chore(deps): bump cairosvg from 2.8.2 to 2.9.0

[dependabot]

Bumps cairosvg from 2.8.2 to 2.9.0.

Changelog

Sourced from cairosvg's changelog.

Version 2.9.0 released on 2026-03-13

WARNING: this is a security update.

Using a lot of recursively nested use tags could lead to long rendering times with relatively small inputs. CairoSVG now stops rendering when more than 100k use tags are rendered.

Using the --unsafe option allows to render larger documents.

• Drop support of Python 3.9, add support of Python 3.14

Commits

• fe5cae5 Version 2.9.0
• 6dde868 Abort when more than 100k referenced elements are rendered
• a6b3a98 Cut long line again
• ce8b51d Cut long line
• b7818c9 Clarify unsafe option scope without removing security warning
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Medium Risk
Updates the docs dependency set and lockfile resolution, including a CairoSVG security bump and changed Python version/marker constraints that could affect documentation builds across Python versions.

Overview
Dependency lockfile refresh for docs tooling. Bumps optional cairosvg from 2.8.2 to 2.9.0 (now python-versions >=3.10) and updates the locked artifact hashes.

Also simplifies lock resolution by removing Python-version-split entries/markers for several docs dependencies (notably ipython, markdown-it-py, myst-parser, sphinx-design, sphinx-prompt) and normalizing a colorama Windows marker, which may change what gets installed for docs across Python versions.

^{Written by Cursor Bugbot for commit 27415c1. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unintended IPython major version downgrade for Python 3.11+

Medium Severity

The lockfile re-resolution collapsed version-split entries, downgrading several packages for Python 3.11+ users. ipython drops from 9.10.0 to 8.38.0 (major version downgrade, marker python_version == "3.10" removed), myst-parser from 5.0.0 to 4.0.1, markdown-it-py from 4.0.0 to 3.0.0, sphinx-design from 0.7.0 to 0.6.1, and sphinx-prompt from 1.10.2 to 1.9.0. The ipython-pygments-lexers package is also removed entirely. These are unintended collateral changes in a PR that only intends to bump cairosvg.

Additional Locations (2)

• poetry.lock#L3027-L3034
• poetry.lock#L5343-L5350

 

[dependabot]

Looks like cairosvg is up-to-date now, so this is no longer needed.