chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
astral-sh/uv-pre-commit	repository	patch	0.11.25 → 0.11.28
biomejs/pre-commit	repository	patch	v2.5.1 → v2.5.3
build (changelog)	dependency-groups	patch	1.5.0 → 1.5.1
coverage	dependency-groups	minor	7.14.3 → 7.15.0	7.15.1
jsh9/pydoclint	repository	patch	0.9.0 → 0.9.1
mypy (changelog)	dependency-groups	minor	2.1.0 → 2.2.0	2.3.0
prek (source, changelog)	dependency-groups	patch	0.4.6 → 0.4.9
pydoclint	dependency-groups	patch	0.9.0 → 0.9.1
ruff (source, changelog)	dependency-groups	patch	0.15.20 → 0.15.21
tombi	dependency-groups	minor	1.1.6 → 1.2.0
tox (changelog)	dependency-groups	patch	4.56.1 → 4.56.4
typing-extensions (changelog)	project.dependencies	minor	4.15.0 → 4.16.0
uv (source, changelog)	dependency-groups	patch	0.11.26 → 0.11.28

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)

v0.11.28

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.11.28

v0.11.27

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.11.27

v0.11.26

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.11.26

biomejs/pre-commit (biomejs/pre-commit)

v2.5.3

Compare Source

v2.5.2

Compare Source

pypa/build (build)

v1.5.1

Compare Source

What's Changed

• ✨ feat(cli): accept sdist tarball as srcdir argument by @​gaborbernat in #​1057
• chore: drop 3.9 branches for version_info checks by @​henryiii in #​1059
• tests: skip test_uv_install_strips_pythonpath with missing uv by @​mtelka in #​1063
• chore: remove myself from codeowners by @​FFY00 in #​1066
• refactor: safe_extractall to use pathlib.Path by @​henryiii in #​1060
• ci: secure GitHub Actions workflows by @​henryiii in #​1068
• test: cover config settings forwarding in build_package and build_package_via_sdist by @​terminalchai in #​1058
• Revert "build(deps): bump virtualenv from 20.17 to 20.36.1" by @​layday in #​1076
• Revert "build(deps): bump wheel from 0.36.0 to 0.38.1" by @​layday in #​1075
• Revert "build(deps): bump pip from 22.3 to 26.1" by @​layday in #​1074
• 👷 ci: enforce lazy imports with flake8-lazy by @​gaborbernat in #​1088
• ✨ feat(deps): show wanted vs found in missing-deps error by @​gaborbernat in #​1082
• 👷 ci: align action pin version comments by @​gaborbernat in #​1091
• docs: update isolated env example to use DefaultIsolatedEnv by @​shenxianpeng in #​1090
• 🧪 test: compact test_parse_args with a typed make_kwargs helper by @​gaborbernat in #​1092
• ♻️ refactor(typing): ban explicit Any across src and tests by @​gaborbernat in #​1093
• ✨ feat(cli): warn on valueless config settings by @​gaborbernat in #​1081
• ✨ feat(cli): add --sdist-extract-dir to reuse compiler caches by @​gaborbernat in #​1085
• ⚠️ feat(util): deprecate project_wheel_metadata by @​gaborbernat in #​1084
• chore: bump pre-commit tags by @​henryiii in #​1095
• ✨ feat: report resolved build dependency versions by @​gaborbernat in #​1086
• ✨ feat(env): control the isolated build environment location by @​gaborbernat in #​1083
• ✨ feat(cli): machine-readable build report, and metadata from a wheel by @​gaborbernat in #​1080
• 🐛 fix(cli): drain verbose subprocess output without a worker thread by @​henryiii in #​1098
• ♻️ refactor(cli): minor cleanups in builder and CLI by @​henryiii in #​1099
• 🐛 fix(env): reject a file as --env-dir and drop a mutable default by @​henryiii in #​1100
• chore: add classifier for 3.15 (testing on beta already) by @​henryiii in #​1104
• chore: add lockfiles to gitignore by @​henryiii in #​1101
• chore: add check-dist by @​henryiii in #​1103
• ✨ feat(cli): surface debug paths when a backend build fails by @​gaborbernat in #​1087
• docs: shorten changelog entries to concise highlights by @​henryiii in #​1105
• chore(deps): raise dependency floors to 3.10 minimums and drop pytest cap by @​henryiii in #​1107
• chore: bump mypy, restrict pytest 9.1.0 by @​henryiii in #​1108
• fix(cli): fix CLI warnings being written to stdout instead of stderr by @​ymyzk in #​1111
• Bump vulnerable dependency floors (virtualenv, wheel) by @​gaborbernat in #​1113
• chore: default --installer to pip in argparse by @​henryiii in #​1117
• fix: build correct dest path in Windows symlink support probe by @​henryiii in #​1118
• fix: derive dist-info directory from wheel contents, not filename by @​henryiii in #​1119
• fix: use LF instead of os.linesep when writing pip/uv requirements files by @​henryiii in #​1120
• fix: decide color support per output stream, not solely from stdout by @​henryiii in #​1123
• refactor: open the wheel only once in metadata_path by @​henryiii in #​1126
• fix: minor robustness fixes from code review by @​henryiii in #​1121
• refactor: simplify code paths found in review by @​henryiii in #​1124
• perf: memoize check_dependency by @​henryiii in #​1122
• test: isolate color tests from NO_COLOR and FORCE_COLOR by @​Yearnzq in #​1128

New Contributors

• @​mtelka made their first contribution in #​1063
• @​shenxianpeng made their first contribution in #​1090
• @​ymyzk made their first contribution in #​1111
• @​Yearnzq made their first contribution in #​1128

Full Changelog: pypa/build@1.5.0...1.5.1

coveragepy/coveragepy (coverage)

v7.15.0

Compare Source

• Since 7.14.0, reporting commands implicitly combine parallel data files. Now
  those commands have a new option --keep-combined to retain the data files
  after combining them instead of the default, which is to delete them.
  Finishes issue 2198_.

• Fix: the LCOV report would incorrectly count excluded functions as uncovered,
  as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen <pull 2206_>.

• When running your program, coverage now correctly sets
  yourmodule.__spec__.loader as strongly recommended <--loader--_>,
  avoiding the deprecation warning described in issue 2208. Thanks, A5rocks <pull 2209_>_.

• Fix: with Python 3.10, running with the -I (isolated mode) option didn't
  correctly omit the current directory from the module search path, as
  described in issue 2103. That is now fixed thanks to Ilia Sorokin <pull 2211_>.

.. --loader--: https://docs.python.org/3/reference/datamodel.html#module.__loader_
.. _issue 2103: #​2103
.. _issue 2198: #​2198
.. _issue 2205: #​2205
.. _pull 2206: #​2206
.. _issue 2208: #​2208
.. _pull 2209: #​2209
.. _pull 2211: #​2211

.. _changes_7-14-3:

jsh9/pydoclint (jsh9/pydoclint)

v0.9.1

Compare Source

• Fixed
  • Restored numpy docstring default checking with
    docstring_parser_fork==0.0.16, which preserves raw parameter and
    attribute type declarations while still exposing normalized type/default
    fields
• Changed
  • Replaced tox type checking from mypy with ty and fixed the surfaced
    typing issues with explicit type narrowing
  • Run the tox -e pydoclint self-check against the local package instead of
    the latest published pydoclint release
  • Updated Muff tooling to 0.15.20 and added a pre-commit hook to keep the
    tox Muff pins in sync with the muff-pre-commit revision
• Full diff
  • jsh9/pydoclint@0.9.0...0.9.1

python/mypy (mypy)

v2.2.0

Compare Source

j178/prek (prek)

v0.4.9

Compare Source

Released on 2026-07-11.

Note: This release changes the repository identity schema stored in cached hook environments. Existing
hook environments will be invalidated, and prek will reinstall them automatically when needed.

Enhancements

• Preserve additional dependency order (#​2311)
• Remove parallel Ruby gem installation (#​2307)
• Warn for missing update repositories (#​2316)

Bug fixes

• Fix mixed workspace selectors (#​2306)
• Fix try-repo local path resolution (#​2310)
• Use resolved gem executable (#​2308)
• Validate complete XML documents in check-xml (#​2312)

Contributors

• @​j178

v0.4.8

Released on 2026-07-04.

Enhancements

• Add default_env configuration (#​2288)
• Rename auto-update to update (#​2286)

Bug fixes

• Fix progress collapse ordering (#​2291)
• Fix progress insertion after collapsed rows (#​2292)

Contributors

• @​j178

astral-sh/ruff (ruff)

v0.15.21

Compare Source

Released on 2026-07-09.

Preview features

• Add --add-ignore for adding ruff:ignore comments (#​26346)
• [flake8-comprehensions] Drop C409 tuple comprehension preview behavior (#​25707)
• Avoid whitespace normalization when formatting comments (#​26455)
• [pyupgrade] Lint and fix use of deprecated abc decorators (UP051) (#​26417)

Bug fixes

• Refine non-empty f-string detection (#​26526)
• Detect syntax errors in individual notebook cells (#​26419)
• [flake8-implicit-str-concat] Fix ISC003 autofix incorrectly stripping + from comments (#​26554)

Rule changes

• [flake8-executable] Mark EXE004 fix as unsafe (#​26033)
• [flake8-pyi] Mark PYI061 fixes as unsafe in Python files (#​26533)
• [pydocstyle] Skip overload-with-docstring in stub files (D418) (#​26318)

Performance

• Avoid per-token source index visitor calls (#​26506)
• Cache parenthesized expression boundaries in the formatter (#​26344)
• Improve performance of rendering edits in preview mode (#​26565)
• Inline fits_element in formatter (#​26429)
• Inline formatter printing hot paths (#​26504)
• Lazily create builtin bindings (#​26510)
• Skip empty trivia scans in the source indexer (#​26507)
• Use ICF for macOS release builds (#​25780)

Formatter

• Add --extend-exclude to ruff format (#​26372)

Documentation

• Add "How does Ruff's import sorting compare to isort?" link to README (#​26530)
• Fix Mozilla Firefox repository link in README (#​26537)
• [flake8-bandit] Fix misleading docstring for mako-templates (S702) (#​26432)
• [ruff] Fix non-triggering example for if-key-in-dict-del (RUF051) (#​26433)

Contributors

• @​EkriirkE
• @​tingerrr
• @​s-rigaud
• @​nikolauspschuetz
• @​Avasam
• @​ntBre
• @​omar-y-abdi
• @​AlexWaygood
• @​sylvestre
• @​shaanmajid
• @​lerebear
• @​baltasarblanco
• @​Sanjays2402
• @​ZedThree
• @​servusdei2018
• @​charliermarsh
• @​jesco-absolute
• @​velikodniy
• @​zaniebot
• @​epage

tombi-toml/tombi (tombi)

v1.2.0

Compare Source

What's Changed

🚨 Breaking Changes

• Send CLI diagnostics to stderr by @​ya7010 in #​1991

🦅 New Features

• Add release asset attestations by @​ya7010 in #​1993

🐝 Bug Fixes

• fix(lsp): clear diagnostics after document close if workspace-diagnostics is disabled by @​ya7010 in #​1998

🛠️ Other Changes

• ci: align release note category emoji by @​ya7010 in #​1990
• docs: document TOMBI_NO_COLOR by @​ya7010 in #​1997
• fix(lsp): avoid cloning document URIs by @​ya7010 in #​1999

Full Changelog: tombi-toml/tombi@v1.1.7...v1.2.0

v1.1.7

Compare Source

What's Changed

🦅 New Features

• Apply quote style to string keys by @​ya7010 in #​1980
• Support JSON schema deprecationMessage by @​ya7010 in #​1986

🐝 Bug Fixes

• Fix nested anyOf hover enum selection by @​ya7010 in #​1979

🛠️ Other Changes

• Update issue template emoji by @​ya7010 in #​1975
• Fix anyOf hover enum leakage by @​ya7010 in #​1976
• ci: validate winget manifest before submission by @​ya7010 in #​1977
• Improve formatting edit debug log by @​ya7010 in #​1978
• ci: harden winget manifest invocation check by @​ya7010 in #​1981
• ci: validate winget manifest leaf directory by @​ya7010 in #​1982
• ci: ignore winget manifest validation warnings by @​ya7010 in #​1983
• Fix root $ref schema completion by @​kjanat in #​1984

Full Changelog: tombi-toml/tombi@v1.1.6...v1.1.7

tox-dev/tox (tox)

v4.56.4

Compare Source

What's Changed

• 🐛 fix(discovery): find debug interpreters like python3.13-dbg by @​gaborbernat in #​3978

Full Changelog: tox-dev/tox@4.56.3...4.56.4

v4.56.3

Compare Source

What's Changed

• Don't double-close the child pty fd (fixes parallel Bad file descriptor) (#​3975) by @​apoorvdarshan in #​3976

New Contributors

• @​apoorvdarshan made their first contribution in #​3976

Full Changelog: tox-dev/tox@4.56.2...4.56.3

v4.56.2

Compare Source

What's Changed

• 🔧 chore(type): drop stale ty invalid-assignment ignores by @​gaborbernat in #​3970
• Fix 17 bugs found in a deep codebase sweep by @​gaborbernat in #​3974

Full Changelog: tox-dev/tox@4.56.1...4.56.2

python/typing_extensions (typing-extensions)

v4.16.0

Compare Source

No user-facing changes since 4.16.0rc2.

astral-sh/uv (uv)

v0.11.28

Compare Source

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

• Upgrade GraalPy to 25.1.3 (#​20069)

Enhancements

• Improve trace logs for unexpected error chains (#​20220)
• Move lockfile update guidance to a hint (#​20219)
• Preserve indentation for multiline error causes (#​20156)
• Render user errors with their cause chains (#​20217)
• Route final command errors through the printer to respect -q and -qq (#​20163)
• Use standard rendering for uv build errors (#​20159)
• Use standard rendering for tool requirement errors (#​20160)

Performance

• Only compile bytecode for installed distributions in uv pip install (#​19914)
• Avoid allocating URL-safe Git revisions (#​20194)
• Avoid allocating canonical Python request strings (#​20193)
• Avoid allocating custom Astral mirror URLs (#​20204)
• Avoid allocating expanded compatibility tags (#​20190)
• Avoid allocating shell strings that need no escaping (#​20196)
• Avoid allocating static ABI descriptions (#​20201)
• Avoid allocating static Windows executable names (#​20200)
• Avoid allocating static dependency table names (#​20199)
• Avoid allocating static platform triple components (#​20195)
• Avoid allocating static resolver report labels (#​20198)
• Avoid allocating static unavailable-version messages (#​20197)
• Avoid allocating unchanged Python download architectures (#​20202)
• Avoid allocating unchanged paths during case normalization (#​20203)
• Avoid allocations when expanding group conflicts (#​20211)
• Avoid allocations when formatting requirements (#​20206)
• Avoid cloning credential lookup services (#​20210)
• Avoid cloning dry-run distributions (#​20209)
• Avoid cloning owned dependency metadata (#​20212)
• Avoid redundant direct URL clones (#​20207)
• Create metadata version errors lazily (#​20205)
• Optimize expanded tag compatibility checks (#​20171)
• Optimize parsing of single-digit three-part versions (#​20118)

Bug fixes

• Avoid overflow when computing HTTP cache age (#​20178)
• Respect --upgrade when upgrade-package is configured (#​19955)
• Support uv tree in dependency-group-only projects (#​20167)
• Treat cache entries as stale at exact expiration (#​20183)

v0.11.27

Compare Source

Released on 2026-07-06.

Enhancements

• Continue on ignored errors when fetching wheel metadata (#​12255)
• Use caching for --python-downloads-json-url (#​16749)

Preview features

• Discover extensionless shebang scripts in uv workspace list --scripts (#​20099)

Performance

• Avoid full site-packages scans for direct reinstalls (#​20119)
• Avoid redundant pyproject parsing (#​20076)
• Cache default dependency markers when reading locks (#​20125)
• Enable SIMD-accelerated TOML parsing (#​20079)
• Intern requires-python specifiers in Simple API parsing (#​20104)
• Read cache entries into exact-sized buffers (#​20120)
• Reduce VersionSpecifiers parsing allocations (#​20105)
• Reduce site-packages scan allocation overhead (#​20087)
• Reuse package names when parsing wheel filenames (#​20110)
• Sort Simple API files after grouping (#​20112)

Bug fixes

• Always emit packages table for pylock.toml (#​20145)
• Avoid blank line for empty uv pip tree (#​20062)
• Encode hashes in file paths (#​19807)
• Error on a registry uv.lock package without a version instead of panicking (#​19855)
• Preserve conditional extra markers in exports (#​20148)
• Skip the ambiguous authority check for file transport VCS URLs (#​20086)
• Sync index format when uv add --index updates an existing index URL (#​19818)

Other changes

• Re-add pub APIs used in Pixi (#​20074)
• Update Rust toolchain to 1.96.1 (#​20103)

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "before 4am on monday"
• Automerge
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pyproject.toml

Artifact update for coverage resolved to version 7.15.1, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 7.15.0
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

File name: pyproject.toml

Artifact update for mypy resolved to version 2.3.0, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 2.2.0
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

[rockygeekz]

Closing due to persistent Renovate artifact failure (uv lock resolves to newer versions than Renovate targets). Renovate will open a fresh PR on the next cycle.