Bump the uv-dependencies group with 4 updates

[dependabot]

Bumps the uv-dependencies group with 4 updates: fonttools, platformdirs, basedpyright and ruff.

Updates fonttools from 4.64.0 to 4.65.0

Release notes

Sourced from fonttools's releases.

4.65.0

• [glyf] Add __iter__, items and values methods to the glyf table to make it more dict-like (#4156).
• [feaLib] Escape the anonymous block tag when scanning for its terminator, so tags containing regex metacharacters are matched literally (#4167).
• [varLib] Strip directory components from <variable-font name="..."/> when deriving the output filename in the varLib command line, so a designspace cannot write outside the output directory (#4168).
• [feaLib] Fix tracking of the current script and language across redundant script statements. Rules following a script statement that names the first declared language system no longer end up under the DFLT script, and a script statement naming the already-current script still narrows the language systems and terminates the current lookup while leaving the lookupflag alone, matching makeotf (#1824, #2522, #4169).
• [varLib.interpolatable] Escape glyph names in the HTML report (#4172).
• [otlLib] Fix overflow handling when building contextual lookups: offset overflows now raise OTLOffsetOverflowError instead of AttributeError so another contextual format can be tried (regression from #3439). When all formats overflow, split the ruleset in halves until it fits (#4171).

Changelog

Sourced from fonttools's changelog.

4.65.0 (released 2026-09-10)

• [glyf] Add __iter__, items and values methods to the glyf table to make it more dict-like (#4156).
• [feaLib] Escape the anonymous block tag when scanning for its terminator, so tags containing regex metacharacters are matched literally (#4167).
• [varLib] Strip directory components from <variable-font name="..."/> when deriving the output filename in the varLib command line, so a designspace cannot write outside the output directory (#4168).
• [feaLib] Fix tracking of the current script and language across redundant script statements. Rules following a script statement that names the first declared language system no longer end up under the DFLT script, and a script statement naming the already-current script still narrows the language systems and terminates the current lookup while leaving the lookupflag alone, matching makeotf (#1824, #2522, #4169).
• [varLib.interpolatable] Escape glyph names in the HTML report (#4172).
• [otlLib] Fix overflow handling when building contextual lookups: offset overflows now raise OTLOffsetOverflowError instead of AttributeError so another contextual format can be tried (regression from #3439). When all formats overflow, split the ruleset in halves until it fits (#4171).

Commits

• 656f89d Release 4.65.0
• 1643950 Update NEWS.rst [skip ci]
• fd0f083 Merge pull request #4177 from fonttools/sbix-to-otsvg-snippet
• 9c625d4 Merge pull request #4171 from fonttools/fix-contextual-size-overflow
• 5f04c38 Add sbix to OT-SVG conversion snippet
• 48a0cf9 Merge pull request #4172 from insaf021/interpolatable-html-escape
• d30db24 Merge pull request #4169 from cmyr/fealib-script-tracking-afdko
• ac342d7 [varLib.interpolatable] escape glyph name in HTML report
• 2a93de2 Split contextual rulesets when all formats overflow
• e6bb5fe Fix overflow reporting when sizing contextual lookups
• Additional commits viewable in compare view

Updates platformdirs from 4.11.7 to 4.11.8

Release notes

Sourced from platformdirs's releases.

4.11.8

What's Changed

• fix: ignore relative XDG base directory paths by @​lakshayxi in tox-dev/platformdirs#540
• fix: return one user path for root under multipath by @​darrenhuai in tox-dev/platformdirs#538
• fix: preserve literal percent signs in user-dirs paths by @​jackwalkerlabs in tox-dev/platformdirs#542
• fix: retain Homebrew site directories inside virtual environments by @​jackwalkerlabs in tox-dev/platformdirs#543

New Contributors

• @​lakshayxi made their first contribution in tox-dev/platformdirs#540
• @​jackwalkerlabs made their first contribution in tox-dev/platformdirs#542

Full Changelog: tox-dev/platformdirs@4.11.7...4.11.8

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.10 (2026-09-18)

---

• With ensure_exists, the site_*_dir and site_*_path properties and the iter_*_dirs iterators only create the site directories they return or yield, instead of every entry in the site list - by :user:darrenhuai. :pr:550

---

4.11.9 (2026-09-16)

---

• Accept multipath in :func:~platformdirs.site_cache_dir and :func:~platformdirs.site_cache_path. Without it, the function API could not return the Homebrew cache prefix that :attr:~platformdirs.macos.MacOS.site_cache_dir adds under multipath - by :user:darrenhuai. :pr:544
• Parse Unix user-dirs.dirs line by line like xdg-user-dir. The INI parser raised on a repeated key or a line without =, and returned trailing comments and backslash escapes inside :func:~platformdirs.user_documents_dir and the other media directories. The last valid assignment now wins, and platformdirs unescapes the quoted value and ignores text after the closing quote - by :user:darrenhuai. :pr:545
• Read PUBLIC before the home directory in :func:~platformdirs.user_publicshare_dir on Windows, so it no longer raises RuntimeError when PUBLIC is set and the home directory cannot be determined - by :user:emme1t. :pr:546
• Raise RuntimeError from :class:~platformdirs.android.Android directories when the app folder cannot be found, instead of TypeError: expected str, bytes or os.PathLike object, not NoneType - by :user:Str0k. :pr:547

---

4.11.8 (2026-09-08)

---

• Make :func:~platformdirs.user_data_path, :func:~platformdirs.user_config_path, :func:~platformdirs.user_preference_path and :func:~platformdirs.user_applications_path return the first site entry when root is redirected by use_site_for_root under multipath, matching their site_*_path twins. They passed the whole joined list to :class:~pathlib.Path, giving one unusable path such as /xdg/a/foo:/xdg/b/foo - by :user:darrenhuai. :pr:538
• Ignore relative paths in XDG Base Directory environment variables and use the existing platform fallback. Relative entries in $XDG_DATA_DIRS and $XDG_CONFIG_DIRS are skipped. :pr:540
• Preserve literal percent signs in Unix user-dirs.dirs paths, including 100% complete, 100%% and %(XDG_DESKTOP_DIR)s. Continue to expand $HOME. :pr:542
• Use the base Python installation to locate Homebrew site directories on macOS, preserving shared data, config, cache and state paths inside virtual environments. :pr:543

---

... (truncated)

Commits

• c5ef1ed Release 4.11.8
• 0e85d6f fix: retain Homebrew site directories inside virtual environments (#543)
• b86a670 fix: preserve literal percent signs in user-dirs paths (#542)
• a6791c8 fix: return one user path for root under multipath (#538)
• 5550385 fix: ignore relative XDG base directory paths (#540)
• a209bf8 [pre-commit.ci] pre-commit autoupdate (#541)
• See full diff in compare view

Updates basedpyright from 1.40.0 to 1.40.1

Release notes

Sourced from basedpyright's releases.

v1.40.1 (pyright 1.1.414)

What's Changed

• Merge 1.1.414 by @​DetachHead in DetachHead/basedpyright#1883
• fix multi-line display of indented lines in builtin docstrings by @​tommyming in DetachHead/basedpyright#1882

Full Changelog: DetachHead/basedpyright@v1.40.0...v1.40.1

Commits

• e7fca69 1.40.1
• f7b6ad0 add checks when there are multiline indents for doc strings, update (#1882)
• 1bc4879 fix broken docs links
• 845bfe1 move and baseline basedpyright errors in new build scripts from upstream
• a9189ef prettier fix
• 756bfaa fix build:extension:dev script
• a7a2efd syncpack fix
• 5f6749f fix tests
• bb9b24f fix zizmor errors in new workflows from upstream
• b8ccd0e fix compile errors from merge
• Additional commits viewable in compare view

Updates ruff from 0.16.6 to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879

... (truncated)

Commits

• b5dba86 Bump version to 0.16.7 (#28496)
• 5992d05 Install rustfmt before linting releases (#28495)
• 1713a1f ensure prepare release changes pass prek (#28488)
• 18cdbb4 use scoped token for release workflow (#28484)
• c3813a5 add a workflow for preparing releases (#28486)
• 00948c0 Remove the "Who’s Using Ruff?" list (#28455)
• 86a2eba [pyupgrade] Stop recommending removed typing.no_type_check_decorator (`UP...
• 609e184 Stop defining __cached__ for Python 3.15 (#28476)
• 859ff2f [ty] Track symlinked directory status in listings (#28482)
• 77f6538 Use paid GitHub-hosted runners for Linux (#28478)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions