You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.
Fix: a one-line class or function body immediately followed by another
statement (such as class Foo: ... on its own line) was incorrectly
reported as a missing branch when using the sys.monitoring core. This is now
fixed, closing issue 2167_ and issue 2337_.
Fix: the HTML report only rewrites a file's page when the file or its data
has changed, but each page also links to the previous and next files. When
the set of reported files changed, unchanged pages kept their old links. For
example, with skip_covered, a file that became 100% covered had its page
deleted, but the pages next to it still linked to it. Now a page is also
rewritten when its neighbors change.
Fix: --fail-under now uses at least the decimal precision of the
threshold for both the comparison and failure message. With precision=0,
a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5
with the message "total of 0.4 is less than fail-under=0.5". Previously, the
comparison rounded the total to zero and the message could claim "1 is less
than 0". Closes issue 2295_.
Fix: the HTML report escaped file names twice, so a name with &, <,
or quotes in it was shown with entities like &. Now they are properly
escaped only once.
Fix: --source=/ measured no files. A file system root can't be a source
directory, so now it is an error. Closes issue 2291_.
In an abundance of caution, prevent forged SQLite journal files from deleting
files they shouldn't.
Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (#905) by @boyfeiyu.
A docs section on which return annotations count as generators or iterators
Changed
Generator, Iterator, and Iterable return annotations are now recognized by
the last name in the annotation's AST instead of by matching the annotation
text, so qualified names such as typing.Generator[...], collections.abc.Iterator[...], and t.Iterable[...] are recognized too
(#317)
Iterator and Iterable annotations are matched by exact name instead of by
prefix, so names like IterableDataset are no longer treated as iterators
Union annotations, such as Iterator[int] | None or Iterator[int] | list[int], are no longer recognized as iterator or
generator annotations
Imports are not resolved: np.random.Generator is treated like typing.Generator, and renamed imports such as from typing import Iterator as It are still not recognized
An empty --exclude pattern (such as --exclude='' or exclude = '' in
the config file) excluded every file, so nothing was checked and the run
passed. Now an empty pattern means "don't exclude any files", so every file
gets checked (#311)
Changed
An --exclude value that isn't a valid regular expression is now rejected
with a clear error message instead of a traceback
A new config option --include-stub-files (shortform: -isf, default: False), so that scanning a folder also checks stub (.pyi) files (#303)
Fixed
False-positive DOC403 and DOC502 violations in stub (.pyi) files,
whose function bodies are placeholders, in both the native mode and flake8 (#303). DOC403 is still reported in stub files when the return
annotation isn't a Generator/Iterator/Iterable (or is missing), because
then the function can't yield anything
False-positive DOC105 and DOC605 violations in stub files when --check-arg-defaults is True: an argument or class attribute whose
default is the ... placeholder can now be documented with any default
value or none
False-positive DOC201 violations for abstract methods and stub functions
annotated with Iterator[...] or Iterable[...] whose docstrings have a
"Yields" section (and no "return" statements in the body). Their bodies are
placeholders, so the "Yields" section is what shows that they yield, and
they don't need a "Returns" section
False-positive DOC203 violations for abstract methods and stub functions
annotated with Generator[YieldType, SendType, ReturnType] whose "Returns"
section documents ReturnType, as for a generator that both yields and
returns
False-positive DOC202 violations for abstract methods and stub functions
that have a "Returns" section but no return annotation. (DOC203 still
reports the missing annotation when return types are checked.)
A crash (IndexError) when --check-arg-defaults is True and
positional-only arguments (the ones before /) have default values. When
it didn't crash, the defaults of positional-only arguments were ignored
pipx run now treats requirements with a version, extras, a marker or a direct URL as packages, and script URLs as downloads, even when the working directory contains a matching file (#2408) by @gaborbernat.
Error, warning, and help messages now state what pipx found and what to run next, without hedges such as "already seems to be installed" or "Perhaps". Update scripts that match the old message text (#2376) by @gaborbernat.
Bug fixes
A pipx that changed its own environment, through pipx upgrade pipx or pipx reinstall pipx for example, no longer crashes with an ImportError when another pipx command empties the trash while it is still running, such as during the rest of pipx upgrade-all. The copy of its environment it imports from now stays in the trash until the process exits (#2397) by @gaborbernat.
Interrupting a parallel pipx reinstall-all with Ctrl-C now gives a restored environment back the shared app, man page or completion links another environment took while the rebuild had it in the trash, as a failed rebuild already did (#2386) by @gaborbernat.
On Windows under the uv backend, pipx run --refresh or --no-cache of a local script no longer deletes the cached environment while another run of the same script is still executing in it, and neither does the expiry sweep. Such a run builds a throwaway environment for itself instead, and after --refresh the next run to find the cached one idle rebuilds it (#2387) by @gaborbernat.
On Windows under the uv backend, pipx upgrade pipx on a pipx that manages itself no longer fails with Access is denied and rolls back. uv deletes the files it replaces, which Windows refuses for the running pipx.exe, so pipx now moves that launcher to its trash first, where the next pipx command deletes it (#2396) by @gaborbernat.
Where pipx copies launchers instead of linking them, as on Windows without symlink rights, pipx reinstall and pipx install --force no longer warn Overwriting file for the package's own launcher. Windows .exe launchers embed their build time, so a rebuilt one never matched its old copy byte for byte and every reinstall warned. pipx now recognises its own copy by the interpreter it names and replaces it without a warning; a file another venv or the user put there still gets one (#2394) by @gaborbernat.
With the uv backend and UV_LINK_MODE=symlink, pipx uninstall now removes the man page and shell completion links it exposed, and pipx list no longer reports those man pages as missing. uv makes the environment's own copies symlinks into its cache, and pipx followed them there instead of stopping at the environment (#2380) by @gaborbernat.
--fetch-python and pipx interpreter upgrade now download and unpack the standalone Python build next to the interpreter directory instead of in the system temp dir, so a tmpfs /tmp or a /tmp on another btrfs subvolume no longer forces a full copy of the build into the pipx home or splits its hard links into separate files (#2403) by @gaborbernat.
pipx inject pipx without --include-apps and pipx runpip pipx on a pipx that manages itself no longer mix old and new pipx code when they change the pipx package. Like pipx upgrade pipx, they now load late imports from a copy of the environment, which the next pipx command deletes from the trash (#2393) by @gaborbernat.
pipx list --json no longer exports the interpreter a self-managed pipx recorded when that path no longer leads to the interpreter its environment runs on, such as a removed bootstrap environment's python3. pipx install-all then builds that environment on the default interpreter instead of whatever appears at the old path (#2389) by @gaborbernat.
pipx reinstall pipx on a pipx that manages itself no longer crashes with an ImportError when it installs a different pipx version. Modules the running pipx imported late came from the version it was installing, so old and new code mixed. It now loads them from its own moved environment, which the next pipx command deletes from the trash (#2377) by @gaborbernat.
pipx upgrade pipx, pipx upgrade-all and pipx install --force pipx on a pipx that manages itself no longer crash with an ImportError when they install a different pipx version. The running pipx now loads its late imports from a copy of its environment, which the next pipx command deletes from the trash (#2388) by @gaborbernat.
pipx now recognises the app copies it made when the environment's interpreter path is too long for a shebang line or contains a space. pip and uv start such launchers with a #!/bin/sh line that hands over to the interpreter, and pipx took /bin/sh for the interpreter, so pipx reinstall kept a stale copy and warned "File exists ... Not modifying." (#2392) by @gaborbernat.
Security
pipx run now names its cached environments with an HMAC keyed by a random per-user secret, stored with mode 0600 in .run-key inside the run cache. Before, the name was a plain hash of inputs that include tokens and proxy passwords from the environment, so another account that could list the cache could check guesses at those values against it. Existing cache entries are not reused and expire as usual (#2370) by @gaborbernat.
pipx no longer records an abbreviation of a one-shot pip option that the current pip finds ambiguous but an older pip accepts, such as --requirem FILE, which pip 24.0 reads as --requirement FILE. With such a shared pip, a later pipx upgrade or pipx reinstall used to replay it and install from whatever another account had put at that path. An existing record drops it when read, and an abbreviation that could name a source option such as --constraint goes through the same replay check as that option (#2390) by @gaborbernat.
pipx no longer records an interpreter that lives inside another virtual environment, such as the python3 of an activated bootstrap environment or of one made with python3 -m venv --copies. It records the base interpreter named in that environment's pyvenv.cfg, which outlives the bootstrap. pipx install-all also stops building on an exported interpreter that sits inside a virtual environment or that another account can change, and uses the default Python with a message instead, so a snapshot taken before the bootstrap was removed no longer runs whatever another account later puts at its old path (#2402) by @gaborbernat.
Extend the 1.18.8 handling of recorded pip arguments to uv's path options and to --group. pipx no longer records --group, which names a pyproject.toml to read packages from, like -r. On POSIX, a recorded --config-file, --project, --directory, --overrides/--override or --excludes/--exclude that points at a path another account could change stops pipx upgrade, pipx reinstall and the other replaying commands with the same error as --find-links. pipx list --outdated runs the same check and reports such an environment as failed instead of querying the recorded location. pipx runpip reads its install arguments with the same parser, so it records an install written as -qe ./project or -e./project as editable (#2363) by @gaborbernat.
When a rebuild fails during a parallel pipx reinstall-all, the restored environment gets back the shared app, man page or completion links another environment took while the rebuild had it in the trash, unless something outside this run has replaced them since (#2371) by @gaborbernat.
pipx run no longer reuses a cached environment after a change to a variable outside PIP_* and UV_* that decides which config file pip or uv reads, which proxy or index answers, which certificate is trusted or which credentials are sent, such as XDG_CONFIG_HOME, SSL_CERT_FILE, HTTPS_PROXY or NETRC. The values only feed the cache key's hash, so secrets in them stay out of cache paths and logs (#2364) by @gaborbernat.
A pipx run that names an app the package does not provide, such as pipx run --spec black blackk, no longer expires the cached environment, so the corrected command reuses it instead of rebuilding. A failed venv creation or install still expires the entry (#2354) by @gaborbernat.
A second Ctrl-C during pipx reinstall-all, upgrade-all or install-all no longer hangs pipx. A signal handled just after a worker took the shared lock could leave it held, so every other task waited forever (#2348) by @gaborbernat.
A self-managed pipx no longer adopts a recorded default interpreter that no longer backs its own environment, such as the python3 of a bootstrap environment removed after pipx install pipx --python python3. pipx failed every command with a PIPX_DEFAULT_PYTHON error, or built new environments on whatever appeared at that path later (#2245) by @gaborbernat.
Apply --cooldown and PIPX_COOLDOWN to the shared pip that the pip backend installs or refreshes during the command. pipx used to fetch the newest pip, even one uploaded minutes earlier, while it held back the package itself. A new shared environment now starts from the oldest pip pipx supports and upgrades only to a release older than the cooldown (#2311) by @gaborbernat.
Finish restoring an environment when Ctrl-C, SIGTERM or SIGHUP arrives while a failed or interrupted pipx reinstall, install --force, inject, upgrade or manifest sync rolls it back. The rollback deletes the half-built environment and then moves the backup in, and a signal between the two steps left the environment deleted and its only copy in the trash, which the next pipx command emptied. pipx now holds such a signal until the backup is back in place and acts on it afterwards (#2329) by @gaborbernat.
For an editable install, pipx now copies only the man pages that resolve inside the project directory. Before, it followed absolute paths, .. and symlinks, and a wheel installed by name could ship its own editable direct_url.json to make pipx copy any readable file into the environment and link it as a man page (#2268) by @gaborbernat.
Ignore apps, man pages and completions whose name is not a plain file name, such as .., and never delete a directory to make room for an app link, so pipx reinstall can no longer remove the parent of PIPX_BIN_DIR (#2228) by @gaborbernat.
Ignore recorded venv_args other than --system-site-packages, with a warning, when reading a snapshot or pipx_metadata.json, so pipx install-all and pipx reinstall no longer pass an edited --clear <dir> or an extra directory to python -m venv (#2239) by @gaborbernat.
Installing an editable project whose man page or project directory is a looping symlink no longer crashes pipx on Python 3.11 and 3.12; pipx skips that man page (#2334) by @gaborbernat.
Keep pipx reinstall-all, upgrade-all, and install-all waiting for the environments they change when pipx can no longer write their output, as with pipx reinstall-all 2>&1 | head or a closed stderr. pipx used to log a traceback and return while it still rebuilt environments in the background, so an interrupt then skipped the rollback, and an environment waiting for its turn hung (#2290) by @gaborbernat.
Keep a command, man page or completion link that another package took over while pipx reinstall, reinstall-all, uninject or uninstall-all was running. These commands gathered the environment's links first and deleted them by name later, so a name another package claimed in between, for example in the same parallel reinstall-all, disappeared without a message. pipx now deletes a link only if it still points into the environment by Bernát Gábor.
Keep pipx's pipx_metadata.json when the installer replaces it with a wheel's data file of the same name. A failed pipx install --force, pipx upgrade or pipx inject, or a pipx runpip APP install of a dependency, used to leave the wheel's copy in place, and later commands read its index arguments, spec and suffix as pipx's own. pipx now puts its record back after every installer run (#2269) by @gaborbernat.
Keep standalone Python archive members inside the unpack directory on Python 3.11.0 to 3.11.3, which lack tarfile.data_filter. pipx's own extractor checked member names as text, so a member whose path went through a symlink unpacked earlier from the same archive was written wherever that link led. It now resolves each path through the links already on disk, extracts under normalized names like the data filter does, and refuses a hard link to a symlink (#2279) by @gaborbernat.
Keep the apps, manual pages, and completions of injected packages exposed when pipx manifest sync reinstalls an existing environment, and expose the environment again when the sync i
8000
s interrupted. pipx used to drop those links without a message, so another package could take the freed names without --force, and an interrupted sync left the rolled-back environment unexposed (#2273) by @gaborbernat.
Keep the environment when pipx install --force or pipx install-all --force cannot move it aside before a Requires-Python rebuild. On Windows the move fails while any file inside the environment is open, and pipx then deleted the environment and reported a FileNotFoundError instead of the real error. pipx now retries the move the way pipx reinstall does, and if it still fails it leaves the environment in place and reports the original error (#2350) by @gaborbernat.
Keep the recorded source of a local wheel when pipx runpip <venv> install abbreviates a value-taking pip option whose value names the package, such as --only-bin <name> for --only-binary <name>, and record an install through an abbreviated --editable, such as --edit <path>, as editable (#2225) by @gaborbernat.
Keep the rollback backup of a running pipx reinstall, reinstall-all, install --force, upgrade or inject when another pipx command starts. Every command used to empty the trash at startup, so a pipx list run meanwhile deleted the backup, and when the first command then failed or was interrupted it lost the environment with a FileNotFoundError. pipx now skips a backup while its environment's lock is held and removes it only once orphaned (#2298) by @gaborbernat.
Leave a command, man page or completion that the environment did not expose before with its owner when pipx reinstall, reinstall-all, interpreter upgrade, the repair step of pipx upgrade, or a repeated pipx manifest sync rebuilds the environment. These used to replace such a file as if --force had been passed, deleting a user's own script or repointing another environment's command, although pipx install had left it alone with a warning. A name two environments both declare now stays with the one that held it, instead of going to whichever reinstall-all rebuilt last (#2321) by @gaborbernat.
Leave an existing environment alone in pipx install-all without --force. pipx said it was not modifying the environment, then injected the snapshot's injected_packages into it anyway. Pass --force to bring existing environments in line with the snapshot (#2333) by @gaborbernat.
Let an environment take over an app, manual page, or completion name whose link points to a file that another installed environment no longer ships. pipx before 1.18.0 left such links behind when an upgrade dropped an app, and pipx kept them as collisions that only --force cleared. A link counts as left over when the environment it points into no longer lists the file in its metadata. The collision warning for a link whose target is missing now says so (#2356) by @gaborbernat.
Mask URL passwords and tokens in the remaining places that printed or logged them as typed: the Injecting packages log line, the --output json error fields of inject, install and uninject, the progress lines of pipx run script dependencies and --preinstall, the local source that pipx upgrade reports, invalid requirement errors from manifests and inline script metadata, --pip-args rejected by the uv backend of pipx run, the "looks like a path" error, and installer output that pipx captures and logs (#2252) by @gaborbernat.
Mask a URL password that contains a literal space or tab, such as --index-url "http://alice:correct horse@host/simple", in the command log, --verbose output and messages; pipx now masks each argument of a command line before joining it (#2241) by @gaborbernat.
Mask the user part of URL credentials that contain a colon, so a token written as https://TOKEN:@host or TOKEN:x-oauth-basic@ no longer shows in the command log, --verbose output and messages. Such URLs now show as ****:****@, which also hides a plain user name such as alice (#2244) by @gaborbernat.
On Windows under the uv backend, pipx run script.py now releases the run-cache lock before the script starts. pipx held it until the script exited, so a second run of the same script waited without a message, and a script that ran itself through pipx never finished (#2352) by @gaborbernat.
Refuse pipx install --lock and pipx manifest sync with a lock under the pip backend when the environment's pip is older than 26.1. That pip read pylock.toml as a requirements file: a real lock failed with a confusing Invalid requirement error, and a file that was not a lock had its lines applied as pip options. The error now names the pip version and suggests pipx upgrade-shared (#2289) by @gaborbernat.
Refuse a URL spec whose installed METADATA names a different project than its .dist-info directory. A wheel could rewrite that name through its data files and make pipx install --upgrade URL install it into another application's environment (#2236) by @gaborbernat.
Refuse a --python value that is not a version before --fetch-python=missing or --fetch-python=always looks in the standalone interpreter cache. pipx joined the raw value onto PIPX_HOME/py and deleted the result as a failed earlier download, so a directory path, .., . or a bare python removed that directory, PIPX_HOME or the whole interpreter cache (#2262) by @gaborbernat.
Refuse an empty or whitespace-only --index-url instead of silently installing from the default index (#2217) by @Svastikkka.
Refuse an empty or whitespace-only index option inside --pip-args (--index-url, -i, --extra-index-url, --default-index, --index), and under the uv backend an empty index recorded by an earlier install, instead of letting uv install from the default index (#2253) by @gaborbernat.
Refuse an environment name that is empty or a path instead of acting outside $PIPX_HOME/venvs. pipx uninstall "", for example from an unset shell variable, used to remove every environment and exit 0, and an install-all snapshot, manifest tool name or reported package name holding a path built the environment at that path. pipx now stops with Invalid environment name (#2331) by @gaborbernat.
Refuse to overwrite /etc/profile.d/pipx.sh or /etc/paths.d/pipx in pipx ensurepath --global when the file holds content pipx did not write, such as an administrator's PIPX_GLOBAL_HOME or PIP_INDEX_URL exports. pipx used to replace the whole file with its PATH entry and report success. It now leaves the file and its mode alone and exits with an error that names --force, which still replaces the file. pipx replaces a file that holds only an earlier pipx entry, as before (#2315) by @gaborbernat.
Refuse to run pipx manifest lock when a tool's lock path resolves outside the manifest directory, instead of replacing a pylock.toml elsewhere on disk and discarding its previous contents. pipx manifest sync still reads such locks (#2223) by @gaborbernat.
Refuse to run pip or uv in an environment whose pyvenv.cfg is gone, and suggest pipx reinstall. Without that file the environment's python link starts the interpreter it was created
[!IMPORTANT]
✂ PR body was truncated to here.
Configuration
📅 Schedule: (in timezone UTC)
Branch creation
"before 4am on monday"
Automerge
Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
If you want to rebase/retry this PR, check this box
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
No actionable comments were generated in the recent review.
Walkthrough
The GitHub Actions workflows now use Ubuntu 26.04 for the docs, release, and forum_post jobs. The release job now uses Python 3.15. Five pinned pre-commit repository revisions were updated.
The CI and hook updates show no concrete merge-blocking regression.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title "chore(deps): update all dependencies" is a Conventional Commits style summary of the PR. The changeset updates pre-commit hook revisions, Python dependency groups, Docker and GitHub Actions…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title "chore(deps): update all dependencies" is a Conventional Commits style summary of the PR. The changeset updates pre-commit hook revisions, Python dependency groups, Docker and GitHub Actions Python versions (3.14 to 3.15), and the Ubuntu runner (24.04 to 26.04). The title accurately names the primary intent, which is a Renovate dependency update. It is broad, since the PR also changes the runner image and Python version, but it is not misleading.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Finishing Touches
Generate u
8BD0
nit tests (beta)
Commit to this branch
Create a new PR
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 29e2aa36-0013-4237-9fc0-00fad5fb2889
Commits
Reviewing files that changed from the base of the PR and between 184f60f and 89b36be.
Files ignored due to path filters: 1
uv.lock is excluded by !**/*.lock
Files selected for processing: 1
.pre-commit-config.yaml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pyproject.toml
Artifact update for coverage resolved to version 7.17.2, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 7.17.1
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/
File name: pyproject.toml
Artifact update for filelock resolved to version 4.2.9, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 4.2.8
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/
File name: pyproject.toml
Artifact update for tox resolved to version 4.67.13, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 4.67.9
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/
File name: pyproject.toml
Artifact update for tox resolved to version 4.67.13, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 4.67.9
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/
File name: pyproject.toml
Artifact update for pipx resolved to version 1.18.15, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 1.18.13
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v26.9.0→v26.10.1v26.11.00.12.19→0.13.7v2.5.14→v2.6.4v2.6.57.17.0→7.17.17.17.24.2.7→4.2.84.2.90.10.1→0.12.02.4.0→2.4.126.2.2→26.31.18.7→1.18.131.18.15(+1)0.5.7→0.5.10v4.0.9→v4.1.33.14→3.151.9.7→1.10.04.67.4→4.67.94.67.13(+3)1.37.2→1.37.56.0.12.20260906→6.0.12.2026110324.04→26.04Note: The
pre-commitmanager in Renovate is not supported by thepre-commitmaintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.Release Notes
ansible/ansible-lint
v26.10.1Compare Source
What's Changed
Full Changelog: ansible/ansible-lint@v26.10.0...v26.10.1
v26.10.0Compare Source
What's Changed
New Contributors
Full Changelog: ansible/ansible-lint@v26.9.0...v26.10.0
astral-sh/uv-pre-commit
v0.13.7Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.7
v0.13.6Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.6
v0.13.5Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.5
v0.13.4Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.4
v0.13.3Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.3
v0.13.2Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.2
v0.13.1Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.1
v0.13.0Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.0
v0.12.24Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.24
v0.12.23Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.23
v0.12.22Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.22
v0.12.21Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.21
v0.12.20Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.20
biomejs/pre-commit
v2.6.4Compare Source
v2.6.3Compare Source
v2.6.2Compare Source
v2.6.1Compare Source
v2.6.0Compare Source
v2.5.15Compare Source
coveragepy/coveragepy (coverage)
v7.17.1Compare Source
Fix: a one-line class or function body immediately followed by another
statement (such as
class Foo: ...on its own line) was incorrectlyreported as a missing branch when using the sys.monitoring core. This is now
fixed, closing
issue 2167_ andissue 2337_.Fix: the HTML report only rewrites a file's page when the file or its data
has changed, but each page also links to the previous and next files. When
the set of reported files changed, unchanged pages kept their old links. For
example, with
skip_covered, a file that became 100% covered had its pagedeleted, but the pages next to it still linked to it. Now a page is also
rewritten when its neighbors change.
Fix:
--fail-undernow uses at least the decimal precision of thethreshold for both the comparison and failure message. With
precision=0,a total of 0.4 now passes
--fail-under=0.3and fails--fail-under=0.5with the message "total of 0.4 is less than fail-under=0.5". Previously, the
comparison rounded the total to zero and the message could claim "1 is less
than 0". Closes
issue 2295_.Fix: the HTML report escaped file names twice, so a name with
&,<,or quotes in it was shown with entities like
&. Now they are properlyescaped only once.
Fix:
--source=/measured no files. A file system root can't be a sourcedirectory, so now it is an error. Closes
issue 2291_.In an abundance of caution, prevent forged SQLite journal files from deleting
files they shouldn't.
.. _issue 2167: #2167
.. _issue 2291: #2291
.. _issue 2295: #2295
.. _issue 2337: #2337
.. _changes_7-17-0:
tox-dev/filelock (filelock)
v4.2.8Compare Source
Documentation
New Contributors
🐍 PyPI release
📜 Full Changelog
jsh9/pydoclint
v0.12.0Compare Source
the last name in the annotation's AST instead of by matching the annotation
text, so qualified names such as
typing.Generator[...],collections.abc.Iterator[...], andt.Iterable[...]are recognized too(#317)
prefix, so names like
IterableDatasetare no longer treated as iteratorsIterator[int] | NoneorIterator[int] | list[int], are no longer recognized as iterator orgenerator annotations
np.random.Generatoris treated liketyping.Generator, and renamed imports such asfrom typing import Iterator as Itare still not recognizedv0.11.1Compare Source
--excludepattern (such as--exclude=''orexclude = ''inthe config file) excluded every file, so nothing was checked and the run
passed. Now an empty pattern means "don't exclude any files", so every file
gets checked (#311)
--excludevalue that isn't a valid regular expression is now rejectedwith a clear error message instead of a traceback
v0.11.0Compare Source
--include-stub-files(shortform:-isf, default:False), so that scanning a folder also checks stub (.pyi) files (#303)DOC403andDOC502violations in stub (.pyi) files,whose function bodies are placeholders, in both the native mode and
flake8 (#303).
DOC403is still reported in stub files when the returnannotation isn't a Generator/Iterator/Iterable (or is missing), because
then the function can't yield anything
DOC105andDOC605violations in stub files when--check-arg-defaultsisTrue: an argument or class attribute whosedefault is the
...placeholder can now be documented with any defaultvalue or none
DOC201violations for abstract methods and stub functionsannotated with
Iterator[...]orIterable[...]whose docstrings have a"Yields" section (and no "return" statements in the body). Their bodies are
placeholders, so the "Yields" section is what shows that they yield, and
they don't need a "Returns" section
DOC203violations for abstract methods and stub functionsannotated with
Generator[YieldType, SendType, ReturnType]whose "Returns"section documents
ReturnType, as for a generator that both yields andreturns
DOC202violations for abstract methods and stub functionsthat have a "Returns" section but no return annotation. (
DOC203stillreports the missing annotation when return types are checked.)
IndexError) when--check-arg-defaultsisTrueandpositional-only arguments (the ones before
/) have default values. Whenit didn't crash, the defaults of positional-only arguments were ignored
python/mypy (mypy)
v2.4.1Compare Source
pypa/pip (pip)
v26.3Compare Source
pypa/pipx (pipx)
v1.18.13Compare Source
No user-facing changes.
🐍 PyPI release
📜 Full Changelog
v1.18.12Compare Source
Security
pipx runnow treats requirements with a version, extras, a marker or a direct URL as packages, and script URLs as downloads, even when the working directory contains a matching file (#2408) by @gaborbernat.🐍 PyPI release
📜 Full Changelog
v1.18.11Compare Source
Bug fixes
pipx pinnow lists the packages it pins without--injected-onlyor--skip(#2405) by @hemcharan710-afk and @gaborbernat.PyPI release
Full Changelog
v1.18.10Compare Source
Changes
Bug fixes
pipx upgrade pipxorpipx reinstall pipxfor example, no longer crashes with anImportErrorwhen another pipx command empties the trash while it is still running, such as during the rest ofpipx upgrade-all. The copy of its environment it imports from now stays in the trash until the process exits (#2397) by @gaborbernat.pipx reinstall-allwith Ctrl-C now gives a restored environment back the shared app, man page or completion links another environment took while the rebuild had it in the trash, as a failed rebuild already did (#2386) by @gaborbernat.pipx run --refreshor--no-cacheof a local script no longer deletes the cached environment while another run of the same script is still executing in it, and neither does the expiry sweep. Such a run builds a throwaway environment for itself instead, and after--refreshthe next run to find the cached one idle rebuilds it (#2387) by @gaborbernat.pipx upgrade pipxon a pipx that manages itself no longer fails withAccess is deniedand rolls back. uv deletes the files it replaces, which Windows refuses for the runningpipx.exe, so pipx now moves that launcher to its trash first, where the next pipx command deletes it (#2396) by @gaborbernat.pipx reinstallandpipx install --forceno longer warnOverwriting filefor the package's own launcher. Windows.exelaunchers embed their build time, so a rebuilt one never matched its old copy byte for byte and every reinstall warned. pipx now recognises its own copy by the interpreter it names and replaces it without a warning; a file another venv or the user put there still gets one (#2394) by @gaborbernat.UV_LINK_MODE=symlink,pipx uninstallnow removes the man page and shell completion links it exposed, andpipx listno longer reports those man pages as missing. uv makes the environment's own copies symlinks into its cache, and pipx followed them there instead of stopping at the environment (#2380) by @gaborbernat.--fetch-pythonandpipx interpreter upgradenow download and unpack the standalone Python build next to the interpreter directory instead of in the system temp dir, so a tmpfs/tmpor a/tmpon another btrfs subvolume no longer forces a full copy of the build into the pipx home or splits its hard links into separate files (#2403) by @gaborbernat.pipx inject pipxwithout--include-appsandpipx runpip pipxon a pipx that manages itself no longer mix old and new pipx code when they change the pipx package. Likepipx upgrade pipx, they now load late imports from a copy of the environment, which the next pipx command deletes from the trash (#2393) by @gaborbernat.pipx list --jsonno longer exports the interpreter a self-managed pipx recorded when that path no longer leads to the interpreter its environment runs on, such as a removed bootstrap environment'spython3.pipx install-allthen builds that environment on the default interpreter instead of whatever appears at the old path (#2389) by @gaborbernat.pipx reinstall pipxon a pipx that manages itself no longer crashes with anImportErrorwhen it installs a different pipx version. Modules the running pipx imported late came from the version it was installing, so old and new code mixed. It now loads them from its own moved environment, which the next pipx command deletes from the trash (#2377) by @gaborbernat.pipx upgrade pipx,pipx upgrade-allandpipx install --force pipxon a pipx that manages itself no longer crash with anImportErrorwhen they install a different pipx version. The running pipx now loads its late imports from a copy of its environment, which the next pipx command deletes from the trash (#2388) by @gaborbernat.#!/bin/shline that hands over to the interpreter, and pipx took/bin/shfor the interpreter, sopipx reinstallkept a stale copy and warned "File exists ... Not modifying." (#2392) by @gaborbernat.Security
pipx runnow names its cached environments with an HMAC keyed by a random per-user secret, stored with mode0600in.run-keyinside the run cache. Before, the name was a plain hash of inputs that include tokens and proxy passwords from the environment, so another account that could list the cache could check guesses at those values against it. Existing cache entries are not reused and expire as usual (#2370) by @gaborbernat.--requirem FILE, which pip 24.0 reads as--requirement FILE. With such a shared pip, a laterpipx upgradeorpipx reinstallused to replay it and install from whatever another account had put at that path. An existing record drops it when read, and an abbreviation that could name a source option such as--constraintgoes through the same replay check as that option (#2390) by @gaborbernat.python3of an activated bootstrap environment or of one made withpython3 -m venv --copies. It records the base interpreter named in that environment'spyvenv.cfg, which outlives the bootstrap.pipx install-allalso stops building on an exported interpreter that sits inside a virtual environment or that another account can change, and uses the default Python with a message instead, so a snapshot taken before the bootstrap was removed no longer runs whatever another account later puts at its old path (#2402) by @gaborbernat.PyPI release
Full Changelog
v1.18.9Compare Source
Bug fixes
--group. pipx no longer records--group, which names apyproject.tomlto read packages from, like-r. On POSIX, a recorded--config-file,--project,--directory,--overrides/--overrideor--excludes/--excludethat points at a path another account could change stopspipx upgrade,pipx reinstalland the other replaying commands with the same error as--find-links.pipx list --outdatedruns the same check and reports such an environment as failed instead of querying the recorded location.pipx runpipreads its install arguments with the same parser, so it records an install written as-qe ./projector-e./projectas editable (#2363) by @gaborbernat.pipx reinstall-all, the restored environment gets back the shared app, man page or completion links another environment took while the rebuild had it in the trash, unless something outside this run has replaced them since (#2371) by @gaborbernat.pipx runno longer reuses a cached environment after a change to a variable outsidePIP_*andUV_*that decides which config file pip or uv reads, which proxy or index answers, which certificate is trusted or which credentials are sent, such asXDG_CONFIG_HOME,SSL_CERT_FILE,HTTPS_PROXYorNETRC. The values only feed the cache key's hash, so secrets in them stay out of cache paths and logs (#2364) by @gaborbernat.PyPI release
Full Changelog
v1.18.8Compare Source
Bug fixes
pipx runthat names an app the package does not provide, such aspipx run --spec black blackk, no longer expires the cached environment, so the corrected command reuses it instead of rebuilding. A failed venv creation or install still expires the entry (#2354) by @gaborbernat.pipx reinstall-all,upgrade-allorinstall-allno longer hangs pipx. A signal handled just after a worker took the shared lock could leave it held, so every other task waited forever (#2348) by @gaborbernat.python3of a bootstrap environment removed afterpipx install pipx --python python3. pipx failed every command with aPIPX_DEFAULT_PYTHONerror, or built new environments on whatever appeared at that path later (#2245) by @gaborbernat.--cooldownandPIPX_COOLDOWNto the shared pip that the pip backend installs or refreshes during the command. pipx used to fetch the newest pip, even one uploaded minutes earlier, while it held back the package itself. A new shared environment now starts from the oldest pip pipx supports and upgrades only to a release older than the cooldown (#2311) by @gaborbernat.SIGTERMorSIGHUParrives while a failed or interruptedpipx reinstall,install --force,inject,upgradeormanifest syncrolls it back. The rollback deletes the half-built environment and then moves the backup in, and a signal between the two steps left the environment deleted and its only copy in the trash, which the next pipx command emptied. pipx now holds such a signal until the backup is back in place and acts on it afterwards (#2329) by @gaborbernat...and symlinks, and a wheel installed by name could ship its own editabledirect_url.jsonto make pipx copy any readable file into the environment and link it as a man page (#2268) by @gaborbernat..., and never delete a directory to make room for an app link, sopipx reinstallcan no longer remove the parent ofPIPX_BIN_DIR(#2228) by @gaborbernat.venv_argsother than--system-site-packages, with a warning, when reading a snapshot orpipx_metadata.json, sopipx install-allandpipx reinstallno longer pass an edited--clear <dir>or an extra directory topython -m venv(#2239) by @gaborbernat.pipx reinstall-all,upgrade-all, andinstall-allwaiting for the environments they change when pipx can no longer write their output, as withpipx reinstall-all 2>&1 | heador a closed stderr. pipx used to log a traceback and return while it still rebuilt environments in the background, so an interrupt then skipped the rollback, and an environment waiting for its turn hung (#2290) by @gaborbernat.pipx reinstall,reinstall-all,uninjectoruninstall-allwas running. These commands gathered the environment's links first and deleted them by name later, so a name another package claimed in between, for example in the same parallelreinstall-all, disappeared without a message. pipx now deletes a link only if it still points into the environment by Bernát Gábor.pipx_metadata.jsonwhen the installer replaces it with a wheel's data file of the same name. A failedpipx install --force,pipx upgradeorpipx inject, or apipx runpip APP installof a dependency, used to leave the wheel's copy in place, and later commands read its index arguments, spec and suffix as pipx's own. pipx now puts its record back after every installer run (#2269) by @gaborbernat.tarfile.data_filter. pipx's own extractor checked member names as text, so a member whose path went through a symlink unpacked earlier from the same archive was written wherever that link led. It now resolves each path through the links already on disk, extracts under normalized names like the data filter does, and refuses a hard link to a symlink (#2279) by @gaborbernat.pipx manifest syncreinstalls an existing environment, and expose the environment again when the sync i 8000 s interrupted. pipx used to drop those links without a message, so another package could take the freed names without--force, and an interrupted sync left the rolled-back environment unexposed (#2273) by @gaborbernat.pipx install --forceorpipx install-all --forcecannot move it aside before aRequires-Pythonrebuild. On Windows the move fails while any file inside the environment is open, and pipx then deleted the environment and reported aFileNotFoundErrorinstead of the real error. pipx now retries the move the waypipx reinstalldoes, and if it still fails it leaves the environment in place and reports the original error (#2350) by @gaborbernat.pipx runpip <venv> installabbreviates a value-taking pip option whose value names the package, such as--only-bin <name>for--only-binary <name>, and record an install through an abbreviated--editable, such as--edit <path>, as editable (#2225) by @gaborbernat.pipx reinstall,reinstall-all,install --force,upgradeorinjectwhen another pipx command starts. Every command used to empty the trash at startup, so apipx listrun meanwhile deleted the backup, and when the first command then failed or was interrupted it lost the environment with aFileNotFoundError. pipx now skips a backup while its environment's lock is held and removes it only once orphaned (#2298) by @gaborbernat.pipx reinstall,reinstall-all,interpreter upgrade, the repair step ofpipx upgrade, or a repeatedpipx manifest syncrebuilds the environment. These used to replace such a file as if--forcehad been passed, deleting a user's own script or repointing another environment's command, althoughpipx installhad left it alone with a warning. A name two environments both declare now stays with the one that held it, instead of going to whicheverreinstall-allrebuilt last (#2321) by @gaborbernat.pipx install-allwithout--force. pipx said it was not modifying the environment, then injected the snapshot'sinjected_packagesinto it anyway. Pass--forceto bring existing environments in line with the snapshot (#2333) by @gaborbernat.--forcecleared. A link counts as left over when the environment it points into no longer lists the file in its metadata. The collision warning for a link whose target is missing now says so (#2356) by @gaborbernat.Injecting packageslog line, the--output jsonerror fields ofinject,installanduninject, the progress lines ofpipx runscript dependencies and--preinstall, the local source thatpipx upgradereports, invalid requirement errors from manifests and inline script metadata,--pip-argsrejected by the uv backend ofpipx run, the "looks like a path" error, and installer output that pipx captures and logs (#2252) by @gaborbernat.--index-url "http://alice:correct horse@host/simple", in the command log,--verboseoutput and messages; pipx now masks each argument of a command line before joining it (#2241) by @gaborbernat.https://TOKEN:@hostorTOKEN:x-oauth-basic@no longer shows in the command log,--verboseoutput and messages. Such URLs now show as****:****@, which also hides a plain user name such asalice(#2244) by @gaborbernat.pipx run script.pynow releases the run-cache lock before the script starts. pipx held it until the script exited, so a second run of the same script waited without a message, and a script that ran itself through pipx never finished (#2352) by @gaborbernat.pipx install --lockandpipx manifest syncwith a lock under the pip backend when the environment's pip is older than 26.1. That pip readpylock.tomlas a requirements file: a real lock failed with a confusingInvalid requirementerror, and a file that was not a lock had its lines applied as pip options. The error now names the pip version and suggestspipx upgrade-shared(#2289) by @gaborbernat.METADATAnames a different project than its.dist-infodirectory. A wheel could rewrite that name through its data files and makepipx install --upgrade URLinstall it into another application's environment (#2236) by @gaborbernat.--pythonvalue that is not a version before--fetch-python=missingor--fetch-python=alwayslooks in the standalone interpreter cache. pipx joined the raw value ontoPIPX_HOME/pyand deleted the result as a failed earlier download, so a directory path,..,.or a barepythonremoved that directory,PIPX_HOMEor the whole interpreter cache (#2262) by @gaborbernat.--index-urlinstead of silently installing from the default index (#2217) by @Svastikkka.--pip-args(--index-url,-i,--extra-index-url,--default-index,--index), and under the uv backend an empty index recorded by an earlier install, instead of letting uv install from the default index (#2253) by @gaborbernat.$PIPX_HOME/venvs.pipx uninstall "", for example from an unset shell variable, used to remove every environment and exit 0, and aninstall-allsnapshot, manifest tool name or reported package name holding a path built the environment at that path. pipx now stops withInvalid environment name(#2331) by @gaborbernat./etc/profile.d/pipx.shor/etc/paths.d/pipxinpipx ensurepath --globalwhen the file holds content pipx did not write, such as an administrator'sPIPX_GLOBAL_HOMEorPIP_INDEX_URLexports. pipx used to replace the whole file with itsPATHentry and report success. It now leaves the file and its mode alone and exits with an error that names--force, which still replaces the file. pipx replaces a file that holds only an earlier pipx entry, as before (#2315) by @gaborbernat.pipx manifest lockwhen a tool'slockpath resolves outside the manifest directory, instead of replacing apylock.tomlelsewhere on disk and discarding its previous contents.pipx manifest syncstill reads such locks (#2223) by @gaborbernat.pyvenv.cfgis gone, and suggestpipx reinstall. Without that file the environment'spythonlink starts the interpreter it was createdConfiguration
📅 Schedule: (in timezone UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.