build(deps): bump the python-minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the python-minor-patch group with 6 updates in the / directory:

Package	From	To
pypdfium2	5.12.1	5.13.0
python-dotenv	1.2.2	1.2.3
pre-commit	4.6.1	4.6.2
pytest-playwright	0.8.0	0.9.0
reportlab	5.0.0	5.0.1
ruff	0.16.1	0.16.6

Updates pypdfium2 from 5.12.1 to 5.13.0

Release notes

Sourced from pypdfium2's releases.

5.13.0

Release 5.13.0

Summary

• Experimental pyemscripten_2026_0_wasm32 (Pyodide) build support added. However, the resulting builds are flaky at runtime and subject to various types of random crashes. Freezes on shutdown have also been observed. While these issues persist, PyEmscripten wheels will not be uploaded to PyPI, but they are included in the release process and can be downloaded from GitHub on an experimental basis. If you can help track down and fix these issues, please reach out. Note: Our PyEmscripten wheels are bigger than usual, as they are built with debug symbols (a non-debug build is not considered useful at this stage).
• Fixed compatibility with Python 3.6 and 3.7.
  • Runtime support was inadvertently broken due to a faulty cached property backport which held only one cache per class, not per instance as should have been. The accidental loss of caches broke key assumptions of our autoclose logic, which relies on cached_property since 5.8.0. (Earlier versions that did not make extensive use of cached properties might work but have not been explicitly tested.)
  • This release replaces both functools.cached_property and the faulty functools.lru_cache() based backport with our own, backward compatible cached_property implementation along with thorough documentation.
  • Also, fixed setup (i.e. source installation) with Python 3.6 and its max available setup dependency versions (that is, setuptools 59). This had probably been broken for a long time. (A few non-breaking issues remain, e.g. for some reason we end up with a purelib directory, but it should be platlib.)
  • Bear in mind that ctypesgen continues to require Python >=3.8 at this time (3.6 compat not being a priority in that case), but you can install with --no-build-isolation and let the reference bindings be used, or try adding ctypesgen's src/ to PYTHONPATH to bypass setup, and see how it goes.
  • Note: We do not plan to (and practically cannot) keep up compatibility with outdated Python versions indefinitely. In particular, setup compatibility may be dropped sooner or later in favor of contemporary Python packaging concepts, like migrating as much as possible to pyproject.toml. That said, we are happy to restore compatibility at this point, and fix any unintentional breakage.
• Fixed MANIFEST.in missing Windows spoof headers, which resulted in subtly incorrect bindings when installing from an sdist on Windows, as seen in test failures. (Release wheels have been unaffected and passed the test suite, so this issue went unnoticed for a while.)
• Bumped gn-dist from 2407.1 to 2407.3. Made its setup python 3.6 compatible likewise (wheels should have worked before now). Changed versioning and release process so that CI no longer needs to push to the repository (may eventually become a blueprint for pypdfium2 itself). More documentation added, including manylinux2014 POC.
• Internal improvements (non-exhaustive):
  • Properly clean up *.egg-info/ and build/ before packaging, to avoid mad file inclusion bugs (ran into this while working on setup include rules).
  • Migrated from requirements files to PEP 735 dependency groups (pyproject.toml). Recent enough pip should be available to Python >= 3.9. For compatibility with older versions, feel free to use ./utils/misc/install_dep_group.py.
  • Applied dependency cooldowns to internal callers of pip install. Always use virtual environments in CI. Use lockfiles in sensitive areas (e.g. publish jobs).
  • Rearranged & improved utilities. Cleaner distinction between setupsrc/ and utils/.
  • Work around persistent i686 container network issues by downgrading host runner to ubuntu-24.04.
  • Let setupsrc/ share code from src/ through a pypdfium2_cfg._shared submodule that can be added to sys.path.

Build info

This release was made with the following build strategies:

• PBIN: [macosx_arm64, macosx_x86_64, win_amd64, win_arm64, win32, manylinux_x86_64, manylinux_i686, manylinux_aarch64, manylinux_armv7l, manylinux_ppc64le, manylinux_mips64le, android_arm64_v8a, android_armeabi_v7a]
• SBLD: [manylinux_mipsle]
• CIBW: [manylinux_riscv64, manylinux_loongarch64, manylinux_s390x, musllinux_x86_64, musllinux_aarch64, musllinux_armv7l, musllinux_i686, musllinux_ppc64le, musllinux_s390x, musllinux_riscv64, musllinux_loongarch64, pyodide_wasm32]

[!CAUTION] The following builds are affected by known, major issues (e.g. endianness bugs, crashes, freezes) and are NOT considered ready for production use: [manylinux_s390x, musllinux_s390x, pyodide_wasm32]

Commit logs

Commits between 5.12.1 and 5.13.0 (latest commit first):

• a4659102 [autorelease main] update 5.13.0
• 9094de35 continue on changelog/docs
• b89e367a git_net_additions.py: minor tweaks
• 57157e78 readme: don't overdo admonitions
• 033d5ce0 changelog: less waffle
• 5afbd619 install_buildtools: use compat function for dependency group

... (truncated)

Commits

• a465910 [autorelease main] update 5.13.0
• 9094de3 continue on changelog/docs
• b89e367 git_net_additions.py: minor tweaks
• 57157e7 readme: don't overdo admonitions
• 033d5ce changelog: less waffle
• 5afbd61 install_buildtools: use compat function for dependency group
• 3282e36 Add zizmor to check step
• 07b84aa Progress changelog
• 6ec38d2 git_net_additions: further improve fallback
• b5cdd7c git_net_additions: fancier fallback for binary files
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates pre-commit from 4.6.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Commits

• 9767b6c v4.6.2
• 42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
• 3056619 fix language: node for hooks with build scripts and npm 11.x
• See full diff in compare view

Updates pytest-playwright from 0.8.0 to 0.9.0

Release notes

Sourced from pytest-playwright's releases.

v0.9.0

Adds --playwright-debug=cli: pytest pauses at the start of the first context and prints a python -m playwright cli attach … command so agents (or you) can inspect the live browser.

pytest --playwright-debug=cli -s
# ### The test is currently paused at the start
# ### Debugging Instructions
# - Run `python -m playwright cli attach tw-a1b2c3` to attach to this test
python -m playwright cli attach tw-a1b2c3
python -m playwright cli --s=tw-a1b2c3 snapshot
python -m playwright cli --s=tw-a1b2c3 resume

Commits

• 70e8949 feat: add --playwright-debug=cli for Python test agents (#315)
• 765e6e9 chore: require playwright>=1.60 in CI and unskip 1.60 tests (#313)
• See full diff in compare view

Updates reportlab from 5.0.0 to 5.0.1

Updates ruff from 0.16.1 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#28219)
• [flake8-pytest-style] Add an autofix for PT020 (#27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

• Validate unary expressions when parsing (#28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

• Add another example and glob reference for lint.per-file-ignores (#28106)
• Add duplicate work guidance (#28229)
• [flake8-async] Document thread offloading (ASYNC240) (#28008)
• [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

• Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

• @​flying-sheep
• @​pikammmmm
• @​fly1d
• @​waterWang
• @​Pierre-Sassoulas
• @​ntBre
• @​jelle-openai
• @​ericbuehl
• @​tjkuson
• @​AbhinavMir
• @​Whning0513
• @​chirizxc

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#28219)
• [flake8-pytest-style] Add an autofix for PT020 (#27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

• Validate unary expressions when parsing (#28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

• Add another example and glob reference for lint.per-file-ignores (#28106)
• Add duplicate work guidance (#28229)
• [flake8-async] Document thread offloading (ASYNC240) (#28008)
• [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

• Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

• @​flying-sheep
• @​pikammmmm
• @​fly1d
• @​waterWang
• @​Pierre-Sassoulas
• @​ntBre
• @​jelle-openai
• @​ericbuehl
• @​tjkuson
• @​AbhinavMir
• @​Whning0513
• @​chirizxc

... (truncated)

Commits

• 22f65a2 Bump 0.16.6 (#28280)
• 7cc9f1e [ty] Document CallableTypeKind variants (#28277)
• 056ce07 Add UV_LOCKED to all workflows (#28261)
• 6d6e35d [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• 80b4891 [ty] Temporarily disable tuple types in property tests (#28275)
• 3f7a54d [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• 35656cf [ty] Preserve deprecations on decorated callables (#28256)
• d2626c8 [ty] Reject missing attributes on type[] aliases (#28267)
• ee6a6d1 [ty] Support ParamSpecs in ConstraintSet (#28028)
• 7f6a170 [ty] Move bound APIs to constraint owners (#28094)
• Additional commits viewable in compare view