[pip][dev] (deps-dev): Bump the dev-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the dev-dependencies group with 6 updates in the / directory:

Package	From	To
filelock	4.0.12	4.1.0
platformdirs	4.12.3	4.12.4
pluggy	1.6.0	1.7.0
python-discovery	1.6.1	1.6.2
ruff	0.16.10	0.17.1
virtualenv	21.14.5	21.14.7

Updates filelock from 4.0.12 to 4.1.0

Release notes

Sourced from filelock's releases.

4.1.0

• Import OwnerMode, CompromiseReason and has_fcntl from filelock. #790
• AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. #803
• A Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. #815
• is_lock_held_by_us and is_lock_held_by_us return False for a marker an earlier process with the same PID left behind. #774
• SoftFileLock removes its marker when writing it fails and closing the descriptor fails too, so the lock path no longer stays blocked. #775
• acquire and acquire no longer wait past timeout when poll_interval is longer than the time left. #777
• SoftReadWriteLock ignores a generation-log entry whose name is not 20 ASCII digits, which used to stop its heartbeat thread or delete real generations. #778
• ReadWriteLock, SoftReadWriteLock and their async wrappers treat a inf timeout like -1 and raise ValueError for a blocking nan one. #779
• ReadWriteLock and SoftReadWriteLock accept a timeout above TIMEOUT_MAX instead of raising OverflowError. #780
• acquire raises ValueError for a blocking nan timeout or a poll_interval above TIMEOUT_MAX, and treats a inf timeout like -1. #781
• SoftFileLock and MarkerSoftFileLock treat a marker cut before its final newline as malformed, so a crash-truncated record self-heals and a read mid-write no longer breaks a live lock. #782
• UnixFileLock no longer deletes another process's live marker when it falls back to a soft lock on ENOSYS, and on macOS a lock path ending in a separator raises FileNotFoundError instead of retrying. #785
• SoftFileLock and SoftFileLease put back a live successor's marker that a racing stale break moved aside, so a third contender no longer acquires beside the successor. #786
• StrictSoftFileLock removes every claim a failed acquire published, counts an EEXIST link that landed as published, and no longer reports is_locked after a failed claim cleanup. #787
• On Python 3.10 without the exceptiongroup backport, a release failure under the default context_error_policy no longer turns into ModuleNotFoundError; cleanup failures chain instead of grouping, and on_acquired is allowed. #788
• AsyncReadWriteLock and AsyncSoftReadWriteLock drop a task's hold when a caller cancels it during a release that still completes, instead of blocking every later writer. #789
• SoftFileLease releases a lease dropped while held, at garbage collection or interpreter exit, and raises ValueError for a heartbeat_interval above TIMEOUT_MAX. #791
• StrictSoftFileLock judges an abandoned private record's age by the filesystem's clock, so a client clock ahead of an NFS server no longer aborts live publications. #792
• BaseAsyncFileLock raises RuntimeError instead of CancelledError when its executor shuts down with the call still queued, and a waiter interrupted by anything else no longer wedges later calls. #793
• Constructing or closing a second ReadWriteLock on a held database no longer drops the holder's lock, so other processes stay excluded. #794
• SoftReadWriteLock no longer admits a second writer after <path>.rw is removed under a live instance, and flushes each snapshot before publishing it so a crash cannot leave an empty one that wedges every peer. #795
• SoftFileLease reclaims a dead MarkerSoftFileLock owner, and expires a lease or a malformed soft marker after it stays unchanged on the contender's own monotonic clock, so clock skew cannot break it. #796
• A soft lock marker written in a Linux container records its PID namespace with the hostname, so a sibling container that shares the hostname and volume no longer breaks a live lock. #797
• close> makes an acquire still waiting in another thread raise RuntimeError, where it used to take the lock on the closed instance and hold it until the process exited. #798
• SoftReadWriteLock reads the head from gen/HEAD, so a client whose cached directory listing is

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.2.2 (2026-10-18)

---

• Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

---

4.2.1 (2026-10-17)

---

• On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
• :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
• Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises :class:ValueError instead of running past the acquire timeout. :pr:834
• Fix five bugs in opening the lock file. :class:~filelock.UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); :class:~filelock.ReadWriteLock on Windows waits for its timeout and raises :class:~filelock.Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the :class:~filelock.ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. :pr:835
• Fix :class:~filelock.SoftFileLock, :class:~filelock.MarkerSoftFileLock and :class:~filelock.SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime

... (truncated)

Commits

• 6c0ecc2 Release 4.1.0
• df06bbd 🐛 fix: close regressions since 4.0.12 (#815)
• 0712045 🐛 fix(read-write): refuse a database moved mid-acquire (#808)
• 73fefc1 📝 docs: point canonical and og:url at versioned pages (#813)
• 181b36b 🧪 test(lease): give the age-out test a real-time margin (#814)
• 2c19af4 🐛 fix(api): release thread holds, guard reentry (#810)
• 367b111 🐛 fix(soft-rw): publish the head through gen/HEAD (#799)
• 61582c5 🐛 fix(api): validate lock options up front (#803)
• 20c4b5a 🐛 fix(descriptor): reject poll intervals above TIMEOUT_MAX (#802)
• cf092c7 🧪 test: drop timing races from two runner-load flakes (#809)
• Additional commits viewable in compare view

Updates platformdirs from 4.12.3 to 4.12.4

Release notes

Sourced from platformdirs's releases.

4.12.4

• Keep site directories readable by other users when root calls place_config_file or another place_*_file method with use_site_for_root - by darrenhuai. #610
• Make user_runtime_dir warn and fall back from an unreachable XDG_RUNTIME_DIR under ensure_exists instead of raising. #611

PyPI release

Full Changelog: tox-dev/platformdirs@4.12.3...4.12.4

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.13.4 (2026-10-17)

---

• Require a complete files path segment when locating Android app directories from sys.path. :pr:621
• Keep root directory tests independent of inherited XDG environment variables. :pr:622
• Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. :pr:624
• Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. :pr:625
• Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. :pr:627
• Correct the contributor guide to name ty as the type checker used by the type environment. :pr:623

---

4.13.3 (2026-10-16)

---

---

4.13.2 (2026-10-16)

---

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

---

4.13.1 (2026-10-15)

---

• Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. :pr:618
• Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

---

4.13.0 (2026-10-10)

---

• Detect Homebrew Python for the :class:~platformdirs.macos.MacOS site directories under :option:python:-S, which leaves :data:sys.base_prefix on the Cellar keg, and for the python-freethreading formula - by :user:sricharanreddycheruku. :pr:612
• Use Python 3.15 for development and automation. :pr:613

---

... (truncated)

Commits

• 19338a4 Release 4.12.4
• f2a4fa9 fix: fall back from unreachable runtime directory with ensure_exists (#611)
• 16429e2 🐛 fix(api): keep root's site dir readable in place_*_file (#610)
• b9735d3 ci: download coverage during tool setup (#609)
• 344f249 [pre-commit.ci] pre-commit autoupdate (#608)
• See full diff in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

• [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

• [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

• [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

  A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

• [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

• [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

• [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

• [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

  As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits

• 4c7f636 Preparing release 1.7.0
• 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
• 628959b docs: remove outdated hookimpl default args paragraph
• 2edab5e Merge pull request #752 from bluetech/register-none-allow
• 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
• 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
• 6a7e84e Add changelog fragment for #776
• d22cfb5 Drop tox from the dev dependency group
• 74cbfa2 Relock pytest and tox that dependabot downgraded
• 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
• Additional commits viewable in compare view

Updates python-discovery from 1.6.1 to 1.6.2

Release notes

Sourced from python-discovery's releases.

v1.6.2

Bug fixes - 1.6.2

• Discard malformed interpreter cache entries and query the interpreter again, including entries with missing, non-string or unusable system_executable paths - by darrenhuai. (#141)
• Use the default interpreter query timeout and warn for invalid PY_DISCOVERY_TIMEOUT values. Accept inf or values above the subprocess wait limit to disable the timeout - by darrenhuai. (#143)

PyPI release

Full Changelog: tox-dev/python-discovery@1.6.1...1.6.2

Changelog

Sourced from python-discovery's changelog.

Bug fixes - 1.6.2

• Discard malformed interpreter cache entries and query the interpreter again, including entries with missing, non-string or unusable system_executable paths - by :user:darrenhuai. (:issue:141)
• Use the default interpreter query timeout and warn for invalid PY_DISCOVERY_TIMEOUT values. Accept inf or values above the subprocess wait limit to disable the timeout - by :user:darrenhuai. (:issue:143)

---

v1.6.1 (2026-09-18)

---

Commits

• 4fe2ade release 1.6.2
• 60ddef1 fix(query): validate PY_DISCOVERY_TIMEOUT (#143)
• eb1eab7 fix(cache): discard unusable interpreter cache entries (#141)
• db810b8 feat(python): default to 3.15 and match virtualenv (#142)
• 614afa4 ci: run old Python checks in parallel (#140)
• 9148aa4 [pre-commit.ci] pre-commit autoupdate (#139)
• a69c0d9 👷 ci: pin ubuntu-26.04 and bump dependencies (#138)
• c8fcbf5 build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
• f0b3a20 [pre-commit.ci] pre-commit autoupdate (#136)
• b4eea32 build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
• Additional commits viewable in compare view

Updates ruff from 0.16.10 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates virtualenv from 21.14.5 to 21.14.7

Release notes

Sourced from virtualenv's releases.

21.14.7

Bugfixes - 21.14.7

• Escape the environment name in the bash activator for both of bash's PS1 passes, so a name or --prompt value with a backslash before $(...) or backticks no longer runs as a command each time bash draws the prompt - by gaborbernat. (#3390)

PyPI release

Full Changelog: pypa/virtualenv@21.14.6...21.14.7

21.14.6

Bugfixes - 21.14.6

• Fall back to the bundled seed wheel with periodic update on (the default) when the embed update log holds JSON of the wrong shape, instead of downloading the wheel or, offline, failing to create the environment - by darrenhuai. (#3383)

PyPI release

Full Changelog: pypa/virtualenv@21.14.5...21.14.6

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.7

• Escape the environment name in the bash activator for both of bash's PS1 passes, so a name or --prompt value with a backslash before $(...) or backticks no longer runs as a command each time bash draws the prompt - by :user:gaborbernat. (:issue:3390)

---

v21.14.6 (2026-10-08)

---

Bugfixes - 21.14.6

• Fall back to the bundled seed wheel with periodic update on (the default) when the embed update log holds JSON of the wrong shape, instead of downloading the wheel or, offline, failing to create the environment - by :user:darrenhuai. (:issue:3383)

---

v21.14.5 (2026-10-02)

---

Commits

• a857a78 release 21.14.7
• 4004d88 🔧 build(release): bump pydantic for 3.15 wheels (#3391)
• 212f69f 🧪 test(activation): undo both bash prompt passes on bash < 4.4 (#3392)
• c3104e0 🐛 fix(activation): escape the bash prompt for both PS1 passes (#3390)
• f29efc4 📝 docs(security): add an email reporting contact (#3388)
• c26cc29 🧪 test(util): skip safe_delete permission tests as root (#3389)
• 8b21c36 🔧 chore: enroll in Anthropic OSS Scanner (#3387)
• bf09c7e feat(python): default to Python 3.15 (#3386)
• 3f07792 🧪 test(seed): verify periodic update scheduling (#3384)
• 7614b02 Upgrade embedded pip/setuptools/wheel and CI test tools (#3385)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.