[dependabot]

Bumps tox from 4.67.2 to 4.67.12.

Release notes

Sourced from tox's releases.

v4.67.12

Bug fixes

• A quoted set_env value that ends with a literal backslash and contains a semicolon no longer loses its quote protection, so WINPATH="C:\tools;C:\bin\\" keeps the whole value instead of failing with invalid marker. tox now counts the backslashes in front of a quote: an even number leaves the quote unescaped (#4388) by @​haigou-web and @​gaborbernat. (#4387)

🐍 PyPI release

📜 Full Changelog

v4.67.11

Bug fixes

• Package staging no longer fails on a .tox that only the project's own writers can change, such as one owned by the workspace owner while root runs tox, or a 777 build directory on Bitbucket. A work directory that other accounts could change, such as a 777 .tox left by an older tox under umask 000 or restored from a CI cache, is made private and emptied once at the start of a run, so tox recreates its environments instead of failing. When staging still refuses a path, the error names its owner and mode (#4386) by @​gaborbernat. (#4376)

🐍 PyPI release

📜 Full Changelog

v4.67.10

Bug fixes

• A pair of numbers after a - is no longer read as a range, so py-django-4-2 keeps its name instead of splitting into py-django-4, 3 and 2. Braced ranges such as py-django-{4-5} still expand (#4380) by @​ericdelorefice and @​gaborbernat.
• On Windows, quoted option values in requirements files and deps, such as -r "sub dir/base.txt", now have their quotes removed as they do on other platforms and in pip; before, the quotes stayed in the path and the file could not be opened. On every platform, a quoted -r, -c or -f value in deps keeps its spaces as written instead of gaining literal backslashes (#4381) by @​abo3losh1 and @​gaborbernat.

New Contributors

• @​abo3losh1 made their first contribution in tox-dev/tox#4381

🐍 PyPI release

📜 Full Changelog

v4.67.9

🐍 PyPI release

📜 Full Changelog

v4.67.8

Bug fixes

• A .tox created under umask 002 no longer fails the package staging check. When the current user owns a group-writable work directory left by an older tox, tox makes it owner-only and removes group write from the staging directories inside it. Provisioning runs the same repair before starting the provisioned tox, which may be a release without it, and creates a missing work directory owner-only. Previously, such checkouts failed until .tox was deleted, and a fresh .tox also failed when tox provisioned itself (#4377) by @​gaborbernat. (#4376)

... (truncated)

Changelog

Sourced from tox's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-67-13:

---

4.67.13 (2026-11-06)

---

.. _release-4-67-13-fixed:

Fixed

• Relative {glob:...} and TOML replace = "glob" patterns now match files when :ref:tox_root contains [, * or ?. tox treats those characters in the project path literally while keeping wildcards in the configured pattern (:pr:4389) by :user:qodelicious and :user:gaborbernat.
• When :ref:work_dir or :ref:tox_root contains [, * or ?, tox now treats those characters literally in its own executable paths and in default or relative :ref:package_glob patterns. This lets it run environment commands and find packages built by package = external (:pr:4390) by :user:qodelicious and :user:gaborbernat.

.. _release-4-67-12:

---

4.67.12 (2026-11-05)

---

.. _release-4-67-12-fixed:

Fixed

• A quoted set_env value that ends with a literal backslash and contains a semicolon no longer loses its quote protection, so WINPATH="C:\tools;C:\bin\\" keeps the whole value instead of failing with invalid marker. tox now counts the backslashes in front of a quote: an even number leaves the quote unescaped (:pr:4388) by :user:haigou-web and :user:gaborbernat. (:issue:4387)

.. _release-4-67-11:

---

4.67.11 (2026-11-04)

---

.. _release-4-67-11-fixed:

... (truncated)

Commits

• e06518d release 4.67.12
• a6ce4cc 🐛 fix(set_env): keep quotes around a value ending with a backslash (#4388)
• 11a2097 release 4.67.11
• 514b084 🐛 fix(staging): trust project writers, rebuild exposed .tox (#4386)
• e63f763 👷 ci: run release notes before PyPI publish (#4384)
• be99e7f 👷 ci: reduce macOS runner use (#4385)
• 9af3141 🧪 test(pylock): install from a local wheel (#4383)
• f8cf729 release 4.67.10
• cf02931 🐛 fix(pip): keep quoted requirement paths intact (#4381)
• abcba3a 🐛 fix(config): don't read dashed version factors as a range (#4380)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)