fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
lxml (source, changelog)	==6.1.0 → ==6.1.1
ops (changelog)	==3.7.0 → ==3.7.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

lxml/lxml (lxml)

v6.1.1

Compare Source

==================

Bugs fixed

• The known link attributes in lxml.html.defs.link_attrs were missing xlink:href,
  which can be used for URL bypass attacks in embedded SVG/MathML/etc. content.
  GHSA-4jhm-jv67-739f

• The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.

• The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

canonical/operator (ops)

v3.7.1

Compare Source

Fixes

• Pass the endpoint name through to relation-get (#​2499)

Documentation

• Add a how-to guide focused on debugging charms (#​2386)
• Add metadata descriptions to the debug and public listing how-to guides (#​2415)
• Update tutorials and how-tos to use pytest-jubilant (#​2406)
• Add how-to guide about CI (#​2405)
• Test COS Lite integration with the k8s-5-observe charm (#​2411)
• Update tutorials and example charms to match Charmcraft 4.2 (#​2407)
• Update api_demo_server version to support non-amd64 architectures (#​2448)
• Pin to 24.04 when launching VMs (#​2457)
• Explain how to remove errored apps in k8s tutorial (#​2445)
• Align example charms with pre-release Charmcraft (#​2444)
• Add how-to guide for naming and initialising a charm (#​2449)
• Add a how-to guide about publishing a charm (#​2420)
• In the tutorials, recommend initing from GitHub (#​2459)
• Fix integration tests of K8s tutorial charms (#​2471)
• Replace the PGP key with the upstream page in SECURITY.md (#​2474)
• Bump api_demo_server to 1.0.4 in docs and example charms (#​2473)
• Refresh the machine workloads how-to (#​2443)
• Add COS Lite integration tests to K8s tutorial (#​2478)
• Add git workflow guidance for contributors (#​2453)
• Update profile guidance in HACKING.md (#​2486)
• Explain how to add an icon to a charm (#​2451)
• Adopt latest Charmcraft profiles, incl juju_setup marker on integration tests (#​2497)
• Improve support for agents, with Sphinx Stack upgrade (#​2495)
• Improve how-to about managing files in containers (#​2470)
• Improve Container.pull docs to avoid leaky files (#​2508)
• Clarify Secret manage-permission error in testing.State (#​2510)

Tests

• Extend the type checking of the ops-scenario tests (#​2234, #​2235)
• Wait on ExecProcess after expected TypeError (#​2509)

CI

• Drop external action for checking PR title format (#​2388)
• Add a dependabot cooldown (#​2413)
• Sort the directory entries when updating the best practices list (#​2422)
• Configure dependabot for the example charms (#​2426)
• Pin zizmor and TIOBE tool versions in pyproject.toml rather than the workflow (#​2437)
• Add 26.04 to smoke tests and remove outdated metadata.yaml (#​2450)
• Use charmcraft test for example charm (#​2440)
• Add workflow_dispatch trigger to workflows where it is useful (#​2468)
• Ensure the correct job is selected in updating charm pins (#​2500)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.