[dependabot]

Bumps the patch-updates group with 4 updates: hypothesis, build, pip and cairosvg.

Updates hypothesis from 6.170.1 to 6.170.5

Commits

• 6dda9ec Bump hypothesis version to 6.170.5 and update changelog
• d5af8b4 Merge pull request #4913 from Liam-DeVoe/fix-integer-weights-key
• 3352fe0 Bump hypothesis version to 6.170.4 and update changelog
• ccb592e Merge pull request #4915 from jorenham/typing/_settings/coverage
• 74a7906 Merge remote-tracking branch 'upstream/master' into pr-4915
• 5378001 Bump hypothesis version to 6.170.3 and update changelog
• 93c67c8 Pin max_examples in mixed-alphabet one_of regression test
• 49ba6fc Merge branch 'master' into typing/_settings/coverage
• 6df93f9 oops
• 2e26f0b Merge pull request #4914 from Liam-DeVoe/fix-shrinker-invalid-sort-key
• Additional commits viewable in compare view

Updates build from 1.6.0 to 1.6.1

Release notes

Sourced from build's releases.

1.6.1

What's Changed

• chore[v1]: prepare for v1.6.1 by @​henryiii in pypa/build#1181

Full Changelog: pypa/build@1.6.0...1.6.1

Changelog

Sourced from build's changelog.

#################### 1.6.1 (2026-09-10) ####################

---

Bugfixes

---

• Avoid trying to detect symlinks on Windows, regression in 1.6.0 - by :user:henryiii (:issue:1175) (:issue:1175)

---

Documentation

---

• Fix doubled backslashes in the Windows pip config path (%APPDATA%\pip\pip.ini) in the docs - by :user:aroh3006 (:issue:1149)

---

Miscellaneous

---

• :issue:1168, :issue:1170, :issue:1178

#################### 1.6.0 (2026-08-27) ####################

---

Features

---

• Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
• The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
• The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
• Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
• Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
  • by :user:gaborbernat (:issue:655)
• Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
• On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

---

Bugfixes

---

... (truncated)

Commits

• 89cccef chore: prepare for 1.6.1
• a6f707a ci: support releases from v* branches (#1178)
• 7785161 docs: fix doubled backslashes in Windows pip config path (#1149)
• 244b250 fix: always use copies for the isolated venv on Windows (#1176)
• c93ca6f build(deps): bump re-actors/alls-green from 1.2.2 to 1.3.0 in the github-acti...
• e02ffd3 pre-commit: bump repositories (#1173)
• aad39a8 docs: fix changelog page heading levels and sidebar (#1171)
• 5c3fd46 docs: use PyPI ref directly (#1172)
• 1c5bd6c 🐛 fix(release): format generated changelog (#1170)
• 7f0cc7e 🔧 build(type): replace mypy with pyrefly (#1168)
• See full diff in compare view

Updates pip from 26.2.1 to 26.2.2

Changelog

Sourced from pip's changelog.

26.2.2 (2026-10-20)

Vendored Libraries

• Upgrade certifi to 2026.10.19

Commits

• b3b696f Bump for release
• b0c56c1 Upgrade certifi to 2026.10.19
• See full diff in compare view

Updates cairosvg from 2.9.0 to 2.9.1

Release notes

Sourced from cairosvg's releases.

2.9.1

WARNING: this is a security update.

Specially crafted SVGs with very long paths could lead to exponential rendering times.

• Support path-like objects for the url parameter
• Fix support of Windows paths

Changelog

Sourced from cairosvg's changelog.

Version 2.9.1 released on 2026-09-07

WARNING: this is a security update.

Specially crafted SVGs with very long paths could lead to exponential rendering times.

• Support path-like objects for the url parameter
• Fix support of Windows paths

Commits

• 3b7a250 Version 2.9.1
• 9d63f04 Use a regex-based tokenizer for paths to avoid quadratic compexity
• a4d585e Don’t use O(n) list.pop(0) for vertices, use O(1) deque.popleft()
• 026fbce Merge pull request #449 from SAY-5/feat/url-pathlike
• 6eaa366 feat(url): accept path-like objects for the url parameter
• 0613641 Cut long line
• 50fdfe8 Merge pull request #447 from BudongJW/fix/resub-positional-flags
• 278c227 Fix re.sub positional argument in nt_compatible_path
• 6075040 Cut long line
• babf3df Fix CI
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.