[pull] master from aio-libs:master - #770
Merged
Merged
Conversation
Bumps [aiofastnet](https://github.com/tarasko/aiofastnet) from 1.1.0 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tarasko/aiofastnet/releases">aiofastnet's releases</a>.</em></p> <blockquote> <h2>v1.1.1</h2> <ul> <li>Align CI and release procedure with aio-libs practices</li> <li>Automate github release creation</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tarasko/aiofastnet/blob/master/CHANGES.md">aiofastnet's changelog</a>.</em></p> <blockquote> <h2>1.1.1</h2> <ul> <li>Align CI and release procedure with aio-libs practices</li> <li>Automate github release creation</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tarasko/aiofastnet/commit/6505b08a7a42e4d032340ed26819e1c298f99dc2"><code>6505b08</code></a> Merge pull request <a href="https://redirect.github.com/tarasko/aiofastnet/issues/73">#73</a> from tarasko/release/1.1.1</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/b8b5ef2f1192aac77896a3e041eb2e9381506b33"><code>b8b5ef2</code></a> Update CHANGES.md</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/4daa4ab39ce97a45cd696f58ac9d63cdd76f562a"><code>4daa4ab</code></a> Align release procedure with aio-libs practices</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/f68b32e2b1e4ff1ba75954c3662adc2a6137f413"><code>f68b32e</code></a> Potential fix for code scanning alert no. 2: Workflow does not contain permis...</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/7562b2d5cd0441012f7a51c628a66c3cf3779bdb"><code>7562b2d</code></a> Potential fix for code scanning alert no. 2: Workflow does not contain permis...</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/adead516b42c0d700c764a17feed45da091fef93"><code>adead51</code></a> Cleanup</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/977a5bcba90a8d5e4532befd641f9770b901113c"><code>977a5bc</code></a> Cleanup</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/25119a0d9f042cd9c9e250cd4f1666a50393ae08"><code>25119a0</code></a> Cleanup docs</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/98f4d2648b7c1608c1b4ccfbf858d843c1240f94"><code>98f4d26</code></a> Formalize release procedure, automate github release creation</li> <li><a href="https://github.com/tarasko/aiofastnet/commit/90134299af89f9bc48a2305eeffc847e4df9dd3d"><code>9013429</code></a> Update version</li> <li>Additional commits viewable in <a href="https://github.com/tarasko/aiofastnet/compare/v1.1.0...v1.1.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](urllib3/urllib3#5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](urllib3/urllib3#4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](urllib3/urllib3#5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pyproject-hooks](https://github.com/pypa/pyproject-hooks) from 1.2.0 to 1.3.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pyproject-hooks/blob/main/docs/changelog.rst">pyproject-hooks's changelog</a>.</em></p> <blockquote> <h2>v1.3.3</h2> <ul> <li>No code changes from 1.3. The git tags and the version number got out of sync while fixing an issue with the Github actions workflow to publish the release. 1.3.3 exists only to get them back in sync without reassigning any tags.</li> </ul> <h2>v1.3</h2> <ul> <li>Python 3.8 or above is now required (:pr:<code>214</code>).</li> <li>UserWarnings from the backend are now captured and re-emitted in the frontend process as a new category <code>BuildBackendWarning</code>, so that frontends can control how they are shown to users (:pr:<code>213</code>).</li> <li>Show the traceback from the backend on a <code>BackendUnavailable</code> error (:pr:<code>219</code>).</li> <li>Fix the return type annotation for <code>prepare_metadata_for_build_wheel</code> (:pr:<code>209</code>).</li> <li>Fix removing the internal <code>_in_process</code> directory from <code>sys.path</code> where the install location includes a symlink (:pr:<code>230</code>).</li> <li>Use <code>os.path.commonpath</code> instead of the deprecated <code>commonprefix</code> to validate the location of in-tree backends.</li> <li>Fix in-tree backends in locations containing the path separator character - <code>:</code> on Posix platforms, <code>;</code> on Windows (:pr:<code>232</code>).</li> <li>Fix finding distribution metadata with <code>importlib.metadata</code> in the backend when an in-tree backend is used (:pr:<code>212</code>).</li> <li><code>pyproject_hooks</code> can be built from source using flit_core 4.x (:pr:<code>233</code>).</li> <li>Document that the <code>hooks.subprocess_runner</code> context manager API is not thread-safe (:pr:227`)</li> </ul> <h2>v1.2</h2> <ul> <li>Improve interoperability with <code>importlib.metadata</code>, fixing a regression in setuptools compatibility in 1.1 (PR :pr:<code>199</code>).</li> <li>Clean up the <code>_in_process</code> directory inside the package from <code>sys.path</code> before imporing the backend (PR :pr:<code>193</code>).</li> </ul> <h2>v1.1</h2> <ul> <li>Add type annotations to the public API.</li> <li>More careful handling of the <code>backend-path</code> key from <code>pyproject.toml</code>. Previous versions would load the backend and then check that it was loaded from the specified path; the new version only loads it from the specified path. The <code>BackendInvalid</code> exception is now a synonym for :exc:<code>BackendUnavailable</code>, and code should move to using the latter name.</li> </ul> <h2>v1.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pyproject-hooks/commit/184c9f56a87ede1276a5b33f5024204adb792cd2"><code>184c9f5</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pyproject-hooks/issues/239">#239</a> from pypa/1.3.3</li> <li><a href="https://github.com/pypa/pyproject-hooks/commit/a7c2c181ea77048fdf6a65c540141f34c127062c"><code>a7c2c18</code></a> Describe why 1.3.3 in changelog</li> <li><a href="https://github.com/pypa/pyproject-hooks/commit/8cc39477ef2459ca3b8f0a2f5185b9489e692daf"><code>8cc3947</code></a> Update version to 1.3.3</li> <li><a href="https://github.com/pypa/pyproject-hooks/commit/6b92c2bda747211cc84dfe31e5ff4083b1c7e863"><code>6b92c2b</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pyproject-hooks/issues/238">#238</a> from pypa/gh-action-fix-publish</li> <li><a href="https://github.com/pypa/pyproject-hooks/commit/1b1013dd52d224bde1ec1e61dd3b7342bc303ee9"><code>1b1013d</code></a> Fix reference to pypi publish action</li> <li><a href="https://github.com/pypa/pyproject-hooks/commit/32cad4e6e2d1a582a33a6d0a7402b1709c5558e6"><code>32cad4e</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pyproject-hooks/issues/237">#237</a> from pypa/update-gh-action-shas</li> <li><a href="https://github.com/pypa/pyproject-hooks/commit/514a241bf54814dcfe08d9a1f2c1be690c564959"><code>514a241</code></a> Latest action versions for lint job as well</li> <li><a href="https://github.com/pypa/pyproject-hooks/commit/91c12fa6c823254e3c5b457453de37ce3676ef28"><code>91c12fa</code></a> Add dependabot config to update Github actions automatically</li> <li><a href="https://github.com/pypa/pyproject-hooks/commit/271cf6c89fe52d3f50fd2ca744917b46a059167e"><code>271cf6c</code></a> Update Github action SHAs to current versions</li> <li><a href="https://github.com/pypa/pyproject-hooks/commit/3f24f34d6dd417d4d60c02544d8fc8e94494f4c1"><code>3f24f34</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pyproject-hooks/issues/235">#235</a> from pypa/changelog-1.3</li> <li>Additional commits viewable in <a href="https://github.com/pypa/pyproject-hooks/compare/v1.2.0...v1.3.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [idna](https://github.com/kjd/idna) from 3.19 to 3.20. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/releases">idna's releases</a>.</em></p> <blockquote> <h2>v3.20</h2> <ul> <li>Update to Unicode 18.0.0.</li> <li>Better enforcement of the domain length limit in the incremental codec.</li> <li>Add support for Python 3.15.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.20 (2026-09-17)</h2> <ul> <li>Update to Unicode 18.0.0.</li> <li>Better enforcement of the domain length limit in the incremental codec.</li> <li>Add support for Python 3.15.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kjd/idna/commit/d55e65e1a3b1ede7f556bc202738066f5597e249"><code>d55e65e</code></a> Release 3.20</li> <li><a href="https://github.com/kjd/idna/commit/0c0824a928e50048e59d4ce55fe760dba30528bc"><code>0c0824a</code></a> Pre-release 3.20rc0</li> <li><a href="https://github.com/kjd/idna/commit/bd7c316a08761c79ba557b5b9e6a3da24d71fa88"><code>bd7c316</code></a> Note Python 3.15 support in the 3.20 changelog</li> <li><a href="https://github.com/kjd/idna/commit/b6cce8523eae3442aba976f01607b1cdf797c6ff"><code>b6cce85</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/276">#276</a> from kjd/unicode-18</li> <li><a href="https://github.com/kjd/idna/commit/9a4bc59e9d5ab89e7916fc0a50650cb55e3faf26"><code>9a4bc59</code></a> Update to Unicode 18.0.0</li> <li><a href="https://github.com/kjd/idna/commit/dfab5a06affddcc7781a7bbab1cac1bb7d3b4e05"><code>dfab5a0</code></a> Merge branch 'python-3.15'</li> <li><a href="https://github.com/kjd/idna/commit/417c35496ccbffad4b0a434ac9b563ee6f8fa0a9"><code>417c354</code></a> Read the latest Unicode version from the DerivedAge.txt header instead of the...</li> <li><a href="https://github.com/kjd/idna/commit/cd1739200f3bf07871372bcb31c271de136eaccf"><code>cd17392</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/274">#274</a> from kjd/fix-decode-length-check</li> <li><a href="https://github.com/kjd/idna/commit/c5796d79d44c76a54f03e8938dd22edaa1221c27"><code>c5796d7</code></a> Skip the decode round-trip check for domains past encode's length limit</li> <li><a href="https://github.com/kjd/idna/commit/d6ee690bf133e874351103b9fe838fdda2a7a09f"><code>d6ee690</code></a> Update to Python 3.15 release candidate in CI and add trove classifier</li> <li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.19...v3.20">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.6 to 3.32.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/py-filelock/releases">filelock's releases</a>.</em></p> <blockquote> <h2>3.32.7</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>Fix final symlink test on musl by <a href="https://github.com/lprnmns"><code>@lprnmns</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/737">tox-dev/filelock#737</a></li> <li>📝 docs: say acquire() falls back to the lock's blocking attribute by <a href="https://github.com/hxperl"><code>@hxperl</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/733">tox-dev/filelock#733</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/hxperl"><code>@hxperl</code></a> made their first contribution in <a href="https://redirect.github.com/tox-dev/filelock/pull/733">tox-dev/filelock#733</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.32.6...3.32.7">https://github.com/tox-dev/filelock/compare/3.32.6...3.32.7</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst">filelock's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <p>.. towncrier-draft-entries:: Unreleased</p> <p>.. towncrier release notes start</p> <hr /> <p>4.0.1 (2026-09-19)</p> <hr /> <ul> <li><code>poll_interval</code> is now validated at construction, on the setter, and on <code>acquire()</code>: a negative, non-finite, or non-numeric value raises :class:<code>ValueError</code>/:class:<code>TypeError</code> immediately instead of failing inside <code>time.sleep</code>. :pr:<code>739</code></li> </ul> <hr /> <p>4.0.0 (2026-09-17)</p> <hr /> <ul> <li>The :class:<code>~filelock.SoftReadWriteLock</code> on-disk protocol is a generation log under <code><path>.rw</code>, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover <code>.state</code>, <code>.write</code> and <code>.readers/</code> files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:<code>~filelock.StrictSoftFileLock</code>, so a runtime without <code>os.link</code> raises :class:<code>~filelock.SoftFileLockProtocolError</code> on acquire. Constructing a singleton again with a different <code>on_compromise</code>, or with <code>poll_interval</code> at or above <code>stale_threshold</code>, now raises :class:<code>ValueError</code>. :pr:<code>735</code></li> <li>:class:<code>~filelock.SoftReadWriteLock</code> exposes :attr:<code>~filelock.SoftReadWriteLock.generation</code> as a fencing token for the protected resource and reports a lost hold through <code>on_compromise</code> and :attr:<code>~filelock.SoftReadWriteLock.compromise</code>. :pr:<code>735</code></li> <li>:class:<code>~filelock.SoftReadWriteLock</code> no longer deadlocks when a holder dies on another host mid-transition, and <code>release()</code> no longer waits on a mutex a dead host left behind (:pr:<code>725</code>, :pr:<code>735</code>). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an <code>mtime</code> read against another host's. :pr:<code>735</code></li> </ul> <hr /> <p>3.32.7 (2026-09-16)</p> <hr /> <ul> <li>Validate final-symlink refusal by error number so the test works across libc implementations. :pr:<code>737</code></li> <li>Document that :meth:<code>~filelock.BaseFileLock.acquire</code> reads <code>blocking=None</code> as the lock's <code>blocking</code> attribute and raises :class:<code>~filelock.Timeout</code> after one attempt when <code>blocking=False</code>. :pr:<code>733</code></li> </ul> <hr /> <p>3.32.6 (2026-09-08)</p> <hr /> <ul> <li><code>SoftFileLease</code> and <code>AsyncSoftFileLease</code> now reject a boolean or non-finite <code>lease_duration</code>, which used to publish an owner record their own <code>owner</code> property reads back as malformed. :pr:<code>723</code></li> <li>Reject non-finite heartbeat, stale, and polling intervals in <code>SoftReadWriteLock</code> and <code>AsyncSoftReadWriteLock</code>, including cached singleton construction and overflow in the default stale threshold. :pr:<code>724</code></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/filelock/commit/20929f7d1439d5fa1df158fcac87b60815f5d422"><code>20929f7</code></a> Release 3.32.7</li> <li><a href="https://github.com/tox-dev/filelock/commit/35f07c48009c41faecfa7182939e5b7e1c78ae71"><code>35f07c4</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/736">#736</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/e860d3905d369b4753de5759d1cd70d0ca639d1f"><code>e860d39</code></a> 📝 docs: say acquire() falls back to the lock's blocking attribute (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/733">#733</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/c530efec2ee5012eeaa742c196c3623d478888ba"><code>c530efe</code></a> Fix final symlink test on musl (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/737">#737</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/py-filelock/compare/3.32.6...3.32.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.8 to 4.11.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/platformdirs/releases">platformdirs's releases</a>.</em></p> <blockquote> <h2>4.11.10</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>👷 ci(release): docstrfmt the changelog before committing it by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/551">tox-dev/platformdirs#551</a></li> <li>fix: only create the site dirs a call hands back by <a href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/550">tox-dev/platformdirs#550</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/platformdirs/compare/4.11.9...4.11.10">https://github.com/tox-dev/platformdirs/compare/4.11.9...4.11.10</a></p> <h2>4.11.9</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>fix: read user-dirs.dirs as shell assignments, not INI by <a href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/545">tox-dev/platformdirs#545</a></li> <li>fix: accept multipath in the site cache functions by <a href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/544">tox-dev/platformdirs#544</a></li> <li>fix: resolve PUBLIC before looking up the user home by <a href="https://github.com/emme1t"><code>@emme1t</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/546">tox-dev/platformdirs#546</a></li> <li>fix: raise RuntimeError when the Android app folder is missing by <a href="https://github.com/Str0k"><code>@Str0k</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/547">tox-dev/platformdirs#547</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/emme1t"><code>@emme1t</code></a> made their first contribution in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/546">tox-dev/platformdirs#546</a></li> <li><a href="https://github.com/Str0k"><code>@Str0k</code></a> made their first contribution in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/547">tox-dev/platformdirs#547</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/platformdirs/compare/4.11.8...4.11.9">https://github.com/tox-dev/platformdirs/compare/4.11.8...4.11.9</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst">platformdirs's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <p>.. towncrier-draft-entries:: Unreleased</p> <p>.. towncrier release notes start</p> <hr /> <p>4.11.11 (2026-09-19)</p> <hr /> <ul> <li>Reject <code>appname</code>, <code>appauthor</code> and <code>version</code> values that leave the platform base directory (a <code>..</code> segment, a leading separator, a drive or a UNC share) with <code>ValueError</code>, so <code>ensure_exists</code> cannot create directories outside it - by :user:<code>Pitchfork-and-Torch</code>. :pr:<code>552</code></li> </ul> <hr /> <p>4.11.10 (2026-09-18)</p> <hr /> <ul> <li>With <code>ensure_exists</code>, the <code>site_*_dir</code> and <code>site_*_path</code> properties and the <code>iter_*_dirs</code> iterators only create the site directories they return or yield, instead of every entry in the site list - by :user:<code>darrenhuai</code>. :pr:<code>550</code></li> </ul> <hr /> <p>4.11.9 (2026-09-16)</p> <hr /> <ul> <li>Accept <code>multipath</code> in :func:<code>~platformdirs.site_cache_dir</code> and :func:<code>~platformdirs.site_cache_path</code>. Without it, the function API could not return the Homebrew cache prefix that :attr:<code>~platformdirs.macos.MacOS.site_cache_dir</code> adds under <code>multipath</code> - by :user:<code>darrenhuai</code>. :pr:<code>544</code></li> <li>Parse Unix <code>user-dirs.dirs</code> line by line like <code>xdg-user-dir</code>. The INI parser raised on a repeated key or a line without <code>=</code>, and returned trailing comments and backslash escapes inside :func:<code>~platformdirs.user_documents_dir</code> and the other media directories. The last valid assignment now wins, and platformdirs unescapes the quoted value and ignores text after the closing quote - by :user:<code>darrenhuai</code>. :pr:<code>545</code></li> <li>Read <code>PUBLIC</code> before the home directory in :func:<code>~platformdirs.user_publicshare_dir</code> on Windows, so it no longer raises <code>RuntimeError</code> when <code>PUBLIC</code> is set and the home directory cannot be determined - by :user:<code>emme1t</code>. :pr:<code>546</code></li> <li>Raise <code>RuntimeError</code> from :class:<code>~platformdirs.android.Android</code> directories when the app folder cannot be found, instead of <code>TypeError: expected str, bytes or os.PathLike object, not NoneType</code> - by :user:<code>Str0k</code>. :pr:<code>547</code></li> </ul> <hr /> <p>4.11.8 (2026-09-08)</p> <hr /> <ul> <li>Make :func:<code>~platformdirs.user_data_path</code>, :func:<code>~platformdirs.user_config_path</code>, :func:<code>~platformdirs.user_preference_path</code> and :func:<code>~platformdirs.user_applications_path</code> return the first site entry when root is redirected by <code>use_site_for_root</code> under <code>multipath</code>, matching their <code>site_*_path</code> twins. They passed the whole joined list to :class:<code>~pathlib.Path</code>, giving one unusable path such as <code>/xdg/a/foo:/xdg/b/foo</code> - by :user:<code>darrenhuai</code>. :pr:<code>538</code></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/platformdirs/commit/35391fc45927adbfb055af9f809b54893a117f3d"><code>35391fc</code></a> Release 4.11.10</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/7d5c85d14e760688a2210c56148b4052e2355ba6"><code>7d5c85d</code></a> fix: only create the site dirs a call hands back (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/550">#550</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/5118d32ca567aba27f0af81b7b5931e162e1b86b"><code>5118d32</code></a> 👷 ci(release): docstrfmt the changelog before committing it (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/551">#551</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/4ebd03d4255e173e3349d8d2cc7a39e2622a42d6"><code>4ebd03d</code></a> Release 4.11.9</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/0ae539be85f844838dd386378f395265bf79df54"><code>0ae539b</code></a> fix: raise RuntimeError when the Android app folder is missing (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/547">#547</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/de87396a6e1368be791510fe25d568a96bc39f31"><code>de87396</code></a> fix: resolve PUBLIC before looking up the user home (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/546">#546</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/2ba683bae8479cad54ed294fb033e70e99e5a2cd"><code>2ba683b</code></a> fix: accept multipath in the site cache functions (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/544">#544</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/bdb0a67d1b58ff1d41e6469e7e4141ae63dc2593"><code>bdb0a67</code></a> fix: read user-dirs.dirs as shell assignments, not INI (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/545">#545</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/59210659cd29ac9ce5300a6d546c6ca95c14559f"><code>5921065</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/549">#549</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/platformdirs/compare/4.11.8...4.11.10">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.6.0 to 1.6.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/releases">python-discovery's releases</a>.</em></p> <blockquote> <h2>v1.6.1</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>📄 docs(py_info): cover system_exe in all four dimensions by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/128">tox-dev/python-discovery#128</a></li> <li>🐛 fix(discovery): skip empty PATH entries by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/132">tox-dev/python-discovery#132</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/python-discovery/compare/1.6.0...1.6.1">https://github.com/tox-dev/python-discovery/compare/1.6.0...1.6.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst">python-discovery's changelog</a>.</em></p> <blockquote> <h1>Bug fixes - 1.6.1</h1> <ul> <li>Skip empty <code>PATH</code> entries during interpreter discovery - by :user:<code>gaborbernat</code>. (:issue:<code>129</code>)</li> </ul> <h1>Improved documentation - 1.6.1</h1> <ul> <li>Document :attr:<code>~python_discovery.PythonInfo.system_exe</code> across the tutorial, the how-to guide and the explanation of how resolution reaches a base interpreter. The class diagram in the how-to guide had :attr:<code>~python_discovery.PythonInfo.system_executable</code> typed <code>str</code> rather than <code>str | None</code> - by :user:<code>gaborbernat</code>. (:issue:<code>128</code>)</li> </ul> <hr /> <p>v1.6.0 (2026-08-28)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/python-discovery/commit/26890284cd9084a7aff30884120c07d1ade573bb"><code>2689028</code></a> release 1.6.1</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/5d6481930c85429f0163be4439e61760e6d0f15b"><code>5d64819</code></a> 🐛 fix(discovery): skip empty PATH entries (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/132">#132</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/4df312079ba9b07903df0f9adc8e6aeece6d6309"><code>4df3120</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/131">#131</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/51d87b6a08a8b12f698f318e4c82c0995c14f6a8"><code>51d87b6</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/130">#130</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/91154dfb5a2241ef943f0bf0bfd878969060ac5e"><code>91154df</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/129">#129</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/cbf85fc38b9f136e75bd42e42275ed64f2e9a20b"><code>cbf85fc</code></a> 📄 docs(py_info): cover system_exe in all four dimensions (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/128">#128</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/python-discovery/compare/1.6.0...1.6.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.9 to 21.7.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/releases">virtualenv's releases</a>.</em></p> <blockquote> <h2>21.7.14</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix(activation): escape ! for csh history expansion by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3256">pypa/virtualenv#3256</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.7.13...21.7.14">https://github.com/pypa/virtualenv/compare/21.7.13...21.7.14</a></p> <h2>21.7.13</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>👷 ci: correct a stale checkout pin comment by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3254">pypa/virtualenv#3254</a></li> <li>🔧 chore: drop misc as a changelog fragment type by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3255">pypa/virtualenv#3255</a></li> <li>👷 ci: scope the nushell apt key to its own repo by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3253">pypa/virtualenv#3253</a></li> <li>🐛 fix(activation): stop path command injection in bash and fish by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3252">pypa/virtualenv#3252</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13">https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13</a></p> <h2>21.7.12</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🔧 chore(changelog): drop dead CVE-2026-24049 fragment by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3249">pypa/virtualenv#3249</a></li> <li>🐛 fix(activation): escape batch quote() against injection by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3250">pypa/virtualenv#3250</a></li> <li>🐛 fix(seed): verify downloaded wheel digests by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3251">pypa/virtualenv#3251</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.7.11...21.7.12">https://github.com/pypa/virtualenv/compare/21.7.11...21.7.12</a></p> <h2>21.7.11</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>Add OpenSSF Scorecard workflow by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3238">pypa/virtualenv#3238</a></li> <li>Document AI-assisted contributions and licensing policy by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3239">pypa/virtualenv#3239</a></li> <li>👷 ci(release): attest and sign release provenance by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3242">pypa/virtualenv#3242</a></li> <li>👷 ci: harden Scorecard-scored checks in CI by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3241">pypa/virtualenv#3241</a></li> <li>🐛 fix(ci): parallelize graalpy tests, recover crashed workers by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3240">pypa/virtualenv#3240</a></li> <li>🐛 fix(ci): mark real-shell activation tests as slow by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3243">pypa/virtualenv#3243</a></li> <li>👷 ci: run macOS jobs on macos-26 by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3244">pypa/virtualenv#3244</a></li> <li>🐛 fix(activation): undo a live activation before activate.bat saves values by <a href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3245">pypa/virtualenv#3245</a></li> <li>🐛 fix(create): keep pyvenv.cfg values on a single line by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3247">pypa/virtualenv#3247</a></li> <li>🔧 chore(test): add opt-in Atheris fuzz harness by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3246">pypa/virtualenv#3246</a></li> <li>📝 docs(readme): add OpenSSF Best Practices badge by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3248">pypa/virtualenv#3248</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.7.10...21.7.11">https://github.com/pypa/virtualenv/compare/21.7.10...21.7.11</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's changelog</a>.</em></p> <blockquote> <h1>Bugfixes - 21.7.14</h1> <ul> <li>Fix <code>activate.csh</code> failing with <code>Event not found</code> when the virtual environment path contains <code>!</code>. (:issue:<code>3256</code>)</li> </ul> <hr /> <p>v21.7.13 (2026-09-18)</p> <hr /> <h1>Bugfixes - 21.7.13</h1> <ul> <li>Fix <code>activate</code> and <code>activate.fish</code> running commands embedded in the virtual environment path or in the interpreter's Tcl/Tk library paths. (:issue:<code>3252</code>)</li> </ul> <hr /> <p>v21.7.12 (2026-09-18)</p> <hr /> <h1>Bugfixes - 21.7.12</h1> <ul> <li>Fix <code>activate.bat</code> running arbitrary commands from a crafted <code>--prompt</code>, <code>VIRTUALENV_PROMPT</code>, or config file value. (:issue:<code>3250</code>)</li> <li>Verify a downloaded seed wheel's sha256 against PyPI before seeding it into a virtual environment, skipped when a custom pip index is configured. (:issue:<code>3251</code>)</li> </ul> <hr /> <p>v21.7.11 (2026-09-17)</p> <hr /> <h1>Bugfixes - 21.7.11</h1> <ul> <li>Running <code>activate.bat</code> again before <code>deactivate</code> no longer makes <code>deactivate</code> leave the environment's <code>PKG_CONFIG_PATH</code>, <code>TCL_LIBRARY</code> and <code>TK_LIBRARY</code> behind, or lose values the user had set before the first activation - by :user:<code>darrenhuai</code>. (:issue:<code>3245</code>)</li> <li>Write <code>pyvenv.cfg</code> values on a single line, so a prompt carrying a line boundary can no longer inject configuration. <code>--prompt</code>, the <code>VIRTUALENV_PROMPT</code> environment variable and the config file all set the prompt, and <code>pyvenv.cfg</code> has no escape syntax, so a newline, a carriage return, or any other boundary <code>str.splitlines</code> recognizes, such as <code>U+2028</code>, started a new configuration line. Reading the file back picked up those lines as keys, and since the last value for a key wins, they replaced anything written earlier, including <code>home</code>. (:issue:<code>3247</code>)</li> </ul> <h1>Improved Documentation - 21.7.11</h1> <ul> <li>Document the policy for AI-assisted contributions and the licensing rules for dependencies. (:issue:<code>3239</code>)</li> </ul> <p>Misc - 21.7.11</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/virtualenv/commit/9baea3c1212d8f8b083337afcb28005ecb27385d"><code>9baea3c</code></a> release 21.7.14</li> <li><a href="https://github.com/pypa/virtualenv/commit/ab3dcff43d7ba8abc516e58c24f9bbb6e408d971"><code>ab3dcff</code></a> 🐛 fix(activation): escape ! for csh history expansion (<a href="https://redirect.github.com/pypa/virtualenv/issues/3256">#3256</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/0c295ff1a5f298e8e11935e3588f59f7455c1f8f"><code>0c295ff</code></a> release 21.7.13</li> <li><a href="https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"><code>4d5a105</code></a> 🐛 fix(activation): stop path command injection in bash and fish (<a href="https://redirect.github.com/pypa/virtualenv/issues/3252">#3252</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/0525dcea21865059ffedc70054f6f982be723992"><code>0525dce</code></a> 👷 ci: scope the nushell apt key to its own repo (<a href="https://redirect.github.com/pypa/virtualenv/issues/3253">#3253</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/aa8323a907834e9c16fb734613ce41a6d7e27260"><code>aa8323a</code></a> 🔧 chore: drop misc as a changelog fragment type (<a href="https://redirect.github.com/pypa/virtualenv/issues/3255">#3255</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/a43547765e017f3a13f029e24c6e6f73882e15bc"><code>a435477</code></a> 👷 ci: correct a stale checkout pin comment (<a href="https://redirect.github.com/pypa/virtualenv/issues/3254">#3254</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/9666b42afc8d6103e765d77958d7bae782f5406e"><code>9666b42</code></a> release 21.7.12</li> <li><a href="https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d"><code>a01ed3e</code></a> 🐛 fix(seed): verify downloaded wheel digests (<a href="https://redirect.github.com/pypa/virtualenv/issues/3251">#3251</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6"><code>d721ff1</code></a> 🐛 fix(activation): escape batch quote() against injection (<a href="https://redirect.github.com/pypa/virtualenv/issues/3250">#3250</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/virtualenv/compare/21.7.9...21.7.14">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )