[dependabot]

Bumps distlib from 0.4.3 to 0.4.4.

Changelog

Sourced from distlib's changelog.

0.4.4

Released: 2026-10-16


compat

Fixed a missing import. Thanks to Andrej730 for the patch.



markers

Fixed #273: Enforce compatible-release bounds in environment markers.
Thanks to Luochenchen for the patch.



metadata

Fix #194: Add an urls property to expose project and home URLs. Thanks to
Sinkleberg for the patch.



scripts


Raise the correct exception when a launcher can't be written. Thanks to
candygoogy for the patch.


Fix #144: Detect shell-script Python executables in ScriptMaker shebangs.
Thanks to Alex Chen for the patch.




util


Improve performance of export entry search to take linear time. Thanks to
Brian Willows for the patch.


Use tarfile.data_filter rather than tarfile.tar_filter in unarchive()
when extraction filters are available, matching the Python 3.14 default. Path and
link containment checks now use os.path.realpath and no longer fail with
IndexError for members such as . or ./. Thanks to Kobain for the patch.


unarchive() now resolves member paths through symlinks seen earlier in the
same archive, so a chain of individually harmless-looking links cannot be used
to write outside the destination on Pythons without extraction filters. Thanks to
Kobain for the patch.




version


Improve NormalizedVersion by addressing correctness and performance gaps
found by comparison with packaging. Thanks to Damian Shaw for the patch.


Improve SemanticVersion by comparing numeric prerelease identifiers,
including those longer than 8 digits. Thanks to Muneeb Sheikh for the
patch.

Commits

• 25eed06 Changes for 0.4.4.
• 8ffee6f Resolve member paths through earlier archive symlinks in unarchive()
• ef4a390 Test that data_filter rejects absolute symlinks with check=False
• 380b6a9 Use data_filter and realpath containment checks in unarchive()
• 7b7c572 fix: enforce compatible-release bounds in markers (#274)
• 38811dd Detect shell-script Python executables in ScriptMaker shebangs (#144) (#264)
• 06ddb5d Compare numeric prerelease identifiers without a digit limit (#270)
• e54dd8c Raise the original error when a launcher can't be written (#269)
• c6270e3 Fix NormalizedVersion gaps found by comparison with packaging (#271)
• 5b3092b Search export entries in linear time (#266)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

📋 Review Summary

This automated Dependabot PR bumps distlib from 0.4.3 to 0.4.4 in sdks/python/pyproject.toml ([build-system] requirements). The patch release includes bug fixes and security hardening in unarchive() path containment checks, with no breaking changes.

🔍 General Feedback

• The dependency update is scoped exclusively to the Python SDK [build-system] requirements and does not conflict with runtime or container dependencies. LGTM.

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

[github-actions]

Assigning reviewers:

R: @shunping for label python.
Backup reviewer: claudevdm (if the main reviewer is unresponsive, you can escalate to them by tagging their username)

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).