[dependabot]

Bumps the python group with 15 updates in the /src directory:

Package	From	To
anyio	4.15.1	4.16.0
bazel-runfiles	2.4.5	2.4.6
click	8.5.0	8.5.1
docutils	0.22.4	0.23
fonttools	4.67.0	4.68.0
jsonschema-rs	0.52.1	0.60.3
minijinja	2.24.0	3.0.5
pydata-sphinx-theme	0.23.0	0.24.0
pyfakefs	6.2.0	6.3.2
pytest	9.1.1	9.2.0
python-dateutil	3.0.0	4.0.0
soupsieve	3.0.4	4.0.1
sphinx-mounts	0.2.0	0.3.1
sphinx-needs	8.5.0	9.2.0
websockets	17.3	17.4

Updates anyio from 4.15.1 to 4.16.0

Release notes

Sourced from anyio's releases.

4.16.0

New features

• Added BlockingPortal.call_async() for asynchronously calling into an event loop with optional abandonment on cancellation (#1342; PR by @​davidbrochart)
• Added SOCK_SEQPACKET support to connect_unix() and create_unix_listener() (#1349; PR by @​theunkn0wn1)

Other changes

• Changed UDP sockets on the asyncio backend to make send() wait until the datagram has been passed to the operating system (#1294; PR by @​graingert)

Bug fixes

• Fixed documentation implying that use_uvloop=True falls back to the standard event loop when uvloop (winloop on Windows) is not installed, and showed how to skip the corresponding pytest backend variant when the dependency is missing (#645; PR by @​GruffElixir)
• Fixed get_current_task() on the asyncio backend raising an opaque TypeError: cannot create weak reference to 'NoneType' object instead of a clear error when called from a callback scheduled via loop.call_soon_threadsafe() (e.g. from within from_thread.run_sync()), where asyncio.current_task() is legitimately None (#773; PR by @​AmirF194)
• Fixed CancelScope on the asyncio backend swallowing a native Task.cancel() that was delivered in the same event loop iteration as the scope's own cancellation (such as a move_on_after() deadline expiring), which left the host task with a pending cancellation request that never raised CancelledError (#1214)
• Fixed UDP socket closing hanging if a datagram send was still in flight (#1237; PR by @​graingert)
• Fixed concurrent aclose_forcefully() calls on asyncio socket streams returning before the underlying socket was closed (#1273; PR by @​graingert)
• Fixed aclose() on sockets not checkpointing, and thus failing to raise a cancellation exception when called inside a cancelled scope (affected UNIX socket streams and UNIX datagram sockets on asyncio, and all sockets on Trio) (#1288; PR by @​graingert)
• Fixed aclose() on asyncio TCP socket listeners not checkpointing, and leaking the listening socket if cancelled while another task was waiting in accept() (#1289; PR by @​graingert)
• Fixed accept() on asyncio UNIX socket listeners hanging forever, and leaving the listening socket registered with the event loop, when the listener was closed by another task (#1289; PR by @​graingert)
• Fixed send() on asyncio TCP and UDP sockets returning normally, despite the data being discarded, when the socket was closed by another task (or, for TCP, the connection was lost) while send() was waiting for the operating system to accept the data (#1289; PR by @​graingert)
• Fixed SocketStream.send() on the asyncio backend handing its data to a paused transport after a previous send() was cancelled (#1299; PR by @​graingert)
• Fixed sleep() treating a negative delay (including -inf) inconsistently across backends (asyncio returned immediately; Trio raised ValueError) by raising ValueError on all backends (#1306; PR by @​BetterAndBetterII)
• Fixed create_tcp_listener() occasionally failing with a message like Could not create 2 listeners with a consistent port when an ephemeral port is requested and IPv6 is enabled and the dual-stack path is not available or a specific local host name was given (#1313)
• Fixed AsyncFile not shielding against cancellation while closing (#1314)
• Fixed TemporaryDirectory.cleanup() reacting to cancellation prematurely when the host task was already cancelled, causing the actual cleanup operation to be skipped (#1316; PR by @​Yasser-Ameur)
• Fixed a NaN deadline being accepted on asyncio while Trio raised ValueError, which silently disabled the timeout (fail_after(math.nan) returned instead of raising TimeoutError); CancelScope now rejects it on both backends (#1317; PR by @​dylanpulver)
• Fixed FileReadStream and FileWriteStream leaving files open when cancelled during context manager exit, including unflushed writes (#1318; PR by @​Kuang-xianxin)
• Fixed Condition.notify() and Condition.notify_all() failing when the underlying lock was acquired directly rather than through the condition (#1319; PR by @​GruffElixir)
• Fixed importing AnyIO with loaders that do not provide __file__, such as PyOxidizer, raising TypeError instead of falling back to eager imports (#1322; PR by @​skulitom)
• Fixed text receive streams silently discarding incomplete characters at end-of-file instead of applying the configured decoding error handler (#1339; PR by @​Aurelucien)
• Fixed Semaphore(fast_acquire=True) losing its fast-acquire behavior when instantiated outside a running event loop (#1348; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider permanently failing with an AttributeError on every subsequent use if the first attempt to start its blocking portal failed (#1350; PR by @​Yasser-Ameur)
• Fixed create_udp_socket() silently ignoring the local_port argument when local_host was omitted, making the socket bind to a random ephemeral port instead of the requested one (#1351; PR by @​januththedev)
• Fixed worker threads on the asyncio backend never returning to the idle pool (and thus never being reused or pruned) when a to_thread.run_sync() call was cancelled after it had been queued for the worker but before the worker thread had picked it up (#1352; PR by @​Zac-HD)
• Fixed pytest plugin running Hypothesis async tests only on the first parametrized backend instead of each backend (#1353; PR by @​DYNOSuprovo)
• Fixed TypeError when subclassing an existing TypedAttributeSet subclass, and this subclass contains type annotations (#1358; PR by @​pasmud)
• Fixed Lock.locked() (and Condition.locked()) raising NoEventLoopError when the lock was created outside a running event loop (#1362; PR by @​00200200)
• Fixed connect_tcp() leaking a connected socket when an enclosing cancel scope was cancelled before the connection attempt task group exited (#1364; PR by @​charan-rathore)
• Fixed create_connected_udp_socket() silently ignoring local_port when local_host was not given: the local address was left unset, so the OS picked an ephemeral port instead of the requested one (#1365; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider not passing the exception raised in its with block on to the start_blocking_portal() context manager it wraps (#1366; PR by @​feiiiiii5)
• Fixed anyio.itertools.islice() not consuming the first start items when stop <= start (#1372; PR by @​Rodrigo-Palma)
• Fixed BufferedByteReceiveStream.receive_exactly() and receive_until() returning buffered data after explicit closure instead of raising ClosedResourceError (#1378; PR by @​kokotatan)
• Fixed a TLS stream sending records the peer could no longer decrypt after a cancelled send() lost an already-encrypted record; the stream now raises BrokenResourceError on further use instead (#1385; PR by @​Kayvan-Zahiri)
• Fixed close() on memory object streams not waking up tasks blocked in send() or receive() on the same stream (#1391)
• Fixed anyio.itertools.product() acquiring and consuming unused input iterables when repeat=0 (#1394; PR by @​sricharanreddycheruku)
• Fixed SpooledTemporaryFile rolling over to disk on writes when max_size is zero (the default) (#1397; PR by @​fhgffy)
• Fixed Trio UDP sockets remaining open when initialization failed or was cancelled (#1400; PR by @​adenzhou1350)
• Fixed SpooledTemporaryFile.rollover() moving the current file position to the end of the file (#1401; PR by @​fhgffy)
• Fixed cancellation during temporary directory creation leaving the directory behind while its context manager is retained (#1403; PR by @​adenzhou1350)

... (truncated)

Commits

• 0ddd02d Released version 4.16.0
• 576892e Fixed certain pending tasks not woken up by the closing of memory object stre...
• 02ff4f8 Added BlockingPortal.call_async() (#1343)
• 1af29a4 Moved documentation code snippets into separate, checked files (#1445)
• f01c041 [pre-commit.ci] pre-commit autoupdate (#1448)
• 95a0143 Test with blockbuster and uvloop on Python 3.15 too
• 4d51154 Modernized the memory object stream tests
• 1e4b448 Fixed the as_connectable() example in the networking docs (#1442)
• cd21b36 Fixed TypedAttributeSet not collecting annotations from superclasses (#1358)
• b7f8c68 [pre-commit.ci] pre-commit autoupdate (#1431)
• Additional commits viewable in compare view

Updates bazel-runfiles from 2.4.5 to 2.4.6

Release notes

Sourced from bazel-runfiles's releases.

2.4.6

For more detailed setup instructions, see https://rules-python.readthedocs.io/en/latest/getting-started.html

For the user-facing changelog see here

Using Bzlmod

Add to your MODULE.bazel file:

bazel_dep(name = "rules_python", version = "2.4.6")
python = use_extension("@​rules_python//python/extensions:python.bzl", "python")
python.toolchain(
python_version = "3.14",
)
pip = use_extension("@​rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
hub_name = "pypi",
python_version = "3.14",
requirements_lock = "//:requirements_lock.txt",
)
use_repo(pip, "pypi")

Using WORKSPACE

Paste this snippet into your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
name = "rules_python",
sha256 = "4765b9a4a9c6e0fb89f465aac5b5b0ac06589c9477144340859310777ad801a7",
strip_prefix = "rules_python-2.4.6",
url = "https://github.com/bazel-contrib/rules_python/releases/download/2.4.6/rules_python-2.4.6.tar.gz",
)
load("@​rules_python//python:repositories.bzl", "py_repositories")
py_repositories()

Gazelle plugin

Paste this snippet into your WORKSPACE file:

... (truncated)

Changelog

Sourced from bazel-runfiles's changelog.

2.4.6 - 2026-10-29

{#v2-4-6-changed}

Changed

• (toolchains) Updated default Python toolchains to 3.10.22, 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2, and removed 3.15.0 pre-release toolchains (#4358).

{#v2-4-5}

Commits

• 943362f feat(toolchains): update Python toolchains to latest patch releases (#4369)
• See full diff in compare view

Updates click from 8.5.0 to 8.5.1

Release notes

Sourced from click's releases.

8.5.1

This is the Click 8.5.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.5.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-1 Milestone: https://github.com/pallets/click/milestone/66

• Fix copy.deepcopy() and pickle on a Parameter, Option or Command. #3805
• A KeyboardInterrupt arriving while Command.main() reports an abort or an error, or while it exits, no longer escapes as an unhandled traceback. The command still exits with the intended code; only the message may be lost. #3802
• Add Option.get_help_spec(), which returns the option's left help column even when the option is hidden. Option.get_help_record() still returns None for hidden options, so help screens are unchanged. #3821
• The Positional arguments help section lists every argument of the command, not only the documented ones. An argument with no help gets an empty description, the same way an option with no help does. #3860
• Argument.get_help_record() always returns a tuple. It used to return None for an argument with no help. #3860
• Document which types are inferred from default, and what an unrecognized type callable does to a command-line value. #3036 #3808
• path_type narrows the converted value's type for convert and prompt. #3822 #3858
• Parameter accepts a new help argument, and Option and Argument inherit it. Parameter.to_info_dict() now reports help for every kind of parameter. #3861
• A command's short help no longer stops at an abbreviation such as vs. or e.g. inside the first sentence. A period ends the sentence only when it closes the text or the next word does not start in lowercase. #3865
• With show_envvar=True, an option's error message now prints all variables of an envvar sequence instead of the repr of the sequence. #3884
• An empty envvar, such as [] or "", shows the same help and error message as no envvar when show_envvar=True. The help screen used to show [env var: ]. #3884
• Align command's deprecated help text to options and arguments: do not translate the command's own help text, only the (DEPRECATED) label. #3901

Changelog

Sourced from click's changelog.

Version 8.5.1

Released 2026-11-09

• Fix copy.deepcopy() and pickle on a Parameter, Option or Command. {pr}3805
• A KeyboardInterrupt arriving while Command.main() reports an abort or an error, or while it exits, no longer escapes as an unhandled traceback. The command still exits with the intended code; only the message may be lost. {issue}3802
• Add {meth}Option.get_help_spec, which returns the option's left help column even when the option is hidden. {meth}Option.get_help_record still returns None for hidden options, so help screens are unchanged. {pr}3821
• The Positional arguments help section lists every argument of the command, not only the documented ones. An argument with no help gets an empty description, the same way an option with no help does. {pr}3860
• {meth}Argument.get_help_record always returns a tuple. It used to return None for an argument with no help. {pr}3860
• Document which types are inferred from default, and what an unrecognized type callable does to a command-line value. {issue}3036 {pr}3808
• path_type narrows the converted value's type for convert and prompt. {issue}3822 {pr}3858
• {class}Parameter accepts a new help argument and {class}Option and {class}Argument inherits it. {meth}Parameter.to_info_dict now reports help for every kind of parameter. {pr}3861
• A command's short help no longer stops at an abbreviation such as vs. or e.g. inside the first sentence. A period ends the sentence only when it closes the text or the next word does not start in lowercase. {pr}3865
• With show_envvar=True, an option's error message now prints all variables of an envvar sequence instead of the repr of the sequence. {pr}3884
• An empty envvar, such as [] or "", shows the same help and error message as no envvar when show_envvar=True. The help screen used to show [env var: ]. {pr}3884
• Align command's deprecated help text to options and arguments: do not translate the command's own help text, only the (DEPRECATED) label. {pr}3901

Commits

• cf19179 Release version 8.5.1
• 1ff766d Remove documentation changelog entry.
• 16da191 Add a standalone application guide for Nuitka (#3897)
• 473f652 Remove issue and PR references outside the changelog (#3905)
• df7fe0b Remove issue and PR references outside the changelog
• 4fd4206 Bump pypa/gh-action-pypi-publish to v1.14.3 (#3906)
• 9048ab0 Bump pypa/gh-action-pypi-publish to v1.14.3
• ff0c369 Add a standalone application guide for Nuitka
• 5125851 Stop passing a deprecated command's help text through gettext (#3901)
• 6d34602 Additional round-trip tests for unstyle() (#3899)
• Additional commits viewable in compare view

Updates docutils from 0.22.4 to 0.23

Commits

• See full diff in compare view

Updates fonttools from 4.67.0 to 4.68.0

Release notes

Sourced from fonttools's releases.

4.68.0

• [feaLib] Escape " and \ when writing names back out with asFea() in FeatureNameStatement, STATNameStatement and CVParametersNameStatement (#4321).
• [scaleUpem] Also scale the MATH lengths that are not MathValueRecords (DelimitedSubFormulaMinHeight, DisplayOperatorMinHeight, MinConnectorOverlap, etc.) (#4327).
• [cffLib] Inherit the initial CFF2 vsindex from the Private DICT when decompiling, specializing and instancing charstrings, and fix programToCommands miscounting operands when several blend operators precede the first stem or moveto (#4337, #4339).
• [instancer] Round CFF2 outlines and stem hints on absolute positions rather than per relative operand, and keep CFF2 Private DICT blend values at full precision until they are written back (#4338, #4341).
• [cffLib] Preserve CFF2 Private DICT arrays that use more than one blend group (#4346).
• [feaLib] Raise FeatureLibError instead of looping forever on an unclosed OS/2, BASE or STAT table block (#4347).
• [designspaceLib] When a variable font overrides some public.fontInfo keys, merge them with the root-level font info instead of replacing it (#4336, #4340).
• [instancer] Raise an error for FeatureVariations conditions of a format other than the supported axis-range one, instead of silently dropping them (#4348).
• [filesystem] Don't overwrite an unrelated sibling .zip when writing a .ufoz or other non-.zip archive (#4342).
• [glyf] Fix exponential running time on composite glyphs that reuse the same component at several nesting levels; getCoordinates now raises TTLibError past 65535 composite points (#4325).
• [ttLib] Add support for the beyond-64k tables of the final ISO Open Font Format 5th edition: uppercase companion tables (GLYF, GVAR, HMTX, GSUB/GPOS extended layout, FeatureVariations 1.1, TTC 1.1/2.1, DMAP), a ttLib.beyond64k module and CLI, and support in FontBuilder, merge, subset, instancer, qu2cu, removeOverlaps and scaleUpem (#4097, #2678).
• [VARC] Keep addVarComponent() locations sparse, passing RESET_UNSPECIFIED_AXES via a new keyword-only resetUnspecifiedAxes pen argument (#4349).
• [woff] Require brotli >= 1.2.1 and brotlicffi >= 1.2.1.0, which fix GHSA-9v8h-qqgm-4m35 (#4365, #4370).
• Build Windows ARM64 wheels (#4366).
• [instancer] Fix AttributeError: ElidedFallbackNameID when updating font names of a font with a version 1.0 STAT table; fall back to the subfamily name (#2933, #4371).

Changelog

Sourced from fonttools's changelog.

4.68.0 (released 2026-10-27)

• [feaLib] Escape " and \ when writing names back out with asFea() in FeatureNameStatement, STATNameStatement and CVParametersNameStatement (#4321).
• [scaleUpem] Also scale the MATH lengths that are not MathValueRecord\ s (DelimitedSubFormulaMinHeight, DisplayOperatorMinHeight, MinConnectorOverlap, etc.) (#4327).
• [cffLib] Inherit the initial CFF2 vsindex from the Private DICT when decompiling, specializing and instancing charstrings, and fix programToCommands miscounting operands when several blend operators precede the first stem or moveto (#4337, #4339).
• [instancer] Round CFF2 outlines and stem hints on absolute positions rather than per relative operand, and keep CFF2 Private DICT blend values at full precision until they are written back (#4338, #4341).
• [cffLib] Preserve CFF2 Private DICT arrays that use more than one blend group (#4346).
• [feaLib] Raise FeatureLibError instead of looping forever on an unclosed OS/2, BASE or STAT table block (#4347).
• [designspaceLib] When a variable font overrides some public.fontInfo keys, merge them with the root-level font info instead of replacing it (#4336, #4340).
• [instancer] Raise an error for FeatureVariations conditions of a format other than the supported axis-range one, instead of silently dropping them (#4348).
• [filesystem] Don't overwrite an unrelated sibling .zip when writing a .ufoz or other non-.zip archive (#4342).
• [glyf] Fix exponential running time on composite glyphs that reuse the same component at several nesting levels; getCoordinates now raises TTLibError past 65535 composite points (#4325).
• [ttLib] Add support for the beyond-64k tables of the final ISO Open Font Format 5th edition: uppercase companion tables (GLYF, GVAR, HMTX, GSUB/GPOS extended layout, FeatureVariations 1.1, TTC 1.1/2.1, DMAP), a ttLib.beyond64k module and CLI, and support in FontBuilder, merge, subset, instancer, qu2cu, removeOverlaps and scaleUpem (#4097, #2678).
• [VARC] Keep addVarComponent() locations sparse, passing RESET_UNSPECIFIED_AXES via a new keyword-only resetUnspecifiedAxes pen argument (#4349).
• [woff] Require brotli >= 1.2.1 and brotlicffi >= 1.2.1.0, which fix GHSA-9v8h-qqgm-4m35 (#4365, #4370).
• Build Windows ARM64 wheels (#4366).
• [instancer] Fix AttributeError: ElidedFallbackNameID when updating font names of a font with a version 1.0 STAT table; fall back to the subfamily name (#2933, #4371).

Commits

• e1013ec Release 4.68.0
• 1a43bc6 Update NEWS.rst [skip ci]
• 095c3ed [instancer] Fall back to subfamily name for STAT 1.0 tables (#4371)
• 1ca5f77 Merge pull request #4372 from fonttools/dependabot/github_actions/pypa/gh-act...
• 7546d0c Bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3
• bf51d90 [setup.py] Raise woff minimums to brotli 1.2.1, brotlicffi 1.2.1.0 (#4370)
• 8d3eb2b Update brotli to v1.2.1 (#4365)
• afaa318 [ci] Build Windows ARM64 wheels (#4366)
• 2cb9ea7 [VARC] Keep pen component locations sparse (#4349)
• ceaf0b2 Merge pull request #4097 from fonttools/beyond-64k
• Additional commits viewable in compare view

Updates jsonschema-rs from 0.52.1 to 0.60.3

Release notes

Sourced from jsonschema-rs's releases.

[Python] Release 0.60.3

Fixed

• Stack overflow when building validators for unevaluated* schemas with $ref cycles across $id resources.

[Rust] Release 0.60.2

Fixed

• Stack overflow when building validators for unevaluated* schemas with $ref cycles across $id resources.

[Ruby] Release 0.60.2

Fixed

• Stack overflow when building validators for unevaluated* schemas with $ref cycles across $id resources.

[Python] Release 0.60.1

Fixed

• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, taking time linear in their written length instead of quadratic in their digit count.

[Rust] Release 0.60.1

• Panic on numbers past f64 in const, enum, minimum, maximum, exclusiveMinimum, exclusiveMaximum and type: integer when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. #1790
• #[jsonschema::validator] panicking during expansion, or generating code that panics, on schema numbers past f64 when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. Such numbers are compile errors, as without that serde_json feature. #1790
• const, enum and uniqueItems treating objects with the same members in a different key order as unequal when another crate in the build enables serde_json/preserve_order. #1791
• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000, with the arbitrary-precision feature.
• #[jsonschema::validator] rejecting multipleOf with a positive divisor below the smallest f64, such as 1e-400, with the arbitrary-precision feature.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum with the arbitrary-precision feature taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, with the arbitrary-precision feature taking time linear in their written length instead of quadratic in their digit count.

[Ruby] Release 0.60.1

Fixed

• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, taking time linear in their written length instead of quadratic in their digit count.

[Python] Release 0.60.0

Added

... (truncated)

Changelog

Sourced from jsonschema-rs's changelog.

Changelog

[Unreleased]

[0.61.1] - 2026-11-10

Added

• PatternCache and ValidationOptions::with_pattern_cache to compile each regex once across validator builds.

Fixed

• dereference following $ref in keywords that hold data, such as const and examples. #1858
• pattern over one character class under a large bounded count, such as ^.{0,404600}$, failing with a regex engine error on the empty string when the size limit was raised to compile it.

Performance

• pattern and patternProperties with a large bounded count over one character class, such as ^.{0,262144}$ or [^\p{C}]{1,2048}, build without unrolling the count and fit the default size limit.
• pattern and patternProperties match anchored character-class patterns such as ^[a-z0-9-]+$ without a regex engine.

[0.61.0] - 2026-11-08

Added

• Evaluation::root() and OutputUnit for walking evaluation output units without serializing them.

Fixed

• . in pattern and patternProperties matched \r, U+2028 and U+2029 (it should reject every line terminator).
• evaluate() reported a missing single required name beside additionalProperties: false at /additionalProperties (it should be /required).
• Numeric keywords misjudging whole floats past 2^53. #1825
• Building a validator with an explicit draft retrieving the schema's $schema URI.
• format: "date-time", "date" and "time" accepting +, ,, -, . or / where RFC 3339 requires a digit. #1829
• $ref pointers through a numeric object key (#/responses/200) skipping the references under their target.
• oneOf / anyOf rejecting valid instances when a $ref inside a branch sits under an $id.
• unevaluatedItems treated every element as evaluated beside a non-schema items value (it should evaluate none).

Performance

• Building validators up to 15% faster on schemas that repeat the same $ref, from resolving each reference once.
• Building registries up to 30% faster and validators up to 3% faster, from a cheaper walk over schema documents.
• Building validators up to 25% faster on schemas that declare a base URI, from building absolute keyword locations on first use.
• Building validators up to 3% faster, from cheaper compilation cache keys.
• oneOf / anyOf up to 7x faster when branches fix a property with const or enum.
• oneOf / anyOf skip branches that exclude the instance's value with not over enum or const.
• properties up to 40% faster on objects with a few more keys than it declares.
• minLength / maxLength skip counting code points when the byte length decides.
• pattern starting with lookaheads (^(?=...)(?=...)...) up to 2x faster.
• properties and additionalProperties up to 13% faster on schemas declaring 15 or more properties.
• properties up to 12% faster on objects with keys it does not declare.

... (truncated)

Commits

• 377bc9a chore(python): Release 0.60.3
• 0c3338f chore(python): Release 0.60.2
• 1efccf5 chore(ruby): Release 0.60.2
• 0b657fa chore(rust): Release 0.60.2
• 7eb6128 fix: Stack overflow on unevaluated* with $ref cycles across $id resources
• 26aedd9 build(deps): bump CodSpeedHQ/action from 5.5.0 to 5.6.0
• e9af61d chore(ruby): Release 0.60.1
• 8aa123d chore(python): Release 0.60.1
• 4eb7a64 chore(rust): Release 0.60.1
• 4e90b95 perf: Single scan for the exponent in the digit budget check
• Additional commits viewable in compare view

Updates minijinja from 2.24.0 to 3.0.5

Changelog

Sourced from minijinja's changelog.

3.0.5

• Fixed a panic or abort in Rust when buffering an iterator that reports a huge size hint, or when passing a huge count to the batch or slice filters. Filters like list, sort, reverse, map, slice and batch as well as slicing and concatenating sequences now cap how much they preallocate, so [1, 2]|batch(4611686018427387904) is [[1, 2]] instead of failing with "capacity overflow". #483
• Fixed floats in Go switching to exponent notation from one million up, so 1234567.5 printed as 1.2345675e+06. Like in Rust, a float now prints as its shortest exact decimal without an exponent, so 1234567.5 is 1234567.5 and 1e20 is 100000000000000000000.0. Inside lists and maps, exponent notation is only used below 1e-4 and from 1e16 up, written like 1e20 and 1e-5. NaN now prints as NaN, and infinity inside a list as inf instead of +Inf. #984
• Fixed %s in the format filter formatting floats with %g rules, so "%s"|format(1234567.5) was 1.23457e+06. Like in Python, floats are now formatted like str() does: 1234567.5, 1e+16, 1e-05 or nan. The 0, + and space flags are ignored for floats and strings with %s, like in Python. This applies to both Rust and Go. #984
• Fixed the tojson filter in Go writing floats like integers. Like in Rust, a float stays a float in the output, so 1.0|tojson is 1.0 instead of 1, large and small magnitudes use exponent notation (1.5e+16, 2.5e-7) and infinity becomes null instead of an error. The same applies to values rendered with JSON auto-escaping. #983
• Fixed the upper, lower, capitalize, title and replace filters in Go ignoring values that are not strings. Like in Rust, the value and the replace arguments are converted to strings first, so 1.5|replace(".", ",") is 1,5 and true|upper is TRUE, and a number passed to replace is no longer treated as an empty string. #985
• Fixed slicing and the in operator on iterables such as range() in Go. Like in Rust, range(5)[:2] is now [0, 1] instead of failing with "cannot slice iterator", and 3 in range(5) is true instead of false. Slicing none or undefined gives an empty list like in Rust. Iterables now also print, compare, serialize with tojson and pprint like lists, so range(2) == [0, 1] is true and [range(2)] prints as [[0, 1]] instead of [<iterator>]. The in operator now also works on custom sequence, iterable and map objects. #986
• Fixed none in Go not being treated as an empty sequence by the sort, unique, select, reject, map, groupby, join and urlencode filters and the iterable test. Like in Rust, none|sort is now [] and none|join is an empty string instead of None. #987
• Fixed the odd, even and divisibleby tests in Go ignoring booleans, and divisibleby ignoring a float divisor. Like in Rust, booleans count as 0 and 1, so true is odd is true, and 6.5 is divisibleby(0.5) is true. #988
• Fixed str.format in pycompat cutting floats to six significant digits when no precision is given. Like in Python, such floats are now formatted like str() does, so '{}'.format(3.14159265) is 3.14159265, '{}'.format(1234567.0) is 1234567.0 instead of 1.23457e+06 and '{}'.format(0.0) is 0.0 instead of 0. #991
• Fixed the trim filter in Go ignoring values that are not strings and only stripping ASCII spaces, tabs and newlines by default. Like in Rust, 5|trim|length is now 1, and Unicode whitespace such as a non-breaking space is stripped. #989
• Fixed undefined values not being treated as empty sequences by the sort, unique, select, reject, selectattr, rejectattr, map, batch and groupby filters in Go, and none by batch, selectattr and rejectattr. Like in Rust, undefined|sort is now [] with lenient undefined behavior, while strict and semi-strict undefined behavior still fail except for join and groupby. #990
• Fixed a panic in compile_expression when the expression contains }} followed by more input, such as }} x. This is now a syntax error, like the same text inside a template. #992

3.0.4

• Fixed str.count in pycompat looping forever when counting an empty string. Like in Python, 'abc'.count('') is now 4.
• Fixed str.islower and str.isupper in pycompat returning false for strings with spaces, digits or other uncased characters, and the str.is* predicates returning true for an empty string. They now follow Python, so 'foo bar'.islower() is true and ''.isdigit() is false.
• Fixed str.find and str.rfind in pycompat returning byte offsets. Like in Python they now return character offsets, so 'über'.find('e') is 2.
• Fixed integer addition, subtraction and multiplication in Go losing precision above 2**53 and clamping results that overflow 64 bits, because they were computed with floats. They are now exact, and like in Rust a result that doesn't fit 64 bits becomes a big integer, so 9007199254740993 + 0 is 9007199254740993 and 9223372036854775807 + 1 is 9223372036854775808. #981
• Fixed booleans not being usable as integers in -, *, /, // and % and for repeating strings and sequences in Go. Like in Rust and Jinja2, true - 1 is 0 and "ab" * true is ab.
• Fixed ** failing with a negative integer exponent in Rust. Like in Jinja2, 2 ** -1 is now 0.5. Zero to a negative power now always fails in Rust and Go like a division by zero, instead of producing inf for floats in Rust and for all numbers in Go. #982
• Fixed ** on integers in Go being computed with floats. Like in Rust the result is now exact up to 128 bits and fails beyond that, a float base stays a float so 2.0 ** 3 is 8.0, and booleans count as integers.
• Fixed the sort filter ignoring a comma-separated list of attributes in Go. Like in Rust, sort(attribute="name, state") now sorts by name and then by state instead of leaving the items in their original order. #979
• Fixed the sort filter comparing strings case-sensitively when sorting by several attributes in Rust and Go. Like in Jinja2, each part of the key is now compared case-insensitively unless case_sensitive is set. An attribute list with whitespace-only entries such as "name, " also no longer sorts by an empty attribute in Rust.
• Added the attribute and start arguments to the sum filter and the attribute argument to the join filter for Jinja2 compat...

  Description has been truncated