Skip to content

chore(deps): bump the python group across 1 directory with 8 updates - #641

Merged
github-actions[bot] merged 3 commits into
mainfrom
dependabot/pip/python-4a51e8e9e2
Oct 29, 2026
Merged

chore(deps): bump the python group across 1 directory with 8 updates#641
github-actions[bot] merged 3 commits into
mainfrom
dependabot/pip/python-4a51e8e9e2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the python group with 8 updates in the / directory:

Package From To
ruff 0.17.1 0.17.2
mkdocs-material 9.7.7 9.8.0
griffe 2.4.0 2.4.1
certifi 2026.10.19 2026.10.23
griffecli 2.4.0 2.4.1
griffelib 2.4.0 2.4.1
mkdocs-autorefs 1.4.4 1.4.5
wcwidth 0.9.2 0.9.4

Updates ruff from 0.17.1 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Commits
  • 30516b4 Bump version to 0.17.2 (#29637)
  • 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
  • 0d562aa [ty] Check inherited attribute conflicts (#28559)
  • 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
  • 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
  • b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
  • 32869b4 Avoid creating deployments for automation jobs (#29626)
  • ec891ba Link the commit in pull request report footers (#29621)
  • 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
  • 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
  • Additional commits viewable in compare view

Updates mkdocs-material from 9.7.7 to 9.8.0

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.8.0

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency Affected versions New minimum Advisory
Jinja2 <=3.1.5 3.1.6 CVE-2025-27516
Markdown <3.8.1 3.8.1 CVE-2025-69534
Pygments <2.20.0 2.20.0 CVE-2026-4539
PyMdown Extensions <=11.0.0 11.0.1 CVE-2026-67422
Requests <2.33.0 2.33.0 CVE-2026-25645
Pillow <13.0.0 13.0.0 CVE-2026-96636
CairoSVG <=2.9.0 2.9.1 CVE-2026-107378
GitPython <=3.2.0 3.2.1 CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

PyMdown Extensions: affected <=11.0.0; new minimum 11.0.1 (CVE-2026-67422) GHSA-gm37-52c6-37mw

Requests: affected <2.33.0; new minimum 2.33.0 (CVE-2026-25645) GHSA-gc5v-m9x4-r6x2

... (truncated)

Commits
  • 0f72ad6 Merge pull request #8615 from squidfunk/fix/security
  • 85a048d Documentation
  • 10c572e Prepare 9.8.0 release
  • dd8a7ef Cleaned up unused assets
  • 8771cef Updated README
  • 7c9a1cc Updated changelog
  • 3ce9310 Removed redirects from recommended dependencies
  • 0b77e8f Updated CLI notice with end-of-life and migration guidance
  • 66e4f9c Updated project status and maintenance links
  • 1ed13d2 Removed RSS from recommended dependencies
  • Additional commits viewable in compare view

Updates griffe from 2.4.0 to 2.4.1

Release notes

Sourced from griffe's releases.

2.4.1

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

Changelog

Sourced from griffe's changelog.

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

Commits
  • a74c9d0 chore: Prepare release 2.4.1
  • 0670d03 refactor: Stop checking attribute values
  • f3f2605 docs: Add back pymdownx.blocks.tab Markdown extension
  • da6f966 docs: Add periods to docstrings
  • 9d51e51 docs: Single block license headers
  • 5b833a9 docs: Fix code tree with annotations
  • 731b3c5 docs: Various improvements
  • 3faeeb1 fix: Load symbols gated behing __getattr__ during dynamic analysis
  • See full diff in compare view

Updates certifi from 2026.10.19 to 2026.10.23

Commits

Updates griffecli from 2.4.0 to 2.4.1

Release notes

Sourced from griffecli's releases.

2.4.1

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

Changelog

Sourced from griffecli's changelog.

