Bump the prod-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the prod-dependencies group with 3 updates in the / directory: faker, pyrefly and copier.

Updates faker from 40.36.0 to 40.39.0

Release notes

Sourced from faker's releases.

Release v40.39.0

See CHANGELOG.md.

Release v40.38.0

See CHANGELOG.md.

Release v40.37.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.39.0 - 2026-09-14

• Fix: compute Norwegian MOD11 check digit so no_NO iban() passes stdnum validation (#2415). Thanks @​CedricConday.

v40.38.0 - 2026-09-01

• Add si_LK (Sinhala, Sri Lanka) person provider (#2430). Thanks @​RavinduPabasara.

v40.37.0 - 2026-08-20

• Fix: generate structurally valid Irish IBANs for en_IE (#2411). Thanks @​CedricConday.
• Add Pillow as an optional dependency (#2442). Thanks @​suliuzh.

Commits

• 328b648 Bump version: 40.38.0 → 40.39.0
• eb2db2d 📝 Update CHANGELOG.md
• 3648583 fix(no_NO): compute Norwegian MOD11 check digit so iban() passes stdnum valid...
• 59a6872 Bump version: 40.37.0 → 40.38.0
• 2407c71 📝 Update CHANGELOG.md
• f6a8427 💄 Format code
• ce50bde Add step to check for existing issues or PRs
• 4ca9116 Add si_LK (Sinhala, Sri Lanka) person provider (#2430)
• c5a0093 mention pull request template in contributing doc
• 4a464c8 Bump version: 40.36.0 → 40.37.0
• Additional commits viewable in compare view

Updates pyrefly from 1.2.0 to 1.3.1

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.3.1

Release date: September 14, 2026

Pyrefly v1.3.1 is a patch release with a single bug fix.

---

🐛 Bug fixes

• #4909: Fixed a critical issue where Pyrefly would immediately crash on startup with a thread panic when empty or relative base paths were encountered during configuration. The server now safely resolves these paths against the working directory, preventing the crash and allowing normal operation.

Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue here.

---

📦 Upgrade

pip install --upgrade pyrefly==1.3.1

How to safely upgrade your codebase

Upgrading the version of Pyrefly you're using or a third-party library you depend on can reveal new type errors in your code. Fixing them all at once is often unrealistic. We've written scripts to help you temporarily silence them. After upgrading, follow these steps:

1. pyrefly check --suppress-errors
2. Run your code formatter of choice
3. pyrefly check --remove-unused-ignores
4. Repeat until you achieve a clean formatting run and a clean type check.

This will add # pyrefly: ignore comments to your code, enabling you to silence errors and return to fix them later. This can make the process of upgrading a large codebase much more manageable.

Read more about error suppressions in the Pyrefly documentation.

Pyrefly v1.3.0

Release date: September 10, 2026

Pyrefly v1.3.0 bundles 934 commits from 71 contributors.

---

🔍Release Highlights

Type Checking

• New diagnostics and more accurate type inference. Pyrefly now catches invalid literal regular expressions, invalid mock.patch targets, unsupported dataclass_transform arguments, incompatible Protocol.__call__ overrides, and unimplemented abstract methods. Pattern-match exhaustiveness, overload resolution, narrowing, and generic inference are also more accurate.
• Better support for major Python frameworks. Pyrefly understands same-file Django reverse relationships, checks SQLAlchemy updates against model fields, and recognizes attributes registered on PyTorch modules.

Language Server

... (truncated)

Commits

• 3e3177d cut 1.3.1
• 3445714 release notes for v1.3.1
• c1be891 fix pyrefly instantly dies with with thread panic #4909 (#4925)
• 624bdc4 cut 1.3.0
• ad6958c feat: support Pyrefly-specific type ignore codes
• f1d8f62 Bump fast-uri from 3.1.5 to 3.1.7 in /website (#4789)
• cb178b9 add type stubs for remaining jax.lax APIs (#4875)
• 8ee41ca Model polars join(..., coalesce=...) (#4833) (#4859)
• 5d00010 Find methods and other nested definitions in workspace symbols
• 5b392ca Cache flat symbols for first-party modules
• Additional commits viewable in compare view

Updates copier from 9.17.1 to 9.18.2

Release notes

Sourced from copier's releases.

v9.18.2 (2026-09-07)

Fix

• allow overwriting destination symlinks when preserve_symlinks: false
• cache: resolve submodules from the current checkout's .gitmodules (#2767)

Security

• prevent trust bypass via ambiguous URL characters

  To prevent URL confusion attacks, trusted prefix matching is now restricted to repository URL paths containing only RFC 3986 §2.3 "unreserved" characters (letters, digits, -, ., _, ~) and /. URL paths containing other characters now require an exact, verbatim match.

v9.18.1 (2026-09-01)

Fix

• disambiguate Windows paths from SCP URLs in trust check

v9.18.0 (2026-09-01)

Feat

• exclude: add support for multiple exclude patterns in a single entry (#2804)

Fix

• preserve the original error when cleanup fails (#2824)

Security

• prevent trust bypass via encoded URL traversal for alias and SCP-style URLs

v9.17.2 (2026-08-19)

Security

• disallow Jinja {% include %} of symlinks resolving outside template root
• disallow config !include paths outside the template root

Refactor

• updating: delete user-removed files after rendering instead of excluding them

Changelog

Sourced from copier's changelog.

v9.18.2 (2026-09-07)

Fix

• allow overwriting destination symlinks when preserve_symlinks: false
• cache: resolve submodules from the current checkout's .gitmodules (#2767)

Security

• prevent trust bypass via ambiguous URL characters

  To prevent URL confusion attacks, trusted prefix matching is now restricted to repository URL paths containing only RFC 3986 §2.3 "unreserved" characters (letters, digits, -, ., _, ~) and /. URL paths containing other characters now require an exact, verbatim match.

v9.18.1 (2026-09-01)

Fix

• disambiguate Windows paths from SCP URLs in trust check

v9.18.0 (2026-09-01)

Feat

• exclude: add support for multiple exclude patterns in a single entry (#2804)

Fix

• preserve the original error when cleanup fails (#2824)

Security

• prevent trust bypass via encoded URL traversal for alias and SCP-style URLs

v9.17.2 (2026-08-19)

Security

• disallow Jinja {% include %} of symlinks resolving outside template root
• disallow config !include paths outside the template root

Refactor

• updating: delete user-removed files after rendering instead of excluding them

Commits

• 217e4f8 bump: version 9.18.1 → 9.18.2
• 50b1927 fix: prevent trust bypass via ambiguous URL characters
• bfa05c1 fix: allow overwriting destination symlinks when preserve_symlinks: false
• 68c8aa2 fix(cache): resolve submodules from the current checkout's .gitmodules (#2767)
• 03c95e2 bump: version 9.18.0 → 9.18.1
• 2a3e140 fix: disambiguate Windows paths from SCP URLs in trust check
• b65cd70 bump: version 9.17.2 → 9.18.0
• dcae663 fix: prevent trust bypass via encoded URL traversal for alias and SCP-style URLs
• bb956bb build(deps): update dependency ruff to v0.16.5
• 27d3629 build(deps): lock file maintenance
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: LabAutomationAndScreening/copier-python-package-template/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 78ad4de0-f391-4f59-84c8-896721ea6b19

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.