From f9c6dbb4925d59c0473f267481bebc1b02d72529 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 11:33:39 +0000 Subject: [PATCH 1/4] Bump ast-serialize from 0.8.0 to 0.9.0 (#13647) Bumps [ast-serialize](https://github.com/mypyc/ast_serialize) from 0.8.0 to 0.9.0.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ast-serialize&package-manager=pip&previous-version=0.8.0&new-version=0.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index d47666572c3..70cd3dc5954 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -26,7 +26,7 @@ alabaster==1.0.0 # via sphinx annotated-types==0.8.0 # via pydantic -ast-serialize==0.8.0 +ast-serialize==0.9.0 # via mypy async-timeout==5.0.1 ; python_version < "3.11" # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 5df52c1016d..c25189542a4 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -26,7 +26,7 @@ alabaster==1.0.0 # via sphinx annotated-types==0.8.0 # via pydantic -ast-serialize==0.8.0 +ast-serialize==0.9.0 # via mypy async-timeout==5.0.1 ; python_version < "3.11" # via diff --git a/requirements/lint.txt b/requirements/lint.txt index f32cf63b327..5ca8908afbb 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -14,7 +14,7 @@ aiosignal==1.4.0 # via aiohttp annotated-types==0.8.0 # via pydantic -ast-serialize==0.8.0 +ast-serialize==0.9.0 # via mypy async-timeout==5.0.1 # via diff --git a/requirements/test-common.txt b/requirements/test-common.txt index 7471fe9aee6..54d283dcecf 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -10,7 +10,7 @@ aiosignal==1.4.0 # via aiohttp annotated-types==0.8.0 # via pydantic -ast-serialize==0.8.0 +ast-serialize==0.9.0 # via mypy async-timeout==5.0.1 # via aiohttp diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 1df6989293e..44824777d1b 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -18,7 +18,7 @@ aiosignal==1.4.0 # aiohttp annotated-types==0.8.0 # via pydantic -ast-serialize==0.8.0 +ast-serialize==0.9.0 # via mypy async-timeout==5.0.1 ; python_version < "3.11" # via diff --git a/requirements/test.txt b/requirements/test.txt index cce5aaf44ff..71519e4aa53 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -18,7 +18,7 @@ aiosignal==1.4.0 # aiohttp annotated-types==0.8.0 # via pydantic -ast-serialize==0.8.0 +ast-serialize==0.9.0 # via mypy async-timeout==5.0.1 ; python_version < "3.11" # via From 7bc621e72cc38134a8f1d1f412e301e5665a07c4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 11:33:52 +0000 Subject: [PATCH 2/4] Bump sphinxcontrib-mermaid from 2.1.0 to 2.1.1 (#13645) Bumps [sphinxcontrib-mermaid](https://github.com/mgaitan/sphinxcontrib-mermaid) from 2.1.0 to 2.1.1.
Changelog

Sourced from sphinxcontrib-mermaid's changelog.

2.1.1 (July 19, 2026)

  • Preserve source metadata on generated Mermaid caption nodes so Sphinx extracts them into gettext catalogs and applies normal caption translations
  • Pass the existing mermaid image class through the HTML visitor so PNG output can be targeted consistently with CSS
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sphinxcontrib-mermaid&package-manager=pip&previous-version=2.1.0&new-version=2.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc-spelling.txt | 2 +- requirements/doc.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 70cd3dc5954..d9a14a9c6ba 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -279,7 +279,7 @@ sphinxcontrib-htmlhelp==2.1.0 # via sphinx sphinxcontrib-jsmath==1.0.1 # via sphinx -sphinxcontrib-mermaid==2.1.0 +sphinxcontrib-mermaid==2.1.1 # via -r requirements/doc.in sphinxcontrib-qthelp==2.0.0 # via sphinx diff --git a/requirements/dev.txt b/requirements/dev.txt index c25189542a4..700e3e07768 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -271,7 +271,7 @@ sphinxcontrib-htmlhelp==2.1.0 # via sphinx sphinxcontrib-jsmath==1.0.1 # via sphinx -sphinxcontrib-mermaid==2.1.0 +sphinxcontrib-mermaid==2.1.1 # via -r requirements/doc.in sphinxcontrib-qthelp==2.0.0 # via sphinx diff --git a/requirements/doc-spelling.txt b/requirements/doc-spelling.txt index 470b59b0a94..e642cb640ae 100644 --- a/requirements/doc-spelling.txt +++ b/requirements/doc-spelling.txt @@ -73,7 +73,7 @@ sphinxcontrib-htmlhelp==2.1.0 # via sphinx sphinxcontrib-jsmath==1.0.1 # via sphinx -sphinxcontrib-mermaid==2.1.0 +sphinxcontrib-mermaid==2.1.1 # via -r requirements/doc.in sphinxcontrib-qthelp==2.0.0 # via sphinx diff --git a/requirements/doc.txt b/requirements/doc.txt index 85c4be94cdf..ff2660b230a 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -68,7 +68,7 @@ sphinxcontrib-htmlhelp==2.1.0 # via sphinx sphinxcontrib-jsmath==1.0.1 # via sphinx -sphinxcontrib-mermaid==2.1.0 +sphinxcontrib-mermaid==2.1.1 # via -r requirements/doc.in sphinxcontrib-qthelp==2.0.0 # via sphinx From c549b4927b8a261700bb53bc30755d8246a41970 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 11:35:19 +0000 Subject: [PATCH 3/4] Bump virtualenv from 21.7.7 to 21.7.8 (#13649) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.7 to 21.7.8.
Release notes

Sourced from virtualenv's releases.

21.7.8

What's Changed

Full Changelog: https://github.com/pypa/virtualenv/compare/21.7.7...21.7.8

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.8

  • A missing source needed by both install modes now disables the builtin creator through meta.error. The check compared RefWhen values against RefMust members, so creation went on to fail with a FileNotFoundError or a dangling symlink - by :user:darrenhuai. (:issue:3227)

v21.7.7 (2026-08-28)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=virtualenv&package-manager=pip&previous-version=21.7.7&new-version=21.7.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index d9a14a9c6ba..379599aa477 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -333,7 +333,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.7 +virtualenv==21.7.8 # via pre-commit wheel==0.48.0 # via pip-tools diff --git a/requirements/dev.txt b/requirements/dev.txt index 700e3e07768..9c7a3890d3f 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -323,7 +323,7 @@ uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpytho # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.7 +virtualenv==21.7.8 # via pre-commit wheel==0.48.0 # via pip-tools diff --git a/requirements/lint.txt b/requirements/lint.txt index 5ca8908afbb..f0b275c1680 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -166,7 +166,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # via -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.7 +virtualenv==21.7.8 # via pre-commit yarl==1.24.5 # via aiohttp From 37c78a7e0da0dbf7b8b78a6cfe77a6c10be04f8d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 11:36:48 +0000 Subject: [PATCH 4/4] Bump platformdirs from 4.11.6 to 4.11.7 (#13650) Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.6 to 4.11.7.
Release notes

Sourced from platformdirs's releases.

4.11.7

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.11.6...4.11.7

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.7 (2026-09-01)

4.11.6 (2026-09-01)

  • Give :func:~platformdirs.user_bin_dir and :func:~platformdirs.user_bin_path the use_site_for_root argument. They took none, so neither could reach the Unix redirect of root to :func:~platformdirs.site_bin_dir. :pr:537

4.11.5 (2026-08-27)

  • Give :func:~platformdirs.user_preference_dir and :func:~platformdirs.user_preference_path the same arguments as :func:~platformdirs.user_config_dir. Added without arguments in :pr:491, they could only return the unscoped base directory even though the property they wrap appends the app name and version. :pr:531
  • Make :func:~platformdirs.site_applications_path return the first entry when multipath=True, matching :func:~platformdirs.site_data_path. On Unix and macOS it passed the whole $XDG_DATA_DIRS list to :class:~pathlib.Path, giving one unusable path such as /first/applications:/second/applications. :pr:532
  • Give :func:~platformdirs.user_applications_dir, :func:~platformdirs.user_applications_path, :func:~platformdirs.site_applications_dir and :func:~platformdirs.site_applications_path the app arguments. Android scopes both applications directories to the app, so without them the functions could only return the unscoped base directory there. On the two site functions they are keyword-only, keeping multipath first positional as it has been since 4.9.0; the two user functions take their boolean options keyword-only. :pr:534
  • Correct the ordering note on the iterator methods. use_site_for_root drops the user directory entirely, so the iterators are documented as yielding the most specific directory first rather than always yielding the user one. :pr:533

4.11.4 (2026-08-24)

  • Stop the iter_*_dirs methods yielding the same directory twice when a site directory resolves to its user equivalent - :pr:520 covered only Unix with use_site_for_root. It also hit :meth:~platformdirs.PlatformDirs.iter_runtime_dirs on Unix with $XDG_RUNTIME_DIR set, on Windows and macOS, and all six iterators on Android. :pr:524
  • Fix the config merging example in the how-to guide. iter_config_paths yields the user directory first, so the config.update loop let the site defaults override the user's config instead of the other way round. :pr:529

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.11.6&new-version=4.11.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 379599aa477..c5f1c63bff4 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -168,7 +168,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.6 +platformdirs==4.11.7 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 9c7a3890d3f..3efdc734b96 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -165,7 +165,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.6 +platformdirs==4.11.7 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index f0b275c1680..25deeade5ce 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -86,7 +86,7 @@ packaging==26.3 # via pytest pathspec==1.1.1 # via mypy -platformdirs==4.11.6 +platformdirs==4.11.7 # via virtualenv pluggy==1.6.0 # via pytest