[dependabot]

Bumps the python-minor-and-patch group with 4 updates: cfgv, identify, nodeenv and pyyaml.

Updates cfgv from 3.4.0 to 3.5.0

Commits

• c734212 v3.5.0
• d64e0cc Merge pull request #158 from asottile/key-value-map
• 641559f add KeyValueMap
• 82e2f93 Merge pull request #157 from asottile/pre-commit-ci-update-config
• 69cd020 [pre-commit.ci] pre-commit autoupdate
• 5ccc4d4 Merge pull request #156 from asottile/pre-commit-ci-update-config
• 2e7ffe5 [pre-commit.ci] pre-commit autoupdate
• ef78499 Merge pull request #155 from asottile/all-repos_autofix_all-repos-manual
• b34b882 py310+
• 724a279 Merge pull request #154 from asottile/pre-commit-ci-update-config
• Additional commits viewable in compare view

Updates identify from 2.6.13 to 2.6.20

Commits

• aa34031 v2.6.20
• 116099f Merge pull request #609 from Malix-Labs/feat/add-nushell
• 971546c Merge pull request #610 from pre-commit/lock-file-tags
• da45cb1 Add support for 'nu' extension and Nushell interpreters
• a35b99b Merge pull request #608 from steovd/profile-sh
• bd5cdb7 Merge pull request #601 from ngie-eign/issue-258
• 66faf04 Merge pull request #597 from edgarrmondragon/patch-1
• c75a0a2 Merge pull request #593 from NinjaMandalorian/main
• ea6c9f9 Add support for 'luau' file extension
• d28c571 Merge pull request #585 from Kvan7/patch-1
• Additional commits viewable in compare view

Updates nodeenv from 1.9.1 to 1.11.0

Release notes

Sourced from nodeenv's releases.

1.11.0

What's Changed

New Features 🎉

• feat(certifi): optionally use certifi certificates by @​ekalinin in ekalinin/nodeenv#394
• feat(nodeenv): accept npm-style semver ranges in --node by @​ekalinin in ekalinin/nodeenv#393
• feat(nodeenv): add --prefer-system to use system node when available by @​ekalinin in ekalinin/nodeenv#395
• feat(nodeenv): add --isolate-npm to keep npm config inside the environment by @​ekalinin in ekalinin/nodeenv#396
• feat(nodeenv): install local packages from a requirements file by @​ekalinin in ekalinin/nodeenv#407
• feat(nodeenv): write the posix activate on Windows for git-bash by @​ekalinin in ekalinin/nodeenv#409

Fixed bugs 🐛

• fix: repair Windows CI (ZipFile.extractall filter, test_smoke layout) by @​ekalinin in ekalinin/nodeenv#392
• fix(nodeenv): replace leftover debug print with logger.debug by @​ekalinin in ekalinin/nodeenv#391
• fix(nodeenv): stop -p from reinstalling node that is already there by @​ekalinin in ekalinin/nodeenv#403
• fix(nodeenv): let -p target a virtualenv nodeenv isn't installed in by @​ekalinin in ekalinin/nodeenv#402
• fix(nodeenv): report the url and proxy instead of a traceback by @​ekalinin in ekalinin/nodeenv#410
• fix(nodeenv): keep the python virtualenv's scripts under -p on Windows by @​ekalinin in ekalinin/nodeenv#411
• fix(nodeenv): report a missing node archive instead of a traceback by @​ekalinin in ekalinin/nodeenv#412
• fix(nodeenv): detect musl regardless of the host triplet vendor by @​ekalinin in ekalinin/nodeenv#413
• fix(nodeenv): read npm's parseable listing in freeze by @​ekalinin in ekalinin/nodeenv#414
• fix: allow zsh to source bin/activate by @​r3wretrhy in ekalinin/nodeenv#417
• fix(nodeenv): link nodejs.exe without mklink by @​ekalinin in ekalinin/nodeenv#415

Improvements 🛠

• FEAT: Check if activate is called as script. by @​quazgar in ekalinin/nodeenv#384
• address deprecation warning in tarfile.TarFile.extract all in Python … by @​nernst in ekalinin/nodeenv#380
• chore(ci): run the activation scripts in sh, dash, bash, zsh and fish by @​ekalinin in ekalinin/nodeenv#397
• chore(ci): give the integration smoke tests a home and stop running them 20 times by @​ekalinin in ekalinin/nodeenv#401
• feat(nodeenv): clean "src" directory by default by @​ekalinin in ekalinin/nodeenv#404

Documentation 📄

• docs(readme): document file:// mirrors as a local download source by @​ekalinin in ekalinin/nodeenv#405
• docs(changes): backfill the changelog from 1.3.2 to 1.10.0 by @​ekalinin in ekalinin/nodeenv#408

Other Changes

• chore(release): bump nodeenv version to 1.11.0 by @​ekalinin in ekalinin/nodeenv#418

New Contributors

• @​quazgar made their first contribution in ekalinin/nodeenv#384
• @​nernst made their first contribution in ekalinin/nodeenv#380
• @​r3wretrhy made their first contribution in ekalinin/nodeenv#417

Full Changelog: ekalinin/nodeenv@1.10.0...1.11.0

1.10.0: Add support Python 3.13/UV

What's Changed

Fixed bugs 🐛

• Use lowercase lookup for archmap by @​robmoss2k in ekalinin/nodeenv#382

Improvements 🛠

• Add support for Python 3.13 by @​hugovk in ekalinin/nodeenv#367

... (truncated)

Changelog

Sourced from nodeenv's changelog.

Version 1.11.0

• Fixed zsh source bin/activate aborting on the direct-call guard [#398](https://github.com/ekalinin/nodeenv/issues/398) <https://github.com/ekalinin/nodeenv/issues/398>_
• Added check for how activate is called [#384](https://github.com/ekalinin/nodeenv/issues/384) <https://github.com/ekalinin/nodeenv/pull/384>_
• Addressed the tarfile.extractall deprecation on Python >= 3.12 by setting filter='data', which also prevents writing files via ".." or absolute paths [#380](https://github.com/ekalinin/nodeenv/issues/380) <https://github.com/ekalinin/nodeenv/pull/380>_
• Added support for Solaris/illumos [#360](https://github.com/ekalinin/nodeenv/issues/360) <https://github.com/ekalinin/nodeenv/issues/360>_
• Added predeactivate hooks for Windows
• Added error handling and tests for the node installation [#336](https://github.com/ekalinin/nodeenv/issues/336) <https://github.com/ekalinin/nodeenv/issues/336>_
• Removed the leftover debug print that leaked a dict to stdout on every version detection [#390](https://github.com/ekalinin/nodeenv/issues/390) <https://github.com/ekalinin/nodeenv/issues/390>_
• Added --with-certifi to download packages with the certifi certificate bundle [#388](https://github.com/ekalinin/nodeenv/issues/388) <https://github.com/ekalinin/nodeenv/pull/388>_
• --node accepts npm-style semver ranges [#393](https://github.com/ekalinin/nodeenv/issues/393) <https://github.com/ekalinin/nodeenv/pull/393>_
• Added --prefer-system to use system-wide node.js when available and install one otherwise [#153](https://github.com/ekalinin/nodeenv/issues/153) <https://github.com/ekalinin/nodeenv/issues/153>_
• Added --isolate-npm to keep npm cache, userconfig and init-module inside the environment [#154](https://github.com/ekalinin/nodeenv/issues/154) <https://github.com/ekalinin/nodeenv/issues/154>_
• Added tests that run the activation scripts in sh, dash, bash, zsh and fish.
• -p no longer reinstalls node when the requested version is already in the virtualenv [#159](https://github.com/ekalinin/nodeenv/issues/159) <https://github.com/ekalinin/nodeenv/issues/159>_
• Repeated -p runs no longer duplicate the predeactivate hook [#159](https://github.com/ekalinin/nodeenv/issues/159) <https://github.com/ekalinin/nodeenv/issues/159>_
• -p accepts an optional virtualenv directory and prefers the activated VIRTUAL_ENV over the virtualenv nodeenv itself is installed in [#156](https://github.com/ekalinin/nodeenv/issues/156) <https://github.com/ekalinin/nodeenv/issues/156>_
• -r/--requirements may now be given more than once, and the new --local-requirements installs the packages of a file locally, into "node_modules" of the current directory, which is what freeze -l writes. Under npm < 1.0.0, which has no -g, a local file is still installed the old way [#206](https://github.com/ekalinin/nodeenv/issues/206) <https://github.com/ekalinin/nodeenv/issues/206>_
• The "src" directory is now removed after installation by default, which halves the size of an environment. Added --no-clean-src to keep it: with --source that is what lets a repeated --force build reuse the downloaded source tree [#205](https://github.com/ekalinin/nodeenv/issues/205) <https://github.com/ekalinin/nodeenv/issues/205>_
• Documented that --mirror takes a file:// URL, so a local directory can serve as the download source [#193](https://github.com/ekalinin/nodeenv/issues/193) <https://github.com/ekalinin/nodeenv/issues/193>_
• The posix activate is now written on Windows too, into "Scripts", so git-bash and the other posix shells there can activate an environment [#226](https://github.com/ekalinin/nodeenv/issues/226) <https://github.com/ekalinin/nodeenv/issues/226>_
• A download that reaches nothing at all, which a broken http_proxy or https_proxy usually causes, now reports the url and the proxy settings instead of a traceback

... (truncated)

Commits

• e745358 Merge pull request #418 from ekalinin/chore/release-1.11.0
• fd19956 chore(release): bump nodeenv version to 1.11.0
• 1767015 Merge pull request #415 from ekalinin/fix/nodejs-exe-link
• 55df3ce Merge pull request #417 from r3wretrhy/fix/zsh-activate-source-guard
• bb15c5c fix: allow zsh to source bin/activate
• 152cd3d fix(nodeenv): link nodejs.exe without mklink
• d163302 Merge pull request #414 from ekalinin/fix/freeze-requirements
• ef5ec35 fix(nodeenv): read npm's parseable listing in freeze
• b1f0c54 Merge pull request #413 from ekalinin/fix/musl-vendor-detection
• aadf307 fix(nodeenv): detect musl regardless of the host triplet vendor
• Additional commits viewable in compare view

Updates pyyaml from 6.0.2 to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

• Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

• yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)

Commits

• 49790e7 Release 6.0.3 (#889)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[esacteksab]

@dependabot recreate

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.