From cb2df16b31f135e60bc0208509eeebbc97412ad9 Mon Sep 17 00:00:00 2001
From: gusthoff <gusthoff@gusthoff.com>
Date: Fri, 30 Oct 2026 18:27:43 +0100
Subject: [PATCH 1/6] Python: update HTTP and WebSocket dependencies

- Refresh HTTPS dependencies and pin `websocket-client` to 1.9.2 in
  both requirements files to keep the network tooling current.
- Validate the complete Python update with `pip check`, frozen
  environment reproduction and a security audit with no findings.

Co-Authored-By: Codex <noreply@openai.com>
---
 frontend/requirements.txt        |  2 +-
 frontend/requirements_frozen.txt | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/frontend/requirements.txt b/frontend/requirements.txt
index 9e41eeed6..9ebda26c4 100644
--- a/frontend/requirements.txt
+++ b/frontend/requirements.txt
@@ -13,4 +13,4 @@ Sphinx==9.1.0
 sphinx-reredirects==1.1.0
 sphinxcontrib-bibtex==2.7.0
 sphinxcontrib-plantuml==0.31
-websocket-client==1.9.0
+websocket-client==1.9.2
diff --git a/frontend/requirements_frozen.txt b/frontend/requirements_frozen.txt
index f271169d0..2f0653343 100644
--- a/frontend/requirements_frozen.txt
+++ b/frontend/requirements_frozen.txt
@@ -3,15 +3,15 @@ alabaster==1.0.0
 asttokens==3.0.2
 babel==2.18.0
 beautifulsoup4==4.15.0
-certifi==2026.7.22
-charset-normalizer==3.4.9
+certifi==2026.10.23
+charset-normalizer==3.5.2
 coverage==7.15.2
 decorator==5.3.1
 docutils==0.22.4
 executing==2.2.1
 furo==2025.12.19
 graphviz==0.21
-idna==3.18
+idna==3.20
 imagesize==2.0.0
 ipython==9.15.0
 ipython_pygments_lexers==1.1.1
@@ -55,6 +55,6 @@ sphinxcontrib-serializinghtml==2.0.0
 stack-data==0.6.3
 traitlets==5.15.1
 typing_extensions==4.16.0
-urllib3==2.7.0
+urllib3==2.8.0
 wcwidth==0.8.2
-websocket-client==1.9.0
+websocket-client==1.9.2

From bad7590c0b3e46944309f0a37c8c20647b2223e0 Mon Sep 17 00:00:00 2001
From: gusthoff <gusthoff@gusthoff.com>
Date: Fri, 30 Oct 2026 18:27:55 +0100
Subject: [PATCH 2/6] Python: update Pillow to 13.0.0

- Pin `pillow` to 13.0.0 in both requirements files to update the
  image-processing dependency used by the publishing pipeline.
- Validate cover generation and PDF/EPUB builds with the complete
  Python dependency update.

Co-Authored-By: Codex <noreply@openai.com>
---
 frontend/requirements.txt        | 2 +-
 frontend/requirements_frozen.txt | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/requirements.txt b/frontend/requirements.txt
index 9ebda26c4..5bf371315 100644
--- a/frontend/requirements.txt
+++ b/frontend/requirements.txt
@@ -4,7 +4,7 @@ furo==2025.12.19
 graphviz==0.21
 ipython==9.15.0
 pdf2image==1.17.0
-pillow==12.3.0
+pillow==13.0.0
 pydot-ng==2.0.0
 Pygments==2.20.0
 pyparsing==3.3.2
diff --git a/frontend/requirements_frozen.txt b/frontend/requirements_frozen.txt
index 2f0653343..4945b188a 100644
--- a/frontend/requirements_frozen.txt
+++ b/frontend/requirements_frozen.txt
@@ -25,7 +25,7 @@ packaging==26.2
 parso==0.8.7
 pdf2image==1.17.0
 pexpect==4.9.0
-pillow==12.3.0
+pillow==13.0.0
 prompt_toolkit==3.0.52
 psutil==7.2.2
 ptyprocess==0.7.0

From a3f5b76c79769b0a5c26083ab94c2d2d09d06eff Mon Sep 17 00:00:00 2001
From: gusthoff <gusthoff@gusthoff.com>
Date: Fri, 30 Oct 2026 18:28:06 +0100
Subject: [PATCH 3/6] Sphinx: update documentation dependencies

- Upgrade `Sphinx` to 9.2.0 and `docutils` to 0.23, and refresh the
  supporting documentation packages in both requirements files.
- Validate the complete Python update with HTML, PDF and EPUB builds;
  book warnings match the previous dependency versions.

