fix(deps): update python dependencies (main)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
charmlibs-interfaces-tls-certificates (source, changelog)	~=1.8 → ~=1.10
jubilant	>=1.7.0 → >=1.13.0
ops (changelog)	>=3.6.0 → >=3.8.2
pydantic (changelog)	==2.12.5 → ==2.13.5

---

Release Notes

canonical/charmlibs (charmlibs-interfaces-tls-certificates)

v1.10.1

Fix Mode.APP_AND_UNIT requirers raising RelationDataAccessError on every non-leader unit. The library read the requirer's own application databag regardless of leadership, so once the leader had written its application certificate request, no other unit could complete a hook -- taking the unit scope down with the application one. Non-leaders now load the unit scope only, which is all they can act on: they can reach neither the application private key nor the application certificate secrets.

canonical/jubilant (jubilant)

v1.13.0

Compare Source

Features

• Expose wait to CLI (#​374)

Documentation

• Extract howto guides from the tutorial (#​383)
• Update juju.wait doc string; update title of run-juju-cli-command how-to page; update juju.cli example (#​396)

v1.12.0

Compare Source

Features

• Improve Jubilant logging mechanism (#​351)
• Bump minimum python version to 3.10 (#​370)

Chores

• Rolling uv exclude-newer supply-chain quarantine (#​368)
• Set dependabot commit-message prefix to "chore" (no scope) (#​367)
• Add Code of Conduct linking to Ubuntu CoC (#​356)
• Run uv lock after adding exclude-newer duration (#​372)

CI

• Adopt new dependabot conventions (#​365)
• Hash-pin actions and drop zizmor config (#​366)
• Correct hash-pin version comment for upload-sarif action (#​376)
• Pin action version comments to exact tags (#​378)

canonical/operator (ops)

v3.8.2

Compare Source

Fixes

• Compare full event paths when skipping duplicate notices (#​2684)
• In ops.testing, don't pass a message when converting an unknown status by name (#​2700)

Documentation

• Give each best-practice admonition a stable anchor (#​2524)
• Reword text that vale 3.17 flags as misspelled (#​2695)
• Stop styling page references as blockquotes (#​2666)
• Make the custom-endpoint-name sample test actually test something (#​2664)
• Replace requests by urllib in K8s tutorial integration tests (#​2687)
• Recommend spread directly, rather than charmcraft test (#​2706)
• Extract sections in "how to write integration tests" to their own how-to guide (#​2662)

CI

• Point DB charm CI at the moved mysql-operators repo (#​2551)
• Switch example charm integration tests to Concierge k8s preset (#​2696)
• Use the upstream concierge presets again (#​2699)

v3.8.1

Compare Source

Fixes

• Align Juju naming rules with testing class rules (#​2570)
• Do not attempt to mutate secret data in grant/revoke during tests (#​2614)
• Allow IdentityDict to be assigned IdentityAccess (#​2628)
• Only decode fields used by the data class in Relation.load() (#​2636)
• Use juju.wait for workload version tests in Kubernetes tutorial (#​2650)

Documentation

• Wait longer for Loki data in Kubernetes tutorial integration tests (#​2611)
• Add more guidance about charm naming (#​2610)
• Fix tempo test_deploy URL (#​2631)
• Add how-to guide for debugging Kubernetes charms (#​2498)
• Revert to installed charmcraft for initing charms (#​2635)
• Grab workload version in Kubernetes tutorial (#​2559)
• Separate test_workload_version_is_set in Kubernetes tutorial chapter 3 (#​2638)
• Add how-to guide to configure jubilant logs (#​2619)
• Use autofunction for layer_from_rockcraft (#​2648)
• Remove log_cli and log_file ini options; keep them as CLI arguments for integration tests (#​2654)
• Fix typo in explanation of mock_version fixture usage (#​2647)
• Switch Kubernetes tutorial charms to rock version of demo server (#​2649)

Tests

• Type-check testing/src/scenario and fix uncovered errors (#​2615)

CI

• Add dependency-review-action on PRs (#​2587)
• Re-enable the tracing integration tests (#​2586)
• Adopt new dependabot conventions (#​2609)
• Drop unsupported cooldown.semver-major-days from github-actions block (#​2617)
• Open an issue if a scheduled workflow fails (#​2627)
• Hash-pin actions and drop zizmor config (#​2612)
• Use uv-venv-lock-runner in tracing tox, align deps (#​2651)

pydantic/pydantic (pydantic)

v2.13.5

Compare Source

v2.13.4: 2026-05-06

Compare Source

v2.13.4 (2026-05-06)

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #​13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #​13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #​13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

v2.13.3

Compare Source

GitHub release

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #​13096

v2.13.2

Compare Source

v2.13.1: 2026-04-15

Compare Source

v2.13.1 (2026-04-15)

What's Changed

Fixes

• Fix ValidationInfo.data missing with model_validate_json() by @​davidhewitt in #​13079

Full Changelog: pydantic/pydantic@v2.13.0...v2.13.1

v2.13.0

Compare Source

GitHub release

The highlights of the v2.13 release are available in the blog post.
Several minor changes (considered non-breaking changes according to our versioning policy)
are also included in this release. Make sure to look into them before upgrading.

This release contains the updated pydantic.v1 namespace, matching version 1.10.26 which includes support for Python 3.14.

What's Changed

See the beta releases for all changes sinces 2.12.

New Features

• Allow default factories of private attributes to take validated model data by @​Viicos in #​13013

Changes

• Warn when serializing fixed length tuples with too few items by @​arvindsaripalli in #​13016

Fixes

• Change type of Any when synthesizing _build_sources for BaseSettings.__init__() signature in the mypy plugin by @​Viicos in #​13049
• Fix model equality when using runtime extra configuration by @​Viicos in #​13062

Packaging

• Add zizmor for GitHub Actions workflow linting by @​Viicos in #​13039
• Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by @​Viicos in #​13064

New Contributors

• @​arvindsaripalli made their first contribution in #​13016

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "before 5am on Monday and Thursday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.