build(deps): bump the minor-and-patch group across 1 directory with 6 updates

[dependabot]

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
boto3	1.43.49	1.43.58
django-oauth-toolkit	3.3.0	3.4.0
faker	40.31.0	40.36.0
djlint	1.40.7	1.43.1
mkdocs-material	9.7.6	9.7.7
ruff	0.15.21	0.16.0

Updates boto3 from 1.43.49 to 1.43.58

Commits

• acd59af Merge branch 'release-1.43.58'
• 73cef5c Bumping version to 1.43.58
• 256b73c Add changelog entries from botocore
• 7b06b40 Merge branch 'release-1.43.57'
• 20040fc Merge branch 'release-1.43.57' into develop
• f5fdd1c Bumping version to 1.43.57
• 6af728c Add changelog entries from botocore
• 72a153d Merge branch 'release-1.43.56'
• 5092de5 Merge branch 'release-1.43.56' into develop
• b1b9ff3 Bumping version to 1.43.56
• Additional commits viewable in compare view

Updates django-oauth-toolkit from 3.3.0 to 3.4.0

Release notes

Sourced from django-oauth-toolkit's releases.

3.4.0

The headline of this release is first-class support for the Model Context Protocol (MCP) authorization server role. MCP's authorization spec is built on a stack of modern OAuth RFCs, and this cycle landed the whole stack: Authorization Server Metadata (RFC 8414) and Protected Resource Metadata (RFC 9728) for discovery, Dynamic Client Registration (RFC 7591 / RFC 7592) and OAuth Client ID Metadata Documents (CIMD) so clients can register themselves, Resource Indicators (RFC 8707) for audience-bound access tokens, and the OAuth 2.0 Security Best Current Practice (RFC 9700) together with the RFC 9207 iss parameter. The RFC 9700 compliance gates double as a configurable OAuth 2.1 security posture — they can reject the implicit and password grants and enforce S256-only PKCE (legacy behavior by default in 3.4, scheduled to flip to compliant in 4.0). The new ALLOW_LOCALHOST_LOOPBACK setting smooths the ephemeral-port loopback callback used by native clients such as Claude Code, MCP Inspector, and mcp-remote.

Beyond MCP, the release adds a Django Ninja integration alongside the existing DRF support and support for RP-Initiated Registration, lifts the 255-character cap on refresh tokens (mirroring the access-token checksum scheme), makes cleartokens reclaim revoked refresh tokens sooner, and harmonizes Bearer Authorization header parsing across the middleware.

It also carries a batch of security fixes: an unauthenticated open redirect from the authorization endpoint (prompt=none), HS256 ID tokens being signed with the hashed client secret, cleartext tokens and codes exposed in the Django admin, client secrets written to debug logs, and predictable device-flow user_code generation. Longstanding operational bugs are fixed too, including a multi-database migrate deadlock (#1591) and duplicate unique indexes that broke fresh installs on Oracle and strict MySQL (#1656).

Before upgrading, read the breaking-changes section below: most items are makemigrations steps for swapped models, but applications using the HS256 signing algorithm now require hash_client_secret=False.

WARNING - POTENTIAL BREAKING CHANGES

• Applications using the HS256 signing algorithm must now be configured with hash_client_secret=False. Previously such applications signed ID tokens with the hashed client secret, producing tokens that relying parties could not verify. Application.clean() now raises a ValidationError for HS256 + hash_client_secret=True, and Application.jwk_key raises ImproperlyConfigured at signing time if the secret is hashed. To migrate an affected application, recreate it (or reset its secret) with hash_client_secret=False so the plaintext secret is stored and can be used as the shared HMAC key.
• Changes to the AbstractRefreshToken model require doing a manage.py migrate after upgrading.
• If you use a swapped refresh token model (OAUTH2_PROVIDER_REFRESH_TOKEN_MODEL) you will need to update your custom model with manage.py makemigrations. If your table already contains refresh tokens you must also backfill token_checksum with a data migration — adapt the batched backfill loop from forwards_func in oauth2_provider/migrations/0015_refreshtoken_token_checksum.py (dropping its swapped-model guard, the early return, and resolving your own model instead) and keep the same operation order: add nullable checksum → drop the old ("token", "revoked") unique constraint → widen token to TextField → backfill → make checksum non-nullable → add the ("token_checksum", "revoked") unique constraint.
• If you use a swapped application model (OAUTH2_PROVIDER_APPLICATION_MODEL), run

... (truncated)

Changelog

Sourced from django-oauth-toolkit's changelog.

[3.4.0] - 2026-07-23

The headline of this release is first-class support for the Model Context Protocol (MCP) authorization server role. MCP's authorization spec is built on a stack of modern OAuth RFCs, and this cycle landed the whole stack: Authorization Server Metadata (RFC 8414) and Protected Resource Metadata (RFC 9728) for discovery, Dynamic Client Registration (RFC 7591 / RFC 7592) and OAuth Client ID Metadata Documents (CIMD) so clients can register themselves, Resource Indicators (RFC 8707) for audience-bound access tokens, and the OAuth 2.0 Security Best Current Practice (RFC 9700) together with the RFC 9207 iss parameter. The RFC 9700 compliance gates double as a configurable OAuth 2.1 security posture — they can reject the implicit and password grants and enforce S256-only PKCE (legacy behavior by default in 3.4, scheduled to flip to compliant in 4.0). The new ALLOW_LOCALHOST_LOOPBACK setting smooths the ephemeral-port loopback callback used by native clients such as Claude Code, MCP Inspector, and mcp-remote.

Beyond MCP, the release adds a Django Ninja integration alongside the existing DRF support and support for RP-Initiated Registration, lifts the 255-character cap on refresh tokens (mirroring the access-token checksum scheme), makes cleartokens reclaim revoked refresh tokens sooner, and harmonizes Bearer Authorization header parsing across the middleware.

It also carries a batch of security fixes: an unauthenticated open redirect from the authorization endpoint (prompt=none), HS256 ID tokens being signed with the hashed client secret, cleartext tokens and codes exposed in the Django admin, client secrets written to debug logs, and predictable device-flow user_code generation. Longstanding operational bugs are fixed too, including a multi-database migrate deadlock (#1591) and duplicate unique indexes that broke fresh installs on Oracle and strict MySQL (#1656).

Before upgrading, read the breaking-changes section below: most items are makemigrations steps for swapped models, but applications using the HS256 signing algorithm now require hash_client_secret=False.

WARNING - POTENTIAL BREAKING CHANGES

• Applications using the HS256 signing algorithm must now be configured with hash_client_secret=False. Previously such applications signed ID tokens with the hashed client secret, producing tokens that relying parties could not verify. Application.clean() now raises a ValidationError for HS256 + hash_client_secret=True, and Application.jwk_key raises ImproperlyConfigured at signing time if the secret is hashed. To migrate an affected application, recreate it (or reset its secret) with hash_client_secret=False so the plaintext secret is stored and can be used as the shared HMAC key.
• Changes to the AbstractRefreshToken model require doing a manage.py migrate after upgrading.
• If you use a swapped refresh token model (OAUTH2_PROVIDER_REFRESH_TOKEN_MODEL) you will need to update your custom model with manage.py makemigrations. If your table already contains refresh tokens you must also backfill token_checksum with a data migration — adapt the batched backfill loop from forwards_func in oauth2_provider/migrations/0015_refreshtoken_token_checksum.py (dropping its swapped-model guard, the early return, and resolving your own model instead) and keep the same operation order: add nullable checksum → drop the old ("token", "revoked") unique constraint → widen token to TextField → backfill → make checksum non-nullable → add the ("token_checksum", "revoked") unique constraint.
• If you use a swapped application model (OAUTH2_PROVIDER_APPLICATION_MODEL), run

... (truncated)

Commits

• 48132d3 chore: 3.4.0 release (#1764)
• 2c34e2a docs: replace m2r2 with myst-parser to drop the mistune dependency (#1761)
• 76cc44b chore(deps): bump cryptography in the uv group across 1 directory (#1760)
• a5e5032 docs: migrate m2r to m2r2 and build docs in CI (#1758)
• ea8f2f0 chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates (#...
• de8e735 Fix 500 error when client_id or username contains a NUL byte (#1754)
• 0c9240b Fix ReadWriteScopedResourceMixin.new() rejecting any constructor argument...
• c5f2b9d Add section in docs about migrations testing (#1717)
• 11b36e4 Extract HttpRequest creation to own method (#1660)
• 82fc862 Fix wildcard redirect URI validation for Netlify double-dash deploy previews ...
• Additional commits viewable in compare view

Updates faker from 40.31.0 to 40.36.0

Release notes

Sourced from faker's releases.

Release v40.36.0

See CHANGELOG.md.

Release v40.35.0

See CHANGELOG.md.

Release v40.34.0

See CHANGELOG.md.

Release v40.33.2

See CHANGELOG.md.

Release v40.33.1

See CHANGELOG.md.

Release v40.33.0

See CHANGELOG.md.

Release v40.32.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.36.0 - 2026-07-24

• Fix: correct uk_UA bban_format to 6 digits + 19 letters so iban() generates valid Ukrainian IBANs (#2417). Thanks @​CedricConday.

v40.35.0 - 2026-07-22

• Fix: add correct bban_format so ru_RU iban() generates valid Russian IBANs (#2416). Thanks @​CedricConday.

v40.34.0 - 2026-07-22

• Fix: correct BBAN length so da_DK iban() generates valid Danish IBANs (#2409). Thanks @​CedricConday.

v40.33.2 - 2026-07-22

• Validate positive=True against a non-positive max_value in pydecimal (#2428). Thanks @​Sreekant13.

v40.33.1 - 2026-07-22

• Make uuid1() and uuid7() reproducible under a fixed seed (#2427). Thanks @​vidigoat.

v40.33.0 - 2026-07-22

• Add alphanumeric CNPJ support for pt_BR via flag (#2402). Thanks @​moohbr.

v40.32.0 - 2026-07-20

• Add allowed_path_traversal_elements option to file_path() (#2397). Thanks @​Ayushmann13479.
• Fix Windows file_path depth=3 test regex. Thanks @​fcurella.

Commits

• 62d5a6a Bump version: 40.35.0 → 40.36.0
• 09c254a 📝 Update CHANGELOG.md
• ce45ebd fix(uk_UA): correct bban_format to 6 digits + 19 letters so iban() is valid (...
• 8ad78a6 Merge pull request #2434 from joke2k/joke2k-security-md
• ce3d3b1 Add SECURITY.md to the manifest file
• ac535cf Revise security policy for clarity and updates
• 4b7d4d7 💄 Lint code
• 2e83f45 Bump version: 40.34.0 → 40.35.0
• b1caba1 📝 Update CHANGELOG.md
• 706aaca 💄 Lint code
• Additional commits viewable in compare view

Updates djlint from 1.40.7 to 1.43.1

Release notes

Sourced from djlint's releases.

v1.43.1

Fix

• H025 no longer reports the closing tag of a multi-line <script> or <style> as an orphan - a regression in 1.43.0. A genuinely unmatched </script> is still reported.

v1.43.0

Feature

• New --stdin-filename option gives content piped in on stdin (djlint -) its real path, so per-file-ignores matches against that name and linter messages report it. Per-file ignores were previously dead for piped input, since nothing matches the name -. Path separators are normalized as they are for files on disk.

Fix

• An apostrophe inside a template tag nested in an attribute value (title="{% translate "You don't have permission" %}") no longer swallows the rest of the document, which made H025 report every enclosing element as an orphan. A template tag in a value is now skipped whole unless it holds a >, so a quoted literal like a="{{" is still left alone.
• A line that starts with a closing tag and ends with a whole tag (</span>tail<textarea>y</textarea>) unindents again; everything after it stayed one level too deep.
• A template block tag followed by a whole html tag on the same line ({% endif %} <td class="x">y</td>) indents as a block tag again, so {% endif %} unindents and {% else %} aligns with its {% if %}. A line only takes that shape once the tag fits on one line, so reformatting an already formatted file moved it.
• A tag opened after the end of a verbatim block on the same line (</pre> <span>x) is tracked again; its closing tag took a level from a tag opened before the block, dedenting that tag's siblings.
• A template control block written across lines is kept that way when it opens against a tag (<div>{% if x %}), and the choice is no longer applied to the wrong block. Blocks were paired with the source by position, which does not line up with the expanded html; they are now matched by tag and contents.
• A tag whose style, srcset, data-srcset or sizes value was written over several lines is no longer spread over multiple lines and pulled back together on the next run. max_attribute_length is now measured against what is written out, not against padding that the rewrite drops.
• A <pre> or <textarea> opened on a line that also holds a self-contained comment (<pre>x<!--c-->) is recognized as opening a verbatim block again. Its contents were re-indented instead of left alone, and the closing </pre> gained an indent level on every run - unbounded whitespace growth inside preformatted text.
• A closing tag that starts its line no longer dedents when the tag it closes was opened after text on an earlier line (text <b>bold / </b> tail). The loss accumulated, so a document repeating that shape drifted further left with each occurrence. A closing tag with nothing to pair against still dedents as before.
• A < inside a one-line <script>, <style>, <textarea> or <title> no longer counts as a tag when indenting. <script>var a = '<span>'</script> left a phantom open <span> on the tag stack, leaving everything after it one level too deep.
• An inline element that opens after text on its line and closes on a later line no longer dedents everything that follows it by one level (text <b>bold / more</b> tail inside a <p>) - a regression in 1.40.8. The wrong output was idempotent, so it survived later runs.
• A Go template comment {{/* ... */}} is no longer read as a block close tag. It starts with {{/, the handlebars block-close prefix, so it popped a block off the stack: H037 reported Duplicate attribute found. for mutually exclusive attributes such as <a {{if .A}}href="a"{{else}}{{/* c */}}href="b"{{end}}>, and the formatter unindented the rest of the block. A comment renders as nothing, so H037 no longer treats one as a template-generated attribute name prefix either.
• A tag that merely touches an ignored block is no longer treated as being inside it. A tag ending exactly where an ignored block starts - such as {% if x %}{# comment #} - was skipped by the linter, most visibly making T038 report End tag has no matching block tag for a balanced {% if %}. Affects every rule that skips ignored blocks (H025, H037, H041, H042, T002, T003, T027, T038, T039) and every kind of ignored block.
• A bare djlint:off pragma no longer ignores the tag written immediately before it. <img>{# djlint:off #} silently dropped every error on that <img>, while <img>{# djlint:off H013 #} correctly reported it - a pragma covers what follows it, not what precedes it.

v1.42.3

Fix

• Attribute names containing punctuation beyond -, ., :, @ and * no longer stop a tag from being wrapped over multiple lines. The attribute parser now accepts any character HTML allows in an attribute name, so Alpine key modifiers (@keydown.prevent.?), Angular bindings ((click), [disabled]) and Vue shorthands (#slot) are formatted like every other attribute instead of leaving the whole tag on one long line. Angular bindings also reach --format-attribute-js-json for the first time, which already listed them.
• An unquoted attribute value with a template tag glued to the rest of the value (e.g. src={{ MEDIA_URL }}/logo.png, href={{ .Permalink }}#{{ .Anchor }}) is no longer split into a truncated value plus a bogus standalone attribute when attributes are wrapped; it stays one value, quoted when spread.

v1.42.2

Fix

• Attributes containing ${...} inside a quoted value (e.g. JS template literals like :name="`x[${i}]`") respect max_attribute_length again and are spread over multiple lines - a regression in 1.40.6. Unquoted Mako-style ${...} expressions in tags are still left unformatted.
• A stray <!-- that is not a real HTML comment (for example inside a {# ... #} template comment or inside a <textarea>/<pre>) no longer swallows the rest of the document. This fixes false H025 orphan-tag reports and over-indentation of the tags that follow - a regression in 1.40.6.
• Handlebars triple-stache {{{ ... }}} and raw-block {{{{ ... }}}} expressions used as tag attributes are tokenized correctly again, fixing false H025 orphan-tag reports - a regression in 1.40.6.
• A quoted literal brace in an attribute value (e.g. data-x="{{") no longer makes the tokenizer scan into later content looking for a matching }}, which could collapse <pre>/<textarea> whitespace - a regression in 1.40.6.
• Spacing the }} of a handlebars {{#if}}/{{#each}} block-open tag is now idempotent; it no longer leaks a trailing space into the following {{...}} tag on later formatting passes.
• T038 no longer reports block tags that appear only inside a handlebars comment ({{!-- ... --}}, {{! ... }}) or inside a handlebars raw block ({{{{raw}}}} ... {{{{/raw}}}}).
• T039 no longer reports handlebars raw-block delimiters ({{{{raw}}}} / {{{{/raw}}}}) as unclosed template tags.
• Malformed tag attributes that the attribute parser cannot fully parse (e.g. a stray < or dangling =) are now left untouched instead of having the unparsable characters silently dropped when attributes are wrapped.
• A < used as a less-than operator inside a template expression in text or <script> content (e.g. ${a<b}, {{a<b}}) is no longer mistaken for an HTML tag start, which could merge or drop following content and break idempotency - a regression in 1.40.6.
• Unquoted attribute values containing : or / (e.g. href=https://example.com/page) are no longer split into a truncated value plus a bogus standalone attribute when attributes are wrapped - a regression in 1.40.6.
• A nameless ="value" attribute is no longer rewritten with the literal attribute name None; malformed attributes are left untouched.
• Trailing whitespace inside an indented <textarea>/<pre> is preserved instead of being collapsed by whitespace cleanup (it is verbatim content).

Performance

... (truncated)

Changelog

Sourced from djlint's changelog.

[1.43.1] - 2026-07-28

Fix

• H025 no longer reports the closing tag of a multi-line <script> or <style> as an orphan - a regression in 1.43.0. A genuinely unmatched </script> is still reported.

[1.43.0] - 2026-07-27

Feature

• New --stdin-filename option gives content piped in on stdin (djlint -) its real path, so per-file-ignores matches against that name and linter messages report it. Per-file ignores were previously dead for piped input, since nothing matches the name -. Path separators are normalized as they are for files on disk.

Fix

• An apostrophe inside a template tag nested in an attribute value (title="{% translate "You don't have permission" %}") no longer swallows the rest of the document, which made H025 report every enclosing element as an orphan. A template tag in a value is now skipped whole unless it holds a >, so a quoted literal like a="{{" is still left alone.
• A line that starts with a closing tag and ends with a whole tag (</span>tail<textarea>y</textarea>) unindents again; everything after it stayed one level too deep.
• A template block tag followed by a whole html tag on the same line ({% endif %} <td class="x">y</td>) indents as a block tag again, so {% endif %} unindents and {% else %} aligns with its {% if %}. A line only takes that shape once the tag fits on one line, so reformatting an already formatted file moved it.
• A tag opened after the end of a verbatim block on the same line (</pre> <span>x) is tracked again; its closing tag took a level from a tag opened before the block, dedenting that tag's siblings.
• A template control block written across lines is kept that way when it opens against a tag (<div>{% if x %}), and the choice is no longer applied to the wrong block. Blocks were paired with the source by position, which does not line up with the expanded html; they are now matched by tag and contents.
• A tag whose style, srcset, data-srcset or sizes value was written over several lines is no longer spread over multiple lines and pulled back together on the next run. max_attribute_length is now measured against what is written out, not against padding that the rewrite drops.
• A <pre> or <textarea> opened on a line that also holds a self-contained comment (<pre>x<!--c-->) is recognized as opening a verbatim block again. Its contents were re-indented instead of left alone, and the closing </pre> gained an indent level on every run - unbounded whitespace growth inside preformatted text.
• A closing tag that starts its line no longer dedents when the tag it closes was opened after text on an earlier line (text <b>bold / </b> tail). The loss accumulated, so a document repeating that shape drifted further left with each occurrence. A closing tag with nothing to pair against still dedents as before.
• A < inside a one-line <script>, <style>, <textarea> or <title> no longer counts as a tag when indenting. <script>var a = '<span>'</script> left a phantom open <span> on the tag stack, leaving everything after it one level too deep.
• An inline element that opens after text on its line and closes on a later line no longer dedents everything that follows it by one level (text <b>bold / more</b> tail inside a <p>) - a regression in 1.40.8. The wrong output was idempotent, so it survived later runs.
• A Go template comment {{/* ... */}} is no longer read as a block close tag. It starts with {{/, the handlebars block-close prefix, so it popped a block off the stack: H037 reported Duplicate attribute found. for mutually exclusive attributes such as <a {{if .A}}href="a"{{else}}{{/* c */}}href="b"{{end}}>, and the formatter unindented the rest of the block. A comment renders as nothing, so H037 no longer treats one as a template-generated attribute name prefix either.
• A tag that merely touches an ignored block is no longer treated as being inside it. A tag ending exactly where an ignored block starts - such as {% if x %}{# comment #} - was skipped by the linter, most visibly making T038 report End tag has no matching block tag for a balanced {% if %}. Affects every rule that skips ignored blocks (H025, H037, H041, H042, T002, T003, T027, T038, T039) and every kind of ignored block.
• A bare djlint:off pragma no longer ignores the tag written immediately before it. <img>{# djlint:off #} silently dropped every error on that <img>, while <img>{# djlint:off H013 #} correctly reported it - a pragma covers what follows it, not what precedes it.

[1.42.3] - 2026-07-23

Fix

• Attribute names containing punctuation beyond -, ., :, @ and * no longer stop a tag from being wrapped over multiple lines. The attribute parser now accepts any character HTML allows in an attribute name, so Alpine key modifiers (@keydown.prevent.?), Angular bindings ((click), [disabled]) and Vue shorthands (#slot) are formatted like every other attribute instead of leaving the whole tag on one long line. Angular bindings also reach --format-attribute-js-json for the first time, which already listed them.
• An unquoted attribute value with a template tag glued to the rest of the value (e.g. src={{ MEDIA_URL }}/logo.png, href={{ .Permalink }}#{{ .Anchor }}) is no longer split into a truncated value plus a bogus standalone attribute when attributes are wrapped; it stays one value, quoted when spread.

[1.42.2] - 2026-07-22

Fix

• Attributes containing ${...} inside a quoted value (e.g. JS template literals like :name="`x[${i}]`") respect max_attribute_length again and are spread over multiple lines - a regression in 1.40.6. Unquoted Mako-style ${...} expressions in tags are still left unformatted.
• A stray <!-- that is not a real HTML comment (for example inside a {# ... #} template comment or inside a <textarea>/<pre>) no longer swallows the rest of the document. This fixes false H025 orphan-tag reports and over-indentation of the tags that follow - a regression in 1.40.6.
• Handlebars triple-stache {{{ ... }}} and raw-block {{{{ ... }}}} expressions used as tag attributes are tokenized correctly again, fixing false H025 orphan-tag reports - a regression in 1.40.6.
• A quoted literal brace in an attribute value (e.g. data-x="{{") no longer makes the tokenizer scan into later content looking for a matching }}, which could collapse <pre>/<textarea> whitespace - a regression in 1.40.6.
• Spacing the }} of a handlebars {{#if}}/{{#each}} block-open tag is now idempotent; it no longer leaks a trailing space into the following {{...}} tag on later formatting passes.
• T038 no longer reports block tags that appear only inside a handlebars comment ({{!-- ... --}}, {{! ... }}) or inside a handlebars raw block ({{{{raw}}}} ... {{{{/raw}}}}).
• T039 no longer reports handlebars raw-block delimiters ({{{{raw}}}} / {{{{/raw}}}}) as unclosed template tags.
• Malformed tag attributes that the attribute parser cannot fully parse (e.g. a stray < or dangling =) are now left untouched instead of having the unparsable characters silently dropped when attributes are wrapped.
• A < used as a less-than operator inside a template expression in text or <script> content (e.g. ${a<b}, {{a<b}}) is no longer mistaken for an HTML tag start, which could merge or drop following content and break idempotency - a regression in 1.40.6.
• Unquoted attribute values containing : or / (e.g. href=https://example.com/page) are no longer split into a truncated value plus a bogus standalone attribute when attributes are wrapped - a regression in 1.40.6.
• A nameless ="value" attribute is no longer rewritten with the literal attribute name None; malformed attributes are left untouched.

... (truncated)

Commits

• c442403 v1.43.1
• c69b4d8 fix(linter): don't orphan the closing tag of a multi-line script/style
• 6d3c807 chore(deps): lock file maintenance (#2305)
• 9b9b10e chore(deps): update dependency sass to v1.102.0 (#2304)
• cad0853 chore(deps): lock file maintenance (#2303)
• f647c3a chore(deps): update dependency postcss to v8.5.23 (#2301)
• 6e993b3 v1.43.0
• 659b7b6 perf: rewrite any generator as a for loop
• 3f843bb docs: condense the unreleased changelog
• e864bf6 fix(linter): don't let quotes inside a template tag end an attribute
• Additional commits viewable in compare view

Updates mkdocs-material from 9.7.6 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

• Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

• Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

• Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

• Limited version range of mkdocs to <2
• Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

• Hardened social cards plugin by switching to sandboxed environment
• Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

• Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

• Opened up version ranges of optional dependencies for forward-compatibility
• Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

• Updated requests to 2.30+ to mitigate CVE in urllib
• Fixed privacy plugin not picking up protocol-relative URLs
• Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

• b3e6dd8 Prepare 9.7.7 release
• 52fb6be Merge commit from fork
• 901e633 Added SECURITY.md with EOL notice
• 5b36f2a Bump js-yaml from 4.1.1 to 4.2.0 (#8598)
• 2d11e7b Bump form-data from 3.0.4 to 3.0.5 (#8597)
• ae05a53 Bump esbuild from 0.27.2 to 0.28.1 (#8596)
• 434af93 Bump shell-quote from 1.7.3 to 1.8.4 (#8593)
• 4447cda Documentation (#8590)
• 8f8d551 Updated copyright year (#8588)
• 08d8514 Bump fast-uri from 3.0.3 to 3.1.2 (#8587)
• Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions