[dependabot]

Bumps the uv group with 10 updates:

Package	From	To
pre-commit	4.6.2	4.7.0
distlib	0.4.3	0.4.4
filelock	4.0.9	4.2.1
platformdirs	4.12.4	4.13.4
pluggy	1.6.0	1.7.0
python-discovery	1.6.2	1.6.4
tomlkit	0.15.1	0.15.2
virtualenv	21.14.6	21.14.12
wcwidth	0.9.2	0.9.3
wrapt	2.5.0	2.5.1

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Commits

• 65bb884 v4.7.0
• 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
• 860d07d don't leak GIT_* env into npm install for language: node
• 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
• 9905e88 use contextlib.chdir
• 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
• 2be1701 remove triple-nested withs for 3.14 coverage
• 4c8d22a py311+
• c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
• f49e251 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates distlib from 0.4.3 to 0.4.4

Changelog

Sourced from distlib's changelog.

0.4.4

Released: 2026-10-16


compat

Fixed a missing import. Thanks to Andrej730 for the patch.



markers

Fixed #273: Enforce compatible-release bounds in environment markers.
Thanks to Luochenchen for the patch.



metadata

Fix #194: Add an urls property to expose project and home URLs. Thanks to
Sinkleberg for the patch.



scripts


Raise the correct exception when a launcher can't be written. Thanks to
candygoogy for the patch.


Fix #144: Detect shell-script Python executables in ScriptMaker shebangs.
Thanks to Alex Chen for the patch.




util


Improve performance of export entry search to take linear time. Thanks to
Brian Willows for the patch.


Use tarfile.data_filter rather than tarfile.tar_filter in unarchive()
when extraction filters are available, matching the Python 3.14 default. Path and
link containment checks now use os.path.realpath and no longer fail with
IndexError for members such as . or ./. Thanks to Kobain for the patch.


unarchive() now resolves member paths through symlinks seen earlier in the
same archive, so a chain of individually harmless-looking links cannot be used
to write outside the destination on Pythons without extraction filters. Thanks to
Kobain for the patch.




version


Improve NormalizedVersion by addressing correctness and performance gaps
found by comparison with packaging. Thanks to Damian Shaw for the patch.


Improve SemanticVersion by comparing numeric prerelease identifiers,
including those longer than 8 digits. Thanks to Muneeb Sheikh for the
patch.

Commits

• 25eed06 Changes for 0.4.4.
• 8ffee6f Resolve member paths through earlier archive symlinks in unarchive()
• ef4a390 Test that data_filter rejects absolute symlinks with check=False
• 380b6a9 Use data_filter and realpath containment checks in unarchive()
• 7b7c572 fix: enforce compatible-release bounds in markers (#274)
• 38811dd Detect shell-script Python executables in ScriptMaker shebangs (#144) (#264)
• 06ddb5d Compare numeric prerelease identifiers without a digit limit (#270)
• e54dd8c Raise the original error when a launcher can't be written (#269)
• c6270e3 Fix NormalizedVersion gaps found by comparison with packaging (#271)
• 5b3092b Search export entries in linear time (#266)
• Additional commits viewable in compare view

Updates filelock from 4.0.9 to 4.2.1

Release notes

Sourced from filelock's releases.

4.2.1

• On a singleton wrapper, close> and close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #832
• ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins its queue no longer blocks every later call on that lock. #833
• Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #834
• Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. #835
• Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no longer carry group or other write bits. A process name containing a carriage return or another line separator no longer makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check no longer compares start times and keeps the marker. #836
• The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat recorded a lost hold, it refuses new acquires until that hold is released. #838
• StrictSoftFileLock creates <path>.filelock and its claims directory with the lock's mode and sets the sticky bit (a directory flag that lets only a file's owner remove it) on both. On the next acquisition it narrows a directory it owns that an earlier release created wider; it leaves a directory of another account as it is, so remove such leftovers by hand. It reaches claims through a descriptor opened without following symlinks; on Windows it holds both directories open and refuses a junction (a directory that points at another directory). Under a sticky parent such as /tmp it refuses a coordination directory of another account, as SoftReadWriteLock does for <path>.rw. One read grace now covers a whole claim scan, a failed claim cleanup no longer leaves the sentinel descriptor open, and a non-regular node at a sentinel private-record name raises SoftFileLockProtocolError. On Windows, contenders read claims without blocking their owner's unlink. #839

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.2.4 (2026-10-19)

---

• Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. :pr:863

---

4.2.3 (2026-10-19)

---

• Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:860
• Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

---

4.2.2 (2026-10-18)

---

• Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

---

4.2.1 (2026-10-17)

---

• On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
• :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
• Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database

... (truncated)

Commits

• 60331bb Release 4.2.1
• 834bf13 🧪 test(soft): skip Unix pin test on Windows
• 9d15e38 fix(soft-rw): isolate subclass singleton registries (#855)
• e1e825b 🐛 fix(open): keep lock files intact, honor deadlines and mode (#835)
• 5e3f2ec 🐛 fix(read-write): keep SQLite off shared names, bound schema (#834)
• bfa066d 🐛 fix(strict): keep claim directories private to the lock (#839)
• 977d2c3 🐛 fix(soft): wait on an empty marker instead of evicting (#846)
• 740ff66 🐛 fix(soft): break stale markers without emptying the lock path (#843)
• 86c6d5f 🐛 fix(async): honor cancellation and per-thread gates (#844)
• eeceaa8 🐛 fix(soft): keep live holders when owner identity differs (#836)
• Additional commits viewable in compare view

Updates platformdirs from 4.12.4 to 4.13.4

Release notes

Sourced from platformdirs's releases.

4.13.4

• Require a complete files path segment when locating Android app directories from sys.path. #621
• Keep root directory tests independent of inherited XDG environment variables. #622
• Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. #624
• Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. #625
• Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. #627
• Correct the contributor guide to name ty as the type checker used by the type environment. #623

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.3...4.13.4

4.13.3

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.2...4.13.3

4.13.2

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. #619

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.1...4.13.2

4.13.1

• Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. #618
• Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.0...4.13.1

4.13.0

• Detect Homebrew Python for the MacOS site directories under python:-S, which leaves base_prefix on the Cellar keg, and for the python-freethreading formula - by sricharanreddycheruku. #612
• Use Python 3.15 for development and automation. #613

PyPI release

Full Changelog: tox-dev/platformdirs@4.12.4...4.13.0

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.13.5 (2026-10-19)

---

• Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. :pr:631

---

4.13.4 (2026-10-17)

---

• Require a complete files path segment when locating Android app directories from sys.path. :pr:621
• Keep root directory tests independent of inherited XDG environment variables. :pr:622
• Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. :pr:624
• Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. :pr:625
• Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. :pr:627
• Correct the contributor guide to name ty as the type checker used by the type environment. :pr:623

---

4.13.3 (2026-10-16)

---

---

4.13.2 (2026-10-16)

---

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

---

4.13.1 (2026-10-15)

---

• Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. :pr:618
• Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

---

4.13.0 (2026-10-10)

---

... (truncated)

Commits

• caa5626 Release 4.13.4
• 9b5c0fd fix(windows): raise when no home directory resolves (#627)
• da72995 fix: require a complete files segment when finding Android app folders (#621)
• da89726 test: isolate root directory checks from inherited XDG settings (#622)
• fb0b1a9 fix: keep root directory accessors consistent during isolation (#625)
• 91f7775 fix(ios): raise when no home directory resolves (#624)
• ed9f25f ci: rerun news check on label changes (#626)
• 334f83c docs: correct type checker in contributor guide (#623)
• 97a8dbc Release 4.13.3
• ca20f65 Release 4.13.2
• Additional commits viewable in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

• [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

• [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

• [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

  A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

• [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

• [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

• [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

• [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

  As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits

• 4c7f636 Preparing release 1.7.0
• 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
• 628959b docs: remove outdated hookimpl default args paragraph
• 2edab5e Merge pull request #752 from bluetech/register-none-allow
• 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
• 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
• 6a7e84e Add changelog fragment for #776
• d22cfb5 Drop tox from the dev dependency group
• 74cbfa2 Relock pytest and tox that dependabot downgraded
• 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
• Additional commits viewable in compare view

Updates python-discovery from 1.6.2 to 1.6.4

Release notes

Sourced from python-discovery's releases.

v1.6.4

Improved documentation - 1.6.4

• Clarify the executable paths accepted by try_first_with in the standalone usage example. (#150)

PyPI release

Full Changelog: tox-dev/python-discovery@1.6.3...1.6.4

1.6.3

Bug fixes - 1.6.3

• Treat specs with dot-only version components, such as python., as literal executable paths instead of raising IndexError - by harbinresearcher. (#147)
• Pass PEP 514 ExecutableArguments to registered Windows interpreters when querying them, so a registration that points at a launcher such as py.exe -3.11 reports the interpreter it selects - by blouirts123. (#148)

PyPI release

Full Changelog: tox-dev/python-discovery@1.6.2...1.6.3

Changelog

Sourced from python-discovery's changelog.

Improved documentation - 1.6.4

• Clarify the executable paths accepted by try_first_with in the standalone usage example. (:issue:150)

---

v1.6.3 (2026-10-16)

---

Bug fixes - 1.6.3

• Treat specs with dot-only version components, such as python., as literal executable paths instead of raising IndexError - by :user:harbinresearcher. (:issue:147)
• Pass PEP 514 ExecutableArguments to registered Windows interpreters when querying them, so a registration that points at a launcher such as py.exe -3.11 reports the interpreter it selects - by :user:blouirts123. (:issue:148)

---

v1.6.2 (2026-10-10)

---

Commits

• 885805a release 1.6.4
• 1a6b5cd fix(release): trim GitHub notes (#154)
• ac862a4 👷 ci: publish release after PyPI (#153)
• 4d53c08 build(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the github-acti...
• 1701972 👷 ci(release): require changelog entries (#151)
• 9f051ac docs: use an executable path in the try_first_with example (#150)
• 3b72b55 test: move argument tests into existing file (#149)
• cbb2abd fix: honor PEP 514 executable arguments during discovery (#148)
• ab2abc8 fix(spec): handle dot-only version components (#147)
• 1c9af8e build(deps): bump the github-actions group with 2 updates (#145)
• Additional commits viewable in compare view

Updates tomlkit from 0.15.1 to 0.15.2

Release notes

Sourced from tomlkit's releases.

0.15.2

What's Changed

• Fix inline table separator after append by @​cyliu0 in python-poetry/tomlkit#477
• chore(deps): bump idna from 3.7 to 3.15 in /docs by @​dependabot[bot] in python-poetry/tomlkit#481
• chore(deps-dev): bump idna from 3.7 to 3.15 by @​dependabot[bot] in python-poetry/tomlkit#480
• chore(deps): bump urllib3 from 2.5.0 to 2.7.0 in /docs by @​dependabot[bot] in python-poetry/tomlkit#475
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in python-poetry/tomlkit#478
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in python-poetry/tomlkit#484
• Fix duplicated comma when removing a middle inline table element by @​sarathfrancis90 in python-poetry/tomlkit#486
• Add native contains to Container, Table and InlineTable by @​tfoutrein in python-poetry/tomlkit#487
• Make Source index-based instead of materializing a char list by @​tfoutrein in python-poetry/tomlkit#489
• reject surrogate code points in \U unicode escapes by @​netliomax25-code in python-poetry/tomlkit#493
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in python-poetry/tomlkit#496
• Scan character runs in bulk while parsing by @​tfoutrein in python-poetry/tomlkit#490
• Fix doubled comma when inserting into a comma-first array by @​binggao1230 in python-poetry/tomlkit#499
• reject tab characters in bare keys by @​netliomax25-code in python-poetry/tomlkit#497
• reject non-hex digits in \u and \U escapes by @​netliomax25-code in python-poetry/tomlkit#501
• Bulk-scan single-line string bodies by @​tfoutrein in python-poetry/tomlkit#491
• Remove the internal TOMLChar wrapper by @​tfoutrein in python-poetry/tomlkit#492
• Fix corrupt output when adding to a dotted key inside an inline table by @​binggao1230 in python-poetry/tomlkit#500
• Compare StringType members by identity instead of building a set by @​tfoutrein in python-poetry/tomlkit#502
• Merge super tables in place instead of deep-copying on every merge by @​tfoutrein in python-poetry/tomlkit#503
• Move a value replacing a table out of the table region by @​binggao1230 in python-poetry/tomlkit#506
• Restore dumps() delegating to as_string for non-Mapping wrappers by @​binggao1230 in python-poetry/tomlkit#508
• Limit parser nesting depth instead of crashing with RecursionError by @​binggao1230 in python-poetry/tomlkit#510
• Prefix every line of a multiline comment with # by @​binggao1230 in python-poetry/tomlkit#511
• Add a native OutOfOrderTableProxy.contains by @​tfoutrein in python-poetry/tomlkit#515
• Place inline-table separator after the value, not a trailing comment (fix #512) by @​binggao1230 in python-poetry/tomlkit#514
• reject a table redefined after its parent table header by @​netliomax25-code in python-poetry/tomlkit#516
• Don't build a discarded error when an array closes right after a value by @​tfoutrein in python-poetry/tomlkit#517
• Validate out-of-order tables incrementally while parsing by @​binggao1230 in python-poetry/tomlkit#509
• Return a single key from key() for a single-element list (fixes #430) by @​tienvantranspk-tech in python-poetry/tomlkit#520
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in python-poetry/tomlkit#522
• Speed up unwrap() by resolving keys from the key map instead of items() by @​tfoutrein in python-poetry/tomlkit#521
• Merge AoT fragments when building an out-of-order table proxy by @​binggao1230 in python-poetry/tomlkit#507
• Bulk-scan multiline string bodies by @​tfoutrein in python-poetry/tomlkit#518
• reject array-of-tables header missing its second closing bracket by @​netliomax25-code in python-poetry/tomlkit#519
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in python-poetry/tomlkit#541
• Fix ParseError when a sub-table extends an array of tables out of order by @​sarathfrancis90 in python-poetry/tomlkit#498
• Render inline tables in O(n) instead of O(n²) by @​tfoutrein in python-poetry/tomlkit#525
• Fix duplicated prefix and captured sibling when replacing a dotted key with a table by @​Labib-Bin-Salam in python-poetry/tomlkit#526
• Reject tables inserted into inline tables by @​binggao1230 in python-poetry/tomlkit#532
• raise on malformed array element instead of dropping it by @​netliomax25-code in python-poetry/tomlkit#527
• fix: reject out-of-order concrete+super table redefinitions at parse time by @​binggao1230 in python-poetry/tomlkit#530
• fix: keep newline after dotted inline table by @​binggao1230 in python-poetry/tomlkit#533
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in python-poetry/tomlkit#548
• chore(deps): bump soupsieve from 2.5 to 2.8.4 in /docs by @​dependabot[bot] in python-poetry/tomlkit#560
• chore(deps-dev): bump soupsieve from 2.4.1 to 2.8.4 by @​dependabot[bot] in python-poetry/tomlkit#559
• Preserve whitespace when replacing super tables by @​binggao1230 in python-poetry/tomlkit#534
• Preserve table display names on self assignment by @​binggao1230 in python-poetry/tomlkit#537

... (truncated)

Changelog

Sourced from tomlkit's changelog.

[0.15.2] - 2026-10-16

Changed

• Write the ESC control character as \u001b instead of \e, which is only valid in TOML 1.1, so the output stays readable by TOML 1.0 parsers such as tomllib. (#641)
• key_value() now raises UnexpectedCharError on anything other than whitespace or a comment after the pair, instead of silently discarding it (e.g. key_value("a = 1 b = 2")), matching parse(). (#594)
• integer() given a string now validates it against the TOML integer grammar and keeps the original text, so grouping underscores (e.g. integer("1_000")) survive dumps(); strings that are not valid TOML integers (e.g. "010") now raise ValueError. (#336)
• Add a fold argument to DateTime and Time, mirroring the stdlib, and carry fold through item(), arithmetic (including datetime subtraction) and unwrap(), so a folded local time no longer converts an hour off. (#619, #623, #626)
• Declare the project metadata in the PEP 621 [project] table; building from source now requires poetry-core>=2.2.0. (#607, #609)

Fixed

• Fix valid TOML being rejected when an out-of-order table reopens an implicit super-table with a dotted key: [a.b.c] then [a] with b.z = 1 extends the implicit a.b super-table rather than redefining it (stdlib tomllib accepts it), so it now parses and round-trips instead of raising Redefinition of an existing table. The concrete-table case ([a.b] then [a] b.z = 1) stays rejected. (#565)
• Fix uppercase E exponent after a leading-zero mantissa (e.g. 0E2) being rejected as an invalid number while 0e2 parsed fine. (#586)
• Fix non-lowercase special floats (e.g. Inf, NaN, -INF) being accepted; TOML only allows lowercase inf and nan, so they now raise ParseError. (#628)
• Fix parse errors reporting the wrong line and column in documents with CRLF or mixed line endings. (#642)
• Fix item() reordering the keys of an inline table (dict-valued keys were forced last) under the default sort_keys=False. (#546)
• Fix unwrap() moving a key to the end after its value was replaced (e.g. doc["b"] = 9), while dumps() and keys() kept the original order. (#591)
• Fix appending a key to a parsed inline table that uses ", " separators emitting a bare "," for the new entry, leaving the table inconsistently spaced (e.g. {x = 1, y = 2,z = 3}). (#595)
• Fix an emptied array of tables being dropped from the output: it now renders as key = [], placed and keyed relative to the nearest table header so it parses back into the same table. (#567)
• Fix a single-line array whose last element is a trailing comment (e.g. from add_line(value, comment=...)) rendering its closing ] on the comment line, producing unparseable output. (#580)
• Fix del array[start:stop:step] with a negative or omitted bound removing the wrong elements from the rendered output. (#599)
• Fix array slice assignment mutating the array before raising ValueError("slice assignment is not supported"). (#600)
• Fix String.__add__ splicing the appended text into a basic string without escaping it, so appending a quote or backslash produced invalid TOML. (#612)
• Fix a bare carriage return in a multiline string producing invalid TOML: it is now escaped as \r in a multiline basic string and rejected with InvalidStringError in a multiline literal string; CRLF line endings are left intact. (#539)
• Fix a tz-aware datetime.time rendering with a UTC offset (e.g. 07:32:00+02:00), which TOML local times do not allow; it now renders as a local time. (#613)
• Fix arithmetic on a signed float producing +-0.0 (e.g. -1.5 times 0), which does not parse. (#629)
• Fix two Bool items never comparing equal to each other; they now compare by value. (#660)

Commits

• a0b15eb chore: release 0.15.2 (#668)
• 18e7f98 Compare Bool items by value (#660)
• 19edc23 [pre-commit.ci] pre-commit autoupdate (#654)
• 6b5f079 Render an emptied array of tables as an empty array (#567)
• 229ee86 fix: don't reject an out-of-order super-table extended by a dotted key (#565)
• 096148f escape or reject a bare carriage return in multiline strings (#539)
• 5fe4329 test: add coverage for tomlkit._types wrapper operators (#570)
• 2279e18 Enable intersphinx so stdlib references resolve (#624)
• a963fe1 Preserve inline table key order in item() (#546) (#552)
• 446d6fa Reject non-lowercase special float literals (#628)
• Additional commits viewable in compare view

Updates virtualenv from 21.14.6 to 21.14.12

Release notes

Sourced from virtualenv's releases.

21.14.12

Bugfixes - 21.14.12

• Upgrade embedded wheels:

  • setuptools to 84.2.1 from 84.0.0
  • pip to 26.2.2 from 26.2.1 (#3452)

Improved Documentation - 21.14.12

• Require a pull request news fragment and a matching changelog section before publishing. (#3445)

PyPI release

Full Changelog: pypa/virtualenv@21.14.11...21.14.12

21.14.11

Bugfixes - 21.14.11

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440)
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441)

PyPI release<...

Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.