[pull] master from aio-libs:master - #739
Merged
Merged
Conversation
Bumps [imagesize](https://github.com/shibukawa/imagesize_py) from 2.0.0 to 2.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/shibukawa/imagesize_py/releases">imagesize's releases</a>.</em></p> <blockquote> <h2>Bug fix</h2> <ul> <li>Optimize metadata parsing and HTTP range reads.</li> <li>Fix JPEG2000 box parsing.</li> <li>Accept single-quoted SVG dimensions.</li> <li>Return positive heights for top-down BMP images.</li> <li>Remove the upper Python version cap, migrate packaging to pyproject.toml, and add Python 3.15 CI coverage.</li> <li>Bump the package version to 2.0.1 and add recent feedback contributors to the README.</li> </ul> <p>Related issues: <a href="https://redirect.github.com/shibukawa/imagesize_py/issues/64">shibukawa/imagesize_py#64</a> <a href="https://redirect.github.com/shibukawa/imagesize_py/issues/83">shibukawa/imagesize_py#83</a> <a href="https://redirect.github.com/shibukawa/imagesize_py/issues/84">shibukawa/imagesize_py#84</a></p> <p>Related pull requests: <a href="https://redirect.github.com/shibukawa/imagesize_py/pull/86">shibukawa/imagesize_py#86</a> <a href="https://redirect.github.com/shibukawa/imagesize_py/pull/87">shibukawa/imagesize_py#87</a> <a href="https://redirect.github.com/shibukawa/imagesize_py/pull/88">shibukawa/imagesize_py#88</a> <a href="https://redirect.github.com/shibukawa/imagesize_py/pull/89">shibukawa/imagesize_py#89</a> <a href="https://redirect.github.com/shibukawa/imagesize_py/pull/90">shibukawa/imagesize_py#90</a> <a href="https://redirect.github.com/shibukawa/imagesize_py/pull/91">shibukawa/imagesize_py#91</a> <a href="https://redirect.github.com/shibukawa/imagesize_py/pull/92">shibukawa/imagesize_py#92</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/shibukawa/imagesize_py/commit/cf87fc06d599c71b61564eca97873b7bc75ab49a"><code>cf87fc0</code></a> Prepare release 2.0.1</li> <li><a href="https://github.com/shibukawa/imagesize_py/commit/24992f68410217f6daf2984577979470a8dfdc0f"><code>24992f6</code></a> Merge pull request <a href="https://redirect.github.com/shibukawa/imagesize_py/issues/92">#92</a> from shibukawa/feature/add-test-python315</li> <li><a href="https://github.com/shibukawa/imagesize_py/commit/cda8b073008a448504d6ba6788e97c436c3373d2"><code>cda8b07</code></a> Add Python 3.15 test coverage</li> <li><a href="https://github.com/shibukawa/imagesize_py/commit/a42d408d4c0b75f218e487b0c88f0501e0372a81"><code>a42d408</code></a> Merge pull request <a href="https://redirect.github.com/shibukawa/imagesize_py/issues/91">#91</a> from shibukawa/feature/fix-issue83</li> <li><a href="https://github.com/shibukawa/imagesize_py/commit/a83b14f684109fcf8e6153deb1f83d4fa6f5c8d2"><code>a83b14f</code></a> Merge remote-tracking branch 'origin/master' into feature/fix-issue84</li> <li><a href="https://github.com/shibukawa/imagesize_py/commit/a1374b11967d841b87b5bf5ec7ebb60b39497197"><code>a1374b1</code></a> Optimize metadata parsing and HTTP range reads</li> <li><a href="https://github.com/shibukawa/imagesize_py/commit/d08863483006e008b8814a031c544b017df5ffc4"><code>d088634</code></a> Merge pull request <a href="https://redirect.github.com/shibukawa/imagesize_py/issues/90">#90</a> from shibukawa/feature/fix-issue84</li> <li><a href="https://github.com/shibukawa/imagesize_py/commit/fde3b5ef10bc510452487b1cf8a11811e83c521a"><code>fde3b5e</code></a> Fix JPEG2000 box parsing for issue 84</li> <li><a href="https://github.com/shibukawa/imagesize_py/commit/7d5c7485ee1d9feeac50163f9f4dbad1ff1dc148"><code>7d5c748</code></a> Merge pull request <a href="https://redirect.github.com/shibukawa/imagesize_py/issues/87">#87</a> from stephenfin/pyproject</li> <li><a href="https://github.com/shibukawa/imagesize_py/commit/efe3db1835f52095e5655e6c296c8ee80e47263f"><code>efe3db1</code></a> Merge pull request <a href="https://redirect.github.com/shibukawa/imagesize_py/issues/89">#89</a> from jdillard/fix-64-svg-single-quotes</li> <li>Additional commits viewable in <a href="https://github.com/shibukawa/imagesize_py/compare/2.0.0...2.0.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.1.0 to 26.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/benoitc/gunicorn/releases">gunicorn's releases</a>.</em></p> <blockquote> <h2>gunicorn 26.2.0</h2> <p>Cleartext HTTP/2 lands, and an HTTP/2 security fix.</p> <h2>Cleartext HTTP/2 (h2c)</h2> <p><code>http2_cleartext</code> accepts <code>prior-knowledge</code>, <code>upgrade</code>, <code>both</code> or <code>off</code> (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; <code>upgrade</code> honours an HTTP/1.1 <code>Upgrade: h2c</code> request. Both work on the gthread, gevent and asgi workers.</p> <p>This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in <code>forwarded_allow_ips</code> are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.</p> <p>Do not expose a cleartext HTTP/2 port to the internet.</p> <h2>Security</h2> <p><code>HTTP2Request</code> built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and <code>header_map</code> policy, duplicate <code>Host</code> and <code>Content-Type</code>, control characters in values, and the <code>forwarded_allow_ips</code> trust gate. An untrusted client could set <code>SCRIPT_NAME</code> and forge <code>HTTP_*</code> entries in the WSGI environ, and decide <code>wsgi.url_scheme</code> through <code>:scheme</code>. Both request classes now share one policy mixin, and the scheme comes from the transport.</p> <p>If you serve HTTP/2, this is the reason to upgrade.</p> <h2>Other HTTP/2 fixes</h2> <p>WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. <code>sendfile()</code> is refused on HTTP/2 responses rather than bypassing framing.</p> <h2>Request bodies dropped on Upgrade requests</h2> <p>On the ASGI worker with the fast parser, any request carrying an <code>Upgrade</code> header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in <code>gunicorn_h1c</code> 0.6.9, which the <code>fast</code> extra now requires.</p> <p>Full changelog: <a href="https://gunicorn.org/news/">https://gunicorn.org/news/</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/benoitc/gunicorn/commit/36f2a3c1b80dfa41d70859d12c5bfbbdc23a3c38"><code>36f2a3c</code></a> gunicorn 26.2.0</li> <li><a href="https://github.com/benoitc/gunicorn/commit/cbba3505f423bfb91af3a87e49ed9d232f39a8fe"><code>cbba350</code></a> test: cover the h2c edge paths that had none</li> <li><a href="https://github.com/benoitc/gunicorn/commit/988541112ebcf3f795c020fc394aa7eed75f9f53"><code>9885411</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3703">#3703</a> from cormier/fix-inconsistency-in-control-socket-docs</li> <li><a href="https://github.com/benoitc/gunicorn/commit/86f0919806a2d4d4cce376cc2088352e7643b139"><code>86f0919</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3704">#3704</a> from methane/doc-wsgi-h1c</li> <li><a href="https://github.com/benoitc/gunicorn/commit/585355122efe736946b977c5605e404ff2d6ddd4"><code>5853551</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3712">#3712</a> from Rotzbua/patch-1</li> <li><a href="https://github.com/benoitc/gunicorn/commit/7bce87e2aa29a4a794eb2b113ff811cad6a80736"><code>7bce87e</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3700">#3700</a> from benoitc/fix/sponsor-logo-path</li> <li><a href="https://github.com/benoitc/gunicorn/commit/972dfb03b110c430712c32a3d92ef6397ff8eff6"><code>972dfb0</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3690">#3690</a> from melbinjp/docs/contributing-settings-path</li> <li><a href="https://github.com/benoitc/gunicorn/commit/7b3f16be8d9cc051538b7f0b58b236b37c9550f8"><code>7b3f16b</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3711">#3711</a> from benoitc/docs/http2-changelog</li> <li><a href="https://github.com/benoitc/gunicorn/commit/5bf237c0c7ef5bcdc63046645a17d6bafd609a34"><code>5bf237c</code></a> http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround</li> <li><a href="https://github.com/benoitc/gunicorn/commit/7cf03385c574228e28c4952fd410ed2df02acc94"><code>7cf0338</code></a> test: skip the fast-parser cases when gunicorn_h1c is absent</li> <li>Additional commits viewable in <a href="https://github.com/benoitc/gunicorn/compare/26.1.0...26.2.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.3 to 4.11.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/platformdirs/releases">platformdirs's releases</a>.</em></p> <blockquote> <h2>4.11.4</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🔧 chore: batch dependency updates weekly on Tuesday by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/528">tox-dev/platformdirs#528</a></li> <li>fix: stop iter_*_dirs yielding the same directory twice by <a href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/524">tox-dev/platformdirs#524</a></li> <li>docs: fix merge order in the config how-to by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/platformdirs/pull/529">tox-dev/platformdirs#529</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/platformdirs/compare/4.11.3...4.11.4">https://github.com/tox-dev/platformdirs/compare/4.11.3...4.11.4</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst">platformdirs's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <p>.. towncrier-draft-entries:: Unreleased</p> <p>.. towncrier release notes start</p> <hr /> <p>4.11.5 (2026-08-27)</p> <hr /> <ul> <li>Give :func:<code>~platformdirs.user_preference_dir</code> and :func:<code>~platformdirs.user_preference_path</code> the same arguments as :func:<code>~platformdirs.user_config_dir</code>. Added without arguments in :pr:<code>491</code>, they could only return the unscoped base directory even though the property they wrap appends the app name and version. :pr:<code>531</code></li> <li>Make :func:<code>~platformdirs.site_applications_path</code> return the first entry when <code>multipath=True</code>, matching :func:<code>~platformdirs.site_data_path</code>. On Unix and macOS it passed the whole <code>$XDG_DATA_DIRS</code> list to :class:<code>~pathlib.Path</code>, giving one unusable path such as <code>/first/applications:/second/applications</code>. :pr:<code>532</code></li> <li>Give :func:<code>~platformdirs.user_applications_dir</code>, :func:<code>~platformdirs.user_applications_path</code>, :func:<code>~platformdirs.site_applications_dir</code> and :func:<code>~platformdirs.site_applications_path</code> the app arguments. Android scopes both applications directories to the app, so without them the functions could only return the unscoped base directory there. On the two site functions they are keyword-only, keeping <code>multipath</code> first positional as it has been since 4.9.0; the two user functions take their boolean options keyword-only. :pr:<code>534</code></li> <li>Correct the ordering note on the iterator methods. <code>use_site_for_root</code> drops the user directory entirely, so the iterators are documented as yielding the most specific directory first rather than always yielding the user one. :pr:<code>533</code></li> </ul> <hr /> <p>4.11.4 (2026-08-24)</p> <hr /> <ul> <li>Stop the <code>iter_*_dirs</code> methods yielding the same directory twice when a site directory resolves to its user equivalent - :pr:<code>520</code> covered only Unix with <code>use_site_for_root</code>. It also hit :meth:<code>~platformdirs.PlatformDirs.iter_runtime_dirs</code> on Unix with <code>$XDG_RUNTIME_DIR</code> set, on Windows and macOS, and all six iterators on Android. :pr:<code>524</code></li> <li>Fix the config merging example in the how-to guide. <code>iter_config_paths</code> yields the user directory first, so the <code>config.update</code> loop let the site defaults override the user's config instead of the other way round. :pr:<code>529</code></li> </ul> <hr /> <p>4.11.3 (2026-08-13)</p> <hr /> <ul> <li><code>python -m platformdirs</code> now lists :func:<code>~platformdirs.user_desktop_dir</code>, which was missing from the properties it prints. :pr:<code>523</code></li> <li>Stop :func:<code>~platformdirs.site_data_dir</code>, :func:<code>~platformdirs.site_config_dir</code> and :func:<code>~platformdirs.site_applications_dir</code> raising <code>IndexError</code> on Unix and macOS when <code>$XDG_DATA_DIRS</code> or <code>$XDG_CONFIG_DIRS</code> holds only separators and whitespace, such as <code>":"</code>. These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:<code>523</code></li> </ul> <hr /> <p>4.11.2 (2026-08-10)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/platformdirs/commit/e5fd9eaec045f583563e077649d903ec5db68cbf"><code>e5fd9ea</code></a> Release 4.11.4</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/4bf9228a33e16c26f1bbd779feb56f5268849b3f"><code>4bf9228</code></a> docs: fix merge order in the config how-to (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/529">#529</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/c653668d63658a1f5c468a2f645deb21bedf5ecd"><code>c653668</code></a> fix: stop iter_*_dirs yielding the same directory twice (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/524">#524</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/f18ebafb3f8858c51bf27877c279f60e2abfe32e"><code>f18ebaf</code></a> 🔧 chore: batch dependency updates weekly on Tuesday (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/528">#528</a>)</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/b2f29d8e8c17ac18299c2a3e1833620281bb57d2"><code>b2f29d8</code></a> build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 in the all group (...</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/272f3403018cd32fab34e0f185907827f5347f39"><code>272f340</code></a> build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 in the all group (#...</li> <li><a href="https://github.com/tox-dev/platformdirs/commit/d3cf61ce5e729f2c35f830b69e14adb7b6970a00"><code>d3cf61c</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/platformdirs/issues/525">#525</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/platformdirs/compare/4.11.3...4.11.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[//]: # (dependabot-start)⚠️ **Dependabot is rebasing this PR**⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.4 to 21.7.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/releases">virtualenv's releases</a>.</em></p> <blockquote> <h2>21.7.5</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix(types): adapt to python-discovery 1.5.2 annotations by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3211">pypa/virtualenv#3211</a></li> <li>📄 docs: publish llms.txt from the docs build by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3210">pypa/virtualenv#3210</a></li> <li>Push renamed changelog to PR branch in upgrade workflow by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3213">pypa/virtualenv#3213</a></li> <li>🔧 chore: batch dependency updates weekly on Tuesday by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3219">pypa/virtualenv#3219</a></li> <li>docs: actualize python support version by <a href="https://github.com/even-even"><code>@even-even</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3220">pypa/virtualenv#3220</a></li> <li>🐛 fix(create): check every execute bit in ExePathRef.can_run by <a href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3217">pypa/virtualenv#3217</a></li> <li>🐛 fix(util): make safe_delete's error handler actually run by <a href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3222">pypa/virtualenv#3222</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/even-even"><code>@even-even</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/virtualenv/pull/3220">pypa/virtualenv#3220</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.7.4...21.7.5">https://github.com/pypa/virtualenv/compare/21.7.4...21.7.5</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's changelog</a>.</em></p> <blockquote> <h1>Bugfixes - 21.7.5</h1> <ul> <li>Fix the type check against <code>python-discovery</code> 1.5.2, whose annotations allow a <code>None</code> <code>prefix</code> and integer <code>sysconfig_vars</code> values: config var substitution now skips a missing prefix and locating the shared libpython requires string <code>INSTSONAME</code>/<code>LIBDIR</code> values. (:issue:<code>3211</code>)</li> <li><code>ExePathRef.can_run</code> now checks the group and other execute bits instead of only the owner one, and returns <code>False</code> rather than <code>None</code> when a file carries none of the three - by :user:<code>darrenhuai</code>. (:issue:<code>3217</code>)</li> <li><code>safe_delete</code> no longer passes <code>ignore_errors=True</code> to <code>shutil.rmtree</code>, which replaced its own chmod-and-retry handler with a no-op and swallowed every failure. Read-only files - every file in a wheel image, which <code>set_tree</code> marks - survived, so <code>--reset-app-data</code> and <code>--clear</code> kept trees they reported deleting. The handler now retries only the deletion itself, keeps the other mode bits, and raises the original error for anything it cannot clear - by :user:<code>darrenhuai</code>. (:issue:<code>3222</code>)</li> </ul> <hr /> <p>v21.7.4 (2026-08-10)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/virtualenv/commit/2a645aece0241e6dc02bf3d67acd88aa0770b601"><code>2a645ae</code></a> release 21.7.5</li> <li><a href="https://github.com/pypa/virtualenv/commit/a48bf4bdce585ab2df7e3eef056b84591429976e"><code>a48bf4b</code></a> 🐛 fix(util): make safe_delete's error handler actually run (<a href="https://redirect.github.com/pypa/virtualenv/issues/3222">#3222</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/31b50810666aac5075a68472d7f9376148dac8d9"><code>31b5081</code></a> 🐛 fix(create): check every execute bit in ExePathRef.can_run (<a href="https://redirect.github.com/pypa/virtualenv/issues/3217">#3217</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/5640eef0a51cbea4518ab7d8a302069866a743c9"><code>5640eef</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/virtualenv/issues/3221">#3221</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/1ebcab6131bf2f777805e3682b755bf1c81b4f60"><code>1ebcab6</code></a> docs: actualize python support version (<a href="https://redirect.github.com/pypa/virtualenv/issues/3220">#3220</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/eb241a03b1b94d4263512c8346fdbaa14f2ba7c3"><code>eb241a0</code></a> 🔧 chore: batch dependency updates weekly on Tuesday (<a href="https://redirect.github.com/pypa/virtualenv/issues/3219">#3219</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/9534eda10bd9a74317ae50e8fdb1327ffc87a8a2"><code>9534eda</code></a> chore(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (<a href="https://redirect.github.com/pypa/virtualenv/issues/3218">#3218</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/c8c4285104995d63859991f115534828add66457"><code>c8c4285</code></a> chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (<a href="https://redirect.github.com/pypa/virtualenv/issues/3215">#3215</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/ea806dbc80cbaa493c2de8569767c81b816e9a24"><code>ea806db</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/virtualenv/issues/3214">#3214</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/a21130f1a430f30aa72bf97bdb424c79c7b3a379"><code>a21130f</code></a> Push renamed changelog to PR branch in upgrade workflow (<a href="https://redirect.github.com/pypa/virtualenv/issues/3213">#3213</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/virtualenv/compare/21.7.4...21.7.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.5.2 to 1.5.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/releases">python-discovery's releases</a>.</em></p> <blockquote> <h2>v1.5.3</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>📄 docs: publish llms.txt from the docs build by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/118">tox-dev/python-discovery#118</a></li> <li>Avoid passing a non-Collection iterable to parametrize by <a href="https://github.com/musicinmybrain"><code>@musicinmybrain</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/120">tox-dev/python-discovery#120</a></li> <li>🔧 chore: batch dependency updates weekly on Tuesday by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/125">tox-dev/python-discovery#125</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/musicinmybrain"><code>@musicinmybrain</code></a> made their first contribution in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/120">tox-dev/python-discovery#120</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/python-discovery/compare/1.5.2...1.5.3">https://github.com/tox-dev/python-discovery/compare/1.5.2...1.5.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst">python-discovery's changelog</a>.</em></p> <blockquote> <h1>Bug fixes - 1.5.3</h1> <ul> <li>Restore discovery of Python 3.6 and 3.7 interpreters: the interrogation script had grown 3.8-only syntax and is now kept to Python 3.6. Candidates below 3.6 log one warning naming the version found instead of two debug-level query attempts, and the verdict is cached so they are queried only once; an absolute-path spec for one raises <code>RuntimeError</code> with the same message - by :user:<code>gaborbernat</code>. (:issue:<code>116</code>)</li> <li>Prefer the version-matched system executable when CPython reports an existing generic executable for a copied POSIX virtual environment. (:issue:<code>124</code>)</li> </ul> <h1>Improved documentation - 1.5.3</h1> <ul> <li>Document the version floors: runs on Python 3.8+, discovers interpreters down to 3.6 - by :user:<code>gaborbernat</code>. (:issue:<code>116</code>)</li> </ul> <hr /> <p>v1.5.1 (2026-07-31)</p> <hr /> <h1>Bug fixes - 1.5.1</h1> <ul> <li>Locate uv's interpreter store the way uv does, using XDG on macOS (<code>~/.local/share/uv/python</code>) and roaming <code>%APPDATA%\uv\python</code> on Windows, neither of which <code>platformdirs</code> reported. The uv variables now come from the <code>env</code> mapping rather than <code>os.environ</code> - by :user:<code>gaborbernat</code>. (:issue:<code>109</code>)</li> <li>Pick uv-managed interpreters by install directory name instead of globbing the store. A bare <code>3.8</code> now means CPython, the way uv resolves it, rather than whichever implementation the filesystem happened to list first, and probing runs newest version first - by :user:<code>gaborbernat</code>. (:issue:<code>110</code>)</li> </ul> <h1>Packaging updates and notes for downstreams - 1.5.1</h1> <ul> <li>Drop the <code>platformdirs</code> runtime dependency; locating uv's store was the only thing it did - by :user:<code>gaborbernat</code>. (:issue:<code>109</code>)</li> </ul> <hr /> <p>v1.5.0 (2026-07-21)</p> <hr /> <h1>Packaging updates and notes for downstreams - 1.5.0</h1> <ul> <li>Declare support for Python 3.15 and run the test suite against it, currently in beta. (:issue:<code>104</code>)</li> </ul> <hr /> <p>v1.4.4 (2026-07-08)</p> <hr /> <h1>Bug fixes - 1.4.4</h1> <ul> <li>Parse the debug build flag in interpreter specs - <code>python3.13d</code> and Debian's <code>python3.13-dbg</code> / <code>python3.13-debug</code> now select a <code>Py_DEBUG</code> interpreter instead of being misread as an ISA named <code>dbg</code>. Resolving a virtualenv to its base interpreter also checks the free-threaded and debug ABI flags, so a debug or free-threaded environment no longer resolves to a release build of the same version - by :user:<code>gaborbernat</code>. (:issue:<code>96</code>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/python-discovery/commit/a4518870621580adee51f1c9d72e695563e6a035"><code>a451887</code></a> release 1.5.3</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/ba973b40b5bacf0db3f77fe93f7730305baa2104"><code>ba973b4</code></a> 🔧 chore: batch dependency updates weekly on Tuesday (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/125">#125</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/4d8574609315ce086f0ff6d13cfe62974a260023"><code>4d85746</code></a> 🐛 fix(py_info): prefer exact base Python</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/8ca46d5b4511cb6c1f11b2d03bee7a36240a7dc8"><code>8ca46d5</code></a> build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/123">#123</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/67cbc06b6067f774856c0f59825766e28ad34975"><code>67cbc06</code></a> build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/122">#122</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/d86823b69f91c947fb31ee4941dcbe11cd635051"><code>d86823b</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/121">#121</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/b30753a59559a94c64f95d8dd2fa7c3db5a03567"><code>b30753a</code></a> Avoid passing a non-Collection iterable to parametrize (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/120">#120</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/e87c2c6c2168ee7a7c0ee1cd6a763c1715eccc8f"><code>e87c2c6</code></a> 📄 docs: publish llms.txt from the docs build (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/118">#118</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/python-discovery/compare/1.5.2...1.5.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )