build(deps): bump the python group across 1 directory with 5 updates

[dependabot]

Bumps the python group with 5 updates in the / directory:

Package	From	To
protobuf	7.35.1	7.36.0
pillow	12.2.0	12.3.0
pymupdf	1.27.2.3	1.28.2
lxml	6.1.1	6.1.2
orjson	3.11.9	3.12.0

Updates protobuf from 7.35.1 to 7.36.0

Commits

• See full diff in compare view

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

• Remove non-image ImageCms modes #9697 [@​radarhere]

Documentation

• Add release notes for SBOM and performance improvements #9747 [@​radarhere]
• Add security release notes #9741 [@​radarhere]
• Add release notes for Python 3.15 beta wheels #9696 [@​radarhere]
• ImageFont can also be used with ImageText #9597 [@​radarhere]
• Additional guidelines for security reports #9659 [@​wiredfool]
• Fixed typo #9636 [@​radarhere]
• Added CVEs to 12.2.0 release notes #9591 [@​radarhere]
• Revise development support information in README #9583 [@​aclark4life]
• Add INCIDENT_RESPONSE.md #9555 [@​aclark4life]
• Add STRIDE threat model to security docs #9562 [@​aclark4life]
• Add CVEs to 12.2.0 release notes #9556 [@​radarhere]
• Update README with revised security policy #9553 [@​radarhere]
• Update security policy #9552 [@​aclark4life]
• Update macOS tested Python versions #9534 [@​radarhere]

Dependencies

• Update dependency harfbuzz to v14.2.1 #9720 [@renovate[bot]]
• Update dependency mypy to v2 #9653 [@renovate[bot]]
• Update dependency cibuildwheel to v4 #9665 [@renovate[bot]]
• Update github-actions #9655 [@renovate[bot]]
• Update dependency libavif to v1.4.2 #9652 [@renovate[bot]]
• Update dependency lcms2 to v2.19.1 #9651 [@renovate[bot]]
• Update dependency check-jsonschema to v0.37.2 #9650 [@renovate[bot]]
• Update google/oss-fuzz digest to d872252 #9614 [@renovate[bot]]
• Update dependency lcms2 to v2.19 #9609 [@renovate[bot]]
• Update dependency libpng to v1.6.58 - autoclosed #9608 [@renovate[bot]]
• Update dependency harfbuzz to v14 #9610 [@renovate[bot]]
• Update dependency mypy to v1.20.2 #9599 [@renovate[bot]]
• Update github-actions #9611 [@renovate[bot]]
• Update dependency cibuildwheel to v3.4.1 #9607 [@renovate[bot]]
• Move dependency versions to single JSON and enable Renovate #9559 [@​hugovk]
• Updated raqm to 0.10.5 #9557 [@​radarhere]
• Update dependency cibuildwheel to v3.4.0 #9532 [@renovate[bot]]

Testing

• Remove matrix.os from benchmark #9735 [@​radarhere]
• Remove references to libavif patch #9734 [@​radarhere]
• Add benchmark tests #9654 [@​akx]
• Use reshape() instead of setting NumPy array shape directly #9728 [@​radarhere]

... (truncated)

Commits

• bb1d8e8 12.3.0 version bump
• e63fc48 Add release notes for SBOM and performance improvements (#9747)
• 13b701b Add release notes for #9679
• 5564ca7 List methods
• a0920fd Speed up ImageChops operations (#9738)
• 07e9a6c Speed up Image.filter() (#9736)
• a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
• 53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
• af03747 Speed up Image.resample() (#9739)
• 5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
• Additional commits viewable in compare view

Updates pymupdf from 1.27.2.3 to 1.28.2

Release notes

Sourced from pymupdf's releases.

PyMuPDF-1.28.2 released

Wheels for Windows, Linux and MacOS, and the sdist, are available on https://pypi.org and can be installed in the usual way, for example:

python -m pip install --upgrade pymupdf

Changes in version 1.28.2 ()

Fixed issues:

• Fixed #4670
• Fixed #4943
• Fixed #5030
• Fixed #5042
• Fixed #5044
• Fixed #5049

Other:

• Use MuPDF-1.28.2.
• Output warning when legacy fitz module is imported.
• Cope better with markdown containing illegal utf8 sequences.
• Fixed building with PYMUPDF_SETUP_MUPDF_VS_UPGRADE.
• pymupdf.Page.find_tables():
  • new args use_layout: bool = True union: bool = False refine: bool = False.
  • Improved speed.
• Retrospectively added fix for #4936 in release 1.28.0 below.

PyMuPDF-1.28.0 released.

Wheels for Windows, Linux and MacOS, and the sdist, are available on https://pypi.org and can be installed in the usual way, for example:

python -m pip install --upgrade pymupdf

Changes in version 1.28.0

Fixed issues:

• Fixed #4114
• Fixed #4950
• Fixed #5001
• Fixed #5033

Other:

... (truncated)

Changelog

Sourced from pymupdf's changelog.

Change Log

Changes in version 1.28.2 (2026-08-06)

Fixed issues:

• Fixed 4670 <https://github.com/pymupdf/PyMuPDF/issues/4670>_: scrub fails to remove hidden text after clean_contents stopped including line breaks (\u2265 1.24.0)
• Fixed 4943 <https://github.com/pymupdf/PyMuPDF/issues/4943>_: enh: applying redactions with image cropping for currently unsupported colorspaces
• Fixed 5030 <https://github.com/pymupdf/PyMuPDF/issues/5030>_: find_tables() with layout enabled can return a zero-cell Table, and Table.bbox then raises "ValueError: min() iterable argument is empty"
• Fixed 5042 <https://github.com/pymupdf/PyMuPDF/issues/5042>_: Page.get_texttrace() leaks None references \u2014 Fatal Python error (none_dealloc) in long-running processes (1.27.2.3 & 1.28.0)
• Fixed 5044 <https://github.com/pymupdf/PyMuPDF/issues/5044>_: Outline (TOC) parsing bug
• Fixed 5049 <https://github.com/pymupdf/PyMuPDF/issues/5049>_: font subsetting segfaults in 1.28.0, regression from 1.27.2.2 #5049
• Fixed 5056 <https://github.com/pymupdf/PyMuPDF/issues/5056>_: Option for reproducible/deterministic save output (omit MuPDF version banner + Producer)

Other:

• Use MuPDF-1.28.2.
• Output warning when legacy fitz module is imported.
• Cope better with markdown containing illegal utf8 sequences.
• Fixed building with PYMUPDF_SETUP_MUPDF_VS_UPGRADE.
• pymupdf.Page.find_tables():
  • new args use_layout: bool = True union: bool = False refine: bool = False.
  • Improved speed.
• Retrospectively added fix for #4936 in release 1.28.0 below.
• Added windows-arm64 wheel.

Changes in version 1.28.0 (2026-06-29)

Fixed issues:

• Fixed 4114 <https://github.com/pymupdf/PyMuPDF/issues/4114>_: ComboBox choice_values full of empty strings despite PDF having valid choices.
• Fixed 4950 <https://github.com/pymupdf/PyMuPDF/issues/4950>_: remove_rotation() raises ValueError on widgets with empty/infinite rects
• Fixed 5001 <https://github.com/pymupdf/PyMuPDF/issues/5001>_: Formulae incorrectly rendered as black boxes
• Fixed 5033 <https://github.com/pymupdf/PyMuPDF/issues/5033>_: Annot.set_rotation(0) followed by Annot.update() throws AttributeError
• Fixed 4936 <https://github.com/pymupdf/PyMuPDF/issues/4936>_: bug: incomplete redaction of vector graphics (line art)

Other:

• Use MuPDF-1.28.0.
• pymupdf.Document.init(): new arg archive to support documents with archives.
• pymupdf.Document.convert_to_pdf(): also generate links.
• Fixed MacOS x64 platform tag - used to be macosx_10_9_x86_64, but we actually require MacOS 10.15, so platform tag is now macosx_10_15_x86_64.
• Support Windows builds with free thread python.
• pymupdf.Document.save() now saves non-PDF documents in PDF format.
• New method pymupdf.Document.apply_css().

... (truncated)

Commits

• 12786d1 tests/test_general.py:test_5054(): expect success after recent fix in mupdf m...
• 6adaca9 src/init.py:JM_get_font(): cope with mupdf master fz_lookup_noto_font()'s...
• 59525c7 changes.txt: updates for 1.28.2.
• 948bfba tests/test_pynone.py: renamed test to test_5042() to match github issue.
• 48b26ea .github/ISSUE_TEMPLATE/bug_report.yml: added 1.28.2.
• 6f98b39 setup.py: increment version to 1.28.2.
• 32eacbf tests/test_font.py:test_5049(): don't overwrite input file.
• 1ef7703 setup.py: misc cleanups.
• eb32057 tests/: added test_5054().
• c47e4c1 Add test for fixing #5056
• Additional commits viewable in compare view

Updates lxml from 6.1.1 to 6.1.2

Changelog

Sourced from lxml's changelog.

6.1.2 (2026-08-18)

• GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

• Some minor corrections for error handling cases.

Other changes

• Built with Cython 3.2.9.

Commits

• f2874e9 Update release date.
• 687a295 Build: Exclude Py3.8 from windows-arm builds.
• acadc56 Build: Remove outdated build target.
• 59f93eb Build: Split old-Linux and other-Py3.8 builds.
• 923df83 Build: Fix manylinux2014 build.
• 975cc83 Build: Fix Px3.8 build setup.
• 09e5d3e Build: Fix cibuildwheel version.
• 998cf50 Build: Build Py3.8 wheels only once, not in every build job.
• 5567037 Build: Exclude Py3.15 from 32bit builds.
• 904db40 Build: Update cibuildwheel to include Py3.15.
• Additional commits viewable in compare view

Updates orjson from 3.11.9 to 3.12.0

Release notes

Sourced from orjson's releases.

3.12.0

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Changelog

Sourced from orjson's changelog.

3.12.0 - 2026-08-14

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Commits

• 6737895 3.12.0
• c2a6e8f JsonWriter, iterators
• 6a2d7a7 yyjson 1ea2fb0
• 97bf170 build update
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions