[dependabot]

Bumps the pre-commit group with 5 updates:

Package	From	To
https://github.com/biomejs/pre-commit	v2.6.4	2.6.6
https://github.com/tox-dev/pyproject-fmt	v2.30.3	2.30.6
https://github.com/djlint/djLint	v1.49.0	1.49.10
https://github.com/astral-sh/ruff-pre-commit	v0.17.3	0.17.4
https://github.com/zizmorcore/zizmor-pre-commit	v1.31.1	1.32.0

Updates https://github.com/biomejs/pre-commit from v2.6.4 to 2.6.6

Commits

• 2a24170 build(deps): bump @​biomejs/biome to 2.6.6
• fcdfe45 build(deps): bump @​biomejs/biome to 2.6.5 (#137)
• f5aab44 build(deps): bump @​biomejs/biome to 2.6.4 (#136)
• See full diff in compare view

Updates https://github.com/tox-dev/pyproject-fmt from v2.30.3 to 2.30.6

Release notes

Sourced from https://github.com/tox-dev/pyproject-fmt's releases.

v2.30.6

What's Changed

• 👷 ci(scorecard): publish OpenSSF results by @​gaborbernat in tox-dev/pyproject-fmt#373
• 🐛 fix(scorecard): pin merged workflow by @​gaborbernat in tox-dev/pyproject-fmt#374
• 👷 ci: shared workflows and dependency hygiene by @​gaborbernat in tox-dev/pyproject-fmt#376
• 👷 ci: pin github-workflows to 6.5.2 by @​gaborbernat in tox-dev/pyproject-fmt#377
• 👷 ci: run nightly checks in the overnight window by @​gaborbernat in tox-dev/pyproject-fmt#378

Full Changelog: tox-dev/pyproject-fmt@v2.30.3...v2.30.6

Commits

• 3c6e76e Mirror: 2.30.6
• e75976f 👷 ci: run nightly checks in the overnight window (#378)
• 4cf2143 👷 ci: pin github-workflows to 6.5.2 (#377)
• 543c80d 👷 ci: shared workflows and dependency hygiene (#376)
• 3d3f39a build(deps): bump astral-sh/setup-uv from 10.3.0 to 10.3.2 in the github-acti...
• 5a57a7e 🐛 fix(scorecard): pin merged workflow (#374)
• a0e62b9 👷 ci(scorecard): publish OpenSSF results (#373)
• 83f80ce [pre-commit.ci] pre-commit autoupdate (#372)
• d02a68e build(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the github-acti...
• e83ed85 [pre-commit.ci] pre-commit autoupdate (#370)
• See full diff in compare view

Updates https://github.com/djlint/djLint from v1.49.0 to 1.49.10

Release notes

Sourced from https://github.com/djlint/djLint's releases.

v1.49.10

Packaging

• Ship a py.typed marker, so type checkers read the annotations of djlint.api.
• Importing djlint.api no longer builds the command line, which takes a little off the start of editors and other programs that use djLint from Python. The command line moved out of the djlint package itself, which still hands out main, process and process_stdin when they are asked for.

v1.49.9

Bug fixes

• A U+2028, U+2029, U+0085 or form feed in the arguments of a call or the value of a {% set %} that is not JSON, as in a string passed to {{ url("…", x) }}, is kept as written. It was rewritten as a line break, which changed the string.
• H057 reports a video whose only track has an empty kind, as in <track kind=""> or <track kind>. Browsers read an empty kind as metadata, not subtitles, so such a track carries no captions. H057 took it for a subtitles track.
• The error about a number setting that is not a number names the file the value was read from, such as djlint.toml, .djlintrc or the file --configuration names. It always said pyproject.toml.

v1.49.8

Feature

• A mako profile for Mako templates. Mako needs a control line, such as % if x: or % endfor, and a ## comment to start a line of their own, and other profiles joined them onto other lines, which broke the template. Under the mako profile they always keep their own lines, and the lines between % if and % endif, or between a <%block> or <%def> tag and its closing tag, are indented like any other block. The code in a ${} expression is left as written, and so are the attributes of a tag that depend on control lines, Python blocks, <%doc> and <%text>, and a script or style holding Mako syntax under --format-js or --format-css. The linter runs the HTML rules. The all profile handles Mako's lines the same way.
• Twig's {% apply %}, {% sandbox %} and {% guard %} blocks and Django's old {% ifequal %} and {% ifnotequal %} blocks indent their contents like other blocks.

Bug fixes

• A number setting written in a config file as a list, a table or null, as max_line_length = [100] or "indent": null, is reported and falls back to its default, as a string that is no number already did. djLint failed instead.
• An end tag that closes no open block, such as the end of a custom block djLint does not know, as in {% endtoc %}, or a stray {% endif %}, stays at the level of the markup around it. It moved one level to the left, and so did everything after it.
• A string written as adjacent literals, as in {{ _("Hello " "world") }} or {% set x = "a" "b" %}, or in triple quotes, keeps its quotes. They were dropped, which left {{ _(Hello world) }}, a variable name rather than a string.

Performance

• A tag whose quoted value runs over thousands of lines, as when its closing quote is missing, no longer slows formatting down. Forty thousand such lines took over seven seconds and now take about one.
• Text with many ${ that never close no longer slows formatting down. Three thousand of them in one paragraph took ten seconds and now take a tenth of one.

v1.49.7

Feature

• djLint warns about a setting that has no effect: max_blank_lines together with preserve_blank_lines, which takes precedence, and --prefer-configuration without --configuration. The warning goes to stderr once per run, so the language server does not repeat it on every change.

Bug fixes

• A closing tag missing its >, as in </p at the end of a line, again runs to the next >, as browsers read it. Since 1.49.5, the tag on the next line was taken for an opening tag, so each paragraph after such a line was indented one level deeper than the one before.

v1.49.6

Docs

• djlint --help groups the options by what they are for: modes, files, configuration, the linter, output, layout, rewrites, and CSS and JavaScript. They used to come in one long list in no particular order.

v1.49.5

Performance

... (truncated)

Changelog

Sourced from https://github.com/djlint/djLint's changelog.

[1.49.10] - 2026-11-07

Packaging

• Ship a py.typed marker, so type checkers read the annotations of djlint.api.
• Importing djlint.api no longer builds the command line, which takes a little off the start of editors and other programs that use djLint from Python. The command line moved out of the djlint package itself, which still hands out main, process and process_stdin when they are asked for.

[1.49.9] - 2026-11-04

Bug fixes

• A U+2028, U+2029, U+0085 or form feed in the arguments of a call or the value of a {% set %} that is not JSON, as in a string passed to {{ url("…", x) }}, is kept as written. It was rewritten as a line break, which changed the string.
• H057 reports a video whose only track has an empty kind, as in <track kind=""> or <track kind>. Browsers read an empty kind as metadata, not subtitles, so such a track carries no captions. H057 took it for a subtitles track.
• The error about a number setting that is not a number names the file the value was read from, such as djlint.toml, .djlintrc or the file --configuration names. It always said pyproject.toml.

[1.49.8] - 2026-11-03

Feature

• A mako profile for Mako templates. Mako needs a control line, such as % if x: or % endfor, and a ## comment to start a line of their own, and other profiles joined them onto other lines, which broke the template. Under the mako profile they always keep their own lines, and the lines between % if and % endif, or between a <%block> or <%def> tag and its closing tag, are indented like any other block. The code in a ${} expression is left as written, and so are the attributes of a tag that depend on control lines, Python blocks, <%doc> and <%text>, and a script or style holding Mako syntax under --format-js or --format-css. The linter runs the HTML rules. The all profile handles Mako's lines the same way.
• Twig's {% apply %}, {% sandbox %} and {% guard %} blocks and Django's old {% ifequal %} and {% ifnotequal %} blocks indent their contents like other blocks.

Bug fixes

• A number setting written in a config file as a list, a table or null, as max_line_length = [100] or "indent": null, is reported and falls back to its default, as a string that is no number already did. djLint failed instead.
• An end tag that closes no open block, such as the end of a custom block djLint does not know, as in {% endtoc %}, or a stray {% endif %}, stays at the level of the markup around it. It moved one level to the left, and so did everything after it.
• A string written as adjacent literals, as in {{ _("Hello " "world") }} or {% set x = "a" "b" %}, or in triple quotes, keeps its quotes. They were dropped, which left {{ _(Hello world) }}, a variable name rather than a string.

Performance

• A tag whose quoted value runs over thousands of lines, as when its closing quote is missing, no longer slows formatting down. Forty thousand such lines took over seven seconds and now take about one.
• Text with many ${ that never close no longer slows formatting down. Three thousand of them in one paragraph took ten seconds and now take a tenth of one.

[1.49.7] - 2026-11-03

Feature

• djLint warns about a setting that has no effect: max_blank_lines together with preserve_blank_lines, which takes precedence, and --prefer-configuration without --configuration. The warning goes to stderr once per run, so the language server does not repeat it on every change.

Bug fixes

• A closing tag missing its >, as in </p at the end of a line, again runs to the next >, as browsers read it. Since 1.49.5, the tag on the next line was taken for an opening tag, so each paragraph after such a line was indented one level deeper than the one before.

[1.49.6] - 2026-11-03

Docs

• djlint --help groups the options by what they are for: modes, files, configuration, the linter, output, layout, rewrites, and CSS and JavaScript. They used to come in one long list in no particular order.

[1.49.5] - 2026-11-03

... (truncated)

Commits

• 291f0f5 v1.49.10
• 0b8eb59 docs: run the demo on the djLint of the commit the site is built from (#2888)
• b9006ca perf: keep the command line out of importing djlint.api (#2887)
• e057668 chore(deps): lock file maintenance (#2886)
• a006e3c chore(deps): update pre-commit hook tombi-toml/tombi-pre-commit to v1.10.0 (#...
• ea94796 chore(deps): lock file maintenance (#2884)
• bb06c52 chore(deps): update dependency rollup to v4.67.5 (#2883)
• e8dff1f chore(deps): lock file maintenance (#2882)
• 02a50b8 chore(deps): lock file maintenance (#2881)
• 0473b1d chore(deps): lock file maintenance (#2880)
• Additional commits viewable in compare view

Updates https://github.com/astral-sh/ruff-pre-commit from v0.17.3 to 0.17.4

Release notes

Sourced from https://github.com/astral-sh/ruff-pre-commit's releases.

v0.17.4

See: https://github.com/astral-sh/ruff/releases/tag/0.17.4

Commits

• c0f278f Mirror: 0.17.4
• 0c0cb54 Bump astral-sh/setup-uv from 10.3.0 to 10.3.2 in the github-actions group (#191)
• 1f5d5de Remove redundant types_or in pyproject.toml example (#190)
• See full diff in compare view

Updates https://github.com/zizmorcore/zizmor-pre-commit from v1.31.1 to 1.32.0

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.32.0

Sponsorship is appreciated!

New Features 🌈🔗

• zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱🔗

• zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the input collection documentation for more information. (#2454)

• zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

• zizmor's LSP now audits pre-commit inputs (#2485)

• zizmor now provides Windows ARM64 wheels on PyPI (#2424)

  Many thanks to @​ndabas for proposing and implementing this improvement!

Bug Fixes 🐛🔗

• Fixed a bug where the bot-conditions audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

• Fixed a bug where the obfuscation audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

• Fixed a class of bugs in the obfuscation audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

• Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

• Fixed a bug where zizmor would not honor some ignore comments for the stale-action-refs audit (#2494)

• Fixed a bug where zizmor would not honor some ignore comments for the ref-version-mismatch audit (#2494)

Commits

• 06a3975 Mirror: 1.32.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.41%. Comparing base (fb8edb8) to head (8b96aa5).

❌ Your project check has failed because the head coverage (76.41%) is below the target coverage (100.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #93   +/-   ##
=======================================
  Coverage   76.41%   76.41%           
=======================================
  Files          12       12           
  Lines         759      759           
=======================================
  Hits          580      580           
  Misses        179      179           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.