Skip to content

[pull] master from aio-libs:master - #770

Merged
pull[bot] merged 8 commits into
tj-python:masterfrom
aio-libs:master
Sep 21, 2026
Merged

pull[bot] merged 8 commits into
tj-python:masterfrom
aio-libs:master

Conversation

@pull

@pull pull Bot commented Sep 21, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

Bumps [aiofastnet](https://github.com/tarasko/aiofastnet) from 1.1.0 to
1.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tarasko/aiofastnet/releases">aiofastnet's
releases</a>.</em></p>
<blockquote>
<h2>v1.1.1</h2>
<ul>
<li>Align CI and release procedure with aio-libs practices</li>
<li>Automate github release creation</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tarasko/aiofastnet/blob/master/CHANGES.md">aiofastnet's
changelog</a>.</em></p>
<blockquote>
<h2>1.1.1</h2>
<ul>
<li>Align CI and release procedure with aio-libs practices</li>
<li>Automate github release creation</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/6505b08a7a42e4d032340ed26819e1c298f99dc2"><code>6505b08</code></a>
Merge pull request <a
href="https://redirect.github.com/tarasko/aiofastnet/issues/73">#73</a>
from tarasko/release/1.1.1</li>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/b8b5ef2f1192aac77896a3e041eb2e9381506b33"><code>b8b5ef2</code></a>
Update CHANGES.md</li>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/4daa4ab39ce97a45cd696f58ac9d63cdd76f562a"><code>4daa4ab</code></a>
Align release procedure with aio-libs practices</li>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/f68b32e2b1e4ff1ba75954c3662adc2a6137f413"><code>f68b32e</code></a>
Potential fix for code scanning alert no. 2: Workflow does not contain
permis...</li>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/7562b2d5cd0441012f7a51c628a66c3cf3779bdb"><code>7562b2d</code></a>
Potential fix for code scanning alert no. 2: Workflow does not contain
permis...</li>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/adead516b42c0d700c764a17feed45da091fef93"><code>adead51</code></a>
Cleanup</li>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/977a5bcba90a8d5e4532befd641f9770b901113c"><code>977a5bc</code></a>
Cleanup</li>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/25119a0d9f042cd9c9e250cd4f1666a50393ae08"><code>25119a0</code></a>
Cleanup docs</li>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/98f4d2648b7c1608c1b4ccfbf858d843c1240f94"><code>98f4d26</code></a>
Formalize release procedure, automate github release creation</li>
<li><a
href="https://github.com/tarasko/aiofastnet/commit/90134299af89f9bc48a2305eeffc847e4df9dd3d"><code>9013429</code></a>
Update version</li>
<li>Additional commits viewable in <a
href="https://github.com/tarasko/aiofastnet/compare/v1.1.0...v1.1.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiofastnet&package-manager=pip&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations &amp; Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77&gt;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw&gt;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g&gt;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations &amp; Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044](urllib3/urllib3#5044)
&lt;https://github.com/urllib3/urllib3/issues/5044&gt;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945](urllib3/urllib3#4945)
&lt;https://github.com/urllib3/urllib3/issues/4945&gt;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092](urllib3/urllib3#5092)
&lt;https://github.com/urllib3/urllib3/issues/5092&gt;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=pip&previous-version=2.7.0&new-version=2.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pyproject-hooks](https://github.com/pypa/pyproject-hooks) from
1.2.0 to 1.3.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/pyproject-hooks/blob/main/docs/changelog.rst">pyproject-hooks's
changelog</a>.</em></p>
<blockquote>
<h2>v1.3.3</h2>
<ul>
<li>No code changes from 1.3. The git tags and the version number got
out of sync
while fixing an issue with the Github actions workflow to publish the
release.
1.3.3 exists only to get them back in sync without reassigning any
tags.</li>
</ul>
<h2>v1.3</h2>
<ul>
<li>Python 3.8 or above is now required (:pr:<code>214</code>).</li>
<li>UserWarnings from the backend are now captured and re-emitted in the
frontend
process as a new category <code>BuildBackendWarning</code>, so that
frontends can
control how they are shown to users (:pr:<code>213</code>).</li>
<li>Show the traceback from the backend on a
<code>BackendUnavailable</code> error (:pr:<code>219</code>).</li>
<li>Fix the return type annotation for
<code>prepare_metadata_for_build_wheel</code>
(:pr:<code>209</code>).</li>
<li>Fix removing the internal <code>_in_process</code> directory from
<code>sys.path</code> where
the install location includes a symlink (:pr:<code>230</code>).</li>
<li>Use <code>os.path.commonpath</code> instead of the deprecated
<code>commonprefix</code> to
validate the location of in-tree backends.</li>
<li>Fix in-tree backends in locations containing the path separator
character -
<code>:</code> on Posix platforms, <code>;</code> on Windows
(:pr:<code>232</code>).</li>
<li>Fix finding distribution metadata with
<code>importlib.metadata</code> in the backend
when an in-tree backend is used (:pr:<code>212</code>).</li>
<li><code>pyproject_hooks</code> can be built from source using
flit_core 4.x (:pr:<code>233</code>).</li>
<li>Document that the <code>hooks.subprocess_runner</code> context
manager API is not
thread-safe (:pr:227`)</li>
</ul>
<h2>v1.2</h2>
<ul>
<li>Improve interoperability with <code>importlib.metadata</code>,
fixing a regression
in setuptools compatibility in 1.1 (PR :pr:<code>199</code>).</li>
<li>Clean up the <code>_in_process</code> directory inside the package
from <code>sys.path</code>
before imporing the backend (PR :pr:<code>193</code>).</li>
</ul>
<h2>v1.1</h2>
<ul>
<li>Add type annotations to the public API.</li>
<li>More careful handling of the <code>backend-path</code> key from
<code>pyproject.toml</code>.
Previous versions would load the backend and then check that it was
loaded
from the specified path; the new version only loads it from the
specified path.
The <code>BackendInvalid</code> exception is now a synonym for
:exc:<code>BackendUnavailable</code>,
and code should move to using the latter name.</li>
</ul>
<h2>v1.0</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/184c9f56a87ede1276a5b33f5024204adb792cd2"><code>184c9f5</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pyproject-hooks/issues/239">#239</a>
from pypa/1.3.3</li>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/a7c2c181ea77048fdf6a65c540141f34c127062c"><code>a7c2c18</code></a>
Describe why 1.3.3 in changelog</li>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/8cc39477ef2459ca3b8f0a2f5185b9489e692daf"><code>8cc3947</code></a>
Update version to 1.3.3</li>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/6b92c2bda747211cc84dfe31e5ff4083b1c7e863"><code>6b92c2b</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pyproject-hooks/issues/238">#238</a>
from pypa/gh-action-fix-publish</li>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/1b1013dd52d224bde1ec1e61dd3b7342bc303ee9"><code>1b1013d</code></a>
Fix reference to pypi publish action</li>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/32cad4e6e2d1a582a33a6d0a7402b1709c5558e6"><code>32cad4e</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pyproject-hooks/issues/237">#237</a>
from pypa/update-gh-action-shas</li>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/514a241bf54814dcfe08d9a1f2c1be690c564959"><code>514a241</code></a>
Latest action versions for lint job as well</li>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/91c12fa6c823254e3c5b457453de37ce3676ef28"><code>91c12fa</code></a>
Add dependabot config to update Github actions automatically</li>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/271cf6c89fe52d3f50fd2ca744917b46a059167e"><code>271cf6c</code></a>
Update Github action SHAs to current versions</li>
<li><a
href="https://github.com/pypa/pyproject-hooks/commit/3f24f34d6dd417d4d60c02544d8fc8e94494f4c1"><code>3f24f34</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pyproject-hooks/issues/235">#235</a>
from pypa/changelog-1.3</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/pyproject-hooks/compare/v1.2.0...v1.3.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyproject-hooks&package-manager=pip&previous-version=1.2.0&new-version=1.3.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [idna](https://github.com/kjd/idna) from 3.19 to 3.20.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/releases">idna's
releases</a>.</em></p>
<blockquote>
<h2>v3.20</h2>
<ul>
<li>Update to Unicode 18.0.0.</li>
<li>Better enforcement of the domain length limit in the incremental
codec.</li>
<li>Add support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's
changelog</a>.</em></p>
<blockquote>
<h2>3.20 (2026-09-17)</h2>
<ul>
<li>Update to Unicode 18.0.0.</li>
<li>Better enforcement of the domain length limit in the incremental
codec.</li>
<li>Add support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kjd/idna/commit/d55e65e1a3b1ede7f556bc202738066f5597e249"><code>d55e65e</code></a>
Release 3.20</li>
<li><a
href="https://github.com/kjd/idna/commit/0c0824a928e50048e59d4ce55fe760dba30528bc"><code>0c0824a</code></a>
Pre-release 3.20rc0</li>
<li><a
href="https://github.com/kjd/idna/commit/bd7c316a08761c79ba557b5b9e6a3da24d71fa88"><code>bd7c316</code></a>
Note Python 3.15 support in the 3.20 changelog</li>
<li><a
href="https://github.com/kjd/idna/commit/b6cce8523eae3442aba976f01607b1cdf797c6ff"><code>b6cce85</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/276">#276</a> from
kjd/unicode-18</li>
<li><a
href="https://github.com/kjd/idna/commit/9a4bc59e9d5ab89e7916fc0a50650cb55e3faf26"><code>9a4bc59</code></a>
Update to Unicode 18.0.0</li>
<li><a
href="https://github.com/kjd/idna/commit/dfab5a06affddcc7781a7bbab1cac1bb7d3b4e05"><code>dfab5a0</code></a>
Merge branch 'python-3.15'</li>
<li><a
href="https://github.com/kjd/idna/commit/417c35496ccbffad4b0a434ac9b563ee6f8fa0a9"><code>417c354</code></a>
Read the latest Unicode version from the DerivedAge.txt header instead
of the...</li>
<li><a
href="https://github.com/kjd/idna/commit/cd1739200f3bf07871372bcb31c271de136eaccf"><code>cd17392</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/274">#274</a> from
kjd/fix-decode-length-check</li>
<li><a
href="https://github.com/kjd/idna/commit/c5796d79d44c76a54f03e8938dd22edaa1221c27"><code>c5796d7</code></a>
Skip the decode round-trip check for domains past encode's length
limit</li>
<li><a
href="https://github.com/kjd/idna/commit/d6ee690bf133e874351103b9fe838fdda2a7a09f"><code>d6ee690</code></a>
Update to Python 3.15 release candidate in CI and add trove
classifier</li>
<li>Additional commits viewable in <a
href="https://github.com/kjd/idna/compare/v3.19...v3.20">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=idna&package-manager=pip&previous-version=3.19&new-version=3.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.6 to
3.32.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/py-filelock/releases">filelock's
releases</a>.</em></p>
<blockquote>
<h2>3.32.7</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Fix final symlink test on musl by <a
href="https://github.com/lprnmns"><code>@​lprnmns</code></a> in <a
href="https://redirect.github.com/tox-dev/filelock/pull/737">tox-dev/filelock#737</a></li>
<li>📝 docs: say acquire() falls back to the lock's blocking attribute by
<a href="https://github.com/hxperl"><code>@​hxperl</code></a> in <a
href="https://redirect.github.com/tox-dev/filelock/pull/733">tox-dev/filelock#733</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/hxperl"><code>@​hxperl</code></a> made
their first contribution in <a
href="https://redirect.github.com/tox-dev/filelock/pull/733">tox-dev/filelock#733</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/filelock/compare/3.32.6...3.32.7">https://github.com/tox-dev/filelock/compare/3.32.6...3.32.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst">filelock's
changelog</a>.</em></p>
<blockquote>
<p>###########
Changelog
###########</p>
<p>.. towncrier-draft-entries:: Unreleased</p>
<p>.. towncrier release notes start</p>
<hr />
<p>4.0.1 (2026-09-19)</p>
<hr />
<ul>
<li><code>poll_interval</code> is now validated at construction, on the
setter, and on <code>acquire()</code>: a negative, non-finite, or
non-numeric value raises
:class:<code>ValueError</code>/:class:<code>TypeError</code> immediately
instead of failing inside <code>time.sleep</code>.
:pr:<code>739</code></li>
</ul>
<hr />
<p>4.0.0 (2026-09-17)</p>
<hr />
<ul>
<li>The :class:<code>~filelock.SoftReadWriteLock</code> on-disk protocol
is a generation log under <code>&lt;path&gt;.rw</code>, and a process
running an earlier release does not see it: an old and a new participant
on one lock path do not exclude each
other. Stop every participant, upgrade them all, then restart them; the
new code ignores leftover <code>.state</code>,
<code>.write</code> and <code>.readers/</code> files, and you can delete
them. The filesystem must provide no-replace hard links, as
it must for :class:<code>~filelock.StrictSoftFileLock</code>, so a
runtime without <code>os.link</code> raises
:class:<code>~filelock.SoftFileLockProtocolError</code> on acquire.
Constructing a singleton again with a different
<code>on_compromise</code>, or with <code>poll_interval</code> at or
above <code>stale_threshold</code>, now raises
:class:<code>ValueError</code>. :pr:<code>735</code></li>
<li>:class:<code>~filelock.SoftReadWriteLock</code> exposes
:attr:<code>~filelock.SoftReadWriteLock.generation</code> as a fencing
token for
the protected resource and reports a lost hold through
<code>on_compromise</code> and
:attr:<code>~filelock.SoftReadWriteLock.compromise</code>.
:pr:<code>735</code></li>
<li>:class:<code>~filelock.SoftReadWriteLock</code> no longer deadlocks
when a holder dies on another host mid-transition, and
<code>release()</code> no longer waits on a mutex a dead host left
behind (:pr:<code>725</code>, :pr:<code>735</code>). The state mutex is
gone.
Each transition is one atomic snapshot commit, and liveness is a
heartbeat nonce read on the observer's own clock
rather than an <code>mtime</code> read against another host's.
:pr:<code>735</code></li>
</ul>
<hr />
<p>3.32.7 (2026-09-16)</p>
<hr />
<ul>
<li>Validate final-symlink refusal by error number so the test works
across libc implementations. :pr:<code>737</code></li>
<li>Document that :meth:<code>~filelock.BaseFileLock.acquire</code>
reads <code>blocking=None</code> as the lock's <code>blocking</code>
attribute and
raises :class:<code>~filelock.Timeout</code> after one attempt when
<code>blocking=False</code>. :pr:<code>733</code></li>
</ul>
<hr />
<p>3.32.6 (2026-09-08)</p>
<hr />
<ul>
<li><code>SoftFileLease</code> and <code>AsyncSoftFileLease</code> now
reject a boolean or non-finite <code>lease_duration</code>, which used
to
publish an owner record their own <code>owner</code> property reads back
as malformed. :pr:<code>723</code></li>
<li>Reject non-finite heartbeat, stale, and polling intervals in
<code>SoftReadWriteLock</code> and <code>AsyncSoftReadWriteLock</code>,
including cached singleton construction and overflow in the default
stale threshold. :pr:<code>724</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tox-dev/filelock/commit/20929f7d1439d5fa1df158fcac87b60815f5d422"><code>20929f7</code></a>
Release 3.32.7</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/35f07c48009c41faecfa7182939e5b7e1c78ae71"><code>35f07c4</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/736">#736</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/e860d3905d369b4753de5759d1cd70d0ca639d1f"><code>e860d39</code></a>
📝 docs: say acquire() falls back to the lock's blocking attribute (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/733">#733</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/c530efec2ee5012eeaa742c196c3623d478888ba"><code>c530efe</code></a>
Fix final symlink test on musl (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/737">#737</a>)</li>
<li>See full diff in <a
href="https://github.com/tox-dev/py-filelock/compare/3.32.6...3.32.7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.32.6&new-version=3.32.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from
4.11.8 to 4.11.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/platformdirs/releases">platformdirs's
releases</a>.</em></p>
<blockquote>
<h2>4.11.10</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>👷 ci(release): docstrfmt the changelog before committing it by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/platformdirs/pull/551">tox-dev/platformdirs#551</a></li>
<li>fix: only create the site dirs a call hands back by <a
href="https://github.com/darrenhuai"><code>@​darrenhuai</code></a> in <a
href="https://redirect.github.com/tox-dev/platformdirs/pull/550">tox-dev/platformdirs#550</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/platformdirs/compare/4.11.9...4.11.10">https://github.com/tox-dev/platformdirs/compare/4.11.9...4.11.10</a></p>
<h2>4.11.9</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>fix: read user-dirs.dirs as shell assignments, not INI by <a
href="https://github.com/darrenhuai"><code>@​darrenhuai</code></a> in <a
href="https://redirect.github.com/tox-dev/platformdirs/pull/545">tox-dev/platformdirs#545</a></li>
<li>fix: accept multipath in the site cache functions by <a
href="https://github.com/darrenhuai"><code>@​darrenhuai</code></a> in <a
href="https://redirect.github.com/tox-dev/platformdirs/pull/544">tox-dev/platformdirs#544</a></li>
<li>fix: resolve PUBLIC before looking up the user home by <a
href="https://github.com/emme1t"><code>@​emme1t</code></a> in <a
href="https://redirect.github.com/tox-dev/platformdirs/pull/546">tox-dev/platformdirs#546</a></li>
<li>fix: raise RuntimeError when the Android app folder is missing by <a
href="https://github.com/Str0k"><code>@​Str0k</code></a> in <a
href="https://redirect.github.com/tox-dev/platformdirs/pull/547">tox-dev/platformdirs#547</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/emme1t"><code>@​emme1t</code></a> made
their first contribution in <a
href="https://redirect.github.com/tox-dev/platformdirs/pull/546">tox-dev/platformdirs#546</a></li>
<li><a href="https://github.com/Str0k"><code>@​Str0k</code></a> made
their first contribution in <a
href="https://redirect.github.com/tox-dev/platformdirs/pull/547">tox-dev/platformdirs#547</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/platformdirs/compare/4.11.8...4.11.9">https://github.com/tox-dev/platformdirs/compare/4.11.8...4.11.9</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst">platformdirs's
changelog</a>.</em></p>
<blockquote>
<p>###########
Changelog
###########</p>
<p>.. towncrier-draft-entries:: Unreleased</p>
<p>.. towncrier release notes start</p>
<hr />
<p>4.11.11 (2026-09-19)</p>
<hr />
<ul>
<li>Reject <code>appname</code>, <code>appauthor</code> and
<code>version</code> values that leave the platform base directory (a
<code>..</code> segment, a
leading separator, a drive or a UNC share) with <code>ValueError</code>,
so <code>ensure_exists</code> cannot create directories outside
it - by :user:<code>Pitchfork-and-Torch</code>.
:pr:<code>552</code></li>
</ul>
<hr />
<p>4.11.10 (2026-09-18)</p>
<hr />
<ul>
<li>With <code>ensure_exists</code>, the <code>site_*_dir</code> and
<code>site_*_path</code> properties and the <code>iter_*_dirs</code>
iterators only
create the site directories they return or yield, instead of every entry
in the site list - by :user:<code>darrenhuai</code>.
:pr:<code>550</code></li>
</ul>
<hr />
<p>4.11.9 (2026-09-16)</p>
<hr />
<ul>
<li>Accept <code>multipath</code> in
:func:<code>~platformdirs.site_cache_dir</code> and
:func:<code>~platformdirs.site_cache_path</code>. Without it,
the function API could not return the Homebrew cache prefix that
:attr:<code>~platformdirs.macos.MacOS.site_cache_dir</code> adds
under <code>multipath</code> - by :user:<code>darrenhuai</code>.
:pr:<code>544</code></li>
<li>Parse Unix <code>user-dirs.dirs</code> line by line like
<code>xdg-user-dir</code>. The INI parser raised on a repeated key or a
line
without <code>=</code>, and returned trailing comments and backslash
escapes inside :func:<code>~platformdirs.user_documents_dir</code>
and the other media directories. The last valid assignment now wins, and
platformdirs unescapes the quoted value and
ignores text after the closing quote - by :user:<code>darrenhuai</code>.
:pr:<code>545</code></li>
<li>Read <code>PUBLIC</code> before the home directory in
:func:<code>~platformdirs.user_publicshare_dir</code> on Windows, so it
no longer
raises <code>RuntimeError</code> when <code>PUBLIC</code> is set and the
home directory cannot be determined - by :user:<code>emme1t</code>.
:pr:<code>546</code></li>
<li>Raise <code>RuntimeError</code> from
:class:<code>~platformdirs.android.Android</code> directories when the
app folder cannot be found,
instead of <code>TypeError: expected str, bytes or os.PathLike object,
not NoneType</code> - by :user:<code>Str0k</code>.
:pr:<code>547</code></li>
</ul>
<hr />
<p>4.11.8 (2026-09-08)</p>
<hr />
<ul>
<li>Make :func:<code>~platformdirs.user_data_path</code>,
:func:<code>~platformdirs.user_config_path</code>,
:func:<code>~platformdirs.user_preference_path</code> and
:func:<code>~platformdirs.user_applications_path</code> return the first
site
entry when root is redirected by <code>use_site_for_root</code> under
<code>multipath</code>, matching their <code>site_*_path</code> twins.
They
passed the whole joined list to :class:<code>~pathlib.Path</code>,
giving one unusable path such as <code>/xdg/a/foo:/xdg/b/foo</code> -
by :user:<code>darrenhuai</code>. :pr:<code>538</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/35391fc45927adbfb055af9f809b54893a117f3d"><code>35391fc</code></a>
Release 4.11.10</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/7d5c85d14e760688a2210c56148b4052e2355ba6"><code>7d5c85d</code></a>
fix: only create the site dirs a call hands back (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/550">#550</a>)</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/5118d32ca567aba27f0af81b7b5931e162e1b86b"><code>5118d32</code></a>
👷 ci(release): docstrfmt the changelog before committing it (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/551">#551</a>)</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/4ebd03d4255e173e3349d8d2cc7a39e2622a42d6"><code>4ebd03d</code></a>
Release 4.11.9</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/0ae539be85f844838dd386378f395265bf79df54"><code>0ae539b</code></a>
fix: raise RuntimeError when the Android app folder is missing (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/547">#547</a>)</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/de87396a6e1368be791510fe25d568a96bc39f31"><code>de87396</code></a>
fix: resolve PUBLIC before looking up the user home (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/546">#546</a>)</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/2ba683bae8479cad54ed294fb033e70e99e5a2cd"><code>2ba683b</code></a>
fix: accept multipath in the site cache functions (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/544">#544</a>)</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/bdb0a67d1b58ff1d41e6469e7e4141ae63dc2593"><code>bdb0a67</code></a>
fix: read user-dirs.dirs as shell assignments, not INI (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/545">#545</a>)</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/59210659cd29ac9ce5300a6d546c6ca95c14559f"><code>5921065</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/549">#549</a>)</li>
<li>See full diff in <a
href="https://github.com/tox-dev/platformdirs/compare/4.11.8...4.11.10">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.11.8&new-version=4.11.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [python-discovery](https://github.com/tox-dev/python-discovery)
from 1.6.0 to 1.6.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/python-discovery/releases">python-discovery's
releases</a>.</em></p>
<blockquote>
<h2>v1.6.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>📄 docs(py_info): cover system_exe in all four dimensions by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/python-discovery/pull/128">tox-dev/python-discovery#128</a></li>
<li>🐛 fix(discovery): skip empty PATH entries by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/python-discovery/pull/132">tox-dev/python-discovery#132</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/python-discovery/compare/1.6.0...1.6.1">https://github.com/tox-dev/python-discovery/compare/1.6.0...1.6.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst">python-discovery's
changelog</a>.</em></p>
<blockquote>
<h1>Bug fixes - 1.6.1</h1>
<ul>
<li>Skip empty <code>PATH</code> entries during interpreter discovery -
by :user:<code>gaborbernat</code>. (:issue:<code>129</code>)</li>
</ul>
<h1>Improved documentation - 1.6.1</h1>
<ul>
<li>Document :attr:<code>~python_discovery.PythonInfo.system_exe</code>
across the tutorial, the how-to guide and the explanation of
how resolution reaches a base interpreter. The class diagram in the
how-to guide had
:attr:<code>~python_discovery.PythonInfo.system_executable</code> typed
<code>str</code> rather than <code>str | None</code> - by
:user:<code>gaborbernat</code>. (:issue:<code>128</code>)</li>
</ul>
<hr />
<p>v1.6.0 (2026-08-28)</p>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tox-dev/python-discovery/commit/26890284cd9084a7aff30884120c07d1ade573bb"><code>2689028</code></a>
release 1.6.1</li>
<li><a
href="https://github.com/tox-dev/python-discovery/commit/5d6481930c85429f0163be4439e61760e6d0f15b"><code>5d64819</code></a>
🐛 fix(discovery): skip empty PATH entries (<a
href="https://redirect.github.com/tox-dev/python-discovery/issues/132">#132</a>)</li>
<li><a
href="https://github.com/tox-dev/python-discovery/commit/4df312079ba9b07903df0f9adc8e6aeece6d6309"><code>4df3120</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/tox-dev/python-discovery/issues/131">#131</a>)</li>
<li><a
href="https://github.com/tox-dev/python-discovery/commit/51d87b6a08a8b12f698f318e4c82c0995c14f6a8"><code>51d87b6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/tox-dev/python-discovery/issues/130">#130</a>)</li>
<li><a
href="https://github.com/tox-dev/python-discovery/commit/91154dfb5a2241ef943f0bf0bfd878969060ac5e"><code>91154df</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/tox-dev/python-discovery/issues/129">#129</a>)</li>
<li><a
href="https://github.com/tox-dev/python-discovery/commit/cbf85fc38b9f136e75bd42e42275ed64f2e9a20b"><code>cbf85fc</code></a>
📄 docs(py_info): cover system_exe in all four dimensions (<a
href="https://redirect.github.com/tox-dev/python-discovery/issues/128">#128</a>)</li>
<li>See full diff in <a
href="https://github.com/tox-dev/python-discovery/compare/1.6.0...1.6.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.9 to
21.7.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/releases">virtualenv's
releases</a>.</em></p>
<blockquote>
<h2>21.7.14</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🐛 fix(activation): escape ! for csh history expansion by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3256">pypa/virtualenv#3256</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.13...21.7.14">https://github.com/pypa/virtualenv/compare/21.7.13...21.7.14</a></p>
<h2>21.7.13</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>👷 ci: correct a stale checkout pin comment by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3254">pypa/virtualenv#3254</a></li>
<li>🔧 chore: drop misc as a changelog fragment type by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3255">pypa/virtualenv#3255</a></li>
<li>👷 ci: scope the nushell apt key to its own repo by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3253">pypa/virtualenv#3253</a></li>
<li>🐛 fix(activation): stop path command injection in bash and fish by
<a href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a>
in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3252">pypa/virtualenv#3252</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13">https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13</a></p>
<h2>21.7.12</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🔧 chore(changelog): drop dead CVE-2026-24049 fragment by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3249">pypa/virtualenv#3249</a></li>
<li>🐛 fix(activation): escape batch quote() against injection by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3250">pypa/virtualenv#3250</a></li>
<li>🐛 fix(seed): verify downloaded wheel digests by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3251">pypa/virtualenv#3251</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.11...21.7.12">https://github.com/pypa/virtualenv/compare/21.7.11...21.7.12</a></p>
<h2>21.7.11</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Add OpenSSF Scorecard workflow by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3238">pypa/virtualenv#3238</a></li>
<li>Document AI-assisted contributions and licensing policy by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3239">pypa/virtualenv#3239</a></li>
<li>👷 ci(release): attest and sign release provenance by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3242">pypa/virtualenv#3242</a></li>
<li>👷 ci: harden Scorecard-scored checks in CI by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3241">pypa/virtualenv#3241</a></li>
<li>🐛 fix(ci): parallelize graalpy tests, recover crashed workers by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3240">pypa/virtualenv#3240</a></li>
<li>🐛 fix(ci): mark real-shell activation tests as slow by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3243">pypa/virtualenv#3243</a></li>
<li>👷 ci: run macOS jobs on macos-26 by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3244">pypa/virtualenv#3244</a></li>
<li>🐛 fix(activation): undo a live activation before activate.bat saves
values by <a
href="https://github.com/darrenhuai"><code>@​darrenhuai</code></a> in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3245">pypa/virtualenv#3245</a></li>
<li>🐛 fix(create): keep pyvenv.cfg values on a single line by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3247">pypa/virtualenv#3247</a></li>
<li>🔧 chore(test): add opt-in Atheris fuzz harness by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3246">pypa/virtualenv#3246</a></li>
<li>📝 docs(readme): add OpenSSF Best Practices badge by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3248">pypa/virtualenv#3248</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.10...21.7.11">https://github.com/pypa/virtualenv/compare/21.7.10...21.7.11</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's
changelog</a>.</em></p>
<blockquote>
<h1>Bugfixes - 21.7.14</h1>
<ul>
<li>Fix <code>activate.csh</code> failing with <code>Event not
found</code> when the virtual environment path contains <code>!</code>.
(:issue:<code>3256</code>)</li>
</ul>
<hr />
<p>v21.7.13 (2026-09-18)</p>
<hr />
<h1>Bugfixes - 21.7.13</h1>
<ul>
<li>Fix <code>activate</code> and <code>activate.fish</code> running
commands embedded in the virtual environment path or in the
interpreter's Tcl/Tk library paths. (:issue:<code>3252</code>)</li>
</ul>
<hr />
<p>v21.7.12 (2026-09-18)</p>
<hr />
<h1>Bugfixes - 21.7.12</h1>
<ul>
<li>Fix <code>activate.bat</code> running arbitrary commands from a
crafted <code>--prompt</code>, <code>VIRTUALENV_PROMPT</code>, or config
file
value. (:issue:<code>3250</code>)</li>
<li>Verify a downloaded seed wheel's sha256 against PyPI before seeding
it into a virtual environment, skipped when a
custom pip index is configured. (:issue:<code>3251</code>)</li>
</ul>
<hr />
<p>v21.7.11 (2026-09-17)</p>
<hr />
<h1>Bugfixes - 21.7.11</h1>
<ul>
<li>Running <code>activate.bat</code> again before
<code>deactivate</code> no longer makes <code>deactivate</code> leave
the environment's
<code>PKG_CONFIG_PATH</code>, <code>TCL_LIBRARY</code> and
<code>TK_LIBRARY</code> behind, or lose values the user had set before
the first
activation - by :user:<code>darrenhuai</code>.
(:issue:<code>3245</code>)</li>
<li>Write <code>pyvenv.cfg</code> values on a single line, so a prompt
carrying a line boundary can no longer inject configuration.
<code>--prompt</code>, the <code>VIRTUALENV_PROMPT</code> environment
variable and the config file all set the prompt, and
<code>pyvenv.cfg</code> has no escape syntax, so a newline, a carriage
return, or any other boundary <code>str.splitlines</code>
recognizes, such as <code>U+2028</code>, started a new configuration
line. Reading the file back picked up those lines as keys,
and since the last value for a key wins, they replaced anything written
earlier, including <code>home</code>. (:issue:<code>3247</code>)</li>
</ul>
<h1>Improved Documentation - 21.7.11</h1>
<ul>
<li>Document the policy for AI-assisted contributions and the licensing
rules for dependencies. (:issue:<code>3239</code>)</li>
</ul>
<p>Misc - 21.7.11</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/virtualenv/commit/9baea3c1212d8f8b083337afcb28005ecb27385d"><code>9baea3c</code></a>
release 21.7.14</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/ab3dcff43d7ba8abc516e58c24f9bbb6e408d971"><code>ab3dcff</code></a>
🐛 fix(activation): escape ! for csh history expansion (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3256">#3256</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/0c295ff1a5f298e8e11935e3588f59f7455c1f8f"><code>0c295ff</code></a>
release 21.7.13</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"><code>4d5a105</code></a>
🐛 fix(activation): stop path command injection in bash and fish (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3252">#3252</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/0525dcea21865059ffedc70054f6f982be723992"><code>0525dce</code></a>
👷 ci: scope the nushell apt key to its own repo (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3253">#3253</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/aa8323a907834e9c16fb734613ce41a6d7e27260"><code>aa8323a</code></a>
🔧 chore: drop misc as a changelog fragment type (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3255">#3255</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a43547765e017f3a13f029e24c6e6f73882e15bc"><code>a435477</code></a>
👷 ci: correct a stale checkout pin comment (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3254">#3254</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/9666b42afc8d6103e765d77958d7bae782f5406e"><code>9666b42</code></a>
release 21.7.12</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d"><code>a01ed3e</code></a>
🐛 fix(seed): verify downloaded wheel digests (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3251">#3251</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6"><code>d721ff1</code></a>
🐛 fix(activation): escape batch quote() against injection (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3250">#3250</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/virtualenv/compare/21.7.9...21.7.14">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@pull pull Bot locked and limited conversation to collaborators Sep 21, 2026
@pull pull Bot added the ⤵️ pull label Sep 21, 2026
@pull
pull Bot merged commit 40d568d into tj-python:master Sep 21, 2026
4 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants