})
+  set(tomviz_git_version
+    "${tomviz_VERSION_MAJOR}.${tomviz_VERSION_MINOR}.${tomviz_VERSION_PATCH}")
+  if("${tomviz_git_version}" VERSION_GREATER "${tomviz_version}")
+    set(tomviz_version_major ${tomviz_VERSION_MAJOR})
+    set(tomviz_version_minor ${tomviz_VERSION_MINOR})
+    set(tomviz_version_patch ${tomviz_VERSION_PATCH})
+    set(tomviz_version "${tomviz_git_version}")
+  endif()
 endif()
-set(tomviz_version
-  "${tomviz_version_major}.${tomviz_version_minor}.${tomviz_version_patch}")
 
 option(TOMVIZ_USE_EXTERNAL_VTK "Use an external VTK." OFF)
 mark_as_advanced(TOMVIZ_USE_EXTERNAL_VTK)

cmake/CompilerFlags.cmake

@@ -11,7 +11,13 @@ if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU" OR CMAKE_CXX_COMPILER_ID MATCHES "Clang"
   include(CheckCXXCompilerFlag)
 
   # Additional warnings for GCC
-  set(CMAKE_CXX_FLAGS_WARN "-Wnon-virtual-dtor -Wno-long-long -Wcast-align -Wchar-subscripts -Wall -Wpointer-arith -Wformat-security -Woverloaded-virtual -fno-check-new -fno-common")
+  set(CMAKE_CXX_FLAGS_WARN "-Wnon-virtual-dtor -Wno-long-long -Wcast-align -Wchar-subscripts -Wall -Wpointer-arith -Wformat-security -Woverloaded-virtual -fno-common")
+
+  # -fno-check-new is a GCC-only flag; clang accepts but ignores it and then
+  # warns that the argument is unused, so only pass it to GCC.
+  if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
+    set(CMAKE_CXX_FLAGS_WARN "${CMAKE_CXX_FLAGS_WARN} -fno-check-new")
+  endif()
 
   # This flag is useful as not returning from a non-void function is an error
   # with MSVC, but it is not supported on all GCC compiler versions

cmake/tomvizDetermineVersion.cmake

@@ -40,7 +40,7 @@ function(determine_version source_dir git_command var_prefix)
   if (NOT TOMVIZ_GIT_DESCRIBE)
     if (EXISTS ${git_command})
       execute_process(
-        COMMAND ${git_command} describe
+        COMMAND ${git_command} describe --tags
         WORKING_DIRECTORY ${source_dir}
         RESULT_VARIABLE result
         OUTPUT_VARIABLE output