[hakonhagland]

This takes the part of the Dependabot group update #41 that does not change the look of the documentation, fixes the reason #41 (and #32 before it) fails the docs build, and adds the fixes for the four open Dependabot security alerts. One commit per package. Only poetry.lock and one line of pyproject.toml change.

The rest of #41 — sphinx 7.3.7, sphinx-rtd-theme 3.1.0 and sphinx-versioned-docs 1.4 — changes the page layout and is left for a separate PR, where the rendered site can be reviewed on its own.

Bump urllib3 to 2.8.0 (commit 1)

• Fixes Dependabot alerts #50, #52 and #53: GHSA-vxq7-64xx-v4gw, GHSA-8988-9cw3-xx77 and GHSA-gh4c-6fx4-qh6g.

Bump setuptools to 84.2.1 (commit 2)

• Fixes Dependabot alert #58: GHSA-xmj3-9gf7-h52w. The fix is in 84.1.0; 84.2.1 is the latest 84.x release.

Bump click to 8.5.0 together with typer 0.27.3 (commit 3)

• Why Bump the python-dependencies group across 1 directory with 7 updates #41 fails: sphinx-versioned builds its command line with typer, which is built on click. typer 0.9.0 gives click an option with a --no-... flag that is not a boolean flag, and click 8.2 and later reject that. With click 8.5.0 and typer 0.9.0, sphinx-versioned fails before doing anything, even for --help: TypeError: Secondary flag is not valid for non-boolean flag.
• Why Dependabot left typer behind: it is only a transitive dependency. sphinx-versioned-docs asks for typer >= 0.9.0, and typer 0.9.0 accepts any click below 9, so nothing forced it forward.
• The fix: move typer to 0.27.3, and add typer = ">=0.27.3,<1.0" to pyproject.toml, so the next group update cannot combine a new click with an old typer again.
• typer 0.27.3 also brings rich 15.0.0 and the new small packages shellingham and annotated-doc, and no longer needs typing-extensions.

Bump coverage, pytest and pytest-mock (commits 4–6)

• coverage 7.6.10 → 7.16.2, pytest 9.1.1 → 9.2.0 (with packaging 26.3 and pluggy 1.7.0), pytest-mock 3.14.0 → 3.17.0, as in Bump the python-dependencies group across 1 directory with 7 updates #41.

Testing

• poetry run pytest tests passes on Python 3.11.
• The full versioned docs build was run locally the same way the workflow does, in a fresh clone of this repository: sphinx-versioned -m master -b "$BRANCHES" --force --git-root ../../, with the branch list from get_doc_branches.sh. It builds master, release-2025.04, release-2025.10, release-2026.04 and the PR branch.
• The output is the same as the live site. All 29 HTML pages of the four published versions, and the top-level index.html, were compared with the current gh-pages branch. The only difference is the extra version-menu entry for the PR branch itself, which every branch build adds.

Note on the lock file diff

One line in poetry.lock is not a version change: the markers line of colorama lists its two conditions (sys_platform == "win32" and platform_system == "Windows", joined by or) in the other order. Poetry 2.5.1 writes it this way when run locally, and Dependabot's run for #38 wrote it the other way. The meaning is the same.

After this is merged, #41 can be closed; the remaining theme upgrade will come as its own PR.

[Copilot]

🟢 Approval recommended

No active review issues are blocking the documentation dependency updates.

No open issues 🎉

What changed in this PR

Updates the documentation build dependencies to address four security alerts and resolve the Click/Typer incompatibility behind the failed builds in #41 and #32, while deferring layout-changing Sphinx upgrades.

Changes:

• Updates urllib3 and setuptools to address the reported security alerts.
• Upgrades Click and Typer together and adds a minimum Typer version constraint.
• Refreshes coverage, pytest, pytest-mock, and related dependencies without changing the Sphinx or theme versions.

File	Description
python/​sphinx_docs/​pyproject.toml	Adds the Typer version constraint to prevent the incompatible dependency combination.
python/​sphinx_docs/​poetry.lock	Records security, command-line compatibility, and test-tool dependency updates.

_{Review effort: Balanced}