This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
BlankSpruce/gersemi-pre-commit	repository	minor	0.27.7 → 0.28.1
astral-sh/ruff-pre-commit	repository	minor	v0.15.22 → v0.16.4
bazel_skylib	bazel_dep	patch	1.9.0 → 1.9.2
fmt	bazel_dep	minor	12.1.0 → 12.2.0
googletest	bazel_dep	minor	1.17.0.bcr.2 → 1.18.0
markdown (changelog)		patch	==3.10.2 → ==3.10.3
meson (source)	pre-commit-python	minor	==1.11.2 → ==1.12.0
mkdocs-git-revision-date-localized-plugin		patch	==1.5.3 → ==1.5.4
pygments (changelog)		minor	==2.20.0 → ==2.21.0
pymdown-extensions		patch	==11.0.1 → ==11.0.2
rules_python	bazel_dep	minor	2.2.0 → 2.3.2

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

BlankSpruce/gersemi-pre-commit (BlankSpruce/gersemi-pre-commit)

v0.28.1

Compare Source

v0.28.0

Compare Source

astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)

v0.16.4

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.16.4

v0.16.3

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.16.3

v0.16.2

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.16.2

v0.16.1

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.16.1

v0.16.0

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.16.0

bazelbuild/bazel-skylib (bazel_skylib)

v1.9.2

Compare Source

What's Changed

• Revert allow_symlink = True by default for non-executables
• Change from stamp to some other boolean flag
• Update Bazel versions in CI: drop Bazel 6, add Bazel 9
• Change Starlark flag default propagation from "universal" to "target"

Contributors:
@​gzm0, @​kotlaja, @​susinmotion, @​justinhorvitz

fmtlib/fmt (fmt)

v12.2.0

Compare Source

• Added a C11 API that brings fast, type-safe formatting to C. The new
  fmt-c library and fmt/fmt-c.h header use _Generic to dispatch on
  argument types and outperform printf/sprintf. For example:

  #include <fmt/fmt-c.h>
  
  fmt_print(stdout, "The answer is {}.\n", 42);

  (#​4663,
  #​4671,
  #​4696,
  #​4693,
  #​4694,
  #​4712,
  #​4789).
  Thanks @​Soumik15630m, @​Ferdi265 and @​localspook.

• Added a separate fmt::fmt-module CMake target for C++20 modules and a
  CI workflow that exercises module-based builds
  (#​4684,
  #​4685,
  #​4707,
  #​4708,
  #​4702,
  #​4709).
  Thanks @​MathewBensonCode.

• Enabled the full Dragonbox lookup cache by default for floating-point
  formatting unless optimizing for binary size (__OPTIMIZE_SIZE__),
  giving a ~10–25% speedup. Thanks Matthias Kretz for the suggestion.
  Average time per double on Apple M1 Pro (clang 17, random digits,
  smaller is better) measured with
  dtoa-benchmark:

  Method	Time (ns)
  fmt (full)	22.07
  fmt (compact)	29.55
  ryu	35.21
  double-conversion	81.81
  sprintf	726.27
  ostringstream	864.34

• Improved integer formatting performance by ~3%
  (#​4630). Thanks @​user202729.

• Optimized formatting into back-insert iterators by using bulk container
  append/insert methods (e.g. on std::vector<char> and custom string
  types) (#​4679). Thanks @​user202729.

• Reduced binary size of debug builds (~200k to ~85k in the bloat test) and
  improved compile speed when consteval is unavailable.

• Made path formatting lossless, preserving ill-formed UTF-16
  sequences when converting std::filesystem::path to a narrow string.

• Added support for formatting std::unexpected
  (#​4675). Thanks @​17steen.

• Added overloads of fmt::println that take a fmt::text_style
  (#​4782). Thanks @​ahoarau.

• Added support for positional arguments as width and precision specifiers
  in fmt::printf (#​4643).
  Thanks @​KareemOtoum.

• Made FMT_STRING a no-op when FMT_USE_CONSTEVAL is enabled, since the
  consteval format-string constructor already provides compile-time
  validation
  (#​4611,
  #​4612). Thanks @​friedkeenan.

• Promoted fmt::detail::named_arg to the public API as fmt::named_arg and
  deprecated the detail alias
  (#​4683,
  #​4687). Thanks @​TPPPP72.

• Moved the std::byte formatter from fmt/format.h to fmt/std.h.

• Provided a default definition for fmt::is_contiguous
  (#​4731,
  #​4770). Thanks @​user202729 and @​phprus.

• Added the FMT_USE_FLOCKFILE macro to disable the use of flockfile
  (#​4646,
  #​4666). Thanks @​mvastola.

• Added include_guard(GLOBAL) so that {fmt} can be used in multiple
  submodules of the same project
  (#​4672). Thanks @​torsten48.

• Improved constexpr support
  (#​4659,
  #​4591).
  Thanks @​elbeno and @​17steen.

• Deprecated the implicit conversion from fmt::format_string and
  fmt::basic_fstring to string_view to align with std::format_string;
  use format_string::get() instead.

• Opted out std::complex from tuple formatting so that the dedicated
  std::complex formatter is always used.

• Removed the fmt::say function.

• Deprecated the std::initializer_list overload of fmt::join and the array
  overload of fmt::vformat_to.

• Made the <fmt/core.h> header equivalent to <fmt/base.h> by
  default. Code that relied on <fmt/core.h> pulling in <fmt/format.h>
  must now either include <fmt/format.h> directly or define
  FMT_DEPRECATED_HEAVY_CORE to opt back in.

• Improved wchar_t support: fmt::join now accepts wchar_t and other
  non-char separators, and fmt::format_to_n now works with fmt::runtime
  on wchar_t
  (#​4686,
  #​4714,
  #​4715).
  Thanks @​Yancey2023 and @​sunmy2019.

• Fixed formatting of std::tm with a null tm_zone
  (#​4790). Thanks @​Carmel0.

• Fixed compile-time formatting in fmt/ranges.h, fmt/style.h and
  fmt/std.h (#​4759). Thanks @​j4niwzis.

• Fixed an ambiguity between formatter<std::optional<T>> in fmt/std.h
  and fmt/ranges.h on C++26 (P3168R2)
  (#​4761). Thanks @​phprus.

• Fixed a GCC PCH breakage triggered by a scoped #pragma GCC optimize.

• Fixed a TSAN false positive in the locale handling code
  (#​4755).

• Fixed compile-time format string checks truncating string literals at
  an embedded null byte
  (#​4732). Thanks @​user202729.

• Fixed out-of-bounds reads in printf formatting
  (#​4741,
  #​4742,
  #​4800).
  Thanks @​Algunenano and @​aizu-m.

• Fixed the return type of the f(un)lockfile wrappers on Windows
  (#​4739). Thanks @​mvastola.

• Worked around a CUDA issue when handling UTF-32 literals
  (#​4719). Thanks @​Cazadorro.

• Fixed missing named-argument validation for compiled format strings
  (#​4638). Thanks @​JaeheonShim.

• Fixed fmt::format_to_n in <fmt/compile.h> failing to compile when
  <iterator> is not transitively included
  (#​4615).

• Fixed handling of pointers in format string compilation with
  FMT_BUILTIN_TYPES=0.

• Stopped assuming nul termination of the format string in fmt::printf.
  Thanks @​ZUENS2020 for reporting.

• Fixed a build error when locale support is disabled
  (#​4627). Thanks @​marcel-behlau-elfin.

• Fixed a fallback range formatter for types with a container_type member
  (#​4123,
  #​4660). Thanks @​Soumik15630m.

• Fixed C++20 concept detection
  (#​4653). Thanks @​tearfur.

• Fixed a clang compilation failure
  (#​4718). Thanks @​mccakit.

• Fixed various MSVC warnings, including C4305 and conversion warnings on
  x86 (#​4668,
  #​4594).
  Thanks @​kanren3 and @​blizzard4591.

• Updated the Android Gradle Plugin to 9.x
  (#​4651,
  #​4658). Thanks @​Soumik15630m.

• Made various code, build and test improvements
  (#​4625,
  #​4639,
  #​4644,
  #​4656,
  #​4680,
  #​4681,
  #​4704,
  #​4710,
  #​4713,
  #​4729,
  #​4751,
  #​4758,
  #​4799).
  Thanks @​ZephyrLykos, @​togunchan, @​kagancansit, @​BerndPetrovitsch,
  @​Skylion007, @​st0rmbtw, @​localspook and @​EXtremeExploit.

• Improved documentation, including a rewrite of the format string syntax,
  better handling of doxygen tags, documenting output_file, fixing CSS so
  that whitespace is displayed properly, and various smaller fixes
  (#​4622,
  #​4626,
  #​4631,
  #​4667,
  #​4616,
  #​4748).
  Thanks @​heavywatal, @​ZephyrLykos, @​user202729, @​ssszcmawo, @​bigmoonbit
  and @​Powerbyte7.

• Added building of release artifacts and SLSA provenance in CI, added a
  CodeQL workflow, and added the security policy in .github/SECURITY.md.

Python-Markdown/markdown (markdown)

v3.10.3

Compare Source

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#​1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.
• Link the Extension API documentation to the API Reference (#​1612).

mesonbuild/meson (meson)

v1.12.0

Compare Source

timvink/mkdocs-git-revision-date-localized-plugin (mkdocs-git-revision-date-localized-plugin)

v1.5.4

Compare Source

Security

Raises the gitpython floor from >=3.1.44 to >=3.1.59.

Earlier dependabot bumps only touched this repo's uv.lock, which pins the CI
environment and nothing else. Downstream users installing from PyPI resolved
against pyproject.toml, so they could still land on a GitPython carrying the
2026 option-injection advisories — GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr
among them, all patched by 3.1.58, with further option hardening in 3.1.59.

This plugin never passes user input as git options, so it was not exploitable
through those. The floor bump forces the upgrade in environments that already
hold an older GitPython, and clears the warnings downstream scanners report.

Thanks to @​nucleus-ffm for reporting it in #​222.

Maintenance

• Harden test git repos against flaky "Error building trees" failures by @​timvink in #​212
• ci: update GitHub Actions to Node 24 compatible versions by @​timvink in #​213
• deps: bump idna and pymdown-extensions to patch security alerts by @​timvink in #​214
• Bump gitpython from 3.1.50 to 3.1.58 in #​217, #​219, #​220
• Bump pymdown-extensions from 10.21.3 to 11.0.1 in #​218, #​221

Full Changelog: timvink/mkdocs-git-revision-date-localized-plugin@v1.5.3...v1.5.4

pygments/pygments (pygments)

v2.21.0

Compare Source

(released August 17th, 2026)

• New lexers:

  • BitBake (#​3103)
  • Caddyfile (#​3225)
  • CEL (#​3048)
  • PureScript (#​1077, #​3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#​2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#​3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$
      prefixes (#​2685)
    • Support dollar-prefixed and multi-quote raw strings (#​3129, #​2897)
    • Recognize union (#​3182)
  • C/C++:
    • Add C23/C++26 attributes (#​3084)
    • Add more C2Y keywords (#​3092)
    • Highlight a function following a namespace body (#​2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#​3051)
    • Add .ipp as a file extension (#​3141, #​1008)
  • Clojure: Recognize named, octal and unicode character literals such as
    \space and \o377 as a single token (#​979)
  • Csound: Add missing opcode parameter type letter (#​3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++
    constructs such as template, class and namespace (#​3127)
  • D: Allow non-ASCII (Unicode) identifiers (#​1088)
  • Fish: Fix single quote backslash escape (#​3138, #​2821)
  • Go: Various lexer improvements (#​3199)
  • GoogleSQL: Require a word break after SET (#​3167)
  • Hexdump: Only match valid digits (#​3200, #​2847)
  • JavaScript: Highlight the arguments object (#​3146)
  • Jsonnet: Recognize colons in array slice expressions (#​2828)
  • JSX: Allow apostrophes in element text (#​2816)
  • Julia: Fix rstrings backslash (#​3140, #​2537)
  • Kotlin: Support companion objects without an explicit name (#​2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following
    character, so Foo?, and a?:b tokenize correctly (#​2964)
  • Kusto: Recognize member-access dots in dynamic objects (#​2779)
  • Lua: Various improvements (#​3143)
  • Macaulay2: Update symbols to 1.26.05 (#​3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#​3067)
    • Fix mention regex to support hyphens in usernames (#​3139, #​3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for
    embedded code blocks (#​3133)
  • Mathematica: Recognize \[Name] named-character escapes such as
    \[Nu] instead of emitting an Error token (#​3097)
  • MATLAB, Octave, Scilab: Allow ... line continuations in function
    definition signatures (#​659)
  • MySQL: Require a word break after SET (#​3110)
  • PostgreSQL: Add more keywords (#​3066)
  • Python:
    • Recognize sentinel (#​3114)
    • Recognize frozendict (#​3119)
    • Recognize lazy imports (#​3115)
  • reStructuredText: Allow . and + in directive/role names (#​3085)
  • Ruby: Don't duplicate the body of an unterminated heredoc (#​2998)
  • Ruby: Treat << after ), ] or } as the shift operator
    rather than the start of a heredoc (#​760)
  • SCSS: Recognize variable references in property values (#​2818)
  • Shell: Recognize chevron prompts (#​3096)
  • Smithy: Fix text blocks and add missing syntax (#​3168)
  • Swift: Keep func a keyword in class func type methods (#​1125)
  • Tcl: Stop $name variable references at a dash (#​1720)
  • TeX: Recognize LaTeX math environments as math (#​3034)
  • Twig: Allow uppercase letters at the start of identifiers (#​3159, #​2965)
  • TypeScript: Only treat module as a keyword when followed by
    whitespace, so identifiers like modules and module.exports
    are highlighted correctly (#​2823)
  • Vala: Recognize verbatim strings before ordinary quoted strings (#​2861)
  • Vala: Recognize conditional compilation directives (#​2858)
  • Vim:
    • Bump the syntax file to vim 9.2 (#​3183, #​3174)
    • Small improvements to the VimScript lexer (#​3173)
  • YAML: Add yml alias (#​3169), recognize non-breaking spaces as valid
    scalar content (#​2827)
  • WebAssembly: Recognize sign-extension operators (#​2991, #​3160)
  • XML: Mark SVG files as XML (#​3093)

• New styles:

  • Night Owl (#​3132)

• Fix catastrophic backtracking in looks_like_xml (#​2931, #​3112)

• Improve monokai theme colors (#​3100)

• Improve handling of non-string types in html_escape to fix broken clients (#​3090, #​3086)

• LaTeX formatter: honor the wrapped lexer's stripnl and other input
  options when escapeinside is set, so blank lines are no longer stripped
  under stripnl=false (#​2975)

• RawTokenFormatter: fix a crash when error_color is set (#​3215)

• Groff formatter: don't duplicate a character when word-wrapping (wrap)
  a token that is not at the end of a line (#​3201)

• Add support for Python 3.15 (#​3099)

• Fix invalid -L values report success (#​3217)

• Allow transparent as a color style definition (#​3180, #​3170)

• HtmlFormatter: " and ' now render literally (#​3185)

facelessuser/pymdown-extensions (pymdown-extensions)

v11.0.2

Compare Source

11.0.2

• FIX: InlineHilite: Improve performance of inline code matching.
• FIX: Keys: Fix regex pattern inefficiencies.
• FIX: Blocks.HTML: Fix backtracking in HTML extension.

bazel-contrib/rules_python (rules_python)

v2.3.2

Compare Source

{#v2-3-2-fixed}

Fixed

• (pypi) Fixed analysis failures in {obj}pip.parse for source-less wheels with
  dependencies. (#​4053)
• (pypi) Fixed the handling of optional args for the {obj}pip_archive and {obj}whl_archive
  repository rules within the {obj}whl_library. From now on we are dropping unsupported args.
• (pypi) Fixed {obj}pip.parse repository names for Git sources in uv.lock
  files by excluding URL query and fragment components
  (#​4084).

{#v2-3-1}

v2.3.1

Compare Source

{#v2-3-1-fixed}

Fixed

• Previous refactor that shipped with 2.3 introduced regression for the
  experimental repository cache users. This restores the previous behavior
  (#​3791).

{#v2-3-0}

v2.3.0

Compare Source

{#v2-3-0-changed}

Changed

• (gazelle) BREAKING rules_python 1.5.0 or higher is now required. The Python
  extension selects its standard library list on is_python_3.14, which earlier
  versions do not define.

{#v2-3-0-fixed}

Fixed

• Fixed py_binary_rule_builder() / py_test_rule_builder() (from python/api/executables.bzl)
  failing at analysis time with a visibility error when used to construct a custom rule from an
  external module.
• (compile_pip_requirements) Add the explicit data attribute and forward it
  directly to the generated py_binary, so files passed via data can be
  referenced from extra_args using $(location ...).
• (coverage) The warning about a missing bundled coverage.py wheel is no longer
  emitted as we are now falling back to a pure python wheel
  (#​3950).
• (gazelle) The Python extension now uses the correct standard library module list for
  python_version 3.13 and 3.14; previously both fell back to the 3.11 list, so modules
  added or removed since then (e.g. compression.zstd, telnetlib) were misclassified. The
  fallback list for unrecognized versions is now the newest available one rather than 3.11
  (#​3978).
• (pypi) Allow uv_lock to be specified in pip.parse without requiring
  requirements_lock (or other os-specific requirement file attributes) to be
  set.
• (pypi) Fixed the fixed-point loop that resolves self-referencing extras
  (pkg[extra] entries in a package's own Requires-Dist). The loop compared
  the number of extras discovered in the current round against the number known
  before it, rather than against the size of the merged set. As a result it
  could stop before every extra was resolved, silently dropping dependencies
  only reachable through two or more pkg[extra] hops, and for the common case
  of a package with no self-referencing extras it never converged at all,
  running all 10000 rounds while evaluating each wheel's generated BUILD file
  (#​4039).
• (pypi) Requirement --hash=<algo>:<digest> pins and Simple API
  #<algo>=<digest> URL fragments are now parsed for all hash algorithms
  instead of silently dropping everything except sha256. Non-sha256 pins are
  matched against the digests advertised by the index and downloads are verified
  using the corresponding Subresource Integrity value, and the pins are kept in
  the requirement line when falling back to pip
  (#​3972).
  As part of this, whl_library repos created by pip.parse now always pass
  the digest via the integrity attribute (SRI format) instead of sha256,
  and the lock file facts store digests as <algo>:<digest> values (the facts
  version was bumped, so cached index information is refreshed once).
• (pypi) pip.parse(uv_lock = ...) no longer exposes uv workspace/root members
  that resolve to no wheel or sdist (e.g. source = { virtual = "." } or editable
  installs). Previously these source-less packages were added to the hub's
  all_requirements / all_whl_requirements with an alias to a subpackage that
  does not exist, breaking analysis for anything enumerating the full set such as
  modules_mapping(wheels = all_whl_requirements)
  (#​3934).
• (pypi) correctly parse the index_url for each wheel so that the source registry is forwarded to
  the {obj}whl_library. This is so that the purl for package_metadata can be correctly
  constructed.
• (pypi) fixed the URL normalization function to correctly handle local paths
  enabling wheel sources files to point to an absolute path. Currently it supports
  the file://<absolute_path> for linux and windows like paths. We also support
  envsubst for the said paths from now on.

{#v2-3-0-added}

Added

• (bzlmod) Added MODULE.bazel flag aliases for Starlark-defined flags:
  build_python_zip, incompatible_default_to_explicit_init_py,
  python_path, and experimental_python_import_all_repositories.
• (bzlmod) Added the {obj}explicit_init_py tag class to the `{obj}`config module extension for configuring implicit __init__.py file
  generation module-wide.
  (#​3997,
  #​2945)
• (cc) Added experimental {obj}py_extension macro for creating C/C++ Python
  extension modules
  (#​3283).
  (cc) Added libc, platform_machine, platform_tag, soabi, and
  sys_platform attributes and info fields to {obj}py_cc_toolchain /
  {obj}PyCcToolchainInfo.
• (pip,python) Added pyproject_toml attribute to {obj}pip.default, {obj}pip.parse and {obj}python.defaults to read the default Python version from the requires-python field of pyproject.toml.
• (py_test) Added an opt-in safeguard against py_test targets that silently
  pass without running any tests. Set
  {obj}--@rules_python//python/config_settings:validate_test_main=enabled to
  fail the build when a test's main module only contains inert top-level
  statements (definitions, imports, assignments) and never invokes a test
  runner (#​3824).

{#v2-2-0}

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.