[dependabot]

Bumps the pip group with 1 update in the / directory: datamodel-code-generator.
Bumps the pip group with 3 updates in the /scripts/ci/reporting_interop/python directory: mcp, opentelemetry-api and filelock.

Updates datamodel-code-generator from 0.64.0 to 0.81.0

Release notes

Sourced from datamodel-code-generator's releases.

0.81.0

Breaking Changes

Code Generation Changes

• Undeclared required keys now retained in variant runtime validation - When combining --read-only-write-only-model-type request/response variants with --schema-validator-type runtime validators, generated models now keep runtime validation rules for required keys that are not declared as properties (for example keys required via additionalProperties or if/then/else), whereas these rules were previously dropped from the variant models. Regenerated Request and Response models therefore enforce stricter validation and may reject payloads that the previously generated validators accepted (#4055)

What's Changed

• Fix parser template data reuse by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4054
• Fix required validation in request and response models by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4055
• Share JSON Schema reference rewriting across inputs by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4057
• Move output model decisions out of parsers by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4058
• Move output configuration out of parsers by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4059
• Guard output policy and private parser boundaries by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4060

Full Changelog: datamodel-code-generator/datamodel-code-generator@0.80.0...0.81.0

0.80.0

Breaking Changes

Code Generation Changes

• Python union annotations preserve unsupported member types - When generating from Python input models, unions containing members such as Callable retain each member type and the original union order instead of repeating the first non-null type. Regenerated annotations change for the affected unions and nested containers. (#3947)
• Optional nested factories require a callable empty constructor - With --use-default-factory-for-optional-nested-models, an optional child with required constructor fields, including inherited fields, keeps its normal None or UNSET default instead of receiving a factory that fails when called without arguments. (#3953)
• Safe frozen set items use native Pydantic hash generation - Safely hashable frozen Pydantic v2 models used as set or frozenset items rely on the native hash in place of the explicit identity-hash assignment. Mutable models and models outside the supported safe cases retain the previous generated hash behavior. (#4025)
• GraphQL msgspec typename fields retain separate inherited slots - For affected GraphQL inheritance collisions, generated models keep inherited synthetic typename slots separate from colliding child user fields, which receive distinct Python names while retaining their wire aliases. Python attribute names in these affected hierarchies can differ from earlier output. (#4045)
• Constrained root aliases retain their validation - With --use-root-model-type-alias, constraints are retained in the alias where supported; affected roots otherwise use a RootModel class instead of an unconstrained alias. Unconstrained aliases retain their prior form, and an existing custom root-alias template keeps its selection and remains responsible for its own constraints. (#3962)
• Eligible compound property names use string key types - Eligible string alternatives in propertyNames generate inline constrained string key types instead of nested-model keys. This changes ordinary key annotations for affected schemas; custom schema runtime validators remain conditional on --schema-validator-type pydantic-v2. (#3970)
• Opt-in schema validators enforce undeclared required names - With --schema-validator-type pydantic-v2, required property names absent from generated fields are checked against the raw object input, including applicable pattern intersections. Payloads missing those required names are rejected where the previous validators accepted them; this fix does not add a validator when the option is disabled. (#3988)
• Mapped allOf roots retain compatible constraints - For affected allOf roots with an outer format or type mapping, compatible numeric or string constraints are preserved while constraints incompatible with the mapped runtime type are omitted. Regenerated annotations change for these roots and avoid applying incompatible constraints to date, UUID, or other mapped values. (#4043)

... (truncated)

Changelog

Sourced from datamodel-code-generator's changelog.

0.81.0 - 2026-09-14

Breaking Changes

Code Generation Changes

• Undeclared required keys now retained in variant runtime validation - When combining --read-only-write-only-model-type request/response variants with --schema-validator-type runtime validators, generated models now keep runtime validation rules for required keys that are not declared as properties (for example keys required via additionalProperties or if/then/else), whereas these rules were previously dropped from the variant models. Regenerated Request and Response models therefore enforce stricter validation and may reject payloads that the previously generated validators accepted (#4055)

What's Changed

• Fix parser template data reuse by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4054
• Fix required validation in request and response models by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4055
• Share JSON Schema reference rewriting across inputs by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4057
• Move output model decisions out of parsers by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4058
• Move output configuration out of parsers by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4059
• Guard output policy and private parser boundaries by @​koxudaxi in datamodel-code-generator/datamodel-code-generator#4060

Full Changelog: datamodel-code-generator/datamodel-code-generator@0.80.0...0.81.0

---

0.80.0 - 2026-09-12

Breaking Changes

Code Generation Changes

• Python union annotations preserve unsupported member types - When generating from Python input models, unions containing members such as Callable retain each member type and the original union order instead of repeating the first non-null type. Regenerated annotations change for the affected unions and nested containers. (#3947)
• Optional nested factories require a callable empty constructor - With --use-default-factory-for-optional-nested-models, an optional child with required constructor fields, including inherited fields, keeps its normal None or UNSET default instead of receiving a factory that fails when called without arguments. (#3953)
• Safe frozen set items use native Pydantic hash generation - Safely hashable frozen Pydantic v2 models used as set or frozenset items rely on the native hash in place of the explicit identity-hash assignment. Mutable models and models outside the supported safe cases retain the previous generated hash behavior. (#4025)
• GraphQL msgspec typename fields retain separate inherited slots - For affected GraphQL inheritance collisions, generated models keep inherited synthetic typename slots separate from colliding child user fields, which receive distinct Python names while retaining their wire aliases. Python attribute names in these affected hierarchies can differ from earlier output. (#4045)
• Constrained root aliases retain their validation - With --use-root-model-type-alias, constraints are retained in the alias where supported; affected roots otherwise use a RootModel class instead of an unconstrained alias. Unconstrained aliases retain their prior form, and an existing custom root-alias template keeps its selection and remains responsible for its own constraints. (#3962)
• Eligible compound property names use string key types - Eligible string alternatives in propertyNames generate inline constrained string key types instead of nested-model keys. This changes ordinary key annotations for affected schemas; custom schema runtime validators remain conditional on --schema-validator-type pydantic-v2. (#3970)
• Opt-in schema validators enforce undeclared required names - With --schema-validator-type pydantic-v2, required property names absent from generated fields are checked against the raw object input, including applicable pattern intersections. Payloads missing those required names are rejected where the previous validators accepted them; this fix does not add a validator when the option is disabled. (#3988)
• Mapped allOf roots retain compatible constraints - For affected allOf roots with an outer format or type mapping, compatible numeric or string constraints are preserved while constraints incompatible with the mapped runtime type are omitted. Regenerated annotations change for these roots and avoid applying incompatible constraints to date, UUID, or other mapped values. (#4043)
• Eligible property-name alternatives use constrained string keys - For supported propertyNames alternatives combining ordinary string constraints with non-string-only branches, generated dictionary keys use the applicable constrained string type instead of retaining the non-string alternatives. References, complex patterns, and unsupported cases retain the existing fallback. (#4046)

... (truncated)

Commits

• be170f7 docs: update release benchmark data (#4053)
• 5492ae9 Fix payload runtime compatibility (#4063)
• 4401cc7 Guard output policy and private parser boundaries (#4060)
• 6c800fc Move output configuration out of parsers (#4059)
• 203d5b2 Move output model decisions out of parsers (#4058)
• 45df98a Share JSON Schema reference rewriting across inputs (#4057)
• 19b9465 Fix required validation in request and response models (#4055)
• 0966214 Fix parser template data reuse (#4054)
• 5e94b8f Merge commit from fork
• 834731d docs: update release benchmark data (#4052)
• Additional commits viewable in compare view

Updates mcp from 2.0.0 to 2.2.0

Release notes

Sourced from mcp's releases.

v2.2.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

A few defaults changed in this release. If you run a server or client on 2.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3397)

• Client("https://..."), streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
• A redirect anywhere else is not followed: the call fails with MCPError and the session stays usable (an SSE connect fails with httpx2.HTTPStatusError). If that other URL is the server you meant, use it as the endpoint URL.
• The follow_redirects setting on an httpx2.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
• The OAuth providers apply the same rule to their own requests.

Idle Streamable HTTP sessions now expire (legacy <=2025-11-25 spec( (#3395)

• A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
• Clients that keep the GET stream open (the SDK's Client does) are not affected. Neither are stateless servers or 2026-07-28 connections.
• A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
• To turn either off: mcp.run(transport="streamable-http", session_idle_timeout=None, max_sessions=None) (also on streamable_http_app() and run_streamable_http_async()).

The OAuth client checks the authorization server's issuer on the legacy path too (#3398)

• For servers without protected resource metadata, authorization server metadata whose issuer isn't the server's own origin is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch. The protected-resource-metadata path has done this since 2.0.
• A 403 that isn't an insufficient_scope challenge is returned to the caller instead of retried.
• If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new MCPDeprecationWarnings (#3435, #3447)

• ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL; 3.0 will require it.
• AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False; 3.0 defaults it to True.
• Both keep working as before in 2.x; this mostly matters if your tests turn warnings into errors.

New

• AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3447).
• issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3398).
• session_idle_timeout= and max_sessions= on the Streamable HTTP server entry points (#3395).

Fixes

• A client DELETE frees its session immediately, and a refused opening request no longer leaves a session behind (#2455, #3228, #3300).
• $refs in a tool's outputSchema resolve within that schema only; an unresolvable one surfaces as RuntimeError: Invalid schema for tool ... (#3394).

Known gaps

The tasks extension (SEP-2663), DPoP (SEP-1932) and the jwt-bearer grant are not implemented yet; https://github.com/modelcontextprotocol/python-sdk/blob/main/ROADMAP.md tracks them.

What's Changed

• Gate draft PRs too and rewrite the auto-close comment by @​maxisbey in modelcontextprotocol/python-sdk#3378
• Resolve tool output-schema references within the schema document only by @​maxisbey in modelcontextprotocol/python-sdk#3394
• Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @​maxisbey in modelcontextprotocol/python-sdk#3395
• Validate the authorization server metadata issuer on every discovery path by @​maxisbey in modelcontextprotocol/python-sdk#3398

... (truncated)

Commits

• 9972c21 Replace RootModel wrappers with type aliases and TypeAdapter validation (#3470)
• fd66270 docs: refresh translations, and translate pages in parallel (#3458)
• 08a3bc8 docs: ask for AI disclosure on comments too (#3459)
• 7bb486a docs: stop presenting the in-memory client as the way to connect (#3443)
• 0c91368 Add AuthSettings.validate_token_resource to check a bearer token's resource (...
• 9771e6b Keep following a relative redirect when the endpoint URL carries userinfo (#3...
• a925e55 Bump the locked versions of eight dev and test dependencies (#3449)
• e8b9486 Bump pymdown-extensions from 11.0 to 11.0.1 (#3285)
• c6762e8 Follow redirects only within the MCP endpoint's origin (#3397)
• 5fd3abc Skip automatic docs previews for fork PRs and drop the setup-uv retry steps (...
• Additional commits viewable in compare view

Updates opentelemetry-api from 1.44.0 to 1.45.1

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Version 1.45.0/0.66b0

Added

• opentelemetry-exporter-prometheus: add support to configure Resource attributes as metric labels (#5122)
• infra: add renovate (#5202)
• opentelemetry-api, opentelemetry-sdk: add support for extended attribute values everywhere. (#5266)
• opentelemetry-sdk: wire the top-level log_level field in declarative configuration — when set, maps the OTel SeverityNumber value to a Python logging level and applies it to the opentelemetry logger so SDK internal diagnostics respect the configured severity. (#5351)
• opentelemetry-sdk: add the new stable AlwaysRecordSampler (#5354)
• opentelemetry-configuration, opentelemetry-sdk: wire top-level attribute_limits into per-signal providers via declarative config; add log_record_limits support to LoggerProvider (#5365)
• opentelemetry-exporter-otlp-json-http: add OTLP JSON HTTP exporter package (#5374)
• opentelemetry-api, opentelemetry-sdk: add enabled() support to the Logger API, SDK, and LogRecordProcessor to let instrumentation skip expensive work when logging is disabled (#5380)
• opentelemetry-exporter-otlp-json-file: add OTLP JSON file Docker tests (#5412)
• opentelemetry-configuration: wire the experimental tracer_configurator/development, meter_configurator/development and logger_configurator/development fields into create_tracer_provider, create_meter_provider and create_logger_provider, so per-instrumentation-scope enabled overrides declared in the config file are applied to the provider (previously these fields were parsed but silently discarded). The logger minimum_severity/trace_based fields are not supported by the Python SDK and are ignored with a warning. (#5418)
• docs/examples: add example on how to manually setup the SDK to get SDK metrics (#5449)
• opentelemetry-docker-tests: add Prometheus exporter docker tests (#5457)
• opentelemetry-sdk: count records dropped after shutdown on otel.sdk.processor.{span,log}.processed with error.type=already_shutdown (batch span/log and simple log processors), which the semantic conventions define as a valid value for this metric. (#5509)
• opentelemetry-semantic-conventions: update semantic conventions to v1.44.0 (#5511)
• opentelemetry-sdk: add host.id to the host resource detector (#5653)
• opentelemetry-test-utils: add CapturingSampler to record what samplers receive in instrumentation tests (#5681)

Changed

• Enable PIE (flake8-pie) ruff rule and fix all violations (#5150)
• The public opentelemetry.util.types.AttributeValue type in package opentelemetry-api is being expanded to include None, heterogeneous sequences of primitive types (and nested sequences) as opposed to only homogeneous primitive sequences, and Mappings of strings to any primitive types or sequences/mappings (which themselves must only contain primitive types or sequences/mappings validated the same way). If a bytes type is set as an attribute value in the SDK, it will no longer be utf-8 decoded to a string, instead it will be passed along as is in accordance with the OTEL spec, since bytes is a valid type in the OTLP proto. (#5266)
• opentelemetry-exporter-otlp-proto-http: add a max_request_size argument to the OTLP HTTP exporters (traces, logs, metrics); serialized requests larger than the limit are dropped before sending, measured before compression. Defaults to 64 MiB (enabled); set to 0 to disable. Mirrors opentelemetry-go#8157. (#5369)
• [BREAKING] opentelemetry-api: subclasses of Logger need to implement the enabled method (#5380)
• opentelemetry-exporter-otlp-proto-http: refactor to use shared opentelemetry-exporter-otlp-common and opentelemetry-exporter-http-transport packages and switch default HTTP backend to urllib3 (#5389)
• opentelemetry-sdk: unify logging force_flush timeout defaults to 30000ms (#5438)
• opentelemetry-python: enable Ruff default ruleset and fix auto-fixable lint issues (#5491)
• opentelemetry-sdk: SimpleSpanProcessor now drops spans ended after shutdown() instead of passing them to the exporter, and counts them on otel.sdk.processor.span.processed with error.type=already_shutdown. (#5512)
• Bump pytest to 9.0.3 (#5518)
• opentelemetry-exporter-otlp-proto-http: clarify that the endpoint= kwarg requires the full signal path (#5633)
• opentelemetry-sdk: fix typos in SpanLimits docstring (#5658)

Fixed

• opentelemetry-configuration: perform environment variable substitution on scalar values after parsing the configuration file, so ${VAR} references inside comments and mapping keys are no longer substituted and undefined references in comments no longer abort loading (#5407)
• opentelemetry-configuration: declarative config environment variable substitution now replaces an unset variable that has no default with an empty value instead of raising an error, per the configuration spec. Resource attributes whose value resolves to null (an unset ${VAR} with no default) are skipped with a warning instead of being inserted as a null value. (#5408)
• 'scripts/build.sh: add opentelemetry-configurationandopentelemetry-proto-json` to the package to release (#5425)
• opentelemetry-sdk: fix View instrument-name matching so a view configured with an instrument's real (mixed-case) name is applied; matching is now case-insensitive and platform-independent instead of relying on fnmatch's OS-dependent case handling (#5430)

... (truncated)

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Version 1.45.0/0.66b0 (2026-09-25)

Added

• opentelemetry-exporter-prometheus: add support to configure Resource attributes as metric labels (#5122)
• infra: add renovate (#5202)
• opentelemetry-api, opentelemetry-sdk: add support for extended attribute values everywhere. (#5266)
• opentelemetry-sdk: wire the top-level log_level field in declarative configuration — when set, maps the OTel SeverityNumber value to a Python logging level and applies it to the opentelemetry logger so SDK internal diagnostics respect the configured severity. (#5351)
• opentelemetry-sdk: add the new stable AlwaysRecordSampler (#5354)
• opentelemetry-configuration, opentelemetry-sdk: wire top-level attribute_limits into per-signal providers via declarative config; add log_record_limits support to LoggerProvider (#5365)
• opentelemetry-exporter-otlp-json-http: add OTLP JSON HTTP exporter package (#5374)
• opentelemetry-api, opentelemetry-sdk: add enabled() support to the Logger API, SDK, and LogRecordProcessor to let instrumentation skip expensive work when logging is disabled (#5380)
• opentelemetry-exporter-otlp-json-file: add OTLP JSON file Docker tests (#5412)
• opentelemetry-configuration: wire the experimental

... (truncated)

Commits

• 14971ce Prepare release 1.45.1/0.66b1 (#5752)
• 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
• a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
• d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
• db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
• 4f0fcfa Prepare release 1.45.0/0.66b0 (#5690)
• 9406f34 opentelemetry-test-utils: add CapturingSampler for instrumentation tests (#5681)
• 1fe31a9 fix: update W3CBaggagePropagator to properly handle whitespace (#5680)
• 008b5b0 feat(config): wire top-level attribute_limits into per-signal providers (#5365)
• edfad0c [opentelemetry-sdk] Fix overwriting of the service.instance.id which has been...
• Additional commits viewable in compare view

Updates filelock from 4.0.1 to 4.2.1

Release notes

Sourced from filelock's releases.

4.2.1

• On a singleton wrapper, close> and close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #832
• ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins its queue no longer blocks every later call on that lock. #833
• Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #834
• Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. #835
• Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no longer carry group or other write bits. A process name containing a carriage return or another line separator no longer makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check no longer compares start times and keeps the marker. #836
• The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat recorded a lost hold, it refuses new acquires until that hold is released. #838
• StrictSoftFileLock creates <path>.filelock and its claims directory with the lock's mode and sets the sticky bit (a directory flag that lets only a file's owner remove it) on both. On the next acquisition it narrows a directory it owns that an earlier release created wider; it leaves a directory of another account as it is, so remove such leftovers by hand. It reaches claims through a descriptor opened without following symlinks; on Windows it holds both directories open and refuses a junction (a directory that points at another directory). Under a sticky parent such as /tmp it refuses a coordination directory of another account, as SoftReadWriteLock does for <path>.rw. One read grace now covers a whole claim scan, a failed claim cleanup no longer leaves the sentinel descriptor open, and a non-regular node at a sentinel private-record name raises SoftFileLockProtocolError. On Windows, contenders read claims without blocking their owner's unlink. #839

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.2.4 (2026-10-19)

---

• Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. :pr:863

---

4.2.3 (2026-10-19)

---

• Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:860
• Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

---

4.2.2 (2026-10-18)

---

• Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

---

4.2.1 (2026-10-17)

---

• On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
• :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
• Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database

... (truncated)

Commits

• 60331bb Release 4.2.1
• 834bf13 🧪 test(soft): skip Unix pin test on Windows
• 9d15e38 fix(soft-rw): isolate subclass singleton registries (#855)
• e1e825b 🐛 fix(open): keep lock files intact, honor deadlines and mode (#835)
• 5e3f2ec 🐛 fix(read-write): keep SQLite off shared names, bound schema (#834)
• bfa066d 🐛 fix(strict): keep claim directories private to the lock (#839)
• 977d2c3 🐛 fix(soft): wait on an empty marker instead of evicting (#846)
• 740ff66 🐛 fix(soft): break stale markers without emptying the lock path (#843)
• 86c6d5f 🐛 fix(async): honor cancellation and per-thread gates (#844)
• eeceaa8 🐛 fix(soft): keep live holders when owner identity differs (#836)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[bokelley]

Closing without merging, for the same reasons #1538 was deferred.

• datamodel-code-generator 0.64.0 → 0.81.0: the pin is exact on purpose. The generator's class numbering shifts between releases, so an upgrade has to regenerate src/adcp/types/ in the same change. This PR bumps the pin without regenerating. Upgrading the generator is a deliberate SDK 10 decision, covered by the codegen plan (docs/v10-codegen-plan.md, docs(types): plan the SDK 10 codegen fidelity and wire round-trip work #1649 against next). It's a dev-only tool and isn't shipped in the wheel.
• scripts/ci/reporting_interop/python/requirements-*.txt: these files are frozen interop controls. Each one pins the installed environment that one reporting interop check verifies, so a bump breaks the control (the 5 failing checks here) and fixes nothing in a shipped artifact.

#1650 (merged as dad3282) extends .github/dependabot.yml so Dependabot ignores every dependency in the interop Python directory and ignores datamodel-code-generator at the root, for both pip and uv. Ignore rules also cover security updates, so this PR shouldn't come back. Every other root dependency still gets security updates.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml