diff --git a/.github/workflows/XmsGridtrace-CI.yaml b/.github/workflows/XmsGridtrace-CI.yaml
index d2af8b3..2587d85 100644
--- a/.github/workflows/XmsGridtrace-CI.yaml
+++ b/.github/workflows/XmsGridtrace-CI.yaml
@@ -6,6 +6,13 @@
 #   AQUAPI_URL_DEV         - devpi index URL for wheel uploads
 #   AQUAVEO_GITHUB_TOKEN   - GitHub token for release asset uploads
 #
+# Third-party actions are pinned to a commit SHA with the tag in a trailing
+# comment. A tag is a movable ref in someone else's repository: whoever owns
+# it can retarget it at new code, which then runs here with this workflow's
+# secrets in its environment. Update a pin by resolving the new tag
+# (`gh api repos/<owner>/<repo>/commits/<tag> --jq .sha`) and editing the
+# template -- not the generated file.
+#
 # Generated by xmsconan_ci — do not edit manually.
 
 name: XmsGridtrace-CI
@@ -34,15 +41,20 @@ jobs:
         uses: actions/checkout@v4
       # Setup Python
       - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       # Install Python Dependencies
       - name: Install Python Dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install flake8 flake8-docstrings flake8-bugbear flake8-import-order pep8-naming
-          pip install "xmsconan==2.16.0" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+          # flake8-tidy-imports registers `banned-modules`, which the .flake8
+          # generated below sets. flake8 ignores config options no installed
+          # plugin claims, so without the plugin the osgeo ban was accepted
+          # and silently enforced nothing -- while this job reported the same
+          # green as a run that had checked it.
+          pip install flake8 flake8-docstrings flake8-bugbear flake8-import-order pep8-naming flake8-tidy-imports
+          pip install --upgrade "xmsconan>=2.23.0" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
       # Generate .flake8 so CI lints with the same config developers use locally.
       # Do not inline the flake8 settings here: that duplicates .flake8.jinja and
       # the two copies drift apart silently.
@@ -63,11 +75,11 @@ jobs:
       fail-fast: false
       matrix:
         platform: [macos-15]
-        python-version: ['3.13']
+        python-version: ["3.13", "3.14"]
         build_type: [Release, Debug]
 
     env:
-      MATRIX_NAME: ${{ matrix.platform }}-Clang${{ matrix.compiler-version }}-${{ matrix.build_type }}
+      MATRIX_NAME: ${{ matrix.platform }}-Clang${{ matrix.compiler-version }}-${{ matrix.build_type }}-py${{ matrix.python-version }}
       # Library Variables
       LIBRARY_NAME: xmsgridtrace
       XMS_VERSION: '0.0.0'
@@ -91,7 +103,7 @@ jobs:
 
     steps:
       # Get Correct Version of Xcode
-      - uses: maxim-lobanov/setup-xcode@v1
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90  # v1
         with:
           xcode-version: 16.4
       - name: Setup Clang
@@ -113,7 +125,7 @@ jobs:
           # package_id computation and silently detach builds from the binaries
           # already published to the remote. Bump this deliberately.
           pip install "conan~=2.31.0" devpi-client wheel
-          python -m pip install --upgrade "xmsconan==2.16.0" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+          python -m pip install --upgrade "xmsconan>=2.23.0" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
       # Setup Conan
       - name: Setup Conan
         run: xmsconan_conan_setup --remote-url ${{ env.CONAN_REMOTE_URL }} --login --remove-conancenter
@@ -121,11 +133,11 @@ jobs:
       # Get Tag Name
       - name: Get Tag
         id: gitTag
-        uses: little-core-labs/get-git-tag@v3.0.2
+        uses: little-core-labs/get-git-tag@2c292ff564c1a61b989e29f0410d131317f89b03  # v3.0.2
         if: startsWith(github.ref, 'refs/tags/')
       # Set Conan Version
       - name: Set Conan Version
-        uses: allenevans/set-env@v2.0.0
+        uses: allenevans/set-env@b68e0a75c99b96b43963b54bc2be13e2f103ad87  # v2.0.0
         with:
           CONAN_REFERENCE: 'xmsgridtrace/${{ steps.gitTag.outputs.tag }}'
           XMS_VERSION: ${{ steps.gitTag.outputs.tag }}
@@ -135,9 +147,9 @@ jobs:
       # Check for release branch
       - name: Get Branch Name
         id: gitBranch
-        uses: nelonoel/branch-name@v1.0.1
+        uses: nelonoel/branch-name@1ea5c86cb559a8c4e623da7f188496208232e49f  # v1.0.1
       - name: Change Channel and URL if Release Branch
-        uses: allenevans/set-env@v2.0.0
+        uses: allenevans/set-env@b68e0a75c99b96b43963b54bc2be13e2f103ad87  # v2.0.0
         with:
           CONAN_CHANNEL: stable
           AQUAPI_URL: ${{ secrets.AQUAPI_URL_DEV}}
@@ -147,7 +159,7 @@ jobs:
         run: xmsconan_gen --version ${{ env.XMS_VERSION }} build.toml
       # Build the Conan Package
       - name: Build the Conan Packages
-        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\" --wheel-dir wheelhouse --artifacts-dir test_artifacts"
+        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"${{ matrix.build_type == 'Release' && ' --wheel-dir wheelhouse' || '' }} --artifacts-dir test_artifacts"
         shell: bash
       - name: Upload test artifacts
         uses: actions/upload-artifact@v4
@@ -164,7 +176,7 @@ jobs:
       - name: Upload wheel artifact
         uses: actions/upload-artifact@v4
         with:
-          name: wheel-${{ runner.os }}
+          name: wheel-${{ runner.os }}-py${{ matrix.python-version }}
           path: wheelhouse/*.whl
         if: matrix.build_type == 'Release'
       # Upload wheel to Aquapi
@@ -180,7 +192,7 @@ jobs:
       # Get the Release Data
       - name: Get Release
         id: git_release
-        uses: bruceadams/get-release@v1.3.2
+        uses: bruceadams/get-release@74c3d60f5a28f358ccf241a00c9021ea16f0569f  # v1.3.2
         env:
           GITHUB_TOKEN: ${{ secrets.AQUAVEO_GITHUB_TOKEN }}
         if: startsWith(github.ref, 'refs/tags/')
@@ -205,19 +217,20 @@ jobs:
   # LINUX
   # ----------------------------------------------------------------------------------------------
   linux:
-    name: GCC-13 (${{ matrix.build_type }}, Linux)
+    name: GCC-13 (${{ matrix.build_type }}, ${{ matrix.python-version }}, Linux)
     runs-on: ubuntu-latest
 
     container:
-      image: ghcr.io/aquaveo/conan-gcc13-py3.13:latest
+      image: ghcr.io/aquaveo/conan-gcc13-py${{ matrix.python-version }}:latest
 
     strategy:
       fail-fast: false
       matrix:
         build_type: [Release, Debug]
+        python-version: ["3.13", "3.14"]
 
     env:
-      MATRIX_NAME: linux-GCC13-${{ matrix.build_type }}
+      MATRIX_NAME: linux-GCC13-${{ matrix.build_type }}-py${{ matrix.python-version }}
       # Library Variables
       LIBRARY_NAME: xmsgridtrace
       XMS_VERSION: '0.0.0'
@@ -235,7 +248,7 @@ jobs:
       AQUAPI_PASSWORD: ${{ secrets.AQUAPI_PASSWORD_SECRET }}
       AQUAPI_URL: ${{ secrets.AQUAPI_URL_DEV }}
       # Python Variables
-      PYTHON_TARGET_VERSION: '3.13'
+      PYTHON_TARGET_VERSION: ${{ matrix.python-version }}
       RELEASE_PYTHON: 'False'
       CTEST_PARALLEL_LEVEL: '8'
 
@@ -250,7 +263,7 @@ jobs:
           # package_id computation and silently detach builds from the binaries
           # already published to the remote. Bump this deliberately.
           pip install "conan~=2.31.0" devpi-client wheel
-          pip install --upgrade "xmsconan==2.16.0" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+          pip install --upgrade "xmsconan>=2.23.0" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
       # Setup Conan
       - name: Setup Conan
         run: xmsconan_conan_setup --remote-url ${{ env.CONAN_REMOTE_URL }} --login
@@ -258,11 +271,11 @@ jobs:
       # Get Tag Name
       - name: Get Tag
         id: gitTag
-        uses: little-core-labs/get-git-tag@v3.0.2
+        uses: little-core-labs/get-git-tag@2c292ff564c1a61b989e29f0410d131317f89b03  # v3.0.2
         if: startsWith(github.ref, 'refs/tags/')
       # Set Conan Version
       - name: Set Conan Version
-        uses: allenevans/set-env@v2.0.0
+        uses: allenevans/set-env@b68e0a75c99b96b43963b54bc2be13e2f103ad87  # v2.0.0
         with:
           CONAN_REFERENCE: 'xmsgridtrace/${{ steps.gitTag.outputs.tag }}'
           XMS_VERSION: ${{ steps.gitTag.outputs.tag }}
@@ -272,9 +285,9 @@ jobs:
       # Check for release branch
       - name: Get Branch Name
         id: gitBranch
-        uses: nelonoel/branch-name@v1.0.1
+        uses: nelonoel/branch-name@1ea5c86cb559a8c4e623da7f188496208232e49f  # v1.0.1
       - name: Change Channel and URL if Release Branch
-        uses: allenevans/set-env@v2.0.0
+        uses: allenevans/set-env@b68e0a75c99b96b43963b54bc2be13e2f103ad87  # v2.0.0
         with:
           CONAN_CHANNEL: stable
           AQUAPI_URL: ${{ secrets.AQUAPI_URL_DEV }}
@@ -284,7 +297,7 @@ jobs:
         run: xmsconan_gen --version ${{ env.XMS_VERSION }} build.toml
       # Build the Conan Package
       - name: Build the Conan Packages
-        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\" --wheel-dir wheelhouse --artifacts-dir test_artifacts"
+        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"${{ matrix.build_type == 'Release' && ' --wheel-dir wheelhouse' || '' }} --artifacts-dir test_artifacts"
         shell: bash
       - name: Upload test artifacts
         uses: actions/upload-artifact@v4
@@ -301,7 +314,7 @@ jobs:
       - name: Upload wheel artifact
         uses: actions/upload-artifact@v4
         with:
-          name: wheel-${{ runner.os }}
+          name: wheel-${{ runner.os }}-py${{ matrix.python-version }}
           path: wheelhouse/*.whl
         if: matrix.build_type == 'Release'
       # Upload wheel to Aquapi
@@ -317,7 +330,7 @@ jobs:
       # Get the Release Data
       - name: Get Release
         id: git_release
-        uses: bruceadams/get-release@v1.3.2
+        uses: bruceadams/get-release@74c3d60f5a28f358ccf241a00c9021ea16f0569f  # v1.3.2
         env:
           GITHUB_TOKEN: ${{ secrets.AQUAVEO_GITHUB_TOKEN }}
         if: startsWith(github.ref, 'refs/tags/')
@@ -349,7 +362,7 @@ jobs:
       fail-fast: false
       matrix:
         platform: [windows-2022]
-        python-version: ["3.10", "3.13"]
+        python-version: ["3.10", "3.13", "3.14"]
         compiler-version: [17]
         build_type: [Release, Debug]
 
@@ -387,7 +400,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
       # Setup Dev Command Prompt env for MSVC
       - name: Setup MSVC env
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756  # v1
         with:
           arch: x64
       # Install Python Dependencies
@@ -398,10 +411,10 @@ jobs:
           # package_id computation and silently detach builds from the binaries
           # already published to the remote. Bump this deliberately.
           pip install "conan~=2.31.0" devpi-client wheel
-          python -m pip install --upgrade "xmsconan==2.16.0" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+          python -m pip install --upgrade "xmsconan>=2.23.0" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
       # Setup Visual Studio
       - name: Setup Visual Studio
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce  # v2
       # Setup Conan
       - name: Setup Conan
         run: xmsconan_conan_setup --remote-url ${{ env.CONAN_REMOTE_URL }} --login
@@ -409,11 +422,11 @@ jobs:
       # Get Tag Name
       - name: Get Tag
         id: gitTag
-        uses: little-core-labs/get-git-tag@v3.0.2
+        uses: little-core-labs/get-git-tag@2c292ff564c1a61b989e29f0410d131317f89b03  # v3.0.2
         if: startsWith(github.ref, 'refs/tags/')
       # Set Conan Version
       - name: Set Conan Version
-        uses: allenevans/set-env@v2.0.0
+        uses: allenevans/set-env@b68e0a75c99b96b43963b54bc2be13e2f103ad87  # v2.0.0
         with:
           CONAN_REFERENCE: 'xmsgridtrace/${{ steps.gitTag.outputs.tag }}'
           XMS_VERSION: ${{ steps.gitTag.outputs.tag }}
@@ -423,9 +436,9 @@ jobs:
       # Check for release branch
       - name: Get Branch Name
         id: gitBranch
-        uses: nelonoel/branch-name@v1.0.1
+        uses: nelonoel/branch-name@1ea5c86cb559a8c4e623da7f188496208232e49f  # v1.0.1
       - name: Change Channel and URL if Release Branch
-        uses: allenevans/set-env@v2.0.0
+        uses: allenevans/set-env@b68e0a75c99b96b43963b54bc2be13e2f103ad87  # v2.0.0
         with:
           CONAN_CHANNEL: stable
           AQUAPI_URL: ${{ secrets.AQUAPI_URL_DEV }}
@@ -435,7 +448,7 @@ jobs:
         run: xmsconan_gen --version ${{ env.XMS_VERSION }} build.toml
       # Build the Conan Package
       - name: Build the Conan Packages
-        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\" --wheel-dir wheelhouse --artifacts-dir test_artifacts"
+        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"${{ matrix.build_type == 'Release' && ' --wheel-dir wheelhouse' || '' }} --artifacts-dir test_artifacts"
         shell: cmd
       - name: Upload test artifacts
         uses: actions/upload-artifact@v4
@@ -468,7 +481,7 @@ jobs:
       # Get the Release Data
       - name: Get Release
         id: git_release
-        uses: bruceadams/get-release@v1.3.2
+        uses: bruceadams/get-release@74c3d60f5a28f358ccf241a00c9021ea16f0569f  # v1.3.2
         env:
           GITHUB_TOKEN: ${{ secrets.AQUAVEO_GITHUB_TOKEN }}
         if: startsWith(github.ref, 'refs/tags/')
diff --git a/.gitignore b/.gitignore
index 9ac35aa..cbd5729 100644
--- a/.gitignore
+++ b/.gitignore
@@ -72,6 +72,7 @@ build_test/
 wheelhouse/
 test_artifacts/
 conan_profiles/
+CMakePresets.json
 CMakeUserPresets.json
 **/CMakeUserPresets.json
 
@@ -99,3 +100,7 @@ cov-py-summary.json
 # Python
 .venv/
 __pycache__/
+
+# Claude Code
+.claude/worktrees/
+.worktreeinclude
diff --git a/build.toml b/build.toml
index 3886825..820a8a0 100644
--- a/build.toml
+++ b/build.toml
@@ -3,10 +3,10 @@ description = "Grid tracing library for XMS products"
 ci_type = "github"
 
 xms_dependencies = [
-    { name = "xmscore", version = "7.0.11" },
-    { name = "xmsgrid", version = "9.0.10" },
-    { name = "xmsinterp", version = "7.0.9" },
-    { name = "xmsextractor", version = "10.0.7" },
+    { name = "xmscore", version = "7.0.13" },
+    { name = "xmsgrid", version = "9.1.1" },
+    { name = "xmsinterp", version = "7.0.12" },
+    { name = "xmsextractor", version = "10.0.10" },
 ]
 
 python_namespaced_dir = "gridtrace"
@@ -34,4 +34,9 @@ pybind_headers = [
 ]
 
 [ci]
-python_versions = ["3.10", "3.13"]
+python_versions = ["3.10", "3.13", "3.14"]
+# python_versions fans out Windows only; mac and linux default to the single
+# highest entry, so leaving these unset would move both platforms off 3.13
+# onto 3.14 rather than adding a leg. Named explicitly to keep 3.13 building.
+mac_python_versions = ["3.13", "3.14"]
+linux_python_versions = ["3.13", "3.14"]