chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
actions/cache (changelog)	action	digest	6682284 → 27d5ce7
actions/upload-artifact (changelog)	action	digest	bbbca2d → 043fb46
ansible/actions	repository	patch	v1.1.1 → v1.1.2
astral-sh/uv-pre-commit	repository	patch	0.11.3 → 0.11.7
biomejs/pre-commit	repository	patch	v2.4.10 → v2.4.12
build (changelog)	dependency-groups	patch	1.4.2 → 1.4.3
mypy (changelog)	dependency-groups	patch	1.20.0 → 1.20.1
prek (source, changelog)	dependency-groups	patch	0.3.8 → 0.3.9
pygithub	project.dependencies	patch	2.9.0 → 2.9.1
release-drafter/release-drafter (changelog)	action	digest	139054a → 5de9358
ruff (source, changelog)	dependency-groups	patch	0.15.9 → 0.15.11
tombi	dependency-groups	patch	0.9.16 → 0.9.18	0.9.20 (+1)
tombi-toml/tombi-pre-commit	repository	patch	v0.9.15 → v0.9.18	v0.9.19

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

ansible/actions (ansible/actions)

v1.1.2

Compare Source

Fixes

• fix: make renovate and md hook use version from action (#​112) @​ssbarnea
• fix: force use of newer node (#​121) @​ssbarnea

Maintenance

• chore(deps): update all dependencies pep621 (#​120) @​renovate[bot]
• chore(deps): update all dependencies (#​119) @​renovate[bot]

astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)

v0.11.7

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.11.7

v0.11.6

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.11.6

v0.11.5

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.11.5

v0.11.4

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.11.4

biomejs/pre-commit (biomejs/pre-commit)

v2.4.12

Compare Source

v2.4.11

Compare Source

pypa/build (build)

v1.4.3

Compare Source

What's Changed

• 🐛 fix(api): resolve thread-safety races in build API by @​gaborbernat in #​1015
• 🐛 fix(builder): validate backend-path entries exist on disk by @​gaborbernat in #​1016
• test: cover config settings build paths by @​terminalchai in #​992
• Add kind=(step, ) for root messages with * by @​abitrolly in #​973
• fix: correct changelog category ordering by @​gaborbernat in #​1017
• 🐛 fix(cli): show full dependency chain in missing deps error by @​gaborbernat in #​1019
• tests: fully annotate by @​henryiii in #​1020
• chore: lazy imports by @​henryiii in #​1021
• chore: adding more ruff codes by @​henryiii in #​1022
• tests: improve annotations by @​henryiii in #​1023
• 🧪 test(coverage): achieve 100% test coverage by @​gaborbernat in #​1018
• chore: add ruff PT by @​henryiii in #​1025
• chore: add ruff PYI by @​henryiii in #​1026
• chore: add ruff SIM/RET by @​henryiii in #​1028
• 🐛 fix(env): strip PYTHONPATH from isolated builds by @​gaborbernat in #​1024
• chore: use ruff ALL by @​henryiii in #​1029
• 🐛 fix(env): prevent pip credential hang with private indexes by @​gaborbernat in #​1030
• 🐛 fix(check_dependency): verify URL reqs via PEP 610 by @​gaborbernat in #​1027

New Contributors

• @​terminalchai made their first contribution in #​992

Full Changelog: pypa/build@1.4.2...1.4.3

python/mypy (mypy)

v1.20.1

Compare Source

• Always disable sync in SQLite cache (Ivan Levkivskyi, PR 21184)
• Temporarily skip few base64 tests (Ivan Levkivskyi, PR 21193)
• Revert dict.__or__ typeshed change (Ivan Levkivskyi, PR 21186)
• Fix narrowing for match case with variadic tuples (Shantanu, PR 21192)
• Avoid narrowing type[T] in type calls (Shantanu, PR 21174)
• Fix regression for catching empty tuple in except (Shantanu, PR 21153)
• Fix reachability for frozenset and dict view narrowing (Shantanu, PR 21151)
• Fix narrowing with chained comparison (Shantanu, PR 21150)
• Avoid narrowing to unreachable at module level (Shantanu, PR 21144)
• Allow dangerous identity comparisons to Any typed variables (Shantanu, PR 21142)
• --warn-unused-config should not be a strict flag (Ivan Levkivskyi, PR 21139)

j178/prek (prek)

v0.3.9

Compare Source

Released on 2026-04-13.

Highlight

prek auto-update is now stricter about pinned revisions and more useful in CI.
It now keeps rev and # frozen: comments in sync, can detect
impostor commits when validating pinned SHAs,
and lets you use prek auto-update --check to fail on both available updates and frozen-ref
mismatches without rewriting the config.

Examples:

$ prek auto-update

# updates revs and repairs stale `# frozen:` comments

$ prek auto-update --freeze

# writes frozen SHAs with matching `# frozen: <tag>` comments

$ prek auto-update --check

# exits non-zero when updates are available, a `# frozen:` comment is stale,
# or a pinned SHA does not belong to the fetched upstream refs

Enhancements

• Check and sync frozen comments during auto-update (#​1896)
• Handle impostor commits in auto-update (#​1919)
• Add experimental language: dotnet support (#​1871)
• Honor repo and worktree core.hooksPath (#​1892)
• Add prek run --no-fail-fast to override config file (#​1859)
• Add forbid-new-submodules as builtin hook (#​1853)
• Clean stale patch files in cache gc (#​1877)
• Display auto-update results by config entry (#​1922)
• Restrict patch directory permissions (#​1876)
• Show tag names in auto-update --freeze output (#​1916)
• Use a bitset for hook stages (#​1860)

Bug fixes

• Canonicalize CWD and GIT_ROOT paths (#​1878)
• Ensure quotes are added for non-string revisions in auto-update (#​1936)

Documentation

• Update docs for case of hooks modifying files with a non-zero exit code (#​1879)

Contributors

• @​RicardoVercetti
• @​nathanjmcdougall
• @​renovate
• @​sadjow
• @​j178

pygithub/pygithub (pygithub)

v2.9.1

Compare Source

Bug Fixes

• Fix getting release by tag in lazy mode by @​EnricoMi in PyGithub/PyGithub#3469

Full Changelog: PyGithub/PyGithub@v2.9.0...v2.9.1

astral-sh/ruff (ruff)

v0.15.11

Compare Source

Released on 2026-04-16.

Preview features

• [ruff] Ignore RUF029 when function is decorated with asynccontextmanager (#​24642)
• [airflow] Implement airflow-xcom-pull-in-template-string (AIR201) (#​23583)
• [flake8-bandit] Fix S103 false positives and negatives in mask analysis (#​24424)

Bug fixes

• [flake8-async] Omit overridden methods for ASYNC109 (#​24648)

Documentation

• [flake8-async] Add override mention to ASYNC109 docs (#​24666)
• Update Neovim config examples to use vim.lsp.config (#​24577)

Contributors

• @​augustelalande
• @​anishgirianish
• @​benberryallwood
• @​charliermarsh
• @​Dev-iL

v0.15.10

Compare Source

Released on 2026-04-09.

Preview features

• [flake8-logging] Allow closures in except handlers (LOG004) (#​24464)
• [flake8-self] Make SLF diagnostics robust to non-self-named variables (#​24281)
• [flake8-simplify] Make the fix for collapsible-if safe in preview (SIM102) (#​24371)

Bug fixes

• Avoid emitting multi-line f-string elements before Python 3.12 (#​24377)
• Avoid syntax error from E502 fixes in f-strings and t-strings (#​24410)
• Strip form feeds from indent passed to dedent_to (#​24381)
• [pyupgrade] Fix panic caused by handling of octals (UP012) (#​24390)
• Reject multi-line f-string elements before Python 3.12 (#​24355)

Rule changes

• [ruff] Treat f-string interpolation as potential side effect (RUF019) (#​24426)

Server

• Add support for custom file extensions (#​24463)

Documentation

• Document adding fixes in CONTRIBUTING.md (#​24393)
• Fix JSON typo in settings example (#​24517)

Contributors

• @​charliermarsh
• @​dylwil3
• @​silverstein
• @​anishgirianish
• @​shizukushq
• @​zanieb
• @​AlexWaygood

tombi-toml/tombi (tombi)

v0.9.18

Compare Source

What's Changed

In this release, we have changed the default settings for DocumentLink, enabling document links only for crates.io or pypi.org.

[extensions]
"tombi-toml/cargo" = {
  lsp = {
    document-link = {
      cargo-toml.enabled = false,
      crates-io.enabled = true,
      git.enabled = false,
      path.enabled = false,
      workspace.enabled = false,
    },
  }
}

You can revert to the previous behavior by modifying the configuration file. However, if there is no demand from users, the DocumentLink functionality that has been disabled by default in this release may be removed in the future.

🚀 New Features

• feat: implement LSP features for pyproject and Tombi extensions by @​ya7010 in #​1712
• Refactor extension feature configuration formatting by @​ya7010 in #​1714
• break: change document-link sub-features to default-false by @​ya7010 in #​1716

🛠️ Other Changes

• Ya7010/fix ci pr1700 by @​ya7010 in #​1701
• Add wildcard support for schemas root accessors by @​ya7010 in #​1702
• Abort did_open background tasks on LSP shutdown by @​ya7010 in #​1703
• Fix document link feature toggles by @​ya7010 in #​1706
• Rename ToggleFeature to ToggleFeatureDefaultTrue across the codebase by @​ya7010 in #​1711
• feat: add BoolDefaultFalse type and update extensions to use it by @​ya7010 in #​1713
• Restore extension_features! and toggle_features! macros by @​ya7010 in #​1715

Full Changelog: tombi-toml/tombi@v0.9.17...v0.9.18

v0.9.17

Compare Source

What's Changed

🚀 New Features

• Support BBEdit hang on LSP shutdown by @​ya7010 in #​1690
• feat: Add autolib configuration to disable automatic discovery of lib targets by @​ya7010 in #​1695
• Remove obsolete rustdoc lint schema and update references in cargo.json to use HTTPS URLs by @​ya7010 in #​1696

🐛 Bug Fixes

• Fix oneOf hover branch selection by @​ya7010 in #​1693
• Fix adjacent applicator schema lookups in LSP by @​ya7010 in #​1697
• fix: Align LSP schema resolution with validation by @​ya7010 in #​1698

🛠️ Other Changes

• Split Cargo lint schemas out of cargo.json by @​ya7010 in #​1688
• chore: Mark deprecated lints in cargo-lints-clippy.json by @​ya7010 in #​1689
• Deprecate authors field in cargo.json by @​jelrwi in #​1699

New Contributors

• @​jelrwi made their first contribution in #​1699

Full Changelog: tombi-toml/tombi@v0.9.16...v0.9.17

tombi-toml/tombi-pre-commit (tombi-toml/tombi-pre-commit)

v0.9.18

Compare Source

See: https://github.com/tombi-toml/tombi/releases/tag/v0.9.18

v0.9.17

Compare Source

See: https://github.com/tombi-toml/tombi/releases/tag/v0.9.17

v0.9.16

Compare Source

See: https://github.com/tombi-toml/tombi/releases/tag/v0.9.16

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "before 4am on monday"
• Automerge
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.