You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.
Fix copy.deepcopy() and pickle on a Parameter, Option or Command. {pr}3805
A KeyboardInterrupt arriving while Command.main() reports an abort or an error,
or while it exits, no longer escapes as an unhandled traceback. The command still
exits with the intended code; only the message may be lost. {issue}3802
Add {meth}Option.get_help_spec, which returns the option's left help
column even when the option is hidden. {meth}Option.get_help_record still
returns None for hidden options, so help screens are unchanged. {pr}3821
The Positional arguments help section lists every argument of the command,
not only the documented ones. An argument with no help gets an empty
description, the same way an option with no help does. {pr}3860
{meth}Argument.get_help_record always returns a tuple. It used to return None for an argument with no help. {pr}3860
Document which types are inferred from default, and what an unrecognized type callable does to a command-line value. {issue}3036 {pr}3808
path_type narrows the converted value's type for convert and prompt.
{issue}3822 {pr}3858
{class}Parameter accepts a new help argument and {class}Option and {class}Argument
inherits it. {meth}Parameter.to_info_dict now reports help for every kind of parameter.
{pr}3861
A command's short help no longer stops at an abbreviation such as vs. or e.g.
inside the first sentence. A period ends the sentence only when it closes the text
or the next word does not start in lowercase. {pr}3865
With show_envvar=True, an option's error message now prints all variables of an envvar sequence instead of the repr of the sequence. {pr}3884
An empty envvar, such as [] or "", shows the same help and error message as
no envvar when show_envvar=True. The help screen used to show [env var: ].
{pr}3884
Align command's deprecated help text to options and arguments: do not translate the
command's own help text, only the (DEPRECATED) label. {pr}3901
Fix: two different scenarios failed with "attempt to write a readonly
database". These were regressions in 7.17.1. They are fixed, closing issue 2356_:
When using a version of SQLite older than 3.34.0, such as on RHEL 8 or
Ubuntu 20.04, coverage combine (and pytest-cov, which combines
automatically) always failed.
coverage combine and coverage debug data failed when a data file
existed but had no coverage schema, for example an empty file left behind
by a worker that died. A file we can't read is now reported like any other
unusable data file, and is left in place.
Fix: a one-line class or function body immediately followed by another
statement (such as class Foo: ... on its own line) was incorrectly
reported as a missing branch when using the sys.monitoring core. This is now
fixed, closing issue 2167_ and issue 2337_.
Fix: the HTML report only rewrites a file's page when the file or its data
has changed, but each page also links to the previous and next files. When
the set of reported files changed, unchanged pages kept their old links. For
example, with skip_covered, a file that became 100% covered had its page
deleted, but the pages next to it still linked to it. Now a page is also
rewritten when its neighbors change.
Fix: --fail-under now uses at least the decimal precision of the
threshold for both the comparison and failure message. With precision=0,
a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5
with the message "total of 0.4 is less than fail-under=0.5". Previously, the
comparison rounded the total to zero and the message could claim "1 is less
than 0". Closes issue 2295_.
Fix: the HTML report escaped file names twice, so a name with &, <,
or quotes in it was shown with entities like &. Now they are properly
escaped only once.
Fix: --source=/ measured no files. A file system root can't be a source
directory, so now it is an error. Closes issue 2291_.
In an abundance of caution, prevent forged SQLite journal files from deleting
files they shouldn't.
ReadWriteLock, SoftReadWriteLock and their async wrappers now raise TypeError for a blocking that is not a bool, in the constructor and on acquire, as FileLock already does. Before, blocking=0 waited out the full timeout on a contended ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (#908) by @abhishekcpp007 and @gaborbernat.
Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (#905) by @boyfeiyu.
A docs section on which return annotations count as generators or iterators
Changed
Generator, Iterator, and Iterable return annotations are now recognized by
the last name in the annotation's AST instead of by matching the annotation
text, so qualified names such as typing.Generator[...], collections.abc.Iterator[...], and t.Iterable[...] are recognized too
(#317)
Iterator and Iterable annotations are matched by exact name instead of by
prefix, so names like IterableDataset are no longer treated as iterators
Union annotations, such as Iterator[int] | None or Iterator[int] | list[int], are no longer recognized as iterator or
generator annotations
Imports are not resolved: np.random.Generator is treated like typing.Generator, and renamed imports such as from typing import Iterator as It are still not recognized
An empty --exclude pattern (such as --exclude='' or exclude = '' in
the config file) excluded every file, so nothing was checked and the run
passed. Now an empty pattern means "don't exclude any files", so every file
gets checked (#311)
Changed
An --exclude value that isn't a valid regular expression is now rejected
with a clear error message instead of a traceback
A new config option --include-stub-files (shortform: -isf, default: False), so that scanning a folder also checks stub (.pyi) files (#303)
Fixed
False-positive DOC403 and DOC502 violations in stub (.pyi) files,
whose function bodies are placeholders, in both the native mode and flake8 (#303). DOC403 is still reported in stub files when the return
annotation isn't a Generator/Iterator/Iterable (or is missing), because
then the function can't yield anything
False-positive DOC105 and DOC605 violations in stub files when --check-arg-defaults is True: an argument or class attribute whose
default is the ... placeholder can now be documented with any default
value or none
False-positive DOC201 violations for abstract methods and stub functions
annotated with Iterator[...] or Iterable[...] whose docstrings have a
"Yields" section (and no "return" statements in the body). Their bodies are
placeholders, so the "Yields" section is what shows that they yield, and
they don't need a "Returns" section
False-positive DOC203 violations for abstract methods and stub functions
annotated with Generator[YieldType, SendType, ReturnType] whose "Returns"
section documents ReturnType, as for a generator that both yields and
returns
False-positive DOC202 violations for abstract methods and stub functions
that have a "Returns" section but no return annotation. (DOC203 still
reports the missing annotation when return types are checked.)
A crash (IndexError) when --check-arg-defaults is True and
positional-only arguments (the ones before /) have default values. When
it didn't crash, the defaults of positional-only arguments were ignored
pipx ensurepath no longer claims it added the binary directories to PATH when they were already there; the summary now says so and points at --force for adding them again (#2431) by @AP24110011695 and @gaborbernat.
Bug fixes
Rebuild shared pip environments created with Python older than 3.10, and refresh existing applications' references to the rebuilt environment before running their installers (#2437) by @gaborbernat. (#2435)
pipx pin --skip accepts case and punctuation variants of injected package names, with or without their suffix (#2425) by @kowellaloo9698-afk and @gaborbernat.
pipx repair now refuses an environment whose pipx_metadata.json a killed install lost or a newer pipx wrote, as pipx reinstall and pipx reinstall-all do, instead of reporting it healthy (#2423) by @AP24110011695 and @gaborbernat.
pipx list --short --include-injected now lists injected packages, as --pinned --include-injected already does (#2415) by @Pixeless001 and @gaborbernat.
pipx uninject matches package names in any spelling, so mixed-case finds a package that pip recorded as Mixed_Case, and it refuses the main package however the name is spelled (#2420) by @guransh0925 and @gaborbernat.
pipx run now treats requirements with a version, extras, a marker or a direct URL as packages, and script URLs as downloads, even when the working directory contains a matching file (#2408) by @gaborbernat.
Error, warning, and help messages now state what pipx found and what to run next, without hedges such as "already seems to be installed" or "Perhaps". Update scripts that match the old message text (#2376) by @gaborbernat.
Bug fixes
A pipx that changed its own environment, through pipx upgrade pipx or pipx reinstall pipx for example, no longer crashes with an ImportError when another pipx command empties the trash while it is still running, such as during the rest of pipx upgrade-all. The copy of its environment it imports from now stays in the trash until the process exits (#2397) by @gaborbernat.
Interrupting a parallel pipx reinstall-all with Ctrl-C now gives a restored environment back the shared app, man page or completion links another environment took while the rebuild had it in the trash, as a failed rebuild already did (#2386) by @gaborbernat.
On Windows under the uv backend, pipx run --refresh or --no-cache of a local script no longer deletes the cached environment while another run of the same script is still executing in it, and neither does the expiry sweep. Such a run builds a throwaway environment for itself instead, and after --refresh the next run to find the cached one idle rebuilds it (#2387) by @gaborbernat.
On Windows under the uv backend, pipx upgrade pipx on a pipx that manages itself no longer fails with Access is denied and rolls back. uv deletes the files it replaces, which Windows refuses for the running pipx.exe, so pipx now moves that launcher to its trash first, where the next pipx command deletes it (#2396) by @gaborbernat.
Where pipx copies launchers instead of linking them, as on Windows without symlink rights, pipx reinstall and pipx install --force no longer warn Overwriting file for the package's own launcher. Windows .exe launchers embed their build time, so a rebuilt one never matched its old copy byte for byte and every reinstall warned. pipx now recognises its own copy by the interpreter it names and replaces it without a warning; a file another venv or the user put there still gets one (#2394) by @gaborbernat.
With the uv backend and UV_LINK_MODE=symlink, pipx uninstall now removes the man page and shell completion links it exposed, and pipx list no longer reports those man pages as missing. uv makes the environment's own copies symlinks into its cache, and pipx followed them there instead of stopping at the environment (#2380) by @gaborbernat.
--fetch-python and pipx interpreter upgrade now download and unpack the standalone Python build next to the interpreter directory instead of in the system temp dir, so a tmpfs /tmp or a /tmp on another btrfs subvolume no longer forces a full copy of the build into the pipx home or splits its hard links into separate files (#2403) by @gaborbernat.
pipx inject pipx without --include-apps and pipx runpip pipx on a pipx that manages itself no longer mix old and new pipx code when they change the pipx package. Like pipx upgrade pipx, they now load late imports from a copy of the environment, which the next pipx command deletes from the trash (#2393) by @gaborbernat.
pipx list --json no longer exports the interpreter a self-managed pipx recorded when that path no longer leads to the interpreter its environment runs on, such as a removed bootstrap environment's python3. pipx install-all then builds that environment on the default interpreter instead of whatever appears at the old path (#2389) by @gaborbernat.
pipx reinstall pipx on a pipx that manages itself no longer crashes with an ImportError when it installs a different pipx version. Modules the running pipx imported late came from the version it was installing, so old and new code mixed. It now loads them from its own moved environment, which the next pipx command deletes from the trash (#2377) by @gaborbernat.
pipx upgrade pipx, pipx upgrade-all and pipx install --force pipx on a pipx that manages itself no longer crash with an ImportError when they install a different pipx version. The running pipx now loads its late imports from a copy of its environment, which the next pipx command deletes from the trash (#2388) by @gaborbernat.
pipx now recognises the app copies it made when the environment's interpreter path is too long for a shebang line or contains a space. pip and uv start such launchers with a #!/bin/sh line that hands over to the interpreter, and pipx took /bin/sh for the interpreter, so pipx reinstall kept a stale copy and warned "File exists ... Not modifying." (#2392) by @gaborbernat.
Security
pipx run now names its cached environments with an HMAC keyed by a random per-user secret, stored with mode 0600 in .run-key inside the run cache. Before, the name was a plain hash of inputs that include tokens and proxy passwords from the environment, so another account that could list the cache could check guesses at those values against it. Existing cache entries are not reused and expire as usual (#2370) by @gaborbernat.
pipx no longer records an abbreviation of a one-shot pip option that the current pip finds ambiguous but an older pip accepts, such as --requirem FILE, which pip 24.0 reads as --requirement FILE. With such a shared pip, a later pipx upgrade or pipx reinstall used to replay it and install from whatever another account had put at that path. An existing record drops it when read, and an abbreviation that could name a source option such as --constraint goes through the same replay check as that option (#2390) by @gaborbernat.
pipx no longer records an interpreter that lives inside another virtual environment, such as the python3 of an activated bootstrap environment or of one made with python3 -m venv --copies. It records the base interpreter named in that environment's pyvenv.cfg, which outlives the bootstrap. pipx install-all also stops building on an exported interpreter that sits inside a virtual environment or that another account can change, and uses the default Python with a message instead, so a snapshot taken before the bootstrap was removed no longer runs whatever another account later puts at its old path (#2402) by @gaborbernat.
Extend the 1.18.8 handling of recorded pip arguments to uv's path options and to --group. pipx no longer records --group, which names a pyproject.toml to read packages from, like -r. On POSIX, a recorded --config-file, --project, --directory, --overrides/--override or --excludes/--exclude that points at a path another account could change stops pipx upgrade, pipx reinstall and the other replaying commands with the same error as --find-links. pipx list --outdated runs the same check and reports such an environment as failed instead of querying the recorded location. pipx runpip reads its install arguments with the same parser, so it records an install written as -qe ./project or -e./project as editable (#2363) by @gaborbernat.
