Skip to content

chore(deps): bump the python-minor-and-patch group across 1 directory with 7 updates - #234

Merged
esacteksab merged 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-c72e9459e9
Oct 22, 2026
Merged

chore(deps): bump the python-minor-and-patch group across 1 directory with 7 updates#234
esacteksab merged 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-c72e9459e9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 7 updates in the / directory:

Package From To
cfgv 3.4.0 3.5.0
distlib 0.4.3 0.4.4
identify 2.6.13 2.6.20
nodeenv 1.9.1 1.11.0
python-discovery 1.6.2 1.6.4
pyyaml 6.0.2 6.0.3
virtualenv 21.14.7 21.14.11

Updates cfgv from 3.4.0 to 3.5.0

Commits
  • c734212 v3.5.0
  • d64e0cc Merge pull request #158 from asottile/key-value-map
  • 641559f add KeyValueMap
  • 82e2f93 Merge pull request #157 from asottile/pre-commit-ci-update-config
  • 69cd020 [pre-commit.ci] pre-commit autoupdate
  • 5ccc4d4 Merge pull request #156 from asottile/pre-commit-ci-update-config
  • 2e7ffe5 [pre-commit.ci] pre-commit autoupdate
  • ef78499 Merge pull request #155 from asottile/all-repos_autofix_all-repos-manual
  • b34b882 py310+
  • 724a279 Merge pull request #154 from asottile/pre-commit-ci-update-config
  • Additional commits viewable in compare view

Updates distlib from 0.4.3 to 0.4.4

Changelog

Sourced from distlib's changelog.

0.4.4


Released: 2026-10-16

    

  • 

    compat
    

      

    • Fixed a missing import. Thanks to Andrej730 for the patch.
      • 

    

    • 

  • 

    markers
    

      

    • Fixed #273: Enforce compatible-release bounds in environment markers.
Thanks to Luochenchen for the patch.
      • 

    

    • 

  • 

    metadata
    

      

    • Fix #194: Add an urls property to expose project and home URLs. Thanks to
Sinkleberg for the patch.
      • 

    

    • 

  • 

    scripts
    

      

    • 

      Raise the correct exception when a launcher can't be written. Thanks to
candygoogy for the patch.
      

      • 

    • 

      Fix #144: Detect shell-script Python executables in ScriptMaker shebangs.
Thanks to Alex Chen for the patch.
      

      • 

    

    • 

  • 

    util
    

      

    • 

      Improve performance of export entry search to take linear time. Thanks to
Brian Willows for the patch.
      

      • 

    • 

      Use tarfile.data_filter rather than tarfile.tar_filter in unarchive()
when extraction filters are available, matching the Python 3.14 default. Path and
link containment checks now use os.path.realpath and no longer fail with
IndexError for members such as . or ./. Thanks to Kobain for the patch.
      

      • 

    • 

      unarchive() now resolves member paths through symlinks seen earlier in the
same archive, so a chain of individually harmless-looking links cannot be used
to write outside the destination on Pythons without extraction filters. Thanks to
Kobain for the patch.
      

      • 

    

    • 

  • 

    version
    

      

    • 

      Improve NormalizedVersion by addressing correctness and performance gaps
found by comparison with packaging. Thanks to Damian Shaw for the patch.
      

      • 

    • 

      Improve SemanticVersion by comparing numeric prerelease identifiers,
including those longer than 8 digits. Thanks to Muneeb Sheikh for the
patch.

Commits
  • 25eed06 Changes for 0.4.4.
  • 8ffee6f Resolve member paths through earlier archive symlinks in unarchive()
  • ef4a390 Test that data_filter rejects absolute symlinks with check=False
  • 380b6a9 Use data_filter and realpath containment checks in unarchive()
  • 7b7c572 fix: enforce compatible-release bounds in markers (#274)
  • 38811dd Detect shell-script Python executables in ScriptMaker shebangs (#144) (#264)
  • 06ddb5d Compare numeric prerelease identifiers without a digit limit (#270)
  • e54dd8c Raise the original error when a launcher can't be written (#269)
  • c6270e3 Fix NormalizedVersion gaps found by comparison with packaging (#271)
  • 5b3092b Search export entries in linear time (#266)
  • Additional commits viewable in compare view

Updates identify from 2.6.13 to 2.6.20

Commits
  • aa34031 v2.6.20
  • 116099f Merge pull request #609 from Malix-Labs/feat/add-nushell
  • 971546c Merge pull request #610 from pre-commit/lock-file-tags
  • da45cb1 Add support for 'nu' extension and Nushell interpreters
  • a35b99b Merge pull request #608 from steovd/profile-sh
  • bd5cdb7 Merge pull request #601 from ngie-eign/issue-258
  • 66faf04 Merge pull request #597 from edgarrmondragon/patch-1
  • c75a0a2 Merge pull request #593 from NinjaMandalorian/main
  • ea6c9f9 Add support for 'luau' file extension
  • d28c571 Merge pull request #585 from Kvan7/patch-1
  • Additional commits viewable in compare view

Updates nodeenv from 1.9.1 to 1.11.0

Release notes

Sourced from nodeenv's releases.

1.11.0

What's Changed

New Features 🎉

Fixed bugs 🐛

Improvements 🛠

Documentation 📄

Other Changes

New Contributors

Full Changelog: ekalinin/nodeenv@1.10.0...1.11.0

1.10.0: Add support Python 3.13/UV

What's Changed

Fixed bugs 🐛

Improvements 🛠

... (truncated)

Changelog

Sourced from nodeenv's changelog.

Version 1.11.0

  • Fixed zsh source bin/activate aborting on the direct-call guard [#398](https://github.com/ekalinin/nodeenv/issues/398) <https://github.com/ekalinin/nodeenv/issues/398>_
  • Added check for how activate is called [#384](https://github.com/ekalinin/nodeenv/issues/384) <https://github.com/ekalinin/nodeenv/pull/384>_
  • Addressed the tarfile.extractall deprecation on Python >= 3.12 by setting filter='data', which also prevents writing files via ".." or absolute paths [#380](https://github.com/ekalinin/nodeenv/issues/380) <https://github.com/ekalinin/nodeenv/pull/380>_
  • Added support for Solaris/illumos [#360](https://github.com/ekalinin/nodeenv/issues/360) <https://github.com/ekalinin/nodeenv/issues/360>_
  • Added predeactivate hooks for Windows
  • Added error handling and tests for the node installation [#336](https://github.com/ekalinin/nodeenv/issues/336) <https://github.com/ekalinin/nodeenv/issues/336>_
  • Removed the leftover debug print that leaked a dict to stdout on every version detection [#390](https://github.com/ekalinin/nodeenv/issues/390) <https://github.com/ekalinin/nodeenv/issues/390>_
  • Added --with-certifi to download packages with the certifi certificate bundle [#388](https://github.com/ekalinin/nodeenv/issues/388) <https://github.com/ekalinin/nodeenv/pull/388>_
  • --node accepts npm-style semver ranges [#393](https://github.com/ekalinin/nodeenv/issues/393) <https://github.com/ekalinin/nodeenv/pull/393>_
  • Added --prefer-system to use system-wide node.js when available and install one otherwise [#153](https://github.com/ekalinin/nodeenv/issues/153) <https://github.com/ekalinin/nodeenv/issues/153>_
  • Added --isolate-npm to keep npm cache, userconfig and init-module inside the environment [#154](https://github.com/ekalinin/nodeenv/issues/154) <https://github.com/ekalinin/nodeenv/issues/154>_
  • Added tests that run the activation scripts in sh, dash, bash, zsh and fish.
  • -p no longer reinstalls node when the requested version is already in the virtualenv [#159](https://github.com/ekalinin/nodeenv/issues/159) <https://github.com/ekalinin/nodeenv/issues/159>_
  • Repeated -p runs no longer duplicate the predeactivate hook [#159](https://github.com/ekalinin/nodeenv/issues/159) <https://github.com/ekalinin/nodeenv/issues/159>_
  • -p accepts an optional virtualenv directory and prefers the activated VIRTUAL_ENV over the virtualenv nodeenv itself is installed in [#156](https://github.com/ekalinin/nodeenv/issues/156) <https://github.com/ekalinin/nodeenv/issues/156>_
  • -r/--requirements may now be given more than once, and the new --local-requirements installs the packages of a file locally, into "node_modules" of the current directory, which is what freeze -l writes. Under npm < 1.0.0, which has no -g, a local file is still installed the old way [#206](https://github.com/ekalinin/nodeenv/issues/206) <https://github.com/ekalinin/nodeenv/issues/206>_
  • The "src" directory is now removed after installation by default, which halves the size of an environment. Added --no-clean-src to keep it: with --source that is what lets a repeated --force build reuse the downloaded source tree [#205](https://github.com/ekalinin/nodeenv/issues/205) <https://github.com/ekalinin/nodeenv/issues/205>_
  • Documented that --mirror takes a file:// URL, so a local directory can serve as the download source [#193](https://github.com/ekalinin/nodeenv/issues/193) <https://github.com/ekalinin/nodeenv/issues/193>_
  • The posix activate is now written on Windows too, into "Scripts", so git-bash and the other posix shells there can activate an environment [#226](https://github.com/ekalinin/nodeenv/issues/226) <https://github.com/ekalinin/nodeenv/issues/226>_
  • A download that reaches nothing at all, which a broken http_proxy or https_proxy usually causes, now reports the url and the proxy settings instead of a traceback

... (truncated)

Commits
  • e745358 Merge pull request #418 from ekalinin/chore/release-1.11.0
  • fd19956 chore(release): bump nodeenv version to 1.11.0
  • 1767015 Merge pull request #415 from ekalinin/fix/nodejs-exe-link
  • 55df3ce Merge pull request #417 from r3wretrhy/fix/zsh-activate-source-guard
  • bb15c5c fix: allow zsh to source bin/activate
  • 152cd3d fix(nodeenv): link nodejs.exe without mklink
  • d163302 Merge pull request #414 from ekalinin/fix/freeze-requirements
  • ef5ec35 fix(nodeenv): read npm's parseable listing in freeze
  • b1f0c54 Merge pull request #413 from ekalinin/fix/musl-vendor-detection
  • aadf307 fix(nodeenv): detect musl regardless of the host triplet vendor
  • Additional commits viewable in compare view

Updates python-discovery from 1.6.2 to 1.6.4

Release notes

Sourced from python-discovery's releases.

v1.6.4

Improved documentation - 1.6.4

  • Clarify the executable paths accepted by try_first_with in the standalone usage example. (#150)

PyPI release

Full Changelog: tox-dev/python-discovery@1.6.3...1.6.4

1.6.3

Bug fixes - 1.6.3

  • Treat specs with dot-only version components, such as python., as literal executable paths instead of raising IndexError - by harbinresearcher. (#147)
  • Pass PEP 514 ExecutableArguments to registered Windows interpreters when querying them, so a registration that points at a launcher such as py.exe -3.11 reports the interpreter it selects - by blouirts123. (#148)

PyPI release

Full Changelog: tox-dev/python-discovery@1.6.2...1.6.3

Changelog

Sourced from python-discovery's changelog.

Improved documentation - 1.6.4

  • Clarify the executable paths accepted by try_first_with in the standalone usage example. (:issue:150)

v1.6.3 (2026-10-16)

Bug fixes - 1.6.3

  • Treat specs with dot-only version components, such as python., as literal executable paths instead of raising IndexError - by :user:harbinresearcher. (:issue:147)
  • Pass PEP 514 ExecutableArguments to registered Windows interpreters when querying them, so a registration that points at a launcher such as py.exe -3.11 reports the interpreter it selects - by :user:blouirts123. (:issue:148)

v1.6.2 (2026-10-10)

Commits
  • 885805a release 1.6.4
  • 1a6b5cd fix(release): trim GitHub notes (#154)
  • ac862a4 👷 ci: publish release after PyPI (#153)
  • 4d53c08 build(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the github-acti...
  • 1701972 👷 ci(release): require changelog entries (#151)
  • 9f051ac docs: use an executable path in the try_first_with example (#150)
  • 3b72b55 test: move argument tests into existing file (#149)
  • cbb2abd fix: honor PEP 514 executable arguments during discovery (#148)
  • ab2abc8 fix(spec): handle dot-only version components (#147)
  • 1c9af8e build(deps): bump the github-actions group with 2 updates (#145)
  • Additional commits viewable in compare view

Updates pyyaml from 6.0.2 to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

  • Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

  • yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)
Commits

Updates virtualenv from 21.14.7 to 21.14.11

Release notes

Sourced from virtualenv's releases.

21.14.11

Bugfixes - 21.14.11

  • Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440)
  • On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441)

PyPI release

Full Changelog: pypa/virtualenv@21.14.10...21.14.11

21.14.10

Bugfixes - 21.14.10

  • Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (#3437)

PyPI release

Full Changelog: pypa/virtualenv@21.14.9...21.14.10

21.14.9

Bugfixes - 21.14.9

  • Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

  • Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

  • Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

    Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

  • Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

  • Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

  • Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

  • Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

    Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

  • Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.11

  • Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (:issue:3440)
  • On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (:issue:3441)

v21.14.10 (2026-10-17)

Bugfixes - 21.14.10

  • Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (:issue:3437)

v21.14.9 (2026-10-17)

Bugfixes - 21.14.9

  • Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

  • Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

  • Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

    Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

  • Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

  • Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

  • Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

  • Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

    Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

  • Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

  • Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-minor-and-patch group across 1 directory…
9b2e4da 
… with 7 updates

Bumps the python-minor-and-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cfgv](https://github.com/asottile/cfgv) | `3.4.0` | `3.5.0` |
| [distlib](https://github.com/pypa/distlib) | `0.4.3` | `0.4.4` |
| [identify](https://github.com/pre-commit/identify) | `2.6.13` | `2.6.20` |
| [nodeenv](https://github.com/ekalinin/nodeenv) | `1.9.1` | `1.11.0` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.6.2` | `1.6.4` |
| [pyyaml](https://github.com/yaml/pyyaml) | `6.0.2` | `6.0.3` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.14.7` | `21.14.11` |



Updates `cfgv` from 3.4.0 to 3.5.0
- [Commits](asottile/cfgv@v3.4.0...v3.5.0)

Updates `distlib` from 0.4.3 to 0.4.4
- [Release notes](https://github.com/pypa/distlib/releases)
- [Changelog](https://github.com/pypa/distlib/blob/master/CHANGES.rst)
- [Commits](pypa/distlib@0.4.3...0.4.4)

Updates `identify` from 2.6.13 to 2.6.20
- [Commits](pre-commit/identify@v2.6.13...v2.6.20)

Updates `nodeenv` from 1.9.1 to 1.11.0
- [Release notes](https://github.com/ekalinin/nodeenv/releases)
- [Changelog](https://github.com/ekalinin/nodeenv/blob/master/CHANGES)
- [Commits](ekalinin/nodeenv@1.9.1...1.11.0)

Updates `python-discovery` from 1.6.2 to 1.6.4
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.6.2...1.6.4)

Updates `pyyaml` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0.2...6.0.3)

Updates `virtualenv` from 21.14.7 to 21.14.11
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.7...21.14.11)

---
updated-dependencies:
- dependency-name: cfgv
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: distlib
  dependency-version: 0.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: identify
  dependency-version: 2.6.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: nodeenv
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: python-discovery
  dependency-version: 1.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pyyaml
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: virtualenv
  dependency-version: 21.14.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from esacteksab as a code owner October 22, 2026 20:19
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file 🔗 python Pull requests that update python code labels Oct 22, 2026
@esacteksab
esacteksab merged commit af77df9 into main Oct 22, 2026
3 checks passed
@esacteksab
esacteksab deleted the dependabot/pip/python-minor-and-patch-c72e9459e9 branch October 22, 2026 20:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@esacteksab esacteksab Awaiting requested review from esacteksab esacteksab is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file 🔗 python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@esacteksab