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

Commits
  • a74c9d0 chore: Prepare release 2.4.1
  • 0670d03 refactor: Stop checking attribute values
  • f3f2605 docs: Add back pymdownx.blocks.tab Markdown extension
  • da6f966 docs: Add periods to docstrings
  • 9d51e51 docs: Single block license headers
  • 5b833a9 docs: Fix code tree with annotations
  • 731b3c5 docs: Various improvements
  • 3faeeb1 fix: Load symbols gated behing __getattr__ during dynamic analysis
  • See full diff in compare view

Updates griffelib from 2.4.0 to 2.4.1

Release notes

Sourced from griffelib's releases.

2.4.1

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

Changelog

Sourced from griffelib's changelog.

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

Commits
  • a74c9d0 chore: Prepare release 2.4.1
  • 0670d03 refactor: Stop checking attribute values
  • f3f2605 docs: Add back pymdownx.blocks.tab Markdown extension
  • da6f966 docs: Add periods to docstrings
  • 9d51e51 docs: Single block license headers
  • 5b833a9 docs: Fix code tree with annotations
  • 731b3c5 docs: Various improvements
  • 3faeeb1 fix: Load symbols gated behing __getattr__ during dynamic analysis
  • See full diff in compare view

Updates mkdocs-autorefs from 1.4.4 to 1.4.5

Release notes

Sourced from mkdocs-autorefs's releases.

1.4.5

1.4.5 - 2026-10-22

Compare with 1.4.4

Build

  • Drop support for Python 3.10 (06bbb4b by Timothée Mazzucotelli).

Bug Fixes

Changelog

Sourced from mkdocs-autorefs's changelog.

1.4.5 - 2026-10-22

Compare with 1.4.4

Build

  • Drop support for Python 3.10 (06bbb4b by Timothée Mazzucotelli).

Bug Fixes

Commits

Updates wcwidth from 0.9.2 to 0.9.4

Release notes

Sourced from wcwidth's releases.

0.9.4

What's Changed

Full Changelog: jquast/wcwidth@0.9.3...0.9.4

0.9.3

What's Changed

Full Changelog: jquast/wcwidth@0.9.2...0.9.3

Changelog

Sourced from wcwidth's changelog.

0.9.4 2026-10-24

  • Bugfix Flag emojis were split by grapheme breaks when following control characters, like newline or tab, PR [#301](https://github.com/jquast/wcwidth/issues/301)_.
  • Improved performance of most general functions by +64% PR [#303](https://github.com/jquast/wcwidth/issues/303)_.

0.9.3 2026-10-20

  • Bugfix libwcwidth no longer has undefined behavior on NULL or empty input in the UTF-8 and alignment functions, PR [#293](https://github.com/jquast/wcwidth/issues/293), PR [#294](https://github.com/jquast/wcwidth/issues/294).
  • Changed HyperlinkParams.parse()_ now rejects trailing text, PR [#296](https://github.com/jquast/wcwidth/issues/296)_.
  • Bugfix wrap()_ should keep a link's own OSC 8 params across a line break, PR [#299](https://github.com/jquast/wcwidth/issues/299)_.
Commits
  • 2a8edf1 stamp for release
  • ffb4a74 Various performance gains, shortcuts and bitsets (#303)
  • 4bb1017 Add benchmarks for width and grapheme performance (#302)
  • f22d465 Bugfix flag emojis after control characters (#301)
  • d137ffb upgrade cibuildwheel for released python3.15 (#300)
  • 12a9d13 this symlink renders bad in github
  • 949a082 fix: preserve hyperlink parameters across wrapped lines (#299)
  • bcdf2c1 make CHANGELOG.rst symlink
  • ff8072d note that 0.9.3 is not released (to PyPI) yet
  • 4f35759 document and fold into test_hyperlinkparams_parse_invalid
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python group across 1 directory with 8 updates
3d0e416 
Bumps the python group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.1` | `0.17.2` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.7` | `9.8.0` |
| [griffe](https://github.com/mkdocstrings/griffe) | `2.4.0` | `2.4.1` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.10.19` | `2026.10.23` |
| [griffecli](https://github.com/mkdocstrings/griffe) | `2.4.0` | `2.4.1` |
| [griffelib](https://github.com/mkdocstrings/griffe) | `2.4.0` | `2.4.1` |
| [mkdocs-autorefs](https://github.com/mkdocstrings/autorefs) | `1.4.4` | `1.4.5` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.9.2` | `0.9.4` |



Updates `ruff` from 0.17.1 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.1...0.17.2)

Updates `mkdocs-material` from 9.7.7 to 9.8.0
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.7...9.8.0)

Updates `griffe` from 2.4.0 to 2.4.1
- [Release notes](https://github.com/mkdocstrings/griffe/releases)
- [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/griffe@2.4.0...2.4.1)

Updates `certifi` from 2026.10.19 to 2026.10.23
- [Commits](certifi/python-certifi@2026.10.19...2026.10.23)

Updates `griffecli` from 2.4.0 to 2.4.1
- [Release notes](https://github.com/mkdocstrings/griffe/releases)
- [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/griffe@2.4.0...2.4.1)

Updates `griffelib` from 2.4.0 to 2.4.1
- [Release notes](https://github.com/mkdocstrings/griffe/releases)
- [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/griffe@2.4.0...2.4.1)

Updates `mkdocs-autorefs` from 1.4.4 to 1.4.5
- [Release notes](https://github.com/mkdocstrings/autorefs/releases)
- [Changelog](https://github.com/mkdocstrings/autorefs/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/autorefs@1.4.4...1.4.5)

Updates `wcwidth` from 0.9.2 to 0.9.4
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Changelog](https://github.com/jquast/wcwidth/blob/master/docs/history.rst)
- [Commits](jquast/wcwidth@0.9.2...0.9.4)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: mkdocs-material
  dependency-version: 9.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: griffe
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: certifi
  dependency-version: 2026.10.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: griffecli
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: griffelib
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: mkdocs-autorefs
  dependency-version: 1.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: wcwidth
  dependency-version: 0.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 28, 2026
@dependabot
dependabot Bot requested review from a team, lywinged and rajnisht7 as code owners October 28, 2026 02:51
@github-actions
github-actions Bot enabled auto-merge (squash) October 28, 2026 02:51
lywinged
lywinged previously approved these changes Oct 28, 2026
View reviewed changes
@lywinged
lywinged disabled auto-merge October 28, 2026 03:01
@claude
chore(deps): regenerate the dev and conformance docs locks for the ra…
cca38a7 
…ised floors

This update raises ruff to >=0.17.2 in pyproject.toml and requirements/dev.in
and mkdocs-material to >=9.8.0 in conformance/requirements-docs.txt, but left
requirements/dev.txt pinning ruff 0.17.1, which CI installs before it lints,
and conformance/requirements/docs.txt pinning mkdocs-material 9.7.7.

Each lock is regenerated with the command in its header, the lock as
preferences, upgrading only the version this update names: ruff==0.17.2 and
mkdocs-material==9.8.0. No other pin moves; uv also sorts the pytest and
pytest-cov entries of requirements/dev.txt ahead of pyyaml, unchanged.
Recompiling either lock with its header command now changes nothing.

Signed-off-by: Louie Lu <48041247+lywinged@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UtTRZHH7SXtpEikWace636
@github-actions
github-actions Bot enabled auto-merge (squash) October 28, 2026 03:07
@lywinged lywinged mentioned this pull request Oct 28, 2026
Merged
1 of 8 tasks
@github-actions
github-actions Bot merged commit f190242 into main Oct 29, 2026
20 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/python-4a51e8e9e2 branch October 29, 2026 23:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lywinged lywinged lywinged approved these changes
@rajnisht7 rajnisht7 rajnisht7 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@lywinged @rajnisht7 @claude