Skip to content

chore(deps): bump the minor-and-patch group with 9 updates - #3323

Merged
mikewilli merged 1 commit into
mainfrom
dependabot/pip/minor-and-patch-c772cabcb8
Oct 22, 2026
Merged

chore(deps): bump the minor-and-patch group with 9 updates#3323
mikewilli merged 1 commit into
mainfrom
dependabot/pip/minor-and-patch-c772cabcb8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 9 updates:

Package From To
cachetools 7.2.3 7.2.4
certifi 2026.7.22 2026.10.18
filelock 4.2.1 4.2.4
platformdirs 4.13.3 4.13.5
pyproject-api 1.11.7 1.12.0
python-discovery 1.6.3 1.6.4
smart-open 8.0.3 8.0.4
tox 4.66.0 4.67.1
virtualenv 21.14.10 21.14.11

Updates cachetools from 7.2.3 to 7.2.4

Changelog

Sourced from cachetools's changelog.

v7.2.4 (2026-10-19)

  • Restore autospec calls to @cachedmethod decorated methods.

  • Improve branch coverage of unit tests.

  • Minor type stub improvements.

Commits

Updates certifi from 2026.7.22 to 2026.10.18

Commits

Updates filelock from 4.2.1 to 4.2.4

Release notes

Sourced from filelock's releases.

4.2.4

  • Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. #863

PyPI release

Full Changelog: tox-dev/filelock@4.2.3...4.2.4

4.2.3

  • Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. #860
  • Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

PyPI release

Full Changelog: tox-dev/filelock@4.2.2...4.2.3

4.2.2

  • Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises FileNotFoundError, and it now leaves the lock's hold count unchanged. #856

PyPI release

Full Changelog: tox-dev/filelock@4.2.1...4.2.2

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.2.4 (2026-10-19)

  • Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. :pr:863

4.2.3 (2026-10-19)

  • Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:860
  • Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

4.2.2 (2026-10-18)

  • Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

4.2.1 (2026-10-17)

  • On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
  • :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
  • Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database

... (truncated)

Commits

Updates platformdirs from 4.13.3 to 4.13.5

Release notes

Sourced from platformdirs's releases.

4.13.5

  • Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. #631

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.4...4.13.5

4.13.4

  • Require a complete files path segment when locating Android app directories from sys.path. #621
  • Keep root directory tests independent of inherited XDG environment variables. #622
  • Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. #624
  • Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. #625
  • Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. #627
  • Correct the contributor guide to name ty as the type checker used by the type environment. #623

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.3...4.13.4

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.13.5 (2026-10-19)

  • Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. :pr:631

4.13.4 (2026-10-17)

  • Require a complete files path segment when locating Android app directories from sys.path. :pr:621
  • Keep root directory tests independent of inherited XDG environment variables. :pr:622
  • Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. :pr:624
  • Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. :pr:625
  • Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. :pr:627
  • Correct the contributor guide to name ty as the type checker used by the type environment. :pr:623

4.13.3 (2026-10-16)

4.13.2 (2026-10-16)

  • Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

4.13.1 (2026-10-15)

  • Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. :pr:618
  • Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

4.13.0 (2026-10-10)

... (truncated)

Commits
  • 5702904 Release 4.13.5
  • 4b2b6a5 🐛 fix(release): trim GitHub release notes (#631)
  • 6f7e3e2 👷 ci: collect required checks (#628)
  • caa5626 Release 4.13.4
  • 9b5c0fd fix(windows): raise when no home directory resolves (#627)
  • da72995 fix: require a complete files segment when finding Android app folders (#621)
  • da89726 test: isolate root directory checks from inherited XDG settings (#622)
  • fb0b1a9 fix: keep root directory accessors consistent during isolation (#625)
  • 91f7775 fix(ios): raise when no home directory resolves (#624)
  • ed9f25f ci: rerun news check on label changes (#626)
  • Additional commits viewable in compare view

Updates pyproject-api from 1.11.7 to 1.12.0

Release notes

Sourced from pyproject-api's releases.

