Skip to content

Update maintenance - #260

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/maintenance
Open

Update maintenance#260
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/maintenance

Conversation

@renovate

@renovate renovate Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
actions/checkout action patch v7.0.0v7.0.1 age confidence
filelock minor ==3.29.4==3.32.2 age confidence
packaging minor ==26.2==26.3 age confidence
pglast (changelog) install minor ==7.14==7.18 age confidence
pglast (changelog) minor ==7.14==7.18 age confidence
platformdirs (changelog) minor ==4.10.0==4.11.1 age confidence
pylint (changelog) patch ==4.0.6==4.0.7 age confidence
pypa/gh-action-pypi-publish (changelog) action digest cef2210dc37677
slackapi/slack-github-action action patch v3.0.3v3.0.5 age confidence
step-security/harden-runner action minor v2.19.4v2.20.1 age confidence
tox (changelog) minor ==4.56.1==4.58.0 age confidence
virtualenv minor ==21.5.1==21.7.3 age confidence

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

tox-dev/py-filelock (filelock)

v3.32.2

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.32.1...3.32.2

v3.32.0

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.31.2...3.32.0

v3.31.2

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.31.1...3.31.2

v3.31.1

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.31.0...3.31.1

v3.31.0

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.30.3...3.31.0

v3.30.3

Compare Source

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.30.2...3.30.3

v3.30.2

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.30.1...3.30.2

v3.30.1

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.30.0...3.30.1

v3.30.0

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.29.7...3.30.0

v3.29.7

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.29.6...3.29.7

v3.29.6

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.29.5...3.29.6

v3.29.5

Compare Source

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.29.4...3.29.5

pypa/packaging (packaging)

v26.3

Compare Source

What's Changed

Features
  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#​1267, #​1270, #​1298)
  • PEP 808: accept Metadata-Version: 2.6. (#​1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#​1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#​1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#​1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#​1313)
Behavior adaptations
  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#​1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#​160)
Fixes for versions and specifiers
  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#​1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#​1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#​1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#​1257)
Fixes for requirements and markers
  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#​1232)
  • Normalize requested extra names before comparing or hashing requirements. (#​644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#​1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#​1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#​1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#​1213)
  • Keep the parentheses of a nested group when serializing markers. (#​1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#​1246, #​1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#​1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#​1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#​1249)
  • Reject requirements and markers with a trailing line break. (#​1345)
Fixes for metadata and licenses
  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#​1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#​1330)
  • Reject malformed Description-Content-Type values. (#​1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#​1327)
  • Route multipart email payloads to unparsed instead of asserting. (#​1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#​1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#​1356)
  • Raise InvalidLicenseExpression for misplaced WITH clauses and empty LicenseRef- names. (#​1266)
  • Raise InvalidLicenseExpression instead of KeyError for a LicenseRef- with a + suffix. (#​1219)
Fixes for tags and filenames
  • Raise InvalidTag from parse_tag() for tags with the wrong number of components. (#​1238)
  • Reject empty tag components in parse_wheel_filename() and parse_tag(). (#​1234)
  • Reject an empty project name in the wheel and sdist filename parsers. (#​1305)
  • Reject wheel filenames with a trailing newline. (#​1341)
  • Reject wheel tags whose interpreter component is not an identifier. (#​577)
  • is_normalized_name now rejects names with collapsed double hyphens like a--b. (#​1230)
  • Fix duplicate explicit abi3t tags. (#​1245)
  • Forward the warn argument to generic_tags() in sys_tags(). (#​1264)
  • Raise SystemError for an empty or malformed CPython EXT_SUFFIX. (#​1271, #​1301)
  • Fix a typo in the macOS fat3 architecture name (was fat32). (#​1199)
Fixes for pylock, direct URLs, and dependency groups
  • Percent-decode pylock artifact file names derived from a url so that local versions (e.g. a wheel with 2.12.1+cu130 encoded as 2.12.1%2Bcu130) yield a valid file name. (#​1314)
  • Use an explicitly empty tags sequence in Pylock.select() instead of falling back to sys_tags(). (#​1349)
  • Fix Pylock.select() on Python builds that report a non-PEP 440 python_full_version (e.g. 3.15.0+). (#​1179)
  • Reject TOML booleans where integers are expected in pylock files. (#​1244)
  • Add PylockSelectError to packaging.pylock.__all__. (#​1202)
  • Fix DirectUrl credential stripping for passwords containing @. (#​1218)
  • Parse the URL scheme case-insensitively when checking for file URLs in direct_url. (#​1240)
  • Require absolute file URLs for local directories in direct_url. (#​1297)
  • Collect InvalidRequirement errors while resolving dependency groups instead of leaking them. (#​1302)
  • Don't cache malformed dependency group parses. (#​1248)
Performance
  • Implement Specifier and SpecifierSet filtering with the new range engine. (#​1120, #​1259)
  • Cache the default marker environment. (#​1250)
  • Cache the _manylinux module lookup process-wide. (#​1254)
  • Add __slots__ to Requirement and the token classes. (#​1320, #​1258)
  • Keep range caches across canonicalization, precompile the wheel project-name pattern, simplify parse_tag(), and skip platform.mac_ver() when the version and arch are given. (#​1253, #​1256, #​1236, #​1255)
Documentation
Internal
  • Add Python 3.15 to the test matrix. (#​1190)
  • Add a musl/Alpine test job and make the test suite pass on musl. (#​1226, #​1227)
  • Expand the downstream test matrix by ten projects. (#​1261)
  • Update to mypy 2. (#​1191)
  • Use nox's uv integration. (#​1057)

New Contributors

Full Changelog: pypa/packaging@26.2...26.3

lelit/pglast (pglast)

v7.18

Compare Source

v7.17

Compare Source

v7.16

Compare Source

v7.15

Compare Source

tox-dev/platformdirs (platformdirs)

v4.11.1

Compare Source

What's Changed
New Contributors

Full Changelog: tox-dev/platformdirs@4.11.0...4.11.1

v4.11.0

Compare Source

What's Changed

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

v4.10.1

Compare Source

What's Changed

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

pylint-dev/pylint (pylint)

v4.0.7

Compare Source

What's new in Pylint 4.0.7?

Release date: 2026-08-09

False Positives Fixed

  • Fix a false positive for invalid-name when a module-level variable is assigned
    an instance of a TypedDict subclass. Such a name is a value, not a type
    definition, so it is now checked against the constant or variable regex instead
    of class-rgx.

    Closes #​11231

Other Bug Fixes

  • Fix a crash in the bad-open-mode check when the mode argument of
    open is the NotImplemented constant (Python >= 3.14).

    Closes #​11099

  • Fix a crash in the not-context-manager and not-async-context-manager
    checks when the context manager infers to a value without a name, such as the
    slice returned by with slice(...) / async with slice(...).

    Closes #​11102

  • Fix a false positive for nested-min-max (W3301) when the inner min/max call carries a keyword argument such as key=. Flattening the call dropped the keyword and changed the result, so nested calls whose inner call has keyword arguments are no longer flagged.

    Closes #​11130

  • Fix a false suggestion from nested-min-max (W3301): when rewriting a nested min/max into a splat call, arguments positioned after the splatted call were silently dropped, so the suggested code changed the result.

    Closes #​11134

  • Fix a false positive for too-many-locals (R0914): PEP 695 type parameters, i.e. the T1 and T2 in a generic def f[T1, T2] signature, were counted as local variables. They are type-system constructs, not runtime locals, and are now excluded from the local-variable count.

    Closes #​11136

  • Fix literal-comparison (R0123) emitting a corrupted suggestion for identifiers
    that contain is (e.g. axis is 5 was rendered ax== == 5). The suggestion
    is now rebuilt from the operands and operator.

    Closes #​11146

  • Fix false positives in bad-string-format-type (E1307) for valid % formatting:
    %i/%u applied to a float (both truncate like %d) and %a applied to any
    non-int type (%a is type-agnostic like %s/%r).

    Closes #​11147

  • Fix a false positive for :ref:useless-parent-delegation when an override changes
    the default value of a positional-only parameter.

    Closes #​11148

  • Fixed a crash in comparison-with-callable when comparing a lambda assigned as a class attribute.

    Closes #​11175

  • too-many-lines could be reported at the line of a # pylint: disable=too-many-lines
    pragma found in a previously linted module. Pragma positions are now reset between
    modules, so the message is reported at line 1 (or at the current module's own pragma)
    regardless of which files were linted before.

    Refs #​11191

  • Fix a crash when a call unpacks a dictionary whose keys are not string
    constants, e.g. copy.copy(**{-1: 1}).

    Closes #​11222

slackapi/slack-github-action (slackapi/slack-github-action)

v3.0.5: Slack GitHub Action v3.0.5

Compare Source

Patch Changes
  • 96fddbe: fix: revert multiline yaml parsing indentation change

v3.0.4: Slack GitHub Action v3.0.4

Compare Source

Patch Changes
step-security/harden-runner (step-security/harden-runner)

v2.20.1

Compare Source

What's Changed
  • AWS CodeBuild-hosted runner support
  • Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

v2.20.0

Compare Source

What's Changed
  • Support for block policy for MacOS and Windows GitHub-hosted runners
  • Support for Bitrise MacOS GitHub Actions runners
  • HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

tox-dev/tox (tox)

v4.58.0

Compare Source

What's Changed

Full Changelog: tox-dev/tox@4.57.2...4.58.0

v4.57.2

Compare Source

What's Changed

Full Changelog: tox-dev/tox@4.57.1...4.57.2

v4.57.1

Compare Source

What's Changed

Full Changelog: tox-dev/tox@4.57.0...4.57.1

v4.57.0

Compare Source

What's Changed

New Contributors

Full Changelog: tox-dev/tox@4.56.4...4.57.0

v4.56.4

Compare Source

What's Changed

Full Changelog: tox-dev/tox@4.56.3...4.56.4

v4.56.3

Compare Source

What's Changed

New Contributors

Full Changelog: tox-dev/tox@4.56.2...4.56.3

v4.56.2

Compare Source

What's Changed

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from svenklemm as a code owner August 1, 2026 02:11
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@renovate
renovate Bot force-pushed the renovate/maintenance branch 4 times, most recently from 787a4f3 to fc45205 Compare August 8, 2026 01:27
@renovate
renovate Bot force-pushed the renovate/maintenance branch from fc45205 to d889a15 Compare August 8, 2026 17:48
@renovate
renovate Bot force-pushed the renovate/maintenance branch from d889a15 to 753b817 Compare August 9, 2026 21:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant