Update Python dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
gunicorn (changelog)	==25.1.0 → ==25.3.0
tombi	==0.9.9 → ==0.9.11
zensical (changelog)	==0.0.28 → ==0.0.30

---

Release Notes

benoitc/gunicorn (gunicorn)

v25.3.0: Gunicorn 25.3.0

Compare Source

Bug Fixes

• HTTP/2 ASGI Body Duplication: Fix request body being received twice in HTTP/2
  ASGI requests, causing JSON parsing errors with "Extra data" messages
  (#​3558)

• ASGI Chunked EOF Handling: Add finish() method to callback parser to handle
  chunked encoding edge case where connection closes before final CRLF after zero-chunk

• HTTP/2 Documentation: Fix http_protocols examples to use comma-separated string
  instead of list syntax (#​3561)

• Chunked Encoding: Reject chunk extensions containing bare CR bytes per RFC 9112
  (#​3556)

• Request Line Limit: Fix --limit-request-line 0 to mean unlimited as documented,
  instead of using default maximum. Works with both Python and fast C parser.
  (#​3563)

Security

• ASGI Parser Header Validation: Add security checks per RFC 9110/9112:
  • Reject duplicate Content-Length headers
  • Reject requests with both Content-Length and Transfer-Encoding
  • Reject chunked transfer encoding in HTTP/1.0
  • Reject stacked chunked encoding
  • Validate Transfer-Encoding values
  • Strict chunk size validation

Changes

• Fast HTTP Parser: Update to gunicorn_h1c >= 0.6.3 for asgi_headers property
  and InvalidChunkExtension validation for bare CR rejection

• ASGI PROXY Protocol: Add PROXY protocol v1/v2 support to callback parser

• Docker Images: Update to Python 3.14

v25.2.0: Gunicorn 25.2.0

Compare Source

New Features

• Fast HTTP Parser (gunicorn_h1c 0.4.1): Integrate new exception types and limit parameters from gunicorn_h1c 0.4.1 for both WSGI and ASGI workers
  • Requires gunicorn_h1c >= 0.4.1 for http_parser='fast'
  • Falls back to Python parser in auto mode if version not met
  • Proper HTTP status codes for limit errors (414, 431)

Bug Fixes

• uWSGI Async Workers: Fix InvalidUWSGIHeader: incomplete header error when using gevent or gthread workers with uwsgi protocol behind nginx. (#​3552, PR #​3554)

• FileWrapper Iterator Protocol: Add __iter__ and __next__ methods to FileWrapper for full PEP 3333 compliance. (#​3396, PR #​3550)

Performance

• ASGI HTTP Parser Optimizations: Improve ASGI worker HTTP parsing performance
  • Callback-based parsing with direct bytearray buffer operations
  • Use bytearray.find() directly instead of converting to bytes first
  • Use index-based iteration for header parsing instead of list.pop(0) (O(1) vs O(n))

tombi-toml/tombi (tombi)

v0.9.11

Compare Source

What's Changed

We released inlay hint

🚀 New Features

• Add hover configuration to extension features by @​ya70https://github.com/tombi-toml/tombi/pull/1641l/1641
• Add extension did_open registry prefetch by @​ya70https://github.com/tombi-toml/tombi/pull/1643l/1643
• Add lockfile-based dependency inlay hints by @​ya70https://github.com/tombi-toml/tombi/pull/1645l/1645
• Limit Cargo hover metadata to crate keys by @​ya70https://github.com/tombi-toml/tombi/pull/1646l/1646
• Add workspace package inlay hints by @​ya70https://github.com/tombi-toml/tombi/pull/1647l/1647
• Cache lockfiles for inlay hints by @​ya70https://github.com/tombi-toml/tombi/pull/1651l/1651
• Add uv dependency version hints by @​ya70https://github.com/tombi-toml/tombi/pull/1653l/1653

🛠️ Other Changes

• docs: update v0.9.10 extension docs by @​ya70https://github.com/tombi-toml/tombi/pull/1640l/1640
• docs: add schema deprecated lint docs by @​ya70https://github.com/tombi-toml/tombi/pull/1642l/1642
• Fix cache path for non-JSON remote URLs by @​ya70https://github.com/tombi-toml/tombi/pull/1644l/1644
• Merge workspace default features when inheriting deps by @​ya70https://github.com/tombi-toml/tombi/pull/1648l/1648
• Remove deprecated Kiro instructions from AGENTS.md by @​ya70https://github.com/tombi-toml/tombi/pull/1650l/1650
• Refactor inlay hint test fixtures by @​ya70https://github.com/tombi-toml/tombi/pull/1649l/1649
• Rename cargo workspace-value config by @​ya70https://github.com/tombi-toml/tombi/pull/1652l/1652

Full Changelog: tombi-toml/tombi@v0.9.10...v0.9.11

v0.9.10

Compare Source

What's Changed

👒 Dependencies

• chore(deps): bump rustls-webpki from 0.103.4 to 0.103.10 in the cargo group across 1 directory by @​dependabot[bot] in #​1613

🛠️ Other Changes

• docs: clarify file:// hostname resolution in #:schema by @​ya7010 in #​1611
• fix: unify docs code block font size on mobile by @​ya7010 in #​1612
• fix: clarify Tombi's formatting policy regarding user data preservation by @​ya7010 in #​1615
• fix: add warning about goto type definition requests in Zed extension documentation by @​ya7010 in #​1616
• fix: add const: true to workspace and optional boolean fields in cargo schema by @​ya7010 in #​1625
• Complete singleton value key completions by @​ya7010 in #​1626
• Add Cargo workspace inheritance completion by @​ya7010 in #​1627
• Add dependency hover metadata by @​ya7010 in #​1628
• Add extension feature config by @​ya7010 in #​1630
• Refactor cargo/uv extension TOML helpers by @​ya7010 in #​1631
• Rename uv extension to pyproject by @​ya7010 in #​1633
• Add schema-level deprecated lint config by @​ya7010 in #​1632
• Cache remote package metadata by @​ya7010 in #​1634
• Cache Cargo completion metadata by @​ya7010 in #​1635
• stype: workspace member declarations and adjust formatting in Cargo.toml files by @​ya7010 in #​1639

Full Changelog: tombi-toml/tombi@v0.9.9...v0.9.10

zensical/zensical (zensical)

v0.0.30: 0.0.30

Compare Source

Summary

This version adds support for mike, a tool for managing multiple versions of MkDocs projects on GitHub Pages. We created a tailored fork of mike for Zensical – all mike commands should work as expected. Please refer to our documentation for setup instructions, and mike's documentation for advanced usage patterns and options.

Note that this is a temporary solution. Zensical will ship native support for versioning in the near future, which will remove the GitHub Pages constraint and offer more flexibility in how versions are deployed and served.

The user interface is updated to v0.0.11, which adds a floating table of contents menu for mobile to the modern theme. The toggle sits at the bottom of the screen for easy thumb access, and the sidebar scrolls to accommodate arbitrarily long tables of contents. This release also includes several improvements: snappier sidebar animations, better tooltip readability, and improved inline code block sizing.

Changelog

Features

• 77a08d9 compat – add support for mike

Bug fixes

• 97cdbc8 ui – update ui to v0.0.11
• 25e8c53 compat – validate docs-directory and custom-theme-directory (#​475)

v0.0.29: 0.0.29

Compare Source

Summary

This version fixes an issue with absolute paths in links, as well as changed files not being picked up by Zensical on Windows 11.

Changelog

Bug fixes

• c1860ca compat – leave absolute links untouched (#​466)
• 6775b75 zensical – canonicalize watched paths (#​451)

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.