build(deps-dev): bump the minor-uv-updates group with 4 updates

[dependabot]

Bumps the minor-uv-updates group with 4 updates: ruff, zizmor, zensical and uv.

Updates ruff from 0.16.0 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878
• @​MichaReiser

... (truncated)

Commits

• 80790b3 Bump 0.16.1 (#27330)
• 63830f3 [ty] Borrow from constraint set storage less often (#27328)
• f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
• 0d80497 Lint TOML files in the LSP (#26862)
• d91586b Update prek dependencies (#27293)
• 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
• b20daf7 [ty] refactor: add helper function to send partial results (#27249)
• 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
• 7c3e2db [ty] Fix enum class container assignability (#27318)
• d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
• Additional commits viewable in compare view

Updates zizmor from 1.28.0 to 1.29.0

Release notes

Sourced from zizmor's releases.

v1.29.0

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Changelog

Sourced from zizmor's changelog.

1.29.0

New Features 🌈

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

• New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and #!yaml uses: ./foo/bar (#2248)

Changes ⚠️

• The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly: [unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses, whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)

• Fixed a bug where the [github-app] audit would incorrectly flag some usages as needing a #!yaml repositories: key, despite requesting organization-level-only permissions (#2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Commits

• 3c11696 zizmor 1.29.0 (#2251)
• 876f448 Bump trophies (#2250)
• 3e92c0a Remove old deprecated --collect modes (#2242)
• 35ab77b Support self-repository syntax for local uses (#2249)
• 6ea55f5 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#2241)
• a56362c chore(deps): bump quinn-proto from 0.11.14 to 0.11.16 (#2240)
• 80b80f3 Bump zensical, fixup anchor IDs (#2239)
• dce1469 Bump trophies (#2238)
• fd487f4 chore(deps): bump the github-actions group with 4 updates (#2236)
• ab59a28 chore(deps): bump the cargo group with 11 updates (#2237)
• Additional commits viewable in compare view

Updates zensical from 0.0.51 to 0.0.52

Release notes

Sourced from zensical's releases.

0.0.52

Summary

This version adds search support for CJK languages: Chinese, Japanese, and Korean. Search needs to segment text into individual words before it can index and match them. While many languages separate words with spaces, this is not consistently the case for CJK text, particularly Chinese and Japanese. Search now uses locale-aware segmentation to identify meaningful word boundaries, ensuring that content and queries are indexed and matched correctly.

Set the site language to zh, zh-Hant, zh-TW, ja, or ko to enable segmentation.

The search modal is also larger, showing more results and context at once. Additionally, keyboard keys inside admonitions now use the correct background color in the modern theme.

Dependencies and development tooling were updated, including TypeScript 7. The build scripts now use tsx instead of ts-node, and npm-run-all2 replaces the unmaintained npm-run-all. Updated icon packages add 56 new icons: 23 Font Awesome icons, 21 Lucide icons, 8 Octicons, and 4 Simple Icons.

Changelog

Features

• f2d9ef8 zensical – add CJK language support for search
• 72f24bf ui – update ui to v0.0.23

Commits

• bf07314 chore: release v0.0.52
• f2d9ef8 feature: add CJK language support for search
• 72f24bf feature: update ui to v0.0.23
• See full diff in compare view

Updates uv from 0.11.32 to 0.12.1

Release notes

Sourced from uv's releases.

0.12.1

Release Notes

Released on 2026-07-31.

Enhancements

• Add package-specific pre-release policies with --prerelease-package (#20837)
• Support local HTML files as flat indexes (#20802)
• Add Xonsh virtual environment activation scripts (activate.xsh) (#19740)
• Preserve filesystem paths passed to uv add --index when updating pyproject.toml (#20817)

Preview features

• Add automatic fixes to uv check with --fix (#20793)
• Avoid rejecting unchanged metadata-free lockfiles when workspace dependencies share direct sources (#20847)
• Honor direct URL constraints when validating metadata-free lockfiles (#20796)
• Ignore malformed PEP 723 scripts discovered during project checks (#20784)
• Use ty's native script exclusion in uv check (#20742)

Performance

• Parse canonical uv lockfiles directly, with a fallback for other valid TOML syntax (#20648)
• Accelerate SHA-256 hashing on non-Windows ARM64 platforms (#20805)

Bug fixes

• Flush shell startup file updates before uv tool update-shell and uv python update-shell exit (#20842)
• Make workspace-root dependency groups available to commands run from workspace members (#20840)
• Resolve --find-links paths in requirements files relative to the containing file (#20832)
• Respect configured indexes in uv tool list --outdated (#20770)

Documentation

• Document Astral GPU indexes in the PyTorch guide (#20785)
• Use consistent dependency-group argument descriptions throughout the CLI documentation (#20823)

Install uv 0.12.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-installer.ps1 | iex"

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.1

Released on 2026-07-31.

Enhancements

• Add package-specific pre-release policies with --prerelease-package (#20837)
• Support local HTML files as flat indexes (#20802)
• Add Xonsh virtual environment activation scripts (activate.xsh) (#19740)
• Preserve filesystem paths passed to uv add --index when updating pyproject.toml (#20817)

Preview features

• Add automatic fixes to uv check with --fix (#20793)
• Avoid rejecting unchanged metadata-free lockfiles when workspace dependencies share direct sources (#20847)
• Honor direct URL constraints when validating metadata-free lockfiles (#20796)
• Ignore malformed PEP 723 scripts discovered during project checks (#20784)
• Use ty's native script exclusion in uv check (#20742)

Performance

• Parse canonical uv lockfiles directly, with a fallback for other valid TOML syntax (#20648)
• Accelerate SHA-256 hashing on non-Windows ARM64 platforms (#20805)

Bug fixes

• Flush shell startup file updates before uv tool update-shell and uv python update-shell exit (#20842)
• Make workspace-root dependency groups available to commands run from workspace members (#20840)
• Resolve --find-links paths in requirements files relative to the containing file (#20832)
• Respect configured indexes in uv tool list --outdated (#20770)

Documentation

• Document Astral GPU indexes in the PyTorch guide (#20785)
• Use consistent dependency-group argument descriptions throughout the CLI documentation (#20823)

0.12.0

Released on 2026-07-28.

Since we released uv 0.11.0 in March, we've accumulated changes that improve correctness, safety, and compatibility with specifications, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution.

We expect most users to be able to upgrade without making changes.

There are no breaking changes to the configuration of the uv build backend. If your [build-system] table includes an upper bound on uv_build, update it to allow uv_build 0.12, e.g., uv_build>=0.11.32,<0.13.

Breaking changes

• Define build systems by default with uv init (#19197)

... (truncated)

Commits

• 329541a Bump version to 0.12.1 (#20867)
• a68f64b fix ost-simple-sts.json (#20866)
• a531d91 Generate README files for issue context branches (#20862)
• 3a9573c Add --frozen to uv run hook invocation (#20865)
• 2a805bd Relocate script (#20864)
• d709d47 Honor direct sources shared across workspace dependencies (#20847)
• a51d7db Rebase promoted pull requests in uv (#20861)
• ec8ad5b Honor direct URL constraints when validating metadata-free locks (#20796)
• 1ac4b3e Allow commands run in workspace members to use root dependency groups (#20840)
• 139f2cf Remove stale Node 20 action TODOs (#20843)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions