[dependabot]

Bumps the python-dependencies group with 5 updates:

Package	From	To
uvicorn	0.52.4	0.53.0
pyjwt	2.13.0	2.14.0
ruff	0.16.6	0.16.8
djlint	1.36.4	1.46.1
yamllint	1.37.1	1.38.0

Updates uvicorn from 0.52.4 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security

- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c6fe464b356ff4b1ebc9ba62172d331a40aa27df&quot;&gt;&lt;code&gt;c6fe464&lt;/code&gt;&lt;/a> release: prepare v2.14.0</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f5413029ae7a2e31b1367b5303ea86a2f54ccf42&quot;&gt;&lt;code&gt;f541302&lt;/code&gt;&lt;/a> style: apply Ruff formatting</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95&quot;&gt;&lt;code&gt;801cd12&lt;/code&gt;&lt;/a> fix: reject public JWK container HMAC keys</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb&quot;&gt;&lt;code&gt;af8181c&lt;/code&gt;&lt;/a> fix: reject empty HMAC keys from JWKs</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1&quot;&gt;&lt;code&gt;ba4853a&lt;/code&gt;&lt;/a> Throttle repeated PyJWKClient refreshes</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499&quot;&gt;&lt;code&gt;2798504&lt;/code&gt;&lt;/a> fix: reject DER public keys as HMAC secrets</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07&quot;&gt;&lt;code&gt;8b4e233&lt;/code&gt;&lt;/a> fix: reject loader-accepted PEM variants</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1f8180a211256dfe5cf32294b6753f554a5a4258&quot;&gt;&lt;code&gt;1f8180a&lt;/code&gt;&lt;/a> fix: format JWS tests</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/cff1ac55fe5f1096fd05295b269fce053ee290ab&quot;&gt;&lt;code&gt;cff1ac5&lt;/code&gt;&lt;/a> Fix redirect handler return annotation</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56&quot;&gt;&lt;code&gt;0a795b8&lt;/code&gt;&lt;/a> Reject redirects in PyJWKClient fetches</li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Updates ruff from 0.16.6 to 0.16.8

Release notes
Sourced from ruff's releases.

0.16.8
Release Notes
Released on 2026-09-16.
Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)
[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
[flake8-simplify] Preserve operand order in SIM109 fix (#27824)
[pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
[pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

Add support for __lazy_modules__ (#28459)
Recognize PEP-728 TypedDict class keywords (#28533)
Recognize quoted types in typing.TypeForm (#28507)
Support conditional assignment to __lazy_modules__ (#28491)
[flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
[pyupgrade] Make the fix for UP040 always unsafe (#28526)
[pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
[ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
[ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

[flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

@​VedantMadane
@​alzeph
@​charliermarsh
@​fredrikblau
@​ntBre
@​zsol
@​Aniket-a14
@​r-b-1

Install ruff 0.16.8
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 


... (truncated)


Changelog
Sourced from ruff's changelog.

0.16.8
Released on 2026-09-16.
Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)
[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
[flake8-simplify] Preserve operand order in SIM109 fix (#27824)
[pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
[pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

Add support for __lazy_modules__ (#28459)
Recognize PEP-728 TypedDict class keywords (#28533)
Recognize quoted types in typing.TypeForm (#28507)
Support conditional assignment to __lazy_modules__ (#28491)
[flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
[pyupgrade] Make the fix for UP040 always unsafe (#28526)
[pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
[ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
[ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

[flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

@​VedantMadane
@​alzeph
@​charliermarsh
@​fredrikblau
@​ntBre
@​zsol
@​Aniket-a14
@​r-b-1

0.16.7
Released on 2026-09-10.
Preview features

[ruff] Add rule for default values on method receivers (RUF077) (#26700)



... (truncated)


Commits

62914c4 Bump version to 0.16.8 (#28648)
c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
94efeaa [ty] Compact reachable binding and declaration histories (#28349)
50020fb [ty] Avoid storing constraint nodes twice (#28375)
446bb68 [ty] Compare bound-method receivers before signatures (#28384)
304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
31131db [ty] Support type[A & B] (#27124)
Additional commits viewable in compare view




Updates djlint from 1.36.4 to 1.46.1

Release notes
Sourced from djlint's releases.

v1.46.1
Fix

A second {# #} comment on a line no longer swallows everything back to the first one, so a tag written between two comments is formatted and linted like any other. Before, it kept lines past --max-line-length and hid findings from the rules. A comment now ends at its first #}, which is where django, jinja and nunjucks end it.

v1.46.0
Feature

New rule T041 reports an {% extends %} that is not the first tag in the template, which django refuses to compile and which leaks whatever text comes before it into the page. A {# #} comment before it is left alone, as is anything inside a {% comment %}, {% raw %} or {% verbatim %} block, named or not, a {# djlint:off #} region or yaml front matter. An html comment is reported, since it is written into the page ahead of the parent template's doctype, and so is a branch tag on the django profile, where {% if x %}{% extends "a.html" %}{% endif %} does not compile; jinja documents that form and keeps it.
New rule T042 reports text or html written after {% extends %} and outside every {% block %}, which the engine silently discards. A template tag there still runs and is left alone, as are comments and the body of a {% macro %}.
New rule T043 reports a block name used more than once in a template, which Django, Jinja and Nunjucks all refuse to parse, even where the two blocks sit in different branches of an {% if %}. A {% blocktrans %}, a named {% endblock %}, a block inside a template comment, a {% comment %} block or a {% raw %} or {% verbatim %} body, and the blocks an {% embed %} fills in another template are left alone; a block inside an html comment or a <script> counts, since the engine still parses it.
New rule T044 reports a statement keyword inside an output tag, such as {{ if x }}, {{ url 'home' }} or {{ endif }}, where a {% %} block tag was meant. A bare keyword such as {{ url }} is an ordinary variable and is left alone, as is an expression that merely starts with one of the names, such as {{ url ~ "/x" }}, {{ url ? url : '#' }} or {{ block ('title') }}, and so is the body of a {% raw %} or {% verbatim %} block, named or not.
New rule T045 reports a statement tag, such as {% include %} or {% if %}, written inside an html comment, where it still runs. A value printed into a comment, as in <!-- built {{ version }} -->, is left alone, and so is a bare Go keyword such as <!-- period {{ start }} to {{ end }} -->, which is an ordinary variable under every other profile, and a {% under handlebars and golang, which have no such syntax. A tag inside a template comment, a {% comment %} block or a raw block is left alone whether it is written with whitespace control, tabs or a named closing tag, as is one inside an Internet Explorer conditional comment, in any case and closed by its <![endif]-->; one left unclosed is the ordinary comment a browser reads it as and is reported.
New rule H053 reports an id used more than once in the file, which breaks getElementById, <label for> and fragment links. Two ids in exclusive branches of one {% if %} are never both rendered and are not reported, whichever language writes the branch, and neither are two ids in separate \<template> fragments; a value written by a template tag is left alone.
New rule H054 reports an interactive element nested inside another, such as a <button> inside an <a href> or a link inside a button. An <a> without an href is not interactive and is left alone, as is a hidden input or one whose type a template tag writes.
New rule H055 reports a lang on <html> that is not a language tag, such as lang="english", lang="en_US" or a value that is only whitespace, which H005 reads as present. An empty value is left to H005, and so is a value written by a template tag or by a php short echo, as in lang="<?= $lang ?>", while a value that merely starts with $ or {, such as lang="$LANG", is read as written. A > written inside a template tag ahead of the attribute, as in {% if a > b %}, does not hide it.
New rule H056 reports an empty src on an element that fetches what it names, such as <img src=""> or <script src=""></script>, which a browser resolves to the page itself. A src with no value at all counts too, while an unquoted value such as src=/static/logo.png, a value written by a template tag, a value that is only whitespace, and the separate srcset and data-src attributes are left alone.
New rule H057 reports a <video> with no captions track, which WCAG 1.2.2 requires for prerecorded video with sound. A <track> of kind captions or subtitles counts, as does one with no kind, since subtitles is the default, while a commented out track and one written inside an attribute value do not; a muted video is left alone, as is one whose tracks or attributes a template tag may write, meaning a real {{, {%, {# or ${ rather than the brace of a css value or the $ of a jQuery handler or a price.
New option --sarif writes the findings as a SARIF 2.1.0 document, which GitHub code scanning, Azure DevOps and most editors read, so a run can be uploaded and kept in the Security tab with history rather than shown only as annotations on one pull request. With --check, a file that would be reformatted is reported under a formatting rule.

Fix

A mako <% %> or <%! %> code block is left as written, since its body is python rather than markup. Formatting re-indented it, flattening a return "unit" inside an if to the start of the line and leaving python that no longer parses, and a tag written in a python string was read as markup, so H025, H054 and T001 reported findings inside these blocks. A <%def> body is markup and is still formatted and linted.
H037 no longer reads an unquoted attribute value as an attribute name, so <img width=1 height=1> is not reported as a duplicate 1. This started in 1.45.0, and a real duplicate whose values are unquoted and start with /, . or #, as in href=/a href=/b, is now caught too.

v1.45.2
Fix

A space beside a template block is kept where the line break next to it is one a {%- or -%} marker strips. The break normally renders the space itself, so djLint drops the space as redundant, but a stripped break renders nothing: {%- if args -%}, {% endif %} followed by {%- for %} lost the space between a macro's arguments.

v1.45.1

H037 no longer reads a quoted string inside a template tag as an attribute name, so href="{{ url "/a/b" "/a/c" }}" is not reported as a duplicate a. This started in 1.45.0.
A jinja call written over several lines keeps its closing bracket at the indent of the tag holding it, rather than pulling ) }} to the start of the line.
Arguments nested inside a jinja call written over several lines keep their depth, so the inner argument of {{ function([nested(...)]) }} is no longer dedented by one level.
An element after a line that closes both a template block and an html tag, as in {%- endif %}:</b>, keeps its own level instead of being indented one further.
A template tag written over several lines inside an attribute keeps the indentation the author gave it, so the body of data-x='{{ f({ ... }) }}' no longer loses a space from every line.
--single-attribute-per-line reaches attributes guarded by a template tag, so {% if x %} a="1" b="2" {% endif %} inside a tag no longer keeps them on one line past --max-line-length.
A tag whose attributes push its line past --max-line-length is spread over several lines, where before only --max-attribute-length decided. A line long because of its text is left alone, since breaking text would change what renders.
A tag whose name a template writes, as in <{{ tag }}>, is read as a tag. It was not recognised at all, so a template block among its attributes was pulled out of the tag and re-indented to the start of the line, and its attributes went unformatted and unchecked.

v1.45.0
Feature

New rule H043 reports a <button> written without a type. A type written inside a template block, as in <button {% if a %}type="button"{% endif %}>, counts.
New rule H044 reports a header row holding both th and td cells. The empty td that opens a two-axis table's header row is allowed.
New rule H045 reports an <iframe> with no accessible name. title, aria-label and aria-labelledby all count, as does a name written by a template tag.
New rule H046 reports a positive tabindex. 0 and -1 are left alone, as is a value written by a template tag.
New rule H047 reports aria-hidden="true" on an element that takes focus. Hiding a decorative icon is not reported, nor is a disabled control or one with tabindex="-1".
New rule H048 reports an aria- attribute that ARIA does not define, such as a misspelled aria-lable. Framework bindings like :aria-label are left alone.
New rule H049 reports a viewport that stops the page being zoomed, by user-scalable=no or a maximum-scale below 2.



... (truncated)


Changelog
Sourced from djlint's changelog.

[1.46.1] - 2026-09-08
Fix

A second {# #} comment on a line no longer swallows everything back to the first one, so a tag written between two comments is formatted and linted like any other. Before, it kept lines past --max-line-length and hid findings from the rules. A comment now ends at its first #}, which is where django, jinja and nunjucks end it.

[1.46.0] - 2026-09-07
Feature

New rule T041 reports an {% extends %} that is not the first tag in the template, which django refuses to compile and which leaks whatever text comes before it into the page. A {# #} comment before it is left alone, as is anything inside a {% comment %}, {% raw %} or {% verbatim %} block, named or not, a {# djlint:off #} region or yaml front matter. An html comment is reported, since it is written into the page ahead of the parent template's doctype, and so is a branch tag on the django profile, where {% if x %}{% extends "a.html" %}{% endif %} does not compile; jinja documents that form and keeps it.
New rule T042 reports text or html written after {% extends %} and outside every {% block %}, which the engine silently discards. A template tag there still runs and is left alone, as are comments and the body of a {% macro %}.
New rule T043 reports a block name used more than once in a template, which Django, Jinja and Nunjucks all refuse to parse, even where the two blocks sit in different branches of an {% if %}. A {% blocktrans %}, a named {% endblock %}, a block inside a template comment, a {% comment %} block or a {% raw %} or {% verbatim %} body, and the blocks an {% embed %} fills in another template are left alone; a block inside an html comment or a <script> counts, since the engine still parses it.
New rule T044 reports a statement keyword inside an output tag, such as {{ if x }}, {{ url 'home' }} or {{ endif }}, where a {% %} block tag was meant. A bare keyword such as {{ url }} is an ordinary variable and is left alone, as is an expression that merely starts with one of the names, such as {{ url ~ "/x" }}, {{ url ? url : '#' }} or {{ block ('title') }}, and so is the body of a {% raw %} or {% verbatim %} block, named or not.
New rule T045 reports a statement tag, such as {% include %} or {% if %}, written inside an html comment, where it still runs. A value printed into a comment, as in <!-- built {{ version }} -->, is left alone, and so is a bare Go keyword such as <!-- period {{ start }} to {{ end }} -->, which is an ordinary variable under every other profile, and a {% under handlebars and golang, which have no such syntax. A tag inside a template comment, a {% comment %} block or a raw block is left alone whether it is written with whitespace control, tabs or a named closing tag, as is one inside an Internet Explorer conditional comment, in any case and closed by its <![endif]-->; one left unclosed is the ordinary comment a browser reads it as and is reported.
New rule H053 reports an id used more than once in the file, which breaks getElementById, <label for> and fragment links. Two ids in exclusive branches of one {% if %} are never both rendered and are not reported, whichever language writes the branch, and neither are two ids in separate \<template> fragments; a value written by a template tag is left alone.
New rule H054 reports an interactive element nested inside another, such as a <button> inside an <a href> or a link inside a button. An <a> without an href is not interactive and is left alone, as is a hidden input or one whose type a template tag writes.
New rule H055 reports a lang on <html> that is not a language tag, such as lang="english", lang="en_US" or a value that is only whitespace, which H005 reads as present. An empty value is left to H005, and so is a value written by a template tag or by a php short echo, as in lang="<?= $lang ?>", while a value that merely starts with $ or {, such as lang="$LANG", is read as written. A > written inside a template tag ahead of the attribute, as in {% if a > b %}, does not hide it.
New rule H056 reports an empty src on an element that fetches what it names, such as <img src=""> or <script src=""></script>, which a browser resolves to the page itself. A src with no value at all counts too, while an unquoted value such as src=/static/logo.png, a value written by a template tag, a value that is only whitespace, and the separate srcset and data-src attributes are left alone.
New rule H057 reports a <video> with no captions track, which WCAG 1.2.2 requires for prerecorded video with sound. A <track> of kind captions or subtitles counts, as does one with no kind, since subtitles is the default, while a commented out track and one written inside an attribute value do not; a muted video is left alone, as is one whose tracks or attributes a template tag may write, meaning a real {{, {%, {# or ${ rather than the brace of a css value or the $ of a jQuery handler or a price.
New option --sarif writes the findings as a SARIF 2.1.0 document, which GitHub code scanning, Azure DevOps and most editors read, so a run can be uploaded and kept in the Security tab with history rather than shown only as annotations on one pull request. With --check, a file that would be reformatted is reported under a formatting rule.

Fix

A mako <% %> or <%! %> code block is left as written, since its body is python rather than markup. Formatting re-indented it, flattening a return "unit" inside an if to the start of the line and leaving python that no longer parses, and a tag written in a python string was read as markup, so H025, H054 and T001 reported findings inside these blocks. A <%def> body is markup and is still formatted and linted.
H037 no longer reads an unquoted attribute value as an attribute name, so <img width=1 height=1> is not reported as a duplicate 1. This started in 1.45.0, and a real duplicate whose values are unquoted and start with /, . or #, as in href=/a href=/b, is now caught too.

[1.45.2] - 2026-09-04
Fix

A space beside a template block is kept where the line break next to it is one a {%- or -%} marker strips. The break normally renders the space itself, so djLint drops the space as redundant, but a stripped break renders nothing: {%- if args -%}, {% endif %} followed by {%- for %} lost the space between a macro's arguments.

[1.45.1] - 2026-09-04
Fix

H037 no longer reads a quoted string inside a template tag as an attribute name, so href="{{ url "/a/b" "/a/c" }}" is not reported as a duplicate a. This started in 1.45.0.
A jinja call written over several lines keeps its closing bracket at the indent of the tag holding it, rather than pulling ) }} to the start of the line.
Arguments nested inside a jinja call written over several lines keep their depth, so the inner argument of {{ function([nested(...)]) }} is no longer dedented by one level.
An element after a line that closes both a template block and an html tag, as in {%- endif %}:</b>, keeps its own level instead of being indented one further.
A template tag written over several lines inside an attribute keeps the indentation the author gave it, so the body of data-x='{{ f({ ... }) }}' no longer loses a space from every line.
--single-attribute-per-line reaches attributes guarded by a template tag, so {% if x %} a="1" b="2" {% endif %} inside a tag no longer keeps them on one line past --max-line-length.
A tag whose attributes push its line past --max-line-length is spread over several lines, where before only --max-attribute-length decided. A line long because of its text is left alone, since breaking text would change what renders.
A tag whose name a template writes, as in <{{ tag }}>, is read as a tag. It was not recognised at all, so a template block among its attributes was pulled out of the tag and re-indented to the start of the line, and its attributes went unformatted and unchecked.

[1.45.0] - 2026-09-03
Feature


... (truncated)


Commits

152599a v1.46.1
1cef4d0 fix ci
3931027 fix changelog
8a5f5b3 fix: end a template comment at its first close, not the last one on the line
4fcf1e5 remove unneeded files
4ad849a v1.46.0
54fea2e chore(deps): lock file maintenance (#2489)
58247d7 chore(deps): update dependency autoprefixer to v10.5.5 (#2488)
9ebc8aa chore(deps): update dependency @​codemirror/state to v6.7.4 (#2487)
ced0cbf perf: anchor H022 and H036 on their candidates instead of scanning from every...
Additional commits viewable in compare view




Updates yamllint from 1.37.1 to 1.38.0

Changelog
Sourced from yamllint's changelog.

1.38.0 (2026-01-13)

Add support for Python 3.14, drop support for Python 3.9
Require pathspec ≥ 1.0.0
Config: Follow gitignore implementation in yaml-files and ignore
Config: Use "mapping" instead of "dict" for user-facing errors
Rule indentation: Fix error message for check-multi-line-strings
Rule quoted-strings: Add quote-type: consistent
Docs: Update the name of BSD ports
Docs: Enhance wording of recursive directory lint in README
Docs: Add Alpine Linux installation instructions in README




Commits

cba56bc yamllint version 1.38.0
9dc506b Require pathspec ≥ 1.0.0 and follow Git's gitignore implementation
73b9c0b Drop support for Python 3.9
22d07ed indentation: Fix error message for check-multi-line-strings
cfbfe9b README: Add Alpine Linux installation instructions
a3b3bb3 README: Enhance wording of recursive directory lint
e3b72f5 quoted-strings: Add missing quote-type: consistent docs
e3d54cc quoted-strings: Add quote-type: consistent
0b4ddc8 CI: Update GitHub Actions
866f805 build: Remove license-files from pyproject.toml
Additional commits viewable in compare view




Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options


You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions