diff --git a/.github/workflows/_build.yaml b/.github/workflows/_build.yaml
index 3aa17238..846ad7af 100644
--- a/.github/workflows/_build.yaml
+++ b/.github/workflows/_build.yaml
@@ -55,18 +55,18 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
 
     - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ matrix.python }}
 
diff --git a/.github/workflows/_generate-rebase.yaml b/.github/workflows/_generate-rebase.yaml
index 6997533f..bc0dbeed 100644
--- a/.github/workflows/_generate-rebase.yaml
+++ b/.github/workflows/_generate-rebase.yaml
@@ -34,12 +34,12 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
         token: ${{ secrets.REPO_ACCESS_TOKEN }}
diff --git a/.github/workflows/_wiki-documentation.yaml b/.github/workflows/_wiki-documentation.yaml
index d0626d14..aae0be0f 100644
--- a/.github/workflows/_wiki-documentation.yaml
+++ b/.github/workflows/_wiki-documentation.yaml
@@ -41,7 +41,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
@@ -49,7 +49,7 @@ jobs:
     # Check out the repository's Wiki repo into the wiki/ folder. The token is required
     # only for private repositories.
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         token: ${{ secrets.REPO_ACCESS_TOKEN }}
         repository: ${{ format('{0}.wiki', github.repository) }}
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index 77f2e9d9..6d4f7c93 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -33,16 +33,16 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
 
     - name: Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set up Python ${{ matrix.python }}
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ matrix.python }}
 
diff --git a/.github/workflows/macaron-analysis.yaml b/.github/workflows/macaron-analysis.yaml
index 808a0fcb..8800fb50 100644
--- a/.github/workflows/macaron-analysis.yaml
+++ b/.github/workflows/macaron-analysis.yaml
@@ -22,13 +22,13 @@ jobs:
     steps:
 
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
 
     # Check the GitHub Actions workflows in the repository for vulnerabilities.
     - name: Run Macaron action
-      uses: oracle/macaron@4ddb55e3c9ef2c77b548be55c557078c4476fd9c # v0.24.0
+      uses: oracle/macaron@794eec32782979f577efb5ff71d585f683a3550f # v0.25.0
       with:
         repo_path: ./
         policy_file: check-github-actions
diff --git a/.github/workflows/pr-conventional-commits.yaml b/.github/workflows/pr-conventional-commits.yaml
index d3dd0a72..a1fb25d5 100644
--- a/.github/workflows/pr-conventional-commits.yaml
+++ b/.github/workflows/pr-conventional-commits.yaml
@@ -22,12 +22,12 @@ jobs:
     steps:
 
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
 
     - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.14'
 
@@ -36,7 +36,7 @@ jobs:
     - name: Set up Commitizen
       run: |
         pip install --upgrade pip wheel
-        pip install 'commitizen ==4.16.4'
+        pip install 'commitizen ==4.16.5'
 
     # Run Commitizen to check the title of the PR which triggered this workflow, and check
     # all commit messages of the PR's branch. If any of the checks fails then this job fails.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 57dafadc..d5761cd5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -30,26 +30,26 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
         token: ${{ secrets.REPO_ACCESS_TOKEN }}
 
     - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.14'
 
     - name: Set up Commitizen
       run: |
         pip install --upgrade pip wheel
-        pip install 'commitizen ==4.16.4'
+        pip install 'commitizen ==4.16.5'
 
     - name: Set up user
       run: |
@@ -98,13 +98,13 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
 
@@ -126,14 +126,14 @@ jobs:
 
     # Create the Release Notes using commitizen.
     - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.14'
 
     - name: Set up Commitizen
       run: |
         pip install --upgrade pip wheel
-        pip install 'commitizen ==4.16.4'
+        pip install 'commitizen ==4.16.5'
 
     - name: Create Release Notes
       run: cz changelog --dry-run "$(cz version --project)" > RELEASE_NOTES.md
@@ -199,13 +199,13 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
index 265b499b..2ab15378 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -26,18 +26,18 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
     - name: Run analysis
-      uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+      uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
       with:
         results_file: results.sarif
         results_format: sarif
diff --git a/.github/workflows/sync-with-upstream.yaml b/.github/workflows/sync-with-upstream.yaml
index 070a25cc..57773777 100644
--- a/.github/workflows/sync-with-upstream.yaml
+++ b/.github/workflows/sync-with-upstream.yaml
@@ -21,7 +21,7 @@ jobs:
     steps:
 
     - name: Check out template repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         # If you decide to change the upstream template repository to a private one, uncomment
         # the following argument to pass the required token to be able to check it out.
@@ -31,7 +31,7 @@ jobs:
         path: template
 
     - name: Check out current repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         token: ${{ secrets.REPO_ACCESS_TOKEN }}
         fetch-depth: 0
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index dca0697a..9d160529 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -15,7 +15,7 @@ repos:
 
 # Commitizen enforces semantic and conventional commit messages.
 - repo: https://github.com/commitizen-tools/commitizen
-  rev: 205e71c26d6dd6a802ca674c9ae4d12f1103a9bb  # frozen: v4.16.4
+  rev: 6afcd8e9560ddf1b9a5032262a0be26540e85fb3  # frozen: v4.16.5
   hooks:
   - id: commitizen
     name: Check conventional commit message
@@ -23,7 +23,7 @@ repos:
 
 # Ruff formats and lints code.
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: c59bba8fb259db0fec2bbb77ad8ba51ea7341b56  # frozen: v0.15.20
+  rev: cb8c523fd4835aba42af70f4cad5568db4df0b6c  # frozen: v0.16.0
   hooks:
   - id: ruff-format
     args: [--config, pyproject.toml]
@@ -49,9 +49,10 @@ repos:
     name: Check typing annotations
     entry: mypy
     language: python
-    files: ^src/package/|^tests/
+    files: ^src/package/|^tests/  # Declare files to run the hook only when necessary.
     types: [text, python]
-    args: [--explicit-package-bases, --config-file, pyproject.toml]
+    pass_filenames: false
+    args: [--config-file, pyproject.toml]
 
 # Enable a whole bunch of useful helper hooks, too.
 # See https://pre-commit.com/hooks.html for more hooks.
@@ -111,7 +112,7 @@ repos:
   hooks:
   - id: actionlint
 
-# On push to the remote, run all tests.
+# On push to the remote, run all unit tests.
 - repo: local
   hooks:
   - id: pytest
diff --git a/Makefile b/Makefile
index bc7a833f..cd1830ad 100644
--- a/Makefile
+++ b/Makefile
@@ -16,8 +16,10 @@ PACKAGE_VERSION := $(shell python -c $$'try: import $(PACKAGE_NAME); print($(PAC
 # (py3), the ABI tag (none), and the platform tag (any) for the final wheel
 # file name.
 PACKAGE_BASE_NAME := $(PACKAGE_NAME)-$(PACKAGE_VERSION)
-PACKAGE_SDIST_NAME := $(PACKAGE_BASE_NAME).tar.gz
-PACKAGE_WHEEL_NAME := $(PACKAGE_BASE_NAME)-py3-none-any.whl
+PACKAGE_SDIST_BASE_NAME := $(PACKAGE_BASE_NAME)
+PACKAGE_SDIST_NAME := $(PACKAGE_SDIST_BASE_NAME).tar.gz
+PACKAGE_WHEEL_BASE_NAME := $(PACKAGE_BASE_NAME)-py3-none-any
+PACKAGE_WHEEL_NAME := $(PACKAGE_WHEEL_BASE_NAME).whl
 
 # If a PYTHON environment variable exists then use that, else define it here.
 PYTHON ?= python3.14
@@ -98,7 +100,7 @@ venv:
 # See https://packaging.python.org/en/latest/tutorials/packaging-projects/#generating-distribution-archives.
 .PHONY: setup
 setup: force-upgrade
-	pre-commit install
+	python -m pre_commit install
 	mkdir -p dist
 
 # Install or upgrade an existing virtual environment based on the
@@ -108,7 +110,7 @@ upgrade: .venv/upgraded-on
 .venv/upgraded-on: pyproject.toml
 	python -m pip install --upgrade pip setuptools
 	python -m pip install --upgrade wheel
-	python -m pip install --upgrade --upgrade-strategy eager --editable .[actions,dev,docs,hooks,test]
+	python -m pip install --upgrade --upgrade-strategy eager --group dev --editable .
 	$(MAKE) upgrade-quiet
 force-upgrade:
 	rm -f .venv/upgraded-on
@@ -165,15 +167,15 @@ audit:
 .PHONY: check check-code check-ruff check-lint check-mypy check-actionlint
 check-code: check-ruff check-lint check-mypy check-actionlint
 check-ruff:
-	pre-commit run ruff --all-files
+	python -m pre_commit run ruff --all-files
 check-lint:
-	pre-commit run pylint --all-files
+	python -m pre_commit run pylint --all-files
 check-mypy:
-	pre-commit run mypy --all-files
+	python -m pre_commit run mypy --all-files
 check-actionlint:
-	pre-commit run actionlint --all-files
+	python -m pre_commit run actionlint --all-files
 check:
-	pre-commit run --all-files
+	python -m pre_commit run --all-files
 
 # Run different kinds of tests: unit tests, integration tests, performance tests.
 # Note that the default goal 'test' runs the unit tests only, mainly for convenience
@@ -194,8 +196,8 @@ test-all: test-unit test-integration test-performance
 .PHONY: dist
 dist: dist/$(PACKAGE_WHEEL_NAME) dist/$(PACKAGE_SDIST_NAME) dist/$(PACKAGE_BASE_NAME)-docs-html.zip dist/$(PACKAGE_BASE_NAME)-docs-md.zip
 dist/$(PACKAGE_WHEEL_NAME): check test-all
-	SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) python -m flit build --setup-py --format wheel
-	echo $(SOURCE_DATE_EPOCH) > dist/$(PACKAGE_BASE_NAME)-py3-none-any-build-epoch.txt
+	SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) python -m flit build --format wheel
+	echo $(SOURCE_DATE_EPOCH) > dist/$(PACKAGE_WHEEL_BASE_NAME)-build-epoch.txt
 dist/$(PACKAGE_SDIST_NAME): check test-all
 	SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) python -m flit build --no-setup-py --format sdist
 dist/$(PACKAGE_BASE_NAME)-docs-html.zip: docs-html
@@ -264,7 +266,7 @@ clean: dist-clean
 # Remove code caches, or the entire virtual environment.
 .PHONY: nuke-git-hooks nuke-caches nuke
 nuke-git-hooks:
-	find .git/hooks/ -type f ! -name '*.sample' -exec rm -fr {} +
+	find .git/hooks/ -type f ! -name '*.sample' -exec rm -f {} +
 nuke-caches:
 	find src/ -type d -name __pycache__ -exec rm -fr {} +
 	find tests/ -type d -name __pycache__ -exec rm -fr {} +
diff --git a/README.md b/README.md
index 08275fb4..5c002d27 100644
--- a/README.md
+++ b/README.md
@@ -50,7 +50,7 @@ Documentation is important, and [Sphinx](https://www.sphinx-doc.org/en/master/)
 
 ### Versioning and publishing
 
-Automatic package versioning and tagging, publishing to [PyPI](https://pypi.org/), and [Changelog](https://keepachangelog.com/) generation are enabled using Github Actions. Furthermore, an optional [Release Notification](https://github.com/jenstroeger/python-package-template/tree/main/.github/workflows/release-notifications.yaml) Action allows Github to push an update notification to a [Slack bot](https://api.slack.com/bot-users) of your choice. For setup instructions, please see [below](#versioning-publishing-and-changelog).
+Automatic and immutable package versioning and tagging, publishing to [PyPI](https://pypi.org/), and [Changelog](https://keepachangelog.com/) generation are enabled using Github Actions. Furthermore, an optional [Release Notification](https://github.com/jenstroeger/python-package-template/tree/main/.github/workflows/release-notifications.yaml) Action allows Github to push an update notification to a [Slack bot](https://api.slack.com/bot-users) of your choice. For setup instructions, please see [below](#versioning-publishing-and-changelog).
 
 ### Dependency analysis
 
@@ -261,7 +261,7 @@ The [sync-with-upstream.yaml](https://github.com/jenstroeger/python-package-temp
 
 To enable automation for [semantic versioning](https://semver.org/), package publishing, and changelog generation it is important to use meaningful [conventional commit messages](https://www.conventionalcommits.org/)! This package template already has a built-in semantic release support enabled which is set up to take care of all three of these aspects — every time changes are pushed to the `release` branch.
 
-With every package release, a new `bump:` commit is pushed to the `release` branch and tagged with the package’s new version. In addition, the `main` branch (which this repository uses to stage merged pull requests into for the next release) is rebased on top of the updated `release` branch automatically, so that subsequent pull requests can be merged while keeping a [linear history](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-linear-history).
+With every package release, a new `bump:` commit is pushed to the `release` branch and tagged with the package’s new version. Tags are immutable for reproducible builds. In addition, the `main` branch (which this repository uses to stage merged pull requests into for the next release) is rebased on top of the updated `release` branch automatically, so that subsequent pull requests can be merged while keeping a [linear history](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-linear-history).
 
 If you’d like to receive Slack notifications whenever a new release is published, follow the comments in the [Release Notification](https://github.com/jenstroeger/python-package-template/tree/main/.github/workflows/_release-notifications.yaml) Action and set up a Slack bot by following [the instructions here](https://github.com/slackapi/slack-github-action#setup-2).
 
@@ -338,8 +338,3 @@ On occasion it’s useful (and perhaps necessary) to clean up stale files, cache
 - In addition and to **reset everything**, to restore a clean package to start over fresh: `make nuke`
 
 Please be careful when nuking your environment, and make sure you know what you’re doing.
-
-## Frequently asked questions
-
-- **Question**: Why don’t you use tools like [tox](https://github.com/tox-dev/tox) or [nox](https://github.com/theacodes/nox) to orchestrate testing?  
-  **Answer**: We’ve removed `tox` based on a discussion in [issue #100](https://github.com/jenstroeger/python-package-template/issues/100) and [PR #102](https://github.com/jenstroeger/python-package-template/pull/102). In short: we want to run tests inside the development venv using `pytest`, and run more tests using an extensive test matrix using Github Actions.
diff --git a/pyproject.toml b/pyproject.toml
index bcaea5c1..dcfca779 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -39,45 +39,62 @@ something = "package.__main__:main"
 [project.entry-points]
 
 [project.optional-dependencies]
+# Add optional package dependencies (extras) here.
+# https://packaging.python.org/en/latest/specifications/dependency-specifiers/#extras
+
+[project.urls]
+Homepage = "https://github.com/jenstroeger/python-package-template"
+Changelog = "https://github.com/jenstroeger/python-package-template/blob/main/CHANGELOG.md"
+Documentation = "https://github.com/jenstroeger/python-package-template/wiki"
+Issues = "https://github.com/jenstroeger/python-package-template/issues"
+
+
+# https://packaging.python.org/en/latest/specifications/dependency-groups/
+# https://peps.python.org/pep-0735/
+[dependency-groups]
+dev = [
+    {include-group = "actions"},
+    {include-group = "check"},
+    {include-group = "test"},
+    {include-group = "docs"},
+    {include-group = "dist"},
+    {include-group = "hooks"},
+]
 # The 'actions' requirements match exactly the packages installed by the workflows.
 # We keep them listed here to ensure the infrastructure BOM is consistent with what's
 # installed. Make sure to keep the requirements in sync with the workflows!
 actions = [
-    "commitizen ==4.16.4",
+    "commitizen ==4.16.5",
     "twine ==6.2.0",
 ]
-dev = [
-    "flit >=3.2.0,<4.0.0",
-    "mypy >=1.0.0,!=1.20.2,<1.21",
+check = [
+    "mypy >=2.0.0,<2.4.0",
     "pip-audit >=2.4.4,<3.0.0",
     "pylint >=4.0.0,<4.1.0",
-    "cyclonedx-bom >=7.0.0,<8.0.0",
-]
-docs = [
-    "sphinx >=5.1.1,<9.0.0",
-    "sphinx-markdown-builder >=0.6.4,<1.0.0",
-]
-hooks = [
-    "pre-commit >=3.0.0,<4.7.0",
 ]
 # Note that the `custom_exit_code` and `env` plugins may currently be unmaintained.
 test = [
-    "faker ==40.28.1",
-    "hypothesis >=6.21.0,<6.152.10",
+    "faker ==40.36.0",
+    "hypothesis >=6.21.0,<6.161.6",
     "pytest >=9.0.3,<9.1.0",  # Pin until fixed: https://github.com/smarie/python-pytest-cases/issues/385
     "pytest-benchmark ==5.2.3",
     "pytest-cases ==3.10.1",
-    "pytest-custom_exit_code ==0.3.0",
     "pytest-cov ==7.1.0",
+    "pytest-custom_exit_code ==0.3.0",
     "pytest-doctestplus ==1.7.1",
-    "pytest-env ==1.6.0",
+    "pytest-env ==1.7.0",
+]
+docs = [
+    "sphinx >=5.1.1,<9.0.0",
+    "sphinx-markdown-builder >=0.6.4,<1.0.0",
+]
+dist = [
+    "cyclonedx-bom >=7.0.0,<8.0.0",
+    "flit >=3.2.0,<4.0.0",
+]
+hooks = [
+    "pre-commit >=4.0.0,<4.7.0",
 ]
-
-[project.urls]
-Homepage = "https://github.com/jenstroeger/python-package-template"
-Changelog = "https://github.com/jenstroeger/python-package-template/blob/main/CHANGELOG.md"
-Documentation = "https://github.com/jenstroeger/python-package-template/wiki"
-Issues = "https://github.com/jenstroeger/python-package-template/issues"
 
 
 # https://github.com/commitizen-tools/commitizen
@@ -124,8 +141,16 @@ exclude = [
 
 # https://mypy.readthedocs.io/en/stable/config_file.html#using-a-pyproject-toml
 [tool.mypy]
-# mypy_path =
+files = [
+    "src/package/",
+    "tests/",
+]
 # exclude =
+mypy_path = [
+    "src/",
+]
+explicit_package_bases = true
+num_workers = 2
 show_error_codes = true
 show_column_numbers = true
 pretty = true
@@ -146,16 +171,17 @@ disallow_untyped_decorators = true
 # disable_error_code =
 # allow_redefinition =
 
+# https://mypy.readthedocs.io/en/stable/running_mypy.html#missing-imports
 [[tool.mypy.overrides]]
 module = [
-    "pytest.*",
 ]
-ignore_missing_imports = true
+follow_untyped_imports = true
+# ignore_missing_imports = true
 
 
 # https://pylint.pycqa.org/en/latest/user_guide/configuration/index.html
 # https://github.com/astral-sh/ruff/issues/970
-[tool.pylint.main]
+[tool.pylint]
 fail-under = 10.0
 load-plugins = [
     "pylint.extensions.bad_builtin",
@@ -203,14 +229,14 @@ disable = [
     "too-many-try-statements",
 ]
 
-[tool.pylint.MISCELLANEOUS]
+[tool.pylint.miscellaneous]
 notes = [
     "FIXME",
     "TODO",
     "BUGBUG",
 ]
 
-[tool.pylint.FORMAT]
+[tool.pylint.format]
 max-line-length = 120