👷 ci: move arm64 MSVC setup off Node 20, bump deps

.github/workflows/check.yaml

@@ -166,7 +166,7 @@ jobs:
     # MSVC is detected by meson without a CC override and maps -Werror to /WX; split from the matrix
     # above so an empty CC env never shadows the auto-detection. x64 builds the SSE2 branch; on
     # windows-11-arm meson does not self-detect MSVC, so that cell installs an arm64 dev Python and
-    # activates the native arm64 toolchain with msvc-dev-cmd (its INCLUDE/LIB ride through tox via
+    # activates the native arm64 toolchain with setup-msvc-dev (its INCLUDE/LIB ride through tox via
     # pass_env), giving MSVC coverage of the _M_ARM64 NEON branch too.
     strategy:
       fail-fast: false
@@ -187,7 +187,7 @@ jobs:
           architecture: arm64
       - name: 🧰 Activate native arm64 MSVC (so meson picks cl over MinGW gcc)
         if: matrix.arm
-        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
+        uses: TheMrMilchmann/setup-msvc-dev@368ef7d1ee4d1171b31d4a7f67f4d954f903f5a9 # v4.1.0
         with:
           arch: arm64
       - name: 🔄 Install uv

.github/workflows/codspeed.yaml

@@ -108,7 +108,7 @@ jobs:
             glibc.malloc.arena_max=1)
           echo "GLIBC_TUNABLES=${tunables%:}" >> "$GITHUB_ENV"
       - name: 🚀 Run benchmarks
-        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
+        uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0
         env:
           # str hashes seed the dict and set probes the benchmarks walk; a fresh seed per run is a small run-to-run
           # term the CPU pins above do not cover.

.pre-commit-config.yaml

@@ -27,13 +27,13 @@ repos:
     hooks:
       - id: pyproject-fmt
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: "v23.1.1" # v22.1.5
+    rev: "v23.1.2" # v22.1.5
     hooks:
       - id: clang-format
         files: ^src/turbohtml/.*\.(c|h)$
         exclude: ^src/turbohtml/_c/(data/(html_entities|entity_names|tld_table|psl_table|idna_table|normalize_table|encoding_tables|phone_table)|encoding/detect_data)\.h$ # generated tables
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "v0.16.9" # v0.15.16
+    rev: "v0.16.10" # v0.15.16
     hooks:
       - id: ruff-format
       - id: ruff-check
@@ -55,9 +55,9 @@ repos:
         files: ^src/turbohtml/.*\.c$
         require_serial: true
         additional_dependencies:
-          - clang-tidy==22.1.7
-          - meson>=1.11.1
-          - ninja>=1.13
+          - clang-tidy==22.1.8
+          - meson>=1.12.1
+          - ninja>=1.13.2
       - id: mdformat
         name: mdformat
         entry: mdformat --wrap 120
@@ -73,7 +73,7 @@ repos:
         language: python
         files: ^docs/.*\.rst$
         additional_dependencies:
-          - ruff==0.15.20 # kept on the ruff-pre-commit rev by sync-pre-commit-deps
+          - ruff==0.16.10 # kept on the ruff-pre-commit rev by sync-pre-commit-deps
       - id: changelogs-rst
         name: changelog filenames
         language: fail

pyproject.toml

@@ -1,9 +1,9 @@
 [build-system]
 build-backend = "mesonpy"
 requires = [
-  "meson>=1.11.1",
-  "meson-python>=0.20",
-  "ninja>=1.13",
+  "meson>=1.12.1",
+  "meson-python>=0.22.1",
+  "ninja>=1.13.2",
 ]
 
 [project]
@@ -84,125 +84,125 @@ dev = [
 ]
 test = [
   "covdefaults>=2.3",
-  "docutils>=0.22",             # render the docs bench-table directive in tests/test_bench_table_directive.py
-  "elementpath>=5.1.3",         # the XPath 2.0 oracle the string-function differential test cross-checks against
-  "httpx2>=2.5",                # the benchmark corpora and the tools/generate_* scripts fetch pinned data over it
-  "jinja2>=3.1.6",              # the markup migration test renders templates with markupsafe swapped for turbohtml.markup
-  "markdown-it-py>=4.2",        # a pure-Python GFM reference to round-trip to_markdown() output back to HTML and check it
-  "meson>=1.11.1",
-  "meson-python>=0.20",
-  "ninja>=1.13",
+  "docutils>=0.23",            # render the docs bench-table directive in tests/test_bench_table_directive.py
+  "elementpath>=5.1.4",        # the XPath 2.0 oracle the string-function differential test cross-checks against
+  "httpx2>=2.13.1",            # the benchmark corpora and the tools/generate_* scripts fetch pinned data over it
+  "jinja2>=3.1.6",             # the markup migration test renders templates with markupsafe swapped for turbohtml.markup
+  "markdown-it-py>=4.2",       # a pure-Python GFM reference to round-trip to_markdown() output back to HTML and check it
+  "meson>=1.12.1",
+  "meson-python>=0.22.1",
+  "ninja>=1.13.2",
   "pyperf>=2.10",
   "pytest>=9.1.1",
-  "pytest-codspeed>=5.0.3",     # the benchmark fixture powers the CodSpeed CI gate; a no-op timer without --codspeed
+  "pytest-codspeed>=5.0.3",    # the benchmark fixture powers the CodSpeed CI gate; a no-op timer without --codspeed
   "pytest-cov>=7.1",
-  "pytest-mock>=3.15.1",
-  "pytest-run-parallel>=0.9.1", # runs each test in many threads to surface free-threaded data races
-  "tenacity>=9.1.4",            # the retry policy wrapping every tools/ HTTP fetch (httpfetch.py)
-  "typing-extensions>=4.15",
+  "pytest-mock>=3.16",
+  "pytest-run-parallel>=0.10", # runs each test in many threads to surface free-threaded data races
+  "tenacity>=9.1.4",           # the retry policy wrapping every tools/ HTTP fetch (httpfetch.py)
+  "typing-extensions>=4.16",
 ]
 type = [
-  "ty>=0.0.57",
+  "ty>=0.0.84",
   { include-group = "bench" }, # type-check the bench competitor modules in tools/bench/competitors
 ]
 docs = [
   "furo>=2025.12.19",
   "sphinx>=9.1",
   "sphinx-argparse-cli>=1.21.4",       # generate the CLI reference from the argparse parser so it cannot drift
   "sphinx-autodoc-typehints>=3.12.1",  # 3.11 types C getset descriptors from the stub
-  "sphinx-codeautolink>=0.18.1",       # link the names in code and doctest blocks to the API reference
+  "sphinx-codeautolink>=0.19",         # link the names in code and doctest blocks to the API reference
   "sphinx-copybutton>=0.5.2",
   "sphinx-design>=0.7",                # the card grid on the landing page
   "sphinx-issues>=6",
   "sphinx-last-updated-by-git>=0.3.8", # stamp each page with its last git edit
-  "sphinx-llm>=0.4.1,!=1.1",
+  "sphinx-llm!=1.1,>=1",
   "sphinx-notfound-page>=1.1",         # a versioned 404 page
   "sphinx-reredirects>=1.1",           # keep old URLs alive after a page moves
   "sphinx-sitemap>=2.9",               # emit sitemap.xml for crawlers
-  "sphinxcontrib-mermaid>=2.0.3",
+  "sphinxcontrib-mermaid>=2.1.1",
   "sphinxcontrib-towncrier>=0.5.0a0",
   "sphinxext-opengraph>=0.13",         # OpenGraph tags for link previews
-  "towncrier>=25.8",
+  "towncrier>=26.9",
 ]
 bench = [
-  "airium>=0.2.7",
+  "airium>=0.3.2",
   "beautifulsoup4>=4.15",
   "bleach>=6.4",
   "boilerpy3>=1.0.7",
   "calmjs-parse>=1.3.4",
-  "chardet>=7.4.3",
-  "charset-normalizer>=3.4.9",
+  "chardet>=7.6",
+  "charset-normalizer>=3.5.2",
   "courlan>=1.4",
   "css-html-js-minify>=2.5.5",
   "csscompressor>=0.9.5",
   "cssmin>=0.2",
-  "cssselect>=1.4",
+  "cssselect>=1.5",
   "dominate>=2.9.1",
   "extruct>=0.18",
   "fast-html>=1.0.12",
-  "faust-cchardet>=2.1.19",
-  "feedparser>=6.0.12",
-  "goose3>=3.1.21",
+  "faust-cchardet>=3.2",
+  "feedparser>=6.0.14",
+  "goose3>=3.1.22",
   "htbuilder>=0.9",
   "html-sanitizer>=2.6",
   "html-text>=0.7.1",
   "html2text>=2025.4.15",
-  "html5-parser>=0.4.12",
+  "html5-parser>=0.5",
   "html5lib>=1.1",
   "html5validator>=0.4.2",
-  "htmldate>=1.10",
+  "htmldate>=1.11",
   "htmlmin2>=0.1.13",
   "htpy>=26.5.1",
-  "inscriptis>=2.7.2",
+  "inscriptis>=2.7.5",
   "jsmin>=3.0.1",
   "justext>=3.0.2",
   "lightningcss>=0.3.1",
-  "linkify-it-py>=2.1",
-  "lxml>=6.1.1",
+  "linkify-it-py>=2.2",
+  "lxml>=6.1.3",
   "lxml-html-clean>=0.4.5",
   "markdownify>=1.2.3",
   "markupsafe>=3.0.3",
   "markyp-html>=0.2306.2",
   "microdata>=0.8",
   "minify-html>=0.18.1",
   "newspaper3k>=0.2.8",
-  "nh3>=0.3.6",
+  "nh3>=0.3.7",
   "opengraph-py3>=0.71",
   "pandas>=3.0.3",
-  "parsel>=1.11",
-  "phonenumbers>=9.0.38",
-  "pyquery>=2.0.1",
+  "parsel>=1.12.1",
+  "phonenumbers>=9.0.40",
+  "pyquery>=2.1",
   "rcssmin>=1.2.2",
   "readabilipy>=0.3",
   "readability-lxml>=0.8.4.1",
-  "resiliparse>=1.0.8",
+  "resiliparse>=1.0.9",
   "rjsmin>=1.2.5",
-  "selectolax>=0.4.10",
+  "selectolax>=0.4.13",
   "simple-html>=3.1.1",
-  "soupsieve>=2.8.4",
-  "trafilatura>=2.1",
-  "urlextract>=1.9",
-  "w3lib>=2.4.1",
+  "soupsieve>=2.10",
+  "trafilatura>=2.3",
+  "urlextract>=1.10",
+  "w3lib>=2.5",
   "yattag>=1.16.1",
   { include-group = "test" },
 ]
 coverage = [
   "covdefaults>=2.3",
-  "coverage[toml]>=7.15",
+  "coverage[toml]>=7.16.2",
 ]
 fix = [
-  "pre-commit-uv>=4.2.2",
+  "pre-commit-uv>=4.3",
 ]
 pkg-meta = [
   "check-wheel-contents>=0.6.3",
-  "twine>=6.2",
-  "uv>=0.11.28",
+  "twine>=7",
+  "uv>=0.12.22",
 ]
 release = [
-  "gitpython>=3.1.50",
-  "packaging>=26.2",
-  "pre-commit>=4.6",
-  "towncrier>=25.8",
+  "gitpython>=3.2",
+  "packaging>=26.3",
+  "pre-commit>=4.6.2",
+  "towncrier>=26.9",
 ]
 
 [tool.cibuildwheel]

tools/fuzz/amplify.py

@@ -47,7 +47,7 @@
 from turbohtml.validate import RelaxNG, XMLSchema
 
 if TYPE_CHECKING:
-    from collections.abc import Callable, Iterator, Sequence
+    from collections.abc import Callable, Generator, Sequence
 
 __all__ = [
     "KINDS",
@@ -328,7 +328,7 @@ def measure(run: Callable[[str], str | None], shape: Shape, base: int = _BASE_BY
 
 
 @contextmanager
-def _gc_paused() -> Iterator[None]:
+def _gc_paused() -> Generator[None, None, None]:
     # a collection lands on whichever sample crosses the allocation threshold, so timeit runs with the collector off too
     enabled = gc.isenabled()
     gc.disable()
@@ -340,7 +340,7 @@ def _gc_paused() -> Iterator[None]:
 
 
 @contextmanager
-def _watchdog() -> Iterator[None]:
+def _watchdog() -> Generator[None, None, None]:
     # a hung call never returns to Python, so a C-level watchdog dumps the stack and exits the process instead
     faulthandler.dump_traceback_later(_HANG_SECONDS, exit=True, file=_STDERR)
     try:

tox.toml

@@ -1,4 +1,4 @@
-requires = [ "tox>=4.56.3", "tox-uv>=1.35.2" ]
+requires = [ "tox>=4.64.7", "tox-uv>=1.36.1" ]
 env_list = [
   "3.15",
   "3.14",
@@ -443,7 +443,7 @@ description = """\
   run the sanitizer wrong-output oracles (independent re-parse, random Policy, URL scheme) under ASan/UBSan\
   """
 # dharma's xss.dg grammar generates seed payloads; six and webencodings are what the vendored html5lib-python imports
-deps = [ "dharma>=1.3.2", "six>=1.17", "webencodings>=0.5.1" ]
+deps = [ "dharma>=1.3.2", "six>=1.17", "webencodings>=0.6.1" ]
 dependency_groups = [ "test" ]
 pass_env = [ "FUZZ_RNG_SEED" ]
 # the independent re-parser is the vendored html5lib-python, imported from its checkout: its setup.py needs the