1.12.0

  • Validate in-tree backend paths and reject metadata directories that contain the project root.
  • Contain response serialization failures.

PyPI release

Full Changelog: tox-dev/pyproject-api@1.11.7...1.12.0

Changelog

Sourced from pyproject-api's changelog.

v1.12.0 (2026-10-18)

  • Validate in-tree backend paths and reject metadata directories that contain the project root.
  • Contain response serialization failures.
Commits
  • a345a26 Reject metadata directories that contain the project root (#323)
  • 368e3a8 fix(backend): contain response serialization failures (#322)
  • 2a6fa5c docs: fix frontend construction example (#321)
  • 55cfc9f fix(frontend): validate in-tree backend paths (#320)
  • See full diff in compare view

Updates python-discovery from 1.6.3 to 1.6.4

Release notes

Sourced from python-discovery's releases.

v1.6.4

Improved documentation - 1.6.4

  • Clarify the executable paths accepted by try_first_with in the standalone usage example. (#150)

PyPI release

Full Changelog: tox-dev/python-discovery@1.6.3...1.6.4

Changelog

Sourced from python-discovery's changelog.

Improved documentation - 1.6.4

  • Clarify the executable paths accepted by try_first_with in the standalone usage example. (:issue:150)

v1.6.3 (2026-10-16)

Commits
  • 885805a release 1.6.4
  • 1a6b5cd fix(release): trim GitHub notes (#154)
  • ac862a4 👷 ci: publish release after PyPI (#153)
  • 4d53c08 build(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the github-acti...
  • 1701972 👷 ci(release): require changelog entries (#151)
  • 9f051ac docs: use an executable path in the try_first_with example (#150)
  • See full diff in compare view

Updates smart-open from 8.0.3 to 8.0.4

Release notes

Sourced from smart-open's releases.

v8.0.4

What's Changed

Full Changelog: piskvorky/smart_open@v8.0.3...v8.0.4

Changelog

Sourced from smart-open's changelog.

8.0.4, 2026-10-17

  • Use binary unit labels (GiB, MiB) in upload size logs (PR #978, @​ddelange)
  • [ftp] Close FTP connections when connection or transfer setup fails (PR #976, @​xiehuanyi)
  • [ssh] Include the port in cached SSH connection keys (PR #967, @​xiehuanyi)
  • [ssh] Apply wildcard Host and Match stanzas from ~/.ssh/config (PR #968, @​xiehuanyi)
  • [s3,azure] Abort uploads when closing a compressed stream fails (PR #969, @​zhechen-cs)
  • [hdfs] Raise on failed hdfs dfs -cat/-put commands and reap reader processes on close (PR #970, @​zhechen-cs)
  • [http] Keep position and drop stale buffered data when a seek request fails (PR #975, @​xiehuanyi)
  • [webhdfs] Accept bytes-like inputs in writes (PR #971, @​zhechen-cs)
  • [webhdfs] Infer compression from the URI path and keep IPv6 hosts and encoded usernames intact (PR #973, @​zhechen-cs)
  • [local] Infer compression from uppercase file extensions (PR #974, @​zhechen-cs)
  • [local] Handle Windows drive letters in file:// URIs (PR #977, @​zhechen-cs)
  • [ftp] Raise upload failures reported by the server on close (PR #972, @​zhechen-cs)
  • [http] Raise from seek() when the server rejects a range request (PR #980, @​ddelange)
Commits
  • 08f9303 Merge branch 'develop' into master
  • 56a1761 Update CHANGELOG.md
  • 589892b Raise from http seek() when the server rejects a range request (#980)
  • 9bc1d45 [ftp] Raise upload failures reported by the server on close (#972)
  • 4389298 [local] Handle Windows drive letters in file:// URIs (#977)
  • 095dc15 [local] Infer compression from uppercase file extensions (#974)
  • 8215c78 [webhdfs] Infer compression from the URI path and keep IPv6 hosts and encoded...
  • 5222896 [webhdfs] Accept bytes-like inputs in writes (#971)
  • bae90bf [http] Keep position and drop stale buffered data when a seek request fails (...
  • 01fbff1 [hdfs] Raise on failed hdfs dfs -cat/-put commands and reap reader processes ...
  • Additional commits viewable in compare view

Updates tox from 4.66.0 to 4.67.1

Release notes

Sourced from tox's releases.

v4.67.1

Bug fixes - 4.67.1

  • Preserve ignore (-) and invert (!) exit code prefixes on commands when referenced via TOML { replace = "ref", ... }. (#4169)
  • Installing from a pylock.toml with no dependency_groups selected now uses the lock file's default-groups, as 751 specifies. Previously packages marked 'default' in dependency_groups (as written by pdm export -f pylock) were skipped - by pcbeingused333. (#4173)
  • A positional {factor:N} label in an env_base now resolves against that table's own factors, so with several env_base tables or an env_list product it no longer expands to an empty string. (#4174)

PyPI release

Full Changelog: tox-dev/tox@4.67.0...4.67.1

v4.67.0

Features - 4.67.0

  • Allow opting in to tox substitutions within TOML positional arguments with substitute = true. (#4165)

Bug fixes - 4.67.0

  • Keep capturing the output of the packaging backend with --no-capture, so tox --no-capture no longer hangs at started backend while waiting for the backend's reply. (#4163)
  • A leading UTF-8 byte order mark in tox.ini, setup.cfg, tox.toml or a TOML pyproject.toml no longer stops the configuration from loading - editors on Windows may add one. (#4166)
  • tox --no-provision <command> no longer treats the command as the JSON output path: a global option placed before a subcommand now keeps it, so tox --no-provision list lists the environments instead of writing a file named list. (#4168)

Improved documentation - 4.67.0

  • Link overridden argparse methods and logging.Handler.name in the plugin API reference. (#4170)

PyPI release

Full Changelog: tox-dev/tox@4.66.0...4.67.0

Changelog

Sourced from tox's changelog.

Bug fixes - 4.67.1

  • Preserve ignore (-) and invert (!) exit code prefixes on commands when referenced via TOML { replace = "ref", ... }. (:issue:4169)
  • Installing from a pylock.toml with no :ref:dependency_groups selected now uses the lock file's default-groups, as :PEP:751 specifies. Previously packages marked 'default' in dependency_groups (as written by pdm export -f pylock) were skipped - by :user:pcbeingused333. (:issue:4173)
  • A positional {factor:N} label in an env_base now resolves against that table's own factors, so with several env_base tables or an env_list product it no longer expands to an empty string. (:issue:4174)

v4.67.0 (2026-10-17)

Features - 4.67.0

  • Allow opting in to tox substitutions within TOML positional arguments with substitute = true. (:issue:4165)

Bug fixes - 4.67.0

  • Keep capturing the output of the packaging backend with --no-capture, so tox --no-capture no longer hangs at started backend while waiting for the backend's reply. (:issue:4163)
  • A leading UTF-8 byte order mark in tox.ini, setup.cfg, tox.toml or a TOML pyproject.toml no longer stops the configuration from loading - editors on Windows may add one. (:issue:4166)
  • tox --no-provision <command> no longer treats the command as the JSON output path: a global option placed before a subcommand now keeps it, so tox --no-provision list lists the environments instead of writing a file named list. (:issue:4168)

Improved documentation - 4.67.0

  • Link overridden argparse methods and logging.Handler.name in the plugin API reference. (:issue:4170)

v4.66.0 (2026-10-16)

Commits
  • 129a377 release 4.67.1
  • 21d01be fix(config): resolve factor labels per env_base (#4174)
  • 7a77f76 🐛 fix(pylock): use default-groups when no dependency group is selected (#4173)
  • 59d3c99 fix(config): keep exit-code prefixes on TOML command references (#4172)
  • 1de497f release 4.67.0
  • 375a807 fix(config): read a UTF-8 BOM in the ini and TOML config sources (#4166)
  • ba393c1 Allow opt-in substitution of TOML positional arguments (#4167)
  • fa16bde fix(cli): --no-provision swallows the subcommand that follows it (#4168)
  • e352fbe ♻️ refactor(docs): use public Sphinx hooks (#4171)
  • 1d054ab 📝 docs(api): link overridden stdlib members (#4170)
  • Additional commits viewable in compare view

Updates virtualenv from 21.14.10 to 21.14.11

Release notes

Sourced from virtualenv's releases.

21.14.11

Bugfixes - 21.14.11

  • Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440)
  • On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441)

PyPI release

Full Changelog: pypa/virtualenv@21.14.10...21.14.11

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.11

  • Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (:issue:3440)
  • On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (:issue:3441)

v21.14.10 (2026-10-17)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group with 9 updates
91849a8 
Bumps the minor-and-patch group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [cachetools](https://github.com/tkem/cachetools) | `7.2.3` | `7.2.4` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.7.22` | `2026.10.18` |
| [filelock](https://github.com/tox-dev/py-filelock) | `4.2.1` | `4.2.4` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.13.3` | `4.13.5` |
| [pyproject-api](https://github.com/tox-dev/pyproject-api) | `1.11.7` | `1.12.0` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.6.3` | `1.6.4` |
| [smart-open](https://github.com/piskvorky/smart_open) | `8.0.3` | `8.0.4` |
| [tox](https://github.com/tox-dev/tox) | `4.66.0` | `4.67.1` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.14.10` | `21.14.11` |


Updates `cachetools` from 7.2.3 to 7.2.4
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](tkem/cachetools@v7.2.3...v7.2.4)

Updates `certifi` from 2026.7.22 to 2026.10.18
- [Commits](certifi/python-certifi@2026.07.22...2026.10.18)

Updates `filelock` from 4.2.1 to 4.2.4
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@4.2.1...4.2.4)

Updates `platformdirs` from 4.13.3 to 4.13.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.13.3...4.13.5)

Updates `pyproject-api` from 1.11.7 to 1.12.0
- [Release notes](https://github.com/tox-dev/pyproject-api/releases)
- [Changelog](https://github.com/tox-dev/pyproject-api/blob/main/docs/changelog.rst)
- [Commits](tox-dev/pyproject-api@1.11.7...1.12.0)

Updates `python-discovery` from 1.6.3 to 1.6.4
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.6.3...1.6.4)

Updates `smart-open` from 8.0.3 to 8.0.4
- [Release notes](https://github.com/piskvorky/smart_open/releases)
- [Changelog](https://github.com/piskvorky/smart_open/blob/develop/CHANGELOG.md)
- [Commits](piskvorky/smart_open@v8.0.3...v8.0.4)

Updates `tox` from 4.66.0 to 4.67.1
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.66.0...4.67.1)

Updates `virtualenv` from 21.14.10 to 21.14.11
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.10...21.14.11)

---
updated-dependencies:
- dependency-name: cachetools
  dependency-version: 7.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: filelock
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: platformdirs
  dependency-version: 4.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pyproject-api
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: python-discovery
  dependency-version: 1.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: smart-open
  dependency-version: 8.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tox
  dependency-version: 4.67.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: virtualenv
  dependency-version: 21.14.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 22, 2026
@dependabot
dependabot Bot deployed to GH Actions October 22, 2026 20:35 Active
@dependabot
dependabot Bot deployed to GH Actions October 22, 2026 20:35 Active
@mikewilli
mikewilli added this pull request to the merge queue Oct 22, 2026
Merged via the queue into main with commit e4bf4f5 Oct 22, 2026
4 checks passed
@mikewilli
mikewilli deleted the dependabot/pip/minor-and-patch-c772cabcb8 branch October 22, 2026 20:59

This branch was successfully deployed

1 active deployment
GH Actions — 91849a85 Deployed Oct 22, 2026 by dependabot[bot] via build #966
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mikewilli mikewilli mikewilli approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mikewilli