[dependabot]

Bumps the pre-commit group with 2 updates: https://github.com/adamchainz/django-upgrade and https://github.com/tox-dev/pyproject-fmt.

Updates https://github.com/adamchainz/django-upgrade from 1.32.0 to 1.33.0

Changelog

Sourced from https://github.com/adamchainz/django-upgrade's changelog.

1.33.0 (2026-10-02)

• Reduce garbage collection frequency while fixing files, yielding a performance improvement of 2-7%, depending on Python version. Measured on the source code of Django, Saleor, Wagtail, and Zulip, with no changes to make, the median speedups were ~7% on Python 3.11, ~3% on Python 3.13, and ~2% on Python 3.14, with no change in peak memory usage.

  PR [#735](https://github.com/adamchainz/django-upgrade/issues/735) <https://github.com/adamchainz/django-upgrade/pull/735>__.

• Speed up the AST traversal by skipping fields that never contain nodes for fixers, such as expression contexts, yielding a further performance improvement of 3-7% on the same projects.

  PR [#736](https://github.com/adamchainz/django-upgrade/issues/736) <https://github.com/adamchainz/django-upgrade/pull/736>__.

• Only call fixers for function calls, names, and attributes with names they handle, yielding a further performance improvement of 23-29% on the same projects. Combined with the above changes, django-upgrade is now 27-38% faster on these projects.

  PR [#737](https://github.com/adamchainz/django-upgrade/issues/737) <https://github.com/adamchainz/django-upgrade/pull/737>__.

Commits

• 5ccd385 Version 1.33.0
• 1d134cf Add links to changelog notes
• 8dc2dba Dispatch fixer callbacks by name (#737)
• 7c4ff49 Speed up AST traversal in visit() (#736)
• f2edbc3 Reduce garbage collection frequency while fixing (#735)
• 4580ebd Upgrade dependencies (#734)
• 0c01d57 [pre-commit.ci] pre-commit autoupdate (#732)
• 592d367 Upgrade dependencies (#731)
• See full diff in compare view

Updates https://github.com/tox-dev/pyproject-fmt from v2.29.4 to 2.30.1

Release notes

Sourced from https://github.com/tox-dev/pyproject-fmt's releases.

v2.30.1

What's Changed

• 👷 ci: pin ubuntu-26.04 and bump dependencies by @​gaborbernat in tox-dev/pyproject-fmt#368

Full Changelog: tox-dev/pyproject-fmt@v2.30.0...v2.30.1

v2.30.0

Full Changelog: tox-dev/pyproject-fmt@v2.29.4...v2.30.0

Commits

• a72ae8e Mirror: 2.30.1
• 89380d9 Mirror: 2.30.1
• 90994db 👷 ci: pin ubuntu-26.04 and bump dependencies (#368)
• 831e544 Mirror: 2.30.0
• dd522cc Mirror: 2.30.0
• 89eb24d Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#367)
• 7c04e1e [pre-commit.ci] pre-commit autoupdate (#366)
• a7c3fab Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-actions group (#365)
• 23684c7 [pre-commit.ci] pre-commit autoupdate (#364)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[hleroy]

SAFE TO MERGE

Checks: ci / tests ✅ · conventional-title ✅ · GitGuardian Security Checks ✅ · MERGEABLE / CLEAN
Release age: django-upgrade 1.33.0 published 2026-10-02 (15 days) · pyproject-fmt 2.30.1 published 2026-10-04 (13 days). Both are past the 7-day cooldown:; neither is fresh, neither is a security update. Neither is yanked; OSV reports 0 advisories against either.

Package	Old → New	Type	Finding
django-upgrade	1.32.0 → 1.33.0	minor	Performance only — reduced GC frequency while fixing files (PR #735), AST traversal skipping fields that never hold nodes (PR #736), and fixer dispatch by name so a fixer is only called for calls/names/attributes it handles (PR #737). Combined ~27-38% faster. No new fixer, no changed rewrite, no dropped Python version (dropping 3.10 is on main, not in 1.33.0).
pyproject-fmt	v2.29.4 → 2.30.1	minor	Thin to the point of absent — the v2.30.0 GitHub release carries no notes at all (just a compare link) and v2.30.1 is a single CI commit ("pin ubuntu-26.04 and bump dependencies"). No changelog exists in the mirror repo or in the tox-dev/toml-fmt monorepo. Resolved by artifact diff + a behavioral test instead; see below.

Impact on this codebase: both of these are pre-commit-only developer tooling — .github/workflows/tests.yml runs ruff check, makemigrations --check and pytest, and never invokes pre-commit, so neither package reaches CI or the runtime image. I did not rely on CI for either; instead I ran both versions of each tool against this repo's real files and diffed the output.

• django-upgrade — ran 1.32.0 and 1.33.0 (--target-version 6.0, matching the hook's args) over copies of radar/ and config/. Output is byte-identical between the two versions, and neither version rewrites a single file. The PR #737 dispatch optimisation is the only change that could in principle alter which fixers fire; empirically it does not, on this codebase.
• pyproject-fmt — unpacked both wheels from PyPI (2.29.4 sha256:c285ab2e…, 2.30.1 sha256:9a4042c9…). The only Python-side change is _MIN_SUPPORTED_PYTHON 3.10 → 3.11 in __main__.py; Requires-Dist / Requires-Python are identical (no new supplier) and no files were added or removed. That floor is irrelevant here — .pre-commit-config.yaml sets default_language_version: python3.14. The substantive formatting logic lives in a compiled Rust extension (_lib.abi3.so), which I cannot read a diff of — stating that plainly. I resolved it behaviorally instead: ran both versions against a copy of this repo's pyproject.toml (the hook's files: pattern is (^|/)pyproject\.toml$, and this repo has exactly one). The two outputs are byte-identical, and neither version rewrites the committed file.
• Supply chain of the hook itself — tox-dev/pyproject-fmt is a pre-commit mirror. Its setup.py at tag v2.30.1 is a placeholder pinning install_requires=['pyproject-fmt==2.30.1'], so the hook installs exactly the PyPI artifact I tested. .pre-commit-hooks.yaml is byte-identical between v2.29.4 and v2.30.1 (same entry, same files regex, same empty args and additional_dependencies).

Invariants considered: pre-commit hooks — the named risks are conventional-pre-commit keeping the same type list as pr-title.yml and gitleaks honouring .gitleaks.toml; neither hook is touched by this PR (conventional-pre-commit stays v4.4.0, gitleaks stays v8.30.1, and the args: type list is unchanged). Ruff — not in this PR; the ruff-pre-commit rev is untouched here and is handled separately in #46. Python 3.14 / PEP 758 — both tools still support 3.14 (django-upgrade 1.32.0 added 3.15 support; pyproject-fmt's floor only rose to 3.11), and nothing moves the interpreter. No runtime, provider, lightning, alerts, storage or canonical-origin invariant is in scope — these tools never run in the app.

Verdict rationale: Two minor bumps in local developer tooling, both past cooldown, neither fresh nor security-driven. django-upgrade's changelog is explicit that 1.33.0 is pure performance work, and an empirical run confirms identical output. pyproject-fmt's release notes are effectively empty, so per the rubric I went to the artifact — the Python side is fully resolved, the Rust core is opaque, and I closed that gap with a direct behavioral test on the only file the hook is configured to touch. Both tools leave this repo's files unchanged at both old and new versions, so there is no formatting churn waiting to land on the next local commit. The evidence here is empirical rather than documentary for pyproject-fmt — flagging that explicitly so the call can be audited.

_{Automated weekly Dependabot triage.}

---

Generated by Claude Code