Update prek dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
astral-sh/ruff-pre-commit	repository	patch	v0.15.4 → v0.15.5	v0.15.6
astral-sh/uv-pre-commit	repository	patch	0.10.7 → 0.10.9	0.10.11 (+1)
igorshubovych/markdownlint-cli	repository	minor	v0.47.0 → v0.48.0
zizmorcore/zizmor-pre-commit	repository	minor	v1.22.0 → v1.23.1

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)

v0.15.5

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.15.5

astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)

v0.10.9

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.10.9

v0.10.8

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.10.8

igorshubovych/markdownlint-cli (igorshubovych/markdownlint-cli)

v0.48.0

Compare Source

• Update all dependencies via Dependabot

zizmorcore/zizmor-pre-commit (zizmorcore/zizmor-pre-commit)

v1.23.1

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.23.1

v1.23.0

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.23.0

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sharkdp]

zizmor fails with:

  warning[: secrets referenced without a dedicated environment
    --> .github/workflows/publish-docs.yml:70:36
     |
  24 |   mkdocs:
     |   ------ this job
  ...
  70 |         run: git clone https://${{ secrets.ASTRAL_DOCS_PAT }}@github.com/astral-sh/docs.git astral-docs
     |                                    ^^^^^^^^^^^^^^^^^^^^^^^ secret is accessed outside of a dedicated environment
     |
     = note: audit confidence → High
     = help: audit documentation → https://docs.zizmor.sh/audits/#secrets-outside-env

ASTRAL_DOCS_PAT is a repo secret. The publish-docs.yml workflow only runs in the context of a release, but I'm not sure if it's fine to move the ASTRAL_DOCS_PAT secret to the release environment? (it's only used in this workflow, though)

FYI @woodruffw

[woodruffw]

Yeah, moving it to the release workflow should be fine!

(I added that new audit in the latest version of zizmor, but it has a lot of problems, including in reusable workflows. So I'm considering dropping it to "pedantic" which would also make the finding disappear here 🙂)

[sharkdp]

I don't really know if I'm allowed to move that secret, and I don't want to break anything, so I'm suppressing the zizmor lint for now.