Skip to content

chore(deps): bump the pip group with 3 updates - #2455

Merged
Lancetnik merged 2 commits into
devfrom
dependabot/pip/pip-f838443594
Aug 14, 2025
Merged

chore(deps): bump the pip group with 3 updates#2455
Lancetnik merged 2 commits into
devfrom
dependabot/pip/pip-f838443594

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2025

Copy link
Copy Markdown
Contributor

Bumps the pip group with 3 updates: mkdocs-macros-plugin, ruff and zizmor.

Updates mkdocs-macros-plugin from 1.3.7 to 1.3.9

Changelog

Sourced from mkdocs-macros-plugin's changelog.

Changelog: Mkdocs-Macros

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Commits
  • 86e31f7 Define explicitely python in update_pypi.sh
  • 6b396ec Add info in doc that a module can have relative path (#263)
  • 62daea9 Fix: Fix detection of Jinja2, to allow title rendering (#266)
  • e0ba1ba Test built-in filters (#253)
  • 0bc57e3 Fix imprecision in description of parameters for jinja2 syntax (#252)
  • 4fb7bf6 Change tests: MkDocsPage.find() -> find_text()
  • See full diff in compare view

Updates ruff from 0.12.8 to 0.12.9

Release notes

Sourced from ruff's releases.

0.12.9

Release Notes

Preview features

  • [airflow] Add check for airflow.secrets.cache.SecretCache (AIR301) (#17707)
  • [ruff] Offer a safe fix for multi-digit zeros (RUF064) (#19847)

Bug fixes

  • [flake8-blind-except] Fix BLE001 false-positive on raise ... from None (#19755)
  • [flake8-comprehensions] Fix false positive for C420 with attribute, subscript, or slice assignment targets (#19513)
  • [flake8-simplify] Fix handling of U+001C..U+001F whitespace (SIM905) (#19849)

Rule changes

  • [pylint] Use lowercase hex characters to match the formatter (PLE2513) (#19808)

Documentation

  • Fix lint.future-annotations link (#19876)

Other changes

  • Build riscv64 binaries for release (#19819)
  • Add rule code to error description in GitLab output (#19896)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.12.9

Preview features

  • [airflow] Add check for airflow.secrets.cache.SecretCache (AIR301) (#17707)
  • [ruff] Offer a safe fix for multi-digit zeros (RUF064) (#19847)

Bug fixes

  • [flake8-blind-except] Fix BLE001 false-positive on raise ... from None (#19755)
  • [flake8-comprehensions] Fix false positive for C420 with attribute, subscript, or slice assignment targets (#19513)
  • [flake8-simplify] Fix handling of U+001C..U+001F whitespace (SIM905) (#19849)

Rule changes

  • [pylint] Use lowercase hex characters to match the formatter (PLE2513) (#19808)

Documentation

  • Fix lint.future-annotations link (#19876)

Other changes

  • Build riscv64 binaries for release (#19819)
  • Add rule code to error description in GitLab output (#19896)
Commits
  • ef42246 Bump 0.12.9 (#19917)
  • dc2e8ab [ty] support kw_only=True for dataclass() and field() (#19677)
  • 9aaa82d Feature/build riscv64 bin (#19819)
  • 3288ac2 [ty] Add caching to CodeGeneratorKind::matches() (#19912)
  • 1167ed6 [ty] Rename functionArgumentNames to callArgumentNames inlay hint setting...
  • 2ee47d8 [ty] Default ty.inlayHints.* server settings to true (#19910)
  • d324ced [ty] Remove py-fuzzer skips for seeds that are no longer slow (#19906)
  • 5a570c8 [ty] fix deferred name loading in PEP695 generic classes/functions (#19888)
  • baadb5a [ty] Add some additional type safety to CycleDetector (#19903)
  • df0648a [flake8-blind-except] Fix BLE001 false-positive on raise ... from None ...
  • Additional commits viewable in compare view

Updates zizmor from 1.11.0 to 1.12.0

Release notes

Sourced from zizmor's releases.

v1.12.0

New Features 🌈🔗

Enhancements 🌱🔗

  • The cache-poisoning audit now supports auto-fixes for many findings (#923)
  • The known-vulnerable-actions audit now supports auto-fixes for many findings (#1019)
  • zizmor is now stricter about parsing uses: clauses. In particular, zizmor will no longer accept uses: org/repo without a trailing @ref, as GitHub Actions itself does not accept this syntax (#1019)
  • The use-trusted-publishing audit now detects many more patterns, including cargo publish and other run: blocks that make use of publishing commands directly (#1042)
  • The insecure-commands audit now supports auto-fixes for many findings (#1045)
  • The template-injection audit now detects more action injection sinks (#1059)

Bug Fixes 🐛🔗

  • Fixed a bug where --fix would fail to preserve comments when modifying block-style YAML mappings (#995)
  • Fixed a bug where zizmor would crash when given a GitHub API token with leading or trailing whitespace (#1027)
  • Fixed a bug where template-injection findings in --fix mode would be incorrectly patched when referencing an env.* context (#1052)
  • Fixed a bug where template-injection findings in --fix mode would be patched with shell syntax that didn't match the step's actual shell (#1064)

v1.11.1-rc1

No release notes provided.

Changelog

Sourced from zizmor's changelog.

1.12.0

New Features 🌈

  • New audit: [unsound-condition] detects if: conditions that inadvertently always evaluate to true (#1053)

Enhancements 🌱

  • The [cache-poisoning] audit now supports auto-fixes for many findings (#923)
  • The [known-vulnerable-actions] audit now supports auto-fixes for many findings (#1019)
  • zizmor is now stricter about parsing uses: clauses. In particular, zizmor will no longer accept uses: org/repo without a trailing @ref, as GitHub Actions itself does not accept this syntax (#1019)
  • The [use-trusted-publishing] audit now detects many more patterns, including cargo publish and other #!yaml run: blocks that make use of publishing commands directly (#1042)
  • The [insecure-commands] audit now supports auto-fixes for many findings (#1045)
  • The [template-injection] audit now detects more action injection sinks (#1059)

Bug Fixes 🐛

  • Fixed a bug where --fix would fail to preserve comments when modifying block-style YAML mappings (#995)
  • Fixed a bug where zizmor would crash when given a GitHub API token with leading or trailing whitespace (#1027)
  • Fixed a bug where [template-injection] findings in --fix mode would be incorrectly patched when referencing an env.* context (#1052)
  • Fixed a bug where [template-injection] findings in --fix mode would be patched with shell syntax that didn't match the step's actual shell (#1064)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the pip group with 3 updates
d0eb2eb 
Bumps the pip group with 3 updates: [mkdocs-macros-plugin](https://github.com/fralau/mkdocs_macros_plugin), [ruff](https://github.com/astral-sh/ruff) and [zizmor](https://github.com/zizmorcore/zizmor).


Updates `mkdocs-macros-plugin` from 1.3.7 to 1.3.9
- [Release notes](https://github.com/fralau/mkdocs_macros_plugin/releases)
- [Changelog](https://github.com/fralau/mkdocs-macros-plugin/blob/master/CHANGELOG.md)
- [Commits](fralau/mkdocs-macros-plugin@v1.3.7...v1.3.9)

Updates `ruff` from 0.12.8 to 0.12.9
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.12.8...0.12.9)

Updates `zizmor` from 1.11.0 to 1.12.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.11.0...v1.12.0)

---
updated-dependencies:
- dependency-name: mkdocs-macros-plugin
  dependency-version: 1.3.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: ruff
  dependency-version: 0.12.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: zizmor
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 14, 2025
@dependabot
dependabot Bot requested a review from Lancetnik as a code owner August 14, 2025 17:46
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 14, 2025
@Lancetnik
Lancetnik enabled auto-merge August 14, 2025 18:00
@Lancetnik
Lancetnik added this pull request to the merge queue Aug 14, 2025
Merged via the queue into dev with commit 8e0338b Aug 14, 2025
28 checks passed
@Lancetnik
Lancetnik deleted the dependabot/pip/pip-f838443594 branch August 14, 2025 18:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Lancetnik Lancetnik Lancetnik approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Lancetnik