[dependabot]

Bumps the python-minor-and-patch group with 7 updates:

Package	From	To
ruff	0.17.0	0.17.1
distlib	0.4.3	0.4.4
filelock	4.2.1	4.2.4
platformdirs	4.13.0	4.13.5
pluggy	1.6.0	1.7.0
python-discovery	1.6.2	1.6.4
wrapt	2.5.0	2.5.1

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates distlib from 0.4.3 to 0.4.4

Changelog

Sourced from distlib's changelog.

0.4.4

Released: 2026-10-16


compat

Fixed a missing import. Thanks to Andrej730 for the patch.



markers

Fixed #273: Enforce compatible-release bounds in environment markers.
Thanks to Luochenchen for the patch.



metadata

Fix #194: Add an urls property to expose project and home URLs. Thanks to
Sinkleberg for the patch.



scripts


Raise the correct exception when a launcher can't be written. Thanks to
candygoogy for the patch.


Fix #144: Detect shell-script Python executables in ScriptMaker shebangs.
Thanks to Alex Chen for the patch.




util


Improve performance of export entry search to take linear time. Thanks to
Brian Willows for the patch.


Use tarfile.data_filter rather than tarfile.tar_filter in unarchive()
when extraction filters are available, matching the Python 3.14 default. Path and
link containment checks now use os.path.realpath and no longer fail with
IndexError for members such as . or ./. Thanks to Kobain for the patch.


unarchive() now resolves member paths through symlinks seen earlier in the
same archive, so a chain of individually harmless-looking links cannot be used
to write outside the destination on Pythons without extraction filters. Thanks to
Kobain for the patch.




version


Improve NormalizedVersion by addressing correctness and performance gaps
found by comparison with packaging. Thanks to Damian Shaw for the patch.


Improve SemanticVersion by comparing numeric prerelease identifiers,
including those longer than 8 digits. Thanks to Muneeb Sheikh for the
patch.

Commits

• 25eed06 Changes for 0.4.4.
• 8ffee6f Resolve member paths through earlier archive symlinks in unarchive()
• ef4a390 Test that data_filter rejects absolute symlinks with check=False
• 380b6a9 Use data_filter and realpath containment checks in unarchive()
• 7b7c572 fix: enforce compatible-release bounds in markers (#274)
• 38811dd Detect shell-script Python executables in ScriptMaker shebangs (#144) (#264)
• 06ddb5d Compare numeric prerelease identifiers without a digit limit (#270)
• e54dd8c Raise the original error when a launcher can't be written (#269)
• c6270e3 Fix NormalizedVersion gaps found by comparison with packaging (#271)
• 5b3092b Search export entries in linear time (#266)
• Additional commits viewable in compare view

Updates filelock from 4.2.1 to 4.2.4

Release notes

Sourced from filelock's releases.

4.2.4

• Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. #863

PyPI release

Full Changelog: tox-dev/filelock@4.2.3...4.2.4

4.2.3

• Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. #860
• Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

PyPI release

Full Changelog: tox-dev/filelock@4.2.2...4.2.3

4.2.2

• Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises FileNotFoundError, and it now leaves the lock's hold count unchanged. #856

PyPI release

Full Changelog: tox-dev/filelock@4.2.1...4.2.2

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.2.4 (2026-10-19)

---

• Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. :pr:863

---

4.2.3 (2026-10-19)

---

• Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:860
• Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

---

4.2.2 (2026-10-18)

---

• Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

---

4.2.1 (2026-10-17)

---

• On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
• :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
• Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database

... (truncated)

Commits

• 22f0776 Release 4.2.4
• 9d278ed Document GitHub Release note cleanup (#863)
• 3c33798 🐛 fix(release): trim GitHub release notes (#862)
• e737924 Release 4.2.3
• 84dc80c 👷 ci: collect required checks (#857)
• cb8b57e fix(api): guard lazy import exit hook (#861)
• dd341ac Handle NetBSD EFTYPE for replaced soft-RW protocol directories (#859)
• db47f34 Release 4.2.2
• caaff8a fix(api): keep the hold count when the lock path cannot be resolved (#856)
• See full diff in compare view

Updates platformdirs from 4.13.0 to 4.13.5

Release notes

Sourced from platformdirs's releases.

4.13.5

• Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. #631

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.4...4.13.5

4.13.4

• Require a complete files path segment when locating Android app directories from sys.path. #621
• Keep root directory tests independent of inherited XDG environment variables. #622
• Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. #624
• Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. #625
• Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. #627
• Correct the contributor guide to name ty as the type checker used by the type environment. #623

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.3...4.13.4

4.13.3

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.2...4.13.3

4.13.2

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. #619

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.1...4.13.2

4.13.1

• Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. #618
• Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.0...4.13.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.13.5 (2026-10-19)

---

• Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. :pr:631

---

4.13.4 (2026-10-17)

---

• Require a complete files path segment when locating Android app directories from sys.path. :pr:621
• Keep root directory tests independent of inherited XDG environment variables. :pr:622
• Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. :pr:624
• Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. :pr:625
• Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. :pr:627
• Correct the contributor guide to name ty as the type checker used by the type environment. :pr:623

---

4.13.3 (2026-10-16)

---

---

4.13.2 (2026-10-16)

---

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

---

4.13.1 (2026-10-15)

---

• Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. :pr:618
• Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

---

4.13.0 (2026-10-10)

---

... (truncated)

Commits

• 5702904 Release 4.13.5
• 4b2b6a5 🐛 fix(release): trim GitHub release notes (#631)
• 6f7e3e2 👷 ci: collect required checks (#628)
• caa5626 Release 4.13.4
• 9b5c0fd fix(windows): raise when no home directory resolves (#627)
• da72995 fix: require a complete files segment when finding Android app folders (#621)
• da89726 test: isolate root directory checks from inherited XDG settings (#622)
• fb0b1a9 fix: keep root directory accessors consistent during isolation (#625)
• 91f7775 fix(ios): raise when no home directory resolves (#624)
• ed9f25f ci: rerun news check on label changes (#626)
• Additional commits viewable in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

• [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

• [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

• [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

  A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

• [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

• [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

• [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

• [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

  As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits

• 4c7f636 Preparing release 1.7.0
• 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
• 628959b docs: remove outdated hookimpl default args paragraph
• 2edab5e Merge pull request #752 from bluetech/register-none-allow
• 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
• 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
• 6a7e84e Add changelog fragment for #776
• d22cfb5 Drop tox from the dev dependency group
• 74cbfa2 Relock pytest and tox that dependabot downgraded
• 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
• Additional commits viewable in compare view

Updates python-discovery from 1.6.2 to 1.6.4

Release notes

Sourced from python-discovery's releases.

v1.6.4

Improved documentation - 1.6.4

• Clarify the executable paths accepted by try_first_with in the standalone usage example. (#150)

PyPI release

Full Changelog: tox-dev/python-discovery@1.6.3...1.6.4

1.6.3

Bug fixes - 1.6.3

• Treat specs with dot-only version components, such as python., as literal executable paths instead of raising IndexError - by harbinresearcher. (#147)
• Pass PEP 514 ExecutableArguments to registered Windows interpreters when querying them, so a registration that points at a launcher such as py.exe -3.11 reports the interpreter it selects - by blouirts123. (#148)

PyPI release

Full Changelog: tox-dev/python-discovery@1.6.2...1.6.3

Changelog

Sourced from python-discovery's changelog.

Improved documentation - 1.6.4

• Clarify the executable paths accepted by try_first_with in the standalone usage example. (:issue:150)

---

v1.6.3 (2026-10-16)

---

Bug fixes - 1.6.3

• Treat specs with dot-only version components, such as python., as literal executable paths instead of raising IndexError - by :user:harbinresearcher. (:issue:147)
• Pass PEP 514 ExecutableArguments to registered Windows interpreters when querying them, so a registration that points at a launcher such as py.exe -3.11 reports the interpreter it selects - by :user:blouirts123. (:issue:148)

---

v1.6.2 (2026-10-10)

---

Commits

• 885805a release 1.6.4
• 1a6b5cd fix(release): trim GitHub notes (#154)
• ac862a4 👷 ci: publish release after PyPI (#153)
• 4d53c08 build(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the github-acti...
• 1701972 👷 ci(release): require changelog entries (#151)
• 9f051ac docs: use an executable path in the try_first_with example (#150)
• 3b72b55 test: move argument tests into existing file (#149)
• cbb2abd fix: honor PEP 514 executable arguments during discovery (#148)
• ab2abc8 fix(spec): handle dot-only version components (#147)
• 1c9af8e build(deps): bump the github-actions group with 2 updates (#145)
• Additional commits viewable in compare view

Updates wrapt from 2.5.0 to 2.5.1

Release notes

Sourced from wrapt's releases.

wrapt 2.5.1

Full release notes: https://wrapt.readthedocs.io/en/latest/changes.html#version-2-5-1

Install from PyPi (recommended):

pip install wrapt==2.5.1

PyPi uploads follow each GitHub release; if pip reports the version is unavailable, the matching PyPi upload may not have happened yet.

Pre-built wheels are provided for a range of Python versions and platforms (Linux x86_64/aarch64/riscv64, macOS x86_64 and arm64, Windows x86_64 and arm64, plus PyPy and free-threaded builds). The source distribution is also attached together with SHA256SUMS for verification.

wrapt 2.5.1rc1

Release candidate. Release notes for the upcoming 2.5.1 final (work in progress): https://wrapt.readthedocs.io/en/latest/changes.html#version-2-5-1

May be installable from PyPi:

pip install wrapt==2.5.1rc1

If pip reports the version is unavailable, this candidate either has not been uploaded yet or is not being published to PyPi. Use the attached wheels or build from the source distribution instead:

tar xf wrapt-2.5.1rc1.tar.gz
cd wrapt-2.5.1rc1
pip install .

SHA256SUMS is attached for verification of the archives.

wrapt 2.5.1.dev1

Development snapshot. Not normally published to PyPi (occasionally uploaded to exercise the release pipeline).

Release notes for the upcoming 2.5.1 final (work in progress): https://wrapt.readthedocs.io/en/latest/changes.html#version-2-5-1

Platform wheels and the source distribution are attached. To test against your Python install, either grab a matching wheel or build from the source distribution:

pip install wrapt-2.5.1.dev1-<python>-<abi>-<platform>.whl

or

... (truncated)

Changelog

Sourced from wrapt's changelog.

Version 2.5.1

Bugs Fixed

• A LazyObjectProxy created with an interface argument that declared a path-like type, such as os.PathLike or pathlib.Path, did not define the __fspath__() special method on the class it generated. Because os.fspath() looks up __fspath__() on the type of the object, passing such a proxy to os.fspath(), the builtin open() or other standard library functions accepting paths raised TypeError before the factory callable had been invoked to create the wrapped object. The __fspath__() special method is now added when the declared interface provides it, in the same way as is already done for the other special methods looked up on the type, so the first path conversion triggers creation of the wrapped object and succeeds. With thanks to Muneeb Sheikh for pull request [#360](https://github.com/GrahamDumpleton/wrapt/issues/360) <https://github.com/GrahamDumpleton/wrapt/pull/360>_.

• A callback passed to wrapt.WeakFunctionProxy which was callable but evaluated as false, such as an event emitter object which reports its number of subscribers via __len__() and is empty when first created, was passed the underlying weak reference object instead of the proxy when the wrapped function expired. Where the wrapped function was a bound method, such a callback could also be called twice, once each when the instance and the function expired. Only None is now treated as meaning no callback was supplied, which mirrors the behaviour of weakref.ref() and weakref.proxy() in the standard library, so these callbacks now receive the proxy and are called only once, as for any other callback. With thanks to Huanyi Xie for pull request [#359](https://github.com/GrahamDumpleton/wrapt/issues/359) <https://github.com/GrahamDumpleton/wrapt/pull/359>_.

• A wrapt.AdapterFactory instance passed as the adapter argument to wrapt.decorator was ignored, and so never called, if the instance evaluated as false, such as when the factory class defined __bool__() or __len__(). The decorated function then retained its original signature instead of that produced by the factory. Whether an adapter factory was supplied is now determined by type before the truth value of the adapter is considered, so such factories are always called. As a consequence of this change a factory can now also return None, or any other false value, to indicate that no adapter should be used for a particular function, where previously this failed with an obscure error. With thanks to Luochenchen for pull request [#358](https://github.com/GrahamDumpleton/wrapt/issues/358) <https://github.com/GrahamDumpleton/wrapt/pull/358>_ which identified the issue.

Commits

• dbbb21f Merge branch 'release/2.5.1'
• 95e2afb Drop the release candidate suffix for the 2.5.1 release.
• 1ed68ca Update to 2.5.1rc1.
• 77e826d Recognise adapter factories by type so one which evaluates as false is not ig...
• 13efe63 Move change note for PR #359 under 2.5.1 and add clarifying comments.
• 6ba6048 Reorder fspath handling in lazy proxy and add change note for PR #360.
• 5e97e2d Update to 2.5.1.dev1.
• e9d491c Merge pull request #359 from xiehuanyi/fix-falsey-weak-proxy-callbacks
• 0d6c935 Merge pull request #360 from muneikh/fix-lazy-pathlike-interface
• de574aa Honor the declared pathlike interface in lazy proxies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions