Bump the "dependencies" group with 2 updates across multiple ecosystems

[dependabot]

Bumps the dependencies group with 1 update in the / directory: setuptools-scm.

Updates setuptools-scm from 10.0.5 to 10.2.0

Release notes

Sourced from setuptools-scm's releases.

setuptools-scm v10.2.0

Added

• Restore Python 3.8 and 3.9 support, re-enabling use as a build dependency for projects like scikit-build that still support these versions. (#1445)

Miscellaneous

• Move PKG-INFO discovery tests from vcs-versioning to setuptools-scm where the entry points are registered. (#1446)

setuptools-scm v10.1.2

Fixed

• Fix DeprecationWarning leak by threading VcsEnvironment through VersionInferenceConfig and using env.make_reader() in _should_write_to_source. (#1424)

setuptools-scm v10.1.1

Fixed

• Update CI to use PyPy 3.11 as cryptography has no PyPy 3.10 build available (#1421)

setuptools-scm v10.1.0

Added

• Add backward-compatible shims in setuptools_scm.git, setuptools_scm.hg, setuptools_scm.hg_git, and setuptools_scm.scm_workdir so that external code calling get_scm_version(config) or run_describe(config) with an explicit Configuration continues to work. The shim automatically wires _config and VcsEnvironment onto the workdir. (#compat-shims)
• Write scm_version.json and scm_file_list.json into egg-info directories during egg_info, enabling sdist fallback version inference when no VCS is present. Add ScmEggInfoMixin for workdir-based file finding in find_sources(). (#egg-info-metadata)
• Add write_to_source pyproject.toml option to control whether version files are written to the source tree. When unset, a deprecation warning advises setting it explicitly before the default changes in a future major release. The SETUPTOOLS_SCM_WRITE_TO_SOURCE environment variable overrides this setting. (#1301)
• Adopt the workdir-centric pipeline from vcs-versioning: version discovery now follows an explicit env → config → workdir → version chain instead of relying on ambient globals and parse entry points. The egg_info command writes scm_version.json and scm_file_list.json metadata so sdists can infer versions without a VCS checkout. Requires vcs-versioning >= 2.0.0.dev0. (#1378)

Fixed

• Fix worktree file listing test to expect relative paths from the file finder. The test now passes on Linux; Windows remains xfail due to a subprocess limitation with worktree directories. (#620)
• Remove the _warn_on_old_setuptools() check that incorrectly warned when a custom build-backend caused setuptools.__version__ to return the project version instead of setuptools' version. The minimum setuptools version is now enforced via build-system requirements. (#1192)
• Wrap version in setuptools.sic() when normalize = false to prevent setuptools from re-normalizing the version after our hook returns. This preserves CalVer zero-padding (e.g. 2024.01.05) and other non-canonical version strings in dist.metadata.version. (#1354)
• Skip writing non-package version files to build_lib, fixing incorrect inclusion of root-level version files in wheels. (#1364)

Documentation

• Rewrite the GitHub Actions CI/CD example to use a dedicated build job (via build-and-inspect-python-package) and OIDC Trusted Publishers instead of building in publishing jobs with long-lived API tokens. (#1215)

Commits

• a705891 Merge pull request #1448 from pypa/release/main
• 630448e Prepare release: setuptools-scm v10.2.0, vcs-versioning v2.2.0
• aaf4950 Merge pull request #1445 from RonnyPfannschmidt/python-legacy
• dd60bf9 Merge pull request #1447 from RonnyPfannschmidt/fix/1446-move-pkginfo-tests
• 535f5ff fix: move PKG-INFO discovery tests to setuptools-scm (#1446)
• 3546a0e feat: restore Python 3.8 and 3.9 support
• 0cde123 Merge pull request #1443 from pypa/release/main
• 51bc391 Prepare release: vcs-versioning v2.1.2
• 310f3c3 Merge pull request #1442 from RonnyPfannschmidt/fix/1439-metadata-workdir-cus...
• b7b70a8 fix: don't re-parse stored tags through tag_regex in MetadataWorkdir (#1439)
• Additional commits viewable in compare view

Bumps the dependencies group with 3 updates in the / directory: https://github.com/astral-sh/ruff-pre-commit, https://github.com/rvben/rumdl-pre-commit and https://github.com/zizmorcore/zizmor-pre-commit.

Updates https://github.com/astral-sh/ruff-pre-commit from v0.15.15 to 0.15.22

Release notes

Sourced from https://github.com/astral-sh/ruff-pre-commit's releases.

v0.15.22

See: https://github.com/astral-sh/ruff/releases/tag/0.15.22

v0.15.21

See: https://github.com/astral-sh/ruff/releases/tag/0.15.21

v0.15.20

See: https://github.com/astral-sh/ruff/releases/tag/0.15.20

v0.15.19

See: https://github.com/astral-sh/ruff/releases/tag/0.15.19

v0.15.18

See: https://github.com/astral-sh/ruff/releases/tag/0.15.18

v0.15.17

See: https://github.com/astral-sh/ruff/releases/tag/0.15.17

v0.15.16

See: https://github.com/astral-sh/ruff/releases/tag/0.15.16

Commits

• 2700fd5 Mirror: 0.15.22
• 01a675e Mirror: 0.15.21
• 9b2d619 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (#173)
• c59bba8 Mirror: 0.15.20
• 745be04 Mirror: 0.15.19
• 998dc2b fix: update prek rev in README.md during mirror (#172)
• 77039cc Mirror: 0.15.18
• 3b3f7c3 Mirror: 0.15.17
• 99e6029 Various hardenings (#170)
• f69224b Bump the github-actions group with 2 updates (#169)
• Additional commits viewable in compare view

Updates https://github.com/rvben/rumdl-pre-commit from v0.2.4 to 0.2.34

Release notes

Sourced from https://github.com/rvben/rumdl-pre-commit's releases.

v0.2.34

See: https://github.com/rvben/rumdl/releases/tag/v0.2.34

v0.2.33

See: https://github.com/rvben/rumdl/releases/tag/v0.2.33

v0.2.32

See: https://github.com/rvben/rumdl/releases/tag/v0.2.32

v0.2.31

See: https://github.com/rvben/rumdl/releases/tag/v0.2.31

v0.2.30

See: https://github.com/rvben/rumdl/releases/tag/v0.2.30

v0.2.29

See: https://github.com/rvben/rumdl/releases/tag/v0.2.29

v0.2.28

See: https://github.com/rvben/rumdl/releases/tag/v0.2.28

v0.2.27

See: https://github.com/rvben/rumdl/releases/tag/v0.2.27

v0.2.26

See: https://github.com/rvben/rumdl/releases/tag/v0.2.26

v0.2.25

See: https://github.com/rvben/rumdl/releases/tag/v0.2.25

v0.2.24

See: https://github.com/rvben/rumdl/releases/tag/v0.2.24

v0.2.23

See: https://github.com/rvben/rumdl/releases/tag/v0.2.23

v0.2.22

See: https://github.com/rvben/rumdl/releases/tag/v0.2.22

v0.2.21

See: https://github.com/rvben/rumdl/releases/tag/v0.2.21

v0.2.20

See: https://github.com/rvben/rumdl/releases/tag/v0.2.20

v0.2.19

See: https://github.com/rvben/rumdl/releases/tag/v0.2.19

v0.2.18

See: https://github.com/rvben/rumdl/releases/tag/v0.2.18

... (truncated)

Commits

• 3558e35 Mirror: 0.2.34
• f11a928 Mirror: 0.2.33
• dd56c01 Mirror: 0.2.32
• 24b60f1 Mirror: 0.2.31
• 8f5dd74 Mirror: 0.2.30
• 62c4f3c Mirror: 0.2.29
• 77cb235 Mirror: 0.2.28
• 5c0245e Mirror: 0.2.27
• 8676d21 Mirror: 0.2.26
• 218e5a2 Mirror: 0.2.25
• Additional commits viewable in compare view

Updates https://github.com/zizmorcore/zizmor-pre-commit from v1.25.2 to 1.27.0

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.27.0

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.27.0

v1.26.1

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.26.1

v1.26.0

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.26.0

Commits

• 64a97fb Mirror: 1.27.0
• 9463fa8 Bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the github-actions group (#52)
• 3a8eeb3 Bump actions/setup-python in the github-actions group (#50)
• fe4aa69 Clean up issue templates
• bce4005 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (#49)
• e3eebf6 Mirror: 1.26.1
• b0de324 Mirror: 1.26.0
• 675ece6 Document autofixing behavior (#45)
• a226068 Bump the github-actions group with 2 updates (#48)
• 1d35d48 Bump tox-dev/action-pre-commit-uv in the github-actions group (#46)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions