Bump the docs-toolchain group across 1 directory with 6 updates by dependabot[bot] · Pull Request #66 · OasisLMF/GenerateDocs

dependabot · 2026-10-08T14:27:48Z

Bumps the docs-toolchain group with 6 updates in the / directory:

Package	From	To
jupytext	`1.19.5`	`1.19.6`
lxml	`6.1.2`	`6.1.3`
markupsafe	`3.0.3`	`3.0.4`
matplotlib	`3.11.1`	`3.11.2`
oasislmf	`2.5.6`	`2.5.8`
ods-tools	`5.0.7`	`5.0.9`

Updates jupytext from 1.19.5 to 1.19.6

Release notes

Sourced from jupytext's releases.

Version 1.19.6

Security

The Quarto conversions now run in a private temporary directory, so that the output file that quarto convert names after its input can no longer be pre-created as a symlink by another user of the machine. Thanks to Naveed for the PR (#1615).

Paired paths from notebook formats metadata are now prevented from escaping the working tree, including when an absolute notebook path is used. Thanks to Naveed for addressing the issue (#1588).

The CLI now ignores trusted cell metadata when the notebook signature is invalid, so a trusted=true option in a paired text file cannot make untrusted notebook outputs trusted during --sync. Thanks to Naveed for the fix (#1617).

Custom cell_markers and endofcell values in the light format are now matched literally, preventing regular-expression injection, parsing errors, and excessive processing time on crafted notebooks. This also fixes writing OCaml notebooks with custom cell markers. Thanks to Naveed again for the PR (#1618).

We have merged Dependabot security updates for the JupyterLab extension and the documentation website (#1614, #1620, #1622, #1624, #1634, #1639, #1642, #1643, #1647, #1653, #1654).

Fixed

Menu entries such as "Rename Notebook…" name the file type again, instead of saying "default". Thanks to Michał Krassowski for this PR (#1632).

Mermaid %% comments inside a markdown cell are no longer mistaken for py:percent cell markers (#1533). Thanks to Sanjay Santhanam for his PR (#1609)

A whitespace-only final line in a percent-format cell is now preserved when reading and round-tripping the notebook (#1599). Thanks to lowbyteguy for the PR (#1610).

The JupyterLab extension's development install script now uses the correct jupyter-builder import (#1632). Thanks again to Michał Krassowski for this fix.

Fixed JupyterLab extension build issues related to Yarn package checksums. Thanks to Mahendra Paipuri for his contributions to #1614, #1620, and #1621.

Fixed pairing on Windows when a prefix root contains subdirectories, such as notebooks/tutorials///ipynb.

Changed

Updated the JupyterLab extension's production dependencies (#1621, #1641, #1652).

Updated the documentation website's Astro, Starlight, and Sharp dependencies (#1612, #1621, #1625, #1641, #1646, #1650, #1652).

Updated the GitHub Actions used for CI and publishing (#1613, #1619, #1633, #1640, #1649, #1651).

Updated Jupyter Server in the Pixi environments. Thanks again to Mahendra Paipuri for this update (#1646).

Added

We have added a development container that can be opened with VS Code’s Dev Containers extension (#1655).

Added support for the Jenner language. Thanks to Lawrence Sinclair for this contribution (#1493).

Changelog

Sourced from jupytext's changelog.

1.19.6 (2026-10-04)

Security

The Quarto conversions now run in a private temporary directory, so that the output file that quarto convert names after its input can no longer be pre-created as a symlink by another user of the machine. Thanks to Naveed for the PR (#1615).

Paired paths from notebook formats metadata are now prevented from escaping the working tree, including when an absolute notebook path is used. Thanks to Naveed for addressing the issue (#1588).

The CLI now ignores trusted cell metadata when the notebook signature is invalid, so a trusted=true option in a paired text file cannot make untrusted notebook outputs trusted during --sync. Thanks to Naveed for the fix (#1617).

Custom cell_markers and endofcell values in the light format are now matched literally, preventing regular-expression injection, parsing errors, and excessive processing time on crafted notebooks. This also fixes writing OCaml notebooks with custom cell markers. Thanks to Naveed again for the PR (#1618).

We have merged Dependabot security updates for the JupyterLab extension and the documentation website (#1614, #1620, #1622, #1624, #1634, #1639, #1642, #1643, #1647, #1653, #1654).

Fixed

Menu entries such as "Rename Notebook…" name the file type again, instead of saying "default". Thanks to Michał Krassowski for this PR (#1632).

Mermaid %% comments inside a markdown cell are no longer mistaken for py:percent cell markers (#1533). Thanks to Sanjay Santhanam for his PR (#1609)

A whitespace-only final line in a percent-format cell is now preserved when reading and round-tripping the notebook (#1599). Thanks to lowbyteguy for the PR (#1610).

The JupyterLab extension's development install script now uses the correct jupyter-builder import (#1632). Thanks again to Michał Krassowski for this fix.

Fixed JupyterLab extension build issues related to Yarn package checksums. Thanks to Mahendra Paipuri for his contributions to #1614, #1620, and #1621.

Fixed pairing on Windows when a prefix root contains subdirectories, such as notebooks/tutorials///ipynb.

Changed

Updated the JupyterLab extension's production dependencies (#1621, #1641, #1652).

Updated the documentation website's Astro, Starlight, and Sharp dependencies (#1612, #1621, #1625, #1641, #1646, #1650, #1652).

Updated the GitHub Actions used for CI and publishing (#1613, #1619, #1633, #1640, #1649, #1651).

... (truncated)

Commits

9fccc3d Version 1.19.6 (#1656)
85c65a9 Add Jenner language support (#1493)
ca39ad2 Add development container (#1655)
0176ff2 reject paired paths that escape the notebook directory tree (#1588)
1eb4653 Ignore '%%' lines inside fenced blocks of py:percent markdown cells (#1609)
b1d7b65 build(deps): bump the jupytext-extension-security-updates group across 2 dire...
85df69a build(deps): bump the actions-dependencies group with 3 updates (#1651)
c3bb81d run quarto convert in a private temp directory (#1615)
9bbd990 build(deps): bump the jupytext-extension-security-updates group across 1 dire...
f96ae7d build(deps): bump the jupytext-extension-dependencies group across 2 director...
Additional commits viewable in compare view

Updates lxml from 6.1.2 to 6.1.3

Changelog

Sourced from lxml's changelog.

6.1.3 (2026-09-02)

Bugs fixed

LP#2165901: External parameter entity parsing was allowed by default (with resolve_entities="internal"). Issue found by Tomer Fichman.

Commits

3c1a4c7 Prepare release of 6.1.3.
c1191fc Update changelog.
03ec312 Disable parameter entity parsing when internal-only entity parsing is requested.
11d03e9 Build: Prevent duplicate Py3.8 wheel builds.
9efc586 Build: Exclude musllinux-ARM from Py3.8 wheel building to prevent slow emulat...
9716fb1 Build: Include older PyPy versions.
0f3327d Build: Exclude Win-Aarch64 from wheel build.
6967c96 Build: Make all built wheels downloadable even if they don't pass the release...
061218d Build: Exclude Py3.15 i686 wheels from validation (because they are intention...
ce9fe0d Build: Fix Py3.8 windows build.
See full diff in compare view

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.4/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-4 Milestone: https://github.com/pallets/markupsafe/milestone/17?closed=1

Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.

Improve performance of striptags. #521

Changelog

Sourced from markupsafe's changelog.

Version 3.0.4

Released 2026-10-02

Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.

Improve performance of striptags. :issue:521

Commits

ece2607 release version 3.0.4
620bc80 split archs
73c3be1 fix wheel builds (#536)
d8ae19e fix wheel builds
ff1eaff Build Android and iOS wheels (#516)
87e64f9 build Android and iOS wheels
bc33c55 Build ppc64le wheels (#518)
0ddd6ea build ppc64le wheels
3e07758 Build armv7l wheels (#514)
39b9aae build armv7l wheels
Additional commits viewable in compare view

Updates matplotlib from 3.11.1 to 3.11.2

Release notes

Sourced from matplotlib's releases.

REL: v3.11.2

This is the second bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

Speed up RGBA-stage image resampling

Fix hexbin clipping in PDF output

Fix \text with internal braces

Fix some crashes and make some checks more robust to unlikely cases

Fix frame skew when saving GIF animations with PillowWriter

Fix HiDPI handling in Qt toolbar and WebAgg embeddings

Fix ResizeEvent handling for TextBox

Fix bug with PGF hatch linewidth and color

Fix a bug with drawing an empty Collection

Fix incorrect glyphs in Cairo backends

Improve build system to prevent conflicts between wheels and system libraries

Commits

d3ca917 REL: v3.11.2
b76fea9 DOC: Set current version to 3.11.2
39c7f06 DOC: Prepare GitHub stats for 3.11.2
5dd13e3 Merge branch 'v3.11.1-doc' into release-3.11.2
aa484be Merge branch 'v3.11.0-doc' into v3.11.1-doc
0e10f83 Merge pull request #32330 from meeseeksmachine/auto-backport-of-pr-32324-on-v...
ebe947b Backport PR #32324: Don't force any diagnostics to be errors in bundled Harfbuzz
8f4b7c5 Merge pull request #32322 from meeseeksmachine/auto-backport-of-pr-32321-on-v...
93278ad Backport PR #32321: DOC: correct note about PyOS_InputHook
b0aee78 Merge pull request #32319 from meeseeksmachine/auto-backport-of-pr-32305-on-v...
Additional commits viewable in compare view

Updates oasislmf from 2.5.6 to 2.5.8

Release notes

Sourced from oasislmf's releases.

Release 2.5.8

OasisLMF Changelog - 2.5.8

#2060 - fix(pre-analysis): preserve original exposure file format for snapshot saves

#2063 - feat(gulmc): coverage dependency (source-driven conditional vulnerability)

#2108 - Dummy model vectorise

#2130 - Only Track issues with the hubspot label

#2132 - Fix fmpy back-allocation rule 1 for layers above layer 1

#2133 - Fix IntCastingNaNError in write_empty_policy_layer when an account has no policy-layer terms

#2135 - Pre-analysis hook constructs the user's class twice and prints kwargs

#2138 - fix(lookup): reproject vector geometries to EPSG:4326 in build_rtree (#2134)

#2140 - fix/csvtobin_pipe

#2141 - fix/elt-plt-reset-state-buffer-full

#2142 - fix/rerun-stale-fifo-redirect

#2148 - Make optional arguments not required

#2150 - docs: scope the docstring rule, and correct what CI enforces

#2152 - Add global logging options to all computaion funcs

#2154 - fix(cli): print help when oasislmf api get is called without options set

#2155 - feature/not-modelled-locations

#2157 - Parallelise the ExposurePreAnalysis hook by account group

#2158 - docs: author version availability as NEXT, resolve it at release

#2160 - fix(losses): pre-build GUL structures for the engine that actually runs

#2163 - Check and wait for pytools logging to complete

#2164 - FileNotFoundError on GenerateLossesDir.run

#2166 - feat(lookup): add geog_lookup builtin for OED GeogScheme/GeogName (#2144)

#2167 - fix/gul_error_csv_write

#2170 - Fix Crash in a Cyber model using PreAnalysis hook

#2173 - Fix FootprintCsv crashing on a bare pd.read_csv() call

OasisLMF Notes

Only Track issues with the hubspot label - [(PR #2130)](OasisLMF/OasisLMF#2130)

fix/csvtobin_pipe - [(PR #2140)](OasisLMF/OasisLMF#2140)

fixes and closes OasisLMF/OasisLMF#2139

Fix eltpy/pltpy crash on MELT/QELT/MPLT/QPLT output-buffer overflow - [(PR #2141)](OasisLMF/OasisLMF#2141)

eltpy/pltpy failed to reset state["reading_losses"] on the buffer-full early-return taken when the MELT/QELT (or MPLT/QPLT) output buffer fills right at a summary's terminator. This left the reader's state stuck mid-summary, so the next call misread the following summary's header bytes as sample data, crashing with a spurious IndexError.

This PR reworks the fix to reserve buffer capacity for a summary's worst-case output before reading its header, rather than checking after writing. This removes every capacity check from the terminator write path, so the missing-reset bug can't recur.

It also fixes an independent bug the above depends on: buffer-full and new-event returns now read the persisted state["current_event_id"] instead of the event_id parameter, since the caller always passes event_id=0 on a fresh call. Previously this could write EventId=0 to output after any buffer-full resume.

Adds regression tests covering a buffer overflow spanning multiple summaries, an overflow landing right before a genuine new event, and the SELT reservation margin.

closes OasisLMF/OasisLMF#2147

fix/rerun-stale-fifo-redirect - [(PR #2142)](OasisLMF/OasisLMF#2142)

... (truncated)

Changelog

Sourced from oasislmf's changelog.

OasisLMF Changelog

2.5.8_

#2060 - fix(pre-analysis): preserve original exposure file format for snapshot saves

#2063 - feat(gulmc): coverage dependency (source-driven conditional vulnerability)

#2108 - Dummy model vectorise

#2130 - Only Track issues with the hubspot label

#2132 - Fix fmpy back-allocation rule 1 for layers above layer 1

#2133 - Fix IntCastingNaNError in write_empty_policy_layer when an account has no policy-layer terms

#2135 - Pre-analysis hook constructs the user's class twice and prints kwargs

#2138 - fix(lookup): reproject vector geometries to EPSG:4326 in build_rtree (#2134)

#2140 - fix/csvtobin_pipe

#2141 - fix/elt-plt-reset-state-buffer-full

#2142 - fix/rerun-stale-fifo-redirect

#2148 - Make optional arguments not required

#2150 - docs: scope the docstring rule, and correct what CI enforces

#2152 - Add global logging options to all computaion funcs

#2154 - fix(cli): print help when oasislmf api get is called without options set

#2155 - feature/not-modelled-locations

#2157 - Parallelise the ExposurePreAnalysis hook by account group

#2158 - docs: author version availability as NEXT, resolve it at release

#2160 - fix(losses): pre-build GUL structures for the engine that actually runs

#2163 - Check and wait for pytools logging to complete

#2164 - FileNotFoundError on GenerateLossesDir.run

#2166 - feat(lookup): add geog_lookup builtin for OED GeogScheme/GeogName (#2144)

#2167 - fix/gul_error_csv_write

#2170 - Fix Crash in a Cyber model using PreAnalysis hook

#2173 - Fix FootprintCsv crashing on a bare pd.read_csv() call .. _2.5.8: OasisLMF/OasisLMF@2.5.7...2.5.8

2.5.7_

#2065 - docs: Diátaxis restructure + ktools→pytools kernel + executable notebooks

#2067 - ci: allow OasisModels CLI workflow to target an external oasislmf fork

#2073 - refactor(gulmc): split compute_event_losses into inlined njit helpers

#2076 - fix/run with env dtype

#2079 - vectorisation of cond_info

#2080 - google style docstrings (1356)

#2083 - Fix CI codecov uploads

#2085 - Issue 2084 cyber loc_idx bug

#2087 - Fix typo: 'vulnerbaility_id' -> 'vulnerability_id' in gul_inputs.py

#2092 - issue 2090 sparse event definition

#2094 - h3 vectorise

#2095 - ri filter vectorise

#2099 - Hubspot ticket tracking

#2102 - Removing dead code

#2105 - Feature/decouple websocket

#2106 - Fix for flaky test

... (truncated)

Commits

b9535d2 Set oasislmf to version 2.5.8
8780018 feature/not-modelled-locations (#2155)
7c42ada fix/gul_error_csv_write (#2167)
fbfe961 Check and wait for pytools logging to complete (#2163)
1d598e2 Fix Crash in a Cyber model using PreAnalysis hook (#2170)
42b5952 Parallelise the ExposurePreAnalysis hook by account group (#2157)
64279d6 fix(cli): print help when oasislmf api get is called without options set (#2154)
2bb951c fix/rerun-stale-fifo-redirect (#2142)
41fb3e7 fix(pre-analysis): preserve original exposure file format for snapshot saves ...
1962747 fix/csvtobin_pipe (#2140)
Additional commits viewable in compare view

Updates ods-tools from 5.0.7 to 5.0.9

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the docs-toolchain group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [jupytext](https://github.com/jupytext/jupytext) | `1.19.5` | `1.19.6` | | [lxml](https://github.com/lxml/lxml) | `6.1.2` | `6.1.3` | | [markupsafe](https://github.com/pallets/markupsafe) | `3.0.3` | `3.0.4` | | [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.1` | `3.11.2` | | [oasislmf](https://github.com/OasisLMF/oasislmf) | `2.5.6` | `2.5.8` | | [ods-tools](https://github.com/OasisLMF/OpenDataStandards) | `5.0.7` | `5.0.9` | Updates `jupytext` from 1.19.5 to 1.19.6 - [Release notes](https://github.com/jupytext/jupytext/releases) - [Changelog](https://github.com/jupytext/jupytext/blob/main/CHANGELOG.md) - [Commits](jupytext/jupytext@v1.19.5...v1.19.6) Updates `lxml` from 6.1.2 to 6.1.3 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-6.1.2...lxml-6.1.3) Updates `markupsafe` from 3.0.3 to 3.0.4 - [Release notes](https://github.com/pallets/markupsafe/releases) - [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst) - [Commits](pallets/markupsafe@3.0.3...3.0.4) Updates `matplotlib` from 3.11.1 to 3.11.2 - [Release notes](https://github.com/matplotlib/matplotlib/releases) - [Commits](matplotlib/matplotlib@v3.11.1...v3.11.2) Updates `oasislmf` from 2.5.6 to 2.5.8 - [Release notes](https://github.com/OasisLMF/oasislmf/releases) - [Changelog](https://github.com/OasisLMF/OasisLMF/blob/main/CHANGELOG.rst) - [Commits](OasisLMF/OasisLMF@2.5.6...2.5.8) Updates `ods-tools` from 5.0.7 to 5.0.9 - [Release notes](https://github.com/OasisLMF/OpenDataStandards/releases) - [Changelog](https://github.com/OasisLMF/ODS_OpenExposureData/blob/main/Changelog.rst) - [Commits](https://github.com/OasisLMF/OpenDataStandards/commits) --- updated-dependencies: - dependency-name: jupytext dependency-version: 1.19.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docs-toolchain - dependency-name: lxml dependency-version: 6.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docs-toolchain - dependency-name: markupsafe dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docs-toolchain - dependency-name: matplotlib dependency-version: 3.11.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docs-toolchain - dependency-name: oasislmf dependency-version: 2.5.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docs-toolchain - dependency-name: ods-tools dependency-version: 5.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docs-toolchain ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 8, 2026

Navigation Menu

Repository navigation

Bump the docs-toolchain group across 1 directory with 6 updates - #66

Bump the docs-toolchain group across 1 directory with 6 updates#66
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs-toolchain-d060ea06b4

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 8, 2026

Version 1.19.6

1.19.6 (2026-10-04)

6.1.3 (2026-09-02)

Bugs fixed

3.0.4

Version 3.0.4

REL: v3.11.2

Release 2.5.8

OasisLMF Changelog - 2.5.8

OasisLMF Notes

Only Track issues with the hubspot label - [(PR #2130)](OasisLMF/OasisLMF#2130)

fix/csvtobin_pipe - [(PR #2140)](OasisLMF/OasisLMF#2140)

Fix eltpy/pltpy crash on MELT/QELT/MPLT/QPLT output-buffer overflow - [(PR #2141)](OasisLMF/OasisLMF#2141)

fix/rerun-stale-fifo-redirect - [(PR #2142)](OasisLMF/OasisLMF#2142)

OasisLMF Changelog

2.5.8_

2.5.7_

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`2.5.8`_

`2.5.7`_