[dependabot]

Bumps the python-tooling group with 8 updates:

Package	From	To
ruff	0.17.3	0.17.4
filelock	4.2.7	4.2.10
platformdirs	4.14.3	4.14.5
py-serializable	2.1.0	2.2.0
coverage	7.17.0	7.17.2
importlib-metadata	9.0.0	10.2.0
mypy-extensions	1.1.0	1.2.0
zipp	4.1.0	4.1.2

Updates ruff from 0.17.3 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view

Updates filelock from 4.2.7 to 4.2.10

Release notes

Sourced from filelock's releases.

4.2.10

Bug fixes

• Contended FileLock and SoftFileLock acquisitions now raise Timeout when elapsed time reaches the requested timeout. A clock that landed exactly on the deadline previously left a waiter retrying with zero-length sleeps indefinitely (#922) by @​gaborbernat.

Packaging

• Every wheel now carries a PEP 770 CycloneDX SBOM in its .dist-info/sboms directory, written at build time by python-sbom (#921) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

4.2.9

Bug fixes

• ReadWriteLock, SoftReadWriteLock and their async wrappers now raise TypeError for a blocking that is not a bool, in the constructor and on acquire, as FileLock already does. Before, blocking=0 waited out the full timeout on a contended ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (#908) by @​abhishekcpp007 and @​gaborbernat.

New Contributors

• @​abhishekcpp007 made their first contribution in tox-dev/filelock#908

🐍 PyPI release

📜 Full Changelog

4.2.8

Documentation

• Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (#905) by @​boyfeiyu.

New Contributors

• @​boyfeiyu made their first contribution in tox-dev/filelock#905

🐍 PyPI release

📜 Full Changelog

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-10:

---

4.2.10 (2026-11-09)

---

.. _release-4-2-10-fixed:

Fixed

• Contended :class:~filelock.FileLock and :class:~filelock.SoftFileLock acquisitions now raise :class:~filelock.Timeout when elapsed time reaches the requested timeout. A clock that landed exactly on the deadline previously left a waiter retrying with zero-length sleeps indefinitely (:pr:922) by :user:gaborbernat.

.. _release-4-2-10-packaging:

Packaging

• Every wheel now carries a PEP 770 <https://peps.python.org/pep-0770/>_ CycloneDX SBOM in its .dist-info/sboms directory, written at build time by python-sbom <https://github.com/tox-dev/python-sbom>_ (:pr:921) by :user:gaborbernat.

.. _release-4-2-9:

---

4.2.9 (2026-11-04)

---

.. _release-4-2-9-fixed:

Fixed

• :class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers now raise :class:TypeError for a blocking that is not a :class:bool, in the constructor and on acquire, as :class:~filelock.FileLock already does. Before, blocking=0 waited out the full timeout on a contended :class:~filelock.ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (:pr:908) by :user:abhishekcpp007 and :user:gaborbernat.

.. _release-4-2-8:

... (truncated)

Commits

• f9e5621 release 4.2.10
• e824091 📦 build(sbom): ship a PEP 770 SBOM in wheels (#921)
• 2e1eaaa 🐛 fix(api): expire at the exact timeout (#922)
• 8b6a40d 🔧 build(lint): adopt simplint 0.8.0 (#918)
• bfd7360 🧹 ci: pin shared workflows to 6.7.2 (#916)
• 4e116d1 🧹 ci: pin shared workflows to 6.7.1 (#915)
• 7f0351d 👷 ci: run every hook under the cooldown (#914)
• b57bd7b 🔒 fix(docker): pin images and pip installs by hash (#912)
• 1581e39 👷 ci: dry-run the release in the PR gate (#911)
• 179df40 🔎 fix(type): annotate lock for ty 0.0.99 (#913)
• Additional commits viewable in compare view

Updates platformdirs from 4.14.3 to 4.14.5

Release notes

Sourced from platformdirs's releases.

4.14.5

Bug fixes

• Resolve the temporary user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (#687) by @​darrenhuai and @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

4.14.4

🐍 PyPI release

📜 Full Changelog

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-14-5:

---

4.14.5 (2026-11-04)

---

.. _release-4-14-5-fixed:

Fixed

• Resolve the temporary :func:~platformdirs.user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (:pr:687) by :user:darrenhuai and :user:gaborbernat.

.. _release-4-14-4:

---

4.14.4 (2026-11-04)

---

.. _release-4-14-3:

---

4.14.3 (2026-11-01)

---

.. _release-4-14-3-fixed:

Fixed

• Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (:pr:679) by :user:mikegit123git and :user:gaborbernat.

.. _release-4-14-2:

---

4.14.2 (2026-10-31)

---

.. _release-4-14-2-fixed:

... (truncated)

Commits

• 6a7d284 release 4.14.5
• c9ad21d 🐛 fix(unix): avoid // in the runtime fallback when the temp dir is / (#687)
• cf51ebd release 4.14.4
• 573a192 👷 ci: adopt shared workflows and dependency hygiene (#685)
• 9008466 build(deps): refresh project lock (#684)
• 246e9ad Bump the "dependencies" group with 2 updates across multiple ecosystems (#683)
• d4064eb 👷 ci(scorecard): publish OpenSSF results (#682)
• f9323b0 🔧 build(deps): use release-creator 4.4 (#681)
• eb0cce8 👷 ci(news): stop cancelling the news check (#680)
• See full diff in compare view

Updates py-serializable from 2.1.0 to 2.2.0

Release notes

Sourced from py-serializable's releases.

v2.2.0 (2026-11-06)

Documentation

• Chaneglog to pyproject (c5369a8)

Features

• Support python 3.15 (#216, b899141)

---

Detailed Changes: v2.1.0-rc.2...v2.2.0

Changelog

Sourced from py-serializable's changelog.

CHANGELOG

Commits

• 603c274 chore(release): 2.2.0
• 3534af2 chore(deps-dev): update pyupgrade requirement from 3.20.0 to 3.21.0 (#192)
• b899141 feat: support python 3.15 (#216)
• c5369a8 docs: chaneglog to pyproject
• fe7f740 chore(deps): update sphinx requirement from <9,>=8 to >=8.1.3,<9 (#213)
• 582c8cd chore(deps): update sphinx-rtd-theme requirement (#211)
• 2e10405 chore(deps): update sphinx-autoapi requirement from <4,>=3 to >=3.8.1,<4 (#210)
• f71921f chore(release): 2.1.0-rc.2
• b6cf797 chore: prep next test build
• c100f35 chore(release): 2.1.0-rc.1
• Additional commits viewable in compare view

Updates coverage from 7.17.0 to 7.17.2

Release notes

Sourced from coverage's releases.

7.17.2

Version 7.17.2 — 2026-11-04

• Fix: two different scenarios failed with “attempt to write a readonly database”. These were regressions in 7.17.1. They are fixed, closing issue 2356:
  • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.
  • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can’t read is now reported like any other unusable data file, and is left in place.

➡️  PyPI page: coverage 7.17.2. :arrow_right:  To install: python3 -m pip install coverage==7.17.2

7.17.1

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167 and issue 2337.
• Fix: the HTML report only rewrites a file’s page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.
• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message “total of 0.4 is less than fail-under=0.5”. Previously, the comparison rounded the total to zero and the message could claim “1 is less than 0”. Closes issue 2295.
• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.
• Fix: --source=/ measured no files. A file system root can’t be a source directory, so now it is an error. Closes issue 2291.
• In an abundance of caution, prevent forged SQLite journal files from deleting files they shouldn’t.

➡️  PyPI page: coverage 7.17.1. :arrow_right:  To install: python3 -m pip install coverage==7.17.1

Changelog

Sourced from coverage's changelog.

Version 7.17.2 — 2026-11-04

• Fix: two different scenarios failed with "attempt to write a readonly database". These were regressions in 7.17.1. They are fixed, closing issue 2356_:

  • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.

  • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can't read is now reported like any other unusable data file, and is left in place.

.. _issue 2356: coveragepy/coveragepy#2356

.. _changes_7-17-1:

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167_ and issue 2337_.

• Fix: the HTML report only rewrites a file's page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.

• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message "total of 0.4 is less than fail-under=0.5". Previously, the comparison rounded the total to zero and the message could claim "1 is less than 0". Closes issue 2295_.

• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.

• Fix: --source=/ measured no files. A file system root can't be a source directory, so now it is an error. Closes issue 2291_.

... (truncated)

Commits

• d0d3e1d docs: combine the two 'combine' failure descriptions
• 33cb85f fix: don't initialize a data file we can only read (#2360)
• 6e71bac docs: prep for 7.17.2
• 8273f72 test: fix two tests that failed on the Rocky 8 old_sqlite job
• ce216fd build: a test environment for old version of SQLite
• 36e4a18 fix: combine failed on SQLite<3.34.0 #2356
• d80ed19 build: bump version to 7.17.2
• 1941ee1 docs: prep for 7.17.1
• 474bba1 chore: make upgrade
• 1ab58b3 chore: bump the action-dependencies group with 6 updates (#2355)
• Additional commits viewable in compare view

Updates importlib-metadata from 9.0.0 to 10.2.0

Changelog

Sourced from importlib-metadata's changelog.

v10.2.0

Features

• Restored csv, inspect, json, zipfile, _adapters, and importlib.metadata to module scope, where a reader can see what the module depends on, instead of hiding them in the functions that use them for performance. They are declared in __lazy_modules__ and so stay deferred, and deferred alike on every supported Python: 3.15 honors the declaration natively (PEP 810) and earlier Pythons reach the same behavior through the lazy-importer backport, which is now a dependency there. (#554)

Bugfixes

• MetadataPathFinder is now installed on sys.meta_path only after the module is fully initialized. Previously it was installed partway through, so anything walking sys.meta_path during that window, such as another thread calling entry_points(), would raise NameError: name 'PathDistribution' is not defined. An import interrupted in that window left the half-built finder installed for the life of the process, failing every subsequent lookup. (#525)
• Return License-File, Import-Name, and Import-Namespace as lists in JSON-compatible metadata, including when only one value is present, and retain all repeated values as required by PEP 566.

Improved Documentation

• Added a caveats page describing how this package and importlib.metadata interoperate: the two class hierarchies, the protocols both satisfy, and what that asks of consumers and of custom providers. (#505)

v10.1.0

Features

• Detecting whether a distribution supplies metadata no longer reads or parses that metadata where the metadata directory can be inspected instead, so retrieving a distribution by name, which prefers the valid candidates, is substantially faster.
• Reverted the preference for the greater metadata directory added in v9.1.0. The ordering was lexicographic on the directory name and not on the parsed version, so it only approximated a preference for the newer version. Where a path supplies more than one metadata directory for a distribution, discovery once again reports them in the order the path supplies python/cpython#100666

... (truncated)

Commits

• 7e35ac1 Finalize
• 93b8d15 Merge pull request #545 from kokotatan/fix-json-multiple-use-metadata
• 57db4ad Merge pull request #557 from python/feature/eager-imports
• 43c451e Keep only the lazy import test that is about this package.
• 61af6b3 Import the adapters as a module where that is possible.
• 1d5a2ce Merge pull request #556 from python/bugfix/525-install-after-init
• fa2b269 Stop returning the class from install.
• 579d2e9 Move the install expectation to tests/compat.
• c52e108 Carry the rationale in install, not at the call site.
• 8495a7f Resolve a lazy name before isinstance.
• Additional commits viewable in compare view

Updates mypy-extensions from 1.1.0 to 1.2.0

Commits

• 35af63f Change version to 1.2.0 (drop -dev)
• ef995d3 Add i8, u64, u32 and u16 native integer types (#78)
• c03837c Drop support for Python 3.8 and 3.9, officially support 3.14 and 3.15 (#79)
• a6221ad Permit building with flit core 4 (#76)
• 9fc7fe0 Bump version for development (#62)
• See full diff in compare view

Updates zipp from 4.1.0 to 4.1.2

Changelog

Sourced from zipp's changelog.

v4.1.2

No significant changes.

v4.1.1

Bugfixes

• Correct ! negation and literal ^ characters in character classes in Path.glob and Path.rglob, without matching path separators.

Commits

• 7dff886 Finalize
• 450ce6d Merge pull request #165 from jaraco/debt/port-cpython-test-changes
• 7a877ce Add an enterContext shim for Python 3.10.
• b710a37 gh-81954: Warn when ZipFile is closed with unwritten data (#152354)
• f59d511 gh-137589: Zipfile tests: close file objects (GH-138080)
• 45585fc Doc: More duplicate word fixes (GH-136299)
• 8f98e1b Finalize
• b0911d5 Merge pull request #162 from kokotatan/fix-glob-character-classes
• 02adfb7 Address review feedback.
• f5078d5 Merge pull request #163 from jaraco/skeleton-update
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions