Bump the monthly-batch group with 2 updates - #60

Sourced from python-hcl2's releases.

v8.1.3

What's Changed

Several fixes below change the values loads() returns for input that already parsed without error in 8.1.x — negative integer literals, both strip_string_quotes behaviours, and the two heredoc body fixes. The previous result was a bug in each case, so this stays a patch release; re-check your expectations if you built around the old values.

Fixed

• Restore py.typed marker so type checkers recognize hcl2 (and cli) as typed packages. (#299)
• Parse heredocs with an empty body again. A marker immediately followed by its closing delimiter failed to match, and the lexer then ran on to a later delimiter, silently absorbing the attributes in between. Thanks, @​livingstaccato (#312)
• Negative integer literals load as numbers again instead of ${-N} expression strings, matching negative floats and the pre-8.x behaviour. Thanks, @​livingstaccato (#311)
• strip_string_quotes no longer unquotes string literals nested inside expressions, which produced invalid HCL such as ${upper(x)} from upper("x"). Thanks, @​livingstaccato (#313)
• strip_string_quotes now resolves escape sequences, so the values it yields match what the option documents. Escapes naming a codepoint outside the Unicode range, or a lone surrogate, are preserved verbatim rather than raising. Thanks, @​livingstaccato (#313)
• Parse files with CRLF (\r\n) line endings, including heredocs. A \r acting as part of a line ending is ignored, so a CRLF file reconstructs with LF endings; a \r that is content — inside a quoted string or a heredoc body — is preserved. Thanks, @​agu2347 (#317)
• Flattened heredoc bodies keep their trailing blank lines and trailing spaces instead of being right-stripped away, for both <<MARKER and <<-MARKER. The closing marker line's own indentation is still removed, and a blank line no longer cancels the <<- dedent. Thanks, @​agu2347 (#318)
• Parse heredocs whose delimiter is a single character, such as <<E. The spec defines the delimiter as an Identifier, which permits one character. (#323)
• preserve_heredocs=False combined with strip_string_quotes now returns the heredoc body as a plain multi-line string instead of escaping every newline to a literal \n. The escaping is still applied to the quoted source form produced without strip_string_quotes. (#324)

Full Changelog: amplify-education/python-hcl2@v8.1.2...v8.1.3

Sourced from python-hcl2's changelog.

[8.1.3] - 2026-08-26

Several fixes below change the values loads() returns for input that already parsed without error in 8.1.x — negative integer literals, both strip_string_quotes behaviours, and the two heredoc body fixes. The previous result was a bug in each case, so this stays a patch release; re-check your expectations if you built around the old values.

Fixed

• Restore py.typed marker so type checkers recognize hcl2 (and cli) as typed packages. (#299)
• Parse heredocs with an empty body again. A marker immediately followed by its closing delimiter failed to match, and the lexer then ran on to a later delimiter, silently absorbing the attributes in between. Thanks, @​livingstaccato (#312)
• Negative integer literals load as numbers again instead of ${-N} expression strings, matching negative floats and the pre-8.x behaviour. Thanks, @​livingstaccato (#311)
• strip_string_quotes no longer unquotes string literals nested inside expressions, which produced invalid HCL such as ${upper(x)} from upper("x"). Thanks, @​livingstaccato (#313)
• strip_string_quotes now resolves escape sequences, so the values it yields match what the option documents. Escapes naming a codepoint outside the Unicode range, or a lone surrogate, are preserved verbatim rather than raising. Thanks, @​livingstaccato (#313)
• Parse files with CRLF (\r\n) line endings, including heredocs. A \r acting as part of a line ending is ignored, so a CRLF file reconstructs with LF endings; a \r that is content — inside a quoted string or a heredoc body — is preserved. Thanks, @​agu2347 (#317)
• Flattened heredoc bodies keep their trailing blank lines and trailing spaces instead of being right-stripped away, for both <<MARKER and <<-MARKER. The closing marker line's own indentation is still removed, and a blank line no longer cancels the <<- dedent. Thanks, @​agu2347 (#318)
• Parse heredocs whose delimiter is a single character, such as <<E. The spec defines the delimiter as an Identifier, which permits one character. (#323)
• preserve_heredocs=False combined with strip_string_quotes now returns the heredoc body as a plain multi-line string instead of escaping every newline to a literal \n. The escaping is still applied to the quoted source form produced without strip_string_quotes. (#324)

• 1874eb7 chore: prepare 8.1.3 release changelog (#325)
• ca51f4b docs: credit contributors in the unreleased changelog entries (#322)
• 06279a0 fix: return heredoc bodies as real multi-line values when unquoting (#303) (#...
• 37c0b8f fix: parse heredocs with a single-character delimiter (#314) (#323)
• e8647d9 chore: sort imports so ruff check passes on main (#320)
• f7531ef chore: union-merge CHANGELOG.md to stop parallel PRs conflicting (#319)
• e0c0207 Fix heredoc bodies losing trailing blank lines/spaces to a greedy rstrip (#318)
• 8973c4c Fix CRLF (\r\n) line endings failing to parse (#317)
• 0015121 fix: make strip_string_quotes yield values, not broken source (#308, #310) (#...
• 205f4ba fix: load negative integer literals as numbers (#307) (#311)
• Additional commits viewable in compare view

Sourced from uv-build's releases.

0.12.6

Release Notes

Released on 2026-08-25.

Python

• Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295)

Enhancements

• Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#21261)
• Limit warnings about unbounded uv_build requirements to source-distribution builds (#21078)
• Display byte counts below 1 KiB without a fractional part (#21237)

Preview features

• Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#21117)
• Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#21235)
• Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#21227)
• Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#21146)

Performance

• Enable profile-guided optimization for Linux x86-64 release binaries (#21001)
• Enable profile-guided optimization for Windows x86-64 release binaries (#21003)
• Enable profile-guided optimization for macOS ARM64 release binaries (#21002)
• Enable profile-guided optimization for Linux ARM64 release binaries (#21004)
• Speed up syncing projects with many activated conflict items by reusing their encoded representation (#21148)

Bug fixes

• Allow explicit uv build and non-editable first-party workspace packages when no-build is enabled (#21294)
• Reuse configured index credentials during uv tool upgrade when the tool receipt references the same index (#21275)
• Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch (#21224)
• Prevent TLS segfaults in riscv64 musl release binaries (#21158)
• Preserve dependencies selected by recursive extras when markers mix production and extra conditions (#21181)
• Preserve version constraints from transitively referenced recursive extras (#21209)
• Resolve repository-relative Git archive dependencies inside the checkout during the initial uv sync (#21264)
• Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header (#21282)
• Do not misclassify package URLs ending in .py as local script paths (#21144)
• Use directory creation times consistently across libc implementations for directory cache-keys entries (#21137)
• Promote human-readable sizes to the next unit at rounding boundaries (#21136)

Other changes

• Add Python 3.15 release-candidate Docker images (#21293)
• Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 (#21258)

Install uv 0.12.6

... (truncated)

Sourced from uv-build's changelog.

0.12.6

Released on 2026-08-25.

Python

• Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295)

Enhancements

• Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#21261)
• Limit warnings about unbounded uv_build requirements to source-distribution builds (#21078)
• Display byte counts below 1 KiB without a fractional part (#21237)

Preview features

• Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#21117)
• Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#21235)
• Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#21227)
• Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#21146)

Performance

• Enable profile-guided optimization for Linux x86-64 release binaries (#21001)
• Enable profile-guided optimization for Windows x86-64 release binaries (#21003)
• Enable profile-guided optimization for macOS ARM64 release binaries (#21002)
• Enable profile-guided optimization for Linux ARM64 release binaries (#21004)
• Speed up syncing projects with many activated conflict items by reusing their encoded representation (#21148)

Bug fixes

• Allow explicit uv build and non-editable first-party workspace packages when no-build is enabled (#21294)
• Reuse configured index credentials during uv tool upgrade when the tool receipt references the same index (#21275)
• Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch (#21224)
• Prevent TLS segfaults in riscv64 musl release binaries (#21158)
• Preserve dependencies selected by recursive extras when markers mix production and extra conditions (#21181)
• Preserve version constraints from transitively referenced recursive extras (#21209)
• Resolve repository-relative Git archive dependencies inside the checkout during the initial uv sync (#21264)
• Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header (#21282)
• Do not misclassify package URLs ending in .py as local script paths (#21144)
• Use directory creation times consistently across libc implementations for directory cache-keys entries (#21137)
• Promote human-readable sizes to the next unit at rounding boundaries (#21136)

Other changes

• Add Python 3.15 release-candidate Docker images (#21293)
• Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 (#21258)

0.12.5

Released on 2026-08-14.

... (truncated)

• 7938ca5 Fix release binary workflow permissions (#21298)
• 6cffb32 Bump version to 0.12.6 (#21297)
• fab2c0c Improve basic space accounting when reporting cache clean space savings (#21261)
• 64c73b1 Reuse configured index credentials during tool upgrades (#21275)
• 45e75a4 feat(docker): add 3.15 rc images to uv docker (#21293)
• e436b76 Allow first-party builds with no-build (#21294)
• ba1f8c1 Sync latest Python releases (#21295)
• a61e5c9 Require bot:promote for uv-security PR promotion (#21286)
• 2e7d28b Limit CI planner checkout depth (#21291)
• 60a38ed Separate hash generation policy from verification policy (#21247)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions