Deps: Bump the dependencies group with 9 updates by dependabot[bot] · Pull Request #795 · greenbone/autohooks

dependabot · 2026-05-25T04:37:12Z

Bumps the dependencies group with 9 updates:

Package	From	To
pontos	`26.4.3`	`26.5.0`
black	`26.5.0`	`26.5.1`
certifi	`2026.4.22`	`2026.5.20`
click	`8.4.0`	`8.4.1`
idna	`3.15`	`3.16`
lxml	`6.1.0`	`6.1.1`
ruff	`0.15.13`	`0.15.14`
snowballstemmer	`3.0.1`	`3.1.0`
soupsieve	`2.8.3`	`2.8.4`

Updates pontos from 26.4.3 to 26.5.0

Release notes

Sourced from pontos's releases.

pontos 26.5.0

26.5.0 - 2026-05-19

👷 Changed

Rename "Status Change" to "CVE Status Change" by @n-thumann in #1220

🚢 Dependencies

Bump urllib3 from 2.6.3 to 2.7.0 by @dependabot[bot] in #1217

Commits

a380de6 Automatic release to 26.5.0
12b9dd2 Change: Rename "Status Change" to "CVE Status Change"
fd0a178 Deps: Bump urllib3 from 2.6.3 to 2.7.0
00adf54 Update: Greenbone license header
a793376 Automatic adjustments after release [skip ci]
See full diff in compare view

Updates black from 26.5.0 to 26.5.1

Release notes

Sourced from black's releases.

26.5.1

Stable style

Fix unstable formatting of annotated assignments whose subscript annotation contains an inline comment (e.g. x: list[ # pyright: ignore[...]) (#5130)

Preserve inline comments (including # type: ignore) immediately before a # fmt: skip line, avoiding AST equivalence failures (#5139)

Packaging

Correct the version in the published executables (#5137)

Documentation

Add Neovim integration guide covering conform.nvim, ALE, and simple command approaches (#5124)

Changelog

Sourced from black's changelog.

Version 26.5.1

Stable style

Fix unstable formatting of annotated assignments whose subscript annotation contains an inline comment (e.g. x: list[ # pyright: ignore[...]) (#5130)

Preserve inline comments (including # type: ignore) immediately before a # fmt: skip line, avoiding AST equivalence failures (#5139)

Packaging

Correct the version in the published executables (#5137)

Documentation

Add Neovim integration guide covering conform.nvim, ALE, and simple command approaches (#5124)

Commits

87928e6 Prepare release 26.5.1 (#5140)
c970a49 Preserve comments before fmt: skip lines (#5139)
5809338 Preserve inline comments inside annotation subscripts (#5130)
61361b7 docs: add Neovim integration guide and fix http link (#5124)
ebe6018 CI Hotfixes (#5136)
9cbd95f Fix publish binaries again on Windows (#5134)
3dc8e6c Add new changelog (#5132)
6d0fff0 Fix publish binaries workflow (#5133)
See full diff in compare view

Updates certifi from 2026.4.22 to 2026.5.20

Commits

d7ea151 2026.05.20 (#413)
See full diff in compare view

Updates click from 8.4.0 to 8.4.1

Release notes

Sourced from click's releases.

8.4.1

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-1 Milestone: https://github.com/pallets/click/milestone/32?closed=1

get_parameter_source() is available during eager callbacks and type conversion again. #3458 #3484

Zsh completion scripts parse correctly on Windows. #3277 # 3466

Shell completion of Choice Enum values produces a valid completion result. #3015

Fix empty byte-string handling in echo. #3487

Fix closed file error with echo_via_pager. #3449

Changelog

Sourced from click's changelog.

Version 8.4.1

Released 2026-05-21

get_parameter_source() is available during eager callbacks and type conversion again. :issue:3458 :issue:3484

Zsh completion scripts parse correctly on Windows. :issue:3277 :pr:3466

Shell completion of Choice Enum values produces a valid completion result. :issue:3015

Fix empty byte-string handling in echo. :issue:3487

Fix closed file error with echo_via_pager. :issue:3449

Commits

6eeb50e release version 8.4.1
67921d5 change log and doc fixes (#3495)
9c41f46 Fix changelog and version admonitions
6cb3477 fix skip condition
5ee8e31 fix I/O operation on closed file error with CliRunner and echo_via_pager (#3482)
becbde5 pager doesn't close std streams
a5f5aa6 Handle empty bytes in echo (#3493)
4d3db84 handle empty bytes in echo
d42f15b Fix get_parameter_source() during type conversion and eager callbacks (#3484)
0baa8db Document ctx.params bypass with test and doc
Additional commits viewable in compare view

Updates idna from 3.15 to 3.16

Changelog

Sourced from idna's changelog.

3.16 (2026-05-22)

Add a command-line interface (python -m idna, also available as the idna script). Encodes or decodes one or more domains supplied as arguments or on standard input, with options to select A-label or U-label output and control error handling.

Raise the minimum supported Python version to 3.9

Various code quality improvements

Commits

6d1a0de Release 3.16
4e6cbe2 Demote installation instruction to usage section
223533c Merge branch 'readme-simplification' into release-3.16
b1640b2 Bump version to 3.16rc0
3a86113 Update history for 3.16 release
d4bc9e7 Merge pull request #246 from kjd/python-3.9
a21d9fc Update deprecation policy
b464926 Raise minimum Python to 3.9 and modernize typing
7f3b15e Explicit example not needed
7530c70 Remove unnecessary print()
Additional commits viewable in compare view

Updates lxml from 6.1.0 to 6.1.1

Changelog

Sourced from lxml's changelog.

6.1.1 (2026-05-18)

Bugs fixed

The known link attributes in lxml.html.defs.link_attrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. GHSA-4jhm-jv67-739f

The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.

The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

Commits

b4a4c59 Build: Fix build in Py3.8.
a116dcb Fix typo: type annotions -> type annotations in PEP 560 comments (GH-504)
7287a75 Prepare release of 6.1.1.
5927a6d Add missing "xlink:href" to the known HTML link attributes.
23efeb4 Build: Fix build in Py3.8.
2c0563b Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...
8a35fcc Fix doctest in PyPy3.9.
See full diff in compare view

Updates ruff from 0.15.13 to 0.15.14

Release notes

Sourced from ruff's releases.

0.15.14

Release Notes

Released on 2026-05-21.

Preview features

[airflow] Implement airflow-task-implicit-multiple-outputs (AIR202) (#25152)

[flake8-use-pathlib] Mark PTH101 fix as unsafe when first argument is a class attribute annotated as int (#25086)

[pylint] Implement too-many-try-statements (W0717) (#23970)

[ruff] Add incorrect-decorator-order (RUF074) (#23461)

[ruff] Add fallible-context-manager (RUF075) (#22844)

Bug fixes

Fix lambda formatting in interpolated string expressions (#25144)

Treat generic frozenset annotations as immutable (#25251)

[flake8-type-checking] Avoid strict behavior when future-annotations are enabled (TC001, TC002, TC003) (#25035)

[pylint] Avoid false positives in else clause (PLR1733) (#25177)

Rule changes

[flake8-comprehensions] Skip C417 for lambdas with positional-only parameters (#25272)

[flake8-simplify] Preserve f-string source verbatim in SIM101 fix (#25061)

Performance

Avoid unnecessary parser lookahead for operators (#25290)

Documentation

Update code example setting Neovim LSP log level (#25284)

Other changes

Add full PEP 798 support (#25104)

Add a parser recursion limit (#24810)

Update various ruff_python_stdlib APIs (#25273)

Contributors

@ocaballeror

@lerebear

@samuelcolvin

@baltasarblanco

@aconal-com

@anishgirianish

@JelleZijlstra

@AlexWaygood

@ntBre

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.14

Released on 2026-05-21.

Preview features

[airflow] Implement airflow-task-implicit-multiple-outputs (AIR202) (#25152)

[flake8-use-pathlib] Mark PTH101 fix as unsafe when first argument is a class attribute annotated as int (#25086)

[pylint] Implement too-many-try-statements (W0717) (#23970)

[ruff] Add incorrect-decorator-order (RUF074) (#23461)

[ruff] Add fallible-context-manager (RUF075) (#22844)

Bug fixes

Fix lambda formatting in interpolated string expressions (#25144)

Treat generic frozenset annotations as immutable (#25251)

[flake8-type-checking] Avoid strict behavior when future-annotations are enabled (TC001, TC002, TC003) (#25035)

[pylint] Avoid false positives in else clause (PLR1733) (#25177)

Rule changes

[flake8-comprehensions] Skip C417 for lambdas with positional-only parameters (#25272)

[flake8-simplify] Preserve f-string source verbatim in SIM101 fix (#25061)

Performance

Avoid unnecessary parser lookahead for operators (#25290)

Documentation

Update code example setting Neovim LSP log level (#25284)

Other changes

Add full PEP 798 support (#25104)

Add a parser recursion limit (#24810)

Update various ruff_python_stdlib APIs (#25273)

Contributors

@ocaballeror

@lerebear

@samuelcolvin

@baltasarblanco

@aconal-com

@anishgirianish

@JelleZijlstra

@AlexWaygood

@ntBre

@adityasingh2400

... (truncated)

Commits

9ad2da3 Bump 0.15.14 (#25295)
c714e84 [ty] Modernize setup of union types in mdtests (#25291)
8a8e35e [flake8-comprehensions] Skip C417 for lambdas with positional-only parame...
aea5ed4 Avoid unnecessary parser lookahead for operators (#25290)
e9d72bb [ty] Allow enum member accesses on self (#25077)
6cbd59b Set exclude-newer = "7 days" in our PEP-723 scripts (#25285)
9999a39 Update code example on how to update Neovim LSP log level (#25284)
67d8c54 [ty] Retain recursively-defined state in binary expressions (#25277)
25a3191 [ty] Refine Callable class-decorator fallback for unknown results (#25250)
c423054 Add a recursion limit to the parser (#24810)
Additional commits viewable in compare view

Updates snowballstemmer from 3.0.1 to 3.1.0

Changelog

Sourced from snowballstemmer's changelog.

Snowball 3.1.0 (2026-05-22)

Compiler changes

Bug fixes:

Fix segmentation fault if -syntax is used on a program with no code.

Fix segmentation fault on some assignment syntax errors.

Fix bug introduced in v3.0.0 with conversion of among starter. If there were any commands after the among in the same command list then the among itself would get lost. Not triggered by any current algorithms.

Clear name field when removing dead assignments. This is visible in the syntax tree shown when command line option -syntax is used, but probably doesn't affect anything otherwise.

Compiler command-line options:

Using - for the Snowball source file is now interpreted as stdin.

Improve comments generated by -comments to show more details of the corresponding Snowball code (e.g. variable names, arithmetic expressions, and literal strings).

Add -coverage option which enables a code coverage feature. So far this tracks which among strings and functions are exercised, and which grouping characters are exercised. !

Support -eprefix for all target languages. This is easy to do and provides a way to deal with externals which collide with keywords in the target language. Our build system now uses -eprefix _ for Python to make the stem external non-public (it is called by BaseStemmer method stemWord()) and we no longer hard-code prefixing Python externals with _.

Describe more options in --help output.

Sort target language options in --help output.

The -o option is now optional. If not specified we now write output(s) to the same filename as the first source, but with a different extension (e.g. path/to/english.sbl -> path/to/english.c and path/to/english.h).

The -o option can now optionally include an extension so you can now write -c++ -o path/to/foo.cxx instead of -c++ -o path/to/foo, which can be more convenient (e.g. in make rules) and also provides an easy way to

... (truncated)

Commits

77e07c9 Update for 3.1.0
4d37f9c Finalise NEWS entry for 3.1.0
2d38e20 make update_version now also updates README.rst
1596c74 Go: Fix code generated for non-constant hop
34d1214 NEWS: Update draft entry
65885b5 finnish: Rename things to match algo description
5c05f53 finnish: Accept apostrophe instead of VI
df25742 JS: Generate simpler code for hop by constant
27c9355 Add runtime test of hop/next
2508d20 Add test coverage for hop 1->next canonicalisation
Additional commits viewable in compare view

Updates soupsieve from 2.8.3 to 2.8.4

Release notes

Sourced from soupsieve's releases.

2.8.4

FIX: Fix another inefficient attribute pattern (@mauriceng98).

FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests (@mauriceng98).

Commits

28108ab Limit excessive selectors
ef18872 Fix test for Windows
eb43976 Merge commit from fork
3a661b2 Fix typo in pseudo-classes.md (#294)
0cb533d Update hatchling version requirement in pyproject.toml (#290)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 9 updates: | Package | From | To | | --- | --- | --- | | [pontos](https://github.com/greenbone/pontos) | `26.4.3` | `26.5.0` | | [black](https://github.com/psf/black) | `26.5.0` | `26.5.1` | | [certifi](https://github.com/certifi/python-certifi) | `2026.4.22` | `2026.5.20` | | [click](https://github.com/pallets/click) | `8.4.0` | `8.4.1` | | [idna](https://github.com/kjd/idna) | `3.15` | `3.16` | | [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.13` | `0.15.14` | | [snowballstemmer](https://github.com/snowballstem/snowball) | `3.0.1` | `3.1.0` | | [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8.3` | `2.8.4` | Updates `pontos` from 26.4.3 to 26.5.0 - [Release notes](https://github.com/greenbone/pontos/releases) - [Commits](greenbone/pontos@v26.4.3...v26.5.0) Updates `black` from 26.5.0 to 26.5.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](psf/black@26.5.0...26.5.1) Updates `certifi` from 2026.4.22 to 2026.5.20 - [Commits](certifi/python-certifi@2026.04.22...2026.05.20) Updates `click` from 8.4.0 to 8.4.1 - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.rst) - [Commits](pallets/click@8.4.0...8.4.1) Updates `idna` from 3.15 to 3.16 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.15...v3.16) Updates `lxml` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-6.1.0...lxml-6.1.1) Updates `ruff` from 0.15.13 to 0.15.14 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.13...0.15.14) Updates `snowballstemmer` from 3.0.1 to 3.1.0 - [Changelog](https://github.com/snowballstem/snowball/blob/main/NEWS) - [Commits](snowballstem/snowball@v3.0.1...v3.1.0) Updates `soupsieve` from 2.8.3 to 2.8.4 - [Release notes](https://github.com/facelessuser/soupsieve/releases) - [Commits](facelessuser/soupsieve@2.8.3...2.8.4) --- updated-dependencies: - dependency-name: pontos dependency-version: 26.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: black dependency-version: 26.5.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: certifi dependency-version: 2026.5.20 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: click dependency-version: 8.4.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: idna dependency-version: '3.16' dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: lxml dependency-version: 6.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: ruff dependency-version: 0.15.14 dependency-type: indirect update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: snowballstemmer dependency-version: 3.1.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: soupsieve dependency-version: 2.8.4 dependency-type: indirect update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-05-25T04:37:40Z

Conventional Commits Report

Type	Number
Dependencies	1

🚀 Conventional commits found.

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels May 25, 2026

dependabot Bot requested review from a team as code owners May 25, 2026 04:37

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels May 25, 2026

greenbonebot enabled auto-merge (rebase) May 25, 2026 04:37

bjoernricks approved these changes May 26, 2026

View reviewed changes

greenbonebot merged commit d6e2f5d into main May 26, 2026
25 checks passed

greenbonebot deleted the dependabot/pip/dependencies-42ec59e766 branch May 26, 2026 06:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deps: Bump the dependencies group with 9 updates#795

Deps: Bump the dependencies group with 9 updates#795
greenbonebot merged 1 commit into
mainfrom
dependabot/pip/dependencies-42ec59e766

dependabot Bot commented on behalf of github May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github May 25, 2026

pontos 26.5.0

26.5.0 - 2026-05-19

👷 Changed

🚢 Dependencies

26.5.1

Stable style

Packaging

Documentation

Version 26.5.1

Stable style

Packaging

Documentation

8.4.1

Version 8.4.1

3.16 (2026-05-22)

6.1.1 (2026-05-18)

Bugs fixed

0.15.14

Release Notes

Preview features

Bug fixes

Rule changes

Performance

Documentation

Other changes

Contributors

0.15.14

Preview features

Bug fixes

Rule changes

Performance

Documentation

Other changes

Contributors

Snowball 3.1.0 (2026-05-22)

Compiler changes

2.8.4

Uh oh!

github-actions Bot commented May 25, 2026

Conventional Commits Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants