Skip to content

Bump the production-dependencies group with 6 updates - #2039

Merged
tomodwyer merged 1 commit into
mainfrom
dependabot/pip/production-dependencies-a3a6e643cc
Aug 17, 2026
Merged

Bump the production-dependencies group with 6 updates#2039
tomodwyer merged 1 commit into
mainfrom
dependabot/pip/production-dependencies-a3a6e643cc

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 6 updates:

PackageFromTo
packaging24.226.3
platformdirs4.3.64.11.1
pyyaml6.0.26.0.3
virtualenv21.7.121.7.3
pip26.226.2.1
setuptools83.0.084.0.0

Updates packaging from 24.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
Behavior adaptations:
  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
Fixes for versions and specifiers:
  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
  • Raise InvalidVersion for non-string pre-release letters passed to
    Version.from_parts. (:pull:1241)
  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
Fixes for requirements and markers:
  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates platformdirs from 4.3.6 to 4.11.1

Release notes

Sourced from platformdirs's releases.

4.11.1

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.11.0...4.11.1

4.11.0

What's Changed

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

4.10.1

What's Changed

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

4.10.0

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.9.6...4.10.0

4.9.6

What's Changed

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.3 (2026-08-13)

  • python -m platformdirs now lists :func:~platformdirs.user_desktop_dir, which was missing from the properties it prints. :pr:523
  • Stop :func:~platformdirs.site_data_dir, :func:~platformdirs.site_config_dir and :func:~platformdirs.site_applications_dir raising IndexError on Unix and macOS when $XDG_DATA_DIRS or $XDG_CONFIG_DIRS holds only separators and whitespace, such as ":". These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:523

4.11.2 (2026-08-10)

  • Stop :meth:~platformdirs.PlatformDirs.iter_cache_dirs, :meth:~platformdirs.PlatformDirs.iter_state_dirs, :meth:~platformdirs.PlatformDirs.iter_log_dirs and :meth:~platformdirs.PlatformDirs.iter_runtime_dirs yielding the same directory twice on Unix when use_site_for_root is active - :pr:469 fixed this for the config and data iterators only. On macOS, :meth:~platformdirs.PlatformDirs.iter_cache_dirs now yields the Homebrew and /Library/Caches entries separately rather than one os.pathsep-joined string when multipath is set. :pr:520

4.11.1 (2026-08-07)

  • Fix :func:~platformdirs.user_desktop_dir on Windows builds without ctypes. CSIDL_DESKTOPDIRECTORY appeared only in the ctypes lookup table, so the registry and environment variable resolvers raised ValueError for it. :pr:519

4.11.0 (2026-07-21)

  • Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

4.10.1 (2026-07-18)

  • Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built

... (truncated)

Commits
  • a9f2ba9 Release 4.11.1
  • 30a9549 Let the non-ctypes resolvers find the desktop folder (#519)
  • cc97359 build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the al...
  • 328e15d [pre-commit.ci] pre-commit autoupdate (#517)
  • 76fd346 build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 in the all group (#516)
  • 13a531d [pre-commit.ci] pre-commit autoupdate (#515)
  • 070777b build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 in the al...
  • 5d09cb0 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the all group (#513)
  • 2140495 Release 4.11.0
  • a562df9 👷 ci: run the test suite against Python 3.15 (#512)
  • Additional commits viewable in compare view

Updates pyyaml from 6.0.2 to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

  • Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

  • yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)
Commits

Updates virtualenv from 21.7.1 to 21.7.3

Release notes

Sourced from virtualenv's releases.

21.7.3

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@21.7.2...21.7.3

21.7.2

What's Changed

Full Changelog: pypa/virtualenv@21.7.1...21.7.2

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.3

  • ListType.split_values now returns a list you can iterate more than once, and accepts bytes input instead of raising TypeError - by :user:darrenhuai. (:issue:3207)

v21.7.2 (2026-08-07)

Bugfixes - 21.7.2

  • Upgrade embedded wheels:

    • pip to 26.2.1 from 26.2 (:issue:3206)

v21.7.1 (2026-07-30)

Commits

Updates pip from 26.2 to 26.2.1

Changelog

Sourced from pip's changelog.

26.2.1 (2026-08-04)

Bug Fixes

  • Reallow keyring installed in a (non-activated) virtual environment to be be used via the import provider method while installing build dependencies. ([#14227](https://github.com/pypa/pip/issues/14227) <https://github.com/pypa/pip/issues/14227>_)
Commits

Updates setuptools from 83.0.0 to 84.0.0

Changelog

Sourced from setuptools's changelog.

v84.0.0

Features

  • Newline-separated keywords and platformspypa/setuptools#4887old specification <https://peps.python.org/pep-0345/>_ separated items with spaces and the current one uses commas. (#4887)
  • Extensionpypa/distutils#373#5022)
  • The C compiler modules now emit log messages through their own compilers.C.* loggers instead of the distutils root logger, part of decoupling the compilers package from distutils. The logger names are normalized to a stable compilers.C.* prefix so they remain constant as the package migrates toward a standalone compilers.C distribution. (#5266)
  • The C compilers gained a Compiler.call method -- a thin wrapper over subprocess.check_call (with macOS deployment-target env injection) that is the modern replacement for Compiler.spawn. The compilers no longer depend on distutils.spawn, distutils.dir_util, distutils.file_util, distutils._modified, or distutils.util.execute/split_quoted: the generic newer/newer_group and split_quoted helpers are vendored into the compilers package, and Compiler.mkpath/move_file/execute are implemented directly on the standard library (os.makedirs/shutil.move). The methods are retained for backward compatibility. (#5267)
  • The compilers no longer depend on distutils.util, distutils.version, distutils.compat, or distutils._macos_compat. The platform-identification helpers (get_platform/get_host_platform/is_mingw) now live in distutils.compilers.platform.detect and the macOS deployment-target logic and compiler_fixup in distutils.compilers.platform.macos; CygwinCCompiler.gcc_version returns a packaging.version.Version. distutils.util re-exports the platform/macOS helpers from their new homes for backward compatibility rather than keeping duplicate copies. (sysconfig lookups still route through distutils pending its own decoupling.) (#5268)
  • The compilers now read their build configuration from the standard library's sysconfig instead of distutils.sysconfig. Per-compiler customization -- previously distutils.sysconfig.customize_compiler -- has moved into Compiler.configure_system(): a no-op on the base class, with UnixCCompiler applying the compiler/flag/archiver settings CPython recorded in sysconfig (and the usual CC/CFLAGS/LDSHARED/… environment overrides). distutils.sysconfig.customize_compiler is retained as a thin wrapper that calls compiler.configure_system(). (#5269)

Bugfixes

  • The MSVC linker now passes its arguments through a response file when the command line would exceed the Windows maximum length, fixing failures when linking a large number of objects. (#4177)
  • The Cygwin and MinGW compilers now pass -O1 instead of a bare -O. The two are equivalent to GCC, but cc1 rejected the bare form when building 32-bit extensions with -m32. -- by :user:dchaudhari7177 (#4873)
  • copy_filepypa/distutils#379#5079)
  • Setuptools wheels no longer bundled the project's own test modules. -- by :user:itscloud0 (#5212)
  • build_ext no longer fails when cross-compiling with a compiler other than MSVC (such as MinGW). Compiler now provides a no-op initialize()pypa/distutils#399

Improved Documentation

  • Clarified what "correspond exactly to the directory structure" means in the packages section of the Package Discovery user guide. (#4109)
  • Documented how bdist_wheel's py_limited_api option controls abi3 wheel tagging for extension modules -- by :user:Himanshuagrawal4 (#4741)

Deprecations and Removals

  • Compiler.spawn is deprecated in favor of the new Compiler.call. call raises native subprocess exceptions; spawn remains as a shim that emits a DeprecationWarning and translates them to DistutilsExecError. The MSVC spawn compatibility shim for third-party monkeypatches predating the env argument (numpy.distutils before 1.19, per pypa/distutils#15) has been removed. distutils.spawn.spawn is likewise reduced to a thin wrapper around subprocess.check_call: it no longer resolves cmd[0] via shutil.which (subprocess searches PATH itself) nor injects MACOSX_DEPLOYMENT_TARGET (that now lives with the compilers, the only callers to which it applied). (#5267)
  • Building an extension with a MACOSX_DEPLOYMENT_TARGET lower than the interpreter's configured value now raises compilers.errors.PlatformError instead of distutils.errors.DistutilsPlatformError (the macOS deployment-target check moved into the compilers package). CygwinCCompiler.gcc_version returns a packaging.version.Version rather than the removed distutils.version.LooseVersion. Completing the transition begun in pypa/distutils#246, UnixCCompiler.runtime_library_dir_option now returns the ["-Wl,--enable-new-dtags", "-Wl,-rpath,<dir>"] list directly for GNU ld rather than collapsing it into a single string, and the temporary distutils.compat.consolidate_linker_args shim has been removed. (#5268)
  • The compilers now define their own exception vocabulary instead of borrowing distutils' framework errors. Language-agnostic exceptions (Error, UnknownFileType, and a new PlatformError) live at distutils.compilers.errors, leaving room for future compilers.<language> siblings; the C/C++-specific CompileError/LinkError/LibError/PreprocessError remain in distutils.compilers.C.errors. The compilers now raise compilers.errors.PlatformError where they previously raised distutils.errors.DistutilsPlatformError/DistutilsModuleError, and compilers._modified.newer raises the stdlib FileNotFoundError. distutils.errors keeps its own framework exceptions and re-exports the compiler ones (CCompilerError, CompileError, etc.) for backward compatibility; because CCompilerError is compilers.errors.Error, code catching it (as distutils' top-level handlers do) still catches the new PlatformError. (#5270)
  • customize_compiler now asserts that the compiler-related config variables (CC, CXX, CFLAGS, etc.) resolve to strings, raising AssertionError if any are unexpectedly Nonepypa/distutils#363
Commits
  • 72e919a Merge pull request #5293 from pypa/bugfix/integration-pip-flit-backend
  • 1b29701 Select the top-level pyproject.toml when reading build requirements
  • bb1b381 Bump version: 83.0.0 → 84.0.0
  • ee6fdd7 Sync with distutils @ e8eb87855 (#5292)
  • 2a4a9e4 Merge remote-tracking branch 'origin/main' into distutils-e8eb87855
  • cbd1195 Merge https://github.com/jaraco/skeleton
  • bd3594e Merge pull request #5287 from Avasam/Configuring-lint.flake8-comprehensions.a...
  • f02e90a Configure C408 to allow dict(a=1) rather than disabling it
  • c55f52b Configuring lint.flake8-comprehensions.allow-dict-calls-with-keyword-argument...
  • e9904b0 Match the distutils sdist base type for the user_options override
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the production-dependencies group with 6 updates
6e64b69
Bumps the production-dependencies group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [packaging](https://github.com/pypa/packaging) | `24.2` | `26.3` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.3.6` | `4.11.1` |
| [pyyaml](https://github.com/yaml/pyyaml) | `6.0.2` | `6.0.3` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.7.1` | `21.7.3` |
| [pip](https://github.com/pypa/pip) | `26.2` | `26.2.1` |
| [setuptools](https://github.com/pypa/setuptools) | `83.0.0` | `84.0.0` |
Updates `packaging` from 24.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@24.2...26.3)
Updates `platformdirs` from 4.3.6 to 4.11.1
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.3.6...4.11.1)
Updates `pyyaml` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0.2...6.0.3)
Updates `virtualenv` from 21.7.1 to 21.7.3
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.7.1...21.7.3)
Updates `pip` from 26.2 to 26.2.1
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@26.2...26.2.1)
Updates `setuptools` from 83.0.0 to 84.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v83.0.0...v84.0.0)
---
updated-dependencies:
- dependency-name: packaging
dependency-version: '26.3'
dependency-type: indirect
update-type: version-update:semver-major
dependency-group: production-dependencies
- dependency-name: platformdirs
dependency-version: 4.11.1
dependency-type: indirect
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: pyyaml
dependency-version: 6.0.3
dependency-type: indirect
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: virtualenv
dependency-version: 21.7.3
dependency-type: indirect
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: pip
dependency-version: 26.2.1
dependency-type: indirect
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: setuptools
dependency-version: 84.0.0
dependency-type: indirect
update-type: version-update:semver-major
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 17, 2026
@tomodwyer
tomodwyer merged commit e1ef24d into mainAug 17, 2026
1 check passed
@tomodwyer
tomodwyer deleted the dependabot/pip/production-dependencies-a3a6e643cc branch August 17, 2026 09:35
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tomodwyertomodwyertomodwyer approved these changes

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tomodwyer