build(deps): bump the simple group in /ci/builder with 5 updates

[dependabot]

Bumps the simple group in /ci/builder with 5 updates:

Package	From	To
boto3	1.43.66	1.43.71
jupyterlab	4.6.2	4.6.3
shtab	1.9.3	1.10.0
sqlparse	0.5.5	0.6.0
hatchling	1.31.0	1.32.0

Updates boto3 from 1.43.66 to 1.43.71

Commits

• a0b0f50 Merge branch 'release-1.43.71'
• 3a07077 Bumping version to 1.43.71
• 9886147 Add changelog entries from botocore
• 8c2ae68 Merge branch 'release-1.43.70'
• 116daa7 Merge branch 'release-1.43.70' into develop
• 4901fc8 Bumping version to 1.43.70
• 19c8fcf Add changelog entries from botocore
• e3a9220 Bump https://github.com/astral-sh/ruff-pre-commit (#4827)
• d592501 Merge branch 'release-1.43.69'
• 6e10b02 Merge branch 'release-1.43.69' into develop
• Additional commits viewable in compare view

Updates jupyterlab from 4.6.2 to 4.6.3

Release notes

Sourced from jupyterlab's releases.

v4.6.3

4.6.3

(Full Changelog)

Bugs fixed

• Fix Shift-click cell selection after editor text selection #19243 (@​MUFFANUJ)
• Fix active cell prompt and source blink in notebook tools & prevent a memory leak #19168 (@​MUFFANUJ)
• Update the item positions when an item is removed from reactive toolbar #19227 (@​brichet)
• Fix variable inspection, document autocomplete and variable inspect/render #19234 (@​krassowski)
• Show "starting" rather than "idle" status when changing kernel via SessionContext.changeKernel() #19166 (@​Zsailer)

Maintenance and upkeep improvements

• Update Altair snapshot #19204 (@​krassowski)
• Switch pre-commit to language: system #19193 (@​krassowski)

Documentation improvements

• Update JEP 91 link to the new MyST docs URL #19212 (@​jtpio)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​brichet (activity) | @​jtpio (activity) | @​krassowski (activity) | @​MUFFANUJ (activity) | @​Zsailer (activity)

Commits

• e7255a9 [ci skip] Publish 4.6.3
• 08c20a1 Backport PR #19243 on branch 4.6.x (Fix Shift-click cell selection after edit...
• 4e08e0d Backport PR #19168 on branch 4.6.x (Fix active cell prompt and source blink i...
• 9653490 Backport PR #19227 on branch 4.6.x (Update the item positions when an item is...
• 243ee01 Backport PR #19234 on branch 4.6.x (Fix variable inspection, document autocom...
• 9b7efed Backport PR #19166 on branch 4.6.x (Show "starting" rather than "idle" status...
• edc8390 Backport PR #19212 on branch 4.6.x (Update JEP 91 link to the new MyST docs U...
• 4cffbed Backport PR #19204 on branch 4.6.x (Update Altair snapshot) (#19205)
• 7d0f5b6 Backport PR #19193 on branch 4.6.x (Switch pre-commit to language: system) ...
• See full diff in compare view

Updates shtab from 1.9.3 to 1.10.0

Release notes

Sourced from shtab's releases.

shtab v1.10.0 stable

• 🥳 add shtab.glob & shtab.cmd (e.g. glob("*.y*ml", "*.toml") & cmd("git branch")) (#226, #242 <- #240)
  • soft-deprecate complete(preamble: dict)
• ▶️ improve bash redirection (e.g. >&2) detection (#211)
• 🧑‍💻 improve tcsh (sub)command completions (#247, #241 <- #236)
• 📂 fish: support shtab.FILE outside current directory (#246 <- #245)
• 🚩 ensure .complete overrides choices (#239)
• 🤦 bash: fix add_argument("--optional", help=SUPPRESS) (#211)
• 🤝 fix bash<4 support (#244 <- #235, #196)
• 🎏 test fish<4 flags (#239)
• 🍴 tests: minimise tcsh pty forks (#247)
• 🔍 test & fix typos (#100, #188)
• 🛠️ misc docs, linting, testing & framework updates (#226, #249)

Commits

• 60f5bf9 Merge pull request #211 from pmhahn/fixes
• fbe86db bash: fix optional.help == SUPPRESS
• 720f057 bash: Fix detection of redirection
• 20125a6 Fix Action == SUPPRESS
• 24aab69 docs: refactor & update guidance
• d496d6c Merge pull request #249 from tqdm/test-tidy
• 87c0373 misc tidy
• abfd6ed Merge pull request #247 from ThomasWaldmann/tcsh-anchor-positionals
• 815b587 minor tidy
• 8d91a55 tests: minimise tcsh pty forks
• Additional commits viewable in compare view

Updates sqlparse from 0.5.5 to 0.6.0

Changelog

Sourced from sqlparse's changelog.

Release 0.6.0 (Aug 13, 2026)

Notable Changes

• Drop support for Python 3.8 and 3.9. Python 3.10+ is now required.
• IMPORTANT: Fixes a potential denial of service attack (DOS) in the lexer, which consumed CPU quadratically on statements containing many unclosed dollar-quoted literals or multiline comments (CVE-2026-59893). See the security advisory for details: GHSA-prg7-hcfm-mfcr The vulnerability was discovered by EQSTLab, min8282 and 7thpark. Thanks for reporting!
• IMPORTANT: Fixes a potential denial of service attack (DOS) when grouping deeply nested or very wide statements. Building a token group re-read the whole group on every step, so a small statement could keep a worker busy for a long time (CVE-2026-54284, pr848 by alhudz and tonghuaroot).
• IMPORTANT: Fixes a potential denial of service attack (DOS) in format(sql, reindent=True), which consumed CPU quadratically on long lists of tuples. See the security advisory for details: GHSA-cfqr-cjx5-5jcm
• IMPORTANT: Fixes a potential denial of service attack (DOS) on statements that consist only of comments (CVE-2026-71491). See the security advisory for details: GHSA-f2ff-p2ww-7p4p The vulnerability was discovered by @​sanktjodel. Thanks for reporting!
• IMPORTANT: Backslashes are now escaped in the python and php output formats. Without escaping, SQL containing a backslash could break out of the generated string literal (CVE-2026-59894). See the security advisory for details: GHSA-3496-9g83-7v6x The vulnerability was discovered by @​7thParkk. Thanks for reporting!

Enhancements

• Modernize type annotations in top-level API functions using PEP 585 and PEP 604 syntax.
• END FOR and END CASE are now recognized as keywords.

Bug Fixes

• Statement splitting was rewritten on a stack-based architecture. This fixes splitting of statements with nested BEGIN ... END blocks (issue845).
• Fix function grouping being skipped in CREATE TABLE ... AS SELECT statements when the as keyword is lowercase (pr867 by Osamaali313).
• Recognize ROW_FORMAT as a keyword so that ALTER TABLE ... ROW_FORMAT=... no longer merges the table name and the option into a single identifier (issue773, pr860 by apoorvdarshan).
• Recognize MATERIALIZED as a keyword so it is parsed and formatted consistently in CREATE MATERIALIZED VIEW statements (issue752, pr854 by

... (truncated)

Commits

• 2f40da9 Update version number.
• 5753f15 Align the changelog entries for this release with previous ones
• b9588d9 Unify the benchmark scripts on a shared harness
• 519e416 Pair comment/dollar-quote delimiters at the lexer position
• a51df6d Measure reindent offsets backwards to avoid quadratic CPU use
• 73d9ccd Update CHANGELOG
• d1d8060 Fix uncontrolled CPU consumption (ReDoS) in the lexer's handling of dollar-qu...
• ef2012a Fix quadratic DoS in group_comments (GHSA-f2ff-p2ww-7p4p)
• 26112dd Update Changelog.
• 53ff44b Escape backslashes in output formatters.
• Additional commits viewable in compare view

Updates hatchling from 1.31.0 to 1.32.0

Release notes

Sourced from hatchling's releases.

Hatchling v1.32.0

Changed:

• Bump default core metadata version to 2.5

• Add tomlkit as a runtime dependency, which is required to rewrite pyproject.toml when setting a static version

Added:

• The version command can now set a version that is statically defined by the project.version field, updating pyproject.toml in place. Pass --force to allow an explicit downgrade

Fixed:

• Allow the ; private annotation on project.import-names and project.import-namespaces entries rather than rejecting them as invalid import names.

• Reject project.readme paths that are absolute or resolve outside of the project directory.

Commits

• 558061c Fix ci (#2377)
• bc6d1bc release Hatch v1.18.0 (#2376)
• 8429e5d release Hatchling v1.32.0 (#2375)
• 413b3a8 Prepare for release (#2374)
• 4ccc9ea Bug Fix - fix CTRL-C behavior to correctly handle signals (#2369)
• a885803 Add sources to enable other types of local dependencies (#2313)
• ab3e000 Add --all flag to hatch build for building all workspace members (#2352)
• bb90277 fix: Allow the ; private annotation in import-names/import-namespaces p...
• 3a9d853 fix: prevent backward relative paths in readme (#2354)
• c4dc4f8 test: Fix test expectations for metadata generated by flit-core (#2365)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
boto3	[>= 1.42.dev0, < 1.43]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions