fix: pin the docs extra back to its audited versions (1.0.1)

[bbalouki]

Summary

Restores the docs extra's five pinned packages to their audited versions,
and stops Dependabot from moving them again. Releases as 1.0.1.

The pins and the comments beside them had come apart. pyproject.toml
simultaneously said:

# Pinned because griffe>=2.0 stops shipping its own implementation and
# instead depends on `griffelib` and `griffecli`. 1.15.0 is the newest
# release verified clean (colorama-only) on PyPI as of 2026-07-13.
"griffe==2.3.0",

Checked rather than assumed, straight from PyPI metadata. Every one of the
five bumped releases depends on the package its own comment warns about:

Package	Was pinned	Pulls	Restored to
griffe	2.3.0	griffelib==2.3.0, griffecli==2.3.0	1.15.0
mkdocstrings-python	2.0.8	griffelib>=2.0	2.0.2
mkdocs-gen-files	0.6.1	properdocs>=1.6.5	0.6.0
mkdocs-literate-nav	0.6.3	properdocs>=1.6.5	0.6.2
mkdocs-section-index	0.3.12	properdocs>=1.6.5	0.3.10

properdocs hijacks the mkdocs import namespace through a sys.meta_path
hook; griffelib replaces the real griffe under a new name.

Blast radius

Limited, but the published v1.0.0 metadata carries it permanently:

• pip install cmakeless was never affected. The package has exactly one
  runtime dependency, Typer. docs is an optional extra.
• Affected: pip install cmakeless[docs], and this repository's own docs CI
  job, which installs .[docs] on every run.

mkdocs build --strict passes unchanged on the audited versions, so nothing
actually depended on the newer ones.

Preventing a repeat

.github/dependabot.yml now ignores all five. They are pinned for
supply-chain reasons rather than compatibility, which is not a distinction an
automated version bump can make, so the pins move only when a human
re-audits the newer release and updates the comment along with it.

Checklist

• Tests added or updated — n/a, no source change; the fix is dependency
  metadata, and the docs build is the thing that exercises it.
• CHANGELOG.md updated under [1.0.1].
• ruff check ., ruff format --check . and mypy src pass locally.
• mkdocs build --strict passes on the restored pins.
• CI green on Windows, Linux and macOS.

Notes for reviewers

The honest part: this rode into v1.0.0 through the merge. I reviewed my own
diff carefully and never diffed main's incoming commits, so two Dependabot
bumps that had landed on main while I worked went unexamined. Diffing what
is being merged in, not only what is being merged out, is the lesson.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!