Skip to content

chore(deps): bump the python-tooling group across 1 directory with 7 updates - #528

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-tooling-ca3b54bb31
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-tooling-ca3b54bb31

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on mkdocs-material, pymdown-extensions, mkdocs, pylint, ruff, black and vermin to permit the latest version.
Updates mkdocs-material to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

  • Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

  • Limited version range of mkdocs to <2
  • Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

  • Hardened social cards plugin by switching to sandboxed environment
  • Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

  • Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

  • Opened up version ranges of optional dependencies for forward-compatibility
  • Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

  • Updated requests to 2.30+ to mitigate CVE in urllib
  • Fixed privacy plugin not picking up protocol-relative URLs
  • Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

Updates pymdown-extensions to 12.3

Release notes

Sourced from pymdown-extensions's releases.

12.3

  • NEW: BetterEm: Expose a way to disable CommonMark punctuation rules in BetterEm if desired via a new punctuation option.
Commits

Updates mkdocs to 1.6.1

Release notes

Sourced from mkdocs's releases.

1.6.1

Version 1.6.1 (Friday 30th August, 2024)

Fixed

  • Fix build error when environment variable SOURCE_DATE_EPOCH=0 is set. #3795
  • Fix build error when mkdocs_theme.yml config is empty. #3700
  • Support python -W and PYTHONWARNINGS instead of overriding the configuration. #3809
  • Support running with Docker under strict mode, by removing 0.0.0.0 dev server warning. #3784
  • Drop unnecessary changefreq from sitemap.xml. #3629
  • Fix JavaScript console error when closing menu dropdown. #3774
  • Fix JavaScript console error that occur on repeated clicks. #3730
  • Fix JavaScript console error that can occur on dropdown selections. #3694

Added

  • Added translations for Dutch. #3804
  • Added and updated translations for Chinese (Simplified). #3684
Commits

Updates pylint from 4.0.6 to 4.1.3

Release notes

Sourced from pylint's releases.

v4.1.3

What's new in Pylint 4.1.3?

Release date: 2026-10-11

False Positives Fixed

  • Fixed a false positive for attribute-defined-outside-init when an attribute is assigned inside the setter of an old-style, non-decorator property(fget, fset) call. The decorator form (@property / @x.setter) was already exempted by the fix for #409; the classic call form was not.

    Closes #3325

  • Fix a false positive for used-before-assignment when a name bound by an earlier target of the same assignment is used by a later target, as in a = b[a] = 0.

    Closes #5955

  • Fix a no-member false positive in a comprehension inside a branch that cannot run, such as if sys.platform == "win32": on Linux. Like the rest of the branch, the comprehension is no longer checked for missing members.

    Closes #7240

  • Fix a false positive for used-before-assignment when a name bound by a tuple or list target of a with item is used by a later item of the same with statement.

    Closes #7545

  • Fix false positives such as not-callable, not-an-iterable, unpacking-non-sequence and no-member on the result of a function whose body is only ..., like @overload and .pyi stubs. Such calls were inferred as returning None. This affected sqlalchemy.func, pydantic.Field, and the torch functions wrapped by _add_docstr, such as torch.linalg.qr.

    Closes #8138 Closes #9218 Closes #9354 Closes #10087

  • Fix a false positive for protected-access when a subclass of a subscripted generic base, such as class Child(Parent[T]), accesses a protected member through that base, such as Parent._foo(self).

    Closes #8600

... (truncated)

Commits
  • e75de10 Bump pylint to 4.1.3, update changelog (#11637)
  • 591f6e2 [Backport maintenance/4.1.x] Fix protected-access false positive through a su...
  • a537920 [Backport maintenance/4.1.x] Ignore discard variable type redefinitions (#11635)
  • 4a8f61c [Backport maintenance/4.1.x] Fix duplicate-code crash when min-similarity-lin...
  • 41fa1c4 [Backport maintenance/4.1.x] [pyreverse] Fix hang/RecursionError with --all-a...
  • a05e2f3 [Backport maintenance/4.1.x] Fix used-before-assignment false positive for ...
  • ea7996b [Backport maintenance/4.1.x] Error when several output formats write to stdou...
  • 479c037 [Backport maintenance/4.1.x] Fix IndexError when Enum init has no argumen...
  • e6aa780 [Backport maintenance/4.1.x] Fix unreachable false positive for raising gener...
  • fc58d0b [Backport maintenance/4.1.x] Fix pyreverse crash on classes with EmptyNode in...
  • Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits
  • 4683270 Bump version to 0.17.1 (#29420)
  • 3514027 [ty] Update typing conformance suite pin (#29417)
  • 8294556 Update referenced PR security-review workflow (#29237)
  • d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
  • 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
  • 83a3afc Fix dedent with multiple leading comments (#29382)
  • b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
  • d01678e [ty] Clarify object attribute write-contract rationale (#29384)
  • 355b42a [ty] Avoid writable override contracts from object (#29373)
  • e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
  • Additional commits viewable in compare view

Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)
  • Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)

... (truncated)

Commits
  • 258e7db Prepare release 26.10.1 (#5511)
  • ac1f715 Action: validate required-version better (#5510)
  • fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
  • 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
  • 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
  • c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
  • 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
  • c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
  • eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
  • 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
  • Additional commits viewable in compare view

Updates vermin from 1.8.0 to 1.9.1

Release notes

Sourced from vermin's releases.

Version 1.9.1

1.9.1:

1.9.0:

  • Python 3.15 support and 160 new rules (netromdk/vermin#342)
    • 4 modules
    • 81 classes/functions/constants members etc.
    • 72 kwargs
    • 3 array typecodes
    • Detect unary + in match literal patterns
      match x:
        case +1:
          pass
    • Detect slice type subscription support
      x = slice[1:2:3]
    • Detect PEP 810 lazy imports and __lazy_modules__ special module attribute
      lazy import foo
      lazy from bar import foo
    • Detect PEP 798 unpacking in comprehension values
      [*x for x in range(10)]
      {*x for x in range(10)}
  • Proper detection of self-documenting and PEP 701 f-strings (netromdk/vermin#360; fixes netromdk/vermin#39 and netromdk/vermin#264)
    • New FStringDetector combining AST analysis with source code verification
    • Detect await expressions in f-strings (3.7)
    • Detect string literals reusing the outer f-string quote
    • Enabled by default but can be disabled with --no-feature
  • Fix kwarg detection for chained receivers, like Path.cwd().exists(follow_symlinks=True) (netromdk/vermin#344; @​apoorvdarshan, netromdk/vermin#327)
  • Add missing rules related to the chained-receiver fix (netromdk/vermin#353)
  • Avoid false violations for the unversioned backport sentinel (netromdk/vermin#354; fixes netromdk/vermin#330)
  • Include tests in the source distribution (netromdk/vermin#365; fixes netromdk/vermin#347)
  • Add manual pages (netromdk/vermin#346; @​kienanstewart, fixes netromdk/vermin#345)
  • Add more Python 3.14.1 rules (netromdk/vermin#321)
  • Assorted rule fixes and cleanups (net +12 rules for other versions)
    • Add missing rules across many versions (netromdk/vermin#342)
    • Remove kwargs that never existed or are positional-only, plus corrections to kwargs rules
    • Remove asyncio.Task._check_future, duplicate functools.partial_method, and dead zip codec aliases
    • Fix concurrent.futures.interpreter member rule paths, imaplib.IMAP4.Idler.burst path, and codecs.StreamRecoder error-index typo
    • Correct asyncio.Server member versions to 3.9 and unittest.doModuleCleanups to 3.11
    • Fix string keys in the CODECS_ENCODINGS table, configparser backport minimum to 3.2, and remove the faulthandler backport

... (truncated)

Commits
  • 072990a Version 1.9.1
  • dc70a66 Merge pull request #375 from netromdk/issue-374
  • 829f164 Fix PEP 798 false positives in comprehension unpacking detection
  • 9357e7e Version 1.9.0
  • 5ecaa9d Update man pages
  • e4b5d03 Merge pull request #342 from netromdk/py3.15
  • 6f4a99f [actions] Test using py3.15
  • 39300f9 [3.15] Add new kwargs
  • 1295d56 Remove faulthandler backport
  • aeaba08 Fix configparser backport py3 minimum to 3.2
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…updates

Updates the requirements on [mkdocs-material](https://github.com/squidfunk/mkdocs-material), [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions), [mkdocs](https://github.com/mkdocs/mkdocs), [pylint](https://github.com/pylint-dev/pylint), [ruff](https://github.com/astral-sh/ruff), [black](https://github.com/psf/black) and [vermin](https://github.com/netromdk/vermin) to permit the latest version.

Updates `mkdocs-material` to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.5.0...9.7.7)

Updates `pymdown-extensions` to 12.3
- [Release notes](https://github.com/facelessuser/pymdown-extensions/releases)
- [Commits](facelessuser/pymdown-extensions@11.0.1...12.3)

Updates `mkdocs` to 1.6.1
- [Release notes](https://github.com/mkdocs/mkdocs/releases)
- [Commits](mkdocs/mkdocs@1.6.0...1.6.1)

Updates `pylint` from 4.0.6 to 4.1.3
- [Release notes](https://github.com/pylint-dev/pylint/releases)
- [Commits](pylint-dev/pylint@v4.0.6...v4.1.3)

Updates `ruff` from 0.15.20 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.17.1)

Updates `black` from 26.5.1 to 26.10.1
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.5.1...26.10.1)

Updates `vermin` from 1.8.0 to 1.9.1
- [Release notes](https://github.com/netromdk/vermin/releases)
- [Commits](netromdk/vermin@v1.8.0...v1.9.1)

---
updated-dependencies:
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:production
  dependency-group: python-tooling
- dependency-name: pymdown-extensions
  dependency-version: '12.3'
  dependency-type: direct:production
  dependency-group: python-tooling
- dependency-name: mkdocs
  dependency-version: 1.6.1
  dependency-type: direct:production
  dependency-group: python-tooling
- dependency-name: pylint
  dependency-version: 4.1.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-tooling
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-tooling
- dependency-name: black
  dependency-version: 26.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-tooling
- dependency-name: vermin
  dependency-version: 1.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from xbmc4lyfe as a code owner October 18, 2026 21:13
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 18, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
pip/mkdocs >= 1.6.1,< 2.0.0 UnknownUnknown
pip/mkdocs-material >= 9.7.7,< 10.0.0 UnknownUnknown
pip/pymdown-extensions >= 12.3,< 13.0.0 UnknownUnknown

Scanned Files

  • requirements-docs.txt

@github-code-quality

Copy link
Copy Markdown

Code coverage overview

Languages: Python

Python / code-coverage/pytest

main 980c325 dependabot/pip/pytho... 976b150 +/-
89% 89% 0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants