From 6514d8e51b89adef73aa42e7a2759f611db73cbc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 11:37:48 +0000 Subject: [PATCH 1/5] Bump github/codeql-action from 4.37.9 to 4.38.0 (#13697) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.9 to 4.38.0.
Release notes

Sourced from github/codeql-action's releases.

v4.38.0

Changelog

Sourced from github/codeql-action's changelog.

4.38.0 - 09 Sept 2026

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4.37.9&new-version=4.38.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cf6fbc17ef3..88c344b6ae4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -29,17 +29,17 @@ jobs: uses: actions/checkout@v7 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.9 + uses: github/codeql-action/init@v4.38.0 with: languages: ${{ matrix.language }} config-file: ./.github/codeql.yml queries: +security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@v4.37.9 + uses: github/codeql-action/autobuild@v4.38.0 if: ${{ matrix.language == 'python' || matrix.language == 'javascript' }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.9 + uses: github/codeql-action/analyze@v4.38.0 with: category: "/language:${{ matrix.language }}" From 8969d74485d820fa6761fa2722b7b41076eb6a7c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 12:15:34 +0000 Subject: [PATCH 2/5] Bump multidict from 6.7.1 to 6.8.0 (#13703) Bumps [multidict](https://github.com/aio-libs/multidict) from 6.7.1 to 6.8.0.
Release notes

Sourced from multidict's releases.

6.8.0

Bug fixes

  • A segmentation fault that could be triggered when getting an item is now fixed -- by :user:Vizonex.

    Related issues and pull requests on GitHub: #1310.

  • Fixed reference leak in iterators, views and istr -- by :user:Vizonex.

    Related issues and pull requests on GitHub: #1311.

  • Fixed the pure-Python :class:~multidict.MultiDict constructor and :py:meth:~multidict.MultiDict.extend, :py:meth:~multidict.MultiDict.update, and :py:meth:~multidict.MultiDict.merge methods over-allocating their internal hash table when called with both a positional argument and keyword arguments, because keyword arguments were counted twice in the size estimate -- by :user:aiolibsbot.

    Related issues and pull requests on GitHub: #1338.

  • Fixed __repr__ of :class:~multidict.MultiDict, :class:~multidict.CIMultiDict, their proxies, and the keys/items views producing invalid output when keys contained quote characters -- keys are now formatted with :func:repr so the result is a valid Python string literal -- by :user:aiolibsbot.

    Related issues and pull requests on GitHub: #1342.

  • Fixed a segfault when calling :py:meth:~multidict.MultiDict.add with only one of its two required arguments supplied by keyword, e.g. d.add(key="k"). Extra keyword arguments passed to the lookup and removal methods are also now rejected with :exc:TypeError instead of being silently ignored.

    -- by :user:devdanzin

    Related issues and pull requests on GitHub: #1376.

  • Fixed a segfault when constructing a multidict iterator type directly, e.g. type(iter(md.keys())).__new__(...). Such an iterator had a NULL internal pointer that next() dereferenced. The iterator types now forbid direct instantiation, the same way the view types were fixed in #1163.

    -- by :user:devdanzin

    Related issues and pull requests on GitHub: #1377.

... (truncated)

Changelog

Sourced from multidict's changelog.

6.8.0

(2026-09-09)

Bug fixes

  • A segmentation fault that could be triggered when getting an item is now fixed -- by :user:Vizonex.

    Related issues and pull requests on GitHub: :issue:1310.

  • Fixed reference leak in iterators, views and istr -- by :user:Vizonex.

    Related issues and pull requests on GitHub: :issue:1311.

  • Fixed the pure-Python :class:~multidict.MultiDict constructor and :py:meth:~multidict.MultiDict.extend, :py:meth:~multidict.MultiDict.update, and :py:meth:~multidict.MultiDict.merge methods over-allocating their internal hash table when called with both a positional argument and keyword arguments, because keyword arguments were counted twice in the size estimate -- by :user:aiolibsbot.

    Related issues and pull requests on GitHub: :issue:1338.

  • Fixed __repr__ of :class:~multidict.MultiDict, :class:~multidict.CIMultiDict, their proxies, and the keys/items views producing invalid output when keys contained quote characters -- keys are now formatted with :func:repr so the result is a valid Python string literal -- by :user:aiolibsbot.

    Related issues and pull requests on GitHub: :issue:1342.

  • Fixed a segfault when calling :py:meth:~multidict.MultiDict.add with only one of its two required arguments supplied by keyword, e.g. d.add(key="k"). Extra keyword arguments passed to the lookup and removal methods are also now rejected with :exc:TypeError instead of being silently ignored.

    -- by :user:devdanzin

    Related issues and pull requests on GitHub: :issue:1376.

  • Fixed a segfault when constructing a multidict iterator type directly, e.g. type(iter(md.keys())).__new__(...). Such an iterator had a NULL internal pointer that next() dereferenced. The iterator types now forbid direct instantiation, the same way the view types were fixed in :issue:1163.

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=multidict&package-manager=pip&previous-version=6.7.1&new-version=6.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 2 +- requirements/cython.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/multidict.txt | 2 +- requirements/runtime-deps.txt | 2 +- requirements/test-common-base.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index 05eb111844f..357eb359b77 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -30,7 +30,7 @@ gunicorn==26.2.0 # via -r requirements/base-ft.in idna==3.19 # via yarl -multidict==6.7.1 +multidict==6.8.0 # via # -r requirements/runtime-deps.in # yarl diff --git a/requirements/base.txt b/requirements/base.txt index fe468e38bc3..5a0d7ba2e09 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -30,7 +30,7 @@ gunicorn==26.2.0 # via -r requirements/base.in idna==3.19 # via yarl -multidict==6.7.1 +multidict==6.8.0 # via # -r requirements/runtime-deps.in # yarl diff --git a/requirements/constraints.txt b/requirements/constraints.txt index b6aa6bb97c3..f83e828cc3d 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -138,7 +138,7 @@ mdit-py-plugins==0.6.1 # via myst-parser mdurl==0.1.2 # via markdown-it-py -multidict==6.7.1 +multidict==6.8.0 # via # -r requirements/multidict.in # -r requirements/runtime-deps.in diff --git a/requirements/cython.txt b/requirements/cython.txt index cc286a5f8be..ae38b7d3bd6 100644 --- a/requirements/cython.txt +++ b/requirements/cython.txt @@ -6,7 +6,7 @@ # cython==3.3.0 # via -r requirements/cython.in -multidict==6.7.1 +multidict==6.8.0 # via -r requirements/multidict.in typing-extensions==4.16.0 # via multidict diff --git a/requirements/dev.txt b/requirements/dev.txt index 8b56c023e2a..ebcda7291f7 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -136,7 +136,7 @@ mdit-py-plugins==0.6.1 # via myst-parser mdurl==0.1.2 # via markdown-it-py -multidict==6.7.1 +multidict==6.8.0 # via # -r requirements/runtime-deps.in # aiohttp diff --git a/requirements/lint.txt b/requirements/lint.txt index 640e8e22f6b..1d2b223cb69 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -72,7 +72,7 @@ markdown-it-py==4.2.0 # via rich mdurl==0.1.2 # via markdown-it-py -multidict==6.7.1 +multidict==6.8.0 # via # aiohttp # yarl diff --git a/requirements/multidict.txt b/requirements/multidict.txt index 212ed1c606f..221f049abf2 100644 --- a/requirements/multidict.txt +++ b/requirements/multidict.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/multidict.txt --resolver=backtracking --strip-extras requirements/multidict.in # -multidict==6.7.1 +multidict==6.8.0 # via -r requirements/multidict.in typing-extensions==4.16.0 # via multidict diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index 051b41d08af..18baf2a2221 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -28,7 +28,7 @@ frozenlist==1.8.0 # aiosignal idna==3.19 # via yarl -multidict==6.7.1 +multidict==6.8.0 # via # -r requirements/runtime-deps.in # yarl diff --git a/requirements/test-common-base.txt b/requirements/test-common-base.txt index 2fc5b13681e..07017f18ee2 100644 --- a/requirements/test-common-base.txt +++ b/requirements/test-common-base.txt @@ -28,7 +28,7 @@ idna==3.19 # via yarl iniconfig==2.3.0 # via pytest -multidict==6.7.1 +multidict==6.8.0 # via # aiohttp # yarl diff --git a/requirements/test-common.txt b/requirements/test-common.txt index ec31e41ba81..32f454b09db 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -54,7 +54,7 @@ markdown-it-py==4.2.0 # via rich mdurl==0.1.2 # via markdown-it-py -multidict==6.7.1 +multidict==6.8.0 # via # aiohttp # yarl diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index ada6a3684f4..6f0695e9ecd 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -75,7 +75,7 @@ markdown-it-py==4.2.0 # via rich mdurl==0.1.2 # via markdown-it-py -multidict==6.7.1 +multidict==6.8.0 # via # -r requirements/runtime-deps.in # aiohttp diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index 3364b7fd15d..1574b90c8d4 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -53,7 +53,7 @@ idna==3.19 # via yarl iniconfig==2.3.0 # via pytest -multidict==6.7.1 +multidict==6.8.0 # via # -r requirements/runtime-deps.in # aiohttp diff --git a/requirements/test.txt b/requirements/test.txt index 1333b9a2e5b..9c6936dfa3a 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -75,7 +75,7 @@ markdown-it-py==4.2.0 # via rich mdurl==0.1.2 # via markdown-it-py -multidict==6.7.1 +multidict==6.8.0 # via # -r requirements/runtime-deps.in # aiohttp From 1eed63cd80c124f67ff241ced4e9305c4b9e1627 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 12:16:00 +0000 Subject: [PATCH 3/5] Bump virtualenv from 21.7.8 to 21.7.9 (#13707) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.8 to 21.7.9.
Release notes

Sourced from virtualenv's releases.

21.7.9

What's Changed

Full Changelog: https://github.com/pypa/virtualenv/compare/21.7.8...21.7.9

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.9

  • Replace dangling symlinks, including interpreter aliases, when recreating an environment. This prevents FileExistsError with --symlinks and writes outside the environment with --copies - by :user:darrenhuai. (:issue:3229)
  • Ignore malformed or unreadable virtualenv.ini files and report the error in the log and --help. Accept a UTF-8 byte order mark, as written by PowerShell 5 and older Notepad versions - by :user:darrenhuai. (:issue:3230)

v21.7.8 (2026-09-01)

Commits
  • abd3829 release 21.7.9
  • 66fadcb 🐛 fix(util): replace a stale symlink instead of writing through it (#3229)
  • 4b31a63 🐛 fix(config): ignore a config file that fails to parse instead of crashing (...
  • f9010b3 [pre-commit.ci] pre-commit autoupdate (#3231)
  • 2ef85af fix(test): EncodingWarning: 'encoding' argument not specified (#3228)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=virtualenv&package-manager=pip&previous-version=21.7.8&new-version=21.7.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index f83e828cc3d..904d2716492 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -333,7 +333,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.8 +virtualenv==21.7.9 # via pre-commit wheel==0.48.0 # via pip-tools diff --git a/requirements/dev.txt b/requirements/dev.txt index ebcda7291f7..8c0f9b44939 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -323,7 +323,7 @@ uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpytho # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.8 +virtualenv==21.7.9 # via pre-commit wheel==0.48.0 # via pip-tools diff --git a/requirements/lint.txt b/requirements/lint.txt index 1d2b223cb69..3dec64d4133 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -166,7 +166,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # via -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.8 +virtualenv==21.7.9 # via pre-commit yarl==1.24.5 # via aiohttp From 99c4988bfdac5669893b765d7879930791ca518a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 12:34:36 +0000 Subject: [PATCH 4/5] Bump filelock from 3.32.5 to 3.32.6 (#13705) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.5 to 3.32.6.
Release notes

Sourced from filelock's releases.

3.32.6

What's Changed

New Contributors

Full Changelog: https://github.com/tox-dev/filelock/compare/3.32.5...3.32.6

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.6 (2026-09-08)

  • SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
  • Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724
  • Honor acquisition timeouts and blocking=False during SoftReadWriteLock state-mutex contention, including failed writer cleanup. Cross-host recovery of an abandoned .state marker remains unsupported. :pr:726
  • Allow acquiring existing lock files that grant write access through group permissions or an ACL even when their owner-write mode bit is unset. :pr:728
  • Preserve exception notes and custom attributes when copying or pickling Timeout and SoftFileLockProtocolError. :pr:729

3.32.5 (2026-08-31)

  • SoftFileLease.token and AsyncSoftFileLease.token now read None after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:721
  • Document that mode has no setter: unlike poll_interval, timeout, blocking and lifetime, it is fixed at construction and lock.mode = ... raises AttributeError. :pr:716

3.32.4 (2026-08-23)

  • StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
  • WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
  • Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

3.32.3 (2026-08-13)

  • The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

... (truncated)

Commits
  • 4efd93e Release 3.32.6
  • 7b7b7a8 Fix SoftReadWriteLock state lock timeout (#726)
  • f2f7b86 fix: respect ACL write access when the owner write bit is absent (#728)
  • e947a69 test(soft-rw): reuse existing test module (#730)
  • da3ae2b fix: preserve exception notes when copying and pickling (#729)
  • ae9cb5b 🐛 fix(soft-rw): reject non-finite timing options (#724)
  • d00f9bb [pre-commit.ci] pre-commit autoupdate (#727)
  • 82f66d7 🐛 fix(lease): reject a duration no marker can carry (#723)
  • 1d9e9e7 [pre-commit.ci] pre-commit autoupdate (#722)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.32.5&new-version=3.32.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 904d2716492..c0c301e9dfd 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -87,7 +87,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.32.5 +filelock==3.32.6 # via # python-discovery # virtualenv diff --git a/requirements/dev.txt b/requirements/dev.txt index 8c0f9b44939..085d03a3719 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -85,7 +85,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.32.5 +filelock==3.32.6 # via # python-discovery # virtualenv diff --git a/requirements/lint.txt b/requirements/lint.txt index 3dec64d4133..8e019e49a77 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -44,7 +44,7 @@ exceptiongroup==1.3.1 # via # aiofastnet # pytest -filelock==3.32.5 +filelock==3.32.6 # via # python-discovery # virtualenv From 51863938a8022e46585d457363ae9d10f829f74f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 12:39:38 +0000 Subject: [PATCH 5/5] Bump build from 1.6.0 to 1.6.1 (#13710) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [build](https://github.com/pypa/build) from 1.6.0 to 1.6.1.
Release notes

Sourced from build's releases.

1.6.1

What's Changed

Full Changelog: https://github.com/pypa/build/compare/1.6.0...1.6.1

Changelog

Sourced from build's changelog.

#################### 1.6.1 (2026-09-10) ####################

Bugfixes

  • Avoid trying to detect symlinks on Windows, regression in 1.6.0 - by :user:henryiii (:issue:1175) (:issue:1175)

Documentation

  • Fix doubled backslashes in the Windows pip config path (%APPDATA%\pip\pip.ini) in the docs - by :user:aroh3006 (:issue:1149)

Miscellaneous

  • :issue:1168, :issue:1170, :issue:1178

#################### 1.6.0 (2026-08-27) ####################

Features

  • Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
  • The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
  • The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
  • Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
  • Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
    • by :user:gaborbernat (:issue:655)
  • Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
  • On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

Bugfixes

... (truncated)

Commits
  • 89cccef chore: prepare for 1.6.1
  • a6f707a ci: support releases from v* branches (#1178)
  • 7785161 docs: fix doubled backslashes in Windows pip config path (#1149)
  • 244b250 fix: always use copies for the isolated venv on Windows (#1176)
  • c93ca6f build(deps): bump re-actors/alls-green from 1.2.2 to 1.3.0 in the github-acti...
  • e02ffd3 pre-commit: bump repositories (#1173)
  • aad39a8 docs: fix changelog page heading levels and sidebar (#1171)
  • 5c3fd46 docs: use PyPI ref directly (#1172)
  • 1c5bd6c 🐛 fix(release): format generated changelog (#1170)
  • 7f0cc7e 🔧 build(type): replace mypy with pyrefly (#1168)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=build&package-manager=pip&previous-version=1.6.0&new-version=1.6.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index c0c301e9dfd..32210cd9454 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -51,7 +51,7 @@ blockbuster==1.5.27 # -r requirements/test-common.in brotli==1.2.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -build==1.6.0 +build==1.6.1 # via pip-tools certifi==2026.7.22 # via requests diff --git a/requirements/dev.txt b/requirements/dev.txt index 085d03a3719..7ce427eae91 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -51,7 +51,7 @@ blockbuster==1.5.27 # -r requirements/test-common.in brotli==1.2.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -build==1.6.0 +build==1.6.1 # via pip-tools certifi==2026.7.22 # via requests