diff --git a/.github/renovate.json b/.github/renovate.json
index d1d82433553..f48b670ecdc 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,7 +1,7 @@
 {
     "$schema": "https://docs.renovatebot.com/renovate-schema.json",
     "extends": [
-        "config:base"
+        "config:recommended"
     ],
     "labels": [
         "Dependency"
@@ -9,9 +9,13 @@
     "packageRules": [
         {
             "groupName": "github-actions",
-            "matchManagers": ["github-actions"],
-            "separateMajorMinor": "false"
+            "matchManagers": [
+                "github-actions"
+            ],
+            "separateMajorMinor": false
         }
     ],
-    "schedule": ["on the 3rd day of the month"]
+    "schedule": [
+        "on the 3rd day of the month"
+    ]
 }
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 92e860cb547..626824f3830 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -33,6 +33,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Set up Python
       uses: actions/setup-python@v5
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index cc4760288e5..8e789a73489 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -21,6 +21,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: pre-commit cache
       uses: actions/cache@v4
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 545c2e3644a..61ccf58e2ea 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  issues: write
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -15,6 +15,8 @@ concurrency:
 jobs:
   stale:
     if: github.repository_owner == 'python-pillow'
+    permissions:
+      issues: write
 
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/test-cygwin.yml b/.github/workflows/test-cygwin.yml
index 0aa79e4235a..656054e8924 100644
--- a/.github/workflows/test-cygwin.yml
+++ b/.github/workflows/test-cygwin.yml
@@ -48,6 +48,8 @@ jobs:
 
       - name: Checkout Pillow
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Cygwin
         uses: cygwin/cygwin-install-action@v4
diff --git a/.github/workflows/test-docker.yml b/.github/workflows/test-docker.yml
index 880fe3eea24..03608319a60 100644
--- a/.github/workflows/test-docker.yml
+++ b/.github/workflows/test-docker.yml
@@ -47,6 +47,7 @@ jobs:
           debian-12-bookworm-x86,
           debian-12-bookworm-amd64,
           fedora-40-amd64,
+          fedora-41-amd64,
           gentoo,
           ubuntu-22.04-jammy-amd64,
           ubuntu-24.04-noble-amd64,
@@ -64,6 +65,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Build system information
       run: python3 .github/workflows/system-info.py
@@ -101,7 +104,6 @@ jobs:
       with:
         flags: GHA_Docker
         name: ${{ matrix.docker }}
-        gcov: true
         token: ${{ secrets.CODECOV_ORG_TOKEN }}
 
   success:
diff --git a/.github/workflows/test-mingw.yml b/.github/workflows/test-mingw.yml
index c7a73439ca9..bfd393db5a2 100644
--- a/.github/workflows/test-mingw.yml
+++ b/.github/workflows/test-mingw.yml
@@ -46,6 +46,8 @@ jobs:
     steps:
       - name: Checkout Pillow
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up shell
         run: echo "C:\msys64\usr\bin\" >> $env:GITHUB_PATH
diff --git a/.github/workflows/test-valgrind.yml b/.github/workflows/test-valgrind.yml
index 63aec586b79..8818b3b2357 100644
--- a/.github/workflows/test-valgrind.yml
+++ b/.github/workflows/test-valgrind.yml
@@ -40,6 +40,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Build system information
       run: python3 .github/workflows/system-info.py
diff --git a/.github/workflows/test-windows.yml b/.github/workflows/test-windows.yml
index f6d0aeb1d4a..c1ba52719ae 100644
--- a/.github/workflows/test-windows.yml
+++ b/.github/workflows/test-windows.yml
@@ -44,16 +44,20 @@ jobs:
     steps:
     - name: Checkout Pillow
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Checkout cached dependencies
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         repository: python-pillow/pillow-depends
         path: winbuild\depends
 
     - name: Checkout extra test images
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         repository: python-pillow/test-images
         path: Tests\test-images
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6576292b5e4..87acd7ddbc0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -63,6 +63,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5
@@ -158,7 +160,6 @@ jobs:
       with:
         flags: ${{ matrix.os == 'ubuntu-latest' && 'GHA_Ubuntu' || 'GHA_macOS' }}
         name: ${{ matrix.os }} Python ${{ matrix.python-version }}
-        gcov: true
         token: ${{ secrets.CODECOV_ORG_TOKEN }}
 
   success:
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 34452fa563c..45f18634100 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -61,6 +61,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           submodules: true
 
       - uses: actions/setup-python@v5
@@ -132,6 +133,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           submodules: true
 
       - uses: actions/setup-python@v5
@@ -173,10 +175,13 @@ jobs:
           - cibw_arch: ARM64
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Checkout extra test images
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           repository: python-pillow/test-images
           path: Tests\test-images
 
@@ -253,6 +258,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Set up Python
       uses: actions/setup-python@v5
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6254b89416f..ddc98fdc356 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,12 +1,12 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.9
+    rev: v0.7.2
     hooks:
       - id: ruff
         args: [--exit-non-zero-on-fix]
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 24.8.0
+    rev: 24.10.0
     hooks:
       - id: black
 
@@ -24,7 +24,7 @@ repos:
         exclude: (Makefile$|\.bat$|\.cmake$|\.eps$|\.fits$|\.gd$|\.opt$)
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: v19.1.1
+    rev: v19.1.3
     hooks:
       - id: clang-format
         types: [c]
@@ -50,7 +50,7 @@ repos:
         exclude: ^.github/.*TEMPLATE|^Tests/(fonts|images)/
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.29.3
+    rev: 0.29.4
     hooks:
       - id: check-github-workflows
       - id: check-readthedocs
@@ -62,12 +62,12 @@ repos:
       - id: sphinx-lint
 
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: 2.2.4
+    rev: v2.5.0
     hooks:
       - id: pyproject-fmt
 
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.20.2
+    rev: v0.22
     hooks:
       - id: validate-pyproject
         additional_dependencies: [trove-classifiers>=2024.10.12]
diff --git a/docs/installation/platform-support.rst b/docs/installation/platform-support.rst
index 21ebd1ad520..a0bada7b428 100644
--- a/docs/installation/platform-support.rst
+++ b/docs/installation/platform-support.rst
@@ -31,6 +31,8 @@ These platforms are built and tested for every change.
 +----------------------------------+----------------------------+---------------------+
 | Fedora 40                        | 3.12                       | x86-64              |
 +----------------------------------+----------------------------+---------------------+
+| Fedora 41                        | 3.13                       | x86-64              |
++----------------------------------+----------------------------+---------------------+
 | Gentoo                           | 3.12                       | x86-64              |
 +----------------------------------+----------------------------+---------------------+
 | macOS 13 Ventura                 | 3.9                        | x86-64              |
@@ -146,7 +148,7 @@ These platforms have been reported to work at the versions mentioned.
 +----------------------------------+----------------------------+------------------+--------------+
 | FreeBSD 10.2                     | 2.7, 3.4                   | 3.1.0            |x86-64        |
 +----------------------------------+----------------------------+------------------+--------------+
-| Windows 11                       | 3.9, 3.10, 3.11, 3.12      | 10.2.0           |arm64         |
+| Windows 11 23H2                  | 3.9, 3.10, 3.11, 3.12, 3.13| 11.0.0           |arm64         |
 +----------------------------------+----------------------------+------------------+--------------+
 | Windows 11 Pro                   | 3.11, 3.12                 | 10.2.0           |x86-64        |
 +----------------------------------+----------------------------+------------------+--------------+
diff --git a/docs/reference/ImageFile.rst b/docs/reference/ImageFile.rst
index fdfeb60f99f..64abd71d156 100644
--- a/docs/reference/ImageFile.rst
+++ b/docs/reference/ImageFile.rst
@@ -19,7 +19,7 @@ Example: Parse an image
 
     from PIL import ImageFile
 
-    fp = open("hopper.pgm", "rb")
+    fp = open("hopper.ppm", "rb")
 
     p = ImageFile.Parser()
 
diff --git a/setup.py b/setup.py
index 38d793b1412..e4ce04883dd 100644
--- a/setup.py
+++ b/setup.py
@@ -1015,7 +1015,7 @@ def debug_build() -> bool:
     return hasattr(sys, "gettotalrefcount") or FUZZING_BUILD
 
 
-files = ["src/_imaging.c"]
+files: list[str | os.PathLike[str]] = ["src/_imaging.c"]
 for src_file in _IMAGING:
     files.append("src/" + src_file + ".c")
 for src_file in _LIB_IMAGING: