build(deps): bump the python-deps group across 1 directory with 5 updates

[dependabot]

Bumps the python-deps group with 5 updates in the / directory:

Package	From	To
pydantic	2.13.4	2.13.5
cryptography	50.0.0	50.0.1
pyspnego	0.12.1	0.12.2
fhirpathpy	2.2.3	2.2.4
zizmor	1.29.0	1.30.0

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates pyspnego from 0.12.1 to 0.12.2

Release notes

Sourced from pyspnego's releases.

v0.12.2

0.12.2 - 2026-08-26

• Fix up NTLM single host data unpacking to be less strict making it compatible with newer Windows versions
• Use canoncial Kerberos client principal from kinit operation, this avoid issues around not being able to find TGT in cache during Kerberos authentication

What's Changed

• Use canonical client principal when initializing kinit ccache by @​ITJoeSchmo in jborean93/pyspnego#104
• Update dev deps to use ruff, release prep by @​jborean93 in jborean93/pyspnego#106
• Prepare for v0.12.2 release by @​jborean93 in jborean93/pyspnego#107

New Contributors

• @​ITJoeSchmo made their first contribution in jborean93/pyspnego#104

Full Changelog: jborean93/pyspnego@v0.12.1...v0.12.2

Changelog

Sourced from pyspnego's changelog.

0.12.2 - 2026-08-26

• Fix up NTLM single host data unpacking to be less strict making it compatible with newer Windows versions
• Use canoncial Kerberos client principal from kinit operation, this avoid issues around not being able to find TGT in cache during Kerberos authentication

Commits

• 3bc2c19 Prepare for v0.12.2 release (#107)
• 1530ba1 Update dev deps to use ruff, release prep (#106)
• a67095e Use canonical client principal when initializing kinit ccache (#104)
• See full diff in compare view

Updates fhirpathpy from 2.2.3 to 2.2.4

Release notes

Sourced from fhirpathpy's releases.

v2.2.4

What's Changed

• Fix join() to return empty collection for empty input by @​alexlipovka in beda-software/fhirpath-py#77

New Contributors

• @​alexlipovka made their first contribution in beda-software/fhirpath-py#77

Full Changelog: beda-software/fhirpath-py@v2.2.3...v2.2.4

Commits

• 19f6316 Bump to 2.2.4
• c1db6d9 Merge pull request #77 from beda-software/fix/join-empty-collection
• 5a1fe46 Fix join() to return empty collection for empty input
• See full diff in compare view

Updates zizmor from 1.29.0 to 1.30.0

Release notes

Sourced from zizmor's releases.

v1.30.0

Sponsorship is appreciated!

New Features 🌈🔗

• New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271) Enhancements 🌱🔗

• The impostor-commit audit now supports pre-commit config inputs (#2256)

• The forbidden-uses audit now supports pre-commit config inputs (#2263)

• The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The archived-uses audit now supports pre-commit config inputs (#2272)

• The ref-confusion audit now supports pre-commit config inputs (#2274)

• The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)

• The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-just (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)

• The archived-uses audit now detects several more archived repositories (#2340)

• The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)

• The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)

• Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#2289)

• Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#2300)

• Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#2308)

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.30.0

New Features 🌈

• New audit: [self-repository] detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)

Enhancements 🌱

• The [impostor-commit] audit now supports pre-commit config inputs (#2256)

• The [forbidden-uses] audit now supports pre-commit config inputs (#2263)

• The [adhoc-packages] audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The [archived-uses] audit now supports pre-commit config inputs (#2272)

• The [ref-confusion] audit now supports pre-commit config inputs (#2274)

• The [cache-poisoning] audit now produces more detailed and more precise diagnostics (#2330)

• The [cache-poisoning] audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes @​sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The [unpinned-tools] audit now produces more detailed and more precise diagnostics (#2339)

• The [unpinned-tools] audit now detects usages of @​extractions/setup-just (#2339)

• The [unpinned-tools] audit now detects usages of @​extractions/setup-crate (#2340)

• The [archived-uses] audit now detects several more archived repositories (#2340)

• The [ref-version-mismatch] audit now supports #!yaml uses: that reference reusable workflows (#2344)

• The [stale-action-refs] audit now supports #!yaml uses: that reference reusable workflows (#2345)

Bug Fixes 🐛

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)

... (truncated)

Commits

• fb814d6 Prep 1.30.0 (#2351)
• 3ebc1b1 expressions: add a recursion budget (#2349)
• 3fd0366 zizmor 1.30.0-rc2 (#2347)
• b97ef2a Use Docker's github-builder for image builds (#2346)
• 5510691 stale-action-refs: support reusable workflows (#2345)
• 0c9a307 ref-version-mismatch: support reusable workflows (#2344)
• 3bebccb Bump trophies (#2341)
• 55336ee Suggest tags belonging to the action being used (#2247)
• 5398c76 More archived actions, unpinned-tools (#2340)
• b54e540 unpinned-tools: rewrite in terms of ActionCoordinate (#2339)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions