Deps: Bump the python-packages group with 6 updates

[dependabot]

Bumps the python-packages group with 6 updates:

Package	From	To
sentry-sdk	2.66.0	2.66.1
pytest-env	1.6.0	1.7.0
certifi	2026.6.17	2026.7.22
h2	4.3.0	4.4.0
platformdirs	4.10.1	4.11.0
ruff	0.15.22	0.16.0

Updates sentry-sdk from 2.66.0 to 2.66.1

Release notes

Sourced from sentry-sdk's releases.

2.66.1

Bug Fixes 🐛

Tracing

• Handle exceptions raised within traces_sampler and other callbacks by @​ericapisani in #6853

Internal Changes 🔧

• Fix flaky decorator test by @​sl0thentr0py in #6830

Changelog

Sourced from sentry-sdk's changelog.

2.66.1

Bug Fixes 🐛

Tracing

• Handle exceptions raised within traces_sampler and other callbacks by @​ericapisani in #6853

Internal Changes 🔧

• Fix flaky decorator test by @​sl0thentr0py in #6830

Commits

• 653a292 Update CHANGELOG.md
• e20c226 release: 2.66.1
• 4524b65 fix(tracing): Stop setting NoOpSpan on scope in the streaming trace lifecyc...
• 2e9f26e ref(tracing): No-op and emit warning in start_transaction with the streamin...
• 3a50950 fix(tracing): handle exceptions raised within traces_sampler and other callba...
• b5171b7 ref: Use top-level trace_lifecycle and ignore_spans options in tests (#6855)
• 17e0348 ref: Use old sampling context format in span streaming (#6848)
• 2e09497 test: Add streaming tests to test_http_headers (#6785)
• 9996734 feat(tracing): Send sentry.segment.name.source instead of `sentry.span.sour...
• 00224f7 remove span streaming docs in changelog (#6831)
• Additional commits viewable in compare view

Updates pytest-env from 1.6.0 to 1.7.0

Release notes

Sourced from pytest-env's releases.

1.7.0

What's Changed

• 🔒 ci(workflows): add zizmor security auditing by @​gaborbernat in pytest-dev/pytest-env#216
• 📦 build: move the testing extra to a dependency group by @​gaborbernat in pytest-dev/pytest-env#243
• 👷 ci: test against Python 3.15 beta by @​gaborbernat in pytest-dev/pytest-env#245

Full Changelog: pytest-dev/pytest-env@1.6.0...1.7.0

Commits

• db01e70 👷 ci: test against Python 3.15 beta (#245)
• 9e3ce0d [pre-commit.ci] pre-commit autoupdate (#244)
• 69dae16 📦 build: move the testing extra to a dependency group (#243)
• 290c20d build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 (#242)
• c64e6db build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 (#241)
• 23d37ac [pre-commit.ci] pre-commit autoupdate (#240)
• 82ba427 build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 (#239)
• 1a85be5 [pre-commit.ci] pre-commit autoupdate (#238)
• 63c2093 💰 Surface GitHub Sponsors + thanks.dev
• ce3f28b [pre-commit.ci] pre-commit autoupdate (#237)
• Additional commits viewable in compare view

Updates certifi from 2026.6.17 to 2026.7.22

Commits

• f4bc676 2026.07.22 (#428)
• 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
• 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
• eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
• 474e6fc Include tests in the source distribution (#424)
• a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420)
• 98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
• See full diff in compare view

Updates h2 from 4.3.0 to 4.4.0

Changelog

Sourced from h2's changelog.

4.4.0 (2026-07-23)

API Changes (Backward Incompatible)

• Support for Python 3.9 has been removed.
• Support for PyPy 3.9 has been removed.
• Stream.end_stream() now raises NoSuchStreamError or StreamClosedError exceptions, instead of a generic KeyError.
• Duplicate content-length headers with different values now raise ProtocolError. Previously, the first content-length header was accepted and later conflicting values were ignored.
• Parse content-length headers according to RFC9110 grammar for numbers (1*DIGIT)
• backfill from v4.3.0 Convert emitted events into Python dataclass, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

• Support for Python 3.14 has been added.
• H2Connection.receive_data now accepts any byte-like object that implements the buffer protocol, such as bytes, bytearray, and memoryview. Existing bytes callers are unaffected.
• Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. Ordinary CONNECT now requires :method=CONNECT and :authority, and forbids :scheme/:path. Extended CONNECT (e.g., WebSocket) requires :scheme, :path, :authority plus :protocol. (PR #1309)
• Fix incorrect substring matching of secure header in cookie and :method.

Bugfixes

• Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
• Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.

Commits

• 6cce763 v4.4.0
• dfafda3 Bump pytest from 8.4.2 to 9.0.3 (#1320)
• b45207c dependencies and packaging++
• c40145f parse content-length headers according to RFC9110 grammar for numbers (1*DI...
• efc8fea cleanup double-dependency
• aba9ad6 fix: reject conflicting content-length headers (#1317)
• 1cd9ce0 Reject client enable-push settings (#1318)
• dc5da5c add changelog, update tests
• bdf0b95 Broaden receive data buffer types
• b08b9d7 Allow sending 0-byte DATA frames when flow-control window is negative
• Additional commits viewable in compare view

Updates platformdirs from 4.10.1 to 4.11.0

Release notes

Sourced from platformdirs's releases.

4.11.0

What's Changed

• 👷 ci: run the test suite against Python 3.15 by @​gaborbernat in tox-dev/platformdirs#512

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.0 (2026-07-21)

---

• Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

---

4.10.1 (2026-07-18)

---

• Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

---

4.10.0 (2026-05-28)

---

• Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
• Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
• Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

---

4.9.6 (2026-04-09)

---

• Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen
• Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

---

4.9.4 (2026-03-05)

---

• Respect XDG_CONFIG_HOME when reading the user-dirs configuration :pr:453 - by :user:bysiber
• Create the directory in Android :func:~platformdirs.user_log_dir and :func:~platformdirs.user_runtime_dir when ensure_exists is set :pr:452 - by :user:bysiber

---

... (truncated)

Commits

• 2140495 Release 4.11.0
• a562df9 👷 ci: run the test suite against Python 3.15 (#512)
• 7c764c4 [pre-commit.ci] pre-commit autoupdate (#511)
• See full diff in compare view

Updates ruff from 0.15.22 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

❌ Patch coverage is 93.24324% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.94%. Comparing base (fa9c3d6) to head (02c250f).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
pheme/renderer.py	33.33%	2 Missing ⚠️
pheme/transformation/scanreport/gvmd.py	92.85%	1 Missing ⚠️
pheme/transformation/scanreport/renderer.py	88.88%	1 Missing ⚠️
tests/test_get_username_and_role.py	75.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1072      +/-   ##
==========================================
- Coverage   87.05%   86.94%   -0.12%     
==========================================
  Files          35       35              
  Lines        1414     1402      -12     
==========================================
- Hits         1231     1219      -12     
  Misses        183      183              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.