Skip to content

deps(deps): Bump the python-dependencies group across 1 directory with 13 updates - #398

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-47b1bea9fa
Open

deps(deps): Bump the python-dependencies group across 1 directory with 13 updates#398
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-47b1bea9fa

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on hypothesis, ruff, mypy, setuptools, wheel, cmake, types-pyyaml, coverage, ast-serialize, librt, packaging, platformdirs and pygments to permit the latest version.
Updates hypothesis from 6.161.8 to 6.165.10

Commits
  • 6384dee Bump hypothesis version to 6.165.10 and update changelog
  • c7ca59d Merge pull request #4864 from dgutson/claude-stateful-and-example
  • 3fc38f1 claude: teach /hypothesis about stateful tests and @​example
  • 16f24b7 Merge pull request #4862 from Zac-HD/claude/upstream-regex-issues-fkke9q
  • 48ce446 Bump hypothesis version to 6.165.9 and update changelog
  • d559a69 Merge pull request #4860 from Liam-DeVoe/optimize-single-branch-one-of
  • 3a19d89 fix context flag restoration
  • 2408c99 drop unecessary empty check
  • 3f94912 Clarify re.ASCII wording in changelog entry
  • 9d0a9a8 Fix from_regex handling of negative classes, re.ASCII, and zero-min repeats
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Commits

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

Updates setuptools from 83.0.0 to 84.0.0

Changelog

Sourced from setuptools's changelog.

v84.0.0

Features

  • Newline-separated keywords and platformspypa/setuptools#4887old specification <https://peps.python.org/pep-0345/>_ separated items with spaces and the current one uses commas. (#4887)
  • Extensionpypa/distutils#373#5022)
  • The C compiler modules now emit log messages through their own compilers.C.* loggers instead of the distutils root logger, part of decoupling the compilers package from distutils. The logger names are normalized to a stable compilers.C.* prefix so they remain constant as the package migrates toward a standalone compilers.C distribution. (#5266)
  • The C compilers gained a Compiler.call method -- a thin wrapper over subprocess.check_call (with macOS deployment-target env injection) that is the modern replacement for Compiler.spawn. The compilers no longer depend on distutils.spawn, distutils.dir_util, distutils.file_util, distutils._modified, or distutils.util.execute/split_quoted: the generic newer/newer_group and split_quoted helpers are vendored into the compilers package, and Compiler.mkpath/move_file/execute are implemented directly on the standard library (os.makedirs/shutil.move). The methods are retained for backward compatibility. (#5267)
  • The compilers no longer depend on distutils.util, distutils.version, distutils.compat, or distutils._macos_compat. The platform-identification helpers (get_platform/get_host_platform/is_mingw) now live in distutils.compilers.platform.detect and the macOS deployment-target logic and compiler_fixup in distutils.compilers.platform.macos; CygwinCCompiler.gcc_version returns a packaging.version.Version. distutils.util re-exports the platform/macOS helpers from their new homes for backward compatibility rather than keeping duplicate copies. (sysconfig lookups still route through distutils pending its own decoupling.) (#5268)
  • The compilers now read their build configuration from the standard library's sysconfig instead of distutils.sysconfig. Per-compiler customization -- previously distutils.sysconfig.customize_compiler -- has moved into Compiler.configure_system(): a no-op on the base class, with UnixCCompiler applying the compiler/flag/archiver settings CPython recorded in sysconfig (and the usual CC/CFLAGS/LDSHARED/… environment overrides). distutils.sysconfig.customize_compiler is retained as a thin wrapper that calls compiler.configure_system(). (#5269)

Bugfixes

  • The MSVC linker now passes its arguments through a response file when the command line would exceed the Windows maximum length, fixing failures when linking a large number of objects. (#4177)
  • The Cygwin and MinGW compilers now pass -O1 instead of a bare -O. The two are equivalent to GCC, but cc1 rejected the bare form when building 32-bit extensions with -m32. -- by :user:dchaudhari7177 (#4873)
  • copy_filepypa/distutils#379#5079)
  • Setuptools wheels no longer bundled the project's own test modules. -- by :user:itscloud0 (#5212)
  • build_ext no longer fails when cross-compiling with a compiler other than MSVC (such as MinGW). Compiler now provides a no-op initialize()pypa/distutils#399

Improved Documentation

  • Clarified what "correspond exactly to the directory structure" means in the packages section of the Package Discovery user guide. (#4109)
  • Documented how bdist_wheel's py_limited_api option controls abi3 wheel tagging for extension modules -- by :user:Himanshuagrawal4 (#4741)

Deprecations and Removals

  • Compiler.spawn is deprecated in favor of the new Compiler.call. call raises native subprocess exceptions; spawn remains as a shim that emits a DeprecationWarning and translates them to DistutilsExecError. The MSVC spawn compatibility shim for third-party monkeypatches predating the env argument (numpy.distutils before 1.19, per pypa/distutils#15) has been removed. distutils.spawn.spawn is likewise reduced to a thin wrapper around subprocess.check_call: it no longer resolves cmd[0] via shutil.which (subprocess searches PATH itself) nor injects MACOSX_DEPLOYMENT_TARGET (that now lives with the compilers, the only callers to which it applied). (#5267)
  • Building an extension with a MACOSX_DEPLOYMENT_TARGET lower than the interpreter's configured value now raises compilers.errors.PlatformError instead of distutils.errors.DistutilsPlatformError (the macOS deployment-target check moved into the compilers package). CygwinCCompiler.gcc_version returns a packaging.version.Version rather than the removed distutils.version.LooseVersion. Completing the transition begun in pypa/distutils#246, UnixCCompiler.runtime_library_dir_option now returns the ["-Wl,--enable-new-dtags", "-Wl,-rpath,<dir>"] list directly for GNU ld rather than collapsing it into a single string, and the temporary distutils.compat.consolidate_linker_args shim has been removed. (#5268)
  • The compilers now define their own exception vocabulary instead of borrowing distutils' framework errors. Language-agnostic exceptions (Error, UnknownFileType, and a new PlatformError) live at distutils.compilers.errors, leaving room for future compilers.<language> siblings; the C/C++-specific CompileError/LinkError/LibError/PreprocessError remain in distutils.compilers.C.errors. The compilers now raise compilers.errors.PlatformError where they previously raised distutils.errors.DistutilsPlatformError/DistutilsModuleError, and compilers._modified.newer raises the stdlib FileNotFoundError. distutils.errors keeps its own framework exceptions and re-exports the compiler ones (CCompilerError, CompileError, etc.) for backward compatibility; because CCompilerError is compilers.errors.Error, code catching it (as distutils' top-level handlers do) still catches the new PlatformError. (#5270)
  • customize_compiler now asserts that the compiler-related config variables (CC, CXX, CFLAGS, etc.) resolve to strings, raising AssertionError if any are unexpectedly Nonepypa/distutils#363
Commits
  • 72e919a Merge pull request #5293 from pypa/bugfix/integration-pip-flit-backend
  • 1b29701 Select the top-level pyproject.toml when reading build requirements
  • bb1b381 Bump version: 83.0.0 → 84.0.0
  • ee6fdd7 Sync with distutils @ e8eb87855 (#5292)
  • 2a4a9e4 Merge remote-tracking branch 'origin/main' into distutils-e8eb87855
  • cbd1195 Merge https://github.com/jaraco/skeleton
  • bd3594e Merge pull request #5287 from Avasam/Configuring-lint.flake8-comprehensions.a...
  • f02e90a Configure C408 to allow dict(a=1) rather than disabling it
  • c55f52b Configuring lint.flake8-comprehensions.allow-dict-calls-with-keyword-argument...
  • e9904b0 Match the distutils sdist base type for the user_options override
  • Additional commits viewable in compare view

Updates wheel from 0.47.0 to 0.48.0

Release notes

Sourced from wheel's releases.

0.48.0

  • Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel (#570)
  • Fixed wheel convert unnecessarily upgrading compatible core metadata versions (#643)
  • Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (#692)
  • Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw)
Changelog

Sourced from wheel's changelog.

Release Notes

UNRELEASED

  • Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target ([#697](https://github.com/pypa/wheel/issues/697) <https://github.com/pypa/wheel/pull/697>_)

0.48.0 (2026-08-12)

  • Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel ([#570](https://github.com/pypa/wheel/issues/570) <https://github.com/pypa/wheel/issues/570>_)
  • Fixed wheel convert unnecessarily upgrading compatible core metadata versions ([#643](https://github.com/pypa/wheel/issues/643) <https://github.com/pypa/wheel/issues/643>_)
  • Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header ([#692](https://github.com/pypa/wheel/issues/692) <https://github.com/pypa/wheel/issues/692>_)
  • Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw>_)

0.47.0 (2026-04-22)

  • Added the wheel info subcommand to display metadata about wheel files without unpacking them ([#639](https://github.com/pypa/wheel/issues/639) <https://github.com/pypa/wheel/issues/639>_)
  • Fixed WheelFile raising Missing RECORD file when the wheel filename contains uppercase characters (e.g. Django-3.2.5.whl) but the .dist-info directory inside uses normalized lowercase naming ([#411](https://github.com/pypa/wheel/issues/411) <https://github.com/pypa/wheel/issues/411>_)

0.46.3 (2026-01-22)

  • Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command ([#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676>_)

0.46.2 (2026-01-22)

  • Restored the bdist_wheel command for compatibility with setuptools older than v70.1
  • Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning
  • Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1 (2025-04-08)

... (truncated)

Commits
  • 21c4da4 Fixed the release heading format
  • f06d4db Flit no longer supports --setup-py
  • 1a96c3e Created a new release
  • d7d625d Fixed wheel convert writing outside the target directory on malicious input (...
  • 986a440 Strip ZIP64 extra field when retagging wheels (#692) (#695)
  • 0ca6f24 feat: add --local-version option to wheel pack (#694)
  • 4a63caf Preserve compatible metadata versions in convert (#690)
  • 33650c6 [pre-commit.ci] pre-commit autoupdate (#691)
  • 197012d Increased the upper bound for flit-core as a build requirement
  • See full diff in compare view

Updates cmake to 4.4.2

Commits

Updates types-pyyaml from 6.0.12.20260724 to 6.0.12.20260815

Commits

Updates coverage from 7.15.2 to 7.15.4

Release notes

Sourced from coverage's releases.

7.15.4

Version 7.15.4 — 2026-08-06

  • Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
  • Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
  • Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
  • A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
  • Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

Changelog

Sourced from coverage's changelog.

Version 7.15.4 — 2026-08-06

  • Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn't escaped where it's dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.

  • Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.

  • Wheels are now provided for Python 3.15.

.. _pull 2226: coveragepy/coveragepy#2226 .. _pull 2227: coveragepy/coveragepy#2227

.. _changes_7-15-3:

Version 7.15.3 — 2026-08-02

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>. Closes issue 2200.

  • A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios <pull 2239_>_.

  • Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: coveragepy/coveragepy#2200 .. _pull 2234: coveragepy/coveragepy#2234 .. _pull 2239: coveragepy/coveragepy#2239 .. _pull 2240: coveragepy/coveragepy#2240

.. _changes_7-15-2:

Commits
  • 4c0e7ff docs: sample HTML for 7.15.4
  • db4cc32 docs: prep for 7.15.4
  • c33085c style: start gradual move to ruff 0.16
  • 53a0fd5 fix: neutralize control characters in lcov report fields (#2226)
  • b64d53d build: make 3.15 wheels
  • 53792ab build: show the python version for kits
  • f6b03c7 chore: make upgrade_one package=cibuildwheel
  • d9b660a chore: make upgrade
  • b128a31 docs: oops, move this entry to the correct place
  • a7a2c15 fix: escape filename urls in html report href attributes (#2227)
  • Additional commits viewable in compare view

Updates ast-serialize from 0.6.0 to 0.8.0

Commits

Updates librt from 0.13.0 to 0.15.0

Commits

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() &lt;packaging.specifiers.SpecifierSet.to_range&gt;,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() &lt;packaging.specifiers.SpecifierSet.is_subset&gt;, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates platformdirs from 4.11.0 to 4.11.3

Release notes

Sourced from platformdirs's releases.

4.11.3

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.2...4.11.3

4.11.2

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.1...4.11.2

4.11.1

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.11.0...4.11.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.3 (2026-08-13)

  • python -m platformdirs now lists :func:~platformdirs.user_desktop_dir, which was missing from the properties it prints. :pr:523
  • Stop :func:~platformdirs.site_data_dir, :func:~platformdirs.site_config_dir and :func:~platformdirs.site_applications_dir raising IndexError on Unix and macOS when $XDG_DATA_DIRS or $XDG_CONFIG_DIRS holds only separators and whitespace, such as ":". These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:523

4.11.2 (2026-08-10)

  • Stop :meth:~platformdirs.PlatformDirs.iter_cache_dirs, :meth:~platformdirs.PlatformDirs.iter_state_dirs, :meth:~platformdirs.PlatformDirs.iter_log_dirs and :meth:~platformdirs.PlatformDirs.iter_runtime_dirs yielding the same directory twice on Unix when use_site_for_root is active - :pr:469 fixed this for the config and data iterators only. On macOS, :meth:~platformdirs.PlatformDirs.iter_cache_dirs now yields the Homebrew and /Library/Caches entries separately rather than one os.pathsep-joined string when multipath is set. :pr:520

4.11.1 (2026-08-07)

  • Fix :func:~platformdirs.user_desktop_dir on Windows builds without ctypesDescription has been truncated

@dependabot
deps(deps): Bump the python-dependencies group across 1 directory wit…
95552f9 
…h 13 updates

Updates the requirements on [hypothesis](https://github.com/HypothesisWorks/hypothesis), [ruff](https://github.com/astral-sh/ruff), [mypy](https://github.com/python/mypy), [setuptools](https://github.com/pypa/setuptools), [wheel](https://github.com/pypa/wheel), [cmake](https://github.com/scikit-build/cmake-python-distributions), [types-pyyaml](https://github.com/python/typeshed), [coverage](https://github.com/coveragepy/coveragepy), [ast-serialize](https://github.com/mypyc/ast_serialize), [librt](https://github.com/mypyc/librt), [packaging](https://github.com/pypa/packaging), [platformdirs](https://github.com/tox-dev/platformdirs) and [pygments](https://github.com/pygments/pygments) to permit the latest version.

Updates `hypothesis` from 6.161.8 to 6.165.10
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.161.8...v6.165.10)

Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)

Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)

Updates `setuptools` from 83.0.0 to 84.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v83.0.0...v84.0.0)

Updates `wheel` from 0.47.0 to 0.48.0
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](pypa/wheel@0.47.0...0.48.0)

Updates `cmake` to 4.4.2
- [Release notes](https://github.com/scikit-build/cmake-python-distributions/releases)
- [Changelog](https://github.com/scikit-build/cmake-python-distributions/blob/main/HISTORY.rst)
- [Commits](scikit-build/cmake-python-distributions@4.4.0...4.4.2)

Updates `types-pyyaml` from 6.0.12.20260724 to 6.0.12.20260815
- [Commits](https://github.com/python/typeshed/commits)

Updates `coverage` from 7.15.2 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.2...7.15.4)

Updates `ast-serialize` from 0.6.0 to 0.8.0
- [Commits](mypyc/ast_serialize@v0.6.0...v0.8.0)

Updates `librt` from 0.13.0 to 0.15.0
- [Commits](mypyc/librt@v0.13.0...v0.15.0)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `platformdirs` from 4.11.0 to 4.11.3
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.0...4.11.3)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

---
updated-dependencies:
- dependency-name: hypothesis
  dependency-version: 6.165.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.16.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: setuptools
  dependency-version: 84.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: wheel
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: cmake
  dependency-version: 4.4.2
  dependency-type: direct:development
  dependency-group: python-dependencies
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260815
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: coverage
  dependency-version: 7.15.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: ast-serialize
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: librt
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: platformdirs
  dependency-version: 4.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates python Python dependency updates labels Aug 24, 2026
@dependabot
dependabot Bot requested a review from Steel-SecAdv-LLC as a code owner August 24, 2026 09:16
@dependabot dependabot Bot added dependencies Dependency updates python Python dependency updates labels Aug 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Steel-SecAdv-LLC Steel-SecAdv-LLC Awaiting requested review from Steel-SecAdv-LLC Steel-SecAdv-LLC is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Dependency updates python Python dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants