chore(deps): bump filelock from 4.0.12 to 4.1.0

[dependabot]

Bumps filelock from 4.0.12 to 4.1.0.

Release notes

Sourced from filelock's releases.

4.1.0

What's Changed

• ci: download coverage during tool setup by @​gaborbernat in tox-dev/filelock#776
• 🐛 fix(api): validate timeout and poll_interval bounds by @​gaborbernat in tox-dev/filelock#781
• 🐛 fix(read-write): accept inf and reject nan timeouts by @​darrenhuai in tox-dev/filelock#779
• 🐛 fix(soft-rw): ignore non-ASCII generation names by @​dxbjavid in tox-dev/filelock#778
• 🐛 fix(soft): check start token in is_lock_held_by_us by @​lprnmns in tox-dev/filelock#774
• 🐛 fix(soft): clean up marker when rollback close fails by @​harbinresearcher in tox-dev/filelock#775
• 🐛 fix(read-write): clamp waits to threading.TIMEOUT_MAX by @​darrenhuai in tox-dev/filelock#780
• 🐛 fix(soft): treat truncated markers as malformed by @​gaborbernat in tox-dev/filelock#782
• 🐛 fix(acquire): keep every acquire wait within the timeout by @​feiiiiii5 in tox-dev/filelock#777
• 📝 docs: fix hanging example and platform claims by @​gaborbernat in tox-dev/filelock#783
• 🐛 fix(unix): keep peer marker on ENOSYS fallback by @​gaborbernat in tox-dev/filelock#785
• 🐛 fix(async): clear the task hold after a canceled release by @​gaborbernat in tox-dev/filelock#789
• ✨ feat(api): export lease types and has_fcntl by @​gaborbernat in tox-dev/filelock#790
• 🐛 fix(strict): age private records by the filesystem clock by @​gaborbernat in tox-dev/filelock#792
• 🐛 fix(async): surface executor shutdown as an error by @​gaborbernat in tox-dev/filelock#793
• 🐛 fix(soft): expire leases on the contender's clock by @​gaborbernat in tox-dev/filelock#796
• 🐛 fix(soft-rw): stop an acquire that close() overtook by @​gaborbernat in tox-dev/filelock#798
• 🐛 fix(strict): record claims before linking them by @​gaborbernat in tox-dev/filelock#787
• 🐛 fix(soft): restore a live marker a stale break moved aside by @​gaborbernat in tox-dev/filelock#786
• 🐛 fix(api): chain errors on 3.10 without exceptiongroup by @​gaborbernat in tox-dev/filelock#788
• 🐛 fix(soft): release a dropped SoftFileLease by @​gaborbernat in tox-dev/filelock#791
• 🐛 fix(read-write): keep probe fds until the last connection closes by @​gaborbernat in tox-dev/filelock#794
• 📦 build(sdist): ship docs and update SECURITY.md by @​gaborbernat in tox-dev/filelock#812
• 🐛 fix(soft-rw): survive a removed generation log by @​gaborbernat in tox-dev/filelock#795
• 🐛 fix(soft): tell PID namespaces apart in the marker host by @​gaborbernat in tox-dev/filelock#797
• 🐛 fix(async): release from the finalizer and keep I/O off the loop by @​gaborbernat in tox-dev/filelock#800
• 🐛 fix(strict): name what blocks the lock path by @​gaborbernat in tox-dev/filelock#804
• 🐛 fix(read-write): reject WAL databases and link beside the db by @​gaborbernat in tox-dev/filelock#805
• 🐛 fix(read-write): track read depth per thread by @​gaborbernat in tox-dev/filelock#806
• 🐛 fix(soft): honour mode and tighten marker grammar by @​gaborbernat in tox-dev/filelock#807
• 🧪 test: drop timing races from two runner-load flakes by @​gaborbernat in tox-dev/filelock#809
• 🐛 fix(descriptor): reject poll intervals above TIMEOUT_MAX by @​sricharanreddycheruku in tox-dev/filelock#802
• 🐛 fix(api): validate lock options up front by @​gaborbernat in tox-dev/filelock#803
• 🐛 fix(soft-rw): publish the head through gen/HEAD by @​gaborbernat in tox-dev/filelock#799
• 🐛 fix(api): release thread holds, guard reentry by @​gaborbernat in tox-dev/filelock#810
• 🧪 test(lease): give the age-out test a real-time margin by @​gaborbernat in tox-dev/filelock#814
• 📝 docs: point canonical and og:url at versioned pages by @​gaborbernat in tox-dev/filelock#813
• 🐛 fix(read-write): refuse a database moved mid-acquire by @​gaborbernat in tox-dev/filelock#808
• 🐛 fix: close regressions since 4.0.12 by @​gaborbernat in tox-dev/filelock#815

New Contributors

• @​darrenhuai made their first contribution in tox-dev/filelock#779
• @​harbinresearcher made their first contribution in tox-dev/filelock#775
• @​sricharanreddycheruku made their first contribution in tox-dev/filelock#802

Full Changelog: tox-dev/filelock@4.0.12...4.1.0

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.1.1 (2026-10-11)

---

• Bound the shared-lock contention test by worker progress so slow CI machines can finish the workload. :pr:819
• Avoid the macOS /dev/fd lookup implicated in a kernel panic by opening SQLite through a validated hard link. The database directory must be writable and support hard links; alias creation failure raises OSError. :pr:820
• Ignore non-ASCII PID or start-time fields and out-of-range PIDs in ReadWriteLock hard-link directory names so forged owners cannot abort acquisition. :pr:821
• Use Python 3.15 for development and automation. :pr:816

---

4.1.0 (2026-10-09)

---

• Import :data:~filelock.OwnerMode, :data:~filelock.CompromiseReason and :data:~filelock.has_fcntl from filelock. :pr:790
• :class:~filelock.AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. :pr:803
• A :class:~filelock.Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. :pr:815
• :attr:~filelock.SoftFileLock.is_lock_held_by_us and :attr:~filelock.MarkerSoftFileLock.is_lock_held_by_us return False for a marker an earlier process with the same PID left behind. :pr:774
• :class:~filelock.SoftFileLock removes its marker when writing it fails and closing the descriptor fails too, so the lock path no longer stays blocked. :pr:775
• :meth:~filelock.BaseFileLock.acquire and :meth:~filelock.BaseAsyncFileLock.acquire no longer wait past timeout when poll_interval is longer than the time left. :pr:777
• :class:~filelock.SoftReadWriteLock ignores a generation-log entry whose name is not 20 ASCII digits, which used to stop its heartbeat thread or delete real generations. :pr:778
• :class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers treat a :data:math.inf timeout like -1 and raise :class:ValueError for a blocking nan one. :pr:779
• :class:~filelock.ReadWriteLock and :class:~filelock.SoftReadWriteLock accept a timeout above :data:threading.TIMEOUT_MAX instead of raising :class:OverflowError. :pr:780
• :meth:~filelock.BaseFileLock.acquire raises :class:ValueError for a blocking nan timeout or a poll_interval above :data:threading.TIMEOUT_MAX, and treats a :data:math.inf timeout like -1. :pr:781
• :class:~filelock.SoftFileLock and :class:~filelock.MarkerSoftFileLock treat a marker cut before its final newline as malformed, so a crash-truncated record self-heals and a read mid-write no longer breaks a live lock. :pr:782
• :class:~filelock.UnixFileLock no longer deletes another process's live marker when it falls back to a soft lock on ENOSYS, and on macOS a lock path ending in a separator raises :class:FileNotFoundError instead of retrying. :pr:785
• :class:~filelock.SoftFileLock and :class:~filelock.SoftFileLease put back a live successor's marker that a racing stale break moved aside, so a third contender no longer acquires beside the successor. :pr:786
• :class:~filelock.StrictSoftFileLock removes every claim a failed acquire published, counts an EEXIST link that

... (truncated)

Commits

• 6c0ecc2 Release 4.1.0
• df06bbd 🐛 fix: close regressions since 4.0.12 (#815)
• 0712045 🐛 fix(read-write): refuse a database moved mid-acquire (#808)
• 73fefc1 📝 docs: point canonical and og:url at versioned pages (#813)
• 181b36b 🧪 test(lease): give the age-out test a real-time margin (#814)
• 2c19af4 🐛 fix(api): release thread holds, guard reentry (#810)
• 367b111 🐛 fix(soft-rw): publish the head through gen/HEAD (#799)
• 61582c5 🐛 fix(api): validate lock options up front (#803)
• 20c4b5a 🐛 fix(descriptor): reject poll intervals above TIMEOUT_MAX (#802)
• cf092c7 🧪 test: drop timing races from two runner-load flakes (#809)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[amrit110]

Automated fix applied and PR merged

The agentic fix loop successfully fixed this PR and merged it.

✓ Successfully fixed merge_only failures - Modified 0 files - Executed 87 agent actions - (52 info, 17 tool_call, 1 error, 14 tool_result, 3 reasoning)

View PR history on dashboard

AI Engineering Maintenance Bot