Skip to content

[UV] Bump the uv group across 1 directory with 14 updates - #732

Merged
tagdots-owner merged 1 commit into
mainfrom
dependabot/uv/uv-8dc5aca9e1
Nov 2, 2026
Merged

[UV] Bump the uv group across 1 directory with 14 updates#732
tagdots-owner merged 1 commit into
mainfrom
dependabot/uv/uv-8dc5aca9e1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 14 updates in the / directory:

Package From To
commitizen 4.19.2 4.19.3
pre-commit 4.6.2 4.7.0
coverage 7.16.2 7.17.0
certifi 2026.7.22 2026.10.23
distlib 0.4.3 0.4.4
filelock 4.0.9 4.2.4
platformdirs 4.12.4 4.13.5
pluggy 1.6.0 1.7.0
pycparser 3.11 3.12
python-discovery 1.6.2 1.6.7
tomlkit 0.15.1 0.15.2
virtualenv 21.14.6 21.14.13
wcwidth 0.9.2 0.9.4
wrapt 2.5.0 2.5.1

Updates commitizen from 4.19.2 to 4.19.3

Release notes

Sourced from commitizen's releases.

v4.19.3 (2026-10-24)

Fix

  • scm-provider: prefer full version over floating tags
Changelog

Sourced from commitizen's changelog.

v4.19.3 (2026-10-24)

Fix

  • scm-provider: prefer full version over floating tags
Commits
  • f690817 bump: version 4.19.2 → 4.19.3
  • 0f5fe53 fix(scm-provider): prefer full version over floating tags
  • b78d581 build(deps): bump uv from 0.11.15 to 0.13.4 (#2112)
  • dcca5b0 build(deps): bump certifi from 2026.2.25 to 2026.10.19 (#2113)
  • 1f773d5 build(deps-dev): update uv-build requirement from <0.13,>=0.9.17 to >=0.9.17,...
  • b00c86a docs(faq): explain how to avoid bumping dependencies that share the project v...
  • 2ebac02 docs: reduce AGENTS size
  • 6ffda2a docs(monorepo): improve docs and add docs to verify it works
  • 195b735 docs(gh): update gh action tutorial
  • 2f86834 docs(cli/screenshots): update CLI screenshots
  • See full diff in compare view

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

Commits
  • 65bb884 v4.7.0
  • 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
  • 860d07d don't leak GIT_* env into npm install for language: node
  • 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
  • 9905e88 use contextlib.chdir
  • 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
  • 2be1701 remove triple-nested withs for 3.14 coverage
  • 4c8d22a py311+
  • c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
  • f49e251 [pre-commit.ci] pre-commit autoupdate
  • Additional commits viewable in compare view

Updates coverage from 7.16.2 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

  • Dropped support for Python 3.10.
  • Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
  • Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
  • Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
  • Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
  • Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
  • Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
  • Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
  • Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.
  • Fixes for obscure but legal file names:
    • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.
    • A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.
  • Fixes in the implementation of the C tracer:
    • If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.
    • The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.
    • The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.
    • An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.
  • Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.
  • Performance: HTML reports should be about 5% faster to produce.
  • Kept the political banner in the README. Closes issue 2344.

➡️  PyPI page: coverage 7.17.0. :arrow_right:  To install: python3 -m pip install coverage==7.17.0

Changelog

Sourced from coverage's changelog.

Version 7.17.0 — 2026-10-22

  • Dropped support for Python 3.10.

  • Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

  • Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987_.

  • Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314_.

  • Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.

  • Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.

  • Fix: The "Can't combine statement coverage data with branch data" error now names the two data files it couldn't combine. The :ref:error description <error_cant_combine> in the docs now lists common causes and how to find the process that wrote the file.

  • Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293_ and issue 2294_.

  • Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338_.

  • Fixes for obscure but legal file names:

    • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and ``coverage debug

... (truncated)

Commits
  • 393ac71 docs: prep for 7.17.0
  • 14257d3 test: check that 100% files haven't lost coverage
  • db056ac docs: keep the ukraine banner #2344
  • 6033660 fix: update the data file hash when a parallel data file is saved again (#2339)
  • 99024b5 fix: clamp rate in XML report to prevent false 1.0/0.0 rounding and scientifi...
  • ff62a02 refactor: remove unused caching branches
  • 24d0b67 fix: KeyError for a with statement at the end of a finally clause (#2336)
  • 934f5b8 chore: upgrade pip==26.2.2 certifi==2026.10.19
  • f95c980 fix: triply nested with statements don't cause false branch misses #1987
  • 6aaa858 docs: more changelog gardening
  • Additional commits viewable in compare view

Updates certifi from 2026.7.22 to 2026.10.23

Commits

Updates distlib from 0.4.3 to 0.4.4

Changelog

Sourced from distlib's changelog.

0.4.4


Released: 2026-10-16

    

  • 

    compat
    

      

    • Fixed a missing import. Thanks to Andrej730 for the patch.
      • 

    

    • 

  • 

    markers
    

      

    • Fixed #273: Enforce compatible-release bounds in environment markers.
Thanks to Luochenchen for the patch.
      • 

    

    • 

  • 

    metadata
    

      

    • Fix #194: Add an urls property to expose project and home URLs. Thanks to
Sinkleberg for the patch.
      • 

    

    • 

  • 

    scripts
    

      

    • 

      Raise the correct exception when a launcher can't be written. Thanks to
candygoogy for the patch.
      

      • 

    • 

      Fix #144: Detect shell-script Python executables in ScriptMaker shebangs.
Thanks to Alex Chen for the patch.
      

      • 

    

    • 

  • 

    util
    

      

    • 

      Improve performance of export entry search to take linear time. Thanks to
Brian Willows for the patch.
      

      • 

    • 

      Use tarfile.data_filter rather than tarfile.tar_filter in unarchive()
when extraction filters are available, matching the Python 3.14 default. Path and
link containment checks now use os.path.realpath and no longer fail with
IndexError for members such as . or ./. Thanks to Kobain for the patch.
      

      • 

    • 

      unarchive() now resolves member paths through symlinks seen earlier in the
same archive, so a chain of individually harmless-looking links cannot be used
to write outside the destination on Pythons without extraction filters. Thanks to
Kobain for the patch.
      

      • 

    

    • 

  • 

    version
    

      

    • 

      Improve NormalizedVersion by addressing correctness and performance gaps
found by comparison with packaging. Thanks to Damian Shaw for the patch.
      

      • 

    • 

      Improve SemanticVersion by comparing numeric prerelease identifiers,
including those longer than 8 digits. Thanks to Muneeb Sheikh for the
patch.

Commits
  • 25eed06 Changes for 0.4.4.
  • 8ffee6f Resolve member paths through earlier archive symlinks in unarchive()
  • ef4a390 Test that data_filter rejects absolute symlinks with check=False
  • 380b6a9 Use data_filter and realpath containment checks in unarchive()
  • 7b7c572 fix: enforce compatible-release bounds in markers (#274)
  • 38811dd Detect shell-script Python executables in ScriptMaker shebangs (#144) (#264)
  • 06ddb5d Compare numeric prerelease identifiers without a digit limit (#270)
  • e54dd8c Raise the original error when a launcher can't be written (#269)
  • c6270e3 Fix NormalizedVersion gaps found by comparison with packaging (#271)
  • 5b3092b Search export entries in linear time (#266)
  • Additional commits viewable in compare view

Updates filelock from 4.0.9 to 4.2.4

Release notes

Sourced from filelock's releases.

4.2.4

🐍 PyPI release

📜 Full Changelog

4.2.3

Bug fixes

  • Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. #861 by @​gaborbernat.
  • Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error. #859 by @​edsonsims.

New Contributors

🐍 PyPI release

📜 Full Changelog

4.2.2

Bug fixes

  • Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises FileNotFoundError, and it now leaves the lock's hold count unchanged. #856 by @​spicysharkco.

New Contributors

🐍 PyPI release

📜 Full Changelog

4.2.1

Bug fixes

  • On a singleton wrapper, AsyncReadWriteLock.close() and AsyncSoftReadWriteLock.close() end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #832 by @​gaborbernat.
  • ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins its queue no longer blocks every later call on that lock. #833 by @​gaborbernat.
  • Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #834 by @​gaborbernat.
  • Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. #835 by @​gaborbernat.
  • Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no longer carry group or other write bits. A process name containing a carriage return or another line separator no longer makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check no longer compares start times and keeps the marker. #836 by @​gaborbernat.
  • The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat recorded a lost hold, it refuses new acquires until that hold is released. #838 by @​gaborbernat.
  • StrictSoftFileLock creates <path>.filelock and its claims directory with the lock's mode and sets the sticky bit (a directory flag that lets only a file's owner remove it) on both. On the next acquisition it narrows a directory it owns that an earlier release created wider; it leaves a directory of another account as it is, so remove such leftovers by hand. It reaches claims through a descriptor opened without following symlinks; on Windows it holds both directories open and refuses a junction (a directory that points at another directory). Under a sticky parent such as /tmp it refuses a coordination directory of another account, as SoftReadWriteLock does for <path>.rw. One read grace now covers a whole claim scan, a failed claim cleanup no longer leaves the sentinel descriptor open, and a non-regular node at a sentinel private-record name raises SoftFileLockProtocolError. On Windows, contenders read claims without blocking their owner's unlink. #839 by @​gaborbernat.
  • Fix a lock reporting a hold the OS had dropped after a signal handler raised during acquire or release. A release that a signal handler cuts short after it has started now completes before the error propagates. A handler that acquires the lock its own thread is releasing now gets RuntimeError instead of a hold that stays held. The singleton cache no longer hands out an is_singleton=True lock or a ReadWriteLock whose finalizer is running, which released the new holder's lock. A signal during os.fork() no longer leaves the other threads blocked in their next lock call, and a fork from another thread no longer waits for a ReadWriteLock acquire on a busy database. #840 by @​gaborbernat.
  • Fix a lock on a relative path locking a file in the directory the process changed to while the lock waited, and leaving its marker behind on release after such a change. The path resolved when an acquisition starts stays in use until the hold ends. An is_singleton=True lookup no longer returns a cached lock whose relative path now resolves to another file; a held lock still matches the file it holds. A rename of the lock's directory during a hold no longer leaves the marker behind or reports a false lease compromise, and a waiter no longer creates a second lock file in a directory that was renamed away. #841 by @​gaborbernat.

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-6:

4.2.6 (2026-10-31)

.. _release-4-2-6-fixed:

Fixed

  • Fix a race in :class:~filelock.SoftFileLock, :class:~filelock.MarkerSoftFileLock and :class:~filelock.SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (:pr:899) by :user:dxbjavid and :user:gaborbernat.

.. _release-4-2-5:

4.2.5 (2026-10-30)

.. _release-4-2-5-fixed:

Fixed

  • :meth:~filelock.BaseFileLock.acquire and :meth:~filelock.BaseAsyncFileLock.acquire raise :class:TypeError for a blocking that is not a :class:bool, as the constructor and the blocking setter already do. A truthy value such as the string "false" used to count as True, so a call meant as a single attempt waited for the instance's timeout, and without a limit at the default -1 (:pr:870) by :user:simpleqt and :user:gaborbernat.
  • A :class:~filelock.SoftFileLock acquisition whose first read of its new marker's identity failed reads it again before rolling back. On Windows the rollback could otherwise not recognize the marker it had created, and the empty marker it left blocked the path for every later acquisition, since no contender breaks an empty marker (:pr:869) by :user:simpleqt and :user:gaborbernat.
  • A fork() child of a process holding a :class:~filelock.SoftFileLease starts from an unheld claim. It used to inherit the parent's token, last compromise and heartbeat, so :attr:~filelock.SoftFileLease.token and :attr:~filelock.SoftFileLease.compromise reported a claim the child never held while is_locked reported it unheld (:pr:868) by :user:dxbjavid and :user:gaborbernat.
  • A nested acquire of a held :class:~filelock.FileLock or :class:~filelock.SoftFileLock no longer creates the lock

... (truncated)

Commits

Updates platformdirs from 4.12.4 to 4.13.5

Release notes

Sourced from platformdirs's releases.

4.13.5

Packaging

  • Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. #631 by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

4.13.4

Bug fixes

  • Require a complete files path segment when locating Android app directories from sys.path. #621 by @​shoaibulhaque and @​gaborbernat.
  • Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. #624 by @​XXXXXQ-0206 and @​gaborbernat.
  • Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. #625 by @​AryanRG and @​gaborbernat.
  • Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. #627 by @​XXXXXQ-0206.

New Contributors

🐍 PyPI release

📜 Full Changelog

4.13.3

🐍 PyPI release

📜 Full Changelog

4.13.2

Bug fixes

New Contributors

🐍 PyPI release

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-14-2:

4.14.2 (2026-10-31)

.. _release-4-14-2-fixed:

Fixed

  • Deduplicate equivalent XDG directory spellings across string and path iterators and file searches (:pr:677) by :user:AlvaroBalbin and :user:gaborbernat.

.. _release-4-14-1:

4.14.1 (2026-10-30)

.. _release-4-14-1-fixed:

Fixed

  • Fall back to the real user ID on platforms without an effective user ID, restoring imports and Unix directory lookups on Pyodide (:pr:676) by :user:mayankdhingra02.

.. _release-4-14-0:

4.14.0 (2026-10-28)

.. _release-4-14-0-added:

Added

  • Accept a keyword-only ensure_exists in the module-level media directory functions, such as :func:~platformdirs.user_documents_path, to create a directory set through XDG_*_DIR or user-dirs.dirs (:pr:656) by :user:darrenhuai and :user:gaborbernat.

... (truncated)

Commits
  • 5702904 Release 4.13.5
  • 4b2b6a5 🐛 fix(release): trim GitHub release notes (#631)
  • 6f7e3e2 👷 ci: collect required checks (#628)
  • caa5626 Release 4.13.4
  • 9b5c0fd fix(windows): raise when no home directory resolves (#627)
  • da72995 fix: require a complete files segment when finding Android app folders (#621)
  • da89726 test: isolate root directory checks from inherited XDG settings (#622)
  • fb0b1a9 fix: keep root directory accessors consistent during isolation (#625)
  • 91f7775 fix(ios): raise when no home directory resolves (#624)
  • ed9f25f ci: rerun news check on label changes (#626)
  • Additional commits viewable in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

  • [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

  • [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

  • [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

    A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

  • [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

  • [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

  • [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

  • [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

    As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits
  • 4c7f636 Preparing release 1.7.0
  • 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
  • 628959b docs: remove outdated hookimpl default args paragraph
  • 2edab5e Merge pull request #752 from bluetech/register-none-allow
  • 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
  • 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
  • 6a7e84e Add changelog fragment for #776
  • d22cfb5 Drop tox from the dev dependency group
  • 74cbfa2 Relock pytest and tox that dependabot downgraded
  • 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
  • Additional commits viewable in compare view

Updates pycparser from 3.11 to 3.12

Release notes

Sourced from pycparser's releases.

release_v3.12

What's Changed

Full Changelog: eliben/pycparser@release_v3.11...release_v3.12

Commits
  • 3ec766b Tweak build
  • 1771cbf Prepare to release 3.12
  • 51715bf Add documentation on using methods of ast node
  • 878c289 Support va_arg properly
  • 840fe55 Add some Linux kernel headers to benchmark
  • 8fd2299 Add ArrayDesignator AST node to distinguish array indices in designators
  • aa32af5 Fix crashes in generator with empty case bodies
  • f29e8ef Regression test for #215
  • a74aa74 Support form feed and vertical tabs as whitespace
  • 02380d0 Comment fixes
  • Additional commits viewable in compare view

Updates python-discovery from 1.6.2 to 1.6.7

Release notes

Sourced from python-discovery's releases.

v1.6.7

Bug fixes

  • Rank uv's minor version links behind the concrete install on Windows too, where uv creates them as directory junctions that Path.is_symlink() does not report (#170) by @​darrenhuai and @​gaborbernat.
  • Stop a venv lookup from rewriting the executable of earlier results, PythonInfo.current() and PythonInfo.current_system() when they share its base interpreter (#171) by @​darrenhuai and @​gaborbernat.

PyPI release

Full Changelog

v1.6.6

Bug fixes

  • Treat version specifiers with an item that cannot be parsed, such as >=3.x, >=3.12 <4 or >=3.12,foo, as literal executable paths instead of raising a bare AssertionError or ignoring the item during discovery (#157) by @​darrenhuai and @​gaborbernat.
  • Accept relative interpreter paths that step up a directory, such as ../venv/bin/python, which were found and queried but never matched the spec (#158) by @​darrenhuai and @​gaborbernat.
  • Match ~=X.Y compatible-release specifiers against later minor versions, as PEP 440 defines, instead of only the same minor; ~=3.10 now accepts 3.11 and newer 3.x (#159) by @​darrenhuai and @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

v1.6.5

Packaging

  • Releases now run on the shared tox-dev/github-workflows pipeline, with a locked release toolchain and generated GitHub Release notes (#164) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

v1.6.4

Documentation

  • Clarify the executable paths accepted by try_first_with in the standalone usage example. (#150) by @​travisfortney.

New Contributors

🐍 PyPI release

📜 Full Changelog

... (truncated)

Changelog

Sourced from python-discovery's changelog.

################# Release History #################

.. towncrier-draft-entries::

.. towncrier release notes start

.. _release-1-9-0:

v1.9.0 (2026-10-30)

.. _release-1-9-...

Description has been truncated

@dependabot
[UV] Bump the uv group across 1 directory with 14 updates
fc21715 
Bumps the uv group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [commitizen](https://github.com/commitizen-tools/commitizen) | `4.19.2` | `4.19.3` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.2` | `4.7.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.16.2` | `7.17.0` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.7.22` | `2026.10.23` |
| [distlib](https://github.com/pypa/distlib) | `0.4.3` | `0.4.4` |
| [filelock](https://github.com/tox-dev/filelock) | `4.0.9` | `4.2.4` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.12.4` | `4.13.5` |
| [pluggy](https://github.com/pytest-dev/pluggy) | `1.6.0` | `1.7.0` |
| [pycparser](https://github.com/eliben/pycparser) | `3.11` | `3.12` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.6.2` | `1.6.7` |
| [tomlkit](https://github.com/python-poetry/tomlkit) | `0.15.1` | `0.15.2` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.14.6` | `21.14.13` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.9.2` | `0.9.4` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `2.5.0` | `2.5.1` |



Updates `commitizen` from 4.19.2 to 4.19.3
- [Release notes](https://github.com/commitizen-tools/commitizen/releases)
- [Changelog](https://github.com/commitizen-tools/commitizen/blob/master/CHANGELOG.md)
- [Commits](commitizen-tools/commitizen@v4.19.2...v4.19.3)

Updates `pre-commit` from 4.6.2 to 4.7.0
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.2...v4.7.0)

Updates `coverage` from 7.16.2 to 7.17.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.2...7.17.0)

Updates `certifi` from 2026.7.22 to 2026.10.23
- [Commits](certifi/python-certifi@2026.07.22...2026.10.23)

Updates `distlib` from 0.4.3 to 0.4.4
- [Release notes](https://github.com/pypa/distlib/releases)
- [Changelog](https://github.com/pypa/distlib/blob/master/CHANGES.rst)
- [Commits](pypa/distlib@0.4.3...0.4.4)

Updates `filelock` from 4.0.9 to 4.2.4
- [Release notes](https://github.com/tox-dev/filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@4.0.9...4.2.4)

Updates `platformdirs` from 4.12.4 to 4.13.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.12.4...4.13.5)

Updates `pluggy` from 1.6.0 to 1.7.0
- [Changelog](https://github.com/pytest-dev/pluggy/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pluggy@1.6.0...1.7.0)

Updates `pycparser` from 3.11 to 3.12
- [Release notes](https://github.com/eliben/pycparser/releases)
- [Commits](eliben/pycparser@release_v3.11...release_v3.12)

Updates `python-discovery` from 1.6.2 to 1.6.7
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.6.2...1.6.7)

Updates `tomlkit` from 0.15.1 to 0.15.2
- [Release notes](https://github.com/python-poetry/tomlkit/releases)
- [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md)
- [Commits](python-poetry/tomlkit@0.15.1...0.15.2)

Updates `virtualenv` from 21.14.6 to 21.14.13
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.6...21.14.13)

Updates `wcwidth` from 0.9.2 to 0.9.4
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Changelog](https://github.com/jquast/wcwidth/blob/master/docs/history.rst)
- [Commits](jquast/wcwidth@0.9.2...0.9.4)

Updates `wrapt` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@2.5.0...2.5.1)

---
updated-dependencies:
- dependency-name: commitizen
  dependency-version: 4.19.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: pre-commit
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: coverage
  dependency-version: 7.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.23
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: distlib
  dependency-version: 0.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: filelock
  dependency-version: 4.2.4
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: platformdirs
  dependency-version: 4.13.5
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: pycparser
  dependency-version: '3.12'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: python-discovery
  dependency-version: 1.6.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: tomlkit
  dependency-version: 0.15.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: virtualenv
  dependency-version: 21.14.13
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: wcwidth
  dependency-version: 0.9.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: wrapt
  dependency-version: 2.5.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner November 1, 2026 00:26
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Nov 1, 2026
@dependabot
dependabot Bot requested a review from andreclc November 1, 2026 00:26
@tagdots-owner
tagdots-owner merged commit 88f2e9a into main Nov 2, 2026
9 checks passed
@tagdots-owner
tagdots-owner deleted the dependabot/uv/uv-8dc5aca9e1 branch November 2, 2026 07:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andreclc andreclc Awaiting requested review from andreclc andreclc is a code owner automatically assigned from tagdots/admins

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tagdots-owner