build(deps): bump the lockfile-minor-and-patch group across 1 directory with 15 updates

[dependabot]

Bumps the lockfile-minor-and-patch group with 15 updates in the / directory:

Package	From	To
fastjsonschema	2.21.2	2.22.2
fonttools	4.64.0	4.65.0
iniconfig	2.3.0	2.3.1
mistune	3.3.3	3.3.4
nest-asyncio2	1.7.3	1.7.4
packaging	26.2	26.3
pluggy	1.6.0	1.7.0
prompt-toolkit	3.0.52	3.0.53
pure-eval	0.2.3	0.2.4
pygments	2.20.0	2.21.0
pyreadstat	1.3.4	1.3.6
pyzmq	27.1.0	27.2.0
traitlets	5.15.1	5.16.1
webencodings	0.5.1	0.6.1
xlrd	2.0.1	2.0.2

Updates fastjsonschema from 2.21.2 to 2.22.2

Changelog

Sourced from fastjsonschema's changelog.

=== 2.22.2 (2026-08-15)

• Fixed wrong results of anyOf, oneOf, not, if/then/else, contains and propertyNames when fast_fail is off
• Fixed collecting errors from subschemas behind $ref when fast_fail is off
• Fixed escaping property name in boolean dependencies validation (prevents schema-controlled code injection)

=== 2.22.1 (2026-07-27)

• Fixed min Python version

=== 2.22.0 (2026-07-25)

• Fixed IPv4 validation (rejecting leading zeros)
• Fixed empty items and patternProperties
• Fixed protection from deeply nested schemas potentially causing denial of service
• Fixed comparing values for enum and const validations
• Fixed resolving plain-name ref fragments
• Fixed not throwing when unknown format is used
• Fixed compilation of not, if/then/else, items, additionalItems, propertyNames and schema dependencies when a subschema generates no validation code
• Added option to get all the errors (set fast_fail to False)
• Added basic type hints
• Added support of duration and uuid formats from draft-2019

Commits

• b88fa37 v2.22.2
• a491757 Fixed escaping property name in boolean dependencies validation
• 1224dc4 Merge pull request #214 from gaoflow/fix-fast-fail-composition
• 8332f11 Fixed compositions returning wrong results when fast_fail is off
• f8ea717 Merge pull request #210 from Sanjays2402/fix/length-variable-scope-157
• c13e524 Merge pull request #212 from Sanjays2402/fix/non-finite-float-defaults
• 8a7cde9 v2.22.1
• e1cf85b Merge pull request #213 from casperdcl/fix-pyver
• 87960c8 fix min python version
• a4b963e Generate non-finite float defaults as valid Python source
• Additional commits viewable in compare view

Updates fonttools from 4.64.0 to 4.65.0

Release notes

Sourced from fonttools's releases.

4.65.0

• [glyf] Add __iter__, items and values methods to the glyf table to make it more dict-like (#4156).
• [feaLib] Escape the anonymous block tag when scanning for its terminator, so tags containing regex metacharacters are matched literally (#4167).
• [varLib] Strip directory components from <variable-font name="..."/> when deriving the output filename in the varLib command line, so a designspace cannot write outside the output directory (#4168).
• [feaLib] Fix tracking of the current script and language across redundant script statements. Rules following a script statement that names the first declared language system no longer end up under the DFLT script, and a script statement naming the already-current script still narrows the language systems and terminates the current lookup while leaving the lookupflag alone, matching makeotf (#1824, #2522, #4169).
• [varLib.interpolatable] Escape glyph names in the HTML report (#4172).
• [otlLib] Fix overflow handling when building contextual lookups: offset overflows now raise OTLOffsetOverflowError instead of AttributeError so another contextual format can be tried (regression from #3439). When all formats overflow, split the ruleset in halves until it fits (#4171).

Changelog

Sourced from fonttools's changelog.

4.65.0 (released 2026-09-10)

• [glyf] Add __iter__, items and values methods to the glyf table to make it more dict-like (#4156).
• [feaLib] Escape the anonymous block tag when scanning for its terminator, so tags containing regex metacharacters are matched literally (#4167).
• [varLib] Strip directory components from <variable-font name="..."/> when deriving the output filename in the varLib command line, so a designspace cannot write outside the output directory (#4168).
• [feaLib] Fix tracking of the current script and language across redundant script statements. Rules following a script statement that names the first declared language system no longer end up under the DFLT script, and a script statement naming the already-current script still narrows the language systems and terminates the current lookup while leaving the lookupflag alone, matching makeotf (#1824, #2522, #4169).
• [varLib.interpolatable] Escape glyph names in the HTML report (#4172).
• [otlLib] Fix overflow handling when building contextual lookups: offset overflows now raise OTLOffsetOverflowError instead of AttributeError so another contextual format can be tried (regression from #3439). When all formats overflow, split the ruleset in halves until it fits (#4171).

Commits

• 656f89d Release 4.65.0
• 1643950 Update NEWS.rst [skip ci]
• fd0f083 Merge pull request #4177 from fonttools/sbix-to-otsvg-snippet
• 9c625d4 Merge pull request #4171 from fonttools/fix-contextual-size-overflow
• 5f04c38 Add sbix to OT-SVG conversion snippet
• 48a0cf9 Merge pull request #4172 from insaf021/interpolatable-html-escape
• d30db24 Merge pull request #4169 from cmyr/fealib-script-tracking-afdko
• ac342d7 [varLib.interpolatable] escape glyph name in HTML report
• 2a93de2 Split contextual rulesets when all formats overflow
• e6bb5fe Fix overflow reporting when sizing contextual lookups
• Additional commits viewable in compare view

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

• Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
• A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

• iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

• The README example now uses IniConfig.parse() (#79, thanks @​MbappeWU).
• Fixed the issue tracker link (#74, thanks @​stefan6419846).

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#71
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#72
• Fix link to issues by @​stefan6419846 in pytest-dev/iniconfig#74
• parse_lines: keep values as list of lines, join once by @​RonnyPfannschmidt in pytest-dev/iniconfig#78
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#73
• test: expect sorted all after ruff autofix by @​RonnyPfannschmidt in pytest-dev/iniconfig#80
• docs: use parse API in the README example by @​MbappeWU in pytest-dev/iniconfig#79
• Strip leading UTF-8 BOM when reading INI files by @​Pitchfork-and-Torch in pytest-dev/iniconfig#76
• changelog: add BOM stripping (#76) to 2.3.1 by @​RonnyPfannschmidt in pytest-dev/iniconfig#81

New Contributors

• @​stefan6419846 made their first contribution in pytest-dev/iniconfig#74
• @​MbappeWU made their first contribution in pytest-dev/iniconfig#79
• @​Pitchfork-and-Torch made their first contribution in pytest-dev/iniconfig#76

Full Changelog: pytest-dev/iniconfig@v2.3.0...v2.3.1

Changelog

Sourced from iniconfig's changelog.

2.3.1

• fix quadratic parse time for values with many continuation lines (#78, regarding #77)
• strip a leading UTF-8 BOM when reading INI files, which previously raised ParseError (#76)
• internal: iniconfig._parse.ParsedLine.value is now a list of lines

Commits

• 316fbfa changelog: add BOM stripping (#76) to 2.3.1 (#81)
• d2dcb72 Strip leading UTF-8 BOM when reading INI files (#76)
• 40d8c03 Merge pull request #79 from MbappeWU/codex/docs-parse-inline-comments
• 48359c3 Merge pull request #80 from pytest-dev/claude/fix-iniconfig-test-eukh2n
• b153213 test: expect sorted all after ruff RUF022 autofix
• 4fddfab Merge pull request #73 from pytest-dev/pre-commit-ci-update-config
• 15852c2 [pre-commit.ci] auto fixes from pre-commit.com hooks
• 2e68639 [pre-commit.ci] pre-commit autoupdate
• 23c9e08 docs: use parse API in the README example
• e038536 Merge pull request #78 from RonnyPfannschmidt/claude/dazzling-einstein-h8zq7m
• Additional commits viewable in compare view

Updates mistune from 3.3.3 to 3.3.4

Release notes

Sourced from mistune's releases.

v3.3.4

   🐞 Bug Fixes

• Improve parsing for edge cases  -  by @​lepture (53412)
• Improve inline parser by learning from wenmode  -  by @​lepture (37bb7)
• Prevent deep alt parsing  -  by @​lepture (b77ee)
• def_list: A tab after the ':' marker no longer makes the definition a code block  -  by @​chuenchen309 and Claude Opus 4.8 (7aa49)
• table: Reject a non-delimiter second row instead of eating it  -  by @​chuenchen309 and Claude Opus 4.8 (86f9f)

   🏎 Performance

• Optimize inline edge-case parsing  -  by @​lepture (b4dd3)

    View changes on GitHub

Changelog

Sourced from mistune's changelog.

Version 3.3.4

Released on Jul 22, 2026

• Harden inline parsing against deeply nested and adversarial link, image, emphasis, formatting, math, and reference inputs.
• Improve performance for repeated link suffixes, dense emphasis, unclosed formatting markers, inline spoilers, and adjacent ruby tokens.
• Refactor the inline parser into dedicated emphasis and link modules.
• Escape literal */_ emphasis markers in the Markdown renderer so round-tripping escaped text does not re-introduce emphasis.

Commits

• 69ec2b8 chore: release 3.3.4
• 234aa25 test: more deadline for pypy
• b77ee58 fix: prevent deep alt parsing
• 66b2171 refactor: expose entity boundary helper
• 30ef44b refactor: move link token construction
• 3066209 refactor: require explicit emphasis depth
• 0396492 refactor: split inline parser modules
• 80b3e85 refactor: isolate inline parser state bounds
• 7b0194c test: cover inline performance edge cases
• b4dd328 perf: optimize inline edge-case parsing
• Additional commits viewable in compare view

Updates nest-asyncio2 from 1.7.3 to 1.7.4

Release notes

Sourced from nest-asyncio2's releases.

nest-asyncio2 v1.7.4

• fix: run_until_complete() manage_asyncgens() too (#5, @​ransomr)

  Fix async generator hooks are not called during run() (but only in run_forever()), and can't get finalized.

• fix: manage_asyncgens() broken on Python 3.5 (#5)

  Fix run_forever() is broken on Python 3.5.

Commits

• f29d44f fix: manage_asyncgens() broken on Python 3.5 (#5)
• 26c55b2 fix: run_until_complete() manage_asyncgens() too (#5)
• See full diff in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

• [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

• [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

• [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

  A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

• [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

• [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

• [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

• [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

  As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits

• 4c7f636 Preparing release 1.7.0
• 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
• 628959b docs: remove outdated hookimpl default args paragraph
• 2edab5e Merge pull request #752 from bluetech/register-none-allow
• 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
• 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
• 6a7e84e Add changelog fragment for #776
• d22cfb5 Drop tox from the dev dependency group
• 74cbfa2 Relock pytest and tox that dependabot downgraded
• 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
• Additional commits viewable in compare view

Updates prompt-toolkit from 3.0.52 to 3.0.53

Release notes

Sourced from prompt-toolkit's releases.

3.0.53

Fixes:

• Fix get_word_before_cursor behavior.
• Fix vt100 6x6x6 color cube range and missing grayscale shades (232, 254-255).
• Treat OSError on add_reader as EOFError (macOS kqueue).
• Handle surrogate pairs in FileHistory.store_string.
• Fix FuzzyWordCompleter meta_dict type hint to match WordCompleter.
• Handle ascii decode errors in terminal type decoding of telnet protocol. (thanks: @​SunandM)
• Update return types of dialog shortcuts to include None when cancelled.
• Set missing minimal requirement on wcwidth.

New features:

• Lazy load __version__.
• Allow to specify show_numbers in ChoiceInput.

Added support for Python 3.14, 3.15, and set minimum Python version to 3.10.

Changelog

Sourced from prompt-toolkit's changelog.

3.0.53: 2026-07-26

Fixes:

• Fix get_word_before_cursor behavior.
• Fix vt100 6x6x6 color cube range and missing grayscale shades (232, 254-255).
• Treat OSError on add_reader as EOFError (macOS kqueue).
• Handle surrogate pairs in FileHistory.store_string.
• Fix FuzzyWordCompleter meta_dict type hint to match WordCompleter.
• Handle ascii decode errors in terminal type decoding of telnet protocol.
• Update return types of dialog shortcuts to include None when cancelled.
• Set missing minimal requirement on wcwidth.

New features:

• Lazy load __version__.
• Allow to specify show_numbers in ChoiceInput.

Added support for Python 3.14, 3.15, and set minimum Python version to 3.10.

Commits

• 583b341 Release 3.0.53
• b6fc80c Fix some incorrect rst markups (#2074)
• f4a5a80 Update return types of dialog shortcuts to include None when cancelled
• c6c8930 Handle ascii decode errors in terminal type decoding of telnet protocol. (#2080)
• 25ff042 Typing fix in breakpointhook.
• 236bfb7 Allow to specify show_numbers in ChoiceInput (#2059)
• 8f3212d Fix FuzzyWordCompleter meta_dict type hint to match WordCompleter (#2070)
• 42f2251 Fix: handle surrogate pairs in FileHistory.store_string (#2062)
• 9146317 Fix typo (#2064)
• 1041a42 fix(vt100): treat OSError on add_reader as EOFError (macOS kqueue) (#2065)
• Additional commits viewable in compare view

Updates pure-eval from 0.2.3 to 0.2.4

Commits

• cbb5256 Merge pull request #24 from alexmojaki/alex/3.15
• d70a873 Test and fix python 3.15
• ab0e226 Stop testing 3.7
• 4f42618 test 3.14
• See full diff in compare view

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
  • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits

• a43b45d Get ready for the 2.21.0 release.
• d8f14cb Fix version_added for Purescript.
• 19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
• 9992e09 Merge pull request #3191 from jvoisin/dupes
• bd22577 Fix regexlint warnings after latest update.
• 6a62df1 Release preparation: Update the changelog.
• aabba32 Merge pull request #3221 from jvoisin/alter
• d3441d0 Merge pull request #3225 from jvoisin/caddy
• c593f3f Add a lexer for Caddy
• 0644b53 Simplify single-character regex alternations...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
fair-code	Ready	Preview	Oct 20, 2026 8:25am UTC

[github-actions]

@yakew7 - new PR touching a path you own, please review.

[yakew7]

@dependabot rebase