Skip to content

Bump the dev-dependencies group across 1 directory with 8 updates - #21

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/dev-dependencies-0023461a51
Open

Bump the dev-dependencies group across 1 directory with 8 updates#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/dev-dependencies-0023461a51

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the dev-dependencies group with 8 updates in the / directory:

Package From To
mypy 2.3.0 2.3.1
django-stubs[compatible-mypy] 6.0.7 6.1.1
djangorestframework-stubs[compatible-mypy] 3.17.1 3.18.1
ruff 0.16.0 0.16.8
coverage 7.15.2 7.16.1
djlint 1.43.0 1.46.1
pre-commit 4.6.1 4.6.2
pytest-django 4.12.0 4.14.0

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

Updates django-stubs[compatible-mypy] from 6.0.7 to 6.1.1

Release notes

Sourced from django-stubs[compatible-mypy]'s releases.

6.1.1

Highlight

This release does some changes around Manager / RelatedManager and the auto generated objects attribute to work better with typechecker like pyright / ty / pyrefly and be more strict about the fact that MyModel().objects is not valid.

However, to support that, existing broad annotations of related managers need to be narrowed or access to these related managers will be flagged as an error. For ex:

from django.db import models
from django_stubs_ext.db.models.manager import ManyRelatedManager, RelatedManager
class Article(models.Model):

category_set: Manager[Category]


category_set: RelatedManager[Category]


tags: Manager[Tag, ArticleTag]


tags: ManyRelatedManager[Tag, ArticleTag]

If you use the mypy plugin, you should also be able to drop these annotation completely in most cases. The plugin infers these types automatically.

See https://github.com/typeddjango/django-stubs#do-i-need-to-annotate-reverse-relations

What's Changed

New Contributors

... (truncated)

Commits

Updates djangorestframework-stubs[compatible-mypy] from 3.17.1 to 3.18.1

Release notes

Sourced from djangorestframework-stubs[compatible-mypy]'s releases.

3.18.1

This release dropped Python 3.10 support, following django-stubs upstream (requires Python 3.11+ now).

What's Changed

Housekeeping

Full Changelog: typeddjango/djangorestframework-stubs@3.18.0...3.18.1

3.18.0

  • This is the first version to be based on DRF 3.18
  • This is the last version to support django-stubs 6.0.x - next release will require 6.1.x
  • This is the last version to support Python 3.10 - following django-stubs upstream

What's Changed

Housekeeping

Full Changelog: typeddjango/djangorestframework-stubs@3.17.1...3.18.0

Commits
  • 11062a8 Version 3.18.1 release (#1050)
  • 1d74bea Lock file maintenance
  • fd11a58 Fix ManyRelatedField type parameters & relation field default/initial t...
  • fd54923 Fix PrimaryKeyRelatedField pk_field attribute & parameter type (#1047)
  • 3336102 [pre-commit.ci] pre-commit autoupdate (#1046)
  • e4c9d11 Lock file maintenance
  • 3410442 Bump sqlparse from 0.5.5 to 0.6.0 (#1042)
  • 36692fc [pre-commit.ci] pre-commit autoupdate (#1041)
  • 5247f84 Update astral-sh/setup-uv action to v10.0.1 (#1040)
  • 603aa12 Fix remaining items in stubtest allowlist_todo.txt and remove the file (#1039)
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits
  • 62914c4 Bump version to 0.16.8 (#28648)
  • c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
  • ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
  • 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
  • 50020fb [ty] Avoid storing constraint nodes twice (#28375)
  • 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
  • 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
  • d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
  • fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
  • 31131db [ty] Support type[A & B] (#27124)
  • Additional commits viewable in compare view

Updates coverage from 7.15.2 to 7.16.1

Release notes

Sourced from coverage's releases.

7.16.1

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
  • Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

7.16.0

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
  • The Coverage.switch_context() method now returns the previous context.
  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
  • Fixes to validation of options and configuration settings:
    • Negative precision settings now always cause useful error messages (pull 2261).
    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

7.15.4

Version 7.15.4 — 2026-08-06

  • Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
  • Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
  • Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
  • A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
  • Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

Changelog

Sourced from coverage's changelog.

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

  • Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

.. _issue 1563: coveragepy/coveragepy#1563 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

  • The :meth:.Coverage.switch_context method now returns the previous context.

  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

  • Fixes to validation of options and configuration settings:

    • Negative precision settings now always cause useful error messages (pull 2261_).

    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't

... (truncated)

Commits
  • ccbb992 docs: prep for 7.16.1
  • 0697ccc chore: make upgrade
  • 12f3595 chore: bump docker/setup-qemu-action in the action-dependencies group (#2280)
  • 35b58d3 fix: CoverageData.update() can be called twice on an in-memory database. #2279
  • 92e1ce9 chore: bump the action-dependencies group with 4 updates (#2278)
  • bf07310 build: quote var expansion (actionlint SC2086)
  • 3c434f5 quality: use shellcheck-py to get shellcheck in GitHub CI
  • 632f397 build: use .txt instead of .pip, even though it's a stupid extension
  • ffc6a4a test: only run diff-cover on pull requests
  • 33553b3 fix: exclude the case line when an irrefutable case body is excluded (#2269)
  • Additional commits viewable in compare view

Updates djlint from 1.43.0 to 1.46.1

Release notes

Sourced from djlint's releases.

v1.46.1

Fix

  • A second {# #} comment on a line no longer swallows everything back to the first one, so a tag written between two comments is formatted and linted like any other. Before, it kept lines past --max-line-length and hid findings from the rules. A comment now ends at its first #}, which is where django, jinja and nunjucks end it.

v1.46.0

Feature

  • New rule T041 reports an {% extends %} that is not the first tag in the template, which django refuses to compile and which leaks whatever text comes before it into the page. A {# #} comment before it is left alone, as is anything inside a {% comment %}, {% raw %} or {% verbatim %} block, named or not, a {# djlint:off #} region or yaml front matter. An html comment is reported, since it is written into the page ahead of the parent template's doctype, and so is a branch tag on the django profile, where {% if x %}{% extends "a.html" %}{% endif %} does not compile; jinja documents that form and keeps it.
  • New rule T042 reports text or html written after {% extends %} and outside every {% block %}, which the engine silently discards. A template tag there still runs and is left alone, as are comments and the body of a {% macro %}.
  • New rule T043 reports a block name used more than once in a template, which Django, Jinja and Nunjucks all refuse to parse, even where the two blocks sit in different branches of an {% if %}. A {% blocktrans %}, a named {% endblock %}, a block inside a template comment, a {% comment %} block or a {% raw %} or {% verbatim %} body, and the blocks an {% embed %} fills in another template are left alone; a block inside an html comment or a <script> counts, since the engine still parses it.
  • New rule T044 reports a statement keyword inside an output tag, such as {{ if x }}, {{ url 'home' }} or {{ endif }}, where a {% %} block tag was meant. A bare keyword such as {{ url }} is an ordinary variable and is left alone, as is an expression that merely starts with one of the names, such as {{ url ~ "/x" }}, {{ url ? url : '#' }} or {{ block ('title') }}, and so is the body of a {% raw %} or {% verbatim %} block, named or not.
  • New rule T045 reports a statement tag, such as {% include %} or {% if %}, written inside an html comment, where it still runs. A value printed into a comment, as in <!-- built {{ version }} -->, is left alone, and so is a bare Go keyword such as <!-- period {{ start }} to {{ end }} -->, which is an ordinary variable under every other profile, and a {% under handlebars and golang, which have no such syntax. A tag inside a template comment, a {% comment %} block or a raw block is left alone whether it is written with whitespace control, tabs or a named closing tag, as is one inside an Internet Explorer conditional comment, in any case and closed by its <![endif]-->; one left unclosed is the ordinary comment a browser reads it as and is reported.
  • New rule H053 reports an id used more than once in the file, which breaks getElementById, <label for> and fragment links. Two ids in exclusive branches of one {% if %} are never both rendered and are not reported, whichever language writes the branch, and neither are two ids in separate \<template> fragments; a value written by a template tag is left alone.
  • New rule H054 reports an interactive element nested inside another, such as a <button> inside an <a href> or a link inside a button. An <a> without an href is not interactive and is left alone, as is a hidden input or one whose type a template tag writes.
  • New rule H055 reports a lang on <html> that is not a language tag, such as lang="english", lang="en_US" or a value that is only whitespace, which H005 reads as present. An empty value is left to H005, and so is a value written by a template tag or by a php short echo, as in lang="<?= $lang ?>", while a value that merely starts with $ or {, such as lang="$LANG", is read as written. A > written inside a template tag ahead of the attribute, as in {% if a > b %}, does not hide it.
  • New rule H056 reports an empty src on an element that fetches what it names, such as <img src=""> or <script src=""></script>, which a browser resolves to the page itself. A src with no value at all counts too, while an unquoted value such as src=/static/logo.png, a value written by a template tag, a value that is only whitespace, and the separate srcset and data-src attributes are left alone.
  • New rule H057 reports a <video> with no captions track, which WCAG 1.2.2 requires for prerecorded video with sound. A <track> of kind captions or subtitles counts, as does one with no kind, since subtitles is the default, while a commented out track and one written inside an attribute value do not; a muted video is left alone, as is one whose tracks or attributes a template tag may write, meaning a real {{, {%, {# or ${ rather than the brace of a css value or the $ of a jQuery handler or a price.
  • New option --sarif writes the findings as a SARIF 2.1.0 document, which GitHub code scanning, Azure DevOps and most editors read, so a run can be uploaded and kept in the Security tab with history rather than shown only as annotations on one pull request. With --check, a file that would be reformatted is reported under a formatting rule.

Fix

  • A mako <% %> or <%! %> code block is left as written, since its body is python rather than markup. Formatting re-indented it, flattening a return "unit" inside an if to the start of the line and leaving python that no longer parses, and a tag written in a python string was read as markup, so H025, H054 and T001 reported findings inside these blocks. A <%def> body is markup and is still formatted and linted.
  • H037 no longer reads an unquoted attribute value as an attribute name, so <img width=1 height=1> is not reported as a duplicate 1. This started in 1.45.0, and a real duplicate whose values are unquoted and start with /, . or #, as in href=/a href=/b, is now caught too.

v1.45.2

Fix

  • A space beside a template block is kept where the line break next to it is one a {%- or -%} marker strips. The break normally renders the space itself, so djLint drops the space as redundant, but a stripped break renders nothing: {%- if args -%}, {% endif %} followed by {%- for %} lost the space between a macro's arguments.

v1.45.1

  • H037 no longer reads a quoted string inside a template tag as an attribute name, so href="{{ url "/a/b" "/a/c" }}" is not reported as a duplicate a. This started in 1.45.0.
  • A jinja call written over several lines keeps its closing bracket at the indent of the tag holding it, rather than pulling ) }} to the start of the line.
  • Arguments nested inside a jinja call written over several lines keep their depth, so the inner argument of {{ function([nested(...)]) }} is no longer dedented by one level.
  • An element after a line that closes both a template block and an html tag, as in {%- endif %}:</b>, keeps its own level instead of being indented one further.
  • A template tag written over several lines inside an attribute keeps the indentation the author gave it, so the body of data-x='{{ f({ ... }) }}' no longer loses a space from every line.
  • --single-attribute-per-line reaches attributes guarded by a template tag, so {% if x %} a="1" b="2" {% endif %} inside a tag no longer keeps them on one line past --max-line-length.
  • A tag whose attributes push its line past --max-line-length is spread over several lines, where before only --max-attribute-length decided. A line long because of its text is left alone, since breaking text would change what renders.
  • A tag whose name a template writes, as in <{{ tag }}>, is read as a tag. It was not recognised at all, so a template block among its attributes was pulled out of the tag and re-indented to the start of the line, and its attributes went unformatted and unchecked.

v1.45.0

Feature

  • New rule H043 reports a <button> written without a type. A type written inside a template block, as in <button {% if a %}type="button"{% endif %}>, counts.
  • New rule H044 reports a header row holding both th and td cells. The empty td that opens a two-axis table's header row is allowed.
  • New rule H045 reports an <iframe> with no accessible name. title, aria-label and aria-labelledby all count, as does a name written by a template tag.
  • New rule H046 reports a positive tabindex. 0 and -1 are left alone, as is a value written by a template tag.
  • New rule H047 reports aria-hidden="true" on an element that takes focus. Hiding a decorative icon is not reported, nor is a disabled control or one with tabindex="-1".
  • New rule H048 reports an aria- attribute that ARIA does not define, such as a misspelled aria-lable. Framework bindings like :aria-label are left alone.
  • New rule H049 reports a viewport that stops the page being zoomed, by user-scalable=no or a maximum-scale below 2.

... (truncated)

Changelog

Sourced from djlint's changelog.

[1.46.1] - 2026-09-08

Fix

  • A second {# #} comment on a line no longer swallows everything back to the first one, so a tag written between two comments is formatted and linted like any other. Before, it kept lines past --max-line-length and hid findings from the rules. A comment now ends at its first #}, which is where django, jinja and nunjucks end it.

[1.46.0] - 2026-09-07

Feature

  • New rule T041 reports an {% extends %} that is not the first tag in the template, which django refuses to compile and which leaks whatever text comes before it into the page. A {# #} comment before it is left alone, as is anything inside a {% comment %}, {% raw %} or {% verbatim %} block, named or not, a {# djlint:off #} region or yaml front matter. An html comment is reported, since it is written into the page ahead of the parent template's doctype, and so is a branch tag on the django profile, where {% if x %}{% extends "a.html" %}{% endif %} does not compile; jinja documents that form and keeps it.
  • New rule T042 reports text or html written after {% extends %} and outside every {% block %}, which the engine silently discards. A template tag there still runs and is left alone, as are comments and the body of a {% macro %}.
  • New rule T043 reports a block name used more than once in a template, which Django, Jinja and Nunjucks all refuse to parse, even where the two blocks sit in different branches of an {% if %}. A {% blocktrans %}, a named {% endblock %}, a block inside a template comment, a {% comment %} block or a {% raw %} or {% verbatim %} body, and the blocks an {% embed %} fills in another template are left alone; a block inside an html comment or a <script> counts, since the engine still parses it.
  • New rule T044 reports a statement keyword inside an output tag, such as {{ if x }}, {{ url 'home' }} or {{ endif }}, where a {% %} block tag was meant. A bare keyword such as {{ url }} is an ordinary variable and is left alone, as is an expression that merely starts with one of the names, such as {{ url ~ "/x" }}, {{ url ? url : '#' }} or {{ block ('title') }}, and so is the body of a {% raw %} or {% verbatim %} block, named or not.
  • New rule T045 reports a statement tag, such as {% include %} or {% if %}, written inside an html comment, where it still runs. A value printed into a comment, as in <!-- built {{ version }} -->, is left alone, and so is a bare Go keyword such as <!-- period {{ start }} to {{ end }} -->, which is an ordinary variable under every other profile, and a {% under handlebars and golang, which have no such syntax. A tag inside a template comment, a {% comment %} block or a raw block is left alone whether it is written with whitespace control, tabs or a named closing tag, as is one inside an Internet Explorer conditional comment, in any case and closed by its <![endif]-->; one left unclosed is the ordinary comment a browser reads it as and is reported.
  • New rule H053 reports an id used more than once in the file, which breaks getElementById, <label for> and fragment links. Two ids in exclusive branches of one {% if %} are never both rendered and are not reported, whichever language writes the branch, and neither are two ids in separate \<template> fragments; a value written by a template tag is left alone.
  • New rule H054 reports an interactive element nested inside another, such as a <button> inside an <a href> or a link inside a button. An <a> without an href is not interactive and is left alone, as is a hidden input or one whose type a template tag writes.
  • New rule H055 reports a lang on <html> that is not a language tag, such as lang="english", lang="en_US" or a value that is only whitespace, which H005 reads as present. An empty value is left to H005, and so is a value written by a template tag or by a php short echo, as in lang="<?= $lang ?>", while a value that merely starts with $ or {, such as lang="$LANG", is read as written. A > written inside a template tag ahead of the attribute, as in {% if a > b %}, does not hide it.
  • New rule H056 reports an empty src on an element that fetches what it names, such as <img src=""> or <script src=""></script>, which a browser resolves to the page itself. A src with no value at all counts too, while an unquoted value such as src=/static/logo.png, a value written by a template tag, a value that is only whitespace, and the separate srcset and data-src attributes are left alone.
  • New rule H057 reports a <video> with no captions track, which WCAG 1.2.2 requires for prerecorded video with sound. A <track> of kind captions or subtitles counts, as does one with no kind, since subtitles is the default, while a commented out track and one written inside an attribute value do not; a muted video is left alone, as is one whose tracks or attributes a template tag may write, meaning a real {{, {%, {# or ${ rather than the brace of a css value or the $ of a jQuery handler or a price.
  • New option --sarif writes the findings as a SARIF 2.1.0 document, which GitHub code scanning, Azure DevOps and most editors read, so a run can be uploaded and kept in the Security tab with history rather than shown only as annotations on one pull request. With --check, a file that would be reformatted is reported under a formatting rule.

Fix

  • A mako <% %> or <%! %> code block is left as written, since its body is python rather than markup. Formatting re-indented it, flattening a return "unit" inside an if to the start of the line and leaving python that no longer parses, and a tag written in a python string was read as markup, so H025, H054 and T001 reported findings inside these blocks. A <%def&g...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/dev-dependencies-0023461a51 branch from 47d7ceb to 8540943 Compare September 7, 2026 01:47
@dependabot
Bump the dev-dependencies group across 1 directory with 8 updates
d09b534 
Bumps the dev-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [django-stubs[compatible-mypy]](https://github.com/typeddjango/django-stubs) | `6.0.7` | `6.1.1` |
| [djangorestframework-stubs[compatible-mypy]](https://github.com/typeddjango/djangorestframework-stubs) | `3.17.1` | `3.18.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.8` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.2` | `7.16.1` |
| [djlint](https://github.com/djlint/djLint) | `1.43.0` | `1.46.1` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.1` | `4.6.2` |
| [pytest-django](https://github.com/pytest-dev/pytest-django) | `4.12.0` | `4.14.0` |



Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)

Updates `django-stubs[compatible-mypy]` from 6.0.7 to 6.1.1
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.7...6.1.1)

Updates `djangorestframework-stubs[compatible-mypy]` from 3.17.1 to 3.18.1
- [Release notes](https://github.com/typeddjango/djangorestframework-stubs/releases)
- [Commits](typeddjango/djangorestframework-stubs@3.17.1...3.18.1)

Updates `ruff` from 0.16.0 to 0.16.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.8)

Updates `coverage` from 7.15.2 to 7.16.1
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.2...7.16.1)

Updates `djlint` from 1.43.0 to 1.46.1
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.43.0...v1.46.1)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `pytest-django` from 4.12.0 to 4.14.0
- [Release notes](https://github.com/pytest-dev/pytest-django/releases)
- [Changelog](https://github.com/pytest-dev/pytest-django/blob/main/docs/changelog.rst)
- [Commits](pytest-dev/pytest-django@v4.12.0...v4.14.0)

---
updated-dependencies:
- dependency-name: coverage
  dependency-version: 7.15.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: django-stubs[compatible-mypy]
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: djangorestframework-stubs[compatible-mypy]
  dependency-version: 3.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: djlint
  dependency-version: 1.44.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: pytest-django
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: ruff
  dependency-version: 0.16.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/dev-dependencies-0023461a51 branch from 8540943 to d09b534 Compare September 21, 2026 01:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants