From cabf83e77fbed1f6d54d154eec436c144f8e558e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:12:00 +0000
Subject: [PATCH 01/33] chore(deps): bump pytest-cov from 6.1.0 to 6.3.0 (#996)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index e88532f9..c294c842 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -66,7 +66,7 @@ test = [
     "pytest >=7.2.0,<9.0.0",
     "pytest-cases ==3.8.6",
     "pytest-custom_exit_code ==0.3.0",
-    "pytest-cov ==6.1.0",
+    "pytest-cov ==6.3.0",
     "pytest-doctestplus ==1.3.0",
     "pytest-env ==1.1.5",
 ]

From 892b93a2fc65ce373d3f7c267d04f496a0225bae Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:12:27 +0000
Subject: [PATCH 02/33] chore(deps): bump github/codeql-action from 3.28.13 to
 3.30.1 (#995)

---
 .github/workflows/codeql-analysis.yaml     | 4 ++--
 .github/workflows/scorecards-analysis.yaml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index 36a31dcf..6e0b735b 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -58,7 +58,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
+      uses: github/codeql-action/init@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
       with:
         languages: ${{ matrix.language }}
         config-file: .github/codeql/codeql-config.yaml
@@ -71,4 +71,4 @@ jobs:
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
+      uses: github/codeql-action/analyze@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
index 767cf52c..bc64b5dc 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -59,6 +59,6 @@ jobs:
 
     # Upload the results to GitHub's code scanning dashboard.
     - name: Upload to code-scanning
-      uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
+      uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
       with:
         sarif_file: results.sarif

From f14c3cfb4d704d6097fedfdc3d89f3bdaa81a5c5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:12:43 +0000
Subject: [PATCH 03/33] chore(deps): bump twine from 6.1.0 to 6.2.0 (#994)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index c294c842..ed637f19 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -42,7 +42,7 @@ something = "package.__main__:main"
 # installed. Make sure to keep the requirements in sync with the workflows!
 actions = [
     "commitizen ==4.5.0",
-    "twine ==6.1.0",
+    "twine ==6.2.0",
 ]
 dev = [
     "flit >=3.2.0,<4.0.0",

From a80136fc063ee7169497bb2a0fec136a36305b74 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:13:15 +0000
Subject: [PATCH 04/33] chore(deps): bump actions/setup-python from 5.5.0 to
 6.0.0 (#993)

---
 .github/workflows/_build.yaml                  | 2 +-
 .github/workflows/codeql-analysis.yaml         | 2 +-
 .github/workflows/pr-conventional-commits.yaml | 2 +-
 .github/workflows/release.yaml                 | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/_build.yaml b/.github/workflows/_build.yaml
index 39bbbaae..feefc38b 100644
--- a/.github/workflows/_build.yaml
+++ b/.github/workflows/_build.yaml
@@ -66,7 +66,7 @@ jobs:
         fetch-depth: 0
 
     - name: Set up Python
-      uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
       with:
         python-version: ${{ matrix.python }}
 
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index 6e0b735b..36e5eb32 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -46,7 +46,7 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Set up Python ${{ matrix.python }}
-      uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
       with:
         python-version: ${{ matrix.python }}
 
diff --git a/.github/workflows/pr-conventional-commits.yaml b/.github/workflows/pr-conventional-commits.yaml
index 811bc182..780b72ba 100644
--- a/.github/workflows/pr-conventional-commits.yaml
+++ b/.github/workflows/pr-conventional-commits.yaml
@@ -27,7 +27,7 @@ jobs:
         fetch-depth: 0
 
     - name: Set up Python
-      uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
       with:
         python-version: '3.13'
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0d4a1dbe..5f851f50 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -42,7 +42,7 @@ jobs:
         token: ${{ secrets.REPO_ACCESS_TOKEN }}
 
     - name: Set up Python
-      uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
       with:
         python-version: '3.13'
 
@@ -126,7 +126,7 @@ jobs:
 
     # Create the Release Notes using commitizen.
     - name: Set up Python
-      uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
       with:
         python-version: '3.13'
 

From 468be5f2c2b86da9a9a240d3598474cc8b9e0f5f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:13:34 +0000
Subject: [PATCH 05/33] chore(deps): update hypothesis requirement from
 <6.130.9,>=6.21.0 to >=6.21.0,<6.138.16 (#992)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index ed637f19..7e9096d2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -62,7 +62,7 @@ hooks = [
 # Note that the `custom_exit_code` and `env` plugins may currently be unmaintained.
 test = [
     "faker ==37.1.0",
-    "hypothesis >=6.21.0,<6.130.9",
+    "hypothesis >=6.21.0,<6.138.16",
     "pytest >=7.2.0,<9.0.0",
     "pytest-cases ==3.8.6",
     "pytest-custom_exit_code ==0.3.0",

From dd8ae598543d11bfcc9b6e235bafc08f940bae49 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:17:14 +0000
Subject: [PATCH 06/33] chore(deps): bump pytest-cases from 3.8.6 to 3.9.1
 (#958)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 7e9096d2..486810e6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -64,7 +64,7 @@ test = [
     "faker ==37.1.0",
     "hypothesis >=6.21.0,<6.138.16",
     "pytest >=7.2.0,<9.0.0",
-    "pytest-cases ==3.8.6",
+    "pytest-cases ==3.9.1",
     "pytest-custom_exit_code ==0.3.0",
     "pytest-cov ==6.3.0",
     "pytest-doctestplus ==1.3.0",

From b6881a5ef226913ac954344d47d51ec0327e853b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:17:24 +0000
Subject: [PATCH 07/33] chore(deps): update pre-commit requirement from
 <4.1.0,>=3.0.0 to >=3.0.0,<4.4.0 (#983)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 486810e6..75aec80f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -57,7 +57,7 @@ docs = [
     "sphinx-markdown-builder >=0.6.4,<1.0.0",
 ]
 hooks = [
-    "pre-commit >=3.0.0,<4.1.0",
+    "pre-commit >=3.0.0,<4.4.0",
 ]
 # Note that the `custom_exit_code` and `env` plugins may currently be unmaintained.
 test = [

From 4bc4285706a98d580326a7a3f4430e9c5ec55420 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:18:07 +0000
Subject: [PATCH 08/33] chore(deps): bump step-security/harden-runner from
 2.11.1 to 2.13.0 (#975)

---
 .github/workflows/_build.yaml              | 2 +-
 .github/workflows/_generate-rebase.yaml    | 2 +-
 .github/workflows/_wiki-documentation.yaml | 2 +-
 .github/workflows/codeql-analysis.yaml     | 2 +-
 .github/workflows/release.yaml             | 6 +++---
 .github/workflows/scorecards-analysis.yaml | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/_build.yaml b/.github/workflows/_build.yaml
index feefc38b..d9f4faec 100644
--- a/.github/workflows/_build.yaml
+++ b/.github/workflows/_build.yaml
@@ -55,7 +55,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
diff --git a/.github/workflows/_generate-rebase.yaml b/.github/workflows/_generate-rebase.yaml
index 19a68c08..c3846c35 100644
--- a/.github/workflows/_generate-rebase.yaml
+++ b/.github/workflows/_generate-rebase.yaml
@@ -34,7 +34,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
diff --git a/.github/workflows/_wiki-documentation.yaml b/.github/workflows/_wiki-documentation.yaml
index af588a88..253469fb 100644
--- a/.github/workflows/_wiki-documentation.yaml
+++ b/.github/workflows/_wiki-documentation.yaml
@@ -41,7 +41,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index 36e5eb32..e70983a8 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -37,7 +37,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5f851f50..a6e99d45 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -30,7 +30,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
@@ -98,7 +98,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
@@ -199,7 +199,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
index bc64b5dc..978562c7 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -26,7 +26,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true

From 09d7c7543c5953fd874eb5d178e6dd13fe7d95a4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:19:01 +0000
Subject: [PATCH 09/33] chore(deps): update mypy requirement from <1.15,>=1.0.0
 to >=1.0.0,<1.18 (#972)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 75aec80f..7a054237 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -46,7 +46,7 @@ actions = [
 ]
 dev = [
     "flit >=3.2.0,<4.0.0",
-    "mypy >=1.0.0,<1.15",
+    "mypy >=1.0.0,<1.18",
     "pip-audit >=2.4.4,<3.0.0",
     "pylint >=3.0.0,<3.4.0",
     "perflint >=0.8.0,<1.0.0",

From c5ccbe40baad5f1729cff02b952c1100eeca9b3f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:19:04 +0000
Subject: [PATCH 10/33] chore(deps): bump actions/checkout from 4.2.2 to 5.0.0
 (#985)

---
 .github/workflows/_build.yaml                  | 2 +-
 .github/workflows/_generate-rebase.yaml        | 2 +-
 .github/workflows/_wiki-documentation.yaml     | 2 +-
 .github/workflows/codeql-analysis.yaml         | 2 +-
 .github/workflows/pr-conventional-commits.yaml | 2 +-
 .github/workflows/release.yaml                 | 6 +++---
 .github/workflows/scorecards-analysis.yaml     | 2 +-
 .github/workflows/sync-with-upstream.yaml      | 4 ++--
 8 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/_build.yaml b/.github/workflows/_build.yaml
index d9f4faec..777b2658 100644
--- a/.github/workflows/_build.yaml
+++ b/.github/workflows/_build.yaml
@@ -61,7 +61,7 @@ jobs:
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/_generate-rebase.yaml b/.github/workflows/_generate-rebase.yaml
index c3846c35..62ae4fd7 100644
--- a/.github/workflows/_generate-rebase.yaml
+++ b/.github/workflows/_generate-rebase.yaml
@@ -39,7 +39,7 @@ jobs:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
     - name: Check out repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         fetch-depth: 0
         token: ${{ secrets.REPO_ACCESS_TOKEN }}
diff --git a/.github/workflows/_wiki-documentation.yaml b/.github/workflows/_wiki-documentation.yaml
index 253469fb..937d141a 100644
--- a/.github/workflows/_wiki-documentation.yaml
+++ b/.github/workflows/_wiki-documentation.yaml
@@ -49,7 +49,7 @@ jobs:
     # Check out the repository's Wiki repo into the wiki/ folder. The token is required
     # only for private repositories.
     - name: Check out repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         token: ${{ secrets.REPO_ACCESS_TOKEN }}
         repository: ${{ format('{0}.wiki', github.repository) }}
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index e70983a8..e0b91412 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -43,7 +43,7 @@ jobs:
         disable-sudo: true
 
     - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Set up Python ${{ matrix.python }}
       uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
diff --git a/.github/workflows/pr-conventional-commits.yaml b/.github/workflows/pr-conventional-commits.yaml
index 780b72ba..6d506d98 100644
--- a/.github/workflows/pr-conventional-commits.yaml
+++ b/.github/workflows/pr-conventional-commits.yaml
@@ -22,7 +22,7 @@ jobs:
     steps:
 
     - name: Check out repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a6e99d45..a59aa45d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -36,7 +36,7 @@ jobs:
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         fetch-depth: 0
         token: ${{ secrets.REPO_ACCESS_TOKEN }}
@@ -104,7 +104,7 @@ jobs:
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         fetch-depth: 0
 
@@ -205,7 +205,7 @@ jobs:
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
index 978562c7..b04bd7f3 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -32,7 +32,7 @@ jobs:
         disable-sudo: true
 
     - name: Check out repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/sync-with-upstream.yaml b/.github/workflows/sync-with-upstream.yaml
index 8b29d998..cfb5f152 100644
--- a/.github/workflows/sync-with-upstream.yaml
+++ b/.github/workflows/sync-with-upstream.yaml
@@ -21,7 +21,7 @@ jobs:
     steps:
 
     - name: Check out template repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # If you decide to change the upstream template repository to a private one, uncomment
         # the following argument to pass the required token to be able to check it out.
@@ -31,7 +31,7 @@ jobs:
         path: template
 
     - name: Check out current repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         token: ${{ secrets.REPO_ACCESS_TOKEN }}
         fetch-depth: 0

From 8b97adba750fd5ab6110e9153e8d44e45d9c6829 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:19:12 +0000
Subject: [PATCH 11/33] chore(deps): bump slsa-framework/slsa-github-generator
 from 2.0.0 to 2.1.0 (#916)

---
 .github/workflows/release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a59aa45d..764d6759 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -177,7 +177,7 @@ jobs:
   # https://github.com/slsa-framework/slsa-github-generator/issues/942
   provenance:
     needs: [build, release]
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
     with:
       base64-subjects: ${{ needs.build.outputs.artifacts-sha256 }}
       compile-generator: false # Do not build the provenance generator from source anymore.

From dfe12f36cdf50396270c089342692a45c98351b7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:19:46 +0000
Subject: [PATCH 12/33] chore(deps): bump ossf/scorecard-action from 2.4.0 to
 2.4.2 (#942)

---
 .github/workflows/scorecards-analysis.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
index b04bd7f3..db3ddd01 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -37,7 +37,7 @@ jobs:
         persist-credentials: false
 
     - name: Run analysis
-      uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+      uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
       with:
         results_file: results.sarif
         results_format: sarif

From dd8777a28686b608a9294c70091e57ce91afcb1f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:41:22 +0000
Subject: [PATCH 13/33] chore(deps): bump faker from 37.1.0 to 37.6.0 (#990)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 7a054237..fdc500ae 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -61,7 +61,7 @@ hooks = [
 ]
 # Note that the `custom_exit_code` and `env` plugins may currently be unmaintained.
 test = [
-    "faker ==37.1.0",
+    "faker ==37.6.0",
     "hypothesis >=6.21.0,<6.138.16",
     "pytest >=7.2.0,<9.0.0",
     "pytest-cases ==3.9.1",

From 2d4284e83e683880e1e61c032dbf63986f01c283 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:45:21 +0000
Subject: [PATCH 14/33] chore(deps): bump actions/upload-artifact from 4.5.0 to
 4.6.2 (#914)

---
 .github/workflows/_build.yaml              | 2 +-
 .github/workflows/scorecards-analysis.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/_build.yaml b/.github/workflows/_build.yaml
index 777b2658..8641b1ed 100644
--- a/.github/workflows/_build.yaml
+++ b/.github/workflows/_build.yaml
@@ -134,7 +134,7 @@ jobs:
     # Currently reusable workflows do not support setting strategy property from the caller workflow.
     - name: Upload the package artifact for debugging and release
       if: matrix.os == env.ARTIFACT_OS && matrix.python == env.ARTIFACT_PYTHON
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: artifact-${{ matrix.os }}-python-${{ matrix.python }}
         path: dist
diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
index db3ddd01..38887b1e 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -52,7 +52,7 @@ jobs:
 
     # Upload the results as artifacts (optional).
     - name: Upload artifact
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: SARIF file
         path: results.sarif

From a37762b40a54587b2a5ac93c51fd0d1f65fd87fb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:46:23 +0000
Subject: [PATCH 15/33] chore(deps): bump actions/download-artifact from 4.1.8
 to 5.0.0 (#984)

---
 .github/workflows/_wiki-documentation.yaml | 2 +-
 .github/workflows/release.yaml             | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/_wiki-documentation.yaml b/.github/workflows/_wiki-documentation.yaml
index 937d141a..0aaffa16 100644
--- a/.github/workflows/_wiki-documentation.yaml
+++ b/.github/workflows/_wiki-documentation.yaml
@@ -57,7 +57,7 @@ jobs:
 
     # Download the build artifacts attached to this workflow run.
     - name: Download artifact
-      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       with:
         name: ${{ inputs.artifact-name }}
         path: dist
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 764d6759..9989dded 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -109,7 +109,7 @@ jobs:
         fetch-depth: 0
 
     - name: Download artifact
-      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       with:
         name: artifact-ubuntu-latest-python-3.13
         path: dist
@@ -210,7 +210,7 @@ jobs:
         fetch-depth: 0
 
     - name: Download provenance
-      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       with:
         name: ${{ needs.provenance.outputs.provenance-name }}
 

From b051cfe742231da4cc88a09ea6bd8008ccbd964b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 19:05:26 +0000
Subject: [PATCH 16/33] chore(deps): bump pytest-doctestplus from 1.3.0 to
 1.4.0 (#909)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index fdc500ae..6e510adc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -67,7 +67,7 @@ test = [
     "pytest-cases ==3.9.1",
     "pytest-custom_exit_code ==0.3.0",
     "pytest-cov ==6.3.0",
-    "pytest-doctestplus ==1.3.0",
+    "pytest-doctestplus ==1.4.0",
     "pytest-env ==1.1.5",
 ]
 

From 5a964f1ab74252233e222de82b2e868bbb9543df Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 11 Sep 2025 05:26:15 +1000
Subject: [PATCH 17/33] chore(deps): bump commitizen from 4.5.0 to 4.8.4 (#997)

* chore(deps): bump commitizen from 4.5.0 to 4.8.4

Bumps [commitizen](https://github.com/commitizen-tools/commitizen) from 4.5.0 to 4.8.4.
- [Release notes](https://github.com/commitizen-tools/commitizen/releases)
- [Changelog](https://github.com/commitizen-tools/commitizen/blob/master/CHANGELOG.md)
- [Commits](https://github.com/commitizen-tools/commitizen/compare/v4.5.0...v4.8.4)

---
updated-dependencies:
- dependency-name: commitizen
  dependency-version: 4.8.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: add missind deps

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jens Troeger <jens.troeger@light-speed.de>
---
 .github/workflows/pr-conventional-commits.yaml | 2 +-
 .github/workflows/release.yaml                 | 4 ++--
 .pre-commit-config.yaml                        | 2 +-
 pyproject.toml                                 | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pr-conventional-commits.yaml b/.github/workflows/pr-conventional-commits.yaml
index 6d506d98..46534dff 100644
--- a/.github/workflows/pr-conventional-commits.yaml
+++ b/.github/workflows/pr-conventional-commits.yaml
@@ -36,7 +36,7 @@ jobs:
     - name: Set up Commitizen
       run: |
         pip install --upgrade pip wheel
-        pip install 'commitizen ==4.5.0'
+        pip install 'commitizen ==4.8.4'
 
     # Run Commitizen to check the title of the PR which triggered this workflow, and check
     # all commit messages of the PR's branch. If any of the checks fails then this job fails.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 9989dded..7e0d464f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -49,7 +49,7 @@ jobs:
     - name: Set up Commitizen
       run: |
         pip install --upgrade pip wheel
-        pip install 'commitizen ==4.5.0'
+        pip install 'commitizen ==4.8.4'
 
     - name: Set up user
       run: |
@@ -133,7 +133,7 @@ jobs:
     - name: Set up Commitizen
       run: |
         pip install --upgrade pip wheel
-        pip install 'commitizen ==4.5.0'
+        pip install 'commitizen ==4.8.4'
 
     - name: Create Release Notes
       run: cz changelog --dry-run "$(cz version --project)" > RELEASE_NOTES.md
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 399991af..6e166ce5 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -15,7 +15,7 @@ repos:
 
 # Commitizen enforces semantic and conventional commit messages.
 - repo: https://github.com/commitizen-tools/commitizen
-  rev: v4.5.0
+  rev: v4.8.4
   hooks:
   - id: commitizen
     name: Check conventional commit message
diff --git a/pyproject.toml b/pyproject.toml
index 6e510adc..f5b9e6cc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -41,7 +41,7 @@ something = "package.__main__:main"
 # We keep them listed here to ensure the infrastructure BOM is consistent with what's
 # installed. Make sure to keep the requirements in sync with the workflows!
 actions = [
-    "commitizen ==4.5.0",
+    "commitizen ==4.8.4",
     "twine ==6.2.0",
 ]
 dev = [

From 6bfad9812f0b4f0f87d643b8b85b879d18327d7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= <jenstroeger@users.noreply.github.com>
Date: Thu, 11 Sep 2025 05:27:59 +1000
Subject: [PATCH 18/33] fix: make sure isort skips over files listed as such in
 the pyproject.toml tool configuration (#968)

---
 pyproject.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pyproject.toml b/pyproject.toml
index f5b9e6cc..400cc307 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -142,6 +142,7 @@ profile = "black"
 multi_line_output = 3
 line_length = 120
 skip_gitignore = true
+filter_files = true
 
 
 # https://mypy.readthedocs.io/en/stable/config_file.html#using-a-pyproject-toml

From b7250ace1e278fb29d3a914768d61e9d77ecd48d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= <jenstroeger@users.noreply.github.com>
Date: Thu, 11 Sep 2025 05:28:53 +1000
Subject: [PATCH 19/33] =?UTF-8?q?fix:=20building=20the=20package=E2=80=99s?=
 =?UTF-8?q?=20dist=20files=20should=20*always*=20generate=20the=20build?=
 =?UTF-8?q?=E2=80=99s=20epoch=20as=20well,=20even=20when=20using=20the=20i?=
 =?UTF-8?q?ndividual=20package=20goals=20only=20(#950)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 061534ff..b5a71800 100644
--- a/Makefile
+++ b/Makefile
@@ -176,9 +176,9 @@ test:
 # set to the build date/epoch. For more details, see: https://flit.pypa.io/en/latest/reproducible.html
 .PHONY: dist
 dist: dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-py3-none-any.whl dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION).tar.gz dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-docs-html.zip dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-docs-md.zip dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-build-epoch.txt
-dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-py3-none-any.whl: check test
+dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-py3-none-any.whl: check test dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-build-epoch.txt
 	SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) flit build --setup-py --format wheel
-dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION).tar.gz: check test
+dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION).tar.gz: check test dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-build-epoch.txt
 	SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) flit build --setup-py --format sdist
 dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-docs-html.zip: docs-html
 	python -m zipfile -c dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-docs-html.zip docs/_build/html/

From 63c2bd04c5f2f713326387a53ed605bded530c3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= <jenstroeger@users.noreply.github.com>
Date: Thu, 11 Sep 2025 05:29:54 +1000
Subject: [PATCH 20/33] fix: remove various repo files that leaked into the
 sdist of the package (#948)

---
 pyproject.toml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pyproject.toml b/pyproject.toml
index 400cc307..1c2ffdee 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -125,12 +125,15 @@ omit = [
 include = []
 exclude = [
     ".github/",
+    ".vscode/",
     "docs/",
     "tests/",
     ".flake8",
+    ".gitattributes",
     ".gitignore",
     ".pre-commit-config.yaml",
     "CHANGELOG.md",
+    "CODEOWNERS",
     "Makefile",
     "SECURITY.md",
 ]

From ff72c397f9d83e2a28789eef64d418759f49d35c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= <jenstroeger@users.noreply.github.com>
Date: Thu, 11 Sep 2025 05:31:37 +1000
Subject: [PATCH 21/33] chore: add macOS .DS_Store system files and vim .swp
 files to the .gitignore list (#945)

---
 .gitignore | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.gitignore b/.gitignore
index fe324aff..89f1b2d5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -132,3 +132,9 @@ dmypy.json
 
 # Pyre type checker
 .pyre/
+
+# macOS cruft
+.DS_Store
+
+# vim swap files
+.*.swp

From 761f68707205ff76dc741192c5a469b1881fbdfa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= <jenstroeger@users.noreply.github.com>
Date: Thu, 11 Sep 2025 05:33:03 +1000
Subject: [PATCH 22/33] feat(ci): cancel existing running workflows for a PR
 when a new change is pushed to that PR (#927)

---
 .github/workflows/pr-change-set.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/pr-change-set.yaml b/.github/workflows/pr-change-set.yaml
index 8c09ad72..56f8a789 100644
--- a/.github/workflows/pr-change-set.yaml
+++ b/.github/workflows/pr-change-set.yaml
@@ -14,6 +14,12 @@ on:
 permissions:
   contents: read
 
+# Cancel existing running workflows for a PR when a new change is pushed
+# to that PR. See also: https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#concurrency
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     uses: ./.github/workflows/_build.yaml

From 7c137a485965bfe843f0f3dff07772f76dbd7bc3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Sep 2025 17:58:02 +0000
Subject: [PATCH 23/33] chore(deps): bump github/codeql-action from 3.30.1 to
 3.30.3 (#1003)

---
 .github/workflows/codeql-analysis.yaml     | 4 ++--
 .github/workflows/scorecards-analysis.yaml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index e0b91412..2b136f03 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -58,7 +58,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
+      uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
       with:
         languages: ${{ matrix.language }}
         config-file: .github/codeql/codeql-config.yaml
@@ -71,4 +71,4 @@ jobs:
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
+      uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
index 38887b1e..5850dae7 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -59,6 +59,6 @@ jobs:
 
     # Upload the results to GitHub's code scanning dashboard.
     - name: Upload to code-scanning
-      uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
+      uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
       with:
         sarif_file: results.sarif

From c8fa9d6e4fe6fa2b9d3df7288a00dc090c78781e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Sep 2025 17:58:15 +0000
Subject: [PATCH 24/33] chore(deps): bump step-security/harden-runner from
 2.13.0 to 2.13.1 (#1001)

---
 .github/workflows/_build.yaml              | 2 +-
 .github/workflows/_generate-rebase.yaml    | 2 +-
 .github/workflows/_wiki-documentation.yaml | 2 +-
 .github/workflows/codeql-analysis.yaml     | 2 +-
 .github/workflows/release.yaml             | 6 +++---
 .github/workflows/scorecards-analysis.yaml | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/_build.yaml b/.github/workflows/_build.yaml
index 8641b1ed..fe52fc30 100644
--- a/.github/workflows/_build.yaml
+++ b/.github/workflows/_build.yaml
@@ -55,7 +55,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
diff --git a/.github/workflows/_generate-rebase.yaml b/.github/workflows/_generate-rebase.yaml
index 62ae4fd7..b35323d3 100644
--- a/.github/workflows/_generate-rebase.yaml
+++ b/.github/workflows/_generate-rebase.yaml
@@ -34,7 +34,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
diff --git a/.github/workflows/_wiki-documentation.yaml b/.github/workflows/_wiki-documentation.yaml
index 0aaffa16..87e399dd 100644
--- a/.github/workflows/_wiki-documentation.yaml
+++ b/.github/workflows/_wiki-documentation.yaml
@@ -41,7 +41,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index 2b136f03..f4baca14 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -37,7 +37,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 7e0d464f..e958bc4a 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -30,7 +30,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
@@ -98,7 +98,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
@@ -199,7 +199,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true
diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
index 5850dae7..13f9e50a 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -26,7 +26,7 @@ jobs:
     steps:
 
     - name: Harden Runner
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
         disable-sudo: true

From 67c08ddeebeb6e33213c62c5d6ab86893268ab20 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Sep 2025 17:58:42 +0000
Subject: [PATCH 25/33] chore(deps): bump pytest-cov from 6.3.0 to 7.0.0
 (#1000)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 1c2ffdee..44616751 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -66,7 +66,7 @@ test = [
     "pytest >=7.2.0,<9.0.0",
     "pytest-cases ==3.9.1",
     "pytest-custom_exit_code ==0.3.0",
-    "pytest-cov ==6.3.0",
+    "pytest-cov ==7.0.0",
     "pytest-doctestplus ==1.4.0",
     "pytest-env ==1.1.5",
 ]

From 38b7bc16f015c1e990cdc2be860467402892320e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Sep 2025 17:58:52 +0000
Subject: [PATCH 26/33] chore(deps): update mypy requirement from <1.18,>=1.0.0
 to >=1.0.0,<1.19 (#999)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 44616751..a2ffa81c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -46,7 +46,7 @@ actions = [
 ]
 dev = [
     "flit >=3.2.0,<4.0.0",
-    "mypy >=1.0.0,<1.18",
+    "mypy >=1.0.0,<1.19",
     "pip-audit >=2.4.4,<3.0.0",
     "pylint >=3.0.0,<3.4.0",
     "perflint >=0.8.0,<1.0.0",

From 6816936b27273a3b87d2a74e7c7f3cd452507de2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Sep 2025 17:59:04 +0000
Subject: [PATCH 27/33] chore(deps): update hypothesis requirement from
 <6.138.16,>=6.21.0 to >=6.21.0,<6.138.17 (#998)

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index a2ffa81c..6bb049b0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -62,7 +62,7 @@ hooks = [
 # Note that the `custom_exit_code` and `env` plugins may currently be unmaintained.
 test = [
     "faker ==37.6.0",
-    "hypothesis >=6.21.0,<6.138.16",
+    "hypothesis >=6.21.0,<6.138.17",
     "pytest >=7.2.0,<9.0.0",
     "pytest-cases ==3.9.1",
     "pytest-custom_exit_code ==0.3.0",

From 46d61679d357c0f3ec17decd1e48c5de39ab0bc5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= <jenstroeger@users.noreply.github.com>
Date: Sat, 20 Sep 2025 17:00:11 +1000
Subject: [PATCH 28/33] =?UTF-8?q?perf(test):=20use=20Python=E2=80=99s=20sy?=
 =?UTF-8?q?stem=20monitoring=20facilities=20to=20improve=20performance=20o?=
 =?UTF-8?q?f=20test=20runs=20(#933)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .pre-commit-config.yaml | 6 ++++--
 pyproject.toml          | 8 +++++++-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6e166ce5..3ff88682 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -160,12 +160,14 @@ repos:
   hooks:
   - id: actionlint
 
-# On push to the remote, run the unit tests.
+# On push to the remote, run the unit tests. Note that the `COVERAGE_CORE` variable is
+# required for Python 3.12+ to make sure Coverage uses the new Python monitoring module.
+# See also: https://blog.trailofbits.com/2025/05/01/making-pypis-test-suite-81-faster/#optimizing-coverage-with-python-312s-sysmonitoring
 - repo: local
   hooks:
   - id: pytest
     name: Run unit tests
-    entry: pytest -c pyproject.toml --cov-config pyproject.toml src/package/ tests/ docs/
+    entry: env COVERAGE_CORE=sysmon pytest -c pyproject.toml --cov-config pyproject.toml src/package/ tests/ docs/
     language: python
     verbose: true
     always_run: true
diff --git a/pyproject.toml b/pyproject.toml
index 6bb049b0..b983b3a8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -61,12 +61,13 @@ hooks = [
 ]
 # Note that the `custom_exit_code` and `env` plugins may currently be unmaintained.
 test = [
+    "coverage ==7.6.12; python_version<'3.14'",  # https://github.com/pypi/warehouse/pull/17872#issuecomment-2845932281
     "faker ==37.6.0",
     "hypothesis >=6.21.0,<6.138.17",
     "pytest >=7.2.0,<9.0.0",
     "pytest-cases ==3.9.1",
     "pytest-custom_exit_code ==0.3.0",
-    "pytest-cov ==7.0.0",
+    "pytest-cov ==6.3.0",  # Uses: coverage[toml] >=7.5
     "pytest-doctestplus ==1.4.0",
     "pytest-env ==1.1.5",
 ]
@@ -271,6 +272,11 @@ env = [
 filterwarnings = [
     "error",
     "always::DeprecationWarning",
+    # The CoverageWarning warning is issued in two contexts:
+    # Python 3.10, 3.11: sys.monitoring isn't available in this version, using default core (no-sysmon)
+    # Python 3.12, 3.13: sys.monitoring can't measure branches in this version, using default core (no-sysmon)
+    "ignore:sys.monitoring isn't available in this version:coverage.exceptions.CoverageWarning",
+    "always::coverage.exceptions.CoverageWarning",
     # https://docs.pytest.org/en/latest/how-to/failures.html#warning-about-unraisable-exceptions-and-unhandled-thread-exceptions
     "error::pytest.PytestUnraisableExceptionWarning",
     "error::pytest.PytestUnhandledThreadExceptionWarning",

From 4a5879071d160871118f8691d93c5eafff56b2c6 Mon Sep 17 00:00:00 2001
From: Behnaz Hassanshahi <b.hassanshahi@gmail.com>
Date: Sat, 20 Sep 2025 17:01:52 +1000
Subject: [PATCH 29/33] build: use head_commit object for checking the bump
 message (#988)

This PR uses the `head_commit` object from the GitHub context object for checking the bump message. This approach provides a cleaner and more reliable way to detect version bump commits.
---
 .github/workflows/release.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e958bc4a..2bd2c45a 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   check:
-    if: ${{ !startsWith(github.event.commits[0].message, 'bump:') }}
+    if: ${{ !startsWith(github.event.head_commit.message, 'bump:') }}
     uses: ./.github/workflows/_build.yaml
     permissions:
       contents: read
@@ -77,7 +77,7 @@ jobs:
 
   # When triggered by the version bump commit, build the package and publish the release artifacts.
   build:
-    if: github.ref == 'refs/heads/release' && startsWith(github.event.commits[0].message, 'bump:')
+    if: github.ref == 'refs/heads/release' && startsWith(github.event.head_commit.message, 'bump:')
     uses: ./.github/workflows/_build.yaml
     permissions:
       contents: read

From 7bd4bc4b3ec730ec72a87d43bbe6f90062c6cdd9 Mon Sep 17 00:00:00 2001
From: Behnaz Hassanshahi <b.hassanshahi@gmail.com>
Date: Sat, 20 Sep 2025 17:02:27 +1000
Subject: [PATCH 30/33] feat: add actions to CodeQL languages (#991)

This PR adds the `actions` scanner to the CodeQL configuration, which has been recently added to the supported languages.
---
 .github/workflows/codeql-analysis.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index f4baca14..cac3bb02 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -30,9 +30,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
         # Learn more about CodeQL language support at https://git.io/codeql-language-support
-        language: [python]
+        language: [python, actions]
         python: ['3.13']
     steps:
 

From 2da2306881b33b09270ac90bba0b2fa4611be097 Mon Sep 17 00:00:00 2001
From: Behnaz Hassanshahi <b.hassanshahi@gmail.com>
Date: Sat, 20 Sep 2025 17:58:36 +1000
Subject: [PATCH 31/33] ci: remove path exclusion for CodeQL Action runs
 (#1004)

This PR adds .github/workflows to the CodeQL configuration and removes path exclusions from the CodeQL GitHub Action, ensuring that CodeQL runs on all changes, including modifications to GitHub Actions workflows themselves.
---
 .github/codeql/codeql-config.yaml      | 1 +
 .github/workflows/codeql-analysis.yaml | 3 ---
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/codeql/codeql-config.yaml b/.github/codeql/codeql-config.yaml
index ac9f5f2b..e574984f 100644
--- a/.github/codeql/codeql-config.yaml
+++ b/.github/codeql/codeql-config.yaml
@@ -1,3 +1,4 @@
 name: CodeQL configuration
 paths:
 - src/package
+- .github/workflows
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index cac3bb02..826ef9e1 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -11,9 +11,6 @@ on:
     branches:
     - release
     - main
-    # Avoid unnecessary scans of pull requests.
-    paths:
-    - '**/*.py'
   schedule:
   - cron: 20 15 * * 3
 permissions:

From baf2c8099b3501771942ef8af736a6de9e9a5d81 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 20 Sep 2025 17:59:01 +1000
Subject: [PATCH 32/33] chore(deps): bump commitizen from 4.8.4 to 4.9.1
 (#1002)

---
 .github/workflows/pr-conventional-commits.yaml | 2 +-
 .github/workflows/release.yaml                 | 4 ++--
 .pre-commit-config.yaml                        | 2 +-
 pyproject.toml                                 | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pr-conventional-commits.yaml b/.github/workflows/pr-conventional-commits.yaml
index 46534dff..f43cfe0a 100644
--- a/.github/workflows/pr-conventional-commits.yaml
+++ b/.github/workflows/pr-conventional-commits.yaml
@@ -36,7 +36,7 @@ jobs:
     - name: Set up Commitizen
       run: |
         pip install --upgrade pip wheel
-        pip install 'commitizen ==4.8.4'
+        pip install 'commitizen ==4.9.1'
 
     # Run Commitizen to check the title of the PR which triggered this workflow, and check
     # all commit messages of the PR's branch. If any of the checks fails then this job fails.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2bd2c45a..d2e8295d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -49,7 +49,7 @@ jobs:
     - name: Set up Commitizen
       run: |
         pip install --upgrade pip wheel
-        pip install 'commitizen ==4.8.4'
+        pip install 'commitizen ==4.9.1'
 
     - name: Set up user
       run: |
@@ -133,7 +133,7 @@ jobs:
     - name: Set up Commitizen
       run: |
         pip install --upgrade pip wheel
-        pip install 'commitizen ==4.8.4'
+        pip install 'commitizen ==4.9.1'
 
     - name: Create Release Notes
       run: cz changelog --dry-run "$(cz version --project)" > RELEASE_NOTES.md
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3ff88682..411e8e6a 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -15,7 +15,7 @@ repos:
 
 # Commitizen enforces semantic and conventional commit messages.
 - repo: https://github.com/commitizen-tools/commitizen
-  rev: v4.8.4
+  rev: v4.9.1
   hooks:
   - id: commitizen
     name: Check conventional commit message
diff --git a/pyproject.toml b/pyproject.toml
index b983b3a8..fb33d0f7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -41,7 +41,7 @@ something = "package.__main__:main"
 # We keep them listed here to ensure the infrastructure BOM is consistent with what's
 # installed. Make sure to keep the requirements in sync with the workflows!
 actions = [
-    "commitizen ==4.8.4",
+    "commitizen ==4.9.1",
     "twine ==6.2.0",
 ]
 dev = [

From 064fb578ca7a598200d2456f3860f95a71654026 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= <jenstroeger@users.noreply.github.com>
Date: Sat, 20 Sep 2025 17:59:28 +1000
Subject: [PATCH 33/33] chore(deps-dev): update pre-commit tools (#949)

---
 .pre-commit-config.yaml | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 411e8e6a..8bb0182d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -23,7 +23,7 @@ repos:
 
 # Sort imports.
 - repo: https://github.com/pycqa/isort
-  rev: 5.13.2
+  rev: 6.0.1
   hooks:
   - id: isort
     name: Sort import statements
@@ -32,22 +32,22 @@ repos:
 
 # Add Black code formatters.
 - repo: https://github.com/ambv/black
-  rev: 24.10.0
+  rev: 25.9.0
   hooks:
   - id: black
     name: Format code
     args: [--config, pyproject.toml]
 - repo: https://github.com/asottile/blacken-docs
-  rev: 1.19.1
+  rev: 1.20.0
   hooks:
   - id: blacken-docs
     name: Format code in docstrings
     args: [--line-length, '120']
-    additional_dependencies: [black==24.10.0]
+    additional_dependencies: [black==25.9.0]
 
 # Upgrade and rewrite Python idioms.
 - repo: https://github.com/asottile/pyupgrade
-  rev: v3.19.0
+  rev: v3.20.0
   hooks:
   - id: pyupgrade
     name: Upgrade code idioms
@@ -57,13 +57,13 @@ repos:
 # Similar to pylint, with a few more/different checks. For more available
 # extensions: https://github.com/DmytroLitvinov/awesome-flake8-extensions
 - repo: https://github.com/pycqa/flake8
-  rev: 7.1.1
+  rev: 7.3.0
   hooks:
   - id: flake8
     name: Check flake8 issues
     files: ^src/package/|^tests/
     types: [text, python]
-    additional_dependencies: [flake8-bugbear==24.10.31, flake8-builtins==2.5.0, flake8-comprehensions==3.16.0, flake8-docstrings==1.7.0, flake8-logging==1.7.0, flake8-mutable==1.2.0, flake8-noqa==1.4.0, flake8-print==5.0.0, flake8-pyi==24.9.0, flake8-pytest-style==2.0.0, flake8-rst-docstrings==0.3.0, pep8-naming==0.14.1]
+    additional_dependencies: [flake8-bugbear==24.12.12, flake8-builtins==3.0.0, flake8-comprehensions==3.17.0, flake8-docstrings==1.7.0, flake8-logging==1.8.0, flake8-mutable==1.2.0, flake8-noqa==1.4.0, flake8-print==5.0.0, flake8-pyi==25.5.0, flake8-pytest-style==2.1.0, flake8-rst-docstrings==0.3.1, pep8-naming==0.15.1]
     args: [--config, .flake8]
 
 # Run Pylint from the local repo to make sure venv packages
@@ -91,7 +91,7 @@ repos:
 
 # Check for potential security issues.
 - repo: https://github.com/PyCQA/bandit
-  rev: 1.7.10
+  rev: 1.8.6
   hooks:
   - id: bandit
     name: Check for security issues
@@ -103,7 +103,7 @@ repos:
 # Enable a whole bunch of useful helper hooks, too.
 # See https://pre-commit.com/hooks.html for more hooks.
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v5.0.0
+  rev: v6.0.0
   hooks:
   - id: check-ast
   - id: check-case-conflict
@@ -144,7 +144,7 @@ repos:
 
 # Check and prettify the configuration files.
 - repo: https://github.com/macisamuele/language-formatters-pre-commit-hooks
-  rev: v2.14.0
+  rev: v2.15.0
   hooks:
   - id: pretty-format-ini
     args: [--autofix]
@@ -156,7 +156,7 @@ repos:
 
 # Check GitHub Actions workflow files.
 - repo: https://github.com/Mateusz-Grzelinski/actionlint-py
-  rev: v1.7.4.18
+  rev: v1.7.7.24
   hooks:
   - id: actionlint