Co-Authored-By: Codex <noreply@openai.com>
---
 frontend/requirements.txt        |  8 ++++----
 frontend/requirements_frozen.txt | 18 +++++++++---------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/frontend/requirements.txt b/frontend/requirements.txt
index 5bf371315..70fa39add 100644
--- a/frontend/requirements.txt
+++ b/frontend/requirements.txt
@@ -1,15 +1,15 @@
 coverage==7.15.2
-docutils==0.22.4
+docutils==0.23
 furo==2025.12.19
 graphviz==0.21
 ipython==9.15.0
 pdf2image==1.17.0
 pillow==13.0.0
 pydot-ng==2.0.0
-Pygments==2.20.0
-pyparsing==3.3.2
+Pygments==2.21.0
+pyparsing==3.3.3
 pyright==1.1.411
-Sphinx==9.1.0
+Sphinx==9.2.0
 sphinx-reredirects==1.1.0
 sphinxcontrib-bibtex==2.7.0
 sphinxcontrib-plantuml==0.31
diff --git a/frontend/requirements_frozen.txt b/frontend/requirements_frozen.txt
index 4945b188a..0ac232a28 100644
--- a/frontend/requirements_frozen.txt
+++ b/frontend/requirements_frozen.txt
@@ -7,21 +7,21 @@ certifi==2026.10.23
 charset-normalizer==3.5.2
 coverage==7.15.2
 decorator==5.3.1
-docutils==0.22.4
+docutils==0.23
 executing==2.2.1
 furo==2025.12.19
 graphviz==0.21
 idna==3.20
-imagesize==2.0.0
+imagesize==2.0.1
 ipython==9.15.0
 ipython_pygments_lexers==1.1.1
 jedi==0.20.0
 Jinja2==3.1.6
 latexcodec==3.0.1
-MarkupSafe==3.0.3
+MarkupSafe==3.0.4
 matplotlib-inline==0.2.2
 nodeenv==1.10.0
-packaging==26.2
+packaging==26.3
 parso==0.8.7
 pdf2image==1.17.0
 pexpect==4.9.0
@@ -33,22 +33,22 @@ pure_eval==0.2.3
 pybtex==0.26.1
 pybtex-docutils==1.0.3
 pydot-ng==2.0.0
-Pygments==2.20.0
-pyparsing==3.3.2
+Pygments==2.21.0
+pyparsing==3.3.3
 pyright==1.1.411
 PyYAML==6.0.3
 requests==2.34.2
 roman-numerals==4.1.0
 snowballstemmer==3.1.1
-soupsieve==2.9.1
-Sphinx==9.1.0
+soupsieve==3.0.4
+Sphinx==9.2.0
 sphinx-basic-ng==1.0.0b2
 sphinx-reredirects==1.1.0
 sphinxcontrib-applehelp==2.0.0
 sphinxcontrib-bibtex==2.7.0
 sphinxcontrib-devhelp==2.0.0
 sphinxcontrib-htmlhelp==2.1.0
-sphinxcontrib-jsmath==1.0.1
+sphinxcontrib-jsmath==2.0.0
 sphinxcontrib-plantuml==0.31
 sphinxcontrib-qthelp==2.0.0
 sphinxcontrib-serializinghtml==2.0.0

From bfa5b5cc8a29b470cfdd22cfa5f06cc6e60e2a0c Mon Sep 17 00:00:00 2001
From: gusthoff <gusthoff@gusthoff.com>
Date: Fri, 30 Oct 2026 18:28:16 +0100
Subject: [PATCH 4/6] Python: update IPython and its dependencies

- Upgrade `ipython` to 9.18.0 and refresh its supporting dependencies.
- Remove `decorator` from the frozen dependency closure because the
  updated environment no longer requires it.
- Verify `pip check` and frozen environment reproduction with the
  complete Python dependency update.

Co-Authored-By: Codex <noreply@openai.com>
---
 frontend/requirements.txt        |  2 +-
 frontend/requirements_frozen.txt | 15 +++++++--------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/frontend/requirements.txt b/frontend/requirements.txt
index 70fa39add..2e6a94753 100644
--- a/frontend/requirements.txt
+++ b/frontend/requirements.txt
@@ -2,7 +2,7 @@ coverage==7.15.2
 docutils==0.23
 furo==2025.12.19
 graphviz==0.21
-ipython==9.15.0
+ipython==9.18.0
 pdf2image==1.17.0
 pillow==13.0.0
 pydot-ng==2.0.0
diff --git a/frontend/requirements_frozen.txt b/frontend/requirements_frozen.txt
index 0ac232a28..8c0bfdd02 100644
--- a/frontend/requirements_frozen.txt
+++ b/frontend/requirements_frozen.txt
@@ -6,16 +6,15 @@ beautifulsoup4==4.15.0
 certifi==2026.10.23
 charset-normalizer==3.5.2
 coverage==7.15.2
-decorator==5.3.1
 docutils==0.23
-executing==2.2.1
+executing==2.3.0
 furo==2025.12.19
 graphviz==0.21
 idna==3.20
 imagesize==2.0.1
-ipython==9.15.0
+ipython==9.18.0
 ipython_pygments_lexers==1.1.1
-jedi==0.20.0
+jedi==0.20.1
 Jinja2==3.1.6
 latexcodec==3.0.1
 MarkupSafe==3.0.4
@@ -26,10 +25,10 @@ parso==0.8.7
 pdf2image==1.17.0
 pexpect==4.9.0
 pillow==13.0.0
-prompt_toolkit==3.0.52
+prompt_toolkit==3.0.53
 psutil==7.2.2
 ptyprocess==0.7.0
-pure_eval==0.2.3
+pure_eval==0.2.4
 pybtex==0.26.1
 pybtex-docutils==1.0.3
 pydot-ng==2.0.0
@@ -53,8 +52,8 @@ sphinxcontrib-plantuml==0.31
 sphinxcontrib-qthelp==2.0.0
 sphinxcontrib-serializinghtml==2.0.0
 stack-data==0.6.3
-traitlets==5.15.1
+traitlets==5.16.1
 typing_extensions==4.16.0
 urllib3==2.8.0
-wcwidth==0.8.2
+wcwidth==0.9.4
 websocket-client==1.9.2

From 41d60a9d680134ebfc29a2bc98839b7b06d3611e Mon Sep 17 00:00:00 2001
From: gusthoff <gusthoff@gusthoff.com>
Date: Fri, 30 Oct 2026 18:28:25 +0100
Subject: [PATCH 5/6] Python: update coverage and type-checking tools

- Update `coverage` to 7.17.0, `pyright` to 1.1.414 and `nodeenv` to
  1.11.1 to keep the test and type-checking toolchain current.
- Validate the complete Python update with type checks, 29 plugin
  tests and 481 pipeline tests, with four expected failures.

Co-Authored-By: Codex <noreply@openai.com>
---
 frontend/requirements.txt        | 4 ++--
 frontend/requirements_frozen.txt | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/frontend/requirements.txt b/frontend/requirements.txt
index 2e6a94753..4176a9043 100644
--- a/frontend/requirements.txt
+++ b/frontend/requirements.txt
@@ -1,4 +1,4 @@
-coverage==7.15.2
+coverage==7.17.0
 docutils==0.23
 furo==2025.12.19
 graphviz==0.21
@@ -8,7 +8,7 @@ pillow==13.0.0
 pydot-ng==2.0.0
 Pygments==2.21.0
 pyparsing==3.3.3
-pyright==1.1.411
+pyright==1.1.414
 Sphinx==9.2.0
 sphinx-reredirects==1.1.0
 sphinxcontrib-bibtex==2.7.0
diff --git a/frontend/requirements_frozen.txt b/frontend/requirements_frozen.txt
index 8c0bfdd02..37404a67b 100644
--- a/frontend/requirements_frozen.txt
+++ b/frontend/requirements_frozen.txt
@@ -5,7 +5,7 @@ babel==2.18.0
 beautifulsoup4==4.15.0
 certifi==2026.10.23
 charset-normalizer==3.5.2
-coverage==7.15.2
+coverage==7.17.0
 docutils==0.23
 executing==2.3.0
 furo==2025.12.19
@@ -19,7 +19,7 @@ Jinja2==3.1.6
 latexcodec==3.0.1
 MarkupSafe==3.0.4
 matplotlib-inline==0.2.2
-nodeenv==1.10.0
+nodeenv==1.11.1
 packaging==26.3
 parso==0.8.7
 pdf2image==1.17.0
@@ -34,7 +34,7 @@ pybtex-docutils==1.0.3
 pydot-ng==2.0.0
 Pygments==2.21.0
 pyparsing==3.3.3
-pyright==1.1.411
+pyright==1.1.414
 PyYAML==6.0.3
 requests==2.34.2
 roman-numerals==4.1.0

From 26a691651793e188267948c5333e7da81c1b2db2 Mon Sep 17 00:00:00 2001
From: gusthoff <gusthoff@gusthoff.com>
Date: Fri, 30 Oct 2026 18:28:34 +0100
Subject: [PATCH 6/6] Python: update pip in CI and Vagrant

- Pin `pip` to 26.2.2 in the four test workflows and both Vagrant
  provisioners so local and CI environments use the same installer.
- Verify `pip check` on both VMs and reproduce the frozen environment
  with the complete Python dependency update.

Co-Authored-By: Codex <noreply@openai.com>
---
 .github/workflows/sphinx-books-tests.js.yml   | 2 +-
 .github/workflows/sphinx-content-tests.js.yml | 2 +-
 .github/workflows/sphinx-plugin-tests.js.yml  | 2 +-
 .github/workflows/typescript-tests.js.yml     | 2 +-
 Vagrantfile                                   | 4 ++--
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/sphinx-books-tests.js.yml b/.github/workflows/sphinx-books-tests.js.yml
index 88a005983..61f92005f 100644
--- a/.github/workflows/sphinx-books-tests.js.yml
+++ b/.github/workflows/sphinx-books-tests.js.yml
@@ -24,7 +24,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
         # Pinned like the packages it installs; the action applies it as an
         # exact `pip==` requirement.
-        pip-version: '26.2.1'
+        pip-version: '26.2.2'
         cache: 'pip'
         # Named explicitly: the default pattern matches `requirements.txt`,
         # which is not the file the workflow installs, so the key would not
diff --git a/.github/workflows/sphinx-content-tests.js.yml b/.github/workflows/sphinx-content-tests.js.yml
index cce7da736..2a9a731ee 100644
--- a/.github/workflows/sphinx-content-tests.js.yml
+++ b/.github/workflows/sphinx-content-tests.js.yml
@@ -24,7 +24,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
         # Pinned like the packages it installs; the action applies it as an
         # exact `pip==` requirement.
-        pip-version: '26.2.1'
+        pip-version: '26.2.2'
         cache: 'pip'
         # Named explicitly: the default pattern matches `requirements.txt`,
         # which is not the file the workflow installs, so the key would not
diff --git a/.github/workflows/sphinx-plugin-tests.js.yml b/.github/workflows/sphinx-plugin-tests.js.yml
index d6b5a6d65..0c0230f17 100644
--- a/.github/workflows/sphinx-plugin-tests.js.yml
+++ b/.github/workflows/sphinx-plugin-tests.js.yml
@@ -30,7 +30,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
         # Pinned like the packages it installs; the action applies it as an
         # exact `pip==` requirement.
-        pip-version: '26.2.1'
+        pip-version: '26.2.2'
         cache: 'pip'
         # Named explicitly: the default pattern matches `requirements.txt`,
         # which is not the file the workflow installs, so the key would not
diff --git a/.github/workflows/typescript-tests.js.yml b/.github/workflows/typescript-tests.js.yml
index 987e51912..41141f885 100644
--- a/.github/workflows/typescript-tests.js.yml
+++ b/.github/workflows/typescript-tests.js.yml
@@ -31,7 +31,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
         # Pinned like the packages it installs; the action applies it as an
         # exact `pip==` requirement.
-        pip-version: '26.2.1'
+        pip-version: '26.2.2'
         cache: 'pip'
         # Named explicitly: the default pattern matches `requirements.txt`,
         # which is not the file the workflow installs, so the key would not
diff --git a/Vagrantfile b/Vagrantfile
index 662eccf18..d45916b77 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -110,7 +110,7 @@ $frontend = <<-SHELL
   source /vagrant/venv/bin/activate
   # Pinned like CI's setup-python pip-version input: pip itself is the one
   # tool that resolves the pinned packages below, so it needs a pin too.
-  pip3 install --upgrade pip==26.2.1
+  pip3 install --upgrade pip==26.2.2
   pip3 install -r /vagrant/frontend/requirements_frozen.txt
   pip3 install -e /vagrant/frontend/python/rst_code_example_pipeline
 
@@ -280,7 +280,7 @@ $epub = <<-SHELL
   source /vagrant/venv/bin/activate
   # Pinned like CI's setup-python pip-version input: pip itself is the one
   # tool that resolves the pinned packages below, so it needs a pin too.
-  pip3 install --upgrade pip==26.2.1
+  pip3 install --upgrade pip==26.2.2
   pip3 install -r /vagrant/frontend/requirements_frozen.txt
   pip3 install -e /vagrant/frontend/python/rst_code_example_pipeline