Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/checkout	action	patch	v7.0.0 → v7.0.1
canonical/charm-ci	action	patch	v0.0.1-alpha.9 → v0.0.1-alpha.10
cosl	project.dependencies	patch	==1.10.1 → ==1.10.2
jubilant	dependency-groups	minor	==1.11.0 → ==1.12.0
ops (changelog)	project.dependencies	patch	==3.8.0 → ==3.8.1
packaging		minor	==26.2 → ==26.3
playwright (changelog)	dependency-groups	minor	==1.61.0 → ==1.62.0
requests (changelog)	dependency-groups	minor	==2.32.5 → ==2.34.2
sphinxcontrib-mermaid (changelog)		minor	==2.0.3 → ==2.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

canonical/charm-ci (canonical/charm-ci)

v0.0.1-alpha.10

Compare Source

This is expected to be the last alpha release before 1.0.0, pending no
new issues surfacing. See Versioning policy.

Changed

• Breaking: artifacts.build.yaml and the expanded spread.yaml/task.yaml
  tree now live under build/ instead of the project root. Update any
  external tooling/scripts that read artifacts.build.yaml directly from the
  project root. (#​118)
• GitHub Release creation on opcli artifacts publish is now optional
  (previously always created); per-arch/base fan-out in publish output was
  also reduced. (#​122, #​129)
• opcli spread jobs output is now sorted for deterministic CI matrix
  ordering. (#​119)
• Renamed the concierge-microk8s.yaml example to concierge-k8s.yaml and
  switched it to the canonical k8s provider. (#​124)
• CI's test job now runs against an explicit Python 3.12/3.13 matrix
  instead of relying on uv's default interpreter resolution.

Fixed

• Fixed a false-positive transport-prefix detection in upload-resource for
  host:port-style OCI references. (#​120)
• opcli artifacts publish now retries known-transient CharmHub upload
  failures (connection resets, upload-status polling timeouts) with
  exponential backoff. (#​115)
• base: null no longer appears in artifacts.build.yaml for charms that use
  charmcraft.yaml's base: field with arch-only platforms: keys (e.g.
  platforms: {amd64:}); the base is now read from charmcraft.yaml as a
  fallback when it cannot be parsed from the packed filename. (#​107)
• Fixed pyproject.toml/__init__.py's hardcoded version string (stuck at
  0.0.1-alpha.2 since alpha.2 despite 8 subsequent tagged releases);
  __version__ is now derived from installed package metadata.

Added

• Support for GitHub Environment-scoped secrets via an optional environment
  input on integration-test.yml and publish-artifacts.yml, forwarded to
  the relevant jobs. (#​123)
• opcli --version flag.
• --verbose/-v global flag to surface internal logger.info() output
  (previously invisible by default).
• Complete PyPI-style package metadata (readme, license, authors,
  keywords, classifiers) in pyproject.toml. (#​131)

Docs

• Documented the TOX_ENV environment variable for overriding the default
  tox environment. (#​87)
• Clarified AI agents must never merge PRs policy in AGENTS.md.
• Added a Versioning policy section to
  README.md and this CHANGELOG.md.

canonical/cos-lib (cosl)

v1.10.2

Compare Source

What's Changed

• feat: persist the cos-tool result cache across processes by @​Abuelodelanada in #​203

Full Changelog: canonical/cos-lib@1.10.1...1.10.2

canonical/jubilant (jubilant)

v1.12.0

Compare Source

Features

• Improve Jubilant logging mechanism (#​351)
• Bump minimum python version to 3.10 (#​370)

Chores

• Rolling uv exclude-newer supply-chain quarantine (#​368)
• Set dependabot commit-message prefix to "chore" (no scope) (#​367)
• Add Code of Conduct linking to Ubuntu CoC (#​356)
• Run uv lock after adding exclude-newer duration (#​372)

CI

• Adopt new dependabot conventions (#​365)
• Hash-pin actions and drop zizmor config (#​366)
• Correct hash-pin version comment for upload-sarif action (#​376)
• Pin action version comments to exact tags (#​378)

canonical/operator (ops)

v3.8.1

Compare Source

Fixes

• Align Juju naming rules with testing class rules (#​2570)
• Do not attempt to mutate secret data in grant/revoke during tests (#​2614)
• Allow IdentityDict to be assigned IdentityAccess (#​2628)
• Only decode fields used by the data class in Relation.load() (#​2636)
• Use juju.wait for workload version tests in Kubernetes tutorial (#​2650)

Documentation

• Wait longer for Loki data in Kubernetes tutorial integration tests (#​2611)
• Add more guidance about charm naming (#​2610)
• Fix tempo test_deploy URL (#​2631)
• Add how-to guide for debugging Kubernetes charms (#​2498)
• Revert to installed charmcraft for initing charms (#​2635)
• Grab workload version in Kubernetes tutorial (#​2559)
• Separate test_workload_version_is_set in Kubernetes tutorial chapter 3 (#​2638)
• Add how-to guide to configure jubilant logs (#​2619)
• Use autofunction for layer_from_rockcraft (#​2648)
• Remove log_cli and log_file ini options; keep them as CLI arguments for integration tests (#​2654)
• Fix typo in explanation of mock_version fixture usage (#​2647)
• Switch Kubernetes tutorial charms to rock version of demo server (#​2649)

Tests

• Type-check testing/src/scenario and fix uncovered errors (#​2615)

CI

• Add dependency-review-action on PRs (#​2587)
• Re-enable the tracing integration tests (#​2586)
• Adopt new dependabot conventions (#​2609)
• Drop unsupported cooldown.semver-major-days from github-actions block (#​2617)
• Open an issue if a scheduled workflow fails (#​2627)
• Hash-pin actions and drop zizmor config (#​2612)
• Use uv-venv-lock-runner in tracing tox, align deps (#​2651)

pypa/packaging (packaging)

v26.3

Compare Source

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#​1267, #​1270, #​1298)
• PEP 808: accept Metadata-Version: 2.6. (#​1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#​1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#​1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#​1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#​1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#​1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#​160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#​1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#​1241)
• Fix an AttributeError when hashing internally trimmed versions. (#​1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#​1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#​1232)
• Normalize requested extra names before comparing or hashing requirements. (#​644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#​1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#​1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#​1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#​1213)
• Keep the parentheses of a nested group when serializing markers. (#​1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#​1246, #​1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#​1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#​1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#​1249)
• Reject requirements and markers with a trailing line break. (#​1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#​1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#​1330)
• Reject malformed Description-Content-Type values. (#​1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#​1327)
• Route multipart email payloads to unparsed instead of asserting. (#​1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#​1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#​1356)
• Raise InvalidLicenseExpression for misplaced WITH clauses and empty LicenseRef- names. (#​1266)
• Raise InvalidLicenseExpression instead of KeyError for a LicenseRef- with a + suffix. (#​1219)

Fixes for tags and filenames

• Raise InvalidTag from parse_tag() for tags with the wrong number of components. (#​1238)
• Reject empty tag components in parse_wheel_filename() and parse_tag(). (#​1234)
• Reject an empty project name in the wheel and sdist filename parsers. (#​1305)
• Reject wheel filenames with a trailing newline. (#​1341)
• Reject wheel tags whose interpreter component is not an identifier. (#​577)
• is_normalized_name now rejects names with collapsed double hyphens like a--b. (#​1230)
• Fix duplicate explicit abi3t tags. (#​1245)
• Forward the warn argument to generic_tags() in sys_tags(). (#​1264)
• Raise SystemError for an empty or malformed CPython EXT_SUFFIX. (#​1271, #​1301)
• Fix a typo in the macOS fat3 architecture name (was fat32). (#​1199)

Fixes for pylock, direct URLs, and dependency groups

• Percent-decode pylock artifact file names derived from a url so that local versions (e.g. a wheel with 2.12.1+cu130 encoded as 2.12.1%2Bcu130) yield a valid file name. (#​1314)
• Use an explicitly empty tags sequence in Pylock.select() instead of falling back to sys_tags(). (#​1349)
• Fix Pylock.select() on Python builds that report a non-PEP 440 python_full_version (e.g. 3.15.0+). (#​1179)
• Reject TOML booleans where integers are expected in pylock files. (#​1244)
• Add PylockSelectError to packaging.pylock.__all__. (#​1202)
• Fix DirectUrl credential stripping for passwords containing @. (#​1218)
• Parse the URL scheme case-insensitively when checking for file URLs in direct_url. (#​1240)
• Require absolute file URLs for local directories in direct_url. (#​1297)
• Collect InvalidRequirement errors while resolving dependency groups instead of leaking them. (#​1302)
• Don't cache malformed dependency group parses. (#​1248)

Performance

• Implement Specifier and SpecifierSet filtering with the new range engine. (#​1120, #​1259)
• Cache the default marker environment. (#​1250)
• Cache the _manylinux module lookup process-wide. (#​1254)
• Add __slots__ to Requirement and the token classes. (#​1320, #​1258)
• Keep range caches across canonicalization, precompile the wheel project-name pattern, simplify parse_tag(), and skip platform.mac_ver() when the version and arch are given. (#​1253, #​1256, #​1236, #​1255)

Documentation

• Describe the validation scope of packaging.pylock. (#​1339)
• Explain which packaging.metadata fields are validated. (#​1342)
• Document RFC822Policy in the low-level packaging.metadata interface. (#​1222)
• Enable nitpicky mode and render missing classes and fields in the API reference. (#​1196, #​1225, #​1277)
• Add missing versionadded / versionchanged directives and many small docstring fixes across the API reference. (#​1205, #​1207, #​1208, #​1209, #​1211, #​1216, #​1217, #​1223, #​1272, #​1273, #​1274, #​1291, #​1300, #​1303, #​1317, #​1344)

Internal

• Add Python 3.15 to the test matrix. (#​1190)
• Add a musl/Alpine test job and make the test suite pass on musl. (#​1226, #​1227)
• Expand the downstream test matrix by ten projects. (#​1261)
• Update to mypy 2. (#​1191)
• Use nox's uv integration. (#​1057)

New Contributors

• @​Sean-Kenneth-Doherty made their first contribution in #​1187
• @​jsirois made their first contribution in #​1199
• @​Alan-K-Biju-7 made their first contribution in #​1217
• @​facutuesca made their first contribution in #​1218
• @​NovaLux12 made their first contribution in #​1317
• @​atsuoishimoto made their first contribution in #​1314
• @​gaoflow made their first contribution in #​1291
• @​jacobdr made their first contribution in #​608
• @​deepakganesh78 made their first contribution in #​1351
• @​rajath201 made their first contribution in #​1356

Full Changelog: pypa/packaging@26.2...26.3

Microsoft/playwright-python (playwright)

v1.62.0

Compare Source

🖼️ WebP screenshots

page.screenshot() and locator.screenshot() can now capture screenshots in the WebP format. Playwright infers the format from a .webp file extension, or you can set the type explicitly. Quality 100 (the default) is lossless, while lower values use lossy compression:

page.screenshot(path="homepage.webp", quality=50)

New APIs

• New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scrolling into view.
• New locator.wait_for_function() waits until a function called with the matching element returns a truthy value.
• New apiResponse.timing() returns resource timing information for an API response.

Announcements

• 📋 The clipboard is now isolated from the operating system in headless mode, so tests that use navigator.clipboard no longer read or overwrite the clipboard of the machine running them.
• ⚠️ Debian 11 is not supported anymore.

Browser Versions

• Chromium 151.0.7922.34
• Mozilla Firefox 153.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 151
• Microsoft Edge 151

psf/requests (requests)

v2.34.2

Compare Source

• Moved headers input type back to Mapping to avoid invariance issues
  with MutableMapping and inferred dict types. Users calling
  Request.headers.update() may need to narrow typing in their code. (#​7441)

v2.34.1

Compare Source

Bugfixes

• Widened json input type from dict and list to Mapping
  and Sequence. (#​7436)
• Changed headers input type to MutableMapping and removed None from
  Request.headers typing to improve handling for users. (#​7431)
• Response.reason moved from str | None to str to improve handling
  for users. (#​7437)
• Fixed a bug where some bodies with custom __getattr__ implementations
  weren't being properly detected as Iterables. (#​7433)

v2.34.0

Compare Source

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by
  typeshed. Public API types should be fully compatible with mypy, pyright,
  and ty. We believe types are comprehensive but if you find issues, please
  report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for
  helping review and test the types ahead of the release. (#​7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify
  security considerations. (#​7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects
  should be able to start testing prior to its release in October. (#​7422)
• Requests added support for Python 3.14t. (#​7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing
  accidental looping when traversing the history list. (#​7328)
• Requests no longer performs greedy matching on no_proxy domains. The
  proxy_bypass implementation has been updated with CPython's fix from
  bpo-39057. (#​7427)
• Requests no longer incorrectly strips duplicate leading slashes in
  URI paths. This should address user issues with specific presigned
  URLs. Note the full fix requires urllib3 2.7.0+. (#​7315)

v2.33.1

Compare Source

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
  files in the tmp directory. (#​7305)
• Fixed Content-Type header parsing for malformed values. (#​7309)
• Improved error consistency for malformed header values. (#​7308)

v2.33.0

Compare Source

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that
  uses Requests, please take a look at #​7271. Give it a try, and report
  any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts
  contents to a non-deterministic location to prevent malicious file
  replacement. This does not affect default usage of Requests, only
  applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#​7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause
  malformed authentication to be applied to Requests on
  Python 3.11+. (#​7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#​7196)

Documentation

• Various typo fixes and doc improvements.

mgaitan/sphinxcontrib-mermaid (sphinxcontrib-mermaid)

v2.1.0

Compare Source

• Add mermaid_config option for passing a global Mermaid configuration (#​215)
• Load the ZenUML plugin lazily, only on pages that contain a ZenUML diagram, and confine its injected stylesheet to the diagram subtree so it no longer restyles the host theme (#​252)
• Skip injecting the Mermaid JavaScript when the output format does not support it (#​253)
• Fix d3 zoom on nested SVGs (#​179)
• Fix fullscreen button positioning inconsistency (#​225)
• Fix interactions between the fullscreen, zoom, and lazy-render features (#​254)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.