cusyio · dependabot · Jun 2, 2026 · Jun 9, 2026 · Jul 1, 2026 · Jul 1, 2026
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -20,7 +20,7 @@ jobs:
     name: Build docs and check links
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
     - uses: pandoc/actions/setup@86321b6dd4675f5014c611e05088e10d4939e09e # v1.1.1

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
@@ -28,11 +28,11 @@ jobs:
       github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
     - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-    - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.cache/pre-commit
         key: pre-commit|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -21,11 +21,11 @@ jobs:
       security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
         with:
           persona: pedantic
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -24,15 +24,15 @@ repos:
     - id: end-of-file-fixer
     - id: trailing-whitespace
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: a007bb7dd9043d022292401abc3061cb1906b4bc # v2.21.2
+    rev: 3a8ef795727fa946dfcb21c5d07b1442c2362c09 # v2.23.0
     hooks:
     - id: pyproject-fmt
   - repo: https://github.com/abravalheri/validate-pyproject
     rev: 4b2e70d08cb2ccd26d1fba73588de41c7a5d50b7 # v0.25
     hooks:
     - id: validate-pyproject
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 5e2fb545eba1ea9dc051f6f962d52fe8f76a9794 # v0.15.13
+    rev: 0671d8ab202c4ac093b78433ae5baf74f3fc7246 # v0.15.15
     hooks:
       - id: ruff-check
         args: [--fix, --exit-non-zero-on-fix]

diff --git a/docs/clean-prep/scikit-learn-reprocessing.ipynb b/docs/clean-prep/scikit-learn-reprocessing.ipynb
@@ -47,8 +47,6 @@
    "metadata": {},
    "outputs": [],
    "source": [
-    "from datetime import datetime\n",
-    "\n",
     "import numpy as np\n",
     "import pandas as pd\n",
     "\n",
@@ -62,7 +60,9 @@
    "metadata": {},
    "outputs": [],
    "source": [
-    "hvac = pd.read_csv(\"https://raw.githubusercontent.com/kjam/data-cleaning-101/master/data/HVAC_with_nulls.csv\")"
+    "hvac = pd.read_csv(\n",
+    "    \"https://raw.githubusercontent.com/kjam/data-cleaning-101/master/data/HVAC_with_nulls.csv\"\n",
+    ")"
    ]
   },
   {
@@ -336,7 +336,7 @@
    "metadata": {},
    "outputs": [],
    "source": [
-    "hvac[\"TargetTemp\"], hvac[\"SystemAge\"] = transformed[:,0], transformed[:,1]"
+    "hvac[\"TargetTemp\"], hvac[\"SystemAge\"] = transformed[:, 0], transformed[:, 1]"
    ]
   },
   {
@@ -583,7 +583,7 @@
     }
    ],
    "source": [
-    "hvac[\"MinMaxScaledTemp\"] = temp_minmax[:,0]\n",
+    "hvac[\"MinMaxScaledTemp\"] = temp_minmax[:, 0]\n",
     "hvac[\"MinMaxScaledTemp\"].head()"
    ]
   },

diff --git a/docs/data-processing/apis/fastapi/example.rst b/docs/data-processing/apis/fastapi/example.rst
@@ -16,7 +16,6 @@ Erstellt die Datei :file:`main.py` mit diesem Inhalt:
 
     from fastapi import FastAPI
 
-
     app = FastAPI()
 
 
@@ -81,7 +80,6 @@ zu erhalten:
 
     from fastapi import FastAPI
 
-
     app = FastAPI()
 
 

diff --git a/docs/data-processing/intake/data-engineers.ipynb b/docs/data-processing/intake/data-engineers.ipynb
@@ -1128,7 +1128,6 @@
     }
    ],
    "source": [
-    "import hvplot.pandas\n",
     "import intake\n",
     "\n",
     "\n",

diff --git a/docs/data-processing/intake/gui.ipynb b/docs/data-processing/intake/gui.ipynb
@@ -5110,24 +5110,15 @@
     "intake.output_notebook()\n",
     "\n",
     "us_crime.plot.bivariate(\n",
-    "    \"Burglary rate\",\n",
-    "    \"Property crime rate\",\n",
-    "    legend=False,\n",
-    "    width=500,\n",
-    "    height=400\n",
+    "    \"Burglary rate\", \"Property crime rate\", legend=False, width=500, height=400\n",
     ") * us_crime.plot.scatter(\n",
     "    \"Burglary rate\",\n",
     "    \"Property crime rate\",\n",
     "    color=\"black\",\n",
     "    size=15,\n",
     "    legend=False,\n",
     ") + us_crime.plot.table(\n",
-    "    [\n",
-    "        \"Burglary rate\",\n",
-    "        \"Property crime rate\"\n",
-    "    ],\n",
-    "    width=350,\n",
-    "    height=350\n",
+    "    [\"Burglary rate\", \"Property crime rate\"], width=350, height=350\n",
     ")"
    ]
   },

diff --git a/docs/data-processing/postgresql/sqlalchemy.rst b/docs/data-processing/postgresql/sqlalchemy.rst
@@ -44,7 +44,6 @@ Datenbankverbindung
 
     from sqlalchemy import create_engine
 
-
     engine = create_engine("postgresql:///example", echo=True)
 
 Datenmodell
@@ -56,7 +55,6 @@ Datenmodell
     from sqlalchemy.ext.declarative import declarative_base
     from sqlalchemy.orm import relationship
 
-
     Base = declarative_base()
 
 

diff --git a/docs/data-processing/serialisation-formats/toml/index.rst b/docs/data-processing/serialisation-formats/toml/index.rst
@@ -66,7 +66,6 @@ Beispiel
 
     import toml
 
-
     config = toml.load("pyproject.toml")
 
 .. seealso::

diff --git a/docs/data-processing/serialisation-formats/toml/pyproject.toml b/docs/data-processing/serialisation-formats/toml/pyproject.toml
@@ -6,12 +6,12 @@ line-length = 79
 
 [tool.isort]
 atomic = true
-force_grid_wrap = 0
+multi_line_output = 3
+use_parentheses = true
 include_trailing_comma = true
+force_grid_wrap = 0
 lines_after_imports = 2
 lines_between_types = 1
-multi_line_output = 3
-not_skip = "__init__.py"
-use_parentheses = true
-known_first_party = [ "MY_FIRST_MODULE", "MY_SECOND_MODULE" ]
 known_third_party = [ "mpi4py", "numpy", "requests" ]
+known_first_party = [ "MY_FIRST_MODULE", "MY_SECOND_MODULE" ]
+not_skip = "__init__.py"
diff --git a/docs/performance/index.rst b/docs/performance/index.rst
@@ -58,7 +58,6 @@ Beispieldaten können wir uns erstellen mit:
 
     from sklearn.datasets import make_blobs
 
-
     points, labels_true = make_blobs(
         n_samples=1000, centers=3, random_state=0, cluster_std=0.60
     )
@@ -136,7 +135,6 @@ k-Means-Algorithmus gibt es sogar gleich zwei Implementierungen:
 
      from sklearn.cluster import KMeans
 
-
      KMeans(10).fit_predict(points)
 
 * `dask_ml.cluster.KMeans
@@ -146,7 +144,6 @@ k-Means-Algorithmus gibt es sogar gleich zwei Implementierungen:
 
      from dask_ml.cluster import KMeans
 
-
      KMeans(10).fit(points).predict(points)
 
 Gegen diese bestehenden Lösungen könnte bestenfalls sprechen, dass sie einen

diff --git a/docs/productive/git/advanced/hooks/scripts.rst b/docs/productive/git/advanced/hooks/scripts.rst
@@ -81,6 +81,9 @@ Linter und Formatierer
     `prettier <https://github.com/pre-commit/mirrors-prettier>`_
         stellt `prettier <https://github.com/prettier/prettier>`__ bereit
 
+`ruff-pre-commit <https://github.com/astral-sh/ruff-pre-commit>`_
+    pre-commit-Hook für :doc:`../../../qa/ruff`
+
 `black <https://github.com/psf/black>`_
     für die Formatierung von Python-Code
 

diff --git a/docs/productive/security.rst b/docs/productive/security.rst
@@ -30,27 +30,76 @@ Sicherheitslücken in seiner eigenen Codebasis oder in seinen Abhängigkeiten
 aufweist. Eine offene Sicherheitslücke kann leicht ausgenutzt werden und sollte
 so schnell wie möglich geschlossen werden.
 
-Für eine solche Überprüfung könnt ihr :abbr:`z.B. (zum Beispiel)` `uv-secure
-<https://pypi.org/project/uv-secure/>`_ verwenden. Alternativ könnt ihr auch
-`osv <https://pypi.org/project/osv/>`_ oder `pip-audit
-<https://pypi.org/project/pip-audit/>`_ verwenden, das auf die `Open Source
-Vulnerability Database <https://osv.dev>`_ zurückgreift.
+Für eine solche Überprüfung könnt ihr :abbr:`z.B. (zum Beispiel)` ``uv audit``
+verwenden. Alternativ könnt ihr auch `osv <https://pypi.org/project/osv/>`_ oder
+`pip-audit <https://pypi.org/project/pip-audit/>`_ verwenden.
+
+``uv audit`` ist ein neuer Befehl von uv≥0.11.19, der die Abhängigkeiten in
+eurem Projekt auf bekannte Schwachstellen in der `OSV
+<https://osv.dev>`_-Datenbank und „nachteilige“ Projektstatus :abbr:`z. B. (zum
+Beispiel)` *deprecated* überprüft:
+
+.. code-block:: console
+
+   $ uv audit
+   warning: `uv audit` is experimental and may change without warning. Pass `--preview-features audit-command` to disable this warning.
+   Resolved 115 packages in 16ms
+   Found 12 known vulnerabilities and no adverse project statuses in 114 packages
+
+   Vulnerabilities:
+
+   idna 3.12 has 1 known vulnerability:
+   - GHSA-65pc-fj4g-8rjx: Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
+     Fixed in: 3.15
+     Advisory information: https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx
+   …
+
+``uv add``, ``uv sync`` :abbr:`usw. (und so weiter)` können nun bei jedem
+Synchronisierungsvorgang nach zuvor identifizierter Malware suchen. Diese
+Funktion ist standardmäßig nicht aktiviert, sie kann jedoch mit
+``UV_MALWARE_CHECK=1`` in der Shell einfach ermöglicht werden.
+
+.. seealso::
+   * `uv audit <https://docs.astral.sh/uv/reference/cli/#uv-audit>`_
+   * `uv audit settings <https://docs.astral.sh/uv/reference/settings/#audit>`_
 
 Wenn eine Schwachstelle in einer Abhängigkeit gefunden wird, solltet ihr auf
 eine nicht-anfällige Version aktualisieren; wenn kein Update verfügbar ist,
 solltet ihr überlegen, die Abhängigkeit zu entfernen.
 
 Wenn ihr glaubt, dass die Sicherheitslücke euer Projekt nicht betrifft, kann für
-``osv`` eine :file:`osv-scanner.toml`-Datei erstellt werden, :abbr:`u.a. (unter
-anderem)` mit der zu ignorierenden ID und einer Begründung, :abbr:`z.B. (zum
-Beispiel)`:
+``uv audit`` in der :file:`pyproject.toml`-Datei Ausnahmen definiert werden,
+:abbr:`z.B. (zum Beispiel)`:
 
 .. code-block:: toml
+   :caption: pyproject.toml
+
+   [tool.uv.audit]
+   ignore = ["PYSEC-2022-43017", "GHSA-5239-wwwm-4pmq"]
+
+oder besser:
+
+.. code-block:: toml
+   :caption: pyproject.toml
+
+   [tool.uv.audit]
+   ignore-until-fixed = ["PYSEC-2022-43017"]
+
+.. seealso::
+   * `ignore <https://docs.astral.sh/uv/reference/settings/#audit_ignore>`_
+   * `ignore-until-fixed
+     <https://docs.astral.sh/uv/reference/settings/#audit_ignore-until-fixed>`_
+
+Ihr könnt die Schwachstellenanalyse mit ``uv-audit`` auch in eure
+:doc:`pre-commit <git/advanced/hooks/pre-commit>`-Checks übernehmen:
+
+.. code-block:: yaml
 
-   [[IgnoredVulns]]
-   id = "GO-2022-1059"
-   # ignoreUntil = 2022-11-09 # Optional exception expiry date
-   reason = "No external http servers are written in Go lang."
+   - repo: https://github.com/astral-sh/uv-pre-commit
+     rev: 73c2d77a42a113aee9e4b748c24937f09557b82d # 0.11.24
+     hooks:
+     - id: uv-audit
+       files: ^(uv\.lock|pyproject\.toml)$
 
 Wartung
 -------

diff --git a/docs/workspace/pandas/date-time.ipynb b/docs/workspace/pandas/date-time.ipynb
@@ -228,7 +228,7 @@
     }
    ],
    "source": [
-    "(pd.to_datetime(uts, unit='s').tz_localize(\"UTC\"))"
+    "(pd.to_datetime(uts, unit=\"s\").tz_localize(\"UTC\"))"
    ]
   },
   {

diff --git a/docs/workspace/pandas/group-operations.ipynb b/docs/workspace/pandas/group-operations.ipynb
@@ -38,8 +38,8 @@
    "metadata": {},
    "outputs": [],
    "source": [
-    "import pandas as pd\n",
-    "import numpy as np"
+    "import numpy as np\n",
+    "import pandas as pd"
    ]
   },
   {

diff --git a/docs/workspace/pandas/python-data-structures.ipynb b/docs/workspace/pandas/python-data-structures.ipynb
@@ -17,7 +17,6 @@
    "metadata": {},
    "outputs": [],
    "source": [
-    "import numpy as np\n",
     "import pandas as pd"
    ]
   },

diff --git a/fastapi/main.py b/fastapi/main.py
@@ -4,9 +4,8 @@
 
 """FastAPI application for items."""
 
-from pydantic import BaseModel
-
 from fastapi import FastAPI
+from pydantic import BaseModel
 
 
 app = FastAPI()

diff --git a/pyproject.toml b/pyproject.toml
@@ -153,8 +153,8 @@ lint.isort.lines-after-imports = 2
 lint.isort.lines-between-types = 1
 
 [tool.codespell]
+ignore-words-list = "comit"
 skip = """\
   *.csv, *.html, *.pdf, *.rst, *.ipynb, ./docs/_build/*, */books.json,  */books.txt, ./styles/*, \
   ./Python4DataScience.egg-info/*\
   """
-ignore-words-list = "comit"
-Original file line number
+Diff line change
@@ Expand Up / @@ -16,7 +16,6 @@ Erstellt die Datei :file:`main.py` mit diesem Inhalt: @@
         from fastapi import FastAPI
         app = FastAPI()
@@ Expand Down Expand Up / @@ -81,7 +80,6 @@ zu erhalten: @@
         from fastapi import FastAPI
         app = FastAPI()
@@ Expand Down @@
Original file line number	Diff line number	Diff line change
Expand Up		@@ -66,7 +66,6 @@ Beispiel

		import toml


		config = toml.load("pyproject.toml")

		.. seealso::
Expand Down