From 15f3f96b16906141d0becb66c0b0bd8d0290a0e6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 11:20:38 +0000 Subject: [PATCH 01/11] Bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#13437) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 9.0.0 to 10.0.1.
Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to
setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined
in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table>

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/setup-uv&package-manager=github_actions&previous-version=9.0.0&new-version=10.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-cd.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index e38f292a472..5e1cb3fd3be 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -294,7 +294,7 @@ jobs: # important: do not use system python env: UV_PYTHON_PREFERENCE: only-managed - uses: astral-sh/setup-uv@v9.0.0 + uses: astral-sh/setup-uv@v10.0.1 with: python-version: ${{ matrix.pyver }} activate-environment: true @@ -382,7 +382,7 @@ jobs: # important: do not use system python env: UV_PYTHON_PREFERENCE: only-managed - uses: astral-sh/setup-uv@v9.0.0 + uses: astral-sh/setup-uv@v10.0.1 with: python-version: ${{ matrix.pyver }} activate-environment: true @@ -447,7 +447,7 @@ jobs: # important: do not use system python env: UV_PYTHON_PREFERENCE: only-managed - uses: astral-sh/setup-uv@v9.0.0 + uses: astral-sh/setup-uv@v10.0.1 with: python-version: ${{ matrix.pyver }} activate-environment: true From ccb4ba57ca8adf1b52cae74fd0a022e38f330a4d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 11:21:21 +0000 Subject: [PATCH 02/11] Bump pip-tools from 7.6.0 to 7.6.1 (#13438) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [pip-tools](https://github.com/jazzband/pip-tools) from 7.6.0 to 7.6.1.
Release notes

Sourced from pip-tools's releases.

v7.6.1

Bug fixes

  • Fixed handling of index URLs ending in /simple/ by improving URL normalization logic. These URLs would previously make pip-compile fail to use the PyPI JSON API.

    -- by @​sirosen

    PRs and issues: #1669

  • Added a missing dependency on typing-extensions for Python 3.9 and 3.10 -- by @​sirosen.

    PRs and issues: #2424

Features

Improved documentation

  • pip-tools documentation now features a how-to section, featuring initial docs which cover controlling output file headers and configuring completion -- by @​sirosen.

Contributor-facing changes

  • Fixed CI triggers so that release tags won't create spurious failing runs -- by @​sirosen.

    PRs and issues: #2421

  • Refactored the bug report template for better reporting -- by @​psthindal.

Changelog

Sourced from pip-tools's changelog.

v7.6.1

2026-08-11

Bug fixes

  • Fixed handling of index URLs ending in /simple/ by improving URL normalization logic. These URLs would previously make pip-compile fail to use the PyPI JSON API.

    -- by {user}sirosen

    PRs and issues: {issue}1669

  • Added a missing dependency on {pypi}typing-extensions for Python 3.9 and 3.10 -- by {user}sirosen.

    PRs and issues: {issue}2424

Features

  • pip-tools is now compatible with pip version 26.2 -- by {user}sirosen.

    PRs and issues: {issue}2436, {issue}2437

Improved documentation

  • pip-tools documentation now features a how-to section, featuring initial docs which cover controlling output file headers and configuring completion -- by {user}sirosen.

Contributor-facing changes

  • Fixed CI triggers so that release tags won't create spurious failing runs -- by {user}sirosen.

    PRs and issues: {issue}2421

  • Refactored the bug report template for better reporting -- by {user}psthindal.

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip-tools&package-manager=pip&previous-version=7.6.0&new-version=7.6.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 3 ++- requirements/dev.txt | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index fd6b6694bb4..8cddf430ae8 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -163,7 +163,7 @@ pathspec==1.1.1 # via mypy pip==26.2.1 # via pip-tools -pip-tools==7.6.0 +pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in @@ -315,6 +315,7 @@ typing-extensions==4.16.0 ; python_version < "3.13" # exceptiongroup # multidict # mypy + # pip-tools # pydantic # pydantic-core # pytest-asyncio diff --git a/requirements/dev.txt b/requirements/dev.txt index aca8050386e..717d61e569d 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -160,7 +160,7 @@ pathspec==1.1.1 # via mypy pip==26.2.1 # via pip-tools -pip-tools==7.6.0 +pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in @@ -305,6 +305,7 @@ typing-extensions==4.16.0 ; python_version < "3.13" # exceptiongroup # multidict # mypy + # pip-tools # pydantic # pydantic-core # pytest-asyncio From 80d77d01d5f12aaa1dea3cb3d75a1300d0e6e7af Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 12:22:29 +0000 Subject: [PATCH 03/11] Bump typing-inspection from 0.4.3 to 0.4.4 (#13440) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [typing-inspection](https://github.com/pydantic/typing-inspection) from 0.4.3 to 0.4.4.
Changelog

Sourced from typing-inspection's changelog.

v0.4.4 (2026-08-12)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typing-inspection&package-manager=pip&previous-version=0.4.3&new-version=0.4.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 8cddf430ae8..79c6916f915 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -322,7 +322,7 @@ typing-extensions==4.16.0 ; python_version < "3.13" # python-on-whales # typing-inspection # virtualenv -typing-inspection==0.4.3 +typing-inspection==0.4.4 # via pydantic urllib3==2.7.0 # via requests diff --git a/requirements/dev.txt b/requirements/dev.txt index 717d61e569d..a8e79588c8e 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -312,7 +312,7 @@ typing-extensions==4.16.0 ; python_version < "3.13" # python-on-whales # typing-inspection # virtualenv -typing-inspection==0.4.3 +typing-inspection==0.4.4 # via pydantic urllib3==2.7.0 # via requests diff --git a/requirements/lint.txt b/requirements/lint.txt index 48f838cdbec..ea61954547e 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -158,7 +158,7 @@ typing-extensions==4.16.0 # python-on-whales # typing-inspection # virtualenv -typing-inspection==0.4.3 +typing-inspection==0.4.4 # via pydantic uvloop==0.22.1 ; platform_system != "Windows" # via -r requirements/lint.in diff --git a/requirements/test-common.txt b/requirements/test-common.txt index 19ac2647921..e112ded4590 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -142,7 +142,7 @@ typing-extensions==4.16.0 # pytest-asyncio # python-on-whales # typing-inspection -typing-inspection==0.4.3 +typing-inspection==0.4.4 # via pydantic yarl==1.24.5 # via aiohttp diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index d0482a51001..20c17415131 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -170,7 +170,7 @@ typing-extensions==4.16.0 ; python_version < "3.13" # pytest-asyncio # python-on-whales # typing-inspection -typing-inspection==0.4.3 +typing-inspection==0.4.4 # via pydantic yarl==1.24.5 # via diff --git a/requirements/test.txt b/requirements/test.txt index 141f9fae0a0..6ed6803e8a0 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -170,7 +170,7 @@ typing-extensions==4.16.0 ; python_version < "3.13" # pytest-asyncio # python-on-whales # typing-inspection -typing-inspection==0.4.3 +typing-inspection==0.4.4 # via pydantic uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpython" # via -r requirements/base.in From 195b5fdf90b86cc7460e1a3c5a58ef6aa34efcee Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 12:29:52 +0000 Subject: [PATCH 04/11] Bump github/codeql-action from 4.37.6 to 4.37.7 (#13439) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.6 to 4.37.7.
Release notes

Sourced from github/codeql-action's releases.

v4.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085
Changelog

Sourced from github/codeql-action's changelog.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085
Commits
  • ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
  • 951a133 Update changelog for v4.37.7
  • be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
  • 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
  • b4d8a54 Rebuild
  • ab5db25 Bump the npm-minor group across 1 directory with 8 updates
  • 38055a3 Drop logger from databaseInitCluster in interface
  • 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
  • dc1b98a Make logger available to getCodeQLForCmd
  • 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4.37.6&new-version=4.37.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2c7a17e48ac..7d48a69d999 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -29,17 +29,17 @@ jobs: uses: actions/checkout@v7 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.6 + uses: github/codeql-action/init@v4.37.7 with: languages: ${{ matrix.language }} config-file: ./.github/codeql.yml queries: +security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@v4.37.6 + uses: github/codeql-action/autobuild@v4.37.7 if: ${{ matrix.language == 'python' || matrix.language == 'javascript' }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.6 + uses: github/codeql-action/analyze@v4.37.7 with: category: "/language:${{ matrix.language }}" From 29e473c4207caa15abbed49cb10a8f1cb3d6d37d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 12:30:20 +0000 Subject: [PATCH 05/11] Bump charset-normalizer from 3.4.9 to 3.5.0 (#13442) Bumps [charset-normalizer](https://github.com/jawah/charset_normalizer) from 3.4.9 to 3.5.0.
Release notes

Sourced from charset-normalizer's releases.

Version 3.5.0

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Changelog

Sourced from charset-normalizer's changelog.

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Commits
  • 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
  • 77203b1 chore: reformat noxfile.py
  • 8561c22 chore(deps): bump github/codeql-action/upload-sarif (#787)
  • 25248df chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#789)
  • 3eaaf3e chore: enable cp315t in ci
  • fbe9fc4 chore: update cibuildwheel for py315 by default
  • 5c7b82a chore: add emscripten classifier
  • 7d30c21 chore: skip pyodide tests cibw
  • 417d66f Merge pull request #791 from jawah/patch-1
  • 130afd5 chore: perf script initial warm with big5 dummy content
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=charset-normalizer&package-manager=pip&previous-version=3.4.9&new-version=3.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc-spelling.txt | 2 +- requirements/doc.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 79c6916f915..2e7f2ea94d7 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -59,7 +59,7 @@ cffi==2.1.1 # pycares cfgv==3.5.0 # via pre-commit -charset-normalizer==3.4.9 +charset-normalizer==3.5.0 # via requests click==8.4.2 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index a8e79588c8e..ffdd9c535ec 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -59,7 +59,7 @@ cffi==2.1.1 # pycares cfgv==3.5.0 # via pre-commit -charset-normalizer==3.4.9 +charset-normalizer==3.5.0 # via requests click==8.4.2 # via diff --git a/requirements/doc-spelling.txt b/requirements/doc-spelling.txt index 9b0d6d6ac3b..137847bbf8c 100644 --- a/requirements/doc-spelling.txt +++ b/requirements/doc-spelling.txt @@ -12,7 +12,7 @@ babel==2.18.0 # via sphinx certifi==2026.7.22 # via requests -charset-normalizer==3.4.9 +charset-normalizer==3.5.0 # via requests click==8.4.2 # via towncrier diff --git a/requirements/doc.txt b/requirements/doc.txt index a84f9b097b3..612136bd1d5 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -12,7 +12,7 @@ babel==2.18.0 # via sphinx certifi==2026.7.22 # via requests -charset-normalizer==3.4.9 +charset-normalizer==3.5.0 # via requests click==8.4.2 # via towncrier From 438c6bf2ac66f2955cf921dd73cee6cda29dadaf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 12:30:33 +0000 Subject: [PATCH 06/11] Bump filelock from 3.32.2 to 3.32.3 (#13441) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.2 to 3.32.3.
Release notes

Sourced from filelock's releases.

3.32.3

What's Changed

Full Changelog: https://github.com/tox-dev/filelock/compare/3.32.2...3.32.3

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.3 (2026-08-13)

  • The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

3.32.2 (2026-07-29)

  • A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

  • Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

3.32.0 (2026-07-21)

  • SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685
  • Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683
  • The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

3.31.2 (2026-07-21)

  • filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

... (truncated)

Commits
  • 4aa742c Release 3.32.3
  • fb5ab3e 🐛 fix(fork): survive audit events during interpreter shutdown (#703)
  • 35f759c 📄 docs: publish llms.txt from the docs build (#700)
  • 4b6e966 [pre-commit.ci] pre-commit autoupdate (#699)
  • 0e0f666 build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#698)
  • 6689d82 🧪 test(strict): deflake close-fault injections on graalpy (#697)
  • df67bf7 [pre-commit.ci] pre-commit autoupdate (#696)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.32.2&new-version=3.32.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 2e7f2ea94d7..4556bc41395 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -85,7 +85,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.32.2 +filelock==3.32.3 # via # python-discovery # virtualenv diff --git a/requirements/dev.txt b/requirements/dev.txt index ffdd9c535ec..ad348397983 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -83,7 +83,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.32.2 +filelock==3.32.3 # via # python-discovery # virtualenv diff --git a/requirements/lint.txt b/requirements/lint.txt index ea61954547e..117f6456063 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -42,7 +42,7 @@ exceptiongroup==1.3.1 # via # aiofastnet # pytest -filelock==3.32.2 +filelock==3.32.3 # via # python-discovery # virtualenv From 7dbe7d45cb21c4e4475801359707982a4cc5c1dc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 12:38:55 +0000 Subject: [PATCH 07/11] Bump aiofastnet from 1.0.5 to 1.1.0 (#13443) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [aiofastnet](https://github.com/tarasko/aiofastnet) from 1.0.5 to 1.1.0.
Release notes

Sourced from aiofastnet's releases.

1.1.0

  • Added missing support for AF_UNIX addresses to SelectorDatagramTransport.sendto
  • Added async sock_* methods. Implemented on top of read/write socket readiness.
Changelog

Sourced from aiofastnet's changelog.

1.1.0

  • Added missing support for AF_UNIX addresses to SelectorDatagramTransport.sendto
  • Added async sock_* methods. Implemented on top of read/write socket readiness.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiofastnet&package-manager=pip&previous-version=1.0.5&new-version=1.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/runtime-deps.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index db96bfc1076..81cc631f478 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.0.5 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/base.txt b/requirements/base.txt index c9e6d276c9d..037b3ea2a91 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.0.5 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 4556bc41395..0bd0403d48c 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==1.0.5 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in diff --git a/requirements/dev.txt b/requirements/dev.txt index ad348397983..9a0fee2c6b6 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==1.0.5 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in diff --git a/requirements/lint.txt b/requirements/lint.txt index 117f6456063..28cfccd3699 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 # via -r requirements/lint.in -aiofastnet==1.0.5 +aiofastnet==1.1.0 # via -r requirements/lint.in aiohappyeyeballs==2.7.1 # via aiohttp diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index 29e2e09eba9..d1aedb9f5da 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.0.5 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 20c17415131..2c524fa780c 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.0.5 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index b847e0875a4..a779b8ae001 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.0.5 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via diff --git a/requirements/test.txt b/requirements/test.txt index 6ed6803e8a0..ab74c5ceb63 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.0.5 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via From bf54920109d8f6508ac78af388bdb6eb60ab5a09 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 12:59:29 +0000 Subject: [PATCH 08/11] Bump platformdirs from 4.11.1 to 4.11.3 (#13452) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.1 to 4.11.3.
Release notes

Sourced from platformdirs's releases.

4.11.3

What's Changed

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.11.2...4.11.3

4.11.2

What's Changed

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.11.1...4.11.2

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.3 (2026-08-13)

  • python -m platformdirs now lists :func:~platformdirs.user_desktop_dir, which was missing from the properties it prints. :pr:523
  • Stop :func:~platformdirs.site_data_dir, :func:~platformdirs.site_config_dir and :func:~platformdirs.site_applications_dir raising IndexError on Unix and macOS when $XDG_DATA_DIRS or $XDG_CONFIG_DIRS holds only separators and whitespace, such as ":". These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:523

4.11.2 (2026-08-10)

  • Stop :meth:~platformdirs.PlatformDirs.iter_cache_dirs, :meth:~platformdirs.PlatformDirs.iter_state_dirs, :meth:~platformdirs.PlatformDirs.iter_log_dirs and :meth:~platformdirs.PlatformDirs.iter_runtime_dirs yielding the same directory twice on Unix when use_site_for_root is active - :pr:469 fixed this for the config and data iterators only. On macOS, :meth:~platformdirs.PlatformDirs.iter_cache_dirs now yields the Homebrew and /Library/Caches entries separately rather than one os.pathsep-joined string when multipath is set. :pr:520

4.11.1 (2026-08-07)

  • Fix :func:~platformdirs.user_desktop_dir on Windows builds without ctypes. CSIDL_DESKTOPDIRECTORY appeared only in the ctypes lookup table, so the registry and environment variable resolvers raised ValueError for it. :pr:519

4.11.0 (2026-07-21)

  • Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

4.10.1 (2026-07-18)

  • Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built

... (truncated)

Commits
  • 7f3960a Release 4.11.3
  • c8af984 fix: don't crash when an XDG dirs variable holds only separators (#523)
  • 6d2105a 📄 docs: publish llms.txt from the docs build (#522)
  • 7e4746c [pre-commit.ci] pre-commit autoupdate (#521)
  • a58fb90 Release 4.11.2
  • a01396c fix: stop the remaining iter_*_dirs yielding duplicate or joined paths (#520)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.11.1&new-version=4.11.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 0bd0403d48c..d177dd4ab5b 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -167,7 +167,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.1 +platformdirs==4.11.3 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 9a0fee2c6b6..863eaa94c2b 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -164,7 +164,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.1 +platformdirs==4.11.3 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 28cfccd3699..29cbd217b4b 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -84,7 +84,7 @@ packaging==26.3 # via pytest pathspec==1.1.1 # via mypy -platformdirs==4.11.1 +platformdirs==4.11.3 # via virtualenv pluggy==1.6.0 # via pytest From 7529f94c29c5ee006c48d2b3aeb17b6e7c69866f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 13:00:33 +0000 Subject: [PATCH 09/11] Bump wheel from 0.47.0 to 0.48.0 (#13448) Bumps [wheel](https://github.com/pypa/wheel) from 0.47.0 to 0.48.0.
Release notes

Sourced from wheel's releases.

0.48.0

  • Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel (#570)
  • Fixed wheel convert unnecessarily upgrading compatible core metadata versions (#643)
  • Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (#692)
  • Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw)
Changelog

Sourced from wheel's changelog.

Release Notes

UNRELEASED

  • Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target ([#697](https://github.com/pypa/wheel/issues/697) <https://github.com/pypa/wheel/pull/697>_)

0.48.0 (2026-08-12)

  • Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel ([#570](https://github.com/pypa/wheel/issues/570) <https://github.com/pypa/wheel/issues/570>_)
  • Fixed wheel convert unnecessarily upgrading compatible core metadata versions ([#643](https://github.com/pypa/wheel/issues/643) <https://github.com/pypa/wheel/issues/643>_)
  • Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header ([#692](https://github.com/pypa/wheel/issues/692) <https://github.com/pypa/wheel/issues/692>_)
  • Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw>_)

0.47.0 (2026-04-22)

  • Added the wheel info subcommand to display metadata about wheel files without unpacking them ([#639](https://github.com/pypa/wheel/issues/639) <https://github.com/pypa/wheel/issues/639>_)
  • Fixed WheelFile raising Missing RECORD file when the wheel filename contains uppercase characters (e.g. Django-3.2.5.whl) but the .dist-info directory inside uses normalized lowercase naming ([#411](https://github.com/pypa/wheel/issues/411) <https://github.com/pypa/wheel/issues/411>_)

0.46.3 (2026-01-22)

  • Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command ([#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676>_)

0.46.2 (2026-01-22)

  • Restored the bdist_wheel command for compatibility with setuptools older than v70.1
  • Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning
  • Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1 (2025-04-08)

... (truncated)

Commits
  • 21c4da4 Fixed the release heading format
  • f06d4db Flit no longer supports --setup-py
  • 1a96c3e Created a new release
  • d7d625d Fixed wheel convert writing outside the target directory on malicious input (...
  • 986a440 Strip ZIP64 extra field when retagging wheels (#692) (#695)
  • 0ca6f24 feat: add --local-version option to wheel pack (#694)
  • 4a63caf Preserve compatible metadata versions in convert (#690)
  • 33650c6 [pre-commit.ci] pre-commit autoupdate (#691)
  • 197012d Increased the upper bound for flit-core as a build requirement
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=wheel&package-manager=pip&previous-version=0.47.0&new-version=0.48.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index d177dd4ab5b..eba8ed3a51b 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -334,7 +334,7 @@ valkey==6.1.1 # via -r requirements/lint.in virtualenv==21.7.4 # via pre-commit -wheel==0.47.0 +wheel==0.48.0 # via pip-tools yarl==1.24.5 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 863eaa94c2b..7a763c9c943 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -324,7 +324,7 @@ valkey==6.1.1 # via -r requirements/lint.in virtualenv==21.7.4 # via pre-commit -wheel==0.47.0 +wheel==0.48.0 # via pip-tools yarl==1.24.5 # via From 7394da3b843383044f78a94ec1d247843f37ca0c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 13:14:44 +0000 Subject: [PATCH 10/11] Bump python-discovery from 1.5.1 to 1.5.2 (#13446) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.5.1 to 1.5.2.
Release notes

Sourced from python-discovery's releases.

1.5.2

What's Changed

Full Changelog: https://github.com/tox-dev/python-discovery/compare/1.5.1...1.5.2

Changelog

Sourced from python-discovery's changelog.

################# Release History #################

.. towncrier-draft-entries::

.. towncrier release notes start

v1.5.1 (2026-07-31)

Commits
  • 0986627 🐛 fix(py_info): discover Python 3.6 and 3.7 interpreters (#117)
  • 32e0db5 [pre-commit.ci] pre-commit autoupdate (#115)
  • 4453b8c build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#114)
  • 2c8ccd6 [pre-commit.ci] pre-commit autoupdate (#113)
  • See full diff in compare view

Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index eba8ed3a51b..ed4f5fa1acb 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -236,7 +236,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.5.1 +python-discovery==1.5.2 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 7a763c9c943..3c10814cafe 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -231,7 +231,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.5.1 +python-discovery==1.5.2 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 29cbd217b4b..de1ce140c2e 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -125,7 +125,7 @@ pytest-mock==3.15.1 # via -r requirements/lint.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.5.1 +python-discovery==1.5.2 # via virtualenv python-on-whales==0.81.0 # via -r requirements/lint.in From 735099321afb0d4a97e0decaefedba49d42c5032 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 19:01:12 +0200 Subject: [PATCH 11/11] [pre-commit.ci] pre-commit autoupdate (#13460) --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index c00b8360908..f2279aba030 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -60,7 +60,7 @@ repos: - flake8-no-implicit-concat==0.3.4 - flake8-requirements==1.7.8 - repo: https://github.com/PyCQA/isort - rev: '9.0.0b2' + rev: '9.0.0b5' hooks: - id: isort - repo: https://github.com/psf/black-pre-commit-mirror