[pull] master from aio-libs:master - #719
Merged
Merged
Conversation
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 9.0.0 to 10.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.0.1 🌈 Tolerate transient manifest timeouts</h2> <h2>Changes</h2> <p>Thank you <a href="https://github.com/arguile"><code>@arguile</code></a>- for making this action more resilient.</p> <h2>🐛 Bug fixes</h2> <ul> <li>Tolerate transient manifest timeouts <a href="https://github.com/arguile"><code>@arguile</code></a>- (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.12.4 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.0.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> </ul> <h2>v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features</h2> <h2>Changes</h2> <p>Another breaking release, directly after v9.0.0 but we think the added security justifies that.</p> <h3>Extra security by default</h3> <p>If you use the default <code>enable-cache: auto</code> this will now <strong>DISABLE THE CACHE</strong> to protect against cache poisoning for the following events:</p> <ul> <li><code>pull_request_target</code></li> <li><code>workflow_run</code></li> <li><code>release</code></li> </ul> <p>You can read the full reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/984">astral-sh/setup-uv#984</a></p> <h3><code>version: latest-known</code></h3> <pre lang="yaml"><code>- name: Install the latest version of uv known to setup-uv uses: astral-sh/setup-uv@v10.0.0 with: version: "latest-known" </code></pre> <p>This will now install the latest version with a checksum that is known by this action. The <a href="https://github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts">known <code>uv</code> checksums</a> are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.</p> <h3>Read python version from <code>.tool-versions</code></h3> <pre lang="yaml"><code>- name: Install uv based on the version defined in .tool-versions and also set python uses: astral-sh/setup-uv@v10.0.0 with: version-file: "pyproject.toml" </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/20cfd1bf945f4377ade1205e4dbc17946fc9a30d"><code>20cfd1b</code></a> chore: update known checksums for 0.12.4 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/d73a0cab66a532d7afa440d9df4a67ea9fe65a30"><code>d73a0ca</code></a> Tolerate transient manifest timeouts (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae3b92d1bdb308a10adfe7b8f408e5cc8c30f3f6"><code>ae3b92d</code></a> docs: update version references to v10.0.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d"><code>ae62891</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1013">#1013</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f9cdb47d487aee2be8925d1e57290177ad9e1ac2"><code>f9cdb47</code></a> Reject paths in .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1007">#1007</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4f6036f71cec78afb113b323f220c9185d983c12"><code>4f6036f</code></a> Require pull requests for Dependabot rollups (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1005">#1005</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8d6402c9b71205b2d8d0b82de531d8fed8430182"><code>8d6402c</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1004">#1004</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/46f427bd47c794e99536b75ffaa9f27602425027"><code>46f427b</code></a> Read Python version from .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/996">#996</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8ed89c51143f65ea13eaba62db51dbb8ea52d0a3"><code>8ed89c5</code></a> ci: pin Alpine container image (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/995">#995</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8473c7fea42cdfd540f4b01317a17ac5f54126ae"><code>8473c7f</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/994">#994</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/v9.0.0...v10.0.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pip-tools](https://github.com/jazzband/pip-tools) from 7.6.0 to 7.6.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jazzband/pip-tools/releases">pip-tools's releases</a>.</em></p> <blockquote> <h2>v7.6.1</h2> <h3>Bug fixes</h3> <ul> <li> <p>Fixed handling of index URLs ending in <code>/simple/</code> by improving URL normalization logic. These URLs would previously make <code>pip-compile</code> fail to use the PyPI JSON API.</p> <p>-- by <a href="https://github.com/sirosen"><code>@sirosen</code></a></p> <p><em>PRs and issues:</em> <a href="https://redirect.github.com/jazzband/pip-tools/issues/1669">#1669</a></p> </li> <li> <p>Added a missing dependency on <code>typing-extensions</code> for Python 3.9 and 3.10 -- by <a href="https://github.com/sirosen"><code>@sirosen</code></a>.</p> <p><em>PRs and issues:</em> <a href="https://redirect.github.com/jazzband/pip-tools/issues/2424">#2424</a></p> </li> </ul> <h3>Features</h3> <ul> <li> <p>pip-tools is now compatible with pip version 26.2 -- by <a href="https://github.com/sirosen"><code>@sirosen</code></a>.</p> <p><em>PRs and issues:</em> <a href="https://redirect.github.com/jazzband/pip-tools/issues/2436">#2436</a>, <a href="https://redirect.github.com/jazzband/pip-tools/issues/2437">#2437</a></p> </li> </ul> <h3>Improved documentation</h3> <ul> <li><code>pip-tools</code> documentation now features a how-to section, featuring initial docs which cover controlling output file headers and configuring completion -- by <a href="https://github.com/sirosen"><code>@sirosen</code></a>.</li> </ul> <h3>Contributor-facing changes</h3> <ul> <li> <p>Fixed CI triggers so that release tags won't create spurious failing runs -- by <a href="https://github.com/sirosen"><code>@sirosen</code></a>.</p> <p><em>PRs and issues:</em> <a href="https://redirect.github.com/jazzband/pip-tools/issues/2421">#2421</a></p> </li> <li> <p>Refactored the bug report template for better reporting -- by <a href="https://github.com/psthindal"><code>@psthindal</code></a>.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jazzband/pip-tools/blob/main/CHANGELOG.md">pip-tools's changelog</a>.</em></p> <blockquote> <h2>v7.6.1</h2> <p><em>2026-08-11</em></p> <h3>Bug fixes</h3> <ul> <li> <p>Fixed handling of index URLs ending in <code>/simple/</code> by improving URL normalization logic. These URLs would previously make <code>pip-compile</code> fail to use the PyPI JSON API.</p> <p>-- by {user}<code>sirosen</code></p> <p><em>PRs and issues:</em> {issue}<code>1669</code></p> </li> <li> <p>Added a missing dependency on {pypi}<code>typing-extensions</code> for Python 3.9 and 3.10 -- by {user}<code>sirosen</code>.</p> <p><em>PRs and issues:</em> {issue}<code>2424</code></p> </li> </ul> <h3>Features</h3> <ul> <li> <p>pip-tools is now compatible with pip version 26.2 -- by {user}<code>sirosen</code>.</p> <p><em>PRs and issues:</em> {issue}<code>2436</code>, {issue}<code>2437</code></p> </li> </ul> <h3>Improved documentation</h3> <ul> <li><code>pip-tools</code> documentation now features a how-to section, featuring initial docs which cover controlling output file headers and configuring completion -- by {user}<code>sirosen</code>.</li> </ul> <h3>Contributor-facing changes</h3> <ul> <li> <p>Fixed CI triggers so that release tags won't create spurious failing runs -- by {user}<code>sirosen</code>.</p> <p><em>PRs and issues:</em> {issue}<code>2421</code></p> </li> <li> <p>Refactored the bug report template for better reporting -- by {user}<code>psthindal</code>.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jazzband/pip-tools/commit/5bc5ded0b685637d6dffb926c00829220b4c6834"><code>5bc5ded</code></a> Merge pull request <a href="https://redirect.github.com/jazzband/pip-tools/issues/2448">#2448</a> from sirosen/release/v7.6.1</li> <li><a href="https://github.com/jazzband/pip-tools/commit/bde325c946f4f8317782310b5607d9dba734ad63"><code>bde325c</code></a> Update changelog for v7.6.1</li> <li><a href="https://github.com/jazzband/pip-tools/commit/2f62a446a6ff780ba10b8fda133c59b900fdd753"><code>2f62a44</code></a> Merge pull request <a href="https://redirect.github.com/jazzband/pip-tools/issues/2438">#2438</a> from sirosen/support-pip-26-2</li> <li><a href="https://github.com/jazzband/pip-tools/commit/a37111927f6865add0baf1f143b072cf9ebf93a1"><code>a371119</code></a> Slightly modify exc_types var name, per review</li> <li><a href="https://github.com/jazzband/pip-tools/commit/b62ac68053b87e810d73084663cd3edfbdeff198"><code>b62ac68</code></a> Merge pull request <a href="https://redirect.github.com/jazzband/pip-tools/issues/2447">#2447</a> from jazzband/pre-commit-ci-update-config</li> <li><a href="https://github.com/jazzband/pip-tools/commit/041bf6f970b0a61cacc90c2d50bed375b9a30228"><code>041bf6f</code></a> Update tests/unit/_internal/pip_api/test_package_finder.py</li> <li><a href="https://github.com/jazzband/pip-tools/commit/9f5d1f3a8fd2a9c2d2682ffb3ccb9be0fd47ddf1"><code>9f5d1f3</code></a> Improve internal names and docs for pip_api</li> <li><a href="https://github.com/jazzband/pip-tools/commit/d50abd79d4fb8a390c007e16ab8647d9c1abe495"><code>d50abd7</code></a> [pre-commit.ci] pre-commit autoupdate</li> <li><a href="https://github.com/jazzband/pip-tools/commit/e8703da9fd613cece46c27c9c06684bed2296ff0"><code>e8703da</code></a> Fix a test which improperly formulated file URIs</li> <li><a href="https://github.com/jazzband/pip-tools/commit/f467ee50113189b9c53e8ec1253eb18f56030717"><code>f467ee5</code></a> Bump pipsupported version + add changelog</li> <li>Additional commits viewable in <a href="https://github.com/jazzband/pip-tools/compare/v7.6.0...v7.6.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [typing-inspection](https://github.com/pydantic/typing-inspection) from 0.4.3 to 0.4.4. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/typing-inspection/blob/main/HISTORY.md">typing-inspection's changelog</a>.</em></p> <blockquote> <h2>v0.4.4 (2026-08-12)</h2> <ul> <li>Add <code>typing_objects.DEPRECATED_ALIASES_ID</code> by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/typing-inspection/pull/63">#63</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/typing-inspection/commit/83d4dbb74fc367db4403c76be8c0f83cd4b63fbe"><code>83d4dbb</code></a> Prepare release v0.4.4 (<a href="https://redirect.github.com/pydantic/typing-inspection/issues/64">#64</a>)</li> <li><a href="https://github.com/pydantic/typing-inspection/commit/3ac9791f1db368a859a516dcf8b2bea271bd0ac2"><code>3ac9791</code></a> Fixes to <code>DEPRECATED_ALIASES_IDS</code> (<a href="https://redirect.github.com/pydantic/typing-inspection/issues/65">#65</a>)</li> <li><a href="https://github.com/pydantic/typing-inspection/commit/382616cb7cb85df8c567450c7a89f1cbdf77ebf5"><code>382616c</code></a> Add <code>typing_objects.DEPRECATED_ALIASES_IDS</code> (<a href="https://redirect.github.com/pydantic/typing-inspection/issues/63">#63</a>)</li> <li><a href="https://github.com/pydantic/typing-inspection/commit/cef71bad4c364a52acd0fb4739df9f3121f29c76"><code>cef71ba</code></a> Fix docs publish CI job (<a href="https://redirect.github.com/pydantic/typing-inspection/issues/62">#62</a>)</li> <li><a href="https://github.com/pydantic/typing-inspection/commit/7b09e7a78fec04b6d9cd32af423c1d5ad4e671cf"><code>7b09e7a</code></a> Fix coverage CI job (<a href="https://redirect.github.com/pydantic/typing-inspection/issues/61">#61</a>)</li> <li>See full diff in <a href="https://github.com/pydantic/typing-inspection/compare/v0.4.3...v0.4.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.6 to 4.37.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a> from github/update-v4.37.7-be7a3dbb8</li> <li><a href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a> Update changelog for v4.37.7</li> <li><a href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a> from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li> <li><a href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a> from github/mbg/thread-action-state-to-codeql</li> <li><a href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a> Bump the npm-minor group across 1 directory with 8 updates</li> <li><a href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a> Drop <code>logger</code> from <code>databaseInitCluster</code> in interface</li> <li><a href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a> from github/update-bundle/codeql-bundle-v2.26.3</li> <li><a href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a> Make <code>logger</code> available to <code>getCodeQLForCmd</code></li> <li><a href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a> from github/navntoft/bump-undici</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/v4.37.6...v4.37.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [charset-normalizer](https://github.com/jawah/charset_normalizer) from 3.4.9 to 3.5.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jawah/charset_normalizer/releases">charset-normalizer's releases</a>.</em></p> <blockquote> <h2>Version 3.5.0</h2> <h2><a href="https://github.com/Ousret/charset_normalizer/compare/3.4.9...3.5.0">3.5.0</a> (2026-08-12)</h2> <h3>Added</h3> <ul> <li>Explicit support for Python 3.15</li> </ul> <h3>Fixed</h3> <ul> <li>Comparing a CharsetMatch to a non-alias encoding strings (<a href="https://redirect.github.com/jawah/charset_normalizer/issues/773">#773</a>)</li> <li>Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (<a href="https://redirect.github.com/jawah/charset_normalizer/issues/774">#774</a>)</li> <li>A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.</li> <li>iso2022* cases misdetected due to a flaw in our multibyte chunking logic.</li> </ul> <h3>Changed</h3> <ul> <li>Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.</li> <li>Applied micro-optimization on several utils.</li> <li>CharsetMatches no longer sort on each match insertion.</li> </ul> <h3>Misc</h3> <ul> <li>Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md">charset-normalizer's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/Ousret/charset_normalizer/compare/3.4.9...3.5.0">3.5.0</a> (2026-08-12)</h2> <h3>Added</h3> <ul> <li>Explicit support for Python 3.15</li> </ul> <h3>Fixed</h3> <ul> <li>Comparing a CharsetMatch to a non-alias encoding strings (<a href="https://redirect.github.com/jawah/charset_normalizer/issues/773">#773</a>)</li> <li>Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (<a href="https://redirect.github.com/jawah/charset_normalizer/issues/774">#774</a>)</li> <li>A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.</li> <li>iso2022* cases misdetected due to a flaw in our multibyte chunking logic.</li> </ul> <h3>Changed</h3> <ul> <li>Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.</li> <li>Applied micro-optimization on several utils.</li> <li>CharsetMatches no longer sort on each match insertion.</li> </ul> <h3>Misc</h3> <ul> <li>Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jawah/charset_normalizer/commit/3325d87c3c73fa1a8746947151faaf9a41177543"><code>3325d87</code></a> Merge pull request <a href="https://redirect.github.com/jawah/charset_normalizer/issues/792">#792</a> from jawah/update-cibuildwheel-action</li> <li><a href="https://github.com/jawah/charset_normalizer/commit/77203b104216a6d578a682b5ac0514750aa988f7"><code>77203b1</code></a> chore: reformat noxfile.py</li> <li><a href="https://github.com/jawah/charset_normalizer/commit/8561c227ba3789c24ad3fde08d23ad85693b4d98"><code>8561c22</code></a> chore(deps): bump github/codeql-action/upload-sarif (<a href="https://redirect.github.com/jawah/charset_normalizer/issues/787">#787</a>)</li> <li><a href="https://github.com/jawah/charset_normalizer/commit/25248df4e75c376d60e307d73a628c57b7db1743"><code>25248df</code></a> chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (<a href="https://redirect.github.com/jawah/charset_normalizer/issues/789">#789</a>)</li> <li><a href="https://github.com/jawah/charset_normalizer/commit/3eaaf3e6f58b43c12fc4b90ced195d1ac05338e0"><code>3eaaf3e</code></a> chore: enable cp315t in ci</li> <li><a href="https://github.com/jawah/charset_normalizer/commit/fbe9fc4f4cb9d1ae415b24e601eaa97c3fe4072e"><code>fbe9fc4</code></a> chore: update cibuildwheel for py315 by default</li> <li><a href="https://github.com/jawah/charset_normalizer/commit/5c7b82afd16e7c5ceda36ea47f996703d776bf08"><code>5c7b82a</code></a> chore: add emscripten classifier</li> <li><a href="https://github.com/jawah/charset_normalizer/commit/7d30c21fe0cfffeae7858631751fa828f040c300"><code>7d30c21</code></a> chore: skip pyodide tests cibw</li> <li><a href="https://github.com/jawah/charset_normalizer/commit/417d66f3d4fa779f4e9075e3fae12f16fb468283"><code>417d66f</code></a> Merge pull request <a href="https://redirect.github.com/jawah/charset_normalizer/issues/791">#791</a> from jawah/patch-1</li> <li><a href="https://github.com/jawah/charset_normalizer/commit/130afd55951e7c8bfe4043b192403b384d6c3827"><code>130afd5</code></a> chore: perf script initial warm with big5 dummy content</li> <li>Additional commits viewable in <a href="https://github.com/jawah/charset_normalizer/compare/3.4.9...3.5.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.2 to 3.32.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/py-filelock/releases">filelock's releases</a>.</em></p> <blockquote> <h2>3.32.3</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🧪 test(strict): deflake close-fault injections on graalpy by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/697">tox-dev/filelock#697</a></li> <li>📄 docs: publish llms.txt from the docs build by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/700">tox-dev/filelock#700</a></li> <li>🐛 fix(fork): survive audit events during interpreter shutdown by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/703">tox-dev/filelock#703</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.32.2...3.32.3">https://github.com/tox-dev/filelock/compare/3.32.2...3.32.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst">filelock's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <p>.. towncrier-draft-entries:: Unreleased</p> <p>.. towncrier release notes start</p> <hr /> <p>3.32.3 (2026-08-13)</p> <hr /> <ul> <li>The fork-safety audit hook no longer prints <code>Exception ignored in audit hook</code> with a <code>TypeError</code> when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:<code>701</code></li> </ul> <hr /> <p>3.32.2 (2026-07-29)</p> <hr /> <ul> <li>A <code>SoftReadWriteLock</code> or <code>SoftFileLease</code> acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:<code>691</code></li> </ul> <hr /> <p>3.32.1 (2026-07-26)</p> <hr /> <ul> <li>Canceling an <code>AsyncSoftReadWriteLock</code> acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:<code>686</code></li> </ul> <hr /> <p>3.32.0 (2026-07-21)</p> <hr /> <ul> <li><code>SoftReadWriteLock</code> closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:<code>685</code></li> <li>Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:<code>683</code></li> <li>The source distribution ships the capability probes the tests import, and reading one no longer needs <code>coverage</code> installed, so the suite runs from an unpacked sdist instead of failing on a missing <code>coverage_pragmas</code>. :pr:<code>685</code></li> </ul> <hr /> <p>3.31.2 (2026-07-21)</p> <hr /> <ul> <li><code>filelock</code> imports again on runtimes whose <code>errno</code> omits <code>ENOTSUP</code>, such as GraalPy, where importing the package raised <code>ImportError</code>. It probes the code instead, preferring <code>ENOTSUP</code>, falling back to <code>EOPNOTSUPP</code> where that name is absent, and dropping to <code>ENOSYS</code>/<code>EXDEV</code> where neither exists. Platforms defining <code>ENOTSUP</code> keep their behavior. :pr:<code>681</code></li> </ul> <hr /> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/filelock/commit/4aa742ca0992135fe21df290c8e9023f6981bb6f"><code>4aa742c</code></a> Release 3.32.3</li> <li><a href="https://github.com/tox-dev/filelock/commit/fb5ab3eee603f352772d33c01a3a319f10c54959"><code>fb5ab3e</code></a> 🐛 fix(fork): survive audit events during interpreter shutdown (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/703">#703</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/35f759c93ec81aecf10d9e3cad5d20ec358f2b96"><code>35f759c</code></a> 📄 docs: publish llms.txt from the docs build (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/700">#700</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/4b6e966a4488807e9148d28d539fe6093fd54362"><code>4b6e966</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/699">#699</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/0e0f666c7d5d0a2e8231eac3c463ecd6a05d3f73"><code>0e0f666</code></a> build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/698">#698</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/6689d821726689295e62c59db2de00d05b6dae94"><code>6689d82</code></a> 🧪 test(strict): deflake close-fault injections on graalpy (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/697">#697</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/df67bf7697c59e29faa40484d54488922a380cac"><code>df67bf7</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/696">#696</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/py-filelock/compare/3.32.2...3.32.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[//]: # (dependabot-start)⚠️ **Dependabot is rebasing this PR**⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [aiofastnet](https://github.com/tarasko/aiofastnet) from 1.0.5 to 1.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tarasko/aiofastnet/releases">aiofastnet's releases</a>.</em></p> <blockquote> <h2>1.1.0</h2> <ul> <li>Added missing support for AF_UNIX addresses to SelectorDatagramTransport.sendto</li> <li>Added async sock_* methods. Implemented on top of read/write socket readiness.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tarasko/aiofastnet/blob/master/HISTORY.rst">aiofastnet's changelog</a>.</em></p> <blockquote> <h2>1.1.0</h2> <ul> <li>Added missing support for AF_UNIX addresses to SelectorDatagramTransport.sendto</li> <li>Added async sock_* methods. Implemented on top of read/write socket readiness.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tarasko/aiofastnet/commit/5582e02c9547ad8b576ab745c1ad9c8073426863"><code>5582e02</code></a> Minor</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/07f2b88d06c5d10560e1ea8bf4ed452a2c945a30"><code>07f2b88</code></a> Add sock_* API</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/0825eadedd9d34e89fa80285d0ca8d3e35cb9c9d"><code>0825ead</code></a> Fix tests</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/7c822a28aecb2eaa03b0859ecb36ff77847b23a7"><code>7c822a2</code></a> Expand udp tests on windows</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/a572ded37a597cc36023ce97946e216cd5e7c5cd"><code>a572ded</code></a> Update tests</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/922a6469998ea52915e4e6dd6ac8fedba27e0b1d"><code>922a646</code></a> Update</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/ce0e28b987c37f2ac1f0c7b35f8fa14672b5f7f6"><code>ce0e28b</code></a> Fix tests on macos</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/5cd63f40ae28608e0b4d60ca8057726257d63c01"><code>5cd63f4</code></a> Update README and version</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/6e28182ba9617cff4409f3c6d1835be006c1829a"><code>6e28182</code></a> Improve coverage</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/b8fa93f6cd3cbcf66adfd6ab6e10cb05172b09a6"><code>b8fa93f</code></a> Improve coverage</li> <li>Additional commits viewable in <a href="https://github.com/tarasko/aiofastnet/compare/v1.0.5...v1.1.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.1 to 4.11.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/platformdirs/releases">platformdirs's releases</a>.</em></p> <blockquote> <h2>4.11.3</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>📄 docs: publish llms.txt from the docs build by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/522">tox-dev/platformdirs#522</a></li> <li>fix: don't crash when an XDG dirs variable holds only separators by <a href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/523">tox-dev/platformdirs#523</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/platformdirs/compare/4.11.2...4.11.3">https://github.com/tox-dev/platformdirs/compare/4.11.2...4.11.3</a></p> <h2>4.11.2</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>fix: stop the remaining iter_*_dirs yielding duplicate or joined paths by <a href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/520">tox-dev/platformdirs#520</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/platformdirs/compare/4.11.1...4.11.2">https://github.com/tox-dev/platformdirs/compare/4.11.1...4.11.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst">platformdirs's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <p>.. towncrier-draft-entries:: Unreleased</p> <p>.. towncrier release notes start</p> <hr /> <p>4.11.3 (2026-08-13)</p> <hr /> <ul> <li><code>python -m platformdirs</code> now lists :func:<code>~platformdirs.user_desktop_dir</code>, which was missing from the properties it prints. :pr:<code>523</code></li> <li>Stop :func:<code>~platformdirs.site_data_dir</code>, :func:<code>~platformdirs.site_config_dir</code> and :func:<code>~platformdirs.site_applications_dir</code> raising <code>IndexError</code> on Unix and macOS when <code>$XDG_DATA_DIRS</code> or <code>$XDG_CONFIG_DIRS</code> holds only separators and whitespace, such as <code>":"</code>. These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:<code>523</code></li> </ul> <hr /> <p>4.11.2 (2026-08-10)</p> <hr /> <ul> <li>Stop :meth:<code>~platformdirs.PlatformDirs.iter_cache_dirs</code>, :meth:<code>~platformdirs.PlatformDirs.iter_state_dirs</code>, :meth:<code>~platformdirs.PlatformDirs.iter_log_dirs</code> and :meth:<code>~platformdirs.PlatformDirs.iter_runtime_dirs</code> yielding the same directory twice on Unix when <code>use_site_for_root</code> is active - :pr:<code>469</code> fixed this for the config and data iterators only. On macOS, :meth:<code>~platformdirs.PlatformDirs.iter_cache_dirs</code> now yields the Homebrew and <code>/Library/Caches</code> entries separately rather than one <code>os.pathsep</code>-joined string when <code>multipath</code> is set. :pr:<code>520</code></li> </ul> <hr /> <p>4.11.1 (2026-08-07)</p> <hr /> <ul> <li>Fix :func:<code>~platformdirs.user_desktop_dir</code> on Windows builds without <code>ctypes</code>. <code>CSIDL_DESKTOPDIRECTORY</code> appeared only in the ctypes lookup table, so the registry and environment variable resolvers raised <code>ValueError</code> for it. :pr:<code>519</code></li> </ul> <hr /> <p>4.11.0 (2026-07-21)</p> <hr /> <ul> <li>Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:<code>512</code></li> </ul> <hr /> <p>4.10.1 (2026-07-18)</p> <hr /> <ul> <li>Stop leaking memory on repeated Windows folder lookups. <code>get_win_folder_via_ctypes</code> defined a fresh <code>ctypes</code> structure on every call, and each one registered a pointer type that was never released; the resolver is now built</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/platformdirs/commit/7f3960afd756d720c9db030ba2aa62690b206e27"><code>7f3960a</code></a> Release 4.11.3</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/c8af984f0f30e868f8e7a38d55dff892f6a220a6"><code>c8af984</code></a> fix: don't crash when an XDG dirs variable holds only separators (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/523">#523</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/6d2105a28ea23c1d357542ef5f9e7e5bf0004dce"><code>6d2105a</code></a> 📄 docs: publish llms.txt from the docs build (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/522">#522</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/7e4746ca6c8c1e5cbb66c90486e8de8af57891b4"><code>7e4746c</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/521">#521</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/a58fb9044f3d9c593ce37e3500345222df5b43db"><code>a58fb90</code></a> Release 4.11.2</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/a01396c50253a0858b666060d51e272219557069"><code>a01396c</code></a> fix: stop the remaining iter_*_dirs yielding duplicate or joined paths (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/520">#520</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/platformdirs/compare/4.11.1...4.11.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [wheel](https://github.com/pypa/wheel) from 0.47.0 to 0.48.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/wheel/releases">wheel's releases</a>.</em></p> <blockquote> <h2>0.48.0</h2> <ul> <li>Added a <code>--local-version</code> option to <code>wheel pack</code> to add, replace, or remove a PEP 440 local version identifier from a wheel (<a href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li> <li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible core metadata versions (<a href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li> <li>Fixed <code>wheel tags</code> producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (<a href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li> <li>Fixed <code>wheel convert</code> writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (<a href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's changelog</a>.</em></p> <blockquote> <h1>Release Notes</h1> <p><strong>UNRELEASED</strong></p> <ul> <li>Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target (<code>[#697](pypa/wheel#697) <https://github.com/pypa/wheel/pull/697></code>_)</li> </ul> <p><strong>0.48.0 (2026-08-12)</strong></p> <ul> <li>Added a <code>--local-version</code> option to <code>wheel pack</code> to add, replace, or remove a PEP 440 local version identifier from a wheel (<code>[#570](pypa/wheel#570) <https://github.com/pypa/wheel/issues/570></code>_)</li> <li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible core metadata versions (<code>[#643](pypa/wheel#643) <https://github.com/pypa/wheel/issues/643></code>_)</li> <li>Fixed <code>wheel tags</code> producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (<code>[#692](pypa/wheel#692) <https://github.com/pypa/wheel/issues/692></code>_)</li> <li>Fixed <code>wheel convert</code> writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (<code>GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw></code>_)</li> </ul> <p><strong>0.47.0 (2026-04-22)</strong></p> <ul> <li>Added the <code>wheel info</code> subcommand to display metadata about wheel files without unpacking them (<code>[#639](pypa/wheel#639) <https://github.com/pypa/wheel/issues/639></code>_)</li> <li>Fixed <code>WheelFile</code> raising <code>Missing RECORD file</code> when the wheel filename contains uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the <code>.dist-info</code> directory inside uses normalized lowercase naming (<code>[#411](pypa/wheel#411) <https://github.com/pypa/wheel/issues/411></code>_)</li> </ul> <p><strong>0.46.3 (2026-01-22)</strong></p> <ul> <li>Fixed <code>ImportError: cannot import name '_setuptools_logging' from 'wheel'</code> when installed alongside an old version of setuptools and running the <code>bdist_wheel</code> command (<code>[#676](pypa/wheel#676) <https://github.com/pypa/wheel/issues/676></code>_)</li> </ul> <p><strong>0.46.2 (2026-01-22)</strong></p> <ul> <li>Restored the <code>bdist_wheel</code> command for compatibility with <code>setuptools</code> older than v70.1</li> <li>Importing <code>wheel.bdist_wheel</code> now emits a <code>FutureWarning</code> instead of a <code>DeprecationWarning</code></li> <li>Fixed <code>wheel unpack</code> potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)</li> </ul> <p><strong>0.46.1 (2025-04-08)</strong></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a> Fixed the release heading format</li> <li><a href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a> Flit no longer supports --setup-py</li> <li><a href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a> Created a new release</li> <li><a href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a> Fixed wheel convert writing outside the target directory on malicious input (...</li> <li><a href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a> Strip ZIP64 extra field when retagging wheels (<a href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a> feat: add --local-version option to wheel pack (<a href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a> Preserve compatible metadata versions in convert (<a href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a> Increased the upper bound for flit-core as a build requirement</li> <li>See full diff in <a href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.5.1 to 1.5.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/releases">python-discovery's releases</a>.</em></p> <blockquote> <h2>1.5.2</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix(py_info): discover Python 3.6 and 3.7 interpreters by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/117">tox-dev/python-discovery#117</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/python-discovery/compare/1.5.1...1.5.2">https://github.com/tox-dev/python-discovery/compare/1.5.1...1.5.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst">python-discovery's changelog</a>.</em></p> <blockquote> <p>################# Release History #################</p> <p>.. towncrier-draft-entries::</p> <p>.. towncrier release notes start</p> <hr /> <p>v1.5.1 (2026-07-31)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/python-discovery/commit/098662762290e5b9a7d48a7ff43cbd1b0a3dbef8"><code>0986627</code></a> 🐛 fix(py_info): discover Python 3.6 and 3.7 interpreters (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/117">#117</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/32e0db5caba06d35f23b91c227a18222747347dd"><code>32e0db5</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/115">#115</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/4453b8c3afbb3e6c2526e638da250cb191e9d322"><code>4453b8c</code></a> build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/114">#114</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/2c8ccd687b6fa802d2e1b997ed24e730b0d66d1c"><code>2c8ccd6</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/113">#113</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/python-discovery/compare/1.5.1...1.5.2">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )