chore(deps)(deps): bump the minor-and-patch group with 2 updates

[dependabot]

Bumps the minor-and-patch group with 2 updates: pymupdf and spacy.

Updates pymupdf from 1.27.2.3 to 1.28.0

Changelog

Sourced from pymupdf's changelog.

Change Log

Changes in version 1.28.0 (2026-06-29)

Fixed issues:

• Fixed 4114 <https://github.com/pymupdf/PyMuPDF/issues/4114>_: ComboBox choice_values full of empty strings despite PDF having valid choices.
• Fixed 4950 <https://github.com/pymupdf/PyMuPDF/issues/4950>_: remove_rotation() raises ValueError on widgets with empty/infinite rects
• Fixed 5001 <https://github.com/pymupdf/PyMuPDF/issues/5001>_: Formulae incorrectly rendered as black boxes
• Fixed 5033 <https://github.com/pymupdf/PyMuPDF/issues/5033>_: Annot.set_rotation(0) followed by Annot.update() throws AttributeError

Other:

• Use MuPDF-1.28.0.
• pymupdf.Document.init(): new arg archive to support documents with archives.
• pymupdf.Document.convert_to_pdf(): also generate links.
• Fixed MacOS x64 platform tag - used to be macosx_10_9_x86_64, but we actually require MacOS 10.15, so platform tag is now macosx_10_15_x86_64.
• Support Windows builds with free thread python.
• pymupdf.Document.save() now saves non-PDF documents in PDF format.
• New method pymupdf.Document.apply_css().

Changes in version 1.27.2.3 (2026-04-24)

• Fixed issues:

  • Fixed 4928 <https://github.com/pymupdf/PyMuPDF/issues/4928>_: pymupdf.Document.scrub raises AttributeError for a document with annotations
  • Fixed 4942 <https://github.com/pymupdf/PyMuPDF/issues/4942>_: bug: IndexError for Page.get_links after Page.clip_to_rect
  • Fixed 4954 <https://github.com/pymupdf/PyMuPDF/issues/4954>_: get_drawings() returns incorrect lineJoin and width
  • Fixed 4958 <https://github.com/pymupdf/PyMuPDF/issues/4958>_: bug: inserting rotated pages to another document messes up link coordinates

• Other:

  • Fixed incorrect generation of lineJoin j in PDF content, introduced in 1.27.2.2.
  • Allow build to (incorrectly) claim to be thread-safe, for #4760. See setup.py for details.
  • Use pypi.org's pipcl package instead of our own pipcl.py file.

Changes in version 1.27.2.2 (2026-03-20)

• Fixed issues:

  • Fixed 4902 <https://github.com/pymupdf/PyMuPDF/issues/4902>_: Incorrect linewidth in elements returned by Page.get_texttrace()
  • Fixed 4932 <https://github.com/pymupdf/PyMuPDF/issues/4932>_: "Page" has no attribute "find_tables" in PyMuPDF 1.27

• Other:

... (truncated)

Commits

• e9cdfc9 changes.txt: fix mupdf version number.
• 629a358 docs/document.rst: add new in 1.28.0 to init's archive.
• 7264f27 README.md: updated example conversion from md to pdf.
• 119a0bc docs/document.rst: document that save() now also works for non-pdf documents.
• 5ebfc4c setup.py: use mupdf-1.28.0.
• 14d8fac changes.txt: removed bogus #4423 entry, added #5033.
• d961616 tests/test_annots.py: added test_5033() for setRect() vs set_rect() bug.
• d91bd63 changes.txt: added note about save() and non-pdf documents.
• fd409de .github/workflows/: updated to use mupdf branch 1.28.x.
• 04aa7dd Remove old setRect Name
• Additional commits viewable in compare view

Updates spacy from 3.8.13 to 3.8.14

Release notes

Sourced from spacy's releases.

v3.8.14: Bug fix for model downloading in environments without pip on PATH

• Fix spacy download failing in environments where pip is not on PATH but is available as a Python module (e.g., some virtual environments and containers)

Commits

• 0069cf9 Set version to 3.8.14
• 5603226 fix: check pip module availability instead of PATH binary in download (#13947)
• d4bb796 Add least-privilege permissions to CI workflow
• 9d29209 Pass github context via stdin instead of CLI arg
• 4216738 Pin GitHub Actions to commit SHAs for supply chain security
• 297938e Add smoke test and upgrade test to release build workflow
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.