Bump the all-dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #427 · Contrast-Security-OSS/integration-verify-github-action

dependabot · 2026-11-02T23:33:23Z

Bumps the all-dependencies group with 5 updates in the / directory:

Package	From	To
filelock	`4.2.4`	`4.2.5`
nodeenv	`1.11.0`	`1.11.1`
platformdirs	`4.13.5`	`4.14.0`
pytest	`9.1.1`	`9.2.0`
virtualenv	`21.14.13`	`21.15.2`

Updates filelock from 4.2.4 to 4.2.5

Release notes

Sourced from filelock's releases.

4.2.5

Bug fixes

acquire and acquire raise TypeError for a blocking that is not a bool, as the constructor and the blocking setter already do. A truthy value such as the string "false" used to count as True, so a call meant as a single attempt waited for the instance's timeout, and without a limit at the default -1 (#870) by @simpleqt and @gaborbernat.

A SoftFileLock acquisition whose first read of its new marker's identity failed reads it again before rolling back. On Windows the rollback could otherwise not recognize the marker it had created, and the empty marker it left blocked the path for every later acquisition, since no contender breaks an empty marker (#869) by @simpleqt and @gaborbernat.

A fork() child of a process holding a SoftFileLease starts from an unheld claim. It used to inherit the parent's token, last compromise and heartbeat, so token and compromise reported a claim the child never held while is_locked reported it unheld (#868) by @dxbjavid and @gaborbernat.

A nested acquire of a held FileLock or SoftFileLock no longer creates the lock file's parent directory. After a rename of that directory during the hold, the nested acquire recreated the old name, and when a file had taken the name it raised FileExistsError and left the hold's recursion count incremented (#878) by @0x5t4l1n and @gaborbernat.

Fix ReadWriteLock failing every acquire with "link directory ... was replaced while opening" in a group-writable directory whose inherited ACL, such as an NFSv4 one on ZFS, opens the link directory to the group. The lock now closes the empty link directory to its owner, and where the filesystem refuses that, such as ZFS with aclmode=restricted, it names the directory to make writable by its owner only (#898) by @gaborbernat.

Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease raising OverflowError out of acquire(), or never reclaiming a dead holder's lock, when a stranded restore claim beside the lock names a process number outside 1..2**31-1 or spells it in non-ASCII digits. Such a claim is now ignored, as no filelock writes one (#871) by @dxbjavid and @gaborbernat.

Fix soft locks on Windows keeping the marker of a holder that has exited while another process still holds a handle to it, such as a parent's subprocess.Popen after wait() or multiprocessing.Process after join(). Acquiring such a lock with the default timeout=-1 waited forever (#874) by @nk-batman21.

Fix the read-only reopen of a lock file this account cannot write resolving a relative path against the working directory of the moment. A chdir between the refused O_RDWR open and the reopen made the acquisition wait on a file that is not there, or probe one in another directory. The reopen now uses the path the acquisition pinned (#889) by @dxbjavid and @gaborbernat.

Handle EMLINK, the error FreeBSD reports when a no-follow open refuses a symlink, in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership there rather than a transient refresh error (#866) by @pacocartones and @gaborbernat.

Resolving ReadWriteLock or AsyncReadWriteLock raises the ImportError when a module other than Python's sqlite3 is missing, as in a frozen application that left out a filelock submodule. The names are None only without SQLite (#880) by @pintu544 and @gaborbernat.

Documentation

The lock-probing recipe in the how-to guide probes with blocking=False instead of a tiny timeout (#873) by @tongwentao and @gaborbernat.

Packaging

Releases now run on the shared tox-dev/github-workflows pipeline, with a locked release toolchain and generated GitHub Release notes (#885) by @gaborbernat.

New Contributors

@simpleqt made their first contribution in tox-dev/filelock#869

@KennyMcSimpson made their first contribution in tox-dev/filelock#875

@0x5t4l1n made their first contribution in tox-dev/filelock#878

@tongwentao made their first contribution in tox-dev/filelock#873

@pacocartones made their first contribution in tox-dev/filelock#866

@nk-batman21 made their first contribution in tox-dev/filelock#874

@pintu544 made their first contribution in tox-dev/filelock#880

@00200200 made their first contribution in tox-dev/filelock#877

PyPI release

Full Changelog

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-7:

4.2.7 (2026-11-02)

.. _release-4-2-7-fixed:

Fixed

A :class:~filelock.SoftFileLease reclaims a dead holder's lease marker even when that holder published another lease_duration. It used to raise :class:~filelock.LeaseSettingsMismatch on every attempt instead, so after a holder crashed and its peers restarted with a changed duration the lock stayed wedged until :meth:force_break() <filelock.MarkerSoftFileLock.force_break>. A live holder with another duration still raises (:pr:900) by :user:dxbjavid and :user:gaborbernat.

.. _release-4-2-6:

4.2.6 (2026-10-31)

.. _release-4-2-6-fixed:

Fixed

Fix a race in :class:~filelock.SoftFileLock, :class:~filelock.MarkerSoftFileLock and :class:~filelock.SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (:pr:899) by :user:dxbjavid and :user:gaborbernat.

.. _release-4-2-5:

4.2.5 (2026-10-30)

.. _release-4-2-5-fixed:

... (truncated)

Commits

b0cc007 release 4.2.5
21bc250 🐛 fix(rw): close a link directory an ACL opened (#898)
715a8de 📝 docs(security): add a threat model and align the policy (#896)
b0f1b73 🧪 test: tolerate a preloaded sqlite3 (#894)
a2e26ac 🧪 test: count descriptors behind an incomplete /dev/fd (#877)
160141c 🐛 fix(import): raise for a missing read-write module (#880)
cb18d9e 🐛 fix(win32): reclaim a soft lock from an exited holder (#874)
adbcde9 🐛 fix(lease): reset the claim in a fork child (#868)
193c7dd 🐛 fix(soft-rw): treat FreeBSD's EMLINK as a symlink refusal (#866)
9a70a71 📝 docs(how-to): probe with blocking=False (#873)
Additional commits viewable in compare view

Updates nodeenv from 1.11.0 to 1.11.1

Release notes

Sourced from nodeenv's releases.

1.11.1

What's Changed

Fixed bugs 🐛

fix(nodeenv): skip node.js pre-releases for latest and ranges by @ekalinin in ekalinin/nodeenv#454

1.11.1 is 1.11.0 plus this fix only. nodejs.org now lists 27.0.0-alpha.0.0.0 first, and nodeenv stopped with a traceback when it used the default latest or a semver range (#453).

Full Changelog: ekalinin/nodeenv@1.11.0...1.11.1

Changelog

Sourced from nodeenv's changelog.

Version 1.11.1

latest, the default, and semver ranges such as --node=26 no longer pick pre-releases: once nodejs.org listed 27.0.0-alpha.0.0.0, both stopped with a traceback. An exact pre-release, such as --node=27.0.0-alpha.0.0.0, installs instead of crashing as well [#453](https://github.com/ekalinin/nodeenv/issues/453) <https://github.com/ekalinin/nodeenv/issues/453>_

Commits

b94e6f5 chore(release): bump nodeenv version to 1.11.1
ac52b66 fix(nodeenv): skip node.js pre-releases for latest and ranges
See full diff in compare view

Updates platformdirs from 4.13.5 to 4.14.0

Release notes

Sourced from platformdirs's releases.

4.14.0

Features

Accept a keyword-only ensure_exists in the module-level media directory functions, such as user_documents_path, to create a directory set through XDG_*_DIR or user-dirs.dirs (#656) by @darrenhuai and @gaborbernat.

Bug fixes

Return the media and fonts directories under root's home for root with use_site_for_root, ignoring the invoking user's XDG_*_DIR, user-dirs.dirs and XDG_DATA_HOME, and create no inherited media directory under ensure_exists (#661) by @gaborbernat.

Raise ValueError from site_data_dir and site_config_dir under multipath=True when appname or version contains os.pathsep, rather than returning a string that splits into a directory outside the site base (#662) by @gaborbernat.

Parse an unquoted user-dirs.dirs value with a long run of blanks in linear time, rather than in time quadratic in the run's length on every Unix media directory lookup (#663) by @gaborbernat.

Treat a relative HOME as unset on Unix, macOS and iOS, taking the home from the password database or raising RuntimeError, rather than resolving user directories against the working directory (#664) by @gaborbernat.

Refuse a symlink as XDG_RUNTIME_DIR in user_runtime_dir when the value ends with / or /., which made the check follow the link (#665) by @gaborbernat.

Redirect user_*_dir calls with use_site_for_root=True when the effective uid is 0, so a setuid-root process gets the site directories, and name and check the runtime directory by the effective uid (#666) by @gaborbernat.

Apply the XDG_RUNTIME_DIR check of the Unix user_runtime_dir to the macOS one, so it no longer uses a directory that is a symlink, owned by another user or not mode 0700 (#667) by @gaborbernat.

Reject an XDG_RUNTIME_DIR below a parent that another user can replace, such as their own entry in /tmp, instead of creating the runtime directory through it (#668) by @gaborbernat.

Stop accepting a Unix runtime directory that another user creates between the owner check and its use: ensure_exists and place_runtime_file create it before checking it, and find_runtime_file checks it again after a hit (#669) by @gaborbernat.

Raise PermissionError on macOS when ensure_exists would create the site cache through a /Library/Caches/$appname that is a symlink, not a directory, or owned by a user other than root and the current one (#670) by @gaborbernat.

With ensure_exists, raise FileExistsError when a configured media directory such as user_documents_dir is a regular file or a symlink to one, instead of returning the file's path. Dangling symlinks are still returned unchanged (#672) by @rupayon123 and @gaborbernat.

New Contributors

@rupayon123 made their first contribution in tox-dev/platformdirs#672

PyPI release

Full Changelog

4.13.7

Bug fixes

Fall back to the default media directories when user-dirs.dirs exists but cannot be read, rather than raising PermissionError or IsADirectoryError (#632) by @Debasishhh and @gaborbernat.

Resolve the Windows Projects directory from USERPROFILE when HOME is empty, rather than raising RuntimeError (#635) by @pabszero and @gaborbernat.

Resolve $HOME entries in user-dirs.dirs to /Documents instead of //Documents when the home directory is / (#636) by @darrenhuai and @gaborbernat.

Print the error and keep listing directories in python -m platformdirs when the home directory is unknown, rather than stopping with RuntimeError (#638) by @tongwentao and @gaborbernat.

Raise FileNotFoundError from the place_*_file methods when the user directory is on a missing Windows drive or network share, rather than recursing until RecursionError (#639) by @nk-batman21 and @gaborbernat.

Search the directories of a subclass's overridden iter_*_paths method in find_*_file and find_*_files, rather than the base class ones (#640) by @KennyMcSimpson and @gaborbernat.

Keep isolated_dirs paths under a relative root after the working directory changes, and yield the root as an absolute path (#643) by @0x5t4l1n and @gaborbernat.

Ignore Windows folder overrides with a UNC path missing its server or share name, such as \\server, instead of treating the application name as the share (#647) by @RedCat888 and @gaborbernat.

Documentation

Remove the literal /opt/homebrew from a macOS source comment. Homebrew replaces it with a placeholder when bottling on Apple Silicon but not on Linux, so formulae that bundle platformdirs could not share one bottle across both (#644) by @Moisan and @gaborbernat.

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-14-3:

4.14.3 (2026-11-01)

.. _release-4-14-3-fixed:

Fixed

Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (:pr:679) by :user:mikegit123git and :user:gaborbernat.

.. _release-4-14-2:

4.14.2 (2026-10-31)

.. _release-4-14-2-fixed:

Fixed

Deduplicate equivalent XDG directory spellings across string and path iterators and file searches (:pr:677) by :user:AlvaroBalbin and :user:gaborbernat.

.. _release-4-14-1:

4.14.1 (2026-10-30)

.. _release-4-14-1-fixed:

Fixed

Fall back to the real user ID on platforms without an effective user ID, restoring imports and Unix directory lookups on Pyodide (:pr:676) by :user:mayankdhingra02.

... (truncated)

Commits

c40ff0b release 4.14.0
18620ed 🐛 fix(unix): check XDG_RUNTIME_DIR parents (#668)
3a5e7d0 🐛 fix(api): raise when a media dir is a file (#672)
790ff18 🐛 fix(unix): decide root redirect by effective uid (#666)
7753a02 🔒 fix(macos): refuse planted site cache entries (#670)
9f5ff8a 🐛 fix(macos): pass missing_ok to runtime dir check (#674)
3ee973f 🐛 fix(unix): ignore inherited media vars for root (#661)
a94826e 🐛 fix(unix): parse user-dirs blank runs in linear time (#663)
3b4cf5f 🐛 fix(unix): reject runtime dir symlink with trailing / (#665)
f5b537b 🐛 fix(dirs): treat a relative HOME as unset (#664)
Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

#14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

#8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

#993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;

a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

#14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

#14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

#14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

#14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

#7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

#14743: Full diff: now contains a legend explaining the + & - symbols in diff output.

#2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.

#6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

#10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits

ae1d0ff Prepare release version 9.2.0
143ce31 pre-commit: exclude codespell on generated release announcements
532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
41d12cd docs: clarify typing for yield fixtures
b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
16f87a7 docs: improve getting-started.rst test execution description
082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
Additional commits viewable in compare view

Updates virtualenv from 21.14.13 to 21.15.2

Release notes

Sourced from virtualenv's releases.

21.15.2

Bug fixes

Build the default application data folder only when no folder was given through --app-data, VIRTUALENV_APP_DATA or the configuration file, so --read-only-app-data with an explicit folder works when the default folder is missing, and writable runs stop creating an unused one. Folders from VIRTUALENV_APP_DATA and the configuration file now get the same checks as --app-data (#3488) by @darrenhuai and @gaborbernat.

Build the seed wheel image in a staging folder and move it into place only once it is complete, so an extraction that fails part way, for example on a full disk, after a killed process or on a path over the Windows length limit, no longer leaves a partial image that later runs seed as a pip without METADATA, RECORD or INSTALLER (#3487) by @darrenhuai and @gaborbernat.

Make -p/--python and --try-first-with replace the interpreters set by VIRTUALENV_PYTHON, VIRTUALENV_TRY_FIRST_WITH or the configuration file instead of being merged with them, so the configured interpreter no longer wins over the one asked for and a -p that finds nothing fails instead of falling back to it. Try several VIRTUALENV_PYTHON values in the order given rather than starting with the second (#3494) by @darrenhuai and @gaborbernat.

On Windows, re-create an environment in place when its copied interpreter files, such as python.exe, or its seeded packages are read-only, instead of failing with PermissionError (#3492) by @darrenhuai and @gaborbernat.

Reject an empty or whitespace-only destination. An empty one, and on Windows one made only of spaces, resolved to the current directory, so an unset VENV in virtualenv --clear "$VENV" deleted the working directory. Pass . to create the environment in the current directory (#3491) by @darrenhuai and @gaborbernat.

Restore the default prompt in deactivate.bat when PROMPT was undefined at activation, instead of leaving the environment name in front of it (#3489) by @darrenhuai.

Undefine PATH again in deactivate.bat when it was undefined at activation, instead of leaving the environment's Scripts folder on it, and stop a second activate.bat from adding that folder twice (#3493) by @darrenhuai and @gaborbernat.

PyPI release

Full Changelog

21.15.1

Bug fixes

Keep the name of a seeded console_scripts entry that contains digits but does not end in a version, such as python3-config or 2to3, instead of truncating it at the first digit; python3-config overwrote the environment's python executable (#3451) by @JingHao-Leon and @gaborbernat.

Copy the content of a symlinked directory when a tree is copied into an environment, instead of dropping it (#3454) by @JingHao-Leon and @gaborbernat.

Count each -v, -q, -p and --try-first-with option once instead of once per internal parsing pass, so Session.verbosity is 3 rather than 9 for a single -v (#3457) by @darrenhuai and @gaborbernat.

Copy the seed packages instead of failing when VIRTUALENV_SYMLINK_APP_DATA or symlink_app_data in the config file turns on symlink seeding on a host that cannot create symlinks, such as Windows without the symlink privilege (#3465) by @darrenhuai and @gaborbernat.

Run the interpreter that collects the target debug information (-vv output and Creator.debug) without PYTHONPATH and with the environment passed to cli_run, so the reported sys.path no longer lists the caller's PYTHONPATH entries (#3474) by @RaphaelFakhri and @gaborbernat.

New Contributors

@JingHao-Leon made their first contribution in pypa/virtualenv#3454

@RaphaelFakhri made their first contribution in pypa/virtualenv#3474

@FliegendeWurst made their first contribution in pypa/virtualenv#3468

PyPI release

Full Changelog

21.15.0

Features

Bundle dependencies for Python 3.15 in the standalone zipapp and stop bundling Python 3.8, which is outside the package's supported range (#3458) by @gaborbernat.

Packaging

Publish GitHub Releases with categorized notes from the tagged changelog, retaining the zipapp, SBOM, and PyPI links (#3458) by @gaborbernat.

... (truncated)

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-2:

21.15.2 (2026-10-30)

.. _release-21-15-2-fixed:

Fixed

Build the default application data folder only when no folder was given through --app-data, VIRTUALENV_APP_DATA or the configuration file, so --read-only-app-data with an explicit folder works when the default folder is missing, and writable runs stop creating an unused one. Folders from VIRTUALENV_APP_DATA and the configuration file now get the same checks as --app-data (:pr:3488) by :user:darrenhuai and :user:gaborbernat.

Build the seed wheel image in a staging folder and move it into place only once it is complete, so an extraction that fails part way, for example on a full disk, after a killed process or on a path over the Windows length limit, no longer leaves a partial image that later runs seed as a pip without METADATA, RECORD or INSTALLER (:pr:3487) by :user:darrenhuai and :user:gaborbernat.

Make -p/--python and --try-first-with replace the interpreters set by VIRTUALENV_PYTHON, VIRTUALENV_TRY_FIRST_WITH or the configuration file instead of being merged with them, so the configured interpreter no longer wins over the one asked for and a -p that finds nothing fails instead of falling back to it. Try several VIRTUALENV_PYTHON values in the order given rather than starting with the second (:pr:3494) by :user:darrenhuai and :user:gaborbernat.

On Windows, re-create an environment in place when its copied interpreter files, such as python.exe, or its seeded packages are read-only, instead of failing with PermissionError (:pr:3492) by :user:darrenhuai and :user:gaborbernat.

Reject an empty or whitespace-only destination. An empty one, and on Windows one made only of spaces, resolved to the current directory, so an unset VENV in virtualenv --clear "$VENV" deleted the working directory. Pass . to create the environment in the current directory (:pr:3491) by :user:darrenhuai and :user:gaborbernat.

Restore the default prompt in deactivate.bat when PROMPT was undefined at activation, instead of leaving the environment name in front of it (:pr:3489) by :user:darrenhuai.

Undefine PATH again in deactivate.bat when it was undefined at activation, instead of leaving the environment's Scripts folder on it, and stop a second activate.bat from adding that folder twice (:pr:3493) by :user:darrenhuai and :user:gaborbernat.

.. _release-21-15-1:

21.15.1 (2026-10-28)

... (truncated)

Commits

53c21ee release 21.15.2
a7999ab 🐛 fix(create): reject an empty destination (#3491)
bf99d28 🐛 fix(discovery): let -p replace the python set in config or env (#3494)
9015069 🐛 fix(batch): remember an undefined PATH so deactivate can restore it (#3493)
58c5c10 🐛 fix(create): replace read-only interpreter files on Windows (#3492)
861cff7 🐛 fix(batch): save an undefined PROMPT so deactivate can restore it (#3489)
c279422 ♻️ refactor(seed): pass the build folder explicitly (#3490)
7e8102f 🐛 fix(app-data): build the default folder only when none is given (#3488)
59edf49 🐛 fix(seed): keep partial wheel images out of the cache (#3487)
fc01ea4 👷 ci: lint activate.sh prompt with semgrep (#3483)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [filelock](https://github.com/tox-dev/filelock) | `4.2.4` | `4.2.5` | | [nodeenv](https://github.com/ekalinin/nodeenv) | `1.11.0` | `1.11.1` | | [platformdirs](https://github.com/tox-dev/platformdirs) | `4.13.5` | `4.14.0` | | [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` | | [virtualenv](https://github.com/pypa/virtualenv) | `21.14.13` | `21.15.2` | Updates `filelock` from 4.2.4 to 4.2.5 - [Release notes](https://github.com/tox-dev/filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@4.2.4...4.2.5) Updates `nodeenv` from 1.11.0 to 1.11.1 - [Release notes](https://github.com/ekalinin/nodeenv/releases) - [Changelog](https://github.com/ekalinin/nodeenv/blob/master/CHANGES) - [Commits](ekalinin/nodeenv@1.11.0...1.11.1) Updates `platformdirs` from 4.13.5 to 4.14.0 - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst) - [Commits](tox-dev/platformdirs@4.13.5...4.14.0) Updates `pytest` from 9.1.1 to 9.2.0 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.1.1...9.2.0) Updates `virtualenv` from 21.14.13 to 21.15.2 - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](pypa/virtualenv@21.14.13...21.15.2) --- updated-dependencies: - dependency-name: filelock dependency-version: 4.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: nodeenv dependency-version: 1.11.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: platformdirs dependency-version: 4.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: pytest dependency-version: 9.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: virtualenv dependency-version: 21.15.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Nov 2, 2026

Navigation Menu

Repository navigation

Bump the all-dependencies group across 1 directory with 5 updates - #427

Bump the all-dependencies group across 1 directory with 5 updates#427
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/all-dependencies-3874ab870b

dependabot Bot commented on behalf of github Nov 2, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 2, 2026

4.2.5

Bug fixes

Documentation

Packaging

New Contributors

Fixed

Fixed

1.11.1

What's Changed

Fixed bugs 🐛

Version 1.11.1

4.14.0

Features

Bug fixes

New Contributors

4.13.7

Bug fixes

Documentation

Fixed

Fixed

Fixed

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

New features

Improvements in existing functionality

21.15.2

Bug fixes

21.15.1

Bug fixes

New Contributors

21.15.0

Features

Packaging

Fixed

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants