Skip to content

Bump the pip-dependencies group with 6 updates#17

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-dependencies-ab483b71fe
Open

Bump the pip-dependencies group with 6 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-dependencies-ab483b71fe

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pip-dependencies group with 6 updates:

Package From To
coverage 7.15.0 7.15.2
ruff 0.15.21 0.15.22
pymarkdownlnt 0.9.38 0.9.39
djlint 1.40.4 1.40.8
mkdocs-material 9.7.6 9.7.7
nautobot 3.1.7 3.1.8

Updates coverage from 7.15.0 to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.
  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️  PyPI page: coverage 7.15.1. :arrow_right:  To install: python3 -m pip install coverage==7.15.1

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Commits
  • 50d8659 docs: sample HTML for 7.15.2
  • b5eed20 docs: prep for 7.15.2
  • 78cab6e fix: reduce memory use during reporting. #2229 (#2231)
  • b4c1fda build: bump version to 7.15.2
  • da63bed docs: sample HTML for 7.15.1
  • bc35e64 docs: prep for 7.15.1
  • 182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
  • ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
  • 1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
  • dd80635 fix: escape context labels in html report inline script block (#2224)
  • Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Commits

Updates pymarkdownlnt from 0.9.38 to 0.9.39

Release notes

Sourced from pymarkdownlnt's releases.

Version 0.9.39 - 2026-07-11

This release focused on some internal cleanup work and a major change! Please check out our improved API documentation along with a new support document giving what we believe is a solid walk-through of the existing Python PyMarkdownApi.

Added

  • Issue 1553
    • Added new documentation around how APIs are listed in the documentation.
    • Added a completely redone document showing how to the PyMarkdownApi.

Changed

  • Issue 1625
    • Changed how HTML tokens are generated for testing, to make more streamlined
Commits

Updates djlint from 1.40.4 to 1.40.8

Release notes

Sourced from djlint's releases.

v1.40.8

Fix

  • Preserve conditional attribute names and significant whitespace in template-generated attributes.
  • Keep parent closing tags aligned after multiline inline content.
  • Avoid false H026 reports when id or class is followed by a spaced equals sign.
  • Keep short tag contents inline when attributes contain template expressions.
  • Avoid false D018/J018 reports for links using valid URI schemes.
  • Indent content inside Twig embed blocks.
  • Avoid false H037 reports for attributes in mutually exclusive template branches.
  • Respect exclude and extend_exclude for explicitly provided files.
  • Preserve attributes containing nested template blocks when wrapping long tags.
  • Preserve template expressions used in dynamic HTML tag names.
  • Preserve asterisks in HTML attribute names such as htmx response targets.
  • Avoid adding trailing whitespace after function calls in multiline template expressions.
  • Avoid false T002 reports for template tags inside HTML attributes.

v1.40.7

Fix

  • Preserve URLs enclosed in angle brackets inside template comments.

v1.40.6

Performance and refactoring

  • Replace repeated HTML regex scans with tokenization.
Changelog

Sourced from djlint's changelog.

[1.40.8] - 2026-07-17

Fix

  • Preserve conditional attribute names and significant whitespace in template-generated attributes.
  • Keep parent closing tags aligned after multiline inline content.
  • Avoid false H026 reports when id or class is followed by a spaced equals sign.
  • Keep short tag contents inline when attributes contain template expressions.
  • Avoid false D018/J018 reports for links using valid URI schemes.
  • Indent content inside Twig embed blocks.
  • Avoid false H037 reports for attributes in mutually exclusive template branches.
  • Respect exclude and extend_exclude for explicitly provided files.
  • Preserve attributes containing nested template blocks when wrapping long tags.
  • Preserve template expressions used in dynamic HTML tag names.
  • Preserve asterisks in HTML attribute names such as htmx response targets.
  • Avoid adding trailing whitespace after function calls in multiline template expressions.
  • Avoid false T002 reports for template tags inside HTML attributes.

[1.40.7] - 2026-07-15

Fix

  • Preserve URLs enclosed in angle brackets inside template comments.

[1.40.6] - 2026-07-13

Performance and refactoring

  • Replace repeated HTML regex scans with tokenization.

[1.40.5] - 2026-07-12

Fix

  • Avoid false H037 reports when attribute names appear inside quoted values or other attribute names.
  • Preserve template expressions in HTML attribute names when wrapping attributes.
  • Preserve indentation after void tags containing markup in quoted attributes.
Commits
  • 625b2ce v1.40.8
  • 50bdc72 fix(formatter): preserve template-generated attributes
  • 215ef42 fix(formatter): dedent after trailing inline closing tags
  • a476e74 fix(linter): avoid false H026 for spaced attribute equals
  • d0c133b fix(formatter): condense tags with template expression attributes
  • f0a2a08 fix(linter): allow valid URI schemes in D018 and J018
  • 1d2e941 fix(formatter): indent Twig embed blocks
  • 53dd4a1 fix(linter): avoid H037 across mutually exclusive branches
  • bb1761d fix: respect excludes for explicitly passed files
  • b719596 fix(formatter): preserve attributes with nested template blocks
  • Additional commits viewable in compare view

Updates mkdocs-material from 9.7.6 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates.

The path forward is Zensical, our next-generation static site generator built from first principles. If you’re planning a new documentation project or thinking about your long-term setup, we encourage you to start exploring Zensical.

Organizations requiring support beyond this date can get in touch to discuss options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

  • Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

  • Limited version range of mkdocs to <2
  • Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

  • Hardened social cards plugin by switching to sandboxed environment
  • Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

  • Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

  • Opened up version ranges of optional dependencies for forward-compatibility
  • Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

  • Updated requests to 2.30+ to mitigate CVE in urllib
  • Fixed privacy plugin not picking up protocol-relative URLs
  • Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

Updates nautobot from 3.1.7 to 3.1.8

Release notes

Sourced from nautobot's releases.

v3.1.8 - 2026-07-17

v3.1.8 (2026-07-17)

Security in v3.1.8

  • GHSA-56v6-2fhr-wxgq - Fixed stored XSS vulnerabilities when rendering Relationship description and Module Family name fields.
  • GHSA-q4c5-2j6f-r476 - Fixed an authorization bypass in the REST API where a user with only add_approvalworkflowstageresponse permission could POST to create "approved" responses, bypassing the intended approver checks and self-approving a workflow. The standalone ApprovalWorkflowStageResponse endpoint has been removed; responses are now exposed as read-only nested data on the approval workflow stage, filtered by view permission.
  • #9218 - Updated dependency django to >=5.2.16,<5.3 to mitigate CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878.
  • #9219 - Updated dependency Pillow to >=12.3.0,<13 to mitigate multiple CVEs.

Added in v3.1.8

  • #9037 - Added a "Go to page" input field to the paginator for quickly jumping to a specific page in multi-page tables.

Changed in v3.1.8

  • #9149 - Changed removing a VRF from a Device or VirtualMachine to raise an error if that VRF is still attached to one of the interfaces.
  • #9149 - Changed attaching a VRF to a VM interface via API/ORM to raise an error if the parent Virtual Machine does not have that VRF assigned.
  • #9210 - Object counts on the home page are now displayed with thousands separators (e.g., 1,009,518).
  • #9250 - Enhanced the REST API queryset optimizer to automatically pre-fetch the related objects traversed by a model's natural key to avoid N+1 queries.

Removed in v3.1.8

  • GHSA-q4c5-2j6f-r476 - Removed the unused ApprovalWorkflowStageResponse UI view registration, which was never linked.

Fixed in v3.1.8

  • #9144 - Fixed the CustomField description field no longer being rendered as Markdown on the Custom Field detail view.
  • #9161 - Fixed the broken Operational Compliance documentation link in the Application Marketplace, which returned a 404 due to a trailing quotation mark in the URL.
  • #9179 - Fixed dynamic group membership incorrectly returning no members when a filter specified multiple conjoined values (such as multiple tags), which should match objects having all of the given values.
  • #9250 - Fixed an N+1 query when listing Interfaces via the REST API.

Dependencies in v3.1.8

  • #9219 - Updated dependency regex to >=2026.6.28.

Documentation in v3.1.8

  • #9100 - Documented that VRF and Location associations cannot be set via Prefix CSV/bulk import and must be assigned via the UI or the REST API assignment endpoints.
  • #9201 - Added documentation clarifying that __init__.py files are required in both the Git repository root and the custom_validators/ folder for Data Compliance Rules to be discovered from a remote Git repository.
  • #9215 - Fixed docs bug in the EVENT_BROKERS setting documentation.

Housekeeping in v3.1.8

  • #9165 - Fixed invoke lint --fix to continue running in the event of a linting failure.
  • #9165 - Removed proper name fix from the markdownlint fix command.
  • #9216 - Changed the default max_locks_per_transaction for Postgres to 512 for test runs with many parallel workers.
  • #9216 - Backported Django 6.0 fix for parallel test runs with --buffer.
  • #9216 - Changed a virtualization test to create its VLANGroup directly instead of via a factory.
  • #9219 - Updated development dependency faker to ^40.28.1.

... (truncated)

Commits
  • 106c8aa Release v3.1.8 (#9267)
  • 5ec1ba7 REST schema fix
  • a8692e4 Docs updates
  • 0fe4d29 prepare release v3.1.8
  • 8682707 Merge commit from fork
  • e6ff20d Merge commit from fork
  • e048436 Changed the REST API to automatically pre-fetch related items used in the nat...
  • 0ff8004 Merge pull request #9165 from loganknecht/bugfix/correct_lint_command_to_run_...
  • ee603d9 Document that Prefix CSV/bulk import doesn't set VRF/Location associations (#...
  • 41080a1 Fix Operational Compliance link in marketplace_manifest (#9161) (#9238)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the pip-dependencies group with 6 updates
cf82136 
Bumps the pip-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.0` | `7.15.2` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.15.22` |
| [pymarkdownlnt](https://github.com/jackdewinter/pymarkdown) | `0.9.38` | `0.9.39` |
| [djlint](https://github.com/djlint/djLint) | `1.40.4` | `1.40.8` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.6` | `9.7.7` |
| [nautobot](https://github.com/nautobot/nautobot) | `3.1.7` | `3.1.8` |


Updates `coverage` from 7.15.0 to 7.15.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.0...7.15.2)

Updates `ruff` from 0.15.21 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.15.22)

Updates `pymarkdownlnt` from 0.9.38 to 0.9.39
- [Release notes](https://github.com/jackdewinter/pymarkdown/releases)
- [Changelog](https://github.com/jackdewinter/pymarkdown/blob/main/changelog.md)
- [Commits](jackdewinter/pymarkdown@v0.9.38...v0.9.39)

Updates `djlint` from 1.40.4 to 1.40.8
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.40.4...v1.40.8)

Updates `mkdocs-material` from 9.7.6 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.6...9.7.7)

Updates `nautobot` from 3.1.7 to 3.1.8
- [Release notes](https://github.com/nautobot/nautobot/releases)
- [Changelog](https://github.com/nautobot/nautobot/blob/develop/CHANGELOG.md)
- [Commits](nautobot/nautobot@v3.1.7...v3.1.8)

---
updated-dependencies:
- dependency-name: coverage
  dependency-version: 7.15.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-dependencies
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-dependencies
- dependency-name: pymarkdownlnt
  dependency-version: 0.9.39
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-dependencies
- dependency-name: djlint
  dependency-version: 1.40.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-dependencies
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-dependencies
- dependency-name: nautobot
  dependency-version: 3.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants