[dependabot]

Bumps the python group with 3 updates: cedarpy, platformdirs and markdown.

Updates cedarpy from 4.12.1 to 4.12.2

Release notes

Sourced from cedarpy's releases.

cedarpy v4.12.2

Added

• With the new keyword-only release_gil=True, other Python threads run while Cedar validates policies or builds a handle, so asyncio.to_thread keeps an event loop responsive during those calls (#120). The default, False, holds the GIL for the whole call, as before. These entry points take it:

  • validate_policies
  • PolicySet.from_str, PolicySet.from_json_str and PolicySet.from_pst
  • Schema.from_str and Schema.from_json_str
  • Entities.from_json_str

  When another thread is busy, a released call typically waits about sys.getswitchinterval() (5 ms by default) to resume, so releasing pays off for calls that take milliseconds or more. Reading the arguments and building the result still hold the GIL. See the Threads and asyncio Guide (#121). Thanks @​kousun12!

Full Changelog: k9securityio/cedar-py@v4.12.1...v4.12.2

Changelog

Sourced from cedarpy's changelog.

[4.12.2] - 2026-10-14

Added

• With the new keyword-only release_gil=True, other Python threads run while Cedar validates policies or builds a handle, so asyncio.to_thread keeps an event loop responsive during those calls (#120). The default, False, holds the GIL for the whole call, as before. These entry points take it:

  • validate_policies
  • PolicySet.from_str, PolicySet.from_json_str and PolicySet.from_pst
  • Schema.from_str and Schema.from_json_str
  • Entities.from_json_str

  When another thread is busy, a released call typically waits about sys.getswitchinterval() (5 ms by default) to resume, so releasing pays off for calls that take milliseconds or more. Reading the arguments and building the result still hold the GIL. See the Threads and asyncio Guide (#121). Thanks @​kousun12!

Commits

• f9a3af1 Merge pull request #122 from k9securityio/release/4.12.2
• fd79b2d release: bump version to 4.12.2
• 5bf4e43 feat: add opt-in release_gil to validation and handle constructors (#121)
• See full diff in compare view

Updates platformdirs from 4.13.1 to 4.13.3

Release notes

Sourced from platformdirs's releases.

4.13.3

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.2...4.13.3

4.13.2

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. #619

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.1...4.13.2

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.13.5 (2026-10-19)

---

• Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. :pr:631

---

4.13.4 (2026-10-17)

---

• Require a complete files path segment when locating Android app directories from sys.path. :pr:621
• Keep root directory tests independent of inherited XDG environment variables. :pr:622
• Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. :pr:624
• Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. :pr:625
• Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. :pr:627
• Correct the contributor guide to name ty as the type checker used by the type environment. :pr:623

---

4.13.3 (2026-10-16)

---

---

4.13.2 (2026-10-16)

---

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

---

4.13.1 (2026-10-15)

---

• Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. :pr:618
• Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

---

4.13.0 (2026-10-10)

---

... (truncated)

Commits

• 97a8dbc Release 4.13.3
• ca20f65 Release 4.13.2
• 9a8eb24 fix: normalize XDG user fonts path at filesystem root (#619)
• a477a0a 🔧 build(yaml): check out YAML with LF so yamlfmt passes on Windows (#620)
• See full diff in compare view

Updates markdown from 3.11 to 3.11.1

Release notes

Sourced from markdown's releases.

Release 3.11.1

Fixed

• Update serializer to be non-recursive (#1644).
• Improve ancestor handling in the inline Treeprocessor (#1646).
• Keep a raw HTML comment inside an inline HTML element that closes in the same paragraph, instead of splitting the paragraph around it (#1643).
• Fix issue where inline HTML attributes were rejected if they had < or > in the attribute (#1647).
• Fix issue where an unterminated end tag (</foo) could cause all remaining content to be dropped (#1651).
• Complete rework of emphasis handling to improve nested emphasis handling better (#1632).

Changelog

Sourced from markdown's changelog.

[3.11.1] - 2026-10-13

Fixed

• Update serializer to be non-recursive (#1644).
• Improve ancestor handling in the inline Treeprocessor (#1646).
• Keep a raw HTML comment inside an inline HTML element that closes in the same paragraph, instead of splitting the paragraph around it (#1643).
• Fix issue where inline HTML attributes were rejected if they had < or > in the attribute (#1647).
• Fix issue where an unterminated end tag (</foo) could cause all remaining content to be dropped (#1651).
• Complete rework of emphasis handling to improve nested emphasis handling better (#1632).

[3.11.0] - 2026-09-25

Changed

• Inline processors now resume searching after the previous match, improving performance for repeated inline patterns (#1619).
• Officially support Python 3.15 and drop support for Python 3.10
• Walk backtick runs in BacktickInlineProcessor without a regex (#1620).
• Switch static site generator for documentation from MkDocs to Zensical (#1627, #1635, #1637, and #1638).

Fixed

• Ensure removing Abbreviations does not raise an error (#1634).
• Fix an issue with excessive backtracking when matching inline code blocks (#1617).
• md_in_html now honors tags added to Markdown.block_level_elements after the extension is loaded (#1246).
• Fix quadratic-time regex backtracking in ReferenceProcessor when a link reference definition has no URL, e.g. a line consisting only of [id]: followed by many trailing spaces (#798).
• Document attr_list usage for def_list (#1123).

[3.10.3] - 2026-07-30

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.
• Link the Extension API documentation to the API Reference (#1612).

[3.10.2] - 2026-02-09

Fixed

• Fix a regression related to comment handling (#1590).
• More reliable fix for </ (#1593).

... (truncated)

Commits

• 2258b48 Bump version to 3.11.1
• 6f825aa Rewrite emphasis handling
• 0bf535b Keep a comment inside raw inline HTML in the same paragraph
• 3ade80d Add playground to docs
• ee57673 docs/extensions/tables.md: Fix header formatting
• 7c265bc Ensure that unterminated HTML tags do not cause text to be dropped
• 7a29324 Fix inline HTML case
• 3002575 Fix ancestor handling
• b2125da Serialize HTML non-recursively
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

A concrete DCO-signed author-adoption companion is available: d231de8c8a089e2d42efadd5692dcfb4006f12d5, branch fix/260-cedar-locks, based on reviewed head 89a2ad37ac1b89c3493042b089d6a4dd1a3bf4a4.

Regenerates both Cedar dependency locks and runs pip check after editable installation in CI.

Earlier fresh hash-locked Python 3.12 run: 843 passed, 2 skipped; installed cedarpy 4.12.2; dependency compatibility check passes. These results come from the recorded correction run; I verified the published commit/sign-off/files today, not a new runtime rerun.

Supported-platform hosted CI and independent acceptance remain required after adoption.

For adoption, fetch https://github.com/dinakarjs/ca2a.git branch fix/260-cedar-locks and apply the missing correction against the current head. Please run final-head checks and obtain independent review after incorporation. Original PR ownership is retained; this handoff is not approval of my own correction.

Reference: The repository's lock-header generation commands and .github/workflows/ci.yml installation path are the reproducibility contract. Prepared with Codex.

[dinakarjs]

At exact head 89a2ad3 the dependency inputs request cedarpy 4.12.2, while the committed runtime lock still pins cedarpy 4.12.1. Please regenerate and adopt the coherent runtime/dev locks before merge; otherwise a hash-locked install and a resolving editable install use different dependency contracts. The tested correction companion d231de8 is already handed off at #260 (comment) . This review retains that existing adoption request rather than opening a competing implementation. The companion's earlier 843-passed/2-skipped run is prior evidence, not a new run this pass. Current green CI does not resolve the committed pin mismatch.

[imran-siddique]

@dinakarjs the lock half of d231de8 is right. CI on 89a2ad3 installed cedarpy 4.12.1 from the old locks, so the green run never tested the bump, and pip check there reports cedarpy==4.12.2 required. Recompiling both locks in place gives your files byte for byte.

The pip check steps break test_release_validation_matches_ci (828 passed, 1 failed), because release-validation.yml must mirror ci.yml. Adding the same three steps there makes it pass. I am taking the two lock files onto this branch and leaving the CI step for its own PR.

[dinakarjs]

Verified the adopted lock correction at 7f61ee3 in a fresh hash-locked Linux/Python 3.12.14 environment: cedarpy 4.12.2 is installed, no-deps editable installation and pip check pass, and the complete unit selection passes 790 tests with 2 hardware skips. My earlier pin-mismatch finding is addressed. Because I supplied the lock correction, this is incorporation verification rather than independent approval of my contribution.

I am keeping the follow-up pip check gate separate as requested, with matching steps in CI and release-validation so the existing parity contract is preserved. Current-head independent approval and supported-platform checks remain required. Reviewed with Codex.

[carloshvp]

Reviewed exact head 7f61ee3ec20171425e662d9fa0d9433db5b545d2 in an isolated checkout.

Approving the corrected dependency update at this head. The pyproject and runtime/dev inputs now agree with the runtime and dev locks on cedarpy 4.12.2. The earlier green-run pin mismatch is addressed. The documentation lock updates to Markdown and platformdirs are also within the stated dependency group.

Independent fresh hash-locked validation: cedarpy 4.12.2 is actually installed; editable no-deps installation and pip check pass; the complete unit selection passes 776 tests with 16 skips. Changed Cedar, Markdown and platformdirs hashes match official PyPI metadata. Whitespace checks pass.

This is independent review of the incorporated lock correction. The consistency gate follow-up is separately reviewed in #264. Current-head hosted technical checks have passed; normal branch rules and review-state requirements still apply. Both PR commits carry DCO sign-off.

Reviewed with OpenAI Codex.