Deps: Bump the python-packages group with 4 updates

[dependabot]

Bumps the python-packages group with 4 updates: pontos, lxml, ruff and uvicorn.

Updates pontos from 25.4.0 to 25.6.0

Release notes

Sourced from pontos's releases.

pontos 25.6.0

25.6.0 - 2025-06-24

Added

• New unit tests 94290043

Changed

• Silence mypy with type ignore instead of unreacable assert b75bb971
• Adjust unit tests 5d35d92e
• Improve error handling of all exists() API methods d9b27e4a

Dependencies

• Bump urllib3 from 2.4.0 to 2.5.0 1dec6149
• Bump the python-packages group across 1 directory with 8 updates c1f7066d
• Bump ossf/scorecard-action in the actions group 0e460ed7
• Bump the python-packages group with 5 updates 74d36fee
• Bump the python-packages group with 2 updates f4b94d6a
• Bump the python-packages group with 4 updates 9b569b68
• Bump the python-packages group with 2 updates c0bc9b1d

Commits

• d0f886a Automatic release to 25.6.0
• b75bb97 Change: Silence mypy with type ignore instead of unreacable assert
• 9429004 Add: New unit tests
• 5d35d92 Change: Adjust unit tests
• d9b27e4 Change: Improve error handling of all exists() API methods
• 1dec614 Deps: Bump urllib3 from 2.4.0 to 2.5.0
• c1f7066 Deps: Bump the python-packages group across 1 directory with 8 updates
• 0e460ed Deps: Bump ossf/scorecard-action in the actions group
• 74d36fe Deps: Bump the python-packages group with 5 updates
• f4b94d6 Deps: Bump the python-packages group with 2 updates
• Additional commits viewable in compare view

Updates lxml from 5.4.0 to 6.0.0

Changelog

Sourced from lxml's changelog.

6.0.0 (2025-06-26)

Features added

• GH#463: lxml.html.diff is faster and provides structurally better diffs. Original patch by Steven Fernandez.

• GH#405: The factories Element and ElementTree can now be used in type hints.

• GH#448: Parsing from memoryview and other buffers is supported to allow zero-copy parsing.

• GH#437: lxml.html.builder was missing several HTML5 tag names. Patch by Nick Tarleton.

• GH#458: CDATA can now be written into the incremental xmlfile() writer. Original patch by Lane Shaw.

• A new parser option decompress=False was added that controls the automatic input decompression when using libxml2 2.15.0 or later. Disabling this option by default will effectively prevent decompression bombs when handling untrusted input. Code that depends on automatic decompression must enable this option. Note that libxml2 2.15.0 was not released yet, so this option currently has no effect but can already be used.

• The set of compile time / runtime supported libxml2 feature names is available as etree.LIBXML_COMPILED_FEATURES and etree.LIBXML_FEATURES. This currently includes catalog, ftp, html, http, iconv, icu, lzma, regexp, schematron, xmlschema, xpath, zlib.

Bugs fixed

• GH#353: Predicates in .find*() could mishandle tag indices if a default namespace is provided. Original patch by Luise K.

• GH#272: The head and body properties of lxml.html elements failed if no such element was found. They now return None instead. Original patch by FVolral.

• Tag names provided by code (API, not data) that are longer than INT_MAX could be truncated or mishandled in other ways.

• .text_content() on lxml.html elements accidentally returned a "smart string" without additional information. It now returns a plain string.

• LP#2109931: When building lxml with coverage reporting, it now disables the sys.monitoring support due to the lack of support in nedbat/coveragepy#1790

... (truncated)

Commits

• 2a67034 Prepare release of 6.0.0.
• e0b4e02 Update changelog.
• d3f4dcf Build: Upgrade libxml2 to latest 2.14.4.
• 014e51c Build: Add Windows arm64 wheel builds (GH-465)
• d3914dc Only use "xmlCtxtIsStopped()" from libxml2 2.15.0 on since it fails to cover ...
• 6e41390 Avoid reading the deprecated "disableSAX" attribute of "xmlParserCtxt".
• f85da81 Use newer "language_level=3" in ElementPath module.
• 787315e Build: bump pypa/cibuildwheel in the github-actions group (#464)
• fb3adb1 Readme: Add project income report for 2024.
• 8e61a75 Fit cached tuple more nicely into cachelines.
• Additional commits viewable in compare view

Updates ruff from 0.12.0 to 0.12.1

Release notes

Sourced from ruff's releases.

0.12.1

Release Notes

Preview features

• [flake8-errmsg] Extend EM101 to support byte strings (#18867)
• [flake8-use-pathlib] Add autofix for PTH202 (#18763)
• [pygrep-hooks] Add AsyncMock methods to invalid-mock-access (PGH005) (#18547)
• [pylint] Ignore __init__.py files in (PLC0414) (#18400)
• [ruff] Trigger RUF037 for empty string and byte strings (#18862)
• [formatter] Fix missing blank lines before decorated classes in .pyi files (#18888)

Bug fixes

• Avoid generating diagnostics with per-file ignores (#18801)
• Handle parenthesized arguments in remove_argument (#18805)
• [flake8-logging] Avoid false positive for exc_info=True outside logger.exception (LOG014) (#18737)
• [flake8-pytest-style] Enforce pytest import for decorators (#18779)
• [flake8-pytest-style] Mark autofix for PT001 and PT023 as unsafe if there's comments in the decorator (#18792)
• [flake8-pytest-style] PT001/PT023 fix makes syntax error on parenthesized decorator (#18782)
• [flake8-raise] Make fix unsafe if it deletes comments (RSE102) (#18788)
• [flake8-simplify] Fix SIM911 autofix creating a syntax error (#18793)
• [flake8-simplify] Fix false negatives for shadowed bindings (SIM910, SIM911) (#18794)
• [flake8-simplify] Preserve original behavior for except () and bare except (SIM105) (#18213)
• [flake8-pyi] Fix PYI041's fix causing TypeError with None | None | ... (#18637)
• [perflint] Fix PERF101 autofix creating a syntax error and mark autofix as unsafe if there are comments in the list call expr (#18803)
• [perflint] Fix false negative in PERF401 (#18866)
• [pylint] Avoid flattening nested min/max when outer call has single argument (PLW3301) (#16885)
• [pylint] Fix PLC2801 autofix creating a syntax error (#18857)
• [pylint] Mark PLE0241 autofix as unsafe if there's comments in the base classes (#18832)
• [pylint] Suppress PLE2510/PLE2512/PLE2513/PLE2514/PLE2515 autofix if the text contains an odd number of backslashes (#18856)
• [refurb] Detect more exotic float literals in FURB164 (#18925)
• [refurb] Fix FURB163 autofix creating a syntax error for yield expressions (#18756)
• [refurb] Mark FURB129 autofix as unsafe if there's comments in the readlines call (#18858)
• [ruff] Fix false positives and negatives in RUF010 (#18690)
• Fix casing of analyze.direction variant names (#18892)

Rule changes

• Fix f-string interpolation escaping in generated fixes (#18882)
• [flake8-return] Mark RET501 fix unsafe if comments are inside (#18780)
• [flake8-async] Fix detection for large integer sleep durations in ASYNC116 rule (#18767)
• [flake8-async] Mark autofix for ASYNC115 as unsafe if the call expression contains comments (#18753)
• [flake8-bugbear] Mark autofix for B004 as unsafe if the hasattr call expr contains comments (#18755)
• [flake8-comprehension] Mark autofix for C420 as unsafe if there's comments inside the dict comprehension (#18768)
• [flake8-comprehensions] Handle template strings for comprehension fixes (#18710)
• [flake8-future-annotations] Add autofix (FA100) (#18903)
• [pyflakes] Mark F504/F522/F523 autofix as unsafe if there's a call with side effect (#18839)
• [pylint] Allow fix with comments and document performance implications (PLW3301) (#18936)
• [pylint] Detect more exotic NaN literals in PLW0177 (#18630)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.12.1

Preview features

• [flake8-errmsg] Extend EM101 to support byte strings (#18867)
• [flake8-use-pathlib] Add autofix for PTH202 (#18763)
• [pygrep-hooks] Add AsyncMock methods to invalid-mock-access (PGH005) (#18547)
• [pylint] Ignore __init__.py files in (PLC0414) (#18400)
• [ruff] Trigger RUF037 for empty string and byte strings (#18862)
• [formatter] Fix missing blank lines before decorated classes in .pyi files (#18888)

Bug fixes

• Avoid generating diagnostics with per-file ignores (#18801)
• Handle parenthesized arguments in remove_argument (#18805)
• [flake8-logging] Avoid false positive for exc_info=True outside logger.exception (LOG014) (#18737)
• [flake8-pytest-style] Enforce pytest import for decorators (#18779)
• [flake8-pytest-style] Mark autofix for PT001 and PT023 as unsafe if there's comments in the decorator (#18792)
• [flake8-pytest-style] PT001/PT023 fix makes syntax error on parenthesized decorator (#18782)
• [flake8-raise] Make fix unsafe if it deletes comments (RSE102) (#18788)
• [flake8-simplify] Fix SIM911 autofix creating a syntax error (#18793)
• [flake8-simplify] Fix false negatives for shadowed bindings (SIM910, SIM911) (#18794)
• [flake8-simplify] Preserve original behavior for except () and bare except (SIM105) (#18213)
• [flake8-pyi] Fix PYI041's fix causing TypeError with None | None | ... (#18637)
• [perflint] Fix PERF101 autofix creating a syntax error and mark autofix as unsafe if there are comments in the list call expr (#18803)
• [perflint] Fix false negative in PERF401 (#18866)
• [pylint] Avoid flattening nested min/max when outer call has single argument (PLW3301) (#16885)
• [pylint] Fix PLC2801 autofix creating a syntax error (#18857)
• [pylint] Mark PLE0241 autofix as unsafe if there's comments in the base classes (#18832)
• [pylint] Suppress PLE2510/PLE2512/PLE2513/PLE2514/PLE2515 autofix if the text contains an odd number of backslashes (#18856)
• [refurb] Detect more exotic float literals in FURB164 (#18925)
• [refurb] Fix FURB163 autofix creating a syntax error for yield expressions (#18756)
• [refurb] Mark FURB129 autofix as unsafe if there's comments in the readlines call (#18858)
• [ruff] Fix false positives and negatives in RUF010 (#18690)
• Fix casing of analyze.direction variant names (#18892)

Rule changes

• Fix f-string interpolation escaping in generated fixes (#18882)
• [flake8-return] Mark RET501 fix unsafe if comments are inside (#18780)
• [flake8-async] Fix detection for large integer sleep durations in ASYNC116 rule (#18767)
• [flake8-async] Mark autofix for ASYNC115 as unsafe if the call expression contains comments (#18753)
• [flake8-bugbear] Mark autofix for B004 as unsafe if the hasattr call expr contains comments (#18755)
• [flake8-comprehension] Mark autofix for C420 as unsafe if there's comments inside the dict comprehension (#18768)
• [flake8-comprehensions] Handle template strings for comprehension fixes (#18710)
• [flake8-future-annotations] Add autofix (FA100) (#18903)
• [pyflakes] Mark F504/F522/F523 autofix as unsafe if there's a call with side effect (#18839)
• [pylint] Allow fix with comments and document performance implications (PLW3301) (#18936)
• [pylint] Detect more exotic NaN literals in PLW0177 (#18630)
• [pylint] Fix PLC1802 autofix creating a syntax error and mark autofix as unsafe if there's comments in the len call (#18836)

... (truncated)

Commits

• 32c5418 Bump 0.12.1 (#18969)
• b85c219 [FastAPI] Add fix safety section to FAST002 (#18940)
• b1d1cf1 [ty] Add regression test for leading tab mis-alignment in diagnostic renderin...
• 1dcdf7f [ty] Resolve python environment in Options::to_program_settings (#18960)
• d006976 [ruff] Fix false positives and negatives in RUF010 (#18690)
• 76619b9 [ty] Fix rendering of long lines that are indented with tabs
• 6e25cfb [ty] Add regression test for diagnostic rendering panic
• 7638729 [ty] Move venv and conda env discovery to SearchPath::from_settings (#18938)
• d04e63a [ty] Add regression-benchmark for attribute-assignment hang (#18957)
• 86fd9b6 [ty] Format conflicting types as an enumeration (#18956)
• Additional commits viewable in compare view

Updates uvicorn from 0.34.3 to 0.35.0

Release notes

Sourced from uvicorn's releases.

Version 0.35.0

Added

• Add WebSocketsSansIOProtocol by @​Kludex in encode/uvicorn#2540

Changed

• Refine help message for option --proxy-headers by @​zhangyoufu in encode/uvicorn#2653

New Contributors

• @​zhangyoufu made their first contribution in encode/uvicorn#2653

Full Changelog: Kludex/uvicorn@0.34.3...0.35.0

Changelog

Sourced from uvicorn's changelog.

0.35.0 (June 28, 2025)

Added

• Add WebSocketsSansIOProtocol (#2540)

Changed

• Refine help message for option --proxy-headers (#2653)

Commits

• daecb45 Version 0.35.0 (#2654)
• 22dfd3f refine help message for option --proxy-headers (#2653)
• b960626 Add WebSocketsSansIOProtocol (#2540)
• 5432729 Add CITATION.cff (#2649)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 70a9253.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
pip/lxml	6.0.0	🟢 6.6	Details Check Score Reason Code-Review ⚠️ 0 Found 1/29 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases.
pip/pontos	25.6.0	🟢 7.3	Details Check Score Reason Dependency-Update-Tool 🟢 10 update tool detected Code-Review ⚠️ 2 Found 3/12 approved changesets -- score normalized to 2 Maintained 🟢 10 20 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Packaging 🟢 10 packaging workflow detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. Security-Policy 🟢 10 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 18 out of 18 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6
pip/ruff	0.12.1	Unknown	Unknown
pip/uvicorn	0.35.0	🟢 6.1	Details Check Score Reason Code-Review 🟢 3 Found 9/24 approved changesets -- score normalized to 3 Maintained 🟢 10 16 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• poetry.lock

[github-actions]

Conventional Commits Report

Type	Number
Dependencies	1

🚀 Conventional commits found.