build(deps): bump the python-minor-patch group across 1 directory with 7 updates

[dependabot]

Bumps the python-minor-patch group with 7 updates in the / directory:

Package	From	To
pypdfium2	5.12.1	5.13.0
python-dotenv	1.2.2	1.2.3
pandas	3.0.5	3.0.6
pre-commit	4.6.1	4.6.2
pytest-playwright	0.8.0	0.9.0
reportlab	5.0.0	5.0.1
ruff	0.16.1	0.16.8

Updates pypdfium2 from 5.12.1 to 5.13.0

Release notes

Sourced from pypdfium2's releases.

5.13.0

Release 5.13.0

Summary

• Experimental pyemscripten_2026_0_wasm32 (Pyodide) build support added. However, the resulting builds are flaky at runtime and subject to various types of random crashes. Freezes on shutdown have also been observed. While these issues persist, PyEmscripten wheels will not be uploaded to PyPI, but they are included in the release process and can be downloaded from GitHub on an experimental basis. If you can help track down and fix these issues, please reach out. Note: Our PyEmscripten wheels are bigger than usual, as they are built with debug symbols (a non-debug build is not considered useful at this stage).
• Fixed compatibility with Python 3.6 and 3.7.
  • Runtime support was inadvertently broken due to a faulty cached property backport which held only one cache per class, not per instance as should have been. The accidental loss of caches broke key assumptions of our autoclose logic, which relies on cached_property since 5.8.0. (Earlier versions that did not make extensive use of cached properties might work but have not been explicitly tested.)
  • This release replaces both functools.cached_property and the faulty functools.lru_cache() based backport with our own, backward compatible cached_property implementation along with thorough documentation.
  • Also, fixed setup (i.e. source installation) with Python 3.6 and its max available setup dependency versions (that is, setuptools 59). This had probably been broken for a long time. (A few non-breaking issues remain, e.g. for some reason we end up with a purelib directory, but it should be platlib.)
  • Bear in mind that ctypesgen continues to require Python >=3.8 at this time (3.6 compat not being a priority in that case), but you can install with --no-build-isolation and let the reference bindings be used, or try adding ctypesgen's src/ to PYTHONPATH to bypass setup, and see how it goes.
  • Note: We do not plan to (and practically cannot) keep up compatibility with outdated Python versions indefinitely. In particular, setup compatibility may be dropped sooner or later in favor of contemporary Python packaging concepts, like migrating as much as possible to pyproject.toml. That said, we are happy to restore compatibility at this point, and fix any unintentional breakage.
• Fixed MANIFEST.in missing Windows spoof headers, which resulted in subtly incorrect bindings when installing from an sdist on Windows, as seen in test failures. (Release wheels have been unaffected and passed the test suite, so this issue went unnoticed for a while.)
• Bumped gn-dist from 2407.1 to 2407.3. Made its setup python 3.6 compatible likewise (wheels should have worked before now). Changed versioning and release process so that CI no longer needs to push to the repository (may eventually become a blueprint for pypdfium2 itself). More documentation added, including manylinux2014 POC.
• Internal improvements (non-exhaustive):
  • Properly clean up *.egg-info/ and build/ before packaging, to avoid mad file inclusion bugs (ran into this while working on setup include rules).
  • Migrated from requirements files to PEP 735 dependency groups (pyproject.toml). Recent enough pip should be available to Python >= 3.9. For compatibility with older versions, feel free to use ./utils/misc/install_dep_group.py.
  • Applied dependency cooldowns to internal callers of pip install. Always use virtual environments in CI. Use lockfiles in sensitive areas (e.g. publish jobs).
  • Rearranged & improved utilities. Cleaner distinction between setupsrc/ and utils/.
  • Work around persistent i686 container network issues by downgrading host runner to ubuntu-24.04.
  • Let setupsrc/ share code from src/ through a pypdfium2_cfg._shared submodule that can be added to sys.path.

Build info

This release was made with the following build strategies:

• PBIN: [macosx_arm64, macosx_x86_64, win_amd64, win_arm64, win32, manylinux_x86_64, manylinux_i686, manylinux_aarch64, manylinux_armv7l, manylinux_ppc64le, manylinux_mips64le, android_arm64_v8a, android_armeabi_v7a]
• SBLD: [manylinux_mipsle]
• CIBW: [manylinux_riscv64, manylinux_loongarch64, manylinux_s390x, musllinux_x86_64, musllinux_aarch64, musllinux_armv7l, musllinux_i686, musllinux_ppc64le, musllinux_s390x, musllinux_riscv64, musllinux_loongarch64, pyodide_wasm32]

[!CAUTION] The following builds are affected by known, major issues (e.g. endianness bugs, crashes, freezes) and are NOT considered ready for production use: [manylinux_s390x, musllinux_s390x, pyodide_wasm32]

Commit logs

Commits between 5.12.1 and 5.13.0 (latest commit first):

• a4659102 [autorelease main] update 5.13.0
• 9094de35 continue on changelog/docs
• b89e367a git_net_additions.py: minor tweaks
• 57157e78 readme: don't overdo admonitions
• 033d5ce0 changelog: less waffle
• 5afbd619 install_buildtools: use compat function for dependency group

... (truncated)

Commits

• a465910 [autorelease main] update 5.13.0
• 9094de3 continue on changelog/docs
• b89e367 git_net_additions.py: minor tweaks
• 57157e7 readme: don't overdo admonitions
• 033d5ce changelog: less waffle
• 5afbd61 install_buildtools: use compat function for dependency group
• 3282e36 Add zizmor to check step
• 07b84aa Progress changelog
• 6ec38d2 git_net_additions: further improve fallback
• b5cdd7c git_net_additions: fancier fallback for binary files
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates pandas from 3.0.5 to 3.0.6

Release notes

Sourced from pandas's releases.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• 2905718 RLS: 3.0.6
• 3188ced [backport 3.0.x] BUG: read_csv(sep=None) raised TypeError instead of falling...
• f097905 DOC: cleanup 3.0.6 whatsnew + mention Python 3.15 support (#68965) (#68969)
• 4f68223 [backport 3.0.x] BUG: fix setting with bool column mask into 1-column DataFra...
• e3df0e8 [backport 3.0.x] BUG: full-slice setitem into a pyarrow-backed array shared m...
• b7735f6 Backport PR #66117 on branch 3.0.x (BUG: interpolate leaving NAs unfilled for...
• bca0b77 [backport 3.0.x] BUG: read_csv leaked the string-intern table when a column f...
• bca1e5d [backport 3.0.x] BUG: prevent external mutation of RangeIndex._data (CoW) (#6...
• c95b42c [3.0.x] CI: skip cython-lint on pre-commit.ci (#68910)
• 9cbd884 [backport 3.0.x] Backport of some already merged regression fixes (#68447)
• Additional commits viewable in compare view

Updates pre-commit from 4.6.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Commits

• 9767b6c v4.6.2
• 42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
• 3056619 fix language: node for hooks with build scripts and npm 11.x
• See full diff in compare view

Updates pytest-playwright from 0.8.0 to 0.9.0

Release notes

Sourced from pytest-playwright's releases.

v0.9.0

Adds --playwright-debug=cli: pytest pauses at the start of the first context and prints a python -m playwright cli attach … command so agents (or you) can inspect the live browser.

pytest --playwright-debug=cli -s
# ### The test is currently paused at the start
# ### Debugging Instructions
# - Run `python -m playwright cli attach tw-a1b2c3` to attach to this test
python -m playwright cli attach tw-a1b2c3
python -m playwright cli --s=tw-a1b2c3 snapshot
python -m playwright cli --s=tw-a1b2c3 resume

Commits

• 70e8949 feat: add --playwright-debug=cli for Python test agents (#315)
• 765e6e9 chore: require playwright>=1.60 in CI and unskip 1.60 tests (#313)
• See full diff in compare view

Updates reportlab from 5.0.0 to 5.0.1

Updates ruff from 0.16.1 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits

• 62914c4 Bump version to 0.16.8 (#28648)
• c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
• ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
• 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
• 50020fb [ty] Avoid storing constraint nodes twice (#28375)
• 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
• 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
• d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
• fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
• 31131db [ty] Support type[A & B] (#27124)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions