[dependabot]

Bumps the user-facing group with 2 updates in the /tools directory: certifi and importlib-metadata.
Bumps the user-facing group with 2 updates in the /tools/publish directory: certifi and importlib-metadata.

Updates certifi from 2026.10.19 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• See full diff in compare view

Updates importlib-metadata from 9.0.1 to 10.1.0

Changelog

Sourced from importlib-metadata's changelog.

v10.1.0

Features

• Detecting whether a distribution supplies metadata no longer reads or parses that metadata where the metadata directory can be inspected instead, so retrieving a distribution by name, which prefers the valid candidates, is substantially faster.
• Reverted the preference for the greater metadata directory added in v9.1.0. The ordering was lexicographic on the directory name and not on the parsed version, so it only approximated a preference for the newer version. Where a path supplies more than one metadata directory for a distribution, discovery once again reports them in the order the path supplies python/cpython#100666

Bugfixes

• entry_points() now prefers distributions whose metadata is readable, so an empty metadata directory left behind by an unclean upgrade no longer shadows the valid one of the same name and suppresses its entry points. Invalid distributions are deferred to the end of the enumeration rather than dropped. (#534)
• The preference for valid distributions no longer propagates the MetadataNotFound of a distribution that a provider derived from importlib.metadata, whose exception is a different class from this package's and so escaped the preference rather than marking the distribution invalid.

v10.0.0

Features

• Added IDistribution and IPackagePath protocols so consumers can target a stable, shared interface across importlib.metadata and importlib_metadata. A provider supplying its own Distribution subclass is warned about only when the class omits members that interface requires, not merely because it derives from importlib.metadata. origin is exempt from that expectation until support for Python 3.12 is dropped, as there is none to inherit before Python 3.13. (#486)

Deprecations and Removals

• When providers supply objects from importlib.metadata, they are now adapted to the classes from importlib_metadata. (#486)

v9.1.0

... (truncated)

Commits

• d196fdb Finalize
• 5d253ae Merge pull request #553 from python/bugfix/534-entry-points-prefer-valid
• 0aa24f3 Prefer valid distributions when collecting entry points.
• e52be78 Detect the presence of metadata without reading it.
• 60bbaca Merge pull request #552 from python/debt/revert-prefer-greater-version
• 7e162d8 Revert "Prefer the greater metadata directory when a path supplies several."
• 3be1416 Finalize
• e3dad22 Merge pull request #505 from python/bugfix/486-local-objects
• 301b791 Finalize
• 4b7c45f Avoid a dot in the news fragment id.
• Additional commits viewable in compare view

Updates certifi from 2026.10.19 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• See full diff in compare view

Updates importlib-metadata from 9.0.1 to 10.1.0

Changelog

Sourced from importlib-metadata's changelog.

v10.1.0

Features

• Detecting whether a distribution supplies metadata no longer reads or parses that metadata where the metadata directory can be inspected instead, so retrieving a distribution by name, which prefers the valid candidates, is substantially faster.
• Reverted the preference for the greater metadata directory added in v9.1.0. The ordering was lexicographic on the directory name and not on the parsed version, so it only approximated a preference for the newer version. Where a path supplies more than one metadata directory for a distribution, discovery once again reports them in the order the path supplies python/cpython#100666

Bugfixes

• entry_points() now prefers distributions whose metadata is readable, so an empty metadata directory left behind by an unclean upgrade no longer shadows the valid one of the same name and suppresses its entry points. Invalid distributions are deferred to the end of the enumeration rather than dropped. (#534)
• The preference for valid distributions no longer propagates the MetadataNotFound of a distribution that a provider derived from importlib.metadata, whose exception is a different class from this package's and so escaped the preference rather than marking the distribution invalid.

v10.0.0

Features

• Added IDistribution and IPackagePath protocols so consumers can target a stable, shared interface across importlib.metadata and importlib_metadata. A provider supplying its own Distribution subclass is warned about only when the class omits members that interface requires, not merely because it derives from importlib.metadata. origin is exempt from that expectation until support for Python 3.12 is dropped, as there is none to inherit before Python 3.13. (#486)

Deprecations and Removals

• When providers supply objects from importlib.metadata, they are now adapted to the classes from importlib_metadata. (#486)

v9.1.0

... (truncated)

Commits

• d196fdb Finalize
• 5d253ae Merge pull request #553 from python/bugfix/534-entry-points-prefer-valid
• 0aa24f3 Prefer valid distributions when collecting entry points.
• e52be78 Detect the presence of metadata without reading it.
• 60bbaca Merge pull request #552 from python/debt/revert-prefer-greater-version
• 7e162d8 Revert "Prefer the greater metadata directory when a path supplies several."
• 3be1416 Finalize
• e3dad22 Merge pull request #505 from python/bugfix/486-local-objects
• 301b791 Finalize
• 4b7c45f Avoid a dot in the news fragment id.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions