[timonweb]

Changes

• Update ruff pre-commit hook to v0.17.2 and rstcheck's tomli to 2.5.0: ruff-pre-commit v0.17.0 → v0.17.2 (from pre-commit autoupdate), and the rstcheck hook's tomli==2.0.1 → tomli==2.5.0. All hooks pass with no file changes.
• Update daisyUI to 5.7.50: daisyui ^5.7.48 → ^5.7.50 in the v4 npm template and example/theme, and DAISYUI_STANDALONE_VERSION v5.7.48 → v5.7.50. Both daisyui.mjs and daisyui-theme.mjs exist for the tag. CHANGELOG line added under a new ## Unreleased heading.
• Update postcss to 8.5.31 in the npm templates: ^8.5.30 → ^8.5.31 in the v4 template, example/theme and the v3 template (patch: better source maps on </style> escaping).
• Update postcss-nested to 9.0.1 in the v4 npm template (major, own commit, see below): ^8.0.1 → ^9.0.1 in the v4 template and example/theme. The v3 template stays on ^7.0.2 (current major only).

Already current: Tailwind CSS 4.3.3 (npm and standalone default), @tailwindcss/postcss, postcss-cli 12.0.0, postcss-simple-vars, cross-env, rimraf; the v3 template within its majors (tailwindcss 3.4.19 is v3-lts; postcss-import 17 is a new major, so it's not bumped in the deprecated template); blacken-docs black==26.10.1; Django 6.1.2 is the latest, and Django 5.2, 6.0 and 6.1 are all still supported. Python 3.10 reached EOL on 2026-10-01, but the floor is already 3.11. Django 6.1 still doesn't declare Python 3.15, so no classifier change.

Needs your decision

• postcss-nested 9 changes CSS output. 9.0.0 fixes how a nested selector with more than one & expands under a parent selector list: .a, .b { & + & {} } used to compile to .a + .a, .b + .b and now compiles to .a + .a, .a + .b, .b + .a, .b + .b, matching Sass and native CSS nesting. Selectors with a single & are unchanged. This is a bug fix, but it changes output for users who rely on the old behaviour. Also, its engines field is ^22 || ^24 || >=26, so npm will warn (not fail) on the odd-numbered Node.js 23 and 25. The README's "Node.js 22+" floor is unchanged. If you'd rather not ship it, drop commit d7d0525 and its CHANGELOG line.

Manual follow-ups

• Dependabot uv updates seem stalled. .github/dependabot.yml asks for monthly uv updates, but the last Dependabot PR was Bump idna from 3.11 to 3.15 #255 (2026-05-19). uv pip list --outdated shows outdated locked packages, including pytailwindcss 0.3.1 → 0.4.2, tox 4.65.4 → 4.67.1, sphinx 9.1.0 → 9.2.0, asgiref 3.12.1 → 3.13.0 and docutils 0.22.4 → 0.23. Check the repo's Dependabot logs (Insights → Dependency graph → Dependabot). uv.lock is left untouched here.
• Optional, from the last run: Python 3.15 is final, so allow-prereleases: true in .github/workflows/ci.yml is no longer needed for it. The comment at ci.yml:51 ("postcss-nested 8 … require Node.js 22+") could say "postcss-nested 9" if you merge the bump.

Verification

Baseline on master and the result on this branch were the same:

• uv sync: OK
• uv run python -m pytest: 58 passed (baseline 58 passed)
• uv run pre-commit run --all-files: all hooks passed, no files changed
• uv build: sdist and wheel built
• rm -rf docs/_build && make docs: succeeded with 10 warnings (baseline 10)
• Smoke test: fresh npm install of example/theme/static_src resolves postcss 8.5.31, postcss-nested 9.0.1 and daisyUI 5.7.50. postcss -u postcss-nested (postcss-cli 12) processes nested CSS and produces the new multi-& expansion.

Changelogs read

• postcss-nested: https://github.com/postcss/postcss-nested/blob/main/CHANGELOG.md (9.0.0 change: Combine every & with each parent selector postcss/postcss-nested#176)
• postcss: https://github.com/postcss/postcss/blob/main/CHANGELOG.md
• daisyUI: https://daisyui.com/docs/changelog/ (release https://github.com/saadeghi/daisyui/releases/tag/v5.7.50)
• ruff: https://github.com/astral-sh/ruff/releases

Opened by the scheduled maintenance agent (repo-maintenance).
Agent head: d7d0525