[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

pluggy (dependency) 1.6.0 -> 1.7.0

Risk: 🟢 Safe

The Deep Dive

Update Scope

Lock file maintenance touching only renovate-eval/uv.lock: pluggy 1.6.0 → 1.7.0 (minor). pluggy is a transitive dependency of pytest 9.1.1, which comes in through the dev-only group (pytest-cov>=7.1.0, pyyaml>=6.0.3 in renovate-eval/pyproject.toml). pytest, pytest-cov, pyyaml and every other locked package stay the same. The shipped action runs python3 .github-actions/renovate-eval/renovate_eval.py without uv, so this lock only affects the local/pre-commit test run (uv run pytest tests/ --cov).

Features & UX

• Hookspec argument defaults (#170): hookspecs can now declare default argument values. This is available but only matters to people who write plugins. The repo defines no hookspecs or hookimpls (renovate-eval/tests/conftest.py only has fixtures), so it has no effect here.
• Clearer trace output (#729): hook tracing now quotes ambiguous strings and shows enums and paths with their repr(). You only see this under pytest --debug, which the repo's pre-commit hook does not pass.

Key Fixes

• Python 3.14 forward-reference fix (#629): hooks with forward-reference annotations failed to register on Python 3.14+. The nix dev shell's python3 is 3.14.7, so this fix applies to the interpreter in use. The pytest 9.1.1 plus pytest-cov 7.1.0 suite already passed on 1.6.0, though, so no failure is known to have occurred here.
• Plugin registration and unregistration fixes (#431, #733, #759): these fix partial registration and incomplete unregistration edge cases. The test suite does not register or unregister plugins dynamically.

Newer Versions

1.7.0 is the newest pluggy tag. On main, two regressions introduced in 1.7.0 were reported and fixed after release, but no newer release contains the fixes yet:

• #794: classes marked as hookspecs (e.g. scancode/plugincode) now raise ValueError. Maintainers treat this as unsupported usage. The repo has no hookspecs, so it is not affected.
• #792: hook tracing crashes on Mock(spec=str/dict) arguments or results. The fix was merged in #799. This only triggers when tracing is on (pytest --debug); the repo's pre-commit hook and CI don't enable it.

Hazards & Risks

• Hookspecs without self are now deprecated (#632): such hookspecs now emit DeprecationWarning. The repo defines no hookspecs, and the full suite passes with -W error::DeprecationWarning, so neither pytest 9.1.1 nor pytest-cov 7.1.0 triggers it.
• Hookimpl default precedence changed (#442): a value passed by the caller now beats a default declared on the hookimpl. The repo has no hookimpls (no def pytest_* or hookimpl matches under renovate-eval/).
• Hook discovery switched to inspect.getattr_static (#701): this changes how plugins are scanned. It is not reachable from repo code, and the third-party plugins in use (pytest-cov) passed the full test run.

No hazards were found for this repository.

Sources

• pluggy CHANGELOG (1.7.0 section)
• pluggy 1.7.0 on PyPI
• pluggy issue #794 (class hookspec regression)
• pluggy issue #792 (tracing with specced Mock)
• OSV query for PyPI pluggy
• pluggy GitHub security advisories

---

🟢 Verdict: Safe

This is a dev/test-only transitive pluggy minor bump. Its deprecations and behavior changes only affect custom hookspecs and hookimpls, which this repo doesn't define, and the full renovate-eval suite (504 tests, 96% coverage) passes on pluggy 1.7.0, even with DeprecationWarnings treated as errors.