[pull] master from aio-libs:master#676
Merged
Merged
Conversation
Bumps [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) from 3.4.1 to 4.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/cibuildwheel/releases">pypa/cibuildwheel's releases</a>.</em></p> <blockquote> <h2>v4.0.0</h2> <p>See <a href="https://github.com/henryiii"><code>@henryiii</code></a>'s <a href="https://iscinumpy.dev/post/cibuildwheel-4-0-0/">release post</a> for more info on new features!</p> <ul> <li> <p>🌟 Adds wheel auditing with <code>abi3audit</code> as a default after the repair step, with new <a href="https://cibuildwheel.pypa.io/en/stable/options/#audit-requires"><code>audit-requires</code></a> and <a href="https://cibuildwheel.pypa.io/en/stable/options/#audit-command"><code>audit-command</code></a> options (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2805">#2805</a>)</p> </li> <li> <p>🌟 Adds <code>pyemscripten</code> platform tag support (PEP 783), updates Pyodide to 314.0.0a2, and adds a <code>pyodide-eol</code> <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code></a> flag for building end-of-life Pyodide versions (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2812">#2812</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2848">#2848</a>)</p> </li> <li> <p>🌟 Sets up <code>delvewheel</code> as the default <a href="https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command"><code>repair-wheel-command</code></a> for Windows, so extension module DLLs are now bundled automatically. Skip by setting it to empty if not needed. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2831">#2831</a>)</p> </li> <li> <p>✨ Adds CPython 3.15 support, under the <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code> option</a> <code>cpython-prerelease</code>. This version of cibuildwheel uses 3.15.0b2. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2833">#2833</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2850">#2850</a>)</p> <p><em>While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.15 will be available in cibuildwheel without the flag.</em></p> </li> <li> <p>✨ Adds CPython 3.15 support for iOS and Android (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2857">#2857</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2858">#2858</a>)</p> </li> <li> <p>✨ Adds Android improvements for building NumPy and related packages, including auditwheel support, pkg-config and Fortran configuration, and the <a href="https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files"><code>xbuild-files</code></a> option (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2695">#2695</a>)</p> </li> <li> <p>✨ Adds <code>CIBUILDWHEEL_BUILD_IDENTIFIER</code> environment variable set to the current build identifier (e.g. <code>cp311-manylinux_x86_64</code>) during per-build steps (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2872">#2872</a>)</p> </li> <li> <p>✨ Adds <code>{project}</code> and <code>{package}</code> placeholders to <a href="https://cibuildwheel.pypa.io/en/stable/options/#config-settings"><code>config-settings</code></a> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2827">#2827</a>)</p> </li> <li> <p>⚠️ Drops support for Python 3.8 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2686">#2686</a>)</p> </li> <li> <p>⚠️ Removes the experimental CPython 3.13 free-threading builds and the <code>cpython-freethreading</code> <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code></a> option. CPython 3.14+ free-threading support remains available without the enable flag. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2684">#2684</a>)</p> </li> <li> <p>⚠️ Drops support for Cirrus CI, which is shutting down June 1, 2026 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2817">#2817</a>)</p> </li> <li> <p>⚠️ Drops GraalPy 3.11 (gp311) support, as agreed in <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2741">#2741</a>, and removes GraalPy 24-only workarounds (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2895">#2895</a>)</p> </li> <li> <p>🔐 Adds SHA256 verification for direct downloads of Python interpreters, virtualenv, and python-build-standalone assets (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2873">#2873</a>)</p> </li> <li> <p>🔐 Adds tarfile extraction filter for safe archive extraction (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2856">#2856</a>)</p> </li> <li> <p>🐛 Fixes <code>UV_PYTHON</code> not being set for <a href="https://cibuildwheel.pypa.io/en/stable/options/#before-build"><code>before-build</code></a> on Linux when using <code>uv</code> as the <a href="https://cibuildwheel.pypa.io/en/stable/options/#build-frontend"><code>build-frontend</code></a> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2830">#2830</a>)</p> </li> <li> <p>🐛 Fixes detection of musl libc when downloading python-build-standalone, which previously always selected the gnu asset on musl hosts like Alpine (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2889">#2889</a>)</p> </li> <li> <p>🐛 Fixes <a href="https://cibuildwheel.pypa.io/en/stable/options/#config-settings"><code>config-settings</code></a> expansion when <code>{project}</code> or <code>{package}</code> contains spaces or backslashes (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2886">#2886</a>)</p> </li> <li> <p>🐛 Prevents deadlock when <code>linux32</code> fails and forwards platform args to the sanity check (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2880">#2880</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2888">#2888</a>)</p> </li> <li> <p>🐛 Fixes container resource leaks on start failure and during teardown (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2879">#2879</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2887">#2887</a>)</p> </li> <li> <p>🐛 Removes potential partial cache-population in case of error (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2892">#2892</a>)</p> </li> <li> <p>🐛 Raises a clear error when <code>ANDROID_API_LEVEL</code> is not an integer (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2891">#2891</a>)</p> </li> <li> <p>🐛 Replaces assert with proper exception in python-build-standalone (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2859">#2859</a>)</p> </li> <li> <p>🐛 Uses ConfigurationError when <code>package_dir</code> is outside cwd instead of a generic Exception (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2898">#2898</a>)</p> </li> <li> <p>🛠 Updates dependencies and container pins (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2893">#2893</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2882">#2882</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2874">#2874</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2868">#2868</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2862">#2862</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2884">#2884</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2845">#2845</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2837">#2837</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2818">#2818</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2810">#2810</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2838">#2838</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2813">#2813</a>)</p> </li> <li> <p>🛠 Updates Android to Python 3.13.13 and 3.14.4 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2821">#2821</a>)</p> </li> <li> <p>🛠 Applies Pyodide-specific patches to the Emscripten toolchain installation (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2800">#2800</a>)</p> </li> <li> <p>🛠 Uses <code>python -V -V</code> for Windows build diagnostics (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2832">#2832</a>)</p> </li> <li> <p>🛠 Simplifies pinned container image lookup (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2897">#2897</a>)</p> </li> <li> <p>🛠 Minor fixups across error messages, OCI container, and options (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2860">#2860</a>)</p> </li> <li> <p>💼 Adds PEP 723 metadata for <code>bin/</code> scripts and drops the <code>bin</code> dependency group (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2819">#2819</a>)</p> </li> <li> <p>💼 Improves Azure test reliability with retries and caching (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2890">#2890</a>)</p> </li> <li> <p>💼 Fixes Windows GitLab CI test running (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2870">#2870</a>)</p> </li> <li> <p>💼 Updates CI action pins and dev dependencies (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2902">#2902</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2867">#2867</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2851">#2851</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2843">#2843</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2826">#2826</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2823">#2823</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2820">#2820</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2807">#2807</a>)</p> </li> <li> <p>💼 Adds agent and copilot setup files (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2861">#2861</a>)</p> </li> <li> <p>💼 Uses <code>if TYPE_CHECKING:</code> blocks (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2866">#2866</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2864">#2864</a>)</p> </li> <li> <p>🧪 Fixes Android tests using the <code>uv</code> frontend (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2809">#2809</a>)</p> </li> <li> <p>🧪 Fixes the update-dependencies workflow to use <code>uv</code> to run <code>nox</code> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2808">#2808</a>)</p> </li> <li> <p>🧪 Adds unit tests for <code>OCIContainer._get_platform_args</code> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2878">#2878</a>)</p> </li> <li> <p>📚 Updates documentation for delvewheel as the default Windows <a href="https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command"><code>repair-wheel-command</code></a>, including the build diagram, schema defaults, and legal note (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2877">#2877</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2853">#2853</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2891">#2891</a>)</p> </li> <li> <p>📚 Documents platform-specific <a href="https://cibuildwheel.pypa.io/en/stable/options/#before-build"><code>before-build</code></a> configuration (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2834">#2834</a>)</p> </li> <li> <p>📚 Updates the "How it works" diagram with details of Android, iOS, and Pyodide builds (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2816">#2816</a>)</p> </li> <li> <p>📚 Adds Pyodide icon and regenerates working examples data for Android, iOS, and Pyodide (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2815">#2815</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2811">#2811</a>)</p> </li> <li> <p>📚 Adds intersphinx support for external documentation linking (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2871">#2871</a>)</p> </li> <li> <p>📚 Adds instructions for building CUDA wheels and fixes manylinux container references in FAQ (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2896">#2896</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2900">#2900</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md">pypa/cibuildwheel's changelog</a>.</em></p> <blockquote> <h3>v4.0.0</h3> <p><em>7 June 2026</em></p> <p>See <a href="https://github.com/henryiii"><code>@henryiii</code></a>'s <a href="https://iscinumpy.dev/post/cibuildwheel-4-0-0/">release post</a> for more info on new features!</p> <ul> <li> <p>🌟 Adds wheel auditing with <code>abi3audit</code> as a default after the repair step, with new <a href="https://cibuildwheel.pypa.io/en/stable/options/#audit-requires"><code>audit-requires</code></a> and <a href="https://cibuildwheel.pypa.io/en/stable/options/#audit-command"><code>audit-command</code></a> options (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2805">#2805</a>)</p> </li> <li> <p>🌟 Adds <code>pyemscripten</code> platform tag support (PEP 783), updates Pyodide to 314.0.0a2, and adds a <code>pyodide-eol</code> <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code></a> flag for building end-of-life Pyodide versions (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2812">#2812</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2848">#2848</a>)</p> </li> <li> <p>🌟 Sets up <code>delvewheel</code> as the default <a href="https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command"><code>repair-wheel-command</code></a> for Windows, so extension module DLLs are now bundled automatically. Skip by setting it to empty if not needed. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2831">#2831</a>)</p> </li> <li> <p>✨ Adds CPython 3.15 support, under the <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code> option</a> <code>cpython-prerelease</code>. This version of cibuildwheel uses 3.15.0b2. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2833">#2833</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2850">#2850</a>)</p> <p><em>While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.15 will be available in cibuildwheel without the flag.</em></p> </li> <li> <p>✨ Adds CPython 3.15 support for iOS and Android (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2857">#2857</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2858">#2858</a>)</p> </li> <li> <p>✨ Adds Android improvements for building NumPy and related packages, including auditwheel support, pkg-config and Fortran configuration, and the <a href="https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files"><code>xbuild-files</code></a> option (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2695">#2695</a>)</p> </li> <li> <p>✨ Adds <code>CIBUILDWHEEL_BUILD_IDENTIFIER</code> environment variable set to the current build identifier (e.g. <code>cp311-manylinux_x86_64</code>) during per-build steps (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2872">#2872</a>)</p> </li> <li> <p>✨ Adds <code>{project}</code> and <code>{package}</code> placeholders to <a href="https://cibuildwheel.pypa.io/en/stable/options/#config-settings"><code>config-settings</code></a> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2827">#2827</a>)</p> </li> <li> <p>⚠️ Drops support for Python 3.8 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2686">#2686</a>)</p> </li> <li> <p>⚠️ Removes the experimental CPython 3.13 free-threading builds and the <code>cpython-freethreading</code> <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code></a> option. CPython 3.14+ free-threading support remains available without the enable flag. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2684">#2684</a>)</p> </li> <li> <p>⚠️ Drops support for Cirrus CI, which is shutting down June 1, 2026 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2817">#2817</a>)</p> </li> <li> <p>⚠️ Drops GraalPy 3.11 (gp311) support, as agreed in <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2741">#2741</a>, and removes GraalPy 24-only workarounds (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2895">#2895</a>)</p> </li> <li> <p>🔐 Adds SHA256 verification for direct downloads of Python interpreters, virtualenv, and python-build-standalone assets (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2873">#2873</a>)</p> </li> <li> <p>🔐 Adds tarfile extraction filter for safe archive extraction (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2856">#2856</a>)</p> </li> <li> <p>🐛 Fixes <code>UV_PYTHON</code> not being set for <a href="https://cibuildwheel.pypa.io/en/stable/options/#before-build"><code>before-build</code></a> on Linux when using <code>uv</code> as the <a href="https://cibuildwheel.pypa.io/en/stable/options/#build-frontend"><code>build-frontend</code></a> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2830">#2830</a>)</p> </li> <li> <p>🐛 Fixes detection of musl libc when downloading python-build-standalone, which previously always selected the gnu asset on musl hosts like Alpine (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2889">#2889</a>)</p> </li> <li> <p>🐛 Fixes <a href="https://cibuildwheel.pypa.io/en/stable/options/#config-settings"><code>config-settings</code></a> expansion when <code>{project}</code> or <code>{package}</code> contains spaces or backslashes (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2886">#2886</a>)</p> </li> <li> <p>🐛 Prevents deadlock when <code>linux32</code> fails and forwards platform args to the sanity check (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2880">#2880</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2888">#2888</a>)</p> </li> <li> <p>🐛 Fixes container resource leaks on start failure and during teardown (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2879">#2879</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2887">#2887</a>)</p> </li> <li> <p>🐛 Removes potential partial cache-population in case of error (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2892">#2892</a>)</p> </li> <li> <p>🐛 Raises a clear error when <code>ANDROID_API_LEVEL</code> is not an integer (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2891">#2891</a>)</p> </li> <li> <p>🐛 Replaces assert with proper exception in python-build-standalone (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2859">#2859</a>)</p> </li> <li> <p>🐛 Uses ConfigurationError when <code>package_dir</code> is outside cwd instead of a generic Exception (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2898">#2898</a>)</p> </li> <li> <p>🛠 Updates dependencies and container pins (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2893">#2893</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2882">#2882</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2874">#2874</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2868">#2868</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2862">#2862</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2884">#2884</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2845">#2845</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2837">#2837</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2818">#2818</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2810">#2810</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2838">#2838</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2813">#2813</a>)</p> </li> <li> <p>🛠 Updates Android to Python 3.13.13 and 3.14.4 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2821">#2821</a>)</p> </li> <li> <p>🛠 Applies Pyodide-specific patches to the Emscripten toolchain installation (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2800">#2800</a>)</p> </li> <li> <p>🛠 Uses <code>python -V -V</code> for Windows build diagnostics (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2832">#2832</a>)</p> </li> <li> <p>🛠 Simplifies pinned container image lookup (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2897">#2897</a>)</p> </li> <li> <p>🛠 Minor fixups across error messages, OCI container, and options (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2860">#2860</a>)</p> </li> <li> <p>💼 Adds PEP 723 metadata for <code>bin/</code> scripts and drops the <code>bin</code> dependency group (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2819">#2819</a>)</p> </li> <li> <p>💼 Improves Azure test reliability with retries and caching (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2890">#2890</a>)</p> </li> <li> <p>💼 Fixes Windows GitLab CI test running (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2870">#2870</a>)</p> </li> <li> <p>💼 Updates CI action pins and dev dependencies (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2902">#2902</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2867">#2867</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2851">#2851</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2843">#2843</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2826">#2826</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2823">#2823</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2820">#2820</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2807">#2807</a>)</p> </li> <li> <p>💼 Adds agent and copilot setup files (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2861">#2861</a>)</p> </li> <li> <p>💼 Uses <code>if TYPE_CHECKING:</code> blocks (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2866">#2866</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2864">#2864</a>)</p> </li> <li> <p>🧪 Fixes Android tests using the <code>uv</code> frontend (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2809">#2809</a>)</p> </li> <li> <p>🧪 Fixes the update-dependencies workflow to use <code>uv</code> to run <code>nox</code> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2808">#2808</a>)</p> </li> <li> <p>🧪 Adds unit tests for <code>OCIContainer._get_platform_args</code> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2878">#2878</a>)</p> </li> <li> <p>📚 Updates documentation for delvewheel as the default Windows <a href="https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command"><code>repair-wheel-command</code></a>, including the build diagram, schema defaults, and legal note (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2877">#2877</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2853">#2853</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2891">#2891</a>)</p> </li> <li> <p>📚 Documents platform-specific <a href="https://cibuildwheel.pypa.io/en/stable/options/#before-build"><code>before-build</code></a> configuration (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2834">#2834</a>)</p> </li> <li> <p>📚 Updates the "How it works" diagram with details of Android, iOS, and Pyodide builds (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2816">#2816</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/cibuildwheel/commit/f03ac7617d6cff873ccf24cc0d567ef5ba5a9e6d"><code>f03ac76</code></a> Bump version: v4.0.0</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/557c5f65f8f54a221176266bc2d0ca6c45e4aa20"><code>557c5f6</code></a> feat: remove GraalPy 3.11 (gp311) support (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2895">#2895</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/70975c215353836ca59d7b6f00dc38bc48782daa"><code>70975c2</code></a> chore: use ConfigurationError when package_dir is outside cwd (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2898">#2898</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/e2f143c327ca18f5ae61d325b778e87f49d96400"><code>e2f143c</code></a> chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 in the actions...</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/866ae747818f794bbaf572f7a651c4296dbfb33e"><code>866ae74</code></a> docs: fix CUDA manylinux container references in FAQ (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2900">#2900</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/84b518a1b1aed68be73fc8809a0502dff4985121"><code>84b518a</code></a> chore: simplify pinned image lookup (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2897">#2897</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/785d812a474288fdd51e0edbd39b7c679d303943"><code>785d812</code></a> docs: add instructions for building CUDA wheels (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2896">#2896</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/f6bd0477ccc60aa8a7a89b8c1eee6bbbd3fe0dbb"><code>f6bd047</code></a> Bump version: v4.0.0rc2</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/6cd2d197c1d4a92539360c32887927b5926e8656"><code>6cd2d19</code></a> fix: remove potential partial cache-population in case of error (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2892">#2892</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/cdb170b8c633405bace02dc1c69be86e975a4911"><code>cdb170b</code></a> [Bot] Update dependencies (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2893">#2893</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/cibuildwheel/compare/v3.4.1...v4.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [distlib](https://github.com/pypa/distlib) from 0.4.1 to 0.4.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/distlib/blob/master/CHANGES.rst">distlib's changelog</a>.</em></p> <blockquote> <p>0.4.2</p> <pre><code> Released: 2026-06-08 <ul> <li> <p>locators</p> <ul> <li> <p>Fix URL percent-encoding using space-padding instead of zero-padding. Thanks to Kadir Can Ozden for the patch.</p> </li> <li> <p>Harden decompression against malicious input. Thanks to tonghuaroot for the patch, which was adapted slightly.</p> </li> </ul> </li> <li> <p>manifest</p> <ul> <li>Use os.lstat in findall to correctly detect symlinked directories. Thanks to Kadir Can Ozden for the patch.</li> </ul> </li> <li> <p>metadata</p> <ul> <li>Improve logic to incorporate newer metadata versions.</li> </ul> </li> <li> <p>resources</p> <ul> <li>Ensure that constructed resource paths don't escape the package. Thanks to tonghuaroot for the patch.</li> </ul> </li> <li> <p>util</p> <ul> <li> <p>Fix <a href="https://redirect.github.com/pypa/distlib/issues/255">#255</a>: Update cache_from_source() for Python 3.15. Thanks to Victor Stinner for the patch.</p> </li> <li> <p>Check during unarchiving that the destination directory isn't escaped via symlinks. Thanks to tonghuaroot for the patch.</p> </li> <li> <p>Improved performance of normalize_name using dual replace. Thanks to Hugo van Kemenade for the patch.</p> </li> </ul> </li> <li> <p>wheel</p> <ul> <li> <p>Add checks that installed files don't escape the installation directory. Thanks to tonghuaroot for the patch.</p> </li> <li> <p>Add checks when mounting extensions to ensure path containment. Thanks to tonghuaroot for the patch. </code></pre></p> </li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/distlib/commit/8183ea60e83bf021bf7d6903f4a6b3c8df0905a6"><code>8183ea6</code></a> Update change log.</li> <li><a href="https://github.com/pypa/distlib/commit/55ca016b2d597ac5eecb10b6c43b4d9652b73462"><code>55ca016</code></a> Changes for 0.4.2.</li> <li><a href="https://github.com/pypa/distlib/commit/7e282abde14bebec2c0e5342faa5a420e70799ca"><code>7e282ab</code></a> Update metadata logic to incorporate newer versions.</li> <li><a href="https://github.com/pypa/distlib/commit/fa4ea501acb14baa31df6b823006da4fd1f8e0dd"><code>fa4ea50</code></a> Remove non-portable portion of test.</li> <li><a href="https://github.com/pypa/distlib/commit/e06a1d5fb237cff35c0bd58fe917ef44c84e41cf"><code>e06a1d5</code></a> Further refine tests.</li> <li><a href="https://github.com/pypa/distlib/commit/ccd2bb0b33ccddb6a6b1a508b918e8ba4dd69a54"><code>ccd2bb0</code></a> Update unit tests.</li> <li><a href="https://github.com/pypa/distlib/commit/ab58056d3fac0f0b11ce58ed866bbd8d9f18dfe5"><code>ab58056</code></a> Formatting tidy-up.</li> <li><a href="https://github.com/pypa/distlib/commit/4d4c926dbfb7c028b11d2a9b37edb6b9cfb99f2e"><code>4d4c926</code></a> Add checks when mounting extensions to ensure path containment.</li> <li><a href="https://github.com/pypa/distlib/commit/9efc6fd6dc2d8b2bf852d627bdb12ba49e6f4b94"><code>9efc6fd</code></a> Check during unarchiving that the destination directory isn't escaped via sym...</li> <li><a href="https://github.com/pypa/distlib/commit/63fd4f1af9e6921ad40e6e6d9f4a2c40d98f0909"><code>63fd4f1</code></a> Ensure that constructed resource paths don't escape the package.</li> <li>Additional commits viewable in <a href="https://github.com/pypa/distlib/compare/0.4.1...0.4.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…arks by connection type (tcp vs ssl)… (#12884)
Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>48.0.1 - 2026-06-09</p> <pre><code> * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1. <p>.. _v48-0-0:<br /> </code></pre></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74"><code>de987ce</code></a> 48.0.1 version bump and changelog (<a href="https://redirect.github.com/pyca/cryptography/issues/14996">#14996</a>)</li> <li>See full diff in <a href="https://github.com/pyca/cryptography/compare/48.0.0...48.0.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.29.1 to 3.29.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/py-filelock/releases">filelock's releases</a>.</em></p> <blockquote> <h2>3.29.3</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🔧 ci(release): publish to PyPI on tag push by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/557">tox-dev/filelock#557</a></li> <li>validate pid range in _parse_lock_holder by <a href="https://github.com/dxbjavid"><code>@dxbjavid</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/556">tox-dev/filelock#556</a></li> <li>🐛 fix(ci): restore release environment on tag job by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/559">tox-dev/filelock#559</a></li> <li>🐛 fix(ci): publish from release.yaml on tag push by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/560">tox-dev/filelock#560</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.29.2...3.29.3">https://github.com/tox-dev/filelock/compare/3.29.2...3.29.3</a></p> <h2>3.29.2</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>open marker reads non-blocking to refuse attacker-placed fifo by <a href="https://github.com/dxbjavid"><code>@dxbjavid</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/549">tox-dev/filelock#549</a></li> <li>🔒 fix(soft): harden stale-lock breaking and self-heal malformed locks by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/551">tox-dev/filelock#551</a></li> <li>check hostname in is_lock_held_by_us by <a href="https://github.com/dxbjavid"><code>@dxbjavid</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/553">tox-dev/filelock#553</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.29.1...3.29.2">https://github.com/tox-dev/filelock/compare/3.29.1...3.29.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst">filelock's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <hr /> <p>3.29.3 (2026-06-10)</p> <hr /> <ul> <li>🐛 fix(ci): restore release environment on tag job :pr:<code>559</code></li> <li>validate pid range in _parse_lock_holder :pr:<code>556</code> - by :user:<code>dxbjavid</code></li> <li>🔧 ci(release): publish to PyPI on tag push :pr:<code>557</code></li> <li>build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 :pr:<code>558</code> - by :user:<code>dependabot[bot]</code></li> </ul> <hr /> <p>3.29.2 (2026-06-10)</p> <hr /> <ul> <li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 :pr:<code>555</code> - by :user:<code>dependabot[bot]</code></li> <li>[pre-commit.ci] pre-commit autoupdate :pr:<code>554</code> - by :user:<code>pre-commit-ci[bot]</code></li> <li>check hostname in is_lock_held_by_us :pr:<code>553</code> - by :user:<code>dxbjavid</code></li> <li>🔒 fix(soft): harden stale-lock breaking and self-heal malformed locks :pr:<code>551</code></li> <li>open marker reads non-blocking to refuse attacker-placed fifo :pr:<code>549</code> - by :user:<code>dxbjavid</code></li> </ul> <hr /> <p>3.29.1 (2026-06-03)</p> <hr /> <ul> <li>🐛 fix(soft): refuse to follow symlinks when reading the lock file :pr:<code>548</code> - by :user:<code>dxbjavid</code></li> <li>[pre-commit.ci] pre-commit autoupdate :pr:<code>547</code> - by :user:<code>pre-commit-ci[bot]</code></li> <li>[pre-commit.ci] pre-commit autoupdate :pr:<code>546</code> - by :user:<code>pre-commit-ci[bot]</code></li> <li>chore: improve filelock maintenance path :pr:<code>545</code> - by :user:<code>lphuc2250gma</code></li> <li>chore: improve filelock maintenance path :pr:<code>544</code> - by :user:<code>lphuc2250gma</code></li> <li>chore: improve filelock maintenance path :pr:<code>542</code> - by :user:<code>lphuc2250gma</code></li> <li>docs: clarify per-thread scope of FileLock configuration :pr:<code>543</code> - by :user:<code>Gares95</code></li> <li>[pre-commit.ci] pre-commit autoupdate :pr:<code>541</code> - by :user:<code>pre-commit-ci[bot]</code></li> <li>docs: fix API docs of <code>release()</code> :pr:<code>540</code> - by :user:<code>MrAnno</code></li> <li>[pre-commit.ci] pre-commit autoupdate :pr:<code>539</code> - by :user:<code>pre-commit-ci[bot]</code></li> <li>[pre-commit.ci] pre-commit autoupdate :pr:<code>538</code> - by :user:<code>pre-commit-ci[bot]</code></li> <li>[pre-commit.ci] pre-commit autoupdate :pr:<code>537</code> - by :user:<code>pre-commit-ci[bot]</code></li> <li>build(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 :pr:<code>536</code> - by :user:<code>dependabot[bot]</code></li> <li>[pre-commit.ci] pre-commit autoupdate :pr:<code>535</code> - by :user:<code>pre-commit-ci[bot]</code></li> </ul> <hr /> <p>3.29.0 (2026-04-19)</p> <hr /> <ul> <li>✨ feat(soft): enable stale lock detection on Windows :pr:<code>534</code></li> <li>🐛 fix(async): use single-thread executor for lock consistency :pr:<code>533</code></li> <li>build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 :pr:<code>530</code> - by :user:<code>dependabot[bot]</code></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/filelock/commit/85e73d7f0575e30a3d94a00452255e381c7b8eb3"><code>85e73d7</code></a> 🐛 fix(ci): publish from release.yaml on tag push (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/560">#560</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/f86dcb1abca36bb02b65232d411d7e8dce8569e6"><code>f86dcb1</code></a> Release 3.29.3</li> <li><a href="https://github.com/tox-dev/filelock/commit/643bdbe89bff3c61e29d14d7657d045bb89ade6d"><code>643bdbe</code></a> 🐛 fix(ci): restore release environment on tag job (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/559">#559</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/7a8f74a904cf7d98b6baf24eb37175d128a5f818"><code>7a8f74a</code></a> validate pid range in _parse_lock_holder (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/556">#556</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/d1d49a0b232a6d904ff29b22213834df75ffc59b"><code>d1d49a0</code></a> 🔧 ci(release): publish to PyPI on tag push (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/557">#557</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/b37e162e316ec0ef6e5b8c37a1c04bdaaa411487"><code>b37e162</code></a> build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/558">#558</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/d9216dea26f31d369c7d3422bfe14c08b51232f1"><code>d9216de</code></a> Release 3.29.2</li> <li><a href="https://github.com/tox-dev/filelock/commit/ab6844ddde56e0a93d34d918f90eef6fc74d2c6a"><code>ab6844d</code></a> build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/555">#555</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/b862ead7201e8a602311bbc29e444db343b07967"><code>b862ead</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/554">#554</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/2ff7c3cffc5d872a890783890fd6fd3b9fd27643"><code>2ff7c3c</code></a> check hostname in is_lock_held_by_us (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/553">#553</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tox-dev/py-filelock/compare/3.29.1...3.29.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python) from 3.3.0 to 3.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/gh-action-sigstore-python/releases">sigstore/gh-action-sigstore-python's releases</a>.</em></p> <blockquote> <h2>v3.4.0</h2> <h2>What's Changed</h2> <ul> <li>Used <a href="https://github.com/sigstore/sigstore-python">sigstore</a> package version is now 4.3.0</li> <li>Other dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/gh-action-sigstore-python/compare/v3.3.0...v3.4.0">https://github.com/sigstore/gh-action-sigstore-python/compare/v3.3.0...v3.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/5b79a39c381910c090341a2c9b0bf022c8b387e1"><code>5b79a39</code></a> build(deps): bump sigstore in the python-dependencies group (<a href="https://redirect.github.com/sigstore/gh-action-sigstore-python/issues/408">#408</a>)</li> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/3d7f17b8b279a1d7ab50eb95c5093a705faa268c"><code>3d7f17b</code></a> build(deps): bump idna in the python-dependencies group (<a href="https://redirect.github.com/sigstore/gh-action-sigstore-python/issues/407">#407</a>)</li> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/2d128b7818557646bcbf10cbacdb1e853bb219f2"><code>2d128b7</code></a> build(deps): bump github/codeql-action in the actions group (<a href="https://redirect.github.com/sigstore/gh-action-sigstore-python/issues/405">#405</a>)</li> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/06882d3fcb29bb3d179477463294949a66a585a3"><code>06882d3</code></a> build(deps): bump the python-dependencies group with 3 updates (<a href="https://redirect.github.com/sigstore/gh-action-sigstore-python/issues/406">#406</a>)</li> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/bab6f774fe0bae9a78bb84a7f2dae7eba8c3acb6"><code>bab6f77</code></a> build(deps): bump the actions group across 1 directory with 3 updates (<a href="https://redirect.github.com/sigstore/gh-action-sigstore-python/issues/403">#403</a>)</li> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/f98c4297018863c6a9e0c5b805a3556b077e71f4"><code>f98c429</code></a> build(deps): bump securesystemslib in the python-dependencies group (<a href="https://redirect.github.com/sigstore/gh-action-sigstore-python/issues/404">#404</a>)</li> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/db9196e5f4691f5b56529ff81e2ebee29602e955"><code>db9196e</code></a> build(deps): bump the python-dependencies group across 1 directory with 3 upd...</li> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/839093df29c9a230f2937675f228721adea13c41"><code>839093d</code></a> build(deps): bump certifi from 2026.4.22 to 2026.5.20 in the python-dependenc...</li> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/d9df9da0e2490b27cf8083a92277335284adb83f"><code>d9df9da</code></a> build(deps): bump ast-serialize in the python-dependencies group (<a href="https://redirect.github.com/sigstore/gh-action-sigstore-python/issues/397">#397</a>)</li> <li><a href="https://github.com/sigstore/gh-action-sigstore-python/commit/2f7a761af4c98ffb7ae55fa917de2cc414a9b681"><code>2f7a761</code></a> build(deps): bump github/codeql-action in the actions group (<a href="https://redirect.github.com/sigstore/gh-action-sigstore-python/issues/395">#395</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/gh-action-sigstore-python/compare/v3.3.0...v3.4.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [distlib](https://github.com/pypa/distlib) from 0.4.2 to 0.4.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/distlib/blob/master/CHANGES.rst">distlib's changelog</a>.</em></p> <blockquote> <p>0.4.3</p> <pre><code> Released: 2026-06-12 <ul> <li> <p>resources</p> <ul> <li>Removed too-restrictive check for escaping resources.<br /> </code></pre></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/distlib/commit/3f4a377c8b164ba1c22a2a61de560f6f80ca7394"><code>3f4a377</code></a> Changes for 0.4.3.</li> <li><a href="https://github.com/pypa/distlib/commit/5ee19e6bac8248d7d5246d498d79abe96faa89a5"><code>5ee19e6</code></a> Relax too-strict escaping check for resources.</li> <li><a href="https://github.com/pypa/distlib/commit/f0e3d1ae3e694045b44a5b0e0a50177429ca1b06"><code>f0e3d1a</code></a> Bump version.</li> <li><a href="https://github.com/pypa/distlib/commit/06e010db2ddc9497d5bbd886747ff4990ac528a9"><code>06e010d</code></a> Add upper version limit for setuptools for build, to keep metadata version to...</li> <li><a href="https://github.com/pypa/distlib/commit/8b5aa55adf617bd3e81da716d44d034d7938f503"><code>8b5aa55</code></a> Added tag 0.4.2 for changeset 5295c0ceb419</li> <li>See full diff in <a href="https://github.com/pypa/distlib/compare/0.4.2...0.4.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.4.0 to 1.4.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/releases">python-discovery's releases</a>.</em></p> <blockquote> <h2>v1.4.2</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix: stop symlink resolution at stdlib landmark and framework builds by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/87">tox-dev/python-discovery#87</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/python-discovery/compare/1.4.1...1.4.2">https://github.com/tox-dev/python-discovery/compare/1.4.1...1.4.2</a></p> <h2>v1.4.1</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix: resolve executable-only symlinks in system_executable by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/85">tox-dev/python-discovery#85</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/python-discovery/compare/1.4.0...1.4.1">https://github.com/tox-dev/python-discovery/compare/1.4.0...1.4.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst">python-discovery's changelog</a>.</em></p> <blockquote> <h1>Bug fixes - 1.4.2</h1> <ul> <li>Stop executable symlink resolution once the stdlib landmark is reachable and keep macOS framework builds untouched, matching <code>getpath</code> - Homebrew interpreters no longer get version-pinned <code>Cellar</code> paths recorded and stable aliases such as Debian's <code>/usr/bin/python3</code> are preserved - by :user:<code>gaborbernat</code>. (:issue:<code>86</code>)</li> </ul> <hr /> <p>v1.4.1 (2026-06-11)</p> <hr /> <h1>Bug fixes - 1.4.1</h1> <ul> <li>Resolve executable-only symlinks when computing <code>system_executable</code>, mirroring CPython's <code>getpath.realpath</code> <code>python/cpython#115237</code> symlinked interpreter tree is kept as-is - by :user:<code>gaborbernat</code>. (:issue:<code>84</code>)</li> </ul> <hr /> <p>v1.4.0 (2026-05-28)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/python-discovery/commit/ca8d9380f9a1457c58dce44f0ef343c712a10275"><code>ca8d938</code></a> release 1.4.2</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/4f6132b672cb84a625501ebced7b999df77fc99d"><code>4f6132b</code></a> 🐛 fix: stop symlink resolution at stdlib landmark and framework builds (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/87">#87</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/95e6470f37a5467319d1bdd6c0c48af4aa987e6f"><code>95e6470</code></a> release 1.4.1</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/011f953446a517fba1b51ffcdab2f87084fc1116"><code>011f953</code></a> 🐛 fix: resolve executable-only symlinks in system_executable (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/85">#85</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/3a761d55bf43606cf09a7e23407c9e2017a91720"><code>3a761d5</code></a> build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/83">#83</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/5d3efc263319089ef8b276858976bc6040d47a32"><code>5d3efc2</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/81">#81</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/31365ac2971cad34a40766c687081fca3ef3e29d"><code>31365ac</code></a> build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/82">#82</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/834a3272c0706ff080bc8f52baafe57019cb660f"><code>834a327</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/80">#80</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/python-discovery/compare/1.4.0...1.4.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.4.2 to 21.4.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/releases">virtualenv's releases</a>.</em></p> <blockquote> <h2>21.4.3</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>ci: silence avoidable check workflow notices by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3154">pypa/virtualenv#3154</a></li> <li>Upgrade embedded pip/setuptools/wheel by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/pypa/virtualenv/pull/3155">pypa/virtualenv#3155</a></li> <li>Fish activator passes VIRTUAL_ENV through cygpath by <a href="https://github.com/LuNoX"><code>@LuNoX</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3161">pypa/virtualenv#3161</a></li> <li>Stop exporting PS1 in bash activator by <a href="https://github.com/karlhillx"><code>@karlhillx</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3162">pypa/virtualenv#3162</a></li> <li>Add wheel-0.47.0 to seed packages as mitigation of CVE-2026-24049 by <a href="https://github.com/apophizzz"><code>@apophizzz</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3167">pypa/virtualenv#3167</a></li> <li>🐛 fix(discovery): resolve base interpreter executable-only symlinks by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3166">pypa/virtualenv#3166</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/LuNoX"><code>@LuNoX</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/virtualenv/pull/3161">pypa/virtualenv#3161</a></li> <li><a href="https://github.com/karlhillx"><code>@karlhillx</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/virtualenv/pull/3162">pypa/virtualenv#3162</a></li> <li><a href="https://github.com/apophizzz"><code>@apophizzz</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/virtualenv/pull/3167">pypa/virtualenv#3167</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.4.2...21.4.3">https://github.com/pypa/virtualenv/compare/21.4.2...21.4.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's changelog</a>.</em></p> <blockquote> <h1>Bugfixes - 21.4.3</h1> <ul> <li> <p>Upgrade embedded wheels:</p> <ul> <li>pip to <code>26.1.2</code> from <code>26.1.1</code> (:issue:<code>u</code>)</li> </ul> </li> <li> <p>Resolve executable-only symlinks when recording <code>home</code> and <code>base-executable</code> in <code>pyvenv.cfg</code>, mirroring CPython's <code>getpath.realpath</code><code>python/cpython#115237</code> binary locate the base stdlib (for example python-build-standalone); a fully symlinked interpreter tree is kept as-is</p> <ul> <li>by :user:<code>gaborbernat</code>. (:issue:<code>3157</code>)</li> </ul> </li> <li> <p>Stop exporting <code>PS1</code> from the bash activator so child processes do not inherit shell prompt state. (:issue:<code>3158</code>)</p> </li> <li> <p>Handle CYGWIN/MSYS/MINGW path conversions in fish activation script - by user::<code>LuNoX</code>. (:issue:<code>3160</code>)</p> </li> </ul> <hr /> <p>v21.4.2 (2026-05-31)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/virtualenv/commit/134b080fae08c8eac719750d21c3449d3aa02aaa"><code>134b080</code></a> release 21.4.3</li> <li><a href="https://github.com/pypa/virtualenv/commit/2a36128bef8914ad006b49e5f1e2ca431dafa1cf"><code>2a36128</code></a> 🐛 fix(discovery): resolve base interpreter executable-only symlinks (<a href="https://redirect.github.com/pypa/virtualenv/issues/3166">#3166</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/5389c25cf4a1ee11ea55183d6daf4c8055dc3060"><code>5389c25</code></a> Add wheel-0.47.0 to seed packages as mitigation of CVE-2026-24049 (<a href="https://redirect.github.com/pypa/virtualenv/issues/3167">#3167</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/0134feeec7ba0bd1a6193dc6245934ee5e800774"><code>0134fee</code></a> chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (<a href="https://redirect.github.com/pypa/virtualenv/issues/3165">#3165</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/af1ed9fd10b67adbcfd9f9e542fdc5bfcdd6ea5b"><code>af1ed9f</code></a> chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/pypa/virtualenv/issues/3164">#3164</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/1b00ec8d284752f893e63fc752535cd7dc14b0c8"><code>1b00ec8</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/virtualenv/issues/3163">#3163</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/ce9729edbfc5b2f5fa2800def1ccc8e7c2d0f0be"><code>ce9729e</code></a> Stop exporting PS1 in bash activator (<a href="https://redirect.github.com/pypa/virtualenv/issues/3162">#3162</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/9e6f59fb2fbd96aba220f5858ae7114aeb353c65"><code>9e6f59f</code></a> Fish activator passes VIRTUAL_ENV through cygpath (<a href="https://redirect.github.com/pypa/virtualenv/issues/3161">#3161</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/a423028aa00bccb071efb72469f4dc0f05b27cfa"><code>a423028</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/virtualenv/issues/3156">#3156</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/f838c2120a0399dd2e2dec1ff38218672c7c8af8"><code>f838c21</code></a> Upgrade embedded pip/setuptools/wheel (<a href="https://redirect.github.com/pypa/virtualenv/issues/3155">#3155</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/virtualenv/compare/21.4.2...21.4.3">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…e_response benchmarks by file size (#12926)
Bumps [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) from 4.0.0 to 4.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/cibuildwheel/releases">pypa/cibuildwheel's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <ul> <li>✨ Updates Pyodide to the final 314.0.0 release, so Pyodide 3.14 wheels now build by default without the <code>pyodide-prerelease</code> <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code></a> flag. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2906">#2906</a>)</li> <li>🐛 Raises clear errors when a build produces no wheel, instead of failing later with a confusing message (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2909">#2909</a>)</li> <li>🛠 Speeds up CLI startup through lazy imports on Python 3.15 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2797">#2797</a>)</li> <li>📚 Adds an FAQ section on caching cibuildwheel's downloaded tools with <code>CIBW_CACHE_PATH</code> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2842">#2842</a>)</li> <li>📚 Documentation improvements: clarifies which shell is used for command options, clarifies environment variable precedence, and fixes a dead Pyodide env info link (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2904">#2904</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2905">#2905</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2911">#2911</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md">pypa/cibuildwheel's changelog</a>.</em></p> <blockquote> <h3>v4.1.0</h3> <p><em>12 June 2026</em></p> <ul> <li>✨ Updates Pyodide to the final 314.0.0 release, so Pyodide 3.14 wheels now build by default without the <code>pyodide-prerelease</code> <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code></a> flag. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2906">#2906</a>)</li> <li>🐛 Raises clear errors when a build produces no wheel, instead of failing later with a confusing message (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2909">#2909</a>)</li> <li>🛠 Speeds up CLI startup through lazy imports on Python 3.15 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2797">#2797</a>)</li> <li>📚 Adds an FAQ section on caching cibuildwheel's downloaded tools with <code>CIBW_CACHE_PATH</code> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2842">#2842</a>)</li> <li>📚 Documentation improvements: clarifies which shell is used for command options, clarifies environment variable precedence, and fixes a dead Pyodide env info link (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2904">#2904</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2905">#2905</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2911">#2911</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/cibuildwheel/commit/294735312765b09d24a2fbec22660ce817587d55"><code>2947353</code></a> Bump version: v4.1.0</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/14a3c3a226d33a726698c79f61a9dfb9b53353a7"><code>14a3c3a</code></a> Remove Travis pre-commit check</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/42aa1345c34b05d518c289cd281cdd950be67967"><code>42aa134</code></a> chore: minor cleanups and perf tweaks from code review (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2910">#2910</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/01265e5db05e25d3f3d7db043210586c9858d2f8"><code>01265e5</code></a> Clarify shell used for command options (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2904">#2904</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/f4afd95cbc1e597c8bc5511b6f6c7847bb1bfd57"><code>f4afd95</code></a> Add FAQ section on caching cibuildwheel's downloaded tools (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2842">#2842</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/6c08562aa1f64dbbabc8510a2041deba5a30a0ed"><code>6c08562</code></a> fix: faster CLI on Python 3.15 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2797">#2797</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/4f42ee3f03d8868b9acb76399ca2a67bfe7fad95"><code>4f42ee3</code></a> fix: raise clear errors when no wheel is produced (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2909">#2909</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/f3aa1bed4f054caad912a882d9ccf52a1f11bd05"><code>f3aa1be</code></a> Fix dead Pyodide env info link, remove mention of alpha ABI (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2911">#2911</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/d60fc2bdd00009b105a36de20997dc30b7afe664"><code>d60fc2b</code></a> Support new graalpy asset names that include Python version. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2863">#2863</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/55c8985c1269caeb261dd8f222a42451f7ee553f"><code>55c8985</code></a> docs: clarify environment precedence (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2905">#2905</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/cibuildwheel/compare/v4.0.0...v4.1.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pytest](https://github.com/pytest-dev/pytest) from 9.0.3 to 9.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest/releases">pytest's releases</a>.</em></p> <blockquote> <h2>9.1.0</h2> <h1>pytest 9.1.0 (2026-06-13)</h1> <h2>Removals and backward incompatible breaking changes</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14533">#14533</a>: When using <code>--doctest-modules</code>, autouse fixtures with <code>module</code>, <code>package</code> or <code>session</code> scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.</p> <p>If this is undesirable, move the fixture definition to a <code>conftest.py</code> file if possible.</p> <p>Technical explanation for those interested: When using <!-- raw HTML omitted -->--doctest-modules<!-- raw HTML omitted -->, pytest possibly collects Python modules twice, once as <code>pytest.Module</code> and once as a <code>DoctestModule</code> (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the <code>DoctestModule</code> collects a fixture, it is now visible to it only, and not to the <code>Module</code>. This means that both need to register the fixtures independently.</p> </li> </ul> <h2>Deprecations (removal in next major release)</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/10819">#10819</a>: Added a deprecation warning for class-scoped fixtures defined as instance methods (without <code>@classmethod</code>). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use <code>@classmethod</code> decorator instead -- by <code>yastcher</code>.</p> <p>See <code>10819</code> and <code>14011</code>.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/12882">#12882</a>: Calling <code>request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue></code> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.</p> <p>See <code>dynamic-fixture-request-during-teardown</code> for details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13409">#13409</a>: Using non-<code>~collections.abc.Collection</code> iterables (such as generators, iterators, or custom iterable objects) for the <code>argvalues</code> parameter in <code>@pytest.mark.parametrize <pytest.mark.parametrize ref></code> and <code>metafunc.parametrize <pytest.Metafunc.parametrize></code> is now deprecated.</p> <p>These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running <code>pytest.main()</code> multiple times, using class-level parametrize decorators, or collecting tests multiple times.</p> <p>See <code>parametrize-iterators</code> for details and suggestions.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13946">#13946</a>: The private <code>config.inicfg</code> attribute is now deprecated. Use <code>config.getini() <pytest.Config.getini></code> to access configuration values instead.</p> <p>See <code>config-inicfg</code> for more details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14004">#14004</a>: Passing <code>baseid</code> to <code>~pytest.FixtureDef</code> or <code>nodeid</code> strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.</p> <p>Use the <code>node</code> parameter instead for fixture scoping. This enables more robust node-based matching instead of string prefix matching. If you've used <code>nodeid=None</code>, pass <code>node=session</code> instead.</p> <p>This will be removed in pytest 10.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14335">#14335</a>: The method of configuring hooks using markers, deprecated since pytest 7.2, is now scheduled to be removed in pytest 10. See <code>hook-markers</code> for more details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14434">#14434</a>: The <code>--pastebin</code> option is now deprecated.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytest-dev/pytest/commit/b2522cf0b11fb33ecc1f4895fa1dffbb9252a63d"><code>b2522cf</code></a> Prepare release version 9.1.0</li> <li><a href="https://github.com/pytest-dev/pytest/commit/368d2fca78e86ac79ec269bb078fcb1259a94fed"><code>368d2fc</code></a> [refactor] Tighten <code>SetComparisonFunction</code> to <code>Iterator[str]</code> (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14587">#14587</a>)</li> <li><a href="https://github.com/pytest-dev/pytest/commit/ff77cd8b66b43a88c26ca54384bbcab72d079497"><code>ff77cd8</code></a> [refactor] Make base assertion comparisons return an iterator instead of a li...</li> <li><a href="https://github.com/pytest-dev/pytest/commit/0d8491a4ecf971800de0479ef55c7f5292c54937"><code>0d8491a</code></a> build(deps): Bump actions/stale from 10.2.0 to 10.3.0</li> <li><a href="https://github.com/pytest-dev/pytest/commit/4a809d9c892f6abb5ba92b77b06f1dd878f4660a"><code>4a809d9</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14568">#14568</a> from pytest-dev/register-fixture</li> <li><a href="https://github.com/pytest-dev/pytest/commit/5dfa38541becfb77d0f52cac4cc8cce71849ab61"><code>5dfa385</code></a> Fix recursion traceback test to cover all styles (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14582">#14582</a>)</li> <li><a href="https://github.com/pytest-dev/pytest/commit/f52ff0c1778c15038cf2bbb00b7668dac674cc26"><code>f52ff0c</code></a> Add <code>pytest.register_fixture</code></li> <li><a href="https://github.com/pytest-dev/pytest/commit/a8ac094e80df788aec844794170b126eab0be7a4"><code>a8ac094</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14567">#14567</a> from pytest-dev/more-visibility-deprecate</li> <li><a href="https://github.com/pytest-dev/pytest/commit/e5620cd21ec62f5a5f9a5141a3c76fb3953729b6"><code>e5620cd</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14577">#14577</a>)</li> <li><a href="https://github.com/pytest-dev/pytest/commit/2ce9c6d94eb691ea4da7f91f330602cbb67a6daf"><code>2ce9c6d</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14540">#14540</a> from minbang930/fix-14533-doctest-module-fixtures</li> <li>Additional commits viewable in <a href="https://github.com/pytest-dev/pytest/compare/9.0.3...9.1.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.4.3 to 21.5.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/releases">virtualenv's releases</a>.</em></p> <blockquote> <h2>21.5.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>Set git identity in upgrade changelog rename step by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3169">pypa/virtualenv#3169</a></li> <li>Upgrade embedded pip/setuptools/wheel by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/pypa/virtualenv/pull/3168">pypa/virtualenv#3168</a></li> <li>✨ feat: drop Python 3.8 support by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3170">pypa/virtualenv#3170</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.4.3...21.5.0">https://github.com/pypa/virtualenv/compare/21.4.3...21.5.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's changelog</a>.</em></p> <blockquote> <h1>Features - 21.5.0</h1> <ul> <li>Drop support for Python 3.8; virtualenv now requires Python 3.9 or later to run and to create environments. Remove the embedded <code>wheel</code> seed package, which virtualenv bundled only for Python 3.8. The <code>--wheel</code> and <code>--no-wheel</code> options stay as no-ops, but now warn that virtualenv will remove them in a release after 2026-12 - by :user:<code>gaborbernat</code>. (:issue:<code>3170</code>)</li> </ul> <h1>Bugfixes - 21.5.0</h1> <ul> <li> <p>Upgrade embedded wheels:</p> <p>Removed wheel of <code>0.47.0</code> (:issue:<code>u</code>)</p> </li> </ul> <hr /> <p>v21.4.3 (2026-06-11)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/virtualenv/commit/90735e08d69325adc25765ef3498df5fac334c07"><code>90735e0</code></a> release 21.5.0</li> <li><a href="https://github.com/pypa/virtualenv/commit/79ce906a2378e24c81a7b27ac506c73d5cc262d9"><code>79ce906</code></a> ✨ feat: drop Python 3.8 support (<a href="https://redirect.github.com/pypa/virtualenv/issues/3170">#3170</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/f1f4d687b12caac079d81ffc5ee50a16d1fabc1a"><code>f1f4d68</code></a> Upgrade embedded pip/setuptools/wheel (<a href="https://redirect.github.com/pypa/virtualenv/issues/3168">#3168</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/78df6f0873a89f8cc4ecb9378562e5eb74576e9f"><code>78df6f0</code></a> Set git identity in upgrade changelog rename step (<a href="https://redirect.github.com/pypa/virtualenv/issues/3169">#3169</a>)</li> <li>See full diff in <a href="https://github.com/pypa/virtualenv/compare/21.4.3...21.5.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [coverage](https://github.com/coveragepy/coveragepy) from 7.15.0 to 7.15.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coveragepy/coveragepy/releases">coverage's releases</a>.</em></p> <blockquote> <h2>7.15.1</h2> <h2>Version 7.15.1 — 2026-07-12</h2> <ul> <li>Fix: in the HTML report with <code>show_contexts</code> enabled, a context label containing <code></script></code> (for example a parametrized pytest node id) could close the inline <code><script></code> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2224">Rajath Mohare</a>.</li> <li>A number of performance improvements thanks to Paul Kehrer, in pull requests <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2213">2213</a>, <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2214">2214</a>, <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2215">2215</a>, <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2216">2216</a>, <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2218">2218</a>, <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2220">2220</a>, and <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2221">2221</a>.</li> </ul> <p>:arrow_right: PyPI page: <a href="https://pypi.org/project/coverage/7.15.1">coverage 7.15.1</a>. :arrow_right: To install: <code>python3 -m pip install coverage==7.15.1</code></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst">coverage's changelog</a>.</em></p> <blockquote> <h2>Version 7.15.1 — 2026-07-12</h2> <ul> <li> <p>Fix: in the HTML report with <code>show_contexts</code> enabled, a context label containing <code></script></code> (for example a parametrized pytest node id) could close the inline <code><script></code> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, <code>Rajath Mohare <pull 2224_></code>_.</p> </li> <li> <p>A number of performance improvements thanks to Paul Kehrer, in pull requests <code>2213 <pull 2213_></code><em>, <code>2214 <pull 2214_></code></em>, <code>2215 <pull 2215_></code><em>, <code>2216 <pull 2216_></code></em>, <code>2218 <pull 2218_></code><em>, <code>2220 <pull 2220_></code></em>, and <code>2221 <pull 2221_></code>_.</p> </li> </ul> <p>.. _pull 2213: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2213">coveragepy/coveragepy#2213</a> .. _pull 2214: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2214">coveragepy/coveragepy#2214</a> .. _pull 2215: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2215">coveragepy/coveragepy#2215</a> .. _pull 2216: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2216">coveragepy/coveragepy#2216</a> .. _pull 2218: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2218">coveragepy/coveragepy#2218</a> .. _pull 2220: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2220">coveragepy/coveragepy#2220</a> .. _pull 2221: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2221">coveragepy/coveragepy#2221</a> .. _pull 2224: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2224">coveragepy/coveragepy#2224</a></p> <p>.. _changes_7-15-0:</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coveragepy/coveragepy/commit/da63bedb76085eddd4819900b39557407086dc12"><code>da63bed</code></a> docs: sample HTML for 7.15.1</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/bc35e64344e0737f6c71dee6cff59da0ad72c30f"><code>bc35e64</code></a> docs: prep for 7.15.1</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/182b010b63a2661c86df1ca3b3f84ce8511ee435"><code>182b010</code></a> perf: resolve sysmon branch events lazily, one pair at a time (<a href="https://redirect.github.com/coveragepy/coveragepy/issues/2221">#2221</a>)</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/ee271ee21fdf4c169648ff4ad3e9dd9d163e5e7f"><code>ee271ee</code></a> perf: compute multiline maps cheaply in the sysmon core (<a href="https://redirect.github.com/coveragepy/coveragepy/issues/2220">#2220</a>)</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/1441b960c698d591d3a22a2190635039320459de"><code>1441b96</code></a> chore: bump the action-dependencies group with 6 updates (<a href="https://redirect.github.com/coveragepy/coveragepy/issues/2225">#2225</a>)</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/dd806350de678c9e4f137ffdda5cb131d269019c"><code>dd80635</code></a> fix: escape context labels in html report inline script block (<a href="https://redirect.github.com/coveragepy/coveragepy/issues/2224">#2224</a>)</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/7c3ae71ca654a0b0e3184d8574aefd9dd511a006"><code>7c3ae71</code></a> docs: normalize earlier history order (<a href="https://redirect.github.com/coveragepy/coveragepy/issues/2222">#2222</a>)</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/088dc601697077364c46967f3ac9afe3bde0083b"><code>088dc60</code></a> chore: make upgrade</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/f7e15a8e31bd98d8f89a7e4602fa6b8bd7c5e468"><code>f7e15a8</code></a> test: upload .json and .xml coverage reports</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/3b6211214d7033e86b88a6e032474c20b7c32814"><code>3b62112</code></a> docs: thanks, Paul Kehrer</li> <li>Additional commits viewable in <a href="https://github.com/coveragepy/coveragepy/compare/7.15.0...7.15.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4 to 4.37.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>v4.36.3</h2> <p>No user facing changes.</p> <h2>v4.36.2</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>v4.36.1</h2> <p>No user facing changes.</p> <h2>v4.36.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>v4.35.5</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>v4.35.4</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>v4.35.3</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <h2>v4.35.2</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <h2>v4.35.1</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>v4.35.0</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a> from github/update-v4.37.0-c7c896d71</li> <li><a href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a> Add changenote for <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li> <li><a href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a> Update changelog for v4.37.0</li> <li><a href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a> from github/update-bundle/codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a> Update default bundle to codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a> from github/mbg/repo-props/config-file-shorthands</li> <li><a href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a> Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...</li> <li><a href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a> Thread <code>ActionState</code> to <code>initConfig</code></li> <li><a href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a> Mark some <code>status-report</code> imports as <code>type</code>-only to avoid circular dependencies</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/v4...v4.37.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.6.0 to 21.6.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/releases">virtualenv's releases</a>.</em></p> <blockquote> <h2>21.6.1</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix(fish): harden prompt against shadowed builtins by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3185">pypa/virtualenv#3185</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.6.0...21.6.1">https://github.com/pypa/virtualenv/compare/21.6.0...21.6.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's changelog</a>.</em></p> <blockquote> <h1>Bugfixes - 21.6.1</h1> <ul> <li>Harden the fish activator prompt against user functions that shadow builtins. Routing <code>functions</code>, <code>printf</code>, <code>string</code>, <code>echo</code> and <code>source</code>/<code>.</code> through <code>builtin</code> stops a shadowing function (such as a dot-style directory navigator that redefines <code>.</code>) from hijacking the prompt and dropping the previous command's exit status, matching the CPython fix in <code>[gh-140006](https://github.com/pypa/virtualenv/issues/140006) <https://github.com/python/cpython/issues/140006></code>_. (:issue:<code>3185</code>)</li> </ul> <hr /> <p>v21.6.0 (2026-07-06)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/virtualenv/commit/544ca3d8b08188e8329570c88b362956496aaeec"><code>544ca3d</code></a> release 21.6.1</li> <li><a href="https://github.com/pypa/virtualenv/commit/3abee98f928981c19240f506401e92a15960e20c"><code>3abee98</code></a> 🐛 fix(fish): harden prompt against shadowed builtins (<a href="https://redirect.github.com/pypa/virtualenv/issues/3185">#3185</a>)</li> <li>See full diff in <a href="https://github.com/pypa/virtualenv/compare/21.6.0...21.6.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/releases">softprops/action-gh-release's releases</a>.</em></p> <blockquote> <h2>v3.0.2</h2> <p><code>3.0.2</code> is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since <code>3.0.1</code>.</p> <p>This release fixes <a href="https://redirect.github.com/softprops/action-gh-release/issues/795">#795</a>, <a href="https://redirect.github.com/softprops/action-gh-release/issues/438">#438</a>, and <a href="https://redirect.github.com/softprops/action-gh-release/issues/803">#803</a>. The upload transport hardening covers the historical failure reported in <a href="https://redirect.github.com/softprops/action-gh-release/issues/790">#790</a>, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to <a href="https://redirect.github.com/softprops/action-gh-release/issues/786">#786</a> and does not claim a reproducible release-creation fix.</p> <h2>What's Changed</h2> <h3>Exciting New Features 🎉</h3> <ul> <li>feat: improve release error reporting and test coverage by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/813">softprops/action-gh-release#813</a></li> </ul> <h3>Bug fixes 🐛</h3> <ul> <li>fix: publish existing draft releases as prereleases by <a href="https://github.com/godfengliang"><code>@godfengliang</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/801">softprops/action-gh-release#801</a></li> <li>fix: upload small checksum assets reliably by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/815">softprops/action-gh-release#815</a></li> <li>fix: replace existing release assets on Gitea by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/816">softprops/action-gh-release#816</a></li> <li>fix: clarify release creation 404 errors by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/817">softprops/action-gh-release#817</a></li> </ul> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): upgrade TypeScript to 7 by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/812">softprops/action-gh-release#812</a></li> <li>chore(deps): remove unused TypeScript tooling by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/814">softprops/action-gh-release#814</a></li> <li>dependency, Node 24 pin, and CI maintenance merged since <code>3.0.1</code></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md">softprops/action-gh-release's changelog</a>.</em></p> <blockquote> <h2>3.0.2</h2> <p><code>3.0.2</code> is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since <code>3.0.1</code>.</p> <p>This release fixes <a href="https://redirect.github.com/softprops/action-gh-release/issues/795">#795</a>, <a href="https://redirect.github.com/softprops/action-gh-release/issues/438">#438</a>, and <a href="https://redirect.github.com/softprops/action-gh-release/issues/803">#803</a>. The upload transport hardening covers the historical failure reported in <a href="https://redirect.github.com/softprops/action-gh-release/issues/790">#790</a>, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to <a href="https://redirect.github.com/softprops/action-gh-release/issues/786">#786</a> and does not claim a reproducible release-creation fix.</p> <h2>What's Changed</h2> <h3>Exciting New Features 🎉</h3> <ul> <li>feat: improve release error reporting and test coverage by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/813">softprops/action-gh-release#813</a></li> </ul> <h3>Bug fixes 🐛</h3> <ul> <li>fix: publish existing draft releases as prereleases by <a href="https://github.com/godfengliang"><code>@godfengliang</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/801">softprops/action-gh-release#801</a></li> <li>fix: upload small checksum assets reliably by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/815">softprops/action-gh-release#815</a></li> <li>fix: replace existing release assets on Gitea by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/816">softprops/action-gh-release#816</a></li> <li>fix: clarify release creation 404 errors by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/817">softprops/action-gh-release#817</a></li> </ul> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): upgrade TypeScript to 7 by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/812">softprops/action-gh-release#812</a></li> <li>chore(deps): remove unused TypeScript tooling by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/814">softprops/action-gh-release#814</a></li> <li>dependency, Node 24 pin, and CI maintenance merged since <code>3.0.1</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/softprops/action-gh-release/commit/3d0d9888cb7fd7b750713d6e236d1fcb99157228"><code>3d0d988</code></a> release 3.0.2 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/818">#818</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/7e13ed4ac596a4adf801d3812be5a089356949aa"><code>7e13ed4</code></a> fix: clarify release creation 404 errors (<a href="https://redirect.github.com/softprops/action-gh-release/issues/817">#817</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/e6c70a53cf67373fbff7eeebca7782b4fe8f106c"><code>e6c70a5</code></a> fix: replace existing release assets on Gitea (<a href="https://redirect.github.com/softprops/action-gh-release/issues/816">#816</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/f3453378888d5ef6208e2788af1c5ba50d8a898d"><code>f345337</code></a> fix: publish existing draft releases as prereleases (<a href="https://redirect.github.com/softprops/action-gh-release/issues/801">#801</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/d8a89a206684ded8435bf16d6f698bf04ab05164"><code>d8a89a2</code></a> fix: upload small checksum assets reliably (<a href="https://redirect.github.com/softprops/action-gh-release/issues/815">#815</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/45ece40c3178522904ac6c51c21d8a4e3565f3c8"><code>45ece40</code></a> chore(deps): remove unused TypeScript tooling (<a href="https://redirect.github.com/softprops/action-gh-release/issues/814">#814</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/f6b913c3f95302d88e8ef7cb2859c2e7656aa01e"><code>f6b913c</code></a> feat: improve release error reporting and test coverage (<a href="https://redirect.github.com/softprops/action-gh-release/issues/813">#813</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/15f193d7d8aa9623b5181913a31fafceb4e8cef9"><code>15f193d</code></a> chore(deps): upgrade TypeScript to 7 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/812">#812</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/cc8268d46a81d57ec9b061f27b0dd68ebd7fb17f"><code>cc8268d</code></a> chore(deps): bump actions/checkout in the github-actions group (<a href="https://redirect.github.com/softprops/action-gh-release/issues/810">#810</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/fd0ed1e85b6730f87f5c67d7355751c46ad513d6"><code>fd0ed1e</code></a> chore(deps): bump the npm group with 3 updates (<a href="https://redirect.github.com/softprops/action-gh-release/issues/811">#811</a>)</li> <li>Additional commits viewable in <a href="https://github.com/softprops/action-gh-release/compare/v3.0.1...v3.0.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 6.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add RHEL support and include Linux distro in cache keys by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li> <li>Fix pip cache error handling on Windows by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li> <li>Upgrade actions dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li>Upgrade dependency versions and test workflow configuration by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li> </ul> <h3>Documentation</h3> <ul> <li>Update advanced-usage.md by <a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li><a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p> <h2>v6.2.0</h2> <h2>What's Changed</h2> <h3>Dependency Upgrades</h3> <ul> <li>Upgrade dependencies to Node 24 compatible versions by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li> <li>Upgrade urllib3 from 2.5.0 to 2.6.3 in <code>/__tests__/data</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1253">actions/setup-python#1253</a> and <a href="https://redirect.github.com/actions/setup-python/pull/1264">actions/setup-python#1264</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v6.2.0">https://github.com/actions/setup-python/compare/v6...v6.2.0</a></p> <h2>v6.1.0</h2> <h2>What's Changed</h2> <h3>Enhancements:</h3> <ul> <li>Add support for <code>pip-install</code> input by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1201">actions/setup-python#1201</a></li> <li>Add graalpy early-access and windows builds by <a href="https://github.com/timfel"><code>@timfel</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/880">actions/setup-python#880</a></li> </ul> <h3>Dependency and Documentation updates:</h3> <ul> <li>Enhanced wording and updated example usage for <code>allow-prereleases</code> by <a href="https://github.com/yarikoptic"><code>@yarikoptic</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/979">actions/setup-python#979</a></li> <li>Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1139">actions/setup-python#1139</a></li> <li>Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1094">actions/setup-python#1094</a></li> <li>Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1199">actions/setup-python#1199</a></li> <li>Upgrade requests from 2.32.2 to 2.32.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1130">actions/setup-python#1130</a></li> <li>Upgrade prettier from 3.5.3 to 3.6.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1234">actions/setup-python#1234</a></li> <li>Upgrade <code>@types/node</code> from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1235">actions/setup-python#1235</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yarikoptic"><code>@yarikoptic</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/979">actions/setup-python#979</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v6.1.0">https://github.com/actions/setup-python/compare/v6...v6.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/actions/setup-python/compare/v6...v6.3.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.29.7 to 3.30.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/py-filelock/releases">filelock's releases</a>.</em></p> <blockquote> <h2>3.30.2</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>Document every lock type, and stop evicting a marker we cannot read by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/672">tox-dev/filelock#672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.30.1...3.30.2">https://github.com/tox-dev/filelock/compare/3.30.1...3.30.2</a></p> <h2>3.30.1</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>📝 docs: separate changelog releases with a blank line by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/668">tox-dev/filelock#668</a></li> <li>🐛 fix: tolerate NFSv3 stale handle in strict claim read by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/669">tox-dev/filelock#669</a></li> <li>Match fork-reset protocol on the class object by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/671">tox-dev/filelock#671</a></li> <li>reject non-finite lease duration in marker records by <a href="https://github.com/dxbjavid"><code>@dxbjavid</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/670">tox-dev/filelock#670</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.30.0...3.30.1">https://github.com/tox-dev/filelock/compare/3.30.0...3.30.1</a></p> <h2>3.30.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🎨 style: readability cleanup across the library by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/598">tox-dev/filelock#598</a></li> <li>🐛 fix(api): ignore lifetime on native OS locks by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/593">tox-dev/filelock#593</a></li> <li>🐛 fix(unix): don't mutate lock file before acquiring flock by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/594">tox-dev/filelock#594</a></li> <li>soft: evict a non-regular lock file without reading it by <a href="https://github.com/dxbjavid"><code>@dxbjavid</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/597">tox-dev/filelock#597</a></li> <li>🐛 fix(windows): bind reparse-point check to the locked handle by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/596">tox-dev/filelock#596</a></li> <li>🐛 fix(api): make native lock release transactional by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/615">tox-dev/filelock#615</a></li> <li>🐛 fix(soft): make marker writes and cleanup transactional by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/614">tox-dev/filelock#614</a></li> <li>🐛 fix(windows): open the lock file through NtCreateFile by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/617">tox-dev/filelock#617</a></li> <li>✨ feat(api): add context_error_policy for dual context failures by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/618">tox-dev/filelock#618</a></li> <li>📝 docs: correct Unix lock-file cleanup and flock claims by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/623">tox-dev/filelock#623</a></li> <li>✨ feat(api): add close_error_policy for post-unlock close errors by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/619">tox-dev/filelock#619</a></li> <li>🐛 fix(api): canonicalize singleton keys without following a final symlink by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/621">tox-dev/filelock#621</a></li> <li>✨ feat(unix): add fallback_to_soft opt-out for native locks by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/622">tox-dev/filelock#622</a></li> <li>✨ feat: add lock_descriptor for a caller-owned descriptor by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/620">tox-dev/filelock#620</a></li> <li>✨ feat(api): add preserve_lock_file to keep the lock pathname by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/624">tox-dev/filelock#624</a></li> <li>✨ feat(api): add on_acquired post-acquisition hook by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/625">tox-dev/filelock#625</a></li> <li>🔧 build(release): towncrier changelog pipeline, backfill, and docs by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/626">tox-dev/filelock#626</a></li> <li>📝 docs: drop bot entries and link code refs in the changelog by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/638">tox-dev/filelock#638</a></li> <li>🐛 fix(api): validate lifetime values by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/644">tox-dev/filelock#644</a></li> <li>🐛 fix(win32): capture process probe errors by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/645">tox-dev/filelock#645</a></li> <li>🐛 fix(api): reject dropped lock options by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/646">tox-dev/filelock#646</a></li> <li>🐛 fix(api): retain acquisition path identity by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/647">tox-dev/filelock#647</a></li> <li>🐛 fix(api): detach grouped release errors by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/648">tox-dev/filelock#648</a></li> <li>🐛 fix(descriptor): define unavailable behavior by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/650">tox-dev/filelock#650</a></li> <li>🐛 fix(ci): map absolute coverage paths by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/651">tox-dev/filelock#651</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst">filelock's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <p>.. towncrier-draft-entries:: Unreleased</p> <p>.. towncrier release notes start</p> <hr /> <p>3.31.1 (2026-07-20)</p> <hr /> <ul> <li>A <code>SoftFileLease</code> acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:<code>680</code></li> </ul> <hr /> <p>3.31.0 (2026-07-18)</p> <hr /> <ul> <li>Support Termux/Android, whose CPython ships without <code>os.link</code> and reports <code>sys.platform == "android"</code>. <code>import filelock</code> and both <code>FileLock</code> and <code>SoftFileLock</code> now work there, <code>StrictSoftFileLock</code> reports its missing hard-link support only when acquired, and process liveness reads <code>/proc</code> on Android instead of PID-only checks. :pr:<code>678</code></li> <li><code>StrictSoftFileLock</code> no longer lets two processes hold the lock at once under heavy contention. A holder now keeps its intent claim for the whole hold, so a contender whose directory scan races the holder's freshly linked claim can no longer miss it and win alongside it. A held lock now exposes both an <code>intent</code> and a <code>held</code> claim. :pr:<code>678</code></li> </ul> <hr /> <p>3.30.3 (2026-07-17)</p> <hr /> <ul> <li><code>AsyncFileLock</code> and <code>AsyncSoftFileLock</code> no longer raise a deadlock <code>RuntimeError</code> when a different asyncio task waits for a lock they hold; the check now scopes holders to the owning task, so only a same-task reacquire is refused. :pr:<code>676</code></li> <li>Keep both tables of contents on screen at any browser font size. The widened body column sized itself in <code>em</code> against the reader's font size while the breakpoints that fold the layout resolve <code>em</code> against a fixed 16px, so a reader whose default font is larger than 16px had the right-hand table of contents clipped off the edge. The body column now flexes instead, and the right-hand table of contents hides only at the mobile breakpoint. :pr:<code>673</code></li> <li>Color the mermaid diagrams from whichever theme is active. They previously carried a light palette baked into each diagram's source, which stayed light on a dark page. :pr:<code>674</code></li> </ul> <hr /> <p>3.30.2 (2026-07-16)</p> <hr /> <ul> <li>Stop :class:<code>~filelock.SoftFileLease</code> deleting a live marker whose <code>mode</code> it does not implement. An unrecognized mode now names its owner instead of reading as malformed, so a record written by a newer filelock survives the grace window rather than being evicted after two seconds. :pr:<code>672</code></li> <li>Stop :class:<code>~filelock.StrictSoftFileLock</code> and :class:<code>~filelock.AsyncStrictSoftFileLock</code> calling themselves a native OS lock when they warn that they ignore <code>lifetime</code>; they now say a strict claim is only ever cleared by <code>force_break()</code>. :pr:<code>672</code></li> <li>Cover every lock type in the tutorials and how-to guides, with examples drawn from projects that use filelock, and color the mermaid diagrams. Correct the claims that <code>StrictSoftFileLock</code> exposes <code>owner</code>, that :class:<code>~filelock.SoftFileLock</code> evicts a strict sentinel, that :class:<code>~filelock.ReadWriteLock</code> requires a <code>.db</code> extension, and that every log record is <code>DEBUG</code>. :pr:<code>672</code></li> </ul> <hr /> <p>3.30.1 (2026-07-16)</p> <hr /> <ul> <li><code>StrictSoftFileLock</code> and <code>AsyncStrictSoftFileLock</code> no longer abort acquisition when a peer's claim vanishes as an</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/filelock/commit/9a71d061458d18742be9c55170dd4465f8edf1c7"><code>9a71d06</code></a> Release 3.30.2</li> <li><a href="https://github.com/tox-dev/filelock/commit/0dfa1b20fb9d85051e3304d3674787bea297b2d1"><code>0dfa1b2</code></a> Document every lock type, and stop evicting a marker we cannot read (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/672">#672</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/47d435f9458a70da803001ebbd424ca03f1afe41"><code>47d435f</code></a> Release 3.30.1</li> <li><a href="https://github.com/tox-dev/filelock/commit/9b7b3b14027a385f8c636b7ee2ecfd3d052bdca0"><code>9b7b3b1</code></a> reject non-finite lease duration in marker records (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/670">#670</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/cfafd70e9118ded6bda9d643ebbedfff12ae46f2"><code>cfafd70</code></a> Match fork-reset protocol on the class object (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/671">#671</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/e4c0eb3d3139bba28daeedc42ee1c7686a98d7bd"><code>e4c0eb3</code></a> 🐛 fix: tolerate NFSv3 stale handle in strict claim read (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/669">#669</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/d0450d5a32962be1cc2419495392beb90891dbaf"><code>d0450d5</code></a> 📝 docs: separate changelog releases with a blank line (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/668">#668</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/1b094069044a3f2a39173ae841eb22b274833ff9"><code>1b09406</code></a> Release 3.30.0</li> <li><a href="https://github.com/tox-dev/filelock/commit/5f2d6639c652a87cfb081bc4b5e05485a76aa675"><code>5f2d663</code></a> 👷 ci(matrix): add SMB, capability, and matrix docs (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/665">#665</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/2345750ae0ee346c9fce9d9ba93cbb089963224c"><code>2345750</code></a> Replace prettier with mdformat and yamlfmt (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/667">#667</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tox-dev/py-filelock/compare/3.29.7...3.30.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [coverage](https://github.com/coveragepy/coveragepy) from 7.15.1 to 7.15.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coveragepy/coveragepy/releases">coverage's releases</a>.</em></p> <blockquote> <h2>7.15.2</h2> <h2>Version 7.15.2 — 2026-07-15</h2> <ul> <li>Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes <a href="https://redirect.github.com/coveragepy/coveragepy/issues/2229">issue 2229</a>.</li> </ul> <p>:arrow_right: PyPI page: <a href="https://pypi.org/project/coverage/7.15.2">coverage 7.15.2</a>. :arrow_right: To install: <code>python3 -m pip install coverage==7.15.2</code></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst">coverage's changelog</a>.</em></p> <blockquote> <h2>Version 7.15.2 — 2026-07-15</h2> <ul> <li>Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes <code>issue 2229</code>_.</li> </ul> <p>.. _issue 2229: <a href="https://redirect.github.com/coveragepy/coveragepy/issues/2229">coveragepy/coveragepy#2229</a></p> <p>.. _changes_7-15-1:</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coveragepy/coveragepy/commit/50d865908dfeb21a0bf1e6f05db578c11662f8dd"><code>50d8659</code></a> docs: sample HTML for 7.15.2</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/b5eed20618cfae07b35328b09dab388e9900f409"><code>b5eed20</code></a> docs: prep for 7.15.2</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/78cab6e1770e55951c84a78d80b90c60ccfba4d5"><code>78cab6e</code></a> fix: reduce memory use during reporting. <a href="https://redirect.github.com/coveragepy/coveragepy/issues/2229">#2229</a> (<a href="https://redirect.github.com/coveragepy/coveragepy/issues/2231">#2231</a>)</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/b4c1fda244a04caaa940ae77dd476a8bedfbf38e"><code>b4c1fda</code></a> build: bump version to 7.15.2</li> <li>See full diff in <a href="https://github.com/coveragepy/coveragepy/compare/7.15.1...7.15.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.0 to 4.37.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/7188fc363630916deb702c7fdcf4e481b751f97a"><code>7188fc3</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4020">#4020</a> from github/update-v4.37.1-9e7c07009</li> <li><a href="https://github.com/github/codeql-action/commit/c8b5f69be686908c3dfd844428137d56fe80c936"><code>c8b5f69</code></a> Update changelog for v4.37.1</li> <li><a href="https://github.com/github/codeql-action/commit/9e7c070092090e89e8b3d62f977d4456e0732cd7"><code>9e7c070</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4014">#4014</a> from github/mbg/explicit-remote-prefix</li> <li><a href="https://github.com/github/codeql-action/commit/3492b7e9ab96e28b1d8b971345d30e929c6f8fee"><code>3492b7e</code></a> Change <code>REMOTE_PATH_PREFIX</code> to <code>remote=</code></li> <li><a href="https://github.com/github/codeql-action/commit/3654baa924bc6456db54002581cb7c1c877548c4"><code>3654baa</code></a> Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix</li> <li><a href="https://github.com/github/codeql-action/commit/2d682ac05f1b3588aaff3814826bede39b9ba6bb"><code>2d682ac</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4017">#4017</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/23f6a50753a88efd9b7ae8687b29f6bdb65f6250"><code>23f6a50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4009">#4009</a> from github/mbg/action-state/additions</li> <li><a href="https://github.com/github/codeql-action/commit/1ee3c75d1988ab8621f01ebb165115c38d56df91"><code>1ee3c75</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4018">#4018</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/e053684dc500899b0b5520edc8549ac0f1ed730b"><code>e053684</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4015">#4015</a> from github/dependabot/npm_and_yarn/npm-minor-fd2e83...</li> <li><a href="https://github.com/github/codeql-action/commit/6803c5671d2f87a83ed96e151c441b1cb3bdc66a"><code>6803c56</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4019">#4019</a> from github/update-bundle/codeql-bundle-v2.26.1</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/v4.37.0...v4.37.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!--pre-commit.ci start--> updates: - [github.com/codespell-project/codespell: v2.4.2 → v2.4.3](codespell-project/codespell@v2.4.2...v2.4.3) <!--pre-commit.ci end--> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )