Bump the uv-minor-patch group across 1 directory with 4 updates

[dependabot]

Bumps the uv-minor-patch group with 4 updates in the / directory: mrrc, ruff, python-dotenv and hypothesis.

Updates mrrc from 0.9.1 to 0.9.2

Release notes

Sourced from mrrc's releases.

v0.9.2

Security

• Bump quick-xml to 0.41.0, fixing the RUSTSEC-2026-0194/0195 DoS advisories on the MARCXML read/write path. The BIBFRAME/RDF path is not covered: oxrdfxml pins quick-xml ^0.37 and still resolves to the affected 0.37.5. Since bibframe is a default feature (and is always enabled in the Python wheel), a default build still contains the affected code on the RDF serialization path. Both advisories are DoS-class.
• Bump crossbeam-epoch to 0.9.20, fixing the RUSTSEC-2026-0204 invalid-pointer-dereference advisory (reached transitively through rayon).
• Gate PyPI publishing behind a required-reviewer GitHub environment, so a release cannot upload without maintainer approval.
• Harden the CI and release workflows: pin all third-party actions to commit SHAs, disable git-credential persistence in checkouts, scope job token permissions to least privilege, and add a zizmor workflow-security scan to CI.

Dependencies

• Bump pytest from 9.1.0 to 9.1.1
• Bump ruff from 0.15.17 to 0.15.21
• Bump pymdown-extensions from 10.21.3 to 11.0.1
• Bump foldhash from 0.1.5 to 0.2.0
• Bump CodSpeedHQ/action from 4.17.5 to 4.18.5
• Bump softprops/action-gh-release from 3.0.0 to 3.0.2
• Bump actions/checkout from 6.0.3 to 7.0.0
• Bump actions/cache from 5 to 6.1.0
• Bump pyright from 1.1.410 to 1.1.411
• Bump syrupy from 5.3.2 to 5.5.3
• Bump regex from 1.12.4 to 1.13.0
• Bump memchr from 2.8.2 to 2.8.3
• Bump crossbeam-channel from 0.5.15 to 0.5.16
• Bump mypy from 2.1.0 to 2.3.0
• Bump pymarc from 5.3.1 to 5.4.0
• Bump astral-sh/setup-uv from 8.2.0 to 8.3.2
• Bump actions/setup-python from 6.2.0 to 6.3.0
• Bump docker/setup-qemu-action from 4.1.0 to 4.2.0
• Bump anyhow from 1.0.102 to 1.0.103 (dev-dependency, used by examples only; picks up the RUSTSEC-2026-0190 Error::downcast_mut() unsoundness fix, which does not affect the published library or wheel)

Changelog

Sourced from mrrc's changelog.

[0.9.2] - 2026-07-27

Security

• Bump quick-xml to 0.41.0, fixing the RUSTSEC-2026-0194/0195 DoS advisories on the MARCXML read/write path. The BIBFRAME/RDF path is not covered: oxrdfxml pins quick-xml ^0.37 and still resolves to the affected 0.37.5. Since bibframe is a default feature (and is always enabled in the Python wheel), a default build still contains the affected code on the RDF serialization path. Both advisories are DoS-class.
• Bump crossbeam-epoch to 0.9.20, fixing the RUSTSEC-2026-0204 invalid-pointer-dereference advisory (reached transitively through rayon).
• Gate PyPI publishing behind a required-reviewer GitHub environment, so a release cannot upload without maintainer approval.
• Harden the CI and release workflows: pin all third-party actions to commit SHAs, disable git-credential persistence in checkouts, scope job token permissions to least privilege, and add a zizmor workflow-security scan to CI.

Dependencies

• Bump pytest from 9.1.0 to 9.1.1
• Bump ruff from 0.15.17 to 0.15.21
• Bump pymdown-extensions from 10.21.3 to 11.0.1
• Bump foldhash from 0.1.5 to 0.2.0
• Bump CodSpeedHQ/action from 4.17.5 to 4.18.5
• Bump softprops/action-gh-release from 3.0.0 to 3.0.2
• Bump actions/checkout from 6.0.3 to 7.0.0
• Bump actions/cache from 5 to 6.1.0
• Bump pyright from 1.1.410 to 1.1.411
• Bump syrupy from 5.3.2 to 5.5.3
• Bump regex from 1.12.4 to 1.13.0
• Bump memchr from 2.8.2 to 2.8.3
• Bump crossbeam-channel from 0.5.15 to 0.5.16
• Bump mypy from 2.1.0 to 2.3.0
• Bump pymarc from 5.3.1 to 5.4.0
• Bump astral-sh/setup-uv from 8.2.0 to 8.3.2
• Bump actions/setup-python from 6.2.0 to 6.3.0
• Bump docker/setup-qemu-action from 4.1.0 to 4.2.0
• Bump anyhow from 1.0.102 to 1.0.103 (dev-dependency, used by examples only; picks up the RUSTSEC-2026-0190 Error::downcast_mut() unsoundness fix, which does not affect the published library or wheel)

Commits

• a3a55b8 chore(release): v0.9.2 (#431)
• 28c8f65 docs(changelog): scope the quick-xml security note; record oxrdf upstream sta...
• 1867299 docs(changelog): record merged dependency bumps (#413–#428) (#429)
• 9f932d1 chore(deps): Bump mypy from 2.1.0 to 2.3.0 (#428)
• fbb7c82 chore(deps): Bump regex from 1.12.4 to 1.13.0 (#422)
• 0dacbd4 chore(deps): Bump CodSpeedHQ/action from 4.18.2 to 4.18.5 (#426)
• f1250b6 chore(deps): Bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#424)
• c17075b chore(deps): Bump astral-sh/setup-uv from 8.3.1 to 8.3.2 (#423)
• e942d3a chore(deps): Bump memchr from 2.8.2 to 2.8.3 (#421)
• f03f9c0 chore(deps): Bump syrupy from 5.5.1 to 5.5.3 (#425)
• Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot

... (truncated)

Commits

• 11c76bf Bump 0.16.4 (#27937)
• d53c8c5 Isolate playground builds from deployment credentials (#27839)
• cab001e Disable uv preview for releases and pre-commit hooks (#27939)
• f8d575f [ty] Clarify writing guidance for human readers (#27912)
• ca45fae Set --preview and --default-index for the uv-lock hook (#27935)
• 4827bf7 Export UV_DEFAULT_INDEX in release.sh (#27934)
• d1087a4 [ty] Handle assignment expressions in string annotations (#27921)
• 680cce4 [ty] Optimize inherited recursive protocol comparisons (#27922)
• 974d3cb Upgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (#27932)
• b169b40 Install cargo tools locked (#27929)
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates hypothesis from 6.156.6 to 6.165.10

Commits

• 6384dee Bump hypothesis version to 6.165.10 and update changelog
• c7ca59d Merge pull request #4864 from dgutson/claude-stateful-and-example
• 3fc38f1 claude: teach /hypothesis about stateful tests and @​example
• 16f24b7 Merge pull request #4862 from Zac-HD/claude/upstream-regex-issues-fkke9q
• 48ce446 Bump hypothesis version to 6.165.9 and update changelog
• d559a69 Merge pull request #4860 from Liam-DeVoe/optimize-single-branch-one-of
• 3a19d89 fix context flag restoration
• 2408c99 drop unecessary empty check
• 3f94912 Clarify re.ASCII wording in changelog entry
• 9d0a9a8 Fix from_regex handling of negative classes, re.ASCII, and zero-min repeats
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions