chore: bump minijinja from 2.21.0 to 2.23.0

[dependabot]

Bumps minijinja from 2.21.0 to 2.23.0.

Changelog

Sourced from minijinja's changelog.

2.23.0

• Fixed Unicode identifiers in templates rendered through the Python bindings.

2.22.0

• Changed rendering of none and boolean values to None, True, and False for Jinja2 compatibility in Rust and Go. #913
• Added StringInput for custom Rust filters and functions that transform strings while preserving safety provenance.
• Fixed safety handling in string-transforming and composing filters to preserve safe strings and escape unsafe fragments in Rust and Go.
• Fixed the split filter to return a sequence, enabling negative indexing and slicing in Rust and Go. #909
• Fixed Python-compatible dict methods being shadowed by same-named map keys. #903
• Fixed loop-local assignments leaking into subsequent iterations in Rust and Go. #912

Commits

• 19af7d4 chore(release): 2.23.0
• 7f63616 docs(changelog): document Python Unicode identifiers
• 179652f ref: Remove CLAUDE.md
• 52b1cc6 ref: Move claude stuff
• 0d4c6f4 ref: Remove broken symlinks
• be3c6f5 fix(python): enable Unicode identifiers
• d5bf25e chore(release): 2.22.0
• cdbd4a9 docs(changelog): document unreleased filter fixes
• d715d56 fix: doc link
• cd62d8c fix(filters): preserve safety in string transformations
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[worktrunk-bot]

Not a mechanical lockfile bump — minijinja 2.22.0 changed how values render, and it breaks a test and changes user-visible template output.

The 2.22.0 entry Changed rendering of none and boolean values to None, True, and False for Jinja2 compatibility in Rust and Go (#913) lands squarely on wt's template surface. code-coverage on this head already fails on it (job log): config::expansion::tests::test_expand_template_vars_json_dot_access asserts {{ vars.config.debug }} renders true, got True.

The test is the messenger, not the problem. vars_map_to_value in src/config/expansion.rs parses a worktrunk.state.<branch>.vars.<key> value as JSON when it's an object or array, so any nested boolean reaches minijinja as a real bool — and it renders into a hook/alias command line. A hook that today runs DEBUG=true … starts running DEBUG=True … after this bump, with no error and no warning. JSON null shifts too: expand_template_with only installs the is_none()-to-empty formatter when escape_mode != ShellEscapeMode::Literal, so in Literal mode — wt step eval, wt step for-each arguments, path templates, wt list custom columns — a null that used to render as the empty string now renders None.

Two defensible resolutions, and which one is right is a maintainer call rather than something a reviewer should pick:

1. Preserve current output. Extend the formatter in expand_template_with (and give template_environment one, so Literal mode and list columns are covered) to write true/false for bools and empty for none. Exact no-op against today's behavior, at the cost of diverging from upstream's Jinja2 parity direction — a divergence every future minijinja bump has to keep working.
2. Adopt the new rendering. Update the test expectation and note the change in CHANGELOG.md. Simpler and follows upstream, but it's a silent behavior change in rendered hook and alias command lines, which reads against CLAUDE.md's "prefer deprecation warnings over silent breaks".

Either way this shouldn't land as-is. If the answer is (2) the test fix belongs on this PR; if it's (1), the shim wants its own PR and this bump should wait behind it (or Cargo.toml gets a temporary >=2.20, <2.22 while that lands). Happy to push either once you've picked — say which and I'll do it.

Trace

• Constraint is minijinja = { version = "2.20", … } in Cargo.toml, so 2.23.0 resolves without a manifest change; nothing in the diff signals the behavior shift.
• Bools break in every escape mode: the non-Literal formatter shell-escapes value.to_string(), which is now True.
• None breaks only in Literal mode; the if value.is_none() { return Ok(()) } guard in the Posix/PowerShell formatter already absorbs it there.
• 2.23.0 itself is Python-bindings only. The other 2.22.0 entries look inert here: no template in this repo uses the split filter (the one split row hit is nushell in a shell-init snapshot), and no custom filter uses StringInput.
• No overlap with #3794 — that bump group doesn't touch minijinja.