chore(deps): bump the python group with 4 updates

[dependabot]

Bumps the python group with 4 updates: charset-normalizer, filelock, platformdirs and python-security-auditing.

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates filelock from 4.0.6 to 4.0.7

Release notes

Sourced from filelock's releases.

4.0.7

What's Changed

• 🐛 fix(mode): require owner read and write by @​gaborbernat in tox-dev/filelock#760

Full Changelog: tox-dev/filelock@4.0.6...4.0.7

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.12 (2026-10-05)

---

• Fix read-lock acquisition on SQLite versions older than 3.33.0 by using sqlite_master for the schema probe. :pr:769

---

4.0.11 (2026-10-05)

---

• ReadWriteLock and AsyncReadWriteLock use a validated private hard link when /dev/fd has no entry for the database descriptor, supporting NetBSD's static descriptor directory beyond descriptor 63. The temporary location must share a filesystem with the database. The symlink refusal test accepts NetBSD's error wording.

---

4.0.10 (2026-10-03)

---

• Reusing a singleton AsyncFileLock with another loop, executor or run_in_executor, or a singleton SoftFileLease with another lease_duration, heartbeat_interval or on_compromise, now raises ValueError instead of returning the lock with its original options. :pr:765

---

4.0.9 (2026-10-01)

---

• ReadWriteLock and AsyncReadWriteLock close the descriptor that checks the database path once SQLite has connected, so on PyPy a dropped lock leaves no descriptor open until garbage collection runs. :pr:763
• ReadWriteLock and AsyncReadWriteLock refuse a symlink at the database path instead of following it, so a user who can create names in a shared lock directory cannot point the lock at another file (GHSA-j8f7-rjxc-mr56).

---

4.0.8 (2026-10-01)

---

• ReadWriteLock.release() and SoftReadWriteLock.release() from a thread that does not hold the write lock now raise RuntimeError instead of dropping the holder's lock and letting a second writer in. :pr:761

---

4.0.7 (2026-09-29)

---

... (truncated)

Commits

• 9ed62ac Release 4.0.7
• 2f2c4a7 🐛 fix(mode): require owner read and write (#760)
• d4ffe9c build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
• See full diff in compare view

Updates platformdirs from 4.12.1 to 4.12.2

Release notes

Sourced from platformdirs's releases.

4.12.2

What's Changed

• 🐛 fix(api): build site paths from site lists by @​9Kun in tox-dev/platformdirs#604
• ♻️ refactor(api): share use_site iteration by @​gaborbernat in tox-dev/platformdirs#606

New Contributors

• @​9Kun made their first contribution in tox-dev/platformdirs#604

Full Changelog: tox-dev/platformdirs@4.12.1...4.12.2

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.12.3 (2026-10-03)

---

• Place files from place_config_file and place_data_file in the first site directory for root on Unix with use_site_for_root=True and multipath=True, where find_config_file and find_data_file look for them. :pr:607

---

4.12.2 (2026-09-29)

---

• Keep os.pathsep in site_applications_path under multipath=True on platforms with one applications directory. :pr:604

---

4.12.1 (2026-09-28)

---

• Avoid PytestAssertRewriteWarning when importing platformdirs before invoking pytest. :pr:601

---

4.12.0 (2026-09-26)

---

• Add place_*_file methods that return a file path under a user directory and create its missing parents with mode 0o700. :pr:585
• Add find_<kind>_file and find_<kind>_files to look up an existing file across the user and site directories of each kind that has an iter_<kind>_paths method. :pr:586
• Add :func:platformdirs.testing.isolated_dirs and the platformdirs_isolated pytest fixture to resolve every directory under one test root. :pr:590
• Emit :class:~platformdirs.RuntimeDirWarning when the Unix :func:~platformdirs.user_runtime_dir falls back from XDG_RUNTIME_DIR. :pr:599
• Read user_templates_dir, user_publicshare_dir and user_bin_dir on Windows from their known folders. :pr:587
• Create missing user app directories and their parents with mode 0700 under ensure_exists on POSIX platforms. :pr:588
• Raise RuntimeError for a Unix or macOS directory under the home when no home resolves, and read the password database for an empty HOME. :pr:589
• Skip an XDG_RUNTIME_DIR or /run/user/<uid> that is not a private directory of the user, and reject a symlink or file as the runtime-<uid> fallback. :pr:599
• Use the app container layout on iOS, such as ~/Library/Application Support for data. :pr:600

... (truncated)

Commits

• af2fc7f Release 4.12.2
• bdafa67 ♻️ refactor(api): share use_site iteration (#606)
• d5ff75c 🐛 fix(api): keep os.pathsep in site_applications_path (#604)
• d545744 build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the all group (...
• 9fd89a7 [pre-commit.ci] pre-commit autoupdate (#603)
• See full diff in compare view

Updates python-security-auditing from 0.6.1 to 1.0.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

✅ All test workflows behaved as expected

13 passed, 0 failed

Test	Name	Expected	Actual	Bandit	pip-audit	Result
01	requirements · flat · clean	success	success	—	—	✅
02	requirements · src/ · bandit HIGH	failure	failure	B105, B404, B602	—	✅
03	requirements · src/+scripts/ · bandit HIGH + pip-audit	failure	failure	B105, B404, B602	click, cryptography, idna, requests, urllib3	✅
04	uv · flat · clean	success	success	—	—	✅
05	uv · src/ · pip-audit vuln	failure	failure	—	click, idna, requests, urllib3	✅
06	uv · src/+scripts/ · bandit MEDIUM	failure	failure	B324, B506	—	✅
07	poetry · flat · clean	success	success	—	—	✅
08	poetry · src/ · bandit MEDIUM + pip-audit	failure	failure	B105, B324	cryptography, idna, requests, urllib3	✅
09	pipenv · flat · clean	success	success	—	—	✅
10	pipenv · src/+scripts/ · bandit HIGH	failure	failure	B404, B602	—	✅
11	requirements · flat · clean (root working dir)	success	success	—	—	✅
12	uv · flat · bandit-only (no pip-audit)	failure	failure	B404, B602	disabled	✅
14	uv · flat · low threshold (B101 assert)	failure	failure	B101	disabled	✅