deps(deps-dev): bump the development-dependencies group with 4 updates

[dependabot]

Bumps the development-dependencies group with 4 updates: charset-normalizer, mypy, platformdirs and pygments.

Updates charset-normalizer from 3.4.9 to 3.5.1

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.1

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

Changelog

Sourced from charset-normalizer's changelog.

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

Commits

• e239bdc Merge pull request #795 from jawah/release-3.5.1
• 648ad77 docs: update faq
• fab2749 docs: write changelog for 3.5.1
• 7d32774 chore: bump version to 3.5.1
• 9a69f60 docs: update data/info
• 5dcc6dd perf: charinfo cache access optimization in cython
• ea3b447 fix: do not validate-decode large payload when md says it's noise
• a05917f chore: allow setuptools 84 builds (#794)
• 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
• 77203b1 chore: reformat noxfile.py
• Additional commits viewable in compare view

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• See full diff in compare view

Updates platformdirs from 4.11.2 to 4.11.3

Release notes

Sourced from platformdirs's releases.

4.11.3

What's Changed

• 📄 docs: publish llms.txt from the docs build by @​gaborbernat in tox-dev/platformdirs#522
• fix: don't crash when an XDG dirs variable holds only separators by @​darrenhuai in tox-dev/platformdirs#523

Full Changelog: tox-dev/platformdirs@4.11.2...4.11.3

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.5 (2026-08-27)

---

• Give :func:~platformdirs.user_preference_dir and :func:~platformdirs.user_preference_path the same arguments as :func:~platformdirs.user_config_dir. Added without arguments in :pr:491, they could only return the unscoped base directory even though the property they wrap appends the app name and version. :pr:531
• Make :func:~platformdirs.site_applications_path return the first entry when multipath=True, matching :func:~platformdirs.site_data_path. On Unix and macOS it passed the whole $XDG_DATA_DIRS list to :class:~pathlib.Path, giving one unusable path such as /first/applications:/second/applications. :pr:532
• Give :func:~platformdirs.user_applications_dir, :func:~platformdirs.user_applications_path, :func:~platformdirs.site_applications_dir and :func:~platformdirs.site_applications_path the app arguments. Android scopes both applications directories to the app, so without them the functions could only return the unscoped base directory there. On the two site functions they are keyword-only, keeping multipath first positional as it has been since 4.9.0; the two user functions take their boolean options keyword-only. :pr:534
• Correct the ordering note on the iterator methods. use_site_for_root drops the user directory entirely, so the iterators are documented as yielding the most specific directory first rather than always yielding the user one. :pr:533

---

4.11.4 (2026-08-24)

---

• Stop the iter_*_dirs methods yielding the same directory twice when a site directory resolves to its user equivalent - :pr:520 covered only Unix with use_site_for_root. It also hit :meth:~platformdirs.PlatformDirs.iter_runtime_dirs on Unix with $XDG_RUNTIME_DIR set, on Windows and macOS, and all six iterators on Android. :pr:524
• Fix the config merging example in the how-to guide. iter_config_paths yields the user directory first, so the config.update loop let the site defaults override the user's config instead of the other way round. :pr:529

---

4.11.3 (2026-08-13)

---

• python -m platformdirs now lists :func:~platformdirs.user_desktop_dir, which was missing from the properties it prints. :pr:523
• Stop :func:~platformdirs.site_data_dir, :func:~platformdirs.site_config_dir and :func:~platformdirs.site_applications_dir raising IndexError on Unix and macOS when $XDG_DATA_DIRS or $XDG_CONFIG_DIRS holds only separators and whitespace, such as ":". These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:523

---

4.11.2 (2026-08-10)

... (truncated)

Commits

• 7f3960a Release 4.11.3
• c8af984 fix: don't crash when an XDG dirs variable holds only separators (#523)
• 6d2105a 📄 docs: publish llms.txt from the docs build (#522)
• 7e4746c [pre-commit.ci] pre-commit autoupdate (#521)
• See full diff in compare view

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
  • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits

• a43b45d Get ready for the 2.21.0 release.
• d8f14cb Fix version_added for Purescript.
• 19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
• 9992e09 Merge pull request #3191 from jvoisin/dupes
• bd22577 Fix regexlint warnings after latest update.
• 6a62df1 Release preparation: Update the changelog.
• aabba32 Merge pull request #3221 from jvoisin/alter
• d3441d0 Merge pull request #3225 from jvoisin/caddy
• c593f3f Add a lexer for Caddy
• 0644b53 Simplify single-character regex alternations to character classes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.