[robbrad]

What

Ten of the eleven open dependabot PRs, applied together on one branch and tested as a set. Each is still its own commit, authored by dependabot, so nothing is re-attributed. Merge this with a merge commit or rebase, not a squash, to keep that.

PR	Bump
#2339	pillow 12.3.0 → 13.0.0 (see below: this is really a Home Assistant bump)
#2270	mako 1.4.1 → 1.4.2
#2271	multidict 6.7.1 → 6.9.1
#2301	black 26.5.1 → 26.10.1
#2302	setuptools 84.0.0 → 84.1.0
#2325	certifi 2026.7.22 → 2026.10.18
#2326	pylint 4.0.8 → 4.0.9
#2340	soupsieve 2.9.2 → 4.0 (major)
#2337	github/codeql-action 4.38.3 → 4.39.3
#2338	docker/login-action 4.6.0 → 4.8.0

#2297 (aiohttp 3.14.3 → 3.14.4) is dropped as superseded. #2339 already takes aiohttp to 3.14.5.

Two of these are bigger than their titles

Comparing each PR's poetry.lock against master shows that the "aiohttp" and "Pillow" PRs are not single-package bumps. They regenerate the lock against newer Home Assistant releases, which pins its transitive dependencies:

• chore: bump pillow from 12.3.0 to 13.0.0 #2339 moves homeassistant 2026.9.0 → 2026.11.1, cryptography 48.0.1 → 50.0.2 (a major), python-slugify 8 → 9, sqlalchemy, pyjwt, pyopenssl, uv, yarl, zeroconf, orjson, securetar and hass-nabucasa.
• It also swaps httpx/httpcore for a new httpx2/httpcore2 stack and adds pyserial and truststore.

#2339 is a strict superset of #2297, which is why #2297 is dropped.

None of these are runtime dependencies of the published package: homeassistant is in the dev group, and pyproject.toml pins none of the transitive libraries. So they change the CI/dev environment and the lock, not what pip install uk-bin-collection resolves. The one that does reach users is soupsieve, because bs4 depends on it unpinned.

Why soupsieve 4.0 is safe

It's a major bump of a CSS-selector engine, so I looked for removed syntax rather than trusting the version number:

• 40 scrapers call .select() / .select_one().
• None use the deprecated :contains(). The only pseudo-classes in use are :nth-child, :nth-of-type, :not and :first-child, which are standard CSS.
• 4.0 requires Python ≥ 3.11.5; the project requires ≥ 3.12.

Test plan

• poetry check --lock is clean, and poetry install from this lock succeeds on Python 3.14.10.
• Installed set confirmed: Home Assistant 2026.11.1, Pillow 13.0.0, soupsieve 4.0, cryptography 50.0.2, aiohttp 3.14.5.
• make unit-tests on that set: 499 passed. The only 3 failures are the known sandbox-only tests that need real network access (test_check_postcode_valid/_invalid, test_create_webdriver_local). To compare like with like, I ran this with the unrelated test fixes from test: stop the Orkney and Broxbourne tests failing on the calendar and the network #2341 applied.
• This PR changes no council file, so CI runs the full live suite against the new dependencies. That is the real check on soupsieve 4.0 across all scrapers.

All 10 commits are chore:, so merging this does not trigger a release.

---

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Updated the automated security analysis and release workflows. No changes to product features or release behavior.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The CodeQL analysis workflow now uses action version v4.39.3 for initialization, autobuild, and analysis. The release workflow now uses Docker login action version v4.8.0.

Changes: CodeQL action updates

Layer / File(s)	Summary
Update CodeQL action versions .github/workflows/codeql-analysis.yml	The initialization, autobuild, and analysis action references changed from v4.38.3 to v4.39.3.

Release Docker login update

Layer / File(s)	Summary
Update Docker login action version .github/workflows/release.yml	The Docker Hub login action reference changed from v4.6.0 to v4.8.0.

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Merge Risk: Minimal · up to c40bd

This change updates CI and release workflow action versions without altering their configuration. No concrete merge-blocking risk was found in the supplied changes, and CI will exercise the updated dependencies.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title is 'chore(deps): November dependency bumps (10 dependabot PRs, tested together)'. The PR combines ten Dependabot dependency updates, so the title describes the main change. The title is some…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title is 'chore(deps): November dependency bumps (10 dependabot PRs, tested together)'. The PR combines ten Dependabot dependency updates, so the title describes the main change. The title is somewhat broad because the raw summary covers only two workflow files (CodeQL and release), while the PR objectives describe ten dependency updates; the title still matches the stated PR intent. The title uses the conventional commit prefix and is clear enough for a teammate scanning history.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2ae39236-03a2-4ce1-993d-25807da02ffe

Commits

Reviewing files that changed from the base of the PR and between 0d1b26a and c40bdd6.

Files ignored due to path filters: 1

• poetry.lock is excluded by !**/*.lock

Files selected for processing: 2

• .github/workflows/codeql-analysis.yml
• .github/workflows/release.yml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.57%. Comparing base (0d1b26a) to head (c40bdd6).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2342   +/-   ##
=======================================
  Coverage   83.57%   83.57%           
=======================================
  Files          43       43           
  Lines        3380     3380           
=======================================
  Hits         2825     2825           
  Misses        555      555           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.