Build(deps-dev): Bump the patch group with 5 updates

[dependabot]

Bumps the patch group with 5 updates:

Package	From	To
mkdocstrings-python	2.0.7	2.0.8
uv	0.12.7	0.12.13
pylint	4.0.7	4.0.8
time-machine	3.5.0	3.5.1
setuptools-scm	10.2.1	10.2.3

Updates mkdocstrings-python from 2.0.7 to 2.0.8

Release notes

Sourced from mkdocstrings-python's releases.

2.0.8

2.0.8 - 2026-08-31

Compare with 2.0.7

Performance Improvements

• Make template existence test (for locale templates) faster (c0424f2 by Timothée Mazzucotelli).

Changelog

Sourced from mkdocstrings-python's changelog.

2.0.8 - 2026-08-31

Compare with 2.0.7

Performance Improvements

• Make template existence test (for locale templates) faster (c0424f2 by Timothée Mazzucotelli).

Commits

• 8125b0d chore: Prepare release 2.0.8
• 5054240 chore: Be a bit more minijinja compatible
• c0424f2 perf: Make template existence test (for locale templates) faster
• See full diff in compare view

Updates uv from 0.12.7 to 0.12.13

Release notes

Sourced from uv's releases.

0.12.13

Release Notes

Released on 2026-09-10.

Python

• Add GraalPy 3.13.0 (#21431)

Enhancements

• Verify hashes when downloading PEP 658 metadata sidecars (#21563)

Preview features

• Respect ty exclusions when uv check automatically selects members of a virtual workspace (#21555)

Performance

• Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#21279)

Bug fixes

• Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#18713)
• Prefer core-metadata over legacy aliases in JSON index responses (#21563)

Install uv 0.12.13

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"

Download uv 0.12.13

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.13

Released on 2026-09-10.

Python

• Add GraalPy 3.13.0 (#21431)

Enhancements

• Verify hashes when downloading PEP 658 metadata sidecars (#21563)

Preview features

• Respect ty exclusions when uv check automatically selects members of a virtual workspace (#21555)

Performance

• Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#21279)

Bug fixes

• Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#18713)
• Prefer core-metadata over legacy aliases in JSON index responses (#21563)

0.12.12

Released on 2026-09-09.

The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

• Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#21539)

0.12.11

Released on 2026-09-08.

Preview features

• Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#20146)
• Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#21462)

Performance

• Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#21478)
• Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#21468)
• Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#21500)
• Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#21499)

... (truncated)

Commits

• 0ebbd92 Bump version to 0.12.13 (#21594)
• 17ccae3 Use separate Depot projects for Docker development builds (#21591)
• 8c18e15 Use the workflow revision for PR security review configuration (#21592)
• 9ebb1f6 Clarify release pipeline job names (#21561)
• d87450d Omit unused exclude-newer-package entries from script locks (#21589)
• 911f3a2 Refactor release artifact handling (#21556)
• a712e81 Separate Docker release builds from publishing (#21586)
• 4196dae Use xhigh effort for PR security review (#21530)
• a51624b Reduce PR security review reporting work (#21528)
• 63e28b6 Use editpe for trampoline resource edits (#18713)
• Additional commits viewable in compare view

Updates pylint from 4.0.7 to 4.0.8

Release notes

Sourced from pylint's releases.

v4.0.8

What's new in Pylint 4.0.8?

Release date: 2026-08-29

False Positives Fixed

• Fix a false positive for :ref:unspecified-encoding when an open call uses a mode argument that cannot be inferred.

  Closes #10201

• Fix a false positive for invalid-name (C0103) on names assigned in an if __name__ == "__main__": block. Such a block reads like a script body, so a name there is now accepted if it matches either the constant or the variable naming style.

  Closes #10766

• Fix false positives for :ref:invalid-str-returned, :ref:invalid-repr-returned, :ref:invalid-format-returned, :ref:invalid-bytes-returned, :ref:invalid-hash-returned, :ref:invalid-index-returned, :ref:invalid-length-returned, :ref:invalid-length-hint-returned, :ref:invalid-getnewargs-returned and :ref:invalid-getnewargs-ex-returned when the returned value is an instance of a subclass of the expected builtin type, such as self in a str subclass or a namedtuple.

  Closes #11306

• Fix false positives for :ref:bad-string-format-type when the argument is an instance of a subclass of int, float or str, such as bool or an IntEnum member formatted with %d.

  Closes #11315

False Negatives Fixed

• redundant-unittest-assert now also flags assertEqual and assertNotEqual when both compared values are constants, e.g. self.assertEqual(5, 5).

  Closes #11321

Other Bug Fixes

... (truncated)

Commits

• ecb84ba Bump pylint to 4.0.8, update changelog (#11355)
• 989e9c5 [Backport maintenance/4.0.x] Support isort 9 (#11354)
• 8c1ee95 Flag assertEqual and assertNotEqual between two constants in W1503
• eadefe3 Fix false positive bad-string-format-type for subclasses of builtin types
• db00e3b [Backport maintenance/4.0.x] fix(docparams): guard decorated_with_property ag...
• 7909c17 Accept subclass instances in the invalid-*-returned checks
• d19640d [Backport maintenance/4.0.x] Fix invalid-name false positive in `if _name...
• 94e5704 Skip unspecified-encoding for unknown open modes (#11163)
• d59b329 fix(refactoring): handle non-AssignName targets in use-yield-from (#11286) (#...
• eea0569 [Backport maintenance/4.0.x] Fix crash in docparams on raising a non-exceptio...
• See full diff in compare view

Updates time-machine from 3.5.0 to 3.5.1

Changelog

Sourced from time-machine's changelog.

3.5.1 (2026-09-08)

• Only pass the compiler option -mno-omit-leaf-frame-pointer when the compiler supports it, checked with a tiny probe program. The option is unsupported outside of x86 and ARM64, so this fixes building from source on other architectures, like PowerPC, which failed since the option was added in version 3.3.0.

  PR [#692](https://github.com/adamchainz/time-machine/issues/692) <https://github.com/adamchainz/time-machine/pull/692>. Thanks to Colin Watson for pointing this out and linking to the workaround in Debian Bug [#1146407](https://github.com/adamchainz/time-machine/issues/1146407) <https://bugs.debian.org/1146407>.

• Fix the mocked datetime.date.today() and datetime.datetime.today() to be exact for all supported dates, like datetime.datetime.now(). Previously, they went through a floating-point timestamp, which could round the microseconds, or even the whole day, for dates far in the future.

  PR [#690](https://github.com/adamchainz/time-machine/issues/690) <https://github.com/adamchainz/time-machine/pull/690>__.

• Fix the class decorator to stop time travelling when tearDownClass() raises an exception, or when setUpClass() raises an exception not deriving from Exception, such as the skip outcome from pytest.skip(). Previously, time remained mocked for the rest of the process in these cases.

  PR [#678](https://github.com/adamchainz/time-machine/issues/678) <https://github.com/adamchainz/time-machine/pull/678>__.

• Fix Traveller.move_to() to keep the current timezone mocked when the given destination is unsupported. Previously, the timezone was restored before the destination was checked, leaving it unmocked whilst still time travelling.

  PR [#679](https://github.com/adamchainz/time-machine/issues/679) <https://github.com/adamchainz/time-machine/pull/679>__.

• Fix the time_machine pytest fixture to not try to stop a traveller that failed to start.

  PR [#680](https://github.com/adamchainz/time-machine/issues/680) <https://github.com/adamchainz/time-machine/pull/680>__.

• Fix the mocked time.strftime() to raise TypeError when passed None as its second argument, like the unmocked function, rather than treating it as the current time.

  PR [#681](https://github.com/adamchainz/time-machine/issues/681) <https://github.com/adamchainz/time-machine/pull/681>__.

• Fix the :ref:Migration CLI <migration-cli> to keep the rewritten imports on the same line when a freezegun import shares its line with other code, like if TYPE_CHECKING: from freezegun import freeze_time, FakeDate. Previously, the remaining from freezegun import FakeDate was moved to a new line, outside the block.

  PR [#682](https://github.com/adamchainz/time-machine/issues/682) <https://github.com/adamchainz/time-machine/pull/682>__.

• Extend the :ref:Migration CLI <migration-cli> to migrate uses of FrozenDateTimeFactory in string annotations, like freezer: "FrozenDateTimeFactory". Previously, the import was removed whilst such annotations were left referring to it.

  PR [#683](https://github.com/adamchainz/time-machine/issues/683) <https://github.com/adamchainz/time-machine/pull/683>__.

• Fix the :ref:Migration CLI <migration-cli> to not rename a freezer argument when the function already has a time_machine argument, which produced invalid syntax.

  PR [#684](https://github.com/adamchainz/time-machine/issues/684) <https://github.com/adamchainz/time-machine/pull/684>__.

• Fix the :ref:Migration CLI <migration-cli> to report positions in the rewritten file, rather than the original. Previously, positions could be off when rewrites earlier in the file changed the number of lines, or the length of the same line.

  PR [#686](https://github.com/adamchainz/time-machine/issues/686) <https://github.com/adamchainz/time-machine/pull/686>__.

... (truncated)

Commits

• 27b1d58 Version 3.5.1
• 59ead38 Add PR links to changelog
• 0e75f48 Make TimeMachineFixture always available (#675)
• 657108b Standardize the import detection test code (#694)
• 34c2a9a Adapt tests for platforms with 32-bit time_t (#693)
• 42b65d0 Only use -mno-omit-leaf-frame-pointer where supported (#692)
• 9446dcd Extend runtime fuzz tests (#691)
• 64aec53 [pre-commit.ci] pre-commit autoupdate (#676)
• effec2d Fix mocked datetime.today() rounding microseconds for far-future dates (#690)
• 656a7a0 Extend Migration CLI fuzz grammar and properties (#689)
• Additional commits viewable in compare view

Updates setuptools-scm from 10.2.1 to 10.2.3

Release notes

Sourced from setuptools-scm's releases.

setuptools-scm v10.2.3

Miscellaneous

• Do not run the xmlsec download regression test on Python 3.8, where no lxml wheel exists and --no-build-isolation leaves pip without a build toolchain for the lxml sdist. (#1516)

setuptools-scm v10.2.2

Miscellaneous

• The pkginfo workdir discovery entry point moved to vcs-versioning; vcs-versioning>=2.3.2 is now required (the workspace pin carries a .dev0 suffix so in-tree builds resolve, matching the existing convention). setuptools_scm._integration._discover.discover_pkginfo remains as a re-export. (#1507)
• Stop shipping a per-package uv.lock in the sdist. It could not be generated correctly whenever setuptools-scm required an unreleased vcs-versioning, which broke the release proposal workflow. (#1509)

Commits

• 886267d Merge pull request #1517 from pypa/release/main
• f57803d Prepare release: setuptools-scm v10.2.3, vcs-versioning v2.3.4
• 9a4b179 Merge pull request #1516 from RonnyPfannschmidt/fix-1512-vcs-versioning-stand...
• 2f8d5a3 test: move the egg-info vs PKG-INFO priority test to setuptools-scm
• ae95190 test: do not run the xmlsec download regression test on python 3.8
• 2822b07 test: make the vcs-versioning testsuite independent of setuptools-scm
• 3f6f8d7 Merge pull request #1514 from pypa/release/main
• a4e3ca2 Prepare release: vcs-versioning v2.3.3
• 5a4539f Merge pull request #1513 from dylanpulver/semver-schemes-keep-epoch
• 07cf0e9 Add changelog fragment
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions