build(deps): bump pdm from 2.28.1 to 2.28.2

[dependabot]

Bumps pdm from 2.28.1 to 2.28.2.

Release notes

Sourced from pdm's releases.

v2.28.2

Bug Fixes

• Keep environment inspection working for Python 3.9 targets when PDM uses dep-logic 0.7 or newer. (#3838)
• Cache the update check timestamp even when the version lookup fails, so that pdm no longer appears to hang on every command when PyPI is unreachable. (#3840)
• Don't crash with an IndexError when listing scripts and one of them is blank. A blank script is now listed as <BLANK_SCRIPT>. (#3842)
• Keep the whole template URL when pdm new is given an ssh:// or credentialed Git URL, instead of truncating it at the userinfo @. (#3843)
• Strip comments preceded by any whitespace, not only a plain space, when importing a requirements.txt file. (#3844)
• Match --trusted-host on host and port when importing a requirements.txt file, and keep the port when exporting one. (#3845)
• Expand a ~ prefix in the venv.location config so pdm venv list/remove/activate/purge find virtualenvs created under it. (#3847)
• Convert a Poetry caret constraint on a 0.x version to the upper bound Poetry documents, so ^0.2.3 becomes <0.3.0 and ^0.0.3 becomes <0.0.4 instead of <1.0.0. (#3848)
• Fill in a placeholder project.name and project.version for the pyproject.toml generated for uv, so pdm lock/pdm install work with use_uv on a project that declares neither. (#3849)
• Resolve nested requirement paths relative to remote requirements file URLs. (#3850)

Changelog

Sourced from pdm's changelog.

Release v2.28.2 (2026-08-18)

Bug Fixes

• Keep environment inspection working for Python 3.9 targets when PDM uses dep-logic 0.7 or newer. (#3838)
• Cache the update check timestamp even when the version lookup fails, so that pdm no longer appears to hang on every command when PyPI is unreachable. (#3840)
• Don't crash with an IndexError when listing scripts and one of them is blank. A blank script is now listed as <BLANK_SCRIPT>. (#3842)
• Keep the whole template URL when pdm new is given an ssh:// or credentialed Git URL, instead of truncating it at the userinfo @. (#3843)
• Strip comments preceded by any whitespace, not only a plain space, when importing a requirements.txt file. (#3844)
• Match --trusted-host on host and port when importing a requirements.txt file, and keep the port when exporting one. (#3845)
• Expand a ~ prefix in the venv.location config so pdm venv list/remove/activate/purge find virtualenvs created under it. (#3847)
• Convert a Poetry caret constraint on a 0.x version to the upper bound Poetry documents, so ^0.2.3 becomes <0.3.0 and ^0.0.3 becomes <0.0.4 instead of <1.0.0. (#3848)
• Fill in a placeholder project.name and project.version for the pyproject.toml generated for uv, so pdm lock/pdm install work with use_uv on a project that declares neither. (#3849)
• Resolve nested requirement paths relative to remote requirements file URLs. (#3850)

Commits

• bc67b54 chore: Release 2.28.2
• 85ae8d2 fix: uv cannot lock a project that declares no name or version (#3849)
• b15d75d fix: resolve nested remote requirement URLs (#3851)
• 95a7777 fix: Poetry caret on a 0.x version converts to the wrong upper bound (#3848)
• 29c40ea fix: 2.28.1: test_core_registration_does_not_import_command_actions fails. ...
• 48f7a76 fix: cache the update check timestamp when the version lookup fails (#3846)
• ef747c9 fix(venv): a ~ in venv.location hides every created virtualenv (#3847)
• fd378b1 fix(formats): --trusted-host ignores the port on import and drops it on expor...
• 5a6ea88 fix: a tab before a comment breaks requirements.txt import (#3844)
• 245fd1c fix(run): a blank script crashes pdm run --list (#3842)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)