[dependabot]

Bumps the dependencies group with 4 updates in the / directory: actions/setup-python, actions/download-artifact, actions/upload-artifact and pypa/gh-action-pypi-publish.

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• See full diff in compare view

Bumps the dependencies group with 6 updates in the / directory:

Package	From	To
pre-commit	4.6.2	4.7.0
setuptools-scm	10.2.1	10.3.4
towncrier	25.8.0	26.9.0
tox-uv	1.36.0	1.37.0
coverage	7.16.0	7.17.0
setuptools	84.0.0	84.2.1

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Commits

• 65bb884 v4.7.0
• 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
• 860d07d don't leak GIT_* env into npm install for language: node
• 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
• 9905e88 use contextlib.chdir
• 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
• 2be1701 remove triple-nested withs for 3.14 coverage
• 4c8d22a py311+
• c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
• f49e251 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates setuptools-scm from 10.2.1 to 10.3.4

Release notes

Sourced from setuptools-scm's releases.

setuptools-scm v10.3.4

Fixed

• Ship the tracked files of projects whose pyproject.toml sits in a subdirectory of the checkout. root defaults to the project directory, so version inference correctly finds no SCM there and answers from SETUPTOOLS_SCM_PRETEND_VERSION or fallback_version -- but that says nothing about which files git tracks, and the sdist and wheel came out with none of them. This was the 10.3.0 regression fixed in 10.3.3, surviving in the subdirectory layout.

  File discovery now follows the checkout the project sits in, independently of the root that scopes versioning, and records scm_file_list.json in the egg-info as a root-level project already did. (#1543)

• Require vcs-versioning>=2.5.0. The subdirectory file-discovery fix (#1543) imports discover_file_workdir, which no earlier release has, while the declared floor still named 2.4.0 -- an install against a published vcs-versioning raised ImportError during the build. (#1546)

setuptools-scm v10.3.3

Fixed

• Keep file discovery working when the version is pretended. SETUPTOOLS_SCM_PRETEND_VERSION and its scoped _FOR_<DIST> form made version inference return before discovering a workdir, and the egg_info mixin read the absent workdir as "searched, found no checkout" -- the signal it acts on by suppressing the setuptools.file_finders chain. Every SCM-tracked file that setuptools' own package discovery does not find was then dropped from the sdist and the wheel, silently, since the build succeeded and the version was correct.

  A pretended version still skips discovery, because most builds only want a version and probing for a checkout nobody asks about costs subprocesses for nothing. What no longer happens is passing that off as an answer: "nobody looked yet" is now distinct from "looked and found nothing", and the workdir is discovered on demand the first time a consumer needs a file list.

  scm_file_list.json is now written to the egg-info for pretended builds as well. It describes which files the checkout tracks, which a pretended version says nothing about. scm_version.json stays absent there, because a pretended version must not be recorded as what the SCM said. (#1540)

setuptools-scm v10.3.2

Fixed

• Stop the command mixins from reordering a project's own build_py, egg_info or bdist_wheel MRO. ScmVersionFileMixin and friends inherited from the corresponding setuptools command, so wrapping a project class built on a disjoint hierarchy -- distutils.command.build_py, or the standalone wheel package's bdist_wheel -- placed setuptools' command ahead of the project's class. setuptools.build_py.run() does not delegate any further, so the project's

... (truncated)

Commits

• b27f597 Merge pull request #1545 from pypa/release/main
• aa18322 Prepare release: setuptools-scm v10.3.4, vcs-versioning v2.5.0
• e40176e Merge pull request #1551 from RonnyPfannschmidt/fix/version-missing-accepts-tool
• 873d4b3 fix(vcs-versioning): accept tool= in _version_missing again
• 5173a1e Merge pull request #1546 from RonnyPfannschmidt/fix/dependency-floor-runs-the...
• cbcd429 fix(deps): require vcs-versioning>=2.5.0.dev0
• 5f95612 ci(dependency-floor): run the testsuite, not just the imports
• e377730 Merge pull request #1544 from RonnyPfannschmidt/fix/file-discovery-follows-th...
• 98fa24d fix(file-discovery): follow the checkout, not the versioning root
• 41edffe Merge pull request #1538 from pypa/release/main
• Additional commits viewable in compare view

Updates towncrier from 25.8.0 to 26.9.0

Release notes

Sourced from towncrier's releases.

Towncrier 26.9.0

Features

• towncrier build now support setting the date via the SOURCE_DATE_EPOCH specification. This adds support for Reproducible Builds. ([#746](https://github.com/twisted/towncrier/issues/746) <https://github.com/twisted/towncrier/issues/746>_)
• Wrapped line length can now be configured by setting wrap to an integer value greater than 0, using 79 by default if set to true. ([#464](https://github.com/twisted/towncrier/issues/464) <https://github.com/twisted/towncrier/issues/464>_)
• The towncrier create command line tool now has the --sub-issue option that is used when creating multiple fragments for the same issue number. ([#714](https://github.com/twisted/towncrier/issues/714) <https://github.com/twisted/towncrier/issues/714>_)

Bugfixes

• towncrier create now rejects fragment names whose issue identifier contains .. ([#733](https://github.com/twisted/towncrier/issues/733) <https://github.com/twisted/towncrier/issues/733>_)

Misc

• [#719](https://github.com/twisted/towncrier/issues/719) <https://github.com/twisted/towncrier/issues/719>, [#729](https://github.com/twisted/towncrier/issues/729) <https://github.com/twisted/towncrier/issues/729>, [#736](https://github.com/twisted/towncrier/issues/736) <https://github.com/twisted/towncrier/issues/736>, [#741](https://github.com/twisted/towncrier/issues/741) <https://github.com/twisted/towncrier/issues/741>, [#747](https://github.com/twisted/towncrier/issues/747) <https://github.com/twisted/towncrier/issues/747>_

Towncrier 26.9.0rc1

Features

• towncrier build now support setting the date via the SOURCE_DATE_EPOCH specification. This adds support for Reproducible Builds. ([#746](https://github.com/twisted/towncrier/issues/746) <https://github.com/twisted/towncrier/issues/746>_)
• Wrapped line length can now be configured by setting wrap to an integer value greater than 0, using 79 by default if set to true. ([#464](https://github.com/twisted/towncrier/issues/464) <https://github.com/twisted/towncrier/issues/464>_)
• The towncrier create command line tool now has the --sub-issue option that is used when creating multiple fragments for the same issue number. ([#714](https://github.com/twisted/towncrier/issues/714) <https://github.com/twisted/towncrier/issues/714>_)

Bugfixes

• towncrier create now rejects fragment names whose issue identifier contains .. ([#733](https://github.com/twisted/towncrier/issues/733) <https://github.com/twisted/towncrier/issues/733>_)

Misc

• [#719](https://github.com/twisted/towncrier/issues/719) <https://github.com/twisted/towncrier/issues/719>, [#729](https://github.com/twisted/towncrier/issues/729) <https://github.com/twisted/towncrier/issues/729>, [#736](https://github.com/twisted/towncrier/issues/736) <https://github.com/twisted/towncrier/issues/736>, [#741](https://github.com/twisted/towncrier/issues/741) <https://github.com/twisted/towncrier/issues/741>, [#747](https://github.com/twisted/towncrier/issues/747) <https://github.com/twisted/towncrier/issues/747>_

Changelog

Sourced from towncrier's changelog.

towncrier 26.9.0 (2026-09-04)

No significant changes since the previous release candidate.

Features

• towncrier build now support setting the date via the SOURCE_DATE_EPOCH specification. This adds support for Reproducible Builds. ([#746](https://github.com/twisted/towncrier/issues/746) <https://github.com/twisted/towncrier/issues/746>_)
• Wrapped line length can now be configured by setting wrap to an integer value greater than 0, using 79 by default if set to true. ([#464](https://github.com/twisted/towncrier/issues/464) <https://github.com/twisted/towncrier/issues/464>_)
• The towncrier create command line tool now has the --sub-issue option that is used when creating multiple fragments for the same issue number. ([#714](https://github.com/twisted/towncrier/issues/714) <https://github.com/twisted/towncrier/issues/714>_)

Bugfixes

• towncrier create now rejects fragment names whose issue identifier contains .. ([#733](https://github.com/twisted/towncrier/issues/733) <https://github.com/twisted/towncrier/issues/733>_)

Misc

• [#719](https://github.com/twisted/towncrier/issues/719) <https://github.com/twisted/towncrier/issues/719>, [#729](https://github.com/twisted/towncrier/issues/729) <https://github.com/twisted/towncrier/issues/729>, [#736](https://github.com/twisted/towncrier/issues/736) <https://github.com/twisted/towncrier/issues/736>, [#741](https://github.com/twisted/towncrier/issues/741) <https://github.com/twisted/towncrier/issues/741>, [#747](https://github.com/twisted/towncrier/issues/747) <https://github.com/twisted/towncrier/issues/747>_

Commits

• 12e95a9 Prepare final release.
• 7f5ef06 Initial commit.
• 1598380 #746 Reproducible build source date epoch (#749)
• b2df9f8 Merge branch 'trunk' into 746-reproducible-build-source-date-epoch
• dc07055 Update release for single line.
• 1e46459 docs: Clarify the defaults for build timestamp values.
• 803dbc5 Specify the precedence order for computing the build date.
• 434bf70 Show an example of 'SOURCE_DATE_EPOCH' in the Tutorial.
• 48f8b3d Document the 'SOURCE_DATE_EPOCH' behaviour for towncrier build.
• 9f899f5 Document the user-facing change in a Towncrier news fragment.
• Additional commits viewable in compare view

Updates tox-uv from 1.36.0 to 1.37.0

Release notes

Sourced from tox-uv's releases.

1.37.0

Features

• Require Python 3.11 (#383) by @​gaborbernat.

Changes

• Use Python 3.15 by default (#383) by @​gaborbernat.

🐍 PyPI: tox-uv

📜 Full Changelog

1.36.1

Bug fixes

• Honor VIRTUALENV_SYSTEM_SITE_PACKAGES when choosing the default for system_site_packages (#376) by @​glaziermag.
• Align the installer with tox 4.59 API changes (#366) by @​gaborbernat.

New Contributors

• @​glaziermag made their first contribution in #376

🐍 PyPI: tox-uv

📜 Full Changelog

Changelog

Sourced from tox-uv's changelog.

1.37.0 (2026-10-10)

Added

• Require Python 3.11 (#383) by @​gaborbernat.

Changes

• Use Python 3.15 by default (#383) by @​gaborbernat.

1.36.1 (2026-09-29)

Fixed

• Honor VIRTUALENV_SYSTEM_SITE_PACKAGES when choosing the default for system_site_packages (#376) by @​glaziermag.
• Align the installer with tox 4.59 API changes (#366) by @​gaborbernat.

Commits

• 808fc71 feat(python): require 3.11 and default to 3.15 (#383)
• 4ba64cf ci: build release packages in parallel (#382)
• 22305ed [pre-commit.ci] pre-commit autoupdate (#381)
• f5a8233 👷 ci: pin ubuntu-26.04 and bump dependencies (#380)
• 0cfb305 build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
• 64ca6b5 [pre-commit.ci] pre-commit autoupdate (#378)
• 8f4da88 build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
• 5f772db 🐛 fix(venv): honor VIRTUALENV_SYSTEM_SITE_PACKAGES for the system_site_packag...
• b1dddaf [pre-commit.ci] pre-commit autoupdate (#375)
• 915d957 [pre-commit.ci] pre-commit autoupdate (#374)
• Additional commits viewable in compare view

Updates coverage from 7.16.0 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.
• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
• Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.
• Fixes for obscure but legal file names:
  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.
  • A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.
• Fixes in the implementation of the C tracer:
  • If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.
  • The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.
  • The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.
  • An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.
• Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.
• Performance: HTML reports should be about 5% faster to produce.
• Kept the political banner in the README. Closes issue 2344.

➡️  PyPI page: coverage 7.17.0. :arrow_right:  To install: python3 -m pip install coverage==7.17.0

7.16.2

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

7.16.1

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
• Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.
• Fix: the Total row in the footer of the HTML report’s index page was recomputed in JavaScript with rounding that could disagree with the total the server rendered in the heading, including showing 100% when coverage was not complete. The footer now clamps values the way the rest of the report does, and when nothing is filtered out it is shown exactly as the server rendered it, so the two can’t disagree. That also keeps rows the report omits (--skip-covered drops fully covered files) in the total. Fixes issue 2256.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

Changelog

Sourced from coverage's changelog.

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.

• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987_.

• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314_.

• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.

• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.

• Fix: The "Can't combine statement coverage data with branch data" error now names the two data files it couldn't combine. The :ref:error description <error_cant_combine> in the docs now lists common causes and how to find the process that wrote the file.

• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293_ and issue 2294_.

• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338_.

• Fixes for obscure but legal file names:

  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and ``coverage debug

... (truncated)

Commits

• 393ac71 docs: prep for 7.17.0
• 14257d3 test: check that 100% files haven't lost coverage
• db056ac docs: keep the ukraine banner #2344
• 6033660 fix: update the data file hash when a parallel data file is saved again (#2339)
• 99024b5 fix: clamp rate in XML report to prevent false 1.0/0.0 rounding and scientifi...
• ff62a02 refactor: remove unused caching branches
• 24d0b67 fix: KeyError for a with statement at the end of a finally clause (#2336)
• 934f5b8 chore: upgrade pip==26.2.2 certifi==2026.10.19
• f95c980 fix: triply nested with statements don't cause false branch misses #1987
• 6aaa858 docs: more changelog gardening
• Additional commits viewable in compare view

Updates setuptools from 84.0.0 to 84.2.1

Changelog

Sourced from setuptools's changelog.

v84.2.1

Bugfixes

• Changed wheel tags and stable-ABI validation to use sysconfig data. (#5360)
• Fixed unimportable extensions on free-threaded Python 3.13 and 3.14 when Extension.py_limited_api is enabled. These builds now use their version-specific extension suffix instead of using the unsupported .abi3t suffix. (#5363)

Improved Documentation

• Replaced broken link to Python Eggs documentation with an archived version from the Wayback Machine. (#1929)

v84.2.0

Features

• Added support for building abi3t extensions and abi3.abi3t wheels on Python 3.15 and newer. See :pep:803 and the Python 3.15 "What's New" entry <https://docs.python.org/3.15/whatsnew/3.15.html#pep-803-abi3t-stable-abi-for-free-threaded-builds>_ for more details. (#5193)
• Updated vendored packaging version to 26.3, which adds support for the abi3t tag from :pep:803. (#5361)

Bugfixes

• Use target sysconfig data for stable-ABI extension filenames. (#5351)

v84.1.0

Features

• setuptools.archive_util now raises the new UnsafeMember exception when an archive member would be extracted outside of the extraction directory, where previously such a member was silently skipped. Aborting makes a malicious or malformed archive visible to the caller instead of yielding a quietly incomplete extraction, and matches the behavior of the standard

... (truncated)

Commits

• 3895f98 Bump version: 84.2.0 → 84.2.1
• 7c5cb7a Merge pull request #5362 from jameshilliard/fix/abi3t-target-config
• 00595bf Use sysconfig data for wheel tags and stable-ABI validation
• 873b29c Merge pull request #5363 from ngoldbaum/fix-3.14t
• d8bc01b Merge pull request #5330 from Topgearfanboy/main
• e27271e Apply review comments from @​jameshillard
• aa98f85 add newsfragment
• 3301fa6 Avoid .abi3t extension suffixes on Python 3.13t and 3.14t
• 301e27a Bump version: 84.1.0 → 84.2.0
• 39a7c2e Merge pull request #5193 from ngoldbaum/abi3.abi3t
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Thank you for your pull request! Unfortunately, CI checks for this pull request are failing because you haven't included a change note in your contribution. Details on creating a change note can be found in the BeeWare Contribution Guide.