Build(deps-dev): Bump the patch group with 5 updates

[dependabot]

Bumps the patch group with 5 updates:

Package	From	To
markdown	3.10.2	3.10.3
mkdocstrings-python	2.0.5	2.0.7
mypy	2.3.0	2.3.1
uv	0.12.0	0.12.7
pylint	4.0.6	4.0.7

Updates markdown from 3.10.2 to 3.10.3

Release notes

Sourced from markdown's releases.

Release 3.10.3

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.
• Link the Extension API documentation to the API Reference (#1612).

Changelog

Sourced from markdown's changelog.

[3.10.3] - 2026-07-30

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.
• Link the Extension API documentation to the API Reference (#1612).

Commits

• bb50627 Bump version to 3.10.3
• 8453df0 Update Extension API documentation
• 93ac448 Document that all extensions are in maintenance mode
• d38fd4a Create AI Policy
• ddead47 Prevent mixed =/- chars in Setext-style headings
• See full diff in compare view

Updates mkdocstrings-python from 2.0.5 to 2.0.7

Release notes

Sourced from mkdocstrings-python's releases.

2.0.7

2.0.7 - 2026-08-17

Compare with 2.0.6

Bug Fixes

• Don't render environment paths in source block labels (84ba73e by Chris Wilson). Issue-333, PR-338

2.0.6

2.0.6 - 2026-08-16

Compare with 2.0.5

Bug Fixes

• Don't pass unsupported options to Griffe parsers (4b38b6b by Timothée Mazzucotelli). Issue-337
• Increase stash key length from 1 to 2 (6ff2749 by Jonas Haag). PR-336

Changelog

Sourced from mkdocstrings-python's changelog.

2.0.7 - 2026-08-17

Compare with 2.0.6

Bug Fixes

• Don't render environment paths in source block labels (84ba73e by Chris Wilson). Issue-333, PR-338

2.0.6 - 2026-08-16

Compare with 2.0.5

Bug Fixes

• Don't pass unsupported options to Griffe parsers (4b38b6b by Timothée Mazzucotelli). Issue-337
• Increase stash key length from 1 to 2 (6ff2749 by Jonas Haag). PR-336

Commits

• 624974a chore: Prepare release 2.0.7
• 84ba73e fix: Don't render environment paths in source block labels
• a025f49 chore: Prepare release 2.0.6
• 3c782f5 ci: Fix type-checking issues
• bb49b15 tests: Re-add griffe as dev-dep to run API checks
• 4b38b6b fix: Don't pass unsupported options to Griffe parsers
• 6ff2749 fix: Increase stash key length from 1 to 2
• 0fa2d2e chore: Update sponsors section in README (#332)
• See full diff in compare view

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• See full diff in compare view

Updates uv from 0.12.0 to 0.12.7

Release notes

Sourced from uv's releases.

0.12.7

Release Notes

Released on 2026-08-27.

Python

• Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

• Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
• Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

• Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

• Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

• remove pyx specific features (#21182, #21183, #21184, #21185, #21186)

Install uv 0.12.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex"

Download uv 0.12.7

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.7

Released on 2026-08-27.

Python

• Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

• Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
• Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

• Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

• Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

• remove pyx specific features (#21182, #21183, #21184, #21185, #21186)

0.12.6

Released on 2026-08-25.

Python

• Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295)

Enhancements

• Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#21261)
• Limit warnings about unbounded uv_build requirements to source-distribution builds (#21078)
• Display byte counts below 1 KiB without a fractional part (#21237)

Preview features

• Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#21117)
• Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#21235)
• Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#21227)
• Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#21146)

Performance

• Enable profile-guided optimization for Linux x86-64 release binaries (#21001)
• Enable profile-guided optimization for Windows x86-64 release binaries (#21003)
• Enable profile-guided optimization for macOS ARM64 release binaries (#21002)

... (truncated)

Commits

• 61291a8 Bump version to 0.12.7 (#21328)
• dd217b8 de-pyx-ify malformed bearer token test (#21326)
• 306ee9c remove references to pyx in RFC 9457 handling code (#21187)
• 6186dcb remove pyx authentication (#21186)
• f61b300 remove pyx publication support (#21185)
• ba19067 remove support for pyx-specific .whl.tar.zst format (#21184)
• ad852ce fix PR labeler automation (#21325)
• 156dd51 Replace Python installations during build upgrades (#21323)
• 1a486d1 Add coverage for Python build upgrades (#21320)
• 17b195b Retry private Azure downloads with authentication (#21318)
• Additional commits viewable in compare view

Updates pylint from 4.0.6 to 4.0.7

Release notes

Sourced from pylint's releases.

v4.0.7

What's new in Pylint 4.0.7?

Release date: 2026-08-09

False Positives Fixed

• Fix a false positive for invalid-name when a module-level variable is assigned an instance of a TypedDict subclass. Such a name is a value, not a type definition, so it is now checked against the constant or variable regex instead of class-rgx.

  Closes #11231

Other Bug Fixes

• Fix a crash in the bad-open-mode check when the mode argument of open is the NotImplemented constant (Python >= 3.14).

  Closes #11099

• Fix a crash in the not-context-manager and not-async-context-manager checks when the context manager infers to a value without a name, such as the slice returned by with slice(...) / async with slice(...).

  Closes #11102

• Fix a false positive for nested-min-max (W3301) when the inner min/max call carries a keyword argument such as key=. Flattening the call dropped the keyword and changed the result, so nested calls whose inner call has keyword arguments are no longer flagged.

  Closes #11130

• Fix a false suggestion from nested-min-max (W3301): when rewriting a nested min/max into a splat call, arguments positioned after the splatted call were silently dropped, so the suggested code changed the result.

  Closes #11134

• Fix a false positive for too-many-locals (R0914): PEP 695 type parameters, i.e. the T1 and T2 in a generic def f[T1, T2] signature, were counted as local variables. They are type-system constructs, not runtime locals, and are now excluded from the local-variable count.

  Closes #11136

• Fix literal-comparison (R0123) emitting a corrupted suggestion for identifiers that contain is (e.g. axis is 5 was rendered ax== == 5). The suggestion is now rebuilt from the operands and operator.

  Closes #11146

... (truncated)

Commits

• c6768d3 Bump pylint to 4.0.7, update changelog (#11246)
• e96ce2b Stop invalid-name from treating TypedDict instances as classes
• 893294e [Backport maintenance/4.0.x] Fix crash in comparison-with-callable on a proxi...
• 8cd74d4 Fix a crash on calls unpacking dicts with non-string keys
• bc618ad Fix too-many-lines being reported at another module's pragma line
• 3e1ee47 [Backport maintenance/4.0.x] Fix bad-string-format-type false positives for...
• 7ca8116 [Backport maintenance/4.0.x] Fix useless-parent-delegation false positive o...
• 14275a1 [Backport maintenance/4.0.x] Fix literal-comparison suggestion corrupting i...
• a87eaa6 [Backport maintenance/4.0.x] Fix nested-min-max dropping arguments after th...
• bdd017f [Backport maintenance/4.0.x] Fix too-many-locals counting PEP 695 type para...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions