chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Update
cosl	==1.9.2 → ==1.10.2			minor
cryptography (changelog)	==49.0.0 → ==50.0.0			major
luaHealthchecksRepo	71b878c → 5cdc8c2			digest
myst-parser	==4.0.1 → ==5.1.0			major
nginxUpstreamLuaModuleRepo	a1c451a → 86d6521			digest
ops (changelog)	==3.7.1 → ==3.8.1			minor
packaging	==26.2 → ==26.3			minor
sphinx-terminal	==1.0.3 → ==1.1.0			minor
sphinxcontrib-mermaid (changelog)	==2.0.2 → ==2.1.0			minor

---

Release Notes

canonical/cos-lib (cosl)

v1.10.2

Compare Source

What's Changed

• feat: persist the cos-tool result cache across processes by @​Abuelodelanada in #​203

Full Changelog: canonical/cos-lib@1.10.1...1.10.2

v1.10.1

Compare Source

What's Changed

• refactor: Rules class helper methods as free functions by @​MichaelThamm in #​195
• perf: memoize _exec to avoid redundant cos-tool subprocess calls by @​Abuelodelanada in #​202

Full Changelog: canonical/cos-lib@1.9.2...1.10.1

pyca/cryptography (cryptography)

v50.0.0

Compare Source

executablebooks/MyST-Parser (myst-parser)

v5.1.0

Compare Source

✨ New Features

• ✨ Add "alert" syntax extension for GFM alerts (e.g. > [!NOTE]), see by gh-user:chrisjsewell in gh-pr:1128
• ✨ Add "gfm_autolink" syntax extension for GFM autolinks, see by gh-user:chrisjsewell in gh-pr:1128
• ✨ Add myst_strikethrough_single_tilde config option to allow single tilde (~) for strikethrough by gh-user:chrisjsewell in gh-pr:1128
• ✨ Add myst_colon_fence_exact_match config option to require the closing colon fence to have exactly the same number of colons as the opening, see by gh-user:chrisjsewell in gh-pr:1128

👌 Improvements

• 👌 Update myst_gfm_only mode to use the unified gfm_plugin, which now includes GFM autolinks, alerts, and improved strikethrough/tasklist handling by gh-user:chrisjsewell in gh-pr:1128
• 👌 Improve MathJax 4 compatibility for Sphinx 9 by gh-user:chrisjsewell in gh-pr:1110
• 👌 Stop directive-option parsing at colon fences, fixing nested colon fence directives by gh-user:chrisjsewell in gh-pr:1133

🐛 Bug Fixes

• 🐛 Use docname instead of source path in warning locations by gh-user:chrisjsewell in gh-pr:1114
• 🐛 Correctly encode & in Markdown URLs by not HTML-escaping refuri by gh-user:chrisjsewell in gh-pr:1126
• 🐛 Fix RemovedInSphinx10Warning for inventory item iteration by gh-user:chrisjsewell in gh-pr:1129
• 🐛 Pin mdit-py-plugins>=0.6.1 for nested field list fix by gh-user:chrisjsewell in gh-pr:1134

⬆️ Dependency Upgrades

• ⬆️ Upgrade to markdown-it-py~=4.2 and mdit-py-plugins~=0.6 by gh-user:chrisjsewell in gh-pr:1128
• ⬆️ Update pygments requirement from <2.20 to <2.21 by gh-user:chrisjsewell in gh-pr:1117

Full Changelog: v5.0.0...v5.1.0

v5.0.0

Compare Source

This release significantly bumps the supported versions of core dependencies:

‼️ Breaking Changes

This release updates the minimum supported versions:

• Python: >=3.11 (dropped Python 3.10, tests up to 3.14)
• Sphinx: >=8,<10 (dropped Sphinx 7, added Sphinx 9)
• Docutils: >=0.20,<0.23 (dropped docutils 0.19, added docutils 0.22)
• markdown-it-py: ~=4.0 (upgraded from v3)

⬆️ Dependency Upgrades

• ⬆️ Upgrade to markdown-it-py v4 by gh-user:chrisjsewell in gh-pr:1060
• ⬆️ Drop Python 3.10 and Sphinx 7 by gh-user:chrisjsewell in gh-pr:1059
• ⬆️ Drop docutils 0.19 by gh-user:chrisjsewell in gh-pr:1061
• ⬆️ Add support for Python 3.14 by gh-user:chrisjsewell in gh-pr:1075
• ⬆️ Support Sphinx v9 by gh-user:chrisjsewell in gh-pr:1076
• ⬆️ Allow docutils 0.22 by gh-user:chrisjsewell in gh-pr:1084

👌 Improvements

• 👌 Improve generation of meta nodes by gh-user:AA-Turner in gh-pr:1080

📚 Documentation

• 📚 Fix typo in tables.md by gh-user:electricalgorithm in gh-pr:1034
• 📚 Fix minor typo in cross-referencing.md by gh-user:krassowski in gh-pr:1036

🔧 Internal / Maintenance

• 🔧 Update pre-commit by gh-user:chrisjsewell in gh-pr:1058
• 🔧 Add AGENTS.md by gh-user:chrisjsewell in gh-pr:1083

Full Changelog: v4.0.1...v5.0.0

canonical/operator (ops)

v3.8.1

Compare Source

Fixes

• Align Juju naming rules with testing class rules (#​2570)
• Do not attempt to mutate secret data in grant/revoke during tests (#​2614)
• Allow IdentityDict to be assigned IdentityAccess (#​2628)
• Only decode fields used by the data class in Relation.load() (#​2636)
• Use juju.wait for workload version tests in Kubernetes tutorial (#​2650)

Documentation

• Wait longer for Loki data in Kubernetes tutorial integration tests (#​2611)
• Add more guidance about charm naming (#​2610)
• Fix tempo test_deploy URL (#​2631)
• Add how-to guide for debugging Kubernetes charms (#​2498)
• Revert to installed charmcraft for initing charms (#​2635)
• Grab workload version in Kubernetes tutorial (#​2559)
• Separate test_workload_version_is_set in Kubernetes tutorial chapter 3 (#​2638)
• Add how-to guide to configure jubilant logs (#​2619)
• Use autofunction for layer_from_rockcraft (#​2648)
• Remove log_cli and log_file ini options; keep them as CLI arguments for integration tests (#​2654)
• Fix typo in explanation of mock_version fixture usage (#​2647)
• Switch Kubernetes tutorial charms to rock version of demo server (#​2649)

Tests

• Type-check testing/src/scenario and fix uncovered errors (#​2615)

CI

• Add dependency-review-action on PRs (#​2587)
• Re-enable the tracing integration tests (#​2586)
• Adopt new dependabot conventions (#​2609)
• Drop unsupported cooldown.semver-major-days from github-actions block (#​2617)
• Open an issue if a scheduled workflow fails (#​2627)
• Hash-pin actions and drop zizmor config (#​2612)
• Use uv-venv-lock-runner in tracing tox, align deps (#​2651)

v3.8.0

Compare Source

Features

• Note the socket path in Pebble tracing spans (#​2555)

Fixes

• Treat remote unit zero as explicit (#​2454)
• Ensure resources are cleaned up in testing.Context (#​2506)
• Close SQLite storage in Harness.cleanup() (#​2507)
• Restore sys.breakpointhook on _Manager teardown (#​2542)
• Avoid errors in finalisation due to already-closed websocket (#​2548)
• Use the correct value for JUJU_HOOK_NAME when objects contain dashes (#​2552)
• Avoid double-closing the framework in testing teardown (#​2561)
• Don't leak exec I/O threads when waiting on the change fails (#​2558)
• Take Pebble defaults into consideration when consistency checking Checks (#​2567)
• Tear down Runtime.exec() when the charm raises (#​2581)

Documentation

• Fix small issues in K8s tutorial (#​2540)
• Document user-secret observer lifecycle and secret-changed semantics (#​2522)
• Replace CoC with link to Ubuntu Code of Conduct (#​2564)
• Add a small note about -W error in the unit test how-to (#​2560)
• Add doc about subordinate charms (#​2455)
• Add 26.04 to the versions page and mark 2.23 as LTS (#​2517)
• Clarify storage-detaching applies to both machine and K8s charms (#​2554)
• Add guidance about names of workload-less charms (#​2496)
• Fix first unit tests command in machine charm tutorial (#​2574)
• Extend security explanation page to cover SEC0030 V1.3 gaps (#​2571)
• Move docs to canonical.com/juju/docs/ops (#​2545)
• Fix docstring of _Event._is_action_event (#​2580)

Tests

• Treat warnings as errors when running unit tests (#​2541)
• Fix mock_temp_dir fixture's open() patch (#​2553)
• Add integration tests for ops.hookcmds (#​2520, #​2562)
• Fix integration test flakes on Juju 3 k8s and Juju 4 secrets (#​2584)

Refactoring

• Avoid yaml.load() to silence security scanner false positives (#​2523)
• Replace jsonpatch with an inline dict-diff (#​2578)
• Move the otlp-json package to be a regular ops-tracing module (#​2585)
• Distinguish between init and attribute types in testing state classes (#​2331)

CI

• Remove obsolete containerd workaround from integration workflow (#​2519)
• Use the sys.monitoring coverage core (#​2518)

pypa/packaging (packaging)

v26.3

Compare Source

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#​1267, #​1270, #​1298)
• PEP 808: accept Metadata-Version: 2.6. (#​1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#​1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#​1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#​1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#​1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#​1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#​160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#​1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#​1241)
• Fix an AttributeError when hashing internally trimmed versions. (#​1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#​1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#​1232)
• Normalize requested extra names before comparing or hashing requirements. (#​644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#​1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#​1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#​1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#​1213)
• Keep the parentheses of a nested group when serializing markers. (#​1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#​1246, #​1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#​1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#​1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#​1249)
• Reject requirements and markers with a trailing line break. (#​1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#​1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#​1330)
• Reject malformed Description-Content-Type values. (#​1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#​1327)
• Route multipart email payloads to unparsed instead of asserting. (#​1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#​1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#​1356)
• Raise InvalidLicenseExpression for misplaced WITH clauses and empty LicenseRef- names. (#​1266)
• Raise InvalidLicenseExpression instead of KeyError for a LicenseRef- with a + suffix. (#​1219)

Fixes for tags and filenames

• Raise InvalidTag from parse_tag() for tags with the wrong number of components. (#​1238)
• Reject empty tag components in parse_wheel_filename() and parse_tag(). (#​1234)
• Reject an empty project name in the wheel and sdist filename parsers. (#​1305)
• Reject wheel filenames with a trailing newline. (#​1341)
• Reject wheel tags whose interpreter component is not an identifier. (#​577)
• is_normalized_name now rejects names with collapsed double hyphens like a--b. (#​1230)
• Fix duplicate explicit abi3t tags. (#​1245)
• Forward the warn argument to generic_tags() in sys_tags(). (#​1264)
• Raise SystemError for an empty or malformed CPython EXT_SUFFIX. (#​1271, #​1301)
• Fix a typo in the macOS fat3 architecture name (was fat32). (#​1199)

Fixes for pylock, direct URLs, and dependency groups

• Percent-decode pylock artifact file names derived from a url so that local versions (e.g. a wheel with 2.12.1+cu130 encoded as 2.12.1%2Bcu130) yield a valid file name. (#​1314)
• Use an explicitly empty tags sequence in Pylock.select() instead of falling back to sys_tags(). (#​1349)
• Fix Pylock.select() on Python builds that report a non-PEP 440 python_full_version (e.g. 3.15.0+). (#​1179)
• Reject TOML booleans where integers are expected in pylock files. (#​1244)
• Add PylockSelectError to packaging.pylock.__all__. (#​1202)
• Fix DirectUrl credential stripping for passwords containing @. (#​1218)
• Parse the URL scheme case-insensitively when checking for file URLs in direct_url. (#​1240)
• Require absolute file URLs for local directories in direct_url. (#​1297)
• Collect InvalidRequirement errors while resolving dependency groups instead of leaking them. (#​1302)
• Don't cache malformed dependency group parses. (#​1248)

Performance

• Implement Specifier and SpecifierSet filtering with the new range engine. (#​1120, #​1259)
• Cache the default marker environment. (#​1250)
• Cache the _manylinux module lookup process-wide. (#​1254)
• Add __slots__ to Requirement and the token classes. (#​1320, #​1258)
• Keep range caches across canonicalization, precompile the wheel project-name pattern, simplify parse_tag(), and skip platform.mac_ver() when the version and arch are given. (#​1253, #​1256, #​1236, #​1255)

Documentation

• Describe the validation scope of packaging.pylock. (#​1339)
• Explain which packaging.metadata fields are validated. (#​1342)
• Document RFC822Policy in the low-level packaging.metadata interface. (#​1222)
• Enable nitpicky mode and render missing classes and fields in the API reference. (#​1196, #​1225, #​1277)
• Add missing versionadded / versionchanged directives and many small docstring fixes across the API reference. (#​1205, #​1207, #​1208, #​1209, #​1211, #​1216, #​1217, #​1223, #​1272, #​1273, #​1274, #​1291, #​1300, #​1303, #​1317, #​1344)

Internal

• Add Python 3.15 to the test matrix. (#​1190)
• Add a musl/Alpine test job and make the test suite pass on musl. (#​1226, #​1227)
• Expand the downstream test matrix by ten projects. (#​1261)
• Update to mypy 2. (#​1191)
• Use nox's uv integration. (#​1057)

New Contributors

• @​Sean-Kenneth-Doherty made their first contribution in #​1187
• @​jsirois made their first contribution in #​1199
• @​Alan-K-Biju-7 made their first contribution in #​1217
• @​facutuesca made their first contribution in #​1218
• @​NovaLux12 made their first contribution in #​1317
• @​atsuoishimoto made their first contribution in #​1314
• @​gaoflow made their first contribution in #​1291
• @​jacobdr made their first contribution in #​608
• @​deepakganesh78 made their first contribution in #​1351
• @​rajath201 made their first contribution in #​1356

Full Changelog: pypa/packaging@26.2...26.3

mgaitan/sphinxcontrib-mermaid (sphinxcontrib-mermaid)

v2.1.0

Compare Source

• Add mermaid_config option for passing a global Mermaid configuration (#​215)
• Load the ZenUML plugin lazily, only on pages that contain a ZenUML diagram, and confine its injected stylesheet to the diagram subtree so it no longer restyles the host theme (#​252)
• Skip injecting the Mermaid JavaScript when the output format does not support it (#​253)
• Fix d3 zoom on nested SVGs (#​179)
• Fix fullscreen button positioning inconsistency (#​225)
• Fix interactions between the fullscreen, zoom, and lazy-render features (#​254)

v2.0.3

Compare Source

• Capture mmdc error message as string for nicer error display
• Fix local JS module imports on root-level pages by ensuring a valid relative ES module specifier (#​246)
• Defer rendering of Mermaid diagrams hidden by a parent (e.g. Reveal.js slides, unopened tabs) until they become visible, fixing broken SVGs

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.