chore(deps): Bump the "all-dependencies" group with 3 updates across multiple ecosystems

[dependabot]

Bumps the all-dependencies group with 2 updates: uv and pydoclint.

Updates uv from 0.12.19 to 0.12.20

Release notes

Sourced from uv's releases.

0.12.20

Release Notes

Released on 2026-09-28.

Enhancements

• Reuse lockfiles when dependency declarations are semantically equivalent (#21951)
• Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs (#21990)

Preview features

• Write normalized requirement declarations with the lockfile-normalization preview feature (#21951)
• Honor synthetic default groups when installing or syncing from pylock.toml (#22003)
• Resolve local paths in exported pylock.toml files relative to the output file (#22042)
• Install each package only once when repeated tool-install-locks requirements resolve to the same package (#22000)
• Reuse lock-without-metadata lockfiles for conflicting groups with distinct base and extra requirement specifiers (#22055)
• Use consistent root-package paths in uv workspace metadata and uv tree --format json output (#22050)

Configuration

• Continue searching XDG_CONFIG_DIRS after empty entries (#21987)

Performance

• Restore the previous HTTP cache-write scheduling while investigating severe cache-revalidation stalls on ext4 filesystems (#22051)

Bug fixes

• Apply hash constraints to every repeated requirement under --require-hashes and --verify-hashes (#21996)
• Allow metadata builds for first-party workspace projects under --no-build (#21988)
• Honor project exclusion flags with --all-packages, including --no-install-project and --no-emit-project (#21994)
• Restore pyproject.toml if uv upgrade fails or is interrupted (#21983)
• Generate working Nushell activation scripts for relocatable virtual environments (#21979)
• Prevent commands from running and changing state after displaying --show-settings (#21989)
• Treat UTF-16 requirements files containing only a byte-order mark as empty (#21991)
• Ignore unrecognized managed-Python implementation directories during uv python list and uv python upgrade instead of panicking (#22033)
• Avoid panics and incorrect rewriting when managed Python sysconfig paths merely start with /install (#22036)
• Report whitespace-only non-ASCII requirements as invalid instead of panicking (#22035)
• Avoid a resolver panic when trace logging an always-false constraint (#22034)

Install uv 0.12.20

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.20/uv-installer.sh | sh

Install prebuilt binaries via powershell script

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.20

Released on 2026-09-28.

Enhancements

• Reuse lockfiles when dependency declarations are semantically equivalent (#21951)
• Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs (#21990)

Preview features

• Write normalized requirement declarations with the lockfile-normalization preview feature (#21951)
• Honor synthetic default groups when installing or syncing from pylock.toml (#22003)
• Resolve local paths in exported pylock.toml files relative to the output file (#22042)
• Install each package only once when repeated tool-install-locks requirements resolve to the same package (#22000)
• Reuse lock-without-metadata lockfiles for conflicting groups with distinct base and extra requirement specifiers (#22055)
• Use consistent root-package paths in uv workspace metadata and uv tree --format json output (#22050)

Configuration

• Continue searching XDG_CONFIG_DIRS after empty entries (#21987)

Performance

• Restore the previous HTTP cache-write scheduling while investigating severe cache-revalidation stalls on ext4 filesystems (#22051)

Bug fixes

• Apply hash constraints to every repeated requirement under --require-hashes and --verify-hashes (#21996)
• Allow metadata builds for first-party workspace projects under --no-build (#21988)
• Honor project exclusion flags with --all-packages, including --no-install-project and --no-emit-project (#21994)
• Restore pyproject.toml if uv upgrade fails or is interrupted (#21983)
• Generate working Nushell activation scripts for relocatable virtual environments (#21979)
• Prevent commands from running and changing state after displaying --show-settings (#21989)
• Treat UTF-16 requirements files containing only a byte-order mark as empty (#21991)
• Ignore unrecognized managed-Python implementation directories during uv python list and uv python upgrade instead of panicking (#22033)
• Avoid panics and incorrect rewriting when managed Python sysconfig paths merely start with /install (#22036)
• Report whitespace-only non-ASCII requirements as invalid instead of panicking (#22035)
• Avoid a resolver panic when trace logging an always-false constraint (#22034)

Commits

• 2274b80 Bump version to 0.12.20 (#22064)
• 8ee7eeb Add atomic write and HTTP cache benchmarks (#22054)
• fc012a6 Reuse conflicting group locks with distinct extra specifiers (#22055)
• c9dab42 Revert "Batch HTTP cache writes in blocking tasks" (#22051)
• b92dafc Normalize root paths in metadata output (#22050)
• 4d3ce16 Normalize requirement declarations in lockfiles (#21951)
• 13fd524 Downgrade some of reqsign's transitive deps (#22047)
• 7a3bc07 Avoid panics for unknown managed Python implementations (#22033)
• a41dbfc Fix local paths in pylock.toml exports (#22042)
• 38502bc Update Rust crate owo-colors to v4.4.0 (#22031)
• Additional commits viewable in compare view

Updates pydoclint from 0.10.0 to 0.10.1

Release notes

Sourced from pydoclint's releases.

0.10.1

What's Changed

• Rewrite README and restructure docs by @​jsh9 in jsh9/pydoclint#307
• Use stacked pytest parametrize instead of itertools.product in tests by @​jsh9 in jsh9/pydoclint#308

Full Changelog: jsh9/pydoclint@0.10.0...0.10.1

Changelog

Sourced from pydoclint's changelog.

[0.10.1] - 2026-09-27

• Changed
  • Rewrote the README and restructured the docs
• Fixed
  • Stale docs content and the broken DOC103/DOC603 docs link
• Added
  • docs/llms.txt and a pre-commit check for orphan docs and broken links
• Maintenance
  • Replaced itertools.product with stacked @pytest.mark.parametrize decorators in tests/test_main.py
• Full diff
  • jsh9/pydoclint@0.10.0...0.10.1

Commits

• e0aeee3 Use stacked pytest parametrize instead of itertools.product in tests (#308)
• f87ba10 Rewrite README and restructure docs (#307)
• See full diff in compare view

Bumps the all-dependencies group with 1 update: https://github.com/jsh9/pydoclint.

Updates https://github.com/jsh9/pydoclint from 0.9.1 to 0.10.1

Release notes

Sourced from https://github.com/jsh9/pydoclint's releases.

0.10.1

What's Changed

• Rewrite README and restructure docs by @​jsh9 in jsh9/pydoclint#307
• Use stacked pytest parametrize instead of itertools.product in tests by @​jsh9 in jsh9/pydoclint#308

Full Changelog: jsh9/pydoclint@0.10.0...0.10.1

Changelog

Sourced from https://github.com/jsh9/pydoclint's changelog.

Change Log

[0.11.0] - 2026-10-02

• Added
  • A new config option --include-stub-files (shortform: -isf, default: False), so that scanning a folder also checks stub (.pyi) files (#303)
• Fixed
  • False-positive DOC403 and DOC502 violations in stub (.pyi) files, whose function bodies are placeholders, in both the native mode and flake8 (#303). DOC403 is still reported in stub files when the return annotation isn't a Generator/Iterator/Iterable (or is missing), because then the function can't yield anything
  • False-positive DOC105 and DOC605 violations in stub files when --check-arg-defaults is True: an argument or class attribute whose default is the ... placeholder can now be documented with any default value or none
  • False-positive DOC201 violations for abstract methods and stub functions annotated with Iterator[...] or Iterable[...] whose docstrings have a "Yields" section (and no "return" statements in the body). Their bodies are placeholders, so the "Yields" section is what shows that they yield, and they don't need a "Returns" section
  • False-positive DOC203 violations for abstract methods and stub functions annotated with Generator[YieldType, SendType, ReturnType] whose "Returns" section documents ReturnType, as for a generator that both yields and returns
  • False-positive DOC202 violations for abstract methods and stub functions that have a "Returns" section but no return annotation. (DOC203 still reports the missing annotation when return types are checked.)
  • A crash (IndexError) when --check-arg-defaults is True and positional-only arguments (the ones before /) have default values. When it didn't crash, the defaults of positional-only arguments were ignored
• Full diff
  • jsh9/pydoclint@0.10.1...0.11.0

[0.10.1] - 2026-09-27

• Changed
  • Rewrote the README and restructured the docs
• Fixed
  • Stale docs content and the broken DOC103/DOC603 docs link
• Added
  • docs/llms.txt and a pre-commit check for orphan docs and broken links
• Maintenance
  • Replaced itertools.product with stacked @pytest.mark.parametrize decorators in tests/test_main.py
• Full diff
  • jsh9/pydoclint@0.10.0...0.10.1

[0.10.0] - 2026-09-27

... (truncated)

Commits

• e0aeee3 Use stacked pytest parametrize instead of itertools.product in tests (#308)
• f87ba10 Rewrite README and restructure docs (#307)
• 4bfdb3c Add separate options for private, underscore-only, and special dunder names (...
• b72c91f Use external changelog diff checking hook (#297)
• See full diff in compare view

Bumps the all-dependencies group with 1 update: github/codeql-action/upload-sarif.

Updates github/codeql-action/upload-sarif from 4.37.6 to 4.38.2

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

... (truncated)

Commits

• 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
• 8ad03a3 Trigger workflows
• 98af865 Update changelog for v4.38.2
• a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
• 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
• 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
• f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
• 5e4e255 Rebuild
• b13f5f4 Bump ruby/setup-ruby
• c87fe57 Rebuild
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions