build(deps): update python-hcl2 requirement from >=8.1.2 to >=8.1.3

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Updates the requirements on python-hcl2 to permit the latest version.

Release notes

Sourced from python-hcl2's releases.

v8.1.3

What's Changed

Several fixes below change the values loads() returns for input that already parsed without error in 8.1.x — negative integer literals, both strip_string_quotes behaviours, and the two heredoc body fixes. The previous result was a bug in each case, so this stays a patch release; re-check your expectations if you built around the old values.

Fixed

• Restore py.typed marker so type checkers recognize hcl2 (and cli) as typed packages. (#299)
• Parse heredocs with an empty body again. A marker immediately followed by its closing delimiter failed to match, and the lexer then ran on to a later delimiter, silently absorbing the attributes in between. Thanks, @​livingstaccato (#312)
• Negative integer literals load as numbers again instead of ${-N} expression strings, matching negative floats and the pre-8.x behaviour. Thanks, @​livingstaccato (#311)
• strip_string_quotes no longer unquotes string literals nested inside expressions, which produced invalid HCL such as ${upper(x)} from upper("x"). Thanks, @​livingstaccato (#313)
• strip_string_quotes now resolves escape sequences, so the values it yields match what the option documents. Escapes naming a codepoint outside the Unicode range, or a lone surrogate, are preserved verbatim rather than raising. Thanks, @​livingstaccato (#313)
• Parse files with CRLF (\r\n) line endings, including heredocs. A \r acting as part of a line ending is ignored, so a CRLF file reconstructs with LF endings; a \r that is content — inside a quoted string or a heredoc body — is preserved. Thanks, @​agu2347 (#317)
• Flattened heredoc bodies keep their trailing blank lines and trailing spaces instead of being right-stripped away, for both <<MARKER and <<-MARKER. The closing marker line's own indentation is still removed, and a blank line no longer cancels the <<- dedent. Thanks, @​agu2347 (#318)
• Parse heredocs whose delimiter is a single character, such as <<E. The spec defines the delimiter as an Identifier, which permits one character. (#323)
• preserve_heredocs=False combined with strip_string_quotes now returns the heredoc body as a plain multi-line string instead of escaping every newline to a literal \n. The escaping is still applied to the quoted source form produced without strip_string_quotes. (#324)

Full Changelog: amplify-education/python-hcl2@v8.1.2...v8.1.3

Changelog

Sourced from python-hcl2's changelog.

[8.1.3] - 2026-08-26

Several fixes below change the values loads() returns for input that already parsed without error in 8.1.x — negative integer literals, both strip_string_quotes behaviours, and the two heredoc body fixes. The previous result was a bug in each case, so this stays a patch release; re-check your expectations if you built around the old values.

Fixed

• Restore py.typed marker so type checkers recognize hcl2 (and cli) as typed packages. (#299)
• Parse heredocs with an empty body again. A marker immediately followed by its closing delimiter failed to match, and the lexer then ran on to a later delimiter, silently absorbing the attributes in between. Thanks, @​livingstaccato (#312)
• Negative integer literals load as numbers again instead of ${-N} expression strings, matching negative floats and the pre-8.x behaviour. Thanks, @​livingstaccato (#311)
• strip_string_quotes no longer unquotes string literals nested inside expressions, which produced invalid HCL such as ${upper(x)} from upper("x"). Thanks, @​livingstaccato (#313)
• strip_string_quotes now resolves escape sequences, so the values it yields match what the option documents. Escapes naming a codepoint outside the Unicode range, or a lone surrogate, are preserved verbatim rather than raising. Thanks, @​livingstaccato (#313)
• Parse files with CRLF (\r\n) line endings, including heredocs. A \r acting as part of a line ending is ignored, so a CRLF file reconstructs with LF endings; a \r that is content — inside a quoted string or a heredoc body — is preserved. Thanks, @​agu2347 (#317)
• Flattened heredoc bodies keep their trailing blank lines and trailing spaces instead of being right-stripped away, for both <<MARKER and <<-MARKER. The closing marker line's own indentation is still removed, and a blank line no longer cancels the <<- dedent. Thanks, @​agu2347 (#318)
• Parse heredocs whose delimiter is a single character, such as <<E. The spec defines the delimiter as an Identifier, which permits one character. (#323)
• preserve_heredocs=False combined with strip_string_quotes now returns the heredoc body as a plain multi-line string instead of escaping every newline to a literal \n. The escaping is still applied to the quoted source form produced without strip_string_quotes. (#324)

[8.1.2] - 2026-04-10

Fixed

• true, false, and null now serialize to native JSON types instead of strings. (#293)

[8.1.1] - 2026-04-07

Added

• v7-to-v8 migration guide and absolute GitHub links in README docs table. (#287)

[8.1.0] - 2026-04-07

Added

• Full architecture overhaul: bidirectional HCL2 ↔ JSON pipeline with typed rule classes. (#203)
• hq read-only query CLI for HCL2 files (#277)
• Agent-friendly conversion CLIs: hcl2tojson and jsontohcl2 (#274)
• Add template directives support (%{if}, %{for}) in quoted strings (#276)
• Support loading comments (#134)
• CLAUDE.md (#260)

Fixed

• Ternary with strings parse error (#55)
• "No terminal matches '|' in the current parser context" when parsing multi-line conditional (#142)
• reverse_transform not working with object-type variables (#231)
• reverse_transform not handling nested functions (#235)
• writes omits quotes around map keys with / (#236)

... (truncated)

Commits

• 1874eb7 chore: prepare 8.1.3 release changelog (#325)
• ca51f4b docs: credit contributors in the unreleased changelog entries (#322)
• 06279a0 fix: return heredoc bodies as real multi-line values when unquoting (#303) (#...
• 37c0b8f fix: parse heredocs with a single-character delimiter (#314) (#323)
• e8647d9 chore: sort imports so ruff check passes on main (#320)
• f7531ef chore: union-merge CHANGELOG.md to stop parallel PRs conflicting (#319)
• e0c0207 Fix heredoc bodies losing trailing blank lines/spaces to a greedy rstrip (#318)
• 8973c4c Fix CRLF (\r\n) line endings failing to parse (#317)
• 0015121 fix: make strip_string_quotes yield values, not broken source (#308, #310) (#...
• 205f4ba fix: load negative integer literals as numbers (#307) (#311)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)