Bump tox from 4.53.0 to 4.58.0

[dependabot]

Bumps tox from 4.53.0 to 4.58.0.

Release notes

Sourced from tox's releases.

v4.58.0

What's Changed

• 👷 ci: run the test matrix against Python 3.15 by @​gaborbernat in tox-dev/tox#4001

Full Changelog: tox-dev/tox@4.57.2...4.58.0

v4.57.2

What's Changed

• 🐛 fix(session): fix package env failure cascade and state corruption by @​gaborbernat in tox-dev/tox#3991
• 🐛 fix(pkg): repair editable fallback and sdist-wheel root handling by @​gaborbernat in tox-dev/tox#3992
• 🐛 fix(pylock): install exactly what the lock file specifies by @​gaborbernat in tox-dev/tox#3994
• 🐛 fix(cache): self-heal wrong-shape tox-info content by @​gaborbernat in tox-dev/tox#3996
• 🐛 fix(config): rebuild loader chains per config set by @​gaborbernat in tox-dev/tox#3993
• 🐛 fix(pip): stable rendering of set options in install cache by @​gaborbernat in tox-dev/tox#3995
• 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks by @​gaborbernat in tox-dev/tox#3997
• 🐛 fix(run): honor the fail-fast contract, resilient teardown by @​gaborbernat in tox-dev/tox#3999
• 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin by @​gaborbernat in tox-dev/tox#3998
• 🐛 fix(ux): four run-edge polish fixes by @​gaborbernat in tox-dev/tox#4000

Full Changelog: tox-dev/tox@4.57.1...4.57.2

v4.57.1

What's Changed

• Run sequentially for run-parallel -p 0 instead of at CPU count by @​chuenchen309 in tox-dev/tox#3989
• Do not let a lone quote in a set_env value swallow the marker by @​chuenchen309 in tox-dev/tox#3988

Full Changelog: tox-dev/tox@4.57.0...4.57.1

v4.57.0

What's Changed

• 💰 Surface the org itself in the FUNDING config by @​webknjaz in tox-dev/tox#3979
• Replace prettier with mdformat and yamlfmt by @​gaborbernat in tox-dev/tox#3984
• 📦 build: use test dependency group in internal envs by @​gaborbernat in tox-dev/tox#3985
• ✨ feat(python): match free-threaded and debug interpreter builds by @​chuenchen309 in tox-dev/tox#3986

New Contributors

• @​chuenchen309 made their first contribution in tox-dev/tox#3986

Full Changelog: tox-dev/tox@4.56.4...4.57.0

... (truncated)

Changelog

Sourced from tox's changelog.

Miscellaneous internal changes - 4.58.0

• Test against Python 3.15 (beta) in CI and declare its classifier - by :user:gaborbernat. (:issue:4001)

---

v4.57.2 (2026-07-21)

---

Bug fixes - 4.57.2

• Fix package environment creation failures being misreported:

  • discard the partially registered configuration on failure, so the real error surfaces instead of a spurious duplicate configuration definition;
  • report the first creation failure in definition order, not a hash-random one;
  • build the PEP 517 frontend lazily, so tox c and tox l work when pyproject.toml cannot be read. (:issue:3987)

• Fix state corruption in the environment creation machinery:

  • a failed run environment build no longer removes shared package environments other run environments still use;
  • a run environment registers with its package environment once, not twice with triple-counted usage;
  • circular depends reports the cycle as an error instead of a raw traceback;
  • Skip raised by a plugin for a package environment marks the run environment package-skipped instead of crashing with UnboundLocalError. (:issue:3991)

• Fix two packaging regressions:

  • package = editable on a build backend without PEP-660 support now falls back to editable-legacy with a warning instead of crashing, also when the project metadata is static;
  • editable and wheel environments running after an sdist-wheel environment build from the project sources again, instead of a stale temporary copy that made source edits invisible. (:issue:3992)

• An environment serving as both a run environment and a package environment now behaves predictably:

  • one defined through a [testenv:...]-style section and referenced by package_env inherits from pkgenv/env_pkg_base as documented, instead of silently keeping run environment defaults;
  • one listed in env_list while referenced as a package environment is reported as a configuration conflict up front, instead of failing late with cannot run packaging environment or silently disappearing from tox l. (:issue:3993)

• pylock.toml installs now match the lock file:

  • a package locked once per Python range installs only the version matching the environment's interpreter;
  • packages locked to a local directory, VCS repository, or archive install from that source instead of resolving the name against the package index;
  • locked hashes are verified when every entry carries one;
  • changing a pip environment variable such as PIP_INDEX_URL reinstalls, as it already did for deps.

... (truncated)

Commits

• 69e1bdc release 4.58.0
• ea8734e 👷 ci: run the test matrix against Python 3.15 (#4001)
• 2d8d5ae release 4.57.2
• b74d78b 🐛 fix(ux): four run-edge polish fixes (#4000)
• 09dad3d 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin (#3...
• fa6ec2b 🐛 fix(run): honor the fail-fast contract, resilient teardown (#3999)
• b1b0159 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks (#3997)
• a111ec6 🐛 fix(pip): stable rendering of set options in install cache (#3995)
• e969723 🐛 fix(config): rebuild loader chains per config set (#3993)
• 6a9b6a5 🐛 fix(cache): self-heal wrong-shape tox-info content (#3996)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)