Skip to content

chore(deps-dev): bump the dev-dependencies group with 6 updates - #128

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/uv/dev-dependencies-8301a22e86
Jul 19, 2026
Merged

chore(deps-dev): bump the dev-dependencies group with 6 updates#128
github-actions[bot] merged 1 commit into
mainfrom
dependabot/uv/dev-dependencies-8301a22e86

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 6 updates:

Package From To
django-stubs 6.0.6 6.0.7
djlint 1.40.5 1.40.10
mypy 2.2.0 2.3.0
ruff 0.15.21 0.15.22
ty 0.0.58 0.0.61
mkdocs-material 9.7.6 9.7.7

Updates django-stubs from 6.0.6 to 6.0.7

Commits

Updates djlint from 1.40.5 to 1.40.10

Release notes

Sourced from djlint's releases.

v1.40.10

Fix

  • Fix crashes in mypyc-compiled wheels: AttributeError: attribute 'reformat' of 'Config' objects is not writable when linting or formatting multiple files, and AttributeError: attribute 'start' of 'TagToken' objects is not writable when processing a file.

v1.40.9

Fix

  • Indent content inside Django {% cache %}, {% timezone %}, {% localtime %} and {% localize %} blocks instead of dedenting everything after them.
  • Format django-cotton component tags such as <c-card> and <c-forms.input /> as block HTML tags without requiring custom_html configuration.
  • Preserve whitespace-only content of inline elements as a single space instead of dropping it, so runs like <b>bold</b><span> </span><i>italic</i> keep rendering a space; non-collapsible whitespace such as U+2005 is kept verbatim.
  • Preserve line breaks inside hyperscript _ attribute values, where a newline separates commands and -- comments run to the end of the line.
  • Stop inserting line breaks into attribute values that render whitespace verbatim; only class and style values are spread over multiple lines with format_attribute_template_tags.
  • Leave {% comment %} block content untouched when reformatting, e.g. bare URLs ending in />.
  • Apply rule-specific djlint:off RULE suppression to any finding overlapping the region, so reformatted guards keep linting clean.
  • Avoid false H037 reports for attribute names with a conditional template prefix, e.g. {% if x %}data-{% endif %}srcset.
  • Avoid false reports for HTML-like content inside template tag arguments, e.g. H008 on quotes in a string argument.

v1.40.8

Fix

  • Preserve conditional attribute names and significant whitespace in template-generated attributes.
  • Keep parent closing tags aligned after multiline inline content.
  • Avoid false H026 reports when id or class is followed by a spaced equals sign.
  • Keep short tag contents inline when attributes contain template expressions.
  • Avoid false D018/J018 reports for links using valid URI schemes.
  • Indent content inside Twig embed blocks.
  • Avoid false H037 reports for attributes in mutually exclusive template branches.
  • Respect exclude and extend_exclude for explicitly provided files.
  • Preserve attributes containing nested template blocks when wrapping long tags.
  • Preserve template expressions used in dynamic HTML tag names.
  • Preserve asterisks in HTML attribute names such as htmx response targets.
  • Avoid adding trailing whitespace after function calls in multiline template expressions.
  • Avoid false T002 reports for template tags inside HTML attributes.

v1.40.7

Fix

  • Preserve URLs enclosed in angle brackets inside template comments.

v1.40.6

Performance and refactoring

  • Replace repeated HTML regex scans with tokenization.
Changelog

Sourced from djlint's changelog.

[1.40.10] - 2026-07-19

Fix

  • Fix crashes in mypyc-compiled wheels: AttributeError: attribute 'reformat' of 'Config' objects is not writable when linting or formatting multiple files, and AttributeError: attribute 'start' of 'TagToken' objects is not writable when processing a file.

[1.40.9] - 2026-07-18

Fix

  • Indent content inside Django {% cache %}, {% timezone %}, {% localtime %} and {% localize %} blocks instead of dedenting everything after them.
  • Format django-cotton component tags such as <c-card> and <c-forms.input /> as block HTML tags without requiring custom_html configuration.
  • Preserve whitespace-only content of inline elements as a single space instead of dropping it, so runs like <b>bold</b><span> </span><i>italic</i> keep rendering a space; non-collapsible whitespace such as U+2005 is kept verbatim.
  • Preserve line breaks inside hyperscript _ attribute values, where a newline separates commands and -- comments run to the end of the line.
  • Stop inserting line breaks into attribute values that render whitespace verbatim; only class and style values are spread over multiple lines with format_attribute_template_tags.
  • Leave {% comment %} block content untouched when reformatting, e.g. bare URLs ending in />.
  • Apply rule-specific djlint:off RULE suppression to any finding overlapping the region, so reformatted guards keep linting clean.
  • Avoid false H037 reports for attribute names with a conditional template prefix, e.g. {% if x %}data-{% endif %}srcset.
  • Avoid false reports for HTML-like content inside template tag arguments, e.g. H008 on quotes in a string argument.

[1.40.8] - 2026-07-17

Fix

  • Preserve conditional attribute names and significant whitespace in template-generated attributes.
  • Keep parent closing tags aligned after multiline inline content.
  • Avoid false H026 reports when id or class is followed by a spaced equals sign.
  • Keep short tag contents inline when attributes contain template expressions.
  • Avoid false D018/J018 reports for links using valid URI schemes.
  • Indent content inside Twig embed blocks.
  • Avoid false H037 reports for attributes in mutually exclusive template branches.
  • Respect exclude and extend_exclude for explicitly provided files.
  • Preserve attributes containing nested template blocks when wrapping long tags.
  • Preserve template expressions used in dynamic HTML tag names.
  • Preserve asterisks in HTML attribute names such as htmx response targets.
  • Avoid adding trailing whitespace after function calls in multiline template expressions.
  • Avoid false T002 reports for template tags inside HTML attributes.

[1.40.7] - 2026-07-15

Fix

  • Preserve URLs enclosed in angle brackets inside template comments.

[1.40.6] - 2026-07-13

Performance and refactoring

  • Replace repeated HTML regex scans with tokenization.
Commits
  • 1e793c3 docs; update changelog
  • 627569d v1.40.10
  • fa98b9b fix: don't mark instance attributes Final, it breaks mypyc wheels
  • d69cec6 perf: rewrite any/all as plain loops
  • cae2535 fix mypyc builds
  • cd4994d v1.40.9
  • 1fa699c docs: add single-attribute-per-line examples
  • 9714ded docs: restore genuine djLint output in formatter and ignoring-code examples
  • 54e2e3d fix: format django-cotton component tags without custom_html configuration
  • 273d0f9 fix: indent content of Django cache, timezone, localtime and localize blocks
  • Additional commits viewable in compare view

Updates mypy from 2.2.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
  • 24c237d [mypyc] Improve documentation of Final (#21713)
  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
  • cbcb51a Narrow for frozendict membership check (#21709)
  • af2bc0f Sync typeshed (#21707)
  • Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Commits

Updates ty from 0.0.58 to 0.0.61

Release notes

Sourced from ty's releases.

0.0.61

Release Notes

Released on 2026-07-17.

Bug fixes

  • Avoid recursive protocol structural comparisons (#26721)

LSP server

  • Render Google docstrings as structured Markdown (#26599)

Library support

  • Pydantic: Collect field metadata through subscripted generic Annotated aliases (#26885)

Diagnostics

  • Avoid extending own-line suppressions in --add-ignore (#26808)

Core type checking

  • Derive descriptor setter domains for protocols (#26683)
  • Enforce declared receiver TypeVar domains (#26863)
  • Infer isinstance results for aliases and type variables (#26961)
  • Infer isinstance results for fixed class tuples (#26935)
  • Narrow inline list and set membership checks (#26955)
  • Narrow tagged unions by tag truthiness (#26887)
  • Narrow walrus expression values (#26949)
  • Project intersections in to_instance (#26892)
  • Remove inferable TypeVar artifacts recursively (#26787)
  • Respect mixin receiver domains in method overrides (#26941)
  • Support TypeVarTuple and Unpack (#25240)

Performance

  • Deduplicate completion labels (#26890)
  • Only collect expected types for files open in the editor (#25546)
  • Parallelize subtype hierarchy search (#26875)
  • Share heap-backed parser names with CharStr (#26594)
  • Use the new incremental checker from the ignore crate (#26933)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.61

Released on 2026-07-17.

Bug fixes

  • Avoid recursive protocol structural comparisons (#26721)

LSP server

  • Render Google docstrings as structured Markdown (#26599)

Library support

  • Pydantic: Collect field metadata through subscripted generic Annotated aliases (#26885)

Diagnostics

  • Avoid extending own-line suppressions in --add-ignore (#26808)

Core type checking

  • Derive descriptor setter domains for protocols (#26683)
  • Enforce declared receiver TypeVar domains (#26863)
  • Infer isinstance results for aliases and type variables (#26961)
  • Infer isinstance results for fixed class tuples (#26935)
  • Narrow inline list and set membership checks (#26955)
  • Narrow tagged unions by tag truthiness (#26887)
  • Narrow walrus expression values (#26949)
  • Project intersections in to_instance (#26892)
  • Remove inferable TypeVar artifacts recursively (#26787)
  • Respect mixin receiver domains in method overrides (#26941)
  • Support TypeVarTuple and Unpack (#25240)

Performance

  • Deduplicate completion labels (#26890)
  • Only collect expected types for files open in the editor (#25546)
  • Parallelize subtype hierarchy search (#26875)
  • Share heap-backed parser names with CharStr (#26594)
  • Use the new incremental checker from the ignore crate (#26933)

Contributors

... (truncated)

Commits

Updates mkdocs-material from 9.7.6 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates.

The path forward is Zensical, our next-generation static site generator built from first principles. If you’re planning a new documentation project or thinking about your long-term setup, we encourage you to start exploring Zensical.

Organizations requiring support beyond this date can get in touch to discuss options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

  • Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

  • Limited version range of mkdocs to <2
  • Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

  • Hardened social cards plugin by switching to sandboxed environment
  • Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

  • Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

  • Opened up version ranges of optional dependencies for forward-compatibility
  • Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

  • Updated requests to 2.30+ to mitigate CVE in urllib
  • Fixed privacy plugin not picking up protocol-relative URLs
  • Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the dev-dependencies group with 6 updates
6119876 
Bumps the dev-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [django-stubs](https://github.com/typeddjango/django-stubs) | `6.0.6` | `6.0.7` |
| [djlint](https://github.com/djlint/djLint) | `1.40.5` | `1.40.10` |
| [mypy](https://github.com/python/mypy) | `2.2.0` | `2.3.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.15.22` |
| [ty](https://github.com/astral-sh/ty) | `0.0.58` | `0.0.61` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.6` | `9.7.7` |


Updates `django-stubs` from 6.0.6 to 6.0.7
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.6...6.0.7)

Updates `djlint` from 1.40.5 to 1.40.10
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.40.5...v1.40.10)

Updates `mypy` from 2.2.0 to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.2.0...v2.3.0)

Updates `ruff` from 0.15.21 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.15.22)

Updates `ty` from 0.0.58 to 0.0.61
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.58...0.0.61)

Updates `mkdocs-material` from 9.7.6 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.6...9.7.7)

---
updated-dependencies:
- dependency-name: django-stubs
  dependency-version: 6.0.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: djlint
  dependency-version: 1.40.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: ty
  dependency-version: 0.0.61
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 19, 2026
@github-actions
github-actions Bot merged commit 293f9aa into main Jul 19, 2026
6 of 11 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/dev-dependencies-8301a22e86 branch July 19, 2026 18:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants