build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the dev-dependencies group with 3 updates in the / directory: djlint, mkdocs-material and ruff.

Updates djlint from 1.40.7 to 1.42.1

Release notes

Sourced from djlint's releases.

v1.42.1

Fix

• H017 and H018 no longer style command, keygen and menuitem - elements that were removed from the HTML standard.
• Enabling H018 together with H017 or H035 now prints a warning when linting - they enforce opposite void tag conventions, so only one should be on.

Changed

Linter rule defaults were reviewed against a simple bar: on by default means correctness, security, clear accessibility, or a consistency check the formatter also enforces - with near-zero false positives. Four rules moved to opt-in (--include=...):

• T003 (endblock names): neither Django nor Jinja requires a name on {% endblock %}; the name demand is a style preference. The correctness checks T003 used to bundle - unclosed {% block %}, orphan {% endblock %} and mismatched endblock names, all hard template errors - moved into T038, which stays on by default, so nothing real is lost when T003 is off.
• T002 (double quotes in tags): engines accept both quote styles, no autofix exists, and quote-style rules are the canonical example of style checks that don't belong in a default tier.
• H006 (img width/height): valuable performance advice (browsers map the attributes to a default aspect-ratio, preventing layout shift) but performance rather than correctness, and the dimensions are frequently unknowable in a template - user uploads, CMS urls, art-directed <picture> sources - so the rule demands data the author may not have.
• H031 (meta keywords): major search engines have ignored keyword metadata for over a decade; recommending that it be added is outdated advice. The niche intranet-indexer use case keeps the rule available via --include=H031.
• H042 (label/for) moved the other way - from opt-in to on by default - after its false-positive class was removed: the rule now checks a file only when nothing in it could render an id invisibly. Any {{ ... }} output (form widgets), {% include %}/{% extends %} or unrecognized template tag silences the rule for that file, so where it does run, every report is a genuinely broken label association (a WCAG 1.3.1/4.1.2 failure the W3C validator also treats as an error).

v1.42.0

Feature

Template languages:

• New askama profile for Askama (jinja-style templates in Rust). Rust expressions are never reformatted: function and {% set %}/{% let %} formatting are disabled so some_macro!("foo")?, char literals 'a' and tuples keep their exact spelling, and string quotes are never rewritten. The Flask-specific url_for rules (J004/J018) don't apply.
• New tera profile for Tera (Rust, used by Zola): jinja-style formatting plus Tera v2 {% component %}/{% endcomponent %} blocks and single-tag {% set_global %}. The Flask-specific url_for rules don't apply. MiniJinja needs no profile of its own - it is fully Jinja2-compatible, use --profile=jinja.
• New liquid profile for Liquid (Shopify themes, Jekyll, Eleventy, the Rust liquid crate). {% case %}/{% when %}, {% capture %}, {% tablerow %}, {% form %}, {% paginate %}, {% highlight %} and {% unless %}/{% elsif %} indent correctly, {%- -%} whitespace control is handled, and the bodies of Shopify section tags ({% schema %}, {% style %}, {% javascript %}, {% stylesheet %}) are left untouched - they contain JSON, CSS or JS rather than html.
• The golang profile now indents template blocks: {{ if }}, {{ range }}, {{ with }}, {{ block }} and {{ define }} indent their contents up to the matching {{ end }}, with {{ else }}/{{ else if }} as branches and the {{- -}} whitespace-control forms included. Blocks opened and closed on one line are left alone; single tags like {{ template }} and lookalike variables such as {{ .end }} are unaffected.

New linter rules:

• T040: {% extends %} or {% include %} with a missing or empty template name - an error the engine only raises at render time, so the typo is easy to ship.
• H041: an html tag opened in one {% block %} and closed in a different one. The pair looks balanced in the file, but a child template overriding either block renders unbalanced html.
• H018 (off by default, enable with --include=H018): void tags closed with /> instead of >, e.g. <br/> - the trailing slash has no effect in HTML. The opposite convention of the optional H017 ("void tags should be self closing"); enable one or the other, not both.
• H042 (off by default, enable with --include=H042): a <label for="..."> whose value matches no element id in the same file. Template-generated values are skipped; the rule is opt-in because inputs rendered by e.g. {{ form.email }} carry ids the linter cannot see.

Configuration:

• indent and max_line_length now fall back to indent_size and max_line_length from a .editorconfig at the project root. The command line and djlint config files still take precedence, and only sections applying to html (or the configured extension) are read.

Documentation:

• Every linter rule now has a detailed entry on the linter page - what it checks, why it matters, and a verified Don't/Do example pair - in English, French, Russian and Chinese. Askama, Tera and Liquid get language pages, logos and homepage cards, and engines covered by existing profiles (MiniJinja, Jinjava, Pebble, the Liquid dialects) are noted on the pages of the profiles that cover them.

Fix

• H017 no longer misfires on tags that merely start with a void tag name: <cola> (matched by a broken colgroup exclusion) and custom elements like <img-icon> are no longer reported. <meta> tags, missing from the rule's void tag list, are now reported.

v1.41.0

Feature

• New rule T038: block template tags with no matching end tag are now reported: {% if %} without {% endif %}, handlebars {{#if}} without {{/if}}, end tags with no opening tag, and crossed blocks like {% if %}{% for %}{% endif %}. Tags from custom_blocks are checked too; {% block %}/{% endblock %} pairs stay covered by T003.
• New rule T039: template tags that never reach their closing delimiter are now reported, e.g. {% url 'x" user.url }} (closed by }} instead of %}), {{ user.name } (missing a brace), or a tag cut off by the next tag or the end of the file. Complements T027 (unclosed string in a complete tag) and T034 (}% typo), which keep reporting their own cases.

... (truncated)

Changelog

Sourced from djlint's changelog.

[1.42.1] - 2026-07-20

Fix

• H017 and H018 no longer style command, keygen and menuitem - elements that were removed from the HTML standard.
• Enabling H018 together with H017 or H035 now prints a warning when linting - they enforce opposite void tag conventions, so only one should be on.

Changed

Linter rule defaults were reviewed against a simple bar: on by default means correctness, security, clear accessibility, or a consistency check the formatter also enforces - with near-zero false positives. Four rules moved to opt-in (--include=...):

• T003 (endblock names): neither Django nor Jinja requires a name on {% endblock %}; the name demand is a style preference. The correctness checks T003 used to bundle - unclosed {% block %}, orphan {% endblock %} and mismatched endblock names, all hard template errors - moved into T038, which stays on by default, so nothing real is lost when T003 is off.
• T002 (double quotes in tags): engines accept both quote styles, no autofix exists, and quote-style rules are the canonical example of style checks that don't belong in a default tier.
• H006 (img width/height): valuable performance advice (browsers map the attributes to a default aspect-ratio, preventing layout shift) but performance rather than correctness, and the dimensions are frequently unknowable in a template - user uploads, CMS urls, art-directed <picture> sources - so the rule demands data the author may not have.
• H031 (meta keywords): major search engines have ignored keyword metadata for over a decade; recommending that it be added is outdated advice. The niche intranet-indexer use case keeps the rule available via --include=H031.
• H042 (label/for) moved the other way - from opt-in to on by default - after its false-positive class was removed: the rule now checks a file only when nothing in it could render an id invisibly. Any {{ ... }} output (form widgets), {% include %}/{% extends %} or unrecognized template tag silences the rule for that file, so where it does run, every report is a genuinely broken label association (a WCAG 1.3.1/4.1.2 failure the W3C validator also treats as an error).

[1.42.0] - 2026-07-20

Feature

Template languages:

• New askama profile for Askama (jinja-style templates in Rust). Rust expressions are never reformatted: function and {% set %}/{% let %} formatting are disabled so some_macro!("foo")?, char literals 'a' and tuples keep their exact spelling, and string quotes are never rewritten. The Flask-specific url_for rules (J004/J018) don't apply.
• New tera profile for Tera (Rust, used by Zola): jinja-style formatting plus Tera v2 {% component %}/{% endcomponent %} blocks and single-tag {% set_global %}. The Flask-specific url_for rules don't apply. MiniJinja needs no profile of its own - it is fully Jinja2-compatible, use --profile=jinja.
• New liquid profile for Liquid (Shopify themes, Jekyll, Eleventy, the Rust liquid crate). {% case %}/{% when %}, {% capture %}, {% tablerow %}, {% form %}, {% paginate %}, {% highlight %} and {% unless %}/{% elsif %} indent correctly, {%- -%} whitespace control is handled, and the bodies of Shopify section tags ({% schema %}, {% style %}, {% javascript %}, {% stylesheet %}) are left untouched - they contain JSON, CSS or JS rather than html.
• The golang profile now indents template blocks: {{ if }}, {{ range }}, {{ with }}, {{ block }} and {{ define }} indent their contents up to the matching {{ end }}, with {{ else }}/{{ else if }} as branches and the {{- -}} whitespace-control forms included. Blocks opened and closed on one line are left alone; single tags like {{ template }} and lookalike variables such as {{ .end }} are unaffected.

New linter rules:

• T040: {% extends %} or {% include %} with a missing or empty template name - an error the engine only raises at render time, so the typo is easy to ship.
• H041: an html tag opened in one {% block %} and closed in a different one. The pair looks balanced in the file, but a child template overriding either block renders unbalanced html.
• H018 (off by default, enable with --include=H018): void tags closed with /> instead of >, e.g. <br/> - the trailing slash has no effect in HTML. The opposite convention of the optional H017 ("void tags should be self closing"); enable one or the other, not both.
• H042 (off by default, enable with --include=H042): a <label for="..."> whose value matches no element id in the same file. Template-generated values are skipped; the rule is opt-in because inputs rendered by e.g. {{ form.email }} carry ids the linter cannot see.

Configuration:

• indent and max_line_length now fall back to indent_size and max_line_length from a .editorconfig at the project root. The command line and djlint config files still take precedence, and only sections applying to html (or the configured extension) are read.

Documentation:

• Every linter rule now has a detailed entry on the linter page - what it checks, why it matters, and a verified Don't/Do example pair - in English, French, Russian and Chinese. Askama, Tera and Liquid get language pages, logos and homepage cards, and engines covered by existing profiles (MiniJinja, Jinjava, Pebble, the Liquid dialects) are noted on the pages of the profiles that cover them.

Fix

• H017 no longer misfires on tags that merely start with a void tag name: <cola> (matched by a broken colgroup exclusion) and custom elements like <img-icon> are no longer reported. <meta> tags, missing from the rule's void tag list, are now reported.

[1.41.0] - 2026-07-19

Feature

... (truncated)

Commits

• d69c351 v1.42.1
• cd95bfb fix: review default rule set
• 184081d docs: update changelog
• 9f1917c update changelog
• c74b705 chore(deps): update pre-commit hook tombi-toml/tombi-pre-commit to v1.2.1 (#2...
• 0ddcb5c chore(deps): update actions/checkout digest to 3d3c42e (#2263)
• 01da37c fix pre-commit
• a111ead v1.42.0
• 572c538 feat: read indent and max_line_length defaults from .editorconfig
• 6cdc37b docs: add per-rule documentation
• Additional commits viewable in compare view

Updates mkdocs-material from 9.7.6 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

• Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

• Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

• Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

• Limited version range of mkdocs to <2
• Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

• Hardened social cards plugin by switching to sandboxed environment
• Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

• Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

• Opened up version ranges of optional dependencies for forward-compatibility
• Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

• Updated requests to 2.30+ to mitigate CVE in urllib
• Fixed privacy plugin not picking up protocol-relative URLs
• Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

• b3e6dd8 Prepare 9.7.7 release
• 52fb6be Merge commit from fork
• 901e633 Added SECURITY.md with EOL notice
• 5b36f2a Bump js-yaml from 4.1.1 to 4.2.0 (#8598)
• 2d11e7b Bump form-data from 3.0.4 to 3.0.5 (#8597)
• ae05a53 Bump esbuild from 0.27.2 to 0.28.1 (#8596)
• 434af93 Bump shell-quote from 1.7.3 to 1.8.4 (#8593)
• 4447cda Documentation (#8590)
• 8f8d551 Updated copyright year (#8588)
• 08d8514 Bump fast-uri from 3.0.3 to 3.1.2 (#8587)
• Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

• [pycodestyle] Add an autofix for E402 (#22212)
• [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
• [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
• [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
• [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

• [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

• [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

• Avoid redundant lexer token bookkeeping (#26765)
• Avoid redundant pending-indentation writes (#26774)
• Avoid unnecessary identifier lookahead (#26525)
• Reuse parser scratch buffers (#26798)

Documentation

• Document argfile support (#26803)
• [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
• [pycodestyle] Document E731 fix safety (#26847)
• [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

• @​dwego
• @​MichaReiser
• @​Joosboy
• @​KaufmanDmitriy
• @​PeterJCLaw
• @​ntBre
• @​charliermarsh

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

• [pycodestyle] Add an autofix for E402 (#22212)
• [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
• [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
• [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
• [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

• [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

• [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

• Avoid redundant lexer token bookkeeping (#26765)
• Avoid redundant pending-indentation writes (#26774)
• Avoid unnecessary identifier lookahead (#26525)
• Reuse parser scratch buffers (#26798)

Documentation

• Document argfile support (#26803)
• [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
• [pycodestyle] Document E731 fix safety (#26847)
• [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

• @​dwego
• @​MichaReiser
• @​Joosboy
• @​KaufmanDmitriy
• @​PeterJCLaw
• @​ntBre
• @​charliermarsh

Commits

• 0177a7e Bump 0.15.22 (#26884)
• fe8ba85 [pycodestyle] Document E731 fix safety (#26847)
• f3cf7c8 [ruff] Add rule-codes-in-selectors (RUF201) (#26772)
• d244fd7 Document argfile support (#26803)
• f239758 [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)
• 54acbcd [ty] Support TypeVarTuple and Unpack (#25240)
• 87fc38c [ty] Parallelize subtype hierarchy search (#26875)
• e454f91 [ty] Share interned query keys across Salsa queries (#26794)
• 6f361a7 [ty] only collect expected types for files open in the editor (#25546)
• 6d6b2b3 [ty] Avoid allocations during Salsa interned lookups (#26877)
• Additional commits viewable in compare view

[dependabot]

Superseded by #483.