Bump the uv group with 14 updates

[dependabot]

Bumps the uv group with 14 updates:

Package	From	To
boto3	1.43.6	1.43.39
botocore	1.43.6	1.43.39
click	8.3.3	8.4.2
coverage	7.14.0	7.14.3
prek	0.3.13	0.4.6
pytest	9.0.3	9.1.1
rust-just	1.50.0	1.55.1
ty	0.0.35	0.0.56
types-pyyaml	6.0.12.20260510	6.0.12.20260518
distlib	0.4.0	0.4.3
docutils	0.22.4	0.23
filelock	3.29.0	3.29.4
mkdocstrings-python	2.0.3	2.0.5
pymdown-extensions	10.21.3	11.0

Updates boto3 from 1.43.6 to 1.43.39

Commits

• 121db7a Merge branch 'release-1.43.39'
• 310317d Bumping version to 1.43.39
• ff7c1cf Add changelog entries from botocore
• 805c683 Update CODEOWNERS to shared Python SDK and CLI team (#4809)
• efcfb65 Merge branch 'release-1.43.38'
• d7aa957 Merge branch 'release-1.43.38' into develop
• c5ccc0d Bumping version to 1.43.38
• 2f87c21 Add changelog entries from botocore
• af4ce8d Merge branch 'release-1.43.37'
• 1d2f989 Merge branch 'release-1.43.37' into develop
• Additional commits viewable in compare view

Updates botocore from 1.43.6 to 1.43.39

Commits

• 3f29544 Merge branch 'release-1.43.39'
• 97d313f Bumping version to 1.43.39
• bcfbd50 Update endpoints model
• 0813a0f Update to latest models
• ea9157a Update CODEOWNERS to shared Python SDK and CLI team (#3740)
• 7ad90e5 Merge branch 'release-1.43.38'
• 4112609 Merge branch 'release-1.43.38' into develop
• c006402 Bumping version to 1.43.38
• e7f2f13 Update endpoints model
• 58db4a7 Update to latest models
• Additional commits viewable in compare view

Updates click from 8.3.3 to 8.4.2

Release notes

Sourced from click's releases.

8.4.2

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.2/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-2 Milestone: https://github.com/pallets/click/milestone/34

• Fix Fish shell completion broken in 8.4.0 by #3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. #3502 #3043 #3504 #3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. #3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. #3059 #3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. #3242 #2542 #3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from #3482. #3449 #3533
• Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. #3578
• {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. #2331 #1884 #3125 #3582

8.4.1

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-1 Milestone: https://github.com/pallets/click/milestone/32

• get_parameter_source() is available during eager callbacks and type conversion again. #3458 #3484
• Zsh completion scripts parse correctly on Windows. #3277 # 3466
• Shell completion of Choice Enum values produces a valid completion result. #3015
• Fix empty byte-string handling in echo. #3487
• Fix closed file error with echo_via_pager. #3449

8.4.0

This is the Click 8.4.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our [Version Support Policy][version] on our website.

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.4.2

Released 2026-06-24

• Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. {issue}3502 {issue}3043 {pr}3504 {pr}3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. {pr}3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. {issue}3059 {pr}3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. {issue}3242 {issue}2542 {pr}3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from {pr}3482. {issue}3449 {pr}3533
• Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. {pr}3578
• {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. {issue}2331 {issue}1884 {issue}3125 {pr}3582

Version 8.4.1

Released 2026-05-21

• get_parameter_source() is available during eager callbacks and type conversion again. {issue}3458 {pr}3484
• Zsh completion scripts parse correctly on Windows. {issue}3277 {pr}3466
• Shell completion of Enum values used as Choice options produces a valid completion result. {issue}3015 {pr}3471
• Fix empty byte-string handling in echo. {issue}3487 {pr}3493
• Fix closed file error with echo_via_pager. {issue}3449 {pr}3482
• Fix open_url on Windows when the file path contains spaces. {issue}2994 {pr}3478

Version 8.4.0

Released 2026-05-17

• {class}ParamType typing improvements. {pr}3371

  • {class}ParamType is now a generic abstract base class,

... (truncated)

Commits

• b2e30a1 Release version 8.4.2
• 7a16b20 Fix package_name resolution when module differs from distribution name (#3582)
• bec5928 Fix package_name resolution when top-level module differs from distribution...
• 916883a Fix tests to not rely on -Wdefault option (#3591)
• 09195f6 Fix double-bracketing of choices in synopsis (#3578)
• 1557e26 Check for warning exception with idiomatic context manager
• d9ff133 Static typing improvements in click.shell_completion (#3460)
• 762c97e Fix double-bracketing of choices in synopsis
• 8929d39 Convert changes to markdown. (#3559)
• 237be50 Move changes headings down a level.
• Additional commits viewable in compare view

Updates coverage from 7.14.0 to 7.14.3

Changelog

Sourced from coverage's changelog.

Version 7.14.3 — 2026-06-22

• Fix: the default ... exclusion rule now also matches function bodies whose closing return-type bracket is on its own line (for example, after a long -> dict[ ... ] annotation that a formatter has split over multiple lines). Closes issue 2185, thanks Mengjia Shang <pull 2196_>.

• Fix: On 3.13t, we incorrectly issued Couldn't import C tracer errors. We can't import the C tracer because in 7.14.2 we stopped shipping compiled wheels for 3.13t. Thanks, Hugo van Kemenade <pull 2203_>_.

.. _issue 2185: coveragepy/coveragepy#2185 .. _pull 2196: coveragepy/coveragepy#2196 .. _pull 2203: coveragepy/coveragepy#2203

.. _changes_7-14-2:

Version 7.14.2 — 2026-06-20

• Fix: some messages were being written to stdout, making coverage json -o - useless for capturing JSON output. Now messages are written to stderr, fixing issue 2197_.

• Fix: CoverageData kept one SQLite connection per thread that recorded coverage, but never closed them when those threads terminated. On long runs with many short-lived threads this leaked one file descriptor per dead thread, eventually failing with OSError: [Errno 24] Too many open files. Connections belonging to terminated threads are now closed and dropped. Fixes issue 2192. Thanks, Matthew Lloyd <pull 2193_>.

• Fix: when using sys.monitoring, we were assuming we could use the COVERAGE_ID tool id. But other tools might also assume they could use that id. Pre-allocated ids don't really make sense, so now we search for a usable one instead. Fixes issue 2187_.

• Following the advice of cibuildwheel <no-13t_>_, we no longer distribute wheels for Python 3.13 free-threaded.

.. _issue 2187: coveragepy/coveragepy#2187 .. _issue 2192: coveragepy/coveragepy#2192 .. _pull 2193: coveragepy/coveragepy#2193 .. _issue 2197: coveragepy/coveragepy#2197 .. _no-13t: https://py-free-threading.github.io/ci/#building-free-threaded-wheels-with-cibuildwheel

.. _changes_7-14-1:

... (truncated)

Commits

• 22f13ea docs: sample HTML for 7.14.3
• 2ca4e5f docs: prep for 7.14.3
• 01d714e docs: add changelog entry for #2203
• f36248d fix: don't emit 'Couldn't import C tracer' warning for 3.13t (#2203)
• 86d73d1 docs: thanks, Mengjia Shang
• 3d4ae3c docs: add the #2196 pr link to CHANGES
• f4b2b4d fix: exclude ... bodies after multi-line return-type annotations (#2185) (#...
• 1980ed0 chore: bump sigstore/gh-action-sigstore-python (#2201)
• bca3217 build: since we don't ship 3.13t, don't test it
• 77550d8 docs: oops, mismatched pull requests
• Additional commits viewable in compare view

Updates prek from 0.3.13 to 0.4.6

Release notes

Sourced from prek's releases.

0.4.6

Release Notes

Released on 2026-07-01.

Enhancements

• Verify managed toolchain downloads before installation (#2229)
• Add PREK_DOCKER_NO_INIT to opt-out Docker --init (#2242)
• Improve subprocess error messages (#2257)
• Split run concurrency knobs: PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES (#2276)

Performance

• Avoid allocating markdown extensions per file (#2245)
• Avoid unchanged config tracking writes (#2247)
• Delay trailing whitespace output buffer (#2244)
• Prefilter VCS permalink lines (#2253)
• Skip unnecessary submodule updates during hook repo clone (#2255)

Documentation

• Document language_version inferring for Python and Go (#2241)

Other changes

• Refactor env var handling (#2277)
• Use serde-saphyr for YAML string quoting (#2228)

Contributors

• @​shaanmajid
• @​j178

Install prek 0.4.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.6/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.6/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

... (truncated)

Changelog

Sourced from prek's changelog.

0.4.6

Released on 2026-07-01.

Enhancements

• Verify managed toolchain downloads before installation (#2229)
• Add PREK_DOCKER_NO_INIT to opt-out Docker --init (#2242)
• Improve subprocess error messages (#2257)
• Split run concurrency knobs: PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES (#2276)

Performance

• Avoid allocating markdown extensions per file (#2245)
• Avoid unchanged config tracking writes (#2247)
• Delay trailing whitespace output buffer (#2244)
• Prefilter VCS permalink lines (#2253)
• Skip unnecessary submodule updates during hook repo clone (#2255)

Documentation

• Document language_version inferring for Python and Go (#2241)

Other changes

• Refactor env var handling (#2277)
• Use serde-saphyr for YAML string quoting (#2228)

Contributors

• @​shaanmajid
• @​j178

0.4.5

Released on 2026-06-15.

✨Highlights

0.4.5 completes prek's pre-commit language coverage. With R, Conda, Perl, and coursier now supported, prek supports every language available in pre-commit, plus prek-only modern languages such as Bun and Deno.

This is full feature parity with pre-commit. The last major compatibility gap is closed, and prek is now on the path to 1.0.

💚 Sponsorship

If prek saves time for you or your team, please consider sponsoring the project on GitHub Sponsors. It helps keep

... (truncated)

Commits

• 643fba4 Bump version to 0.4.6 (#2280)
• b0f9261 Refactor env var handling (#2277)
• 8494d16 Split run concurrency knobs (#2276)
• f20bbaa Update sample config for .pre-commit-config.yaml (#2275)
• 5485289 Pin pre-commit repos to commit hash (#2274)
• d418ab3 Improve nix shebang parsing (#2271)
• cc261c1 Update actions/checkout action to v7 (#2267)
• 8d2dbba Update Rust crate itertools to 0.15.0 (#2265)
• 51db86c Update Rust crate phf to 0.14.0 (#2266)
• 1aa7d38 Update dependency uv to v0.11.23 (#2262)
• Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates rust-just from 1.50.0 to 1.55.1

Release notes

Sourced from rust-just's releases.

1.55.1

Fixed

• Fix panic when empty path is passed to --show and --usage (#3511 by casey)

Misc

• Upgrade sha2 to 0.11.0 (#3512 by casey)
• Remove Test::test_round_trip() (#3509 by casey)
• Remove round-trip testing (#3508 by casey)

1.55.0

Fixed

• Fix forwarded dependency flag value (#3489 by casey)

Changed

• Allow [arg(pattern)] to be a list (#3484 by casey)
• Allow [arg(help)] to be expression (#3483 by casey)
• Allow [arg(pattern)] to be expression (#3482 by casey)

Added

• Add stream gates to style() (#3503 by casey)
• Accept -F for --dotenv-filename (#3498 by casey)
• Add just_version() function (#3497 by casey)
• Add [arg(multiple)] (#3493 by casey)
• Allow combining short options (#3490 by casey)
• Allow variadic parameters to be options (#3488 by casey)
• Default [arg(short)] to first character of parameter name (#3486 by casey)
• Add support for RGB and fixed colors to style() (#3479 by casey)
• Improve style() function (#3478 by casey)
• Add set minimum-version (#3477 by casey)
• Add module aliases (#3472 by casey)

Misc

• Add example to cached recipes readme (#3506 by casey)
• Fix readme heading levels (#3505 by casey)
• Move Friendly Admonitions higher in Cached Recipes section (#3504 by casey)
• Rename test helper functions (#3502 by casey)
• Simplify tests (#3501 by casey)
• Use assert_eval_eq in tests (#3499 by casey)
• Expand readme intro list (#3496 by casey)
• Organize readme into sections (#3495 by casey)
• Rename option tests (#3494 by casey)
• Move option application to switch.apply() (#3491 by casey)
• Document that [arg(help)] may be a list (#3485 by casey)
• Move override processing out of Analyzer (#3481 by casey)
• Add ConstEvalError (#3480 by casey)
• Remove ModuleAlias (#3475 by casey)
• Chain tests (#3476 by casey)
• Remove temptree dependency (#3473 by casey)
• Simplify show tests (#3471 by casey)
• Remove unnecessary tab escapes (#3470 by casey)

... (truncated)

Changelog

Sourced from rust-just's changelog.

1.55.1 - 2026-06-29

Fixed

• Fix panic when empty path is passed to --show and --usage (#3511 by casey)

Misc

• Upgrade sha2 to 0.11.0 (#3512 by casey)
• Remove Test::test_round_trip() (#3509 by casey)
• Remove round-trip testing (#3508 by casey)

1.55.0 - 2026-06-29

Fixed

• Fix forwarded dependency flag value (#3489 by casey)

Changed

• Allow [arg(pattern)] to be a list (#3484 by casey)
• Allow [arg(help)] to be expression (#3483 by casey)
• Allow [arg(pattern)] to be expression (#3482 by casey)

Added

• Add stream gates to style() (#3503 by casey)
• Accept -F for --dotenv-filename (#3498 by casey)
• Add just_version() function (#3497 by casey)
• Add [arg(multiple)] (#3493 by casey)
• Allow combining short options (#3490 by casey)
• Allow variadic parameters to be options (#3488 by casey)
• Default [arg(short)] to first character of parameter name (#3486 by casey)
• Add support for RGB and fixed colors to style() (#3479 by casey)
• Improve style() function (#3478 by casey)
• Add set minimum-version (#3477 by casey)
• Add module aliases (#3472 by casey)

Misc

• Add example to cached recipes readme (#3506 by casey)
• Fix readme heading levels (#3505 by casey)
• Move Friendly Admonitions higher in Cached Recipes section (#3504 by casey)
• Rename test helper functions (#3502 by casey)
• Simplify tests (#3501 by casey)
• Use assert_eval_eq in tests (#3499 by casey)
• Expand readme intro list (#3496 by casey)
• Organize readme into sections (#3495 by casey)
• Rename option tests (#3494 by casey)
• Move option application to switch.apply() (#3491 by casey)
• Document that [arg(help)] may be a list (#3485 by casey)
• Move override processing out of Analyzer (#3481 by casey)
• Add ConstEvalError (#3480 by casey)
• Remove ModuleAlias (#3475 by casey)

... (truncated)

Commits

• cfcd918 Merge pull request #539 from gnpaone/sync-action
• 18b9a05 chore: sync files from source repo
• 8f3f41a Merge pull request #536 from gnpaone/dependabot/npm_and_yarn/npm/rust-just/ty...
• 0fd46b8 npm(deps-dev): bump @​typescript-eslint/parser in /npm/rust-just
• 5112945 Merge pull request #538 from gnpaone/npm-update
• 0150b71 chore: bump npm package version
• 1e265f5 Merge pull request #537 from gnpaone/sync-action
• 7ba86d0 chore: sync files from source repo
• 493ad19 Merge pull request #535 from gnpaone/dependabot/npm_and_yarn/npm/rust-just/ty...
• 33f4d8a npm(deps-dev): bump @​typescript-eslint/eslint-plugin in /npm/rust-just
• Additional commits viewable in compare view

Updates ty from 0.0.35 to 0.0.56

Release notes

Sourced from ty's releases.

0.0.55

Release Notes

Released on 2026-06-26.

LSP server

• Render full diagnostics in color (#26384)

Documentation

• Document colored diagnostic output (#3858)

Performance

• Improve vendored filesystem concurrency (#26408)
• Optimize enum comparisons in equality evaluation (#26340)
• Remove redundant semantic index shrinks (#26392)
• Use never-change durability for one-shot checks (#26359)

Core type checking

• Correct enum alias detection and scalar constructors (#26345)
• Fix structural pattern binding inference (#26411)
• Improve variable-length tuple slicing (#26151)
• Infer class and mapping pattern bindings (#25941)
• Infer empty collection constructors from later uses (#26389)
• Skip shadowed submodule bindings during import analysis (#26385)
• Sync vendored typeshed stubs (#26406). Typeshed diff
• Track literal iterable emptiness for reachability (#25222)
• Validate positional class patterns against __match_args__ (#26195)

Contributors

• @​charliermarsh
• @​carljm
• @​AlexWaygood
• @​MichaReiser
• @​mtshiba
• @​felixscherz

Install ty 0.0.55

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.55/ty-installer.sh | sh

Install prebuilt binaries via powershell script

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.56

Released on 2026-07-01.

Bug fixes

• Avoid MRO cycle when collecting NamedTuple fields (#26464)
• Model int and str enum value normalization (#26349)
• Prefer reflected operators by runtime class (#26434, #26474)

CLI

• Exit with status 130 when interrupted (#26465)

Performance

• Avoid exponential OR-pattern reachability (#26481)
• Reduce bound typevar identity overhead (#26396)

Core type checking

• Infer generic class pattern capture types (#26479)
• Narrow exact tuples through sequence patterns (#26424)
• Recognize inherited enum member constructors (#26410)
• Respect return-context inference when filtering overloads (#26454)
• Sync vendored typeshed stubs (#26501). Typeshed diff

Contributors

• @​charliermarsh
• @​sharkdp

0.0.55

Released on 2026-06-26.

LSP server

• Render full diagnostics in color (#26384)

Documentation

• Document colored diagnostic output (#3858)

Performance

• Improve vendored filesystem concurrency (#26408)
• Optimize enum comparisons in equality evaluation (#26340)
• Remove redundant semantic index shrinks (#26392)
• Use never-change durability for one-shot checks (#26359)

... (truncated)

Commits

• See full diff in compare view

Updates types-pyyaml from 6.0.12.20260510 to 6.0.12.20260518

Commits

• See full diff in compare view

Updates distlib from 0.4.0 to 0.4.3

Changelog

Sourced from distlib's changelog.

0.4.3

Released: 2026-06-12


resources

Removed too-restrictive check for escaping resources.



0.4.2

Released: 2026-06-08

• locators

  • Fix URL percent-encoding using space-padding instead of zero-padding. Thanks to Kadir Can Ozden for the patch.

  • Harden decompression against malicious input. Thanks to tonghuaroot for the patch, which was adapted slightly.

• manifest

  • Use os.lstat in findall to correctly detect symlinked directories. Thanks to Kadir Can Ozden for the patch.

• metadata

  • Improve logic to incorporate newer metadata versions.

• resources

  • Ensure that constructed resource paths don't escape the package. Thanks to tonghuaroot for the patch.

• util

  • Fix #255: Update cache_from_source() for Python 3.15. Thanks to Victor Stinner for the patch.

  • Check during unarchiving that the destination directory isn't escaped via symlinks. Thanks to tonghuaroot for the patch.

  • Improved performance of normalize_name using dual replace. Thanks to Hugo van Kemenade for the patch.

• wheel

... (truncated)

Commits

• 3f4a377 Changes for 0.4.3.
• 5ee19e6 Relax too-strict escaping check for resources.
• f0e3d1a Bump version.
• 06e010d Add upper version limit for setuptools for build, to keep metadata version to...
• 8b5aa55 Added tag 0.4.2 for changeset 5295c0ceb419
• 8183ea6 Update change log.
• 55ca016 Changes for 0.4.2.
• 7e282ab Update metadata logic to incorporate newer versions.
• fa4ea50 Remove non-portable portion of test.
• e06a1d5 Further refine tests.
• Additional commits viewable in compare view

Updates docutils from 0.22.4 to 0.23

Commits

• See full diff in compare view

Updates filelock from 3.29.0 to 3.29.4

Release notes

Sourced from filelock's releases.

3.29.4

What's Changed

• verify inode in break_lock_file before unlinking a stale lock by @​dxbjavid in tox-dev/filelock#561
• keep the read/write heartbeat alive on a transient touch error by @​dxbjavid in tox-dev/filelock#562

Full Changelog: tox-dev/filelock@3.29.3...3.29.4

3.29.3

What's Changed

• 🔧 ci(release): publish to PyPI on tag push by @​gaborbernat in tox-dev/filelock#557
• validate pid range in _parse_lock_holder by @​dxbjavid in tox-dev/filelock#556
• 🐛 fix(ci): restore release environment on tag job by @​gaborbernat in tox-dev/filelock#559
• 🐛 fix(ci): publish from release.yaml on tag push by @​gaborbernat<...

  Description has been truncated