[dependabot]

Bumps the uv-updates group with 3 updates: cyclopts, pytest and tox.

Updates cyclopts from 5.3.0 to 5.3.2

Release notes

Sourced from cyclopts's releases.

v5.3.2

Bug Fixes

• Fix enum members in a Literal (including Parameter(choices=Literal[...])) being shown as Color.RED in help, completion and errors instead of the name that parses (red) by @​youdie006 in BrianPugh/cyclopts#1033

New Contributors

• @​youdie006 made their first contribution in BrianPugh/cyclopts#1033

Full Changelog: BrianPugh/cyclopts@v5.3.1...v5.3.2

v5.3.1

Bug Fixes

• respect explicit delimiters for path environment values by @​Don-Yin in BrianPugh/cyclopts#1021
• validate Parameter(name="*") behind a type alias at setup time by @​Rahul-cs50 in BrianPugh/cyclopts#1030
• resolve subscripted generic type aliases (#1028) by @​yash-bitla in BrianPugh/cyclopts#1031
• bind config values to a meta app's own parameters (regressed in v4.0.0) by @​BrianPugh in BrianPugh/cyclopts#1027

New Contributors

• @​Don-Yin made their first contribution in BrianPugh/cyclopts#1021
• @​Rahul-cs50 made their first contribution in BrianPugh/cyclopts#1030
• @​yash-bitla made their first contribution in BrianPugh/cyclopts#1031

Full Changelog: BrianPugh/cyclopts@v5.3.0...v5.3.1

Commits

• 146828c Merge pull request #1033 from youdie006/literal-enum-member-choices
• 3f57429 fix: don't crash on a nameless Flag value in a Literal
• 243513d List enum members in a Literal by their transformed name
• 5c217f9 Merge pull request #1027 from BrianPugh/fix/meta-app-config-params
• eea85d9 Merge pull request #1031 from yash-bitla/fix-generic-type-alias-1028
• 3357a6b fix: resolve generic type alias whose value ignores its type parameter
• f98cbb2 fix: validate Parameter(name="*") behind a type alias at setup time
• 79bcb1d fix: resolve subscripted generic type aliases (#1028)
• 3b873e9 docs: trim meta-app config docs and docstring
• 5675265 docs: note that config binds meta app parameters
• Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

• #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

• #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

  Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

• #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

  • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
  • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

  pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

• #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

• #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

• #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

  They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

• #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

• #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

• #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
• #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
• #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

• #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits

• ae1d0ff Prepare release version 9.2.0
• 143ce31 pre-commit: exclude codespell on generated release announcements
• 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
• a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
• 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
• 41d12cd docs: clarify typing for yield fixtures
• b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
• 16f87a7 docs: improve getting-started.rst test execution description
• 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
• ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
• Additional commits viewable in compare view

Updates tox from 4.67.1 to 4.67.4

Release notes

Sourced from tox's releases.

v4.67.4

Bug fixes

• A dependency group entry that refers to the project's own extra with an environment marker, such as demo[dev]; python_version < "3.10", now keeps that marker on the extra's requirements instead of installing them on every interpreter (#4211) by @​ericdelorefice and @​gaborbernat.

PyPI release

Full Changelog

v4.67.3

Bug fixes

• An open-ended factor range whose explicit bound sits outside the supported CPython window no longer expands to nothing. An INI env_list such as py3{16-} used to fail with ValueError: py3{}, and a TOML range dict expanded to an empty axis, dropping that dimension from the matrix (#4176) by @​HyperionBurn and @​gaborbernat.
• A TOML replace = "glob" table now substitutes its pattern and default, matching the INI {glob:PATTERN:DEFAULT} form, so pattern = "{env_name}/*.whl" matches files instead of a literal {env_name} directory (#4180) by @​ag3ntsc4rn and @​gaborbernat. (#4178)
• --force-dep now matches dependency names after PEP 503 normalization, so --force-dep typing-extensions==4.9.0 replaces Typing_Extensions==4.12.2 in deps instead of passing both pins to pip, and replaces a Typing_Extensions requirement from the package metadata, where tox used to drop the forced pin (#4181) by @​ag3ntsc4rn and @​gaborbernat. (#4179)
• {glob:PATTERN:DEFAULT} with a single-letter pattern and an absolute default, such as {glob:z:/fallback}, no longer expands to an empty string on POSIX: tox now looks for a Windows drive letter in the pattern only on Windows (#4183) by @​JingHao-Leon and @​gaborbernat. (#4182)
• A TOML { replace = "env" } table in set_env whose default ends in a backslash now resolves to the variable or the default, instead of the literal {env:...} text (#4185) by @​JingHao-Leon and @​gaborbernat. (#4184)
• --no-index in a requirements file or deps now wins over --index-url and --extra-index-url on the same or a later line, as in pip. Previously tox dropped it and installed from those indexes, and from PyPI too when given an --extra-index-url (#4187) by @​syahra712 and @​gaborbernat.
• A leading UTF-8 byte order mark in pyproject.toml no longer breaks dependency_groups or reading the package's static dependencies from [project], and one in a base_python_file such as .python-version is no longer read as part of the Python version (#4188) by @​pcbeingused333 and @​gaborbernat.
• --parallel auto now counts the CPUs tox may run on instead of every CPU in the machine, so it respects the CPU affinity mask set by taskset or a container's cpuset (and PYTHON_CPU_COUNT on Python 3.13+) (#4190) by @​mehdimirzafaruk and @​gaborbernat.
• A TOML { replace = "ref", env = ..., key = ... } now takes a path (change_dir, env_dir), set (extras, labels, dependency_groups) or environment list (depends) value from another environment, instead of failing validation of the referencing key (#4192) by @​pcbeingused333 and @​gaborbernat.
• --result-json is now always written as UTF-8 instead of the locale's preferred encoding. Captured output that a legacy Windows code page cannot represent, or that holds bytes which are not valid UTF-8, no longer crashes the run at the end with a truncated file; the invalid bytes are stored as \uXXXX escapes (#4194) by @​mehdimirzafaruk and @​gaborbernat.
• Glob character sets such as lint-[ab] and lint-[!a] in an ini depends now load, as the depends reference documents, instead of failing to load the configuration (#4195) by @​nk-batman21 and @​gaborbernat.
• Disable the parallel spinner by default in CI for the legacy command, as tox run-parallel does (#4196) by @​Rodrigo-Palma and @​gaborbernat.
• Leave extras, editables, local directories and source archives out of the constrain_package_deps constraints file, so pip no longer rejects it (#4203) by @​ericdelorefice and @​gaborbernat.
• An empty PYTHONHASHSEED no longer makes every tox command fail with ValueError. tox treats it as unset, as Python does, and picks a random seed (#4205) by @​devYRPauli and @​gaborbernat.

Documentation

• Explain how to quote command arguments built from [vars] values that contain spaces, and how quotes stored in those values pair with the quotes around them (#4197) by @​Blues-berry and @​gaborbernat. (#4191)

New Contributors

• @​devYRPauli made their first contribution in tox-dev/tox#4205
• @​JingHao-Leon made their first contribution in tox-dev/tox#4183
• @​HyperionBurn made their first contribution in tox-dev/tox#4176
• @​ag3ntsc4rn made their first contribution in tox-dev/tox#4180
• @​ericdelorefice made their first contribution in tox-dev/tox#4203
• @​nk-batman21 made their first contribution in tox-dev/tox#4195
• @​mehdimirzafaruk made their first contribution in tox-dev/tox#4194
• @​Blues-berry made their first contribution in tox-dev/tox#4197

PyPI release

... (truncated)

Changelog

Sourced from tox's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-67-5:

---

4.67.5 (2026-10-31)

---

.. _release-4-67-5-fixed:

Fixed

• A packaging environment whose base_python (or default_base_python) is not installed no longer crashes with KeyError: 'skip_missing_interpreters'. It now fails with the missing interpreter, or skips the run environment when skip_missing_interpreters is true, as tox did before 4.36.0 (:pr:4213) by :user:gaborbernat. (:issue:4212)

• Keep environment markers when a package extra refers to another extra of the same package.

  For example, demo[dev]; python_version < '3.10' keeps the version condition on dependencies from dev (:pr:4216) by :user:ericdelorefice and :user:gaborbernat.

• A pylock.toml or a tox user configuration file (TOX_USER_CONFIG_FILE) saved with a UTF-8 byte order mark, as some Windows editors do, is now read instead of failing with a TOML decode error or being ignored with failed to read config file (:pr:4217) by :user:pcbeingused333.

• With args_are_paths enabled, a positional argument naming an existing file whose rewritten path relative to change_dir starts with - (for example tests/--config=evil.cfg) is now prefixed with ./ so the command still receives a path instead of an option (:pr:4317) by :user:rahuldevikar and :user:gaborbernat. (:issue:4218)

• An extending TOML replace table with a nonempty marker now raises an error instead of adding its internal value and marker keys to :ref:deps or :ref:requires. Markers on set_env values remain supported (:pr:4320) by :user:rahuldevikar and :user:gaborbernat. (:issue:4220)

• A TOML type mismatch no longer includes an expanded string or container value. A malformed commands setting with {env:...} reports its type instead of the substituted text (:pr:4327) by :user:rahuldevikar and :user:gaborbernat. (:issue:4221)

• Keep artifacts supplied with --installpkg out of tox's provisioning environment while installing them in the requested test environments (:pr:4304) by :user:Pratham2511 and :user:gaborbernat. (:issue:4222)

• A file: URI passed to --installpkg is now percent-decoded once instead of twice, so a path containing a literal % sequence, such as a directory named feature%2Flogin, selects the package the user named (:pr:4300) by :user:pcbeingused333 and :user:gaborbernat. (:issue:4223)

• A relative TOX_INSTALL_PKG or user configuration install_pkg path is now resolved against the invocation directory, as --installpkg already was, so tox inspects and installs from the same path (:pr:4333) by :user:rahuldevikar and :user:gaborbernat. (:issue:4224)

• tox refuses a symlink or Windows junction at meta_dir because the build frontend empties that directory during

... (truncated)

Commits

• ff5def6 release 4.67.4
• 0255ed0 🐛 fix(deps): keep marker on self-referencing extra (#4211)
• 9178b69 release 4.67.3
• 5d15d9b 🐛 fix(config): resolve TOML env defaults ending in a backslash (#4185)
• af9eabf 🐛 fix(config): let TOML env refs take path, set and env list values (#4192)
• 070a72c 🐛 fix(parallel): size --parallel auto by the CPUs tox may use (#4190)
• 5b4b7a7 📝 docs(config): explain quoting spaced substitutions (#4197)
• 6bf3afe 🐛 fix(journal): write --result-json as UTF-8 (#4194)
• 4931a47 🐛 fix(config): allow glob character sets in ini depends (#4195)
• f736d1c 🐛 fix(force-dep): match dependency names after normalization (#4181)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions