deps(deps): bump the python-minor-and-patch group with 8 updates

[dependabot]

Bumps the python-minor-and-patch group with 8 updates:

Package	From	To
django-flexible-reports	0.3.2	0.4.1
pandas	3.0.3	3.0.5
tqdm	4.69.0	4.69.1
django-oauth-toolkit	3.3.0	3.4.0
ruff	0.15.22	0.16.0
djlint	1.41.0	1.42.3
pre-commit	4.6.0	4.6.1
pytest-env	1.6.0	1.7.0

Updates django-flexible-reports from 0.3.2 to 0.4.1

Release notes

Sourced from django-flexible-reports's releases.

v0.4.1

• Python 3.14 is supported and tested, against both Django 5.2 LTS and 6.0.

• PyPI metadata is fuller: real keywords instead of just the package name, and links to the documentation, repository, issue tracker and changelog rather than the homepage alone. Development Status moves from 3 - Alpha to 5 - Production/Stable.

• Internal: removed the last Python 2 leftovers (__future__ imports, UTF-8 encoding headers, super(Class, self)) and turned on ruff's UP (pyupgrade) ruleset, which had been off, so that they cannot creep back in. No runtime behaviour changed.

v0.4.0

• Backwards incompatible: the minimum supported Django is now 5.2 LTS. Tested against Django 5.2 and 6.0.

• The Polish translation now actually works when installed from PyPI. Django reads compiled .mo catalogues rather than the .po sources, and *.mo is gitignored, so every release up to and including 0.3.2 shipped the .po alone and the translation silently did nothing. Releases now compile the catalogues before building, and the build fails if the wheel ends up with fewer .mo files than .po files.

• The example/ project, which could not start on any supported Django, is replaced by demo/ -- a working project that runs against either the plain admin (make demo) or grappelli (make demo-grappelli) from one set of models and seed data.

• Documentation is rewritten and published to https://mpasternak.github.io/django-flexible-reports/. The previous docs/readme.rst included a README.rst that does not exist and rendered blank; the install instructions recommended easy_install.

  The manual is now built with MkDocs and the Material theme instead of Sphinx, and its sources are Markdown.

• Three migrations no longer import django.contrib.postgres.fields.jsonb. That import pulled in psycopg2 at module load, so migrate failed on SQLite for anyone who had installed only the runtime dependencies.

• Table and Report can now be cloned from the admin, using a Clone button on the change form. Cloning a table copies its columns and its sort order; cloning a report copies its elements, which keep pointing at the same tables and datasources. The clone's name gets a translatable (copy) suffix.

... (truncated)

Changelog

Sourced from django-flexible-reports's changelog.

0.4.1 (2026-07-23)

• Python 3.14 is supported and tested, against both Django 5.2 LTS and 6.0.

• PyPI metadata is fuller: real keywords instead of just the package name, and links to the documentation, repository, issue tracker and changelog rather than the homepage alone. Development Status moves from 3 - Alpha to 5 - Production/Stable.

• Internal: removed the last Python 2 leftovers (__future__ imports, UTF-8 encoding headers, super(Class, self)) and turned on ruff's UP (pyupgrade) ruleset, which had been off, so that they cannot creep back in. No runtime behaviour changed.

0.4.0 (2026-07-22)

• Backwards incompatible: the minimum supported Django is now 5.2 LTS. Tested against Django 5.2 and 6.0.

• The Polish translation now actually works when installed from PyPI. Django reads compiled .mo catalogues rather than the .po sources, and *.mo is gitignored, so every release up to and including 0.3.2 shipped the .po alone and the translation silently did nothing. Releases now compile the catalogues before building, and the build fails if the wheel ends up with fewer .mo files than .po files.

• The example/ project, which could not start on any supported Django, is replaced by demo/ -- a working project that runs against either the plain admin (make demo) or grappelli (make demo-grappelli) from one set of models and seed data.

• Documentation is rewritten and published to https://mpasternak.github.io/django-flexible-reports/. The previous docs/readme.rst included a README.rst that does not exist and rendered blank; the install instructions recommended easy_install.

  The manual is now built with MkDocs and the Material theme instead of Sphinx, and its sources are Markdown.

• Three migrations no longer import django.contrib.postgres.fields.jsonb. That import pulled in psycopg2 at module load, so migrate failed on SQLite for anyone who had installed only the runtime dependencies.

• Table and Report can now be cloned from the admin, using a Clone button on the change form. Cloning a table copies its columns and its sort order; cloning a report copies its elements, which keep pointing at the same tables and datasources. The clone's name gets a translatable (copy) suffix.

... (truncated)

Commits

• 96c994d Merge pull request #12 from mpasternak/release/0.4.1
• 585f11e Bump version: 0.4.0 → 0.4.1
• e823785 docs: date the 0.4.1 changelog section
• 0e22cf3 Run the grappelli guard with python -m pytest, not the console script
• 27e1a0f Merge pull request #11 from mpasternak/chore/python2-cleanup
• f2df50d Merge pull request #10 from mpasternak/chore/audit-followups
• 79ac672 Enable ruff's UP (pyupgrade) rules so the cruft cannot come back
• e8b1725 Remove obsolete UTF-8 encoding declarations
• c72ab63 Use the modern postgresql backend name in the test settings
• b3ce469 Drop the unreachable django.conf.urls.url fallback in the test urlconf
• Additional commits viewable in compare view

Updates pandas from 3.0.3 to 3.0.5

Release notes

Sourced from pandas's releases.

pandas 3.0.5

We are pleased to announce the release of pandas 3.0.5. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.4

We are pleased to announce the release of pandas 3.0.4. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• e68db09 RLS: 3.0.5
• 0697623 Backport PR #66428: DOC: update whatsnew for 3.0.5 (#66430)
• 5d846d0 Backport PR #66090 on branch 3.0.x (BLD: exclude numpy 2.5.0 when building wh...
• bef7a2b Backport PR #66169 on branch 3.0.x (CI: Fix pyarrow-nightly job (stale nightl...
• 8188eb1 RLS: 3.0.4 (#66079)
• bd35f15 [3.0.x] BUG: fix CoW issue in eval() (#66072)
• 6195872 [backport 3.0.x] BUG: anchor whole alternation in Series.str.match for PyArro...
• 70313be Backport PR #66051 on branch 3.0.x (BUG: fix regression in DataFrame setitem ...
• 57ed3e2 [backport 3.0.x] Bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#65934) (#66026)
• f9693fc [backport 3.0.x] BUG(pandas 3.0 regression): drop(index=...) doesn't accept N...
• Additional commits viewable in compare view

Updates tqdm from 4.69.0 to 4.69.1

Release notes

Sourced from tqdm's releases.

tqdm v4.69.1 stable

• contrib.logging: preserve filters (#1775 <- #1581)
• rich: misc fixes (#1773)
  • support generators (without len) (#1391)
  • fix potential AttributeError on exit (#1674)
• fix total=float('inf') (#1781 <- #651)
• fix potential AttributeError on exit (#1778 <- #1668, #1537, #261)
• fix minor docs typos (#1780, #1746)

Commits

• 93370ff bump version, merge pull requests #1781, #1773, #1778, #1775, #1780, #1746
• 238501f docs: fix redundant word typo in tests_synchronisation.py
• b78624a contrib.logging: preserve filters
• 9f92bc6 remove unnecessary comments
• 494372e Fix AttributeError in close() on failed __init__
• 796cea1 misc tidy
• 164ef73 rich: misc fixes
• f18c88e fix properly
• 90f5970 minor tidy
• ef15578 fix: handle total=inf in format_meter to avoid OverflowError
• Additional commits viewable in compare view

Updates django-oauth-toolkit from 3.3.0 to 3.4.0

Release notes

Sourced from django-oauth-toolkit's releases.

3.4.0

The headline of this release is first-class support for the Model Context Protocol (MCP) authorization server role. MCP's authorization spec is built on a stack of modern OAuth RFCs, and this cycle landed the whole stack: Authorization Server Metadata (RFC 8414) and Protected Resource Metadata (RFC 9728) for discovery, Dynamic Client Registration (RFC 7591 / RFC 7592) and OAuth Client ID Metadata Documents (CIMD) so clients can register themselves, Resource Indicators (RFC 8707) for audience-bound access tokens, and the OAuth 2.0 Security Best Current Practice (RFC 9700) together with the RFC 9207 iss parameter. The RFC 9700 compliance gates double as a configurable OAuth 2.1 security posture — they can reject the implicit and password grants and enforce S256-only PKCE (legacy behavior by default in 3.4, scheduled to flip to compliant in 4.0). The new ALLOW_LOCALHOST_LOOPBACK setting smooths the ephemeral-port loopback callback used by native clients such as Claude Code, MCP Inspector, and mcp-remote.

Beyond MCP, the release adds a Django Ninja integration alongside the existing DRF support and support for RP-Initiated Registration, lifts the 255-character cap on refresh tokens (mirroring the access-token checksum scheme), makes cleartokens reclaim revoked refresh tokens sooner, and harmonizes Bearer Authorization header parsing across the middleware.

It also carries a batch of security fixes: an unauthenticated open redirect from the authorization endpoint (prompt=none), HS256 ID tokens being signed with the hashed client secret, cleartext tokens and codes exposed in the Django admin, client secrets written to debug logs, and predictable device-flow user_code generation. Longstanding operational bugs are fixed too, including a multi-database migrate deadlock (#1591) and duplicate unique indexes that broke fresh installs on Oracle and strict MySQL (#1656).

Before upgrading, read the breaking-changes section below: most items are makemigrations steps for swapped models, but applications using the HS256 signing algorithm now require hash_client_secret=False.

WARNING - POTENTIAL BREAKING CHANGES

• Applications using the HS256 signing algorithm must now be configured with hash_client_secret=False. Previously such applications signed ID tokens with the hashed client secret, producing tokens that relying parties could not verify. Application.clean() now raises a ValidationError for HS256 + hash_client_secret=True, and Application.jwk_key raises ImproperlyConfigured at signing time if the secret is hashed. To migrate an affected application, recreate it (or reset its secret) with hash_client_secret=False so the plaintext secret is stored and can be used as the shared HMAC key.
• Changes to the AbstractRefreshToken model require doing a manage.py migrate after upgrading.
• If you use a swapped refresh token model (OAUTH2_PROVIDER_REFRESH_TOKEN_MODEL) you will need to update your custom model with manage.py makemigrations. If your table already contains refresh tokens you must also backfill token_checksum with a data migration — adapt the batched backfill loop from forwards_func in oauth2_provider/migrations/0015_refreshtoken_token_checksum.py (dropping its swapped-model guard, the early return, and resolving your own model instead) and keep the same operation order: add nullable checksum → drop the old ("token", "revoked") unique constraint → widen token to TextField → backfill → make checksum non-nullable → add the ("token_checksum", "revoked") unique constraint.
• If you use a swapped application model (OAUTH2_PROVIDER_APPLICATION_MODEL), run

... (truncated)

Changelog

Sourced from django-oauth-toolkit's changelog.

[3.4.0] - 2026-07-23

The headline of this release is first-class support for the Model Context Protocol (MCP) authorization server role. MCP's authorization spec is built on a stack of modern OAuth RFCs, and this cycle landed the whole stack: Authorization Server Metadata (RFC 8414) and Protected Resource Metadata (RFC 9728) for discovery, Dynamic Client Registration (RFC 7591 / RFC 7592) and OAuth Client ID Metadata Documents (CIMD) so clients can register themselves, Resource Indicators (RFC 8707) for audience-bound access tokens, and the OAuth 2.0 Security Best Current Practice (RFC 9700) together with the RFC 9207 iss parameter. The RFC 9700 compliance gates double as a configurable OAuth 2.1 security posture — they can reject the implicit and password grants and enforce S256-only PKCE (legacy behavior by default in 3.4, scheduled to flip to compliant in 4.0). The new ALLOW_LOCALHOST_LOOPBACK setting smooths the ephemeral-port loopback callback used by native clients such as Claude Code, MCP Inspector, and mcp-remote.

Beyond MCP, the release adds a Django Ninja integration alongside the existing DRF support and support for RP-Initiated Registration, lifts the 255-character cap on refresh tokens (mirroring the access-token checksum scheme), makes cleartokens reclaim revoked refresh tokens sooner, and harmonizes Bearer Authorization header parsing across the middleware.

It also carries a batch of security fixes: an unauthenticated open redirect from the authorization endpoint (prompt=none), HS256 ID tokens being signed with the hashed client secret, cleartext tokens and codes exposed in the Django admin, client secrets written to debug logs, and predictable device-flow user_code generation. Longstanding operational bugs are fixed too, including a multi-database migrate deadlock (#1591) and duplicate unique indexes that broke fresh installs on Oracle and strict MySQL (#1656).

Before upgrading, read the breaking-changes section below: most items are makemigrations steps for swapped models, but applications using the HS256 signing algorithm now require hash_client_secret=False.

WARNING - POTENTIAL BREAKING CHANGES

• Applications using the HS256 signing algorithm must now be configured with hash_client_secret=False. Previously such applications signed ID tokens with the hashed client secret, producing tokens that relying parties could not verify. Application.clean() now raises a ValidationError for HS256 + hash_client_secret=True, and Application.jwk_key raises ImproperlyConfigured at signing time if the secret is hashed. To migrate an affected application, recreate it (or reset its secret) with hash_client_secret=False so the plaintext secret is stored and can be used as the shared HMAC key.
• Changes to the AbstractRefreshToken model require doing a manage.py migrate after upgrading.
• If you use a swapped refresh token model (OAUTH2_PROVIDER_REFRESH_TOKEN_MODEL) you will need to update your custom model with manage.py makemigrations. If your table already contains refresh tokens you must also backfill token_checksum with a data migration — adapt the batched backfill loop from forwards_func in oauth2_provider/migrations/0015_refreshtoken_token_checksum.py (dropping its swapped-model guard, the early return, and resolving your own model instead) and keep the same operation order: add nullable checksum → drop the old ("token", "revoked") unique constraint → widen token to TextField → backfill → make checksum non-nullable → add the ("token_checksum", "revoked") unique constraint.
• If you use a swapped application model (OAUTH2_PROVIDER_APPLICATION_MODEL), run

... (truncated)

Commits

• 48132d3 chore: 3.4.0 release (#1764)
• 2c34e2a docs: replace m2r2 with myst-parser to drop the mistune dependency (#1761)
• 76cc44b chore(deps): bump cryptography in the uv group across 1 directory (#1760)
• a5e5032 docs: migrate m2r to m2r2 and build docs in CI (#1758)
• ea8f2f0 chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates (#...
• de8e735 Fix 500 error when client_id or username contains a NUL byte (#1754)
• 0c9240b Fix ReadWriteScopedResourceMixin.new() rejecting any constructor argument...
• c5f2b9d Add section in docs about migrations testing (#1717)
• 11b36e4 Extract HttpRequest creation to own method (#1660)
• 82fc862 Fix wildcard redirect URI validation for Netlify double-dash deploy previews ...
• Additional commits viewable in compare view

Updates ruff from 0.15.22 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Updates djlint from 1.41.0 to 1.42.3

Release notes

Sourced from djlint's releases.

v1.42.3

Fix

• Attribute names containing punctuation beyond -, ., :, @ and * no longer stop a tag from being wrapped over multiple lines. The attribute parser now accepts any character HTML allows in an attribute name, so Alpine key modifiers (@keydown.prevent.?), Angular bindings ((click), [disabled]) and Vue shorthands (#slot) are formatted like every other attribute instead of leaving the whole tag on one long line. Angular bindings also reach --format-attribute-js-json for the first time, which already listed them.
• An unquoted attribute value with a template tag glued to the rest of the value (e.g. src={{ MEDIA_URL }}/logo.png, href={{ .Permalink }}#{{ .Anchor }}) is no longer split into a truncated value plus a bogus standalone attribute when attributes are wrapped; it stays one value, quoted when spread.

v1.42.2

Fix

• Attributes containing ${...} inside a quoted value (e.g. JS template literals like :name="`x[${i}]`") respect max_attribute_length again and are spread over multiple lines - a regression in 1.40.6. Unquoted Mako-style ${...} expressions in tags are still left unformatted.
• A stray <!-- that is not a real HTML comment (for example inside a {# ... #} template comment or inside a <textarea>/<pre>) no longer swallows the rest of the document. This fixes false H025 orphan-tag reports and over-indentation of the tags that follow - a regression in 1.40.6.
• Handlebars triple-stache {{{ ... }}} and raw-block {{{{ ... }}}} expressions used as tag attributes are tokenized correctly again, fixing false H025 orphan-tag reports - a regression in 1.40.6.
• A quoted literal brace in an attribute value (e.g. data-x="{{") no longer makes the tokenizer scan into later content looking for a matching }}, which could collapse <pre>/<textarea> whitespace - a regression in 1.40.6.
• Spacing the }} of a handlebars {{#if}}/{{#each}} block-open tag is now idempotent; it no longer leaks a trailing space into the following {{...}} tag on later formatting passes.
• T038 no longer reports block tags that appear only inside a handlebars comment ({{!-- ... --}}, {{! ... }}) or inside a handlebars raw block ({{{{raw}}}} ... {{{{/raw}}}}).
• T039 no longer reports handlebars raw-block delimiters ({{{{raw}}}} / {{{{/raw}}}}) as unclosed template tags.
• Malformed tag attributes that the attribute parser cannot fully parse (e.g. a stray < or dangling =) are now left untouched instead of having the unparsable characters silently dropped when attributes are wrapped.
• A < used as a less-than operator inside a template expression in text or <script> content (e.g. ${a<b}, {{a<b}}) is no longer mistaken for an HTML tag start, which could merge or drop following content and break idempotency - a regression in 1.40.6.
• Unquoted attribute values containing : or / (e.g. href=https://example.com/page) are no longer split into a truncated value plus a bogus standalone attribute when attributes are wrapped - a regression in 1.40.6.
• A nameless ="value" attribute is no longer rewritten with the literal attribute name None; malformed attributes are left untouched.
• Trailing whitespace inside an indented <textarea>/<pre> is preserved instead of being collapsed by whitespace cleanup (it is verbatim content).

Performance

• Detecting ignored/verbatim blocks ({% comment %}, {% blocktrans %}, {% filter %}, <pre>, <script>, etc.) is dramatically faster on templates with many {% ... %} tags. A lazy [ ]*? before the block keywords caused pathological backtracking; the equivalent greedy [ ]* removes it, cutting reformat time on large template-heavy files by roughly 5x.

v1.42.1

Fix

• H017 and H018 no longer style command, keygen and menuitem - elements that were removed from the HTML standard.
• Enabling H018 together with H017 or H035 now prints a warning when linting - they enforce opposite void tag conventions, so only one should be on.

Changed

Linter rule defaults were reviewed against a simple bar: on by default means correctness, security, clear accessibility, or a consistency check the formatter also enforces - with near-zero false positives. Four rules moved to opt-in (--include=...):

• T003 (endblock names): neither Django nor Jinja requires a name on {% endblock %}; the name demand is a style preference. The correctness checks T003 used to bundle - unclosed {% block %}, orphan {% endblock %} and mismatched endblock names, all hard template errors - moved into T038, which stays on by default, so nothing real is lost when T003 is off.
• T002 (double quotes in tags): engines accept both quote styles, no autofix exists, and quote-style rules are the canonical example of style checks that don't belong in a default tier.
• H006 (img width/height): valuable performance advice (browsers map the attributes to a default aspect-ratio, preventing layout shift) but performance rather than correctness, and the dimensions are frequently unknowable in a template - user uploads, CMS urls, art-directed <picture> sources - so the rule demands data the author may not have.
• H031 (meta keywords): major search engines have ignored keyword metadata for over a decade; recommending that it be added is outdated advice. The niche intranet-indexer use case keeps the rule available via --include=H031.
• H042 (label/for) moved the other way - from opt-in to on by default - after its false-positive class was removed: the rule now checks a file only when nothing in it could render an id invisibly. Any {{ ... }} output (form widgets), {% include %}/{% extends %} or unrecognized template tag silences the rule for that file, so where it does run, every report is a genuinely broken label association (a WCAG 1.3.1/4.1.2 failure the W3C validator also treats as an error).

v1.42.0

Feature

Template languages:

• New askama profile for Askama (jinja-style templates in Rust). Rust expressions are never reformatted: function and {% set %}/{% let %} formatting are disabled so some_macro!("foo")?, char literals 'a' and tuples keep their exact spelling, and string quotes are never rewritten. The Flask-specific url_for rules (J004/J018) don't apply.
• New tera profile for Tera (Rust, used by Zola): jinja-style formatting plus Tera v2 {% component %}/{% endcomponent %} blocks and single-tag {% set_global %}. The Flask-specific url_for rules don't apply. MiniJinja needs no profile of its own - it is fully Jinja2-compatible, use --profile=jinja.
• New liquid profile for Liquid (Shopify themes, Jekyll, Eleventy, the Rust liquid crate). {% case %}/{% when %}, {% capture %}, {% tablerow %}, {% form %}, {% paginate %}, {% highlight %} and {% unless %}/{% elsif %} indent correctly, {%- -%} whitespace control is handled, and the bodies of Shopify section tags ({% schema %}, {% style %}, {% javascript %}, {% stylesheet %}) are left untouched - they contain JSON, CSS or JS rather than html.

... (truncated)

Changelog

Sourced from djlint's changelog.

[1.42.3] - 2026-07-23

Fix

• Attribute names containing punctuation beyond -, ., :, @ and * no longer stop a tag from being wrapped over multiple lines. The attribute parser now accepts any character HTML allows in an attribute name, so Alpine key modifiers (@keydown.prevent.?), Angular bindings ((click), [disabled]) and Vue shorthands (#slot) are formatted like every other attribute instead of leaving the whole tag on one long line. Angular bindings also reach --format-attribute-js-json for the first time, which already listed them.
• An unquoted attribute value with a template tag glued to the rest of the value (e.g. src={{ MEDIA_URL }}/logo.png, href={{ .Permalink }}#{{ .Anchor }}) is no longer split into a truncated value plus a bogus standalone attribute when attributes are wrapped; it stays one value, quoted when spread.

[1.42.2] - 2026-07-22

Fix

• Attributes containing ${...} inside a quoted value (e.g. JS template literals like :name="`x[${i}]`") respect max_attribute_length again and are spread over multiple lines - a regression in 1.40.6. Unquoted Mako-style ${...} expressions in tags are still left unformatted.
• A stray <!-- that is not a real HTML comment (for example inside a {# ... #} template comment or inside a <textarea>/<pre>) no longer swallows the rest of the document. This fixes false H025 orphan-tag reports and over-indentation of the tags that follow - a regression in 1.40.6.
• Handlebars triple-stache {{{ ... }}} and raw-block {{{{ ... }}}} expressions used as tag attributes are tokenized correctly again, fixing false H025 orphan-tag reports - a regression in 1.40.6.
• A quoted literal brace in an attribute value (e.g. data-x="{{") no longer makes the tokenizer scan into later content looking for a matching }}, which could collapse <pre>/<textarea> whitespace - a regression in 1.40.6.
• Spacing the }} of a handlebars {{#if}}/{{#each}} block-open tag is now idempotent; it no longer leaks a trailing space into the following {{...}} tag on later formatting passes.
• T038 no longer reports block tags that appear only inside a handlebars comment ({{!-- ... --}}, {{! ... }}) or inside a handlebars raw block ({{{{raw}}}} ... {{{{/raw}}}}).
• T039 no longer reports handlebars raw-block delimiters ({{{{raw}}}} / {{{{/raw}}}}) as unclosed template tags.
• Malformed tag attributes that the attribute parser cannot fully parse (e.g. a stray < or dangling =) are now left untouched instead of having the unparsable characters silently dropped when attributes are wrapped.
• A < used as a less-than operator inside a template expression in text or <script> content (e.g. ${a<b}, {{a<b}}) is no longer mistaken for an HTML tag start, which could merge or drop following content and break idempotency - a regression in 1.40.6.
• Unquoted attribute values containing : or / (e.g. href=https://example.com/page) are no longer split into a truncated value plus a bogus standalone attribute when attributes are wrapped - a regression in 1.40.6.
• A nameless ="value" attribute is no longer rewritten with the literal attribute name None; malformed attributes are left untouched.
• Trailing whitespace inside an indented <textarea>/<pre> is preserved instead of being collapsed by whitespace cleanup (it is verbatim content).

Performance

• Detecting ignored/verbatim blocks ({% comment %}, {% blocktrans %}, {% filter %}, <pre>, <script>, etc.) is dramatically faster on templates with many {% ... %} tags. A lazy [ ]*? before the block keywords caused pathological backtracking; the equivalent greedy [ ]* removes it, cutting reformat time on large template-heavy files by roughly 5x.

[1.42.1] - 2026-07-20

Fix

• H017 and H018 no longer style command, keygen and menuitem - elements that were removed from the HTML standard.
• Enabling H018 together with H017 or H035 now prints a warning when linting - they enforce opposite void tag conventions, so only one should be on.

Changed

Linter rule defaults were reviewed against a simple bar: on by default means correctness, security, clear accessibility, or a consistency check the formatter also enforces - with near-zero false positives. Four rules moved to opt-in (--include=...):

• T003 (endblock names): neither Django nor Jinja requires a name on {% endblock %}; the name demand is a style preference. The correctness checks T003 used to bundle - unclosed {% block %}, orphan {% endblock %} and mismatched endblock names, all hard template errors - moved into T038, which stays on by default, so nothing real is lost when T003 is off.
• T002 (double quotes in tags): engines accept both quote styles, no autofix exists, and quote-style rules are the canonical example of style checks that don't belong in a default tier.
• H006 (img width/height): valuable performance advice (browsers map the attributes to a default aspect-ratio, preventing layout shift) but performance rather than correctness, and the dimensions are frequently unknowable in a template - user uploads, CMS urls, art-directed <picture> sources - so the rule demands data the author may not have.
• H031 (meta keywords): major search engines have ignored keyword metadata for over a decade; recommending that it be added is outdated advice. The niche intranet-indexer use case keeps the rule available via --include=H031.
• H042 (label/for) moved the other way - from opt-in to on by default - after its false-positive class was removed: the rule now checks a file only when nothing in it could render an id invisibly. Any {{ ... }} output (form widgets), {% include %}/{% extends %} or unrecognized template tag silences the rule for that file, so where it does run, every report is a genuinely broken label association (a WCAG 1.3.1/4.1.2 failure the W3C validator also treats as an error).

[1.42.0] - 2026-07-20

Feature

Template languages:

... (truncated)

Commits

• 464aca7 v1.42.3
• 5acc4fd fix: accept every HTML-legal character in attribute names
• 5a999c8 chore: reformat
• 6a84807 docs: update pyodide in playground
• d48d64f chore(deps): lock file maintenance (#2275)
• c029d26 chore(deps): lock file maintenance (#2274)
• 33bd21e chore(deps): update pre-commit hook types-regex to v2026.7.19.20260720 (#2273)
• 014dff7 chore(deps): update pre-commit hook tombi-toml/tombi-pre-commit to v1.2.4 (#2...
• 6597903 v1.42.2
• 6fa03c2 bug fixes and perf improvements
• Additional commits viewable in compare view

Updates pre-commit from 4.6.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

• Install language: node hooks via git.
  • Fixes npm 12.x compatibility
  • #3719 PR by @​asottile.
  • #3517 issue by @​ojob.
• Set JULIA_DEPOT_PATH for language: julia.
  • #3711 PR by @​damonbayer.
  • pre-commit-ci/runner-image#335 issue by @​damonbayer.
• Produce error on mistyped --repo for pre-commit autoupdate.
  • #3701 PR by @​mxr.
  • #3695 issue by @​mxr.
• Improve performance of commit existence check in pre-push.
  • #3726 PR by @​asottile.
  • #3604 issue by @​ptarjan.
• Avoid duplicating conflicted filenames during pre-commit run --all-files.
  • #3727 PR by @​asottile.
  • #3706 issue by @​RomanValov.

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

• Install language: node hooks via git.
  • Fixes npm 12.x compatibility
  • #3719 PR by @​asottile.
  • #3517 issue by @​ojob.
• Set JULIA_DEPOT_PATH for language: julia.
  • #3711 PR by @​damonbayer.
  • pre-commit-ci/runner-image#335 issue by @​damonbayer.
• Produce error on mistyped --repo for pre-commit autoupdate.
  • #3701 PR by @​mxr.
  • #3695 issue by @​mxr.
• Improve performance of commit existence check in pre-push.
  • #3726 PR by @​asottile.
  • #3604 issue by @​ptarjan.
• Avoid duplicating conflicted filenames during pre-commit run --all-files.
  • #3727 PR by @​asottile.
  • #3706 issue by @​RomanValov.

Commits

• 242ce8a v4.6.1
• 766e550 Merge pull request #3727 from pre-commit/dedupe
• 1558d06 Merge pull request #3726 from pre-commit/exists-faster
• 8a1c47a avoid duplicate files in --all-files during conflict
• 2e01c99 faster check of rev existing locally as a commit
• 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
• 1d811d9 Return an error for invalid --repo
• 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
• 1e7994f set JULIA_DEPOT_PATH
• b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
• Additional commits viewable in compare view

Updates pytest-env from 1.6.0 to 1.7.0

Release notes

Sourced from pytest-env's releases.

1.7.0

What's Changed

• 🔒 ci(workflows): add zizmor security auditing by @​gaborbernat in pytest-dev/pytest-env#216
• 📦 build: move the testing extra to a dependency group by @​gaborbernat in pytest-dev/pytest-env#243
• 👷 ci: test against Python 3.15 beta by @​gaborbernat in pytest-dev/pytest-env#245

Full Changelog: pytest-dev/pytest-env@1.6.0...1.7.0

Commits

• db01e70 👷 ci: test against Python 3.15 beta (#245)
• 9e3ce0d [pre-commit.ci] pre-commit autoupdate (