When a rebuild fails during a parallel pipx reinstall-all, the restored environment gets back the shared app, man page or completion links another environment took while the rebuild had it in the trash, unless something outside this run has replaced them since (#2371) by @gaborbernat.
pipx run no longer reuses a cached environment after a change to a variable outside PIP_* and UV_* that decides which config file pip or uv reads, which proxy or index answers, which certificate is trusted or which credentials are sent, such as XDG_CONFIG_HOME, SSL_CERT_FILE, HTTPS_PROXY or NETRC. The values only feed the cache key's hash, so secrets in them stay out of cache paths and logs (#2364) by @gaborbernat.
A pipx run that names an app the package does not provide, such as pipx run --spec black blackk, no longer expires the cached environment, so the corrected command reuses it instead of rebuilding. A failed venv creation or install still expires the entry (#2354) by @gaborbernat.
A second
[!IMPORTANT]
✂ PR body was truncated to here.
Configuration
📅 Schedule: (in timezone UTC)
Branch creation
"before 4am on monday"
Automerge
Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
If you want to rebase/retry this PR, check this box
<
8000
span class="Button-label">
Copy link
Copy Markdown
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
No actionable comments were generated in the recent review.
Walkthrough
The GitHub Actions workflows now use Ubuntu 26.04 for the docs, release, and forum_post jobs. The release job now uses Python 3.15. Five pinned pre-commit repository revisions were updated.
The CI and hook updates show no concrete merge-blocking regression.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title "chore(deps): update all dependencies" is a Conventional Commits style summary of the PR. The changeset updates pre-commit hook revisions, Python dependency groups, Docker and GitHub Actions…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explana
8000
tion
The title "chore(deps): update all dependencies" is a Conventional Commits style summary of the PR. The changeset updates pre-commit hook revisions, Python dependency groups, Docker and GitHub Actions Python versions (3.14 to 3.15), and the Ubuntu runner (24.04 to 26.04). The title accurately names the primary intent, which is a Renovate dependency update. It is broad, since the PR also changes the runner image and Python version, but it is not misleading.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 29e2aa36-0013-4237-9fc0-00fad5fb2889
Commits
Reviewing files that changed from the base of the PR and between 184f60f and 89b36be.
Files ignored due to path filters: 1
uv.lock is excluded by !**/*.lock
Files selected for processing: 1
.pre-commit-config.yaml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pyproject.toml
Artifact update for wcmatch resolved to version 12.0.1, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 12.0
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/
File name: pyproject.toml
Artifact update for filelock resolved to version 4.2.10, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 4.2.9
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/
File name: pyproject.toml
Artifact update for types-pyyaml resolved to version 6.0.12.20261111, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 6.0.12.20261103
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/
File name: pyproject.toml
Artifact update for tombi resolved to version 1.11.2, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update t
8BD0
o 1.11.1
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
26.10.0→26.11.026.10.1→26.11.026.10.0→26.11.0v26.9.0→v26.11.00.12.19→0.13.7v2.5.14→v2.6.68.5.0→8.5.17.17.0→7.17.24.2.7→4.2.94.2.100.10.1→0.12.02.4.0→2.4.126.2.2→26.31.18.7→1.18.160.5.7→0.5.10v4.0.9→v4.1.326.10.0→26.11.03.14→3.153.14→3.150.17.3→0.17.41.9.7→1.11.11.11.24.67.4→4.67.1326.10.0→26.11.01.37.2→1.37.76.0.12.20260906→6.0.12.202611036.0.12.2026111124.04→26.0411.2→12.012.0.1Note: The
pre-commitmanager in Renovate is not supported by thepre-commitmaintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.Release Notes
ansible/ansible-compat (ansible-compat)
v26.11.0Compare Source
What's Changed
Full Changelog: ansible/ansible-compat@v26.10.0...v26.11.0
ansible/ansible-lint (ansible-lint)
v26.11.0Compare Source
What's Changed
New Contributors
Full Changelog: ansible/ansible-lint@v26.10.1...v26.11.0
ansible/ansible-navigator (ansible-navigator)
v26.11.0Compare Source
What's Changed
New Contributors
Full Changelog: ansible/ansible-navigator@v26.10.0...v26.11.0
astral-sh/uv-pre-commit
v0.13.7Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.7
v0.13.6Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.6
v0.13.5Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.5
v0.13.4Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.4
v0.13.3Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.3
v0.13.2Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.2
v0.13.1Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.1
v0.13.0Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.13.0
v0.12.24Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.24
v0.12.23Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.23
v0.12.22Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.22
v0.12.21Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.21
v0.12.20Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.12.20
biomejs/pre-commit
v2.6.6Compare Source
v2.6.5Compare Source
v2.6.4Compare Source
v2.6.3Compare Source
v2.6.2Compare Source
v2.6.1Compare Source
v2.6.0Compare Source
v2.5.15Compare Source
pallets/click (click)
v8.5.1Compare Source
Released 2026-11-09
copy.deepcopy()andpickleon aParameter,OptionorCommand. {pr}3805KeyboardInterruptarriving whileCommand.main()reports an abort or an error,or while it exits, no longer escapes as an unhandled traceback. The command still
exits with the intended code; only the message may be lost. {issue}
3802Option.get_help_spec, which returns the option's left helpcolumn even when the option is hidden. {meth}
Option.get_help_recordstillreturns
Nonefor hidden options, so help screens are unchanged. {pr}3821Positional argumentshelp section lists every argument of the command,not only the documented ones. An argument with no
helpgets an emptydescription, the same way an option with no
helpdoes. {pr}3860Argument.get_help_recordalways returns a tuple. It used to returnNonefor an argument with nohelp. {pr}3860default, and what an unrecognizedtypecallable does to a command-line value. {issue}3036{pr}3808path_typenarrows the converted value's type forconvertandprompt.{issue}
3822{pr}3858Parameteraccepts a newhelpargument and {class}Optionand {class}Argumentinherits it. {meth}
Parameter.to_info_dictnow reportshelpfor every kind of parameter.{pr}
3861vs.ore.g.inside the first sentence. A period ends the sentence only when it closes the text
or the next word does not start in lowercase. {pr}
3865show_envvar=True, an option's error message now prints all variables of anenvvarsequence instead of thereprof the sequence. {pr}3884envvar, such as[]or"", shows the same help and error message asno
envvarwhenshow_envvar=True. The help screen used to show[env var: ].{pr}
3884command's own help text, only the
(DEPRECATED)label. {pr}3901coveragepy/coveragepy (coverage)
v7.17.2Compare Source
Fix: two different scenarios failed with "attempt to write a readonly
database". These were regressions in 7.17.1. They are fixed, closing
issue 2356_:When using a version of SQLite older than 3.34.0, such as on RHEL 8 or
Ubuntu 20.04,
coverage combine(and pytest-cov, which combinesautomatically) always failed.
coverage combineandcoverage debug datafailed when a data fileexisted but had no coverage schema, for example an empty file left behind
by a worker that died. A file we can't read is now reported like any other
unusable data file, and is left in place.
.. _issue 2356: #2356
.. _changes_7-17-1:
v7.17.1Compare Source
Fix: a one-line class or function body immediately followed by another
statement (such as
class Foo: ...on its own line) was incorrectlyreported as a missing branch when using the sys.monitoring core. This is now
fixed, closing
issue 2167_ andissue 2337_.Fix: the HTML report only rewrites a file's page when the file or its data
has changed, but each page also links to the previous and next files. When
the set of reported files changed, unchanged pages kept their old links. For
example, with
skip_covered, a file that became 100% covered had its pagedeleted, but the pages next to it still linked to it. Now a page is also
rewritten when its neighbors change.
Fix:
--fail-undernow uses at least the decimal precision of thethreshold for both the comparison and failure message. With
precision=0,a total of 0.4 now passes
--fail-under=0.3and fails--fail-under=0.5with the message "total of 0.4 is less than fail-under=0.5". Previously, the
comparison rounded the total to zero and the message could claim "1 is less
than 0". Closes
issue 2295_.Fix: the HTML report escaped file names twice, so a name with
&,<,or quotes in it was shown with entities like
&. Now they are properlyescaped only once.
Fix:
--source=/measured no files. A file system root can't be a sourcedirectory, so now it is an error. Closes
issue 2291_.In an abundance of caution, prevent forged SQLite journal files from deleting
files they shouldn't.
.. _issue 2167: #2167
.. _issue 2291: #2291
.. _issue 2295: #2295
.. _issue 2337: #2337
.. _changes_7-17-0:
tox-dev/filelock (filelock)
v4.2.9Compare Source
Bug fixes
ReadWriteLock,SoftReadWriteLockand their async wrappers now raiseTypeErrorfor a blocking that is not abool, in the constructor and on acquire, asFileLockalready does. Before,blocking=0waited out the full timeout on a contendedReadWriteLockwhileblocking=Falsefailed at once, and a truthy value such as"false"turned a single attempt into a blocking wait (#908) by @abhishekcpp007 and @gaborbernat.New Contributors
🐍 PyPI release
📜 Full Changelog
v4.2.8Compare Source
Documentation
New Contributors
🐍 PyPI release
📜 Full Changelog
jsh9/pydoclint
v0.12.0Compare Source
the last name in the annotation's AST instead of by matching the annotation
text, so qualified names such as
typing.Generator[...],collections.abc.Iterator[...], andt.Iterable[...]are recognized too(#317)
prefix, so names like
IterableDatasetare no longer treated as iteratorsIterator[int] | NoneorIterator[int] | list[int], are no longer recognized as iterator orgenerator annotations
np.random.Generatoris treated liketyping.Generator, and renamed imports such asfrom typing import Iterator as Itare still not recognizedv0.11.1Compare Source
--excludepattern (such as--exclude=''orexclude = ''inthe config file) excluded every file, so nothing was checked and the run
passed. Now an empty pattern means "don't exclude any files", so every file
gets checked (#311)
--excludevalue that isn't a valid regular expression is now rejectedwith a clear error message instead of a traceback
v0.11.0Compare Source
--include-stub-files(shortform:-isf, default:False), so that scanning a folder also checks stub (.pyi) files (#303)DOC403andDOC502violations in stub (.pyi) files,whose function bodies are placeholders, in both the native mode and
flake8 (#303).
DOC403is still reported in stub files when the returnannotation isn't a Generator/Iterator/Iterable (or is missing), because
then the function can't yield anything
DOC105andDOC605violations in stub files when--check-arg-defaultsisTrue: an argument or class attribute whosedefault is the
...placeholder can now be documented with any defaultvalue or none
DOC201violations for abstract methods and stub functionsannotated with
Iterator[...]orIterable[...]whose docstrings have a"Yields" section (and no "return" statements in the body). Their bodies are
placeholders, so the "Yields" section is what shows that they yield, and
they don't need a "Returns" section
DOC203violations for abstract methods and stub functionsannotated with
Generator[YieldType, SendType, ReturnType]whose "Returns"section documents
ReturnType, as for a generator that both yields andreturns
DOC202violations for abstract methods and stub functionsthat have a "Returns" section but no return annotation. (
DOC203stillreports the missing annotation when return types are checked.)
IndexError) when--check-arg-defaultsisTrueandpositional-only arguments (the ones before
/) have default values. Whenit didn't crash, the defaults of positional-only arguments were ignored
python/mypy (mypy)
v2.4.1Compare Source
pypa/pip (pip)
v26.3Compare Source
pypa/pipx (pipx)
v1.18.16Compare Source
Changes
pipx ensurepathno longer claims it added the binary directories to PATH when they were already there; the summary now says so and points at--forcefor adding them again (#2431) by @AP24110011695 and @gaborbernat.Bug fixes
🐍 PyPI release
📜 Full Changelog
v1.18.15Compare Source
Bug fixes
pipx pin --skipaccepts case and punctuation variants of injected package names, with or without their suffix (#2425) by @kowellaloo9698-afk and @gaborbernat.pipx repairnow refuses an environment whosepipx_metadata.jsona killed install lost or a newer pipx wrote, aspipx reinstallandpipx reinstall-alldo, instead of reporting it healthy (#2423) by @AP24110011695 and @gaborbernat.New Contributors
🐍 PyPI release
📜 Full Changelog
v1.18.14Compare Source
Bug fixes
pipx list --short --include-injectednow lists injected packages, as--pinned --include-injectedalready does (#2415) by @Pixeless001 and @gaborbernat.pipx uninjectmatches package names in any spelling, somixed-casefinds a package that pip recorded asMixed_Case, and it refuses the main package however the name is spelled (#2420) by @guransh0925 and @gaborbernat.New Contributors
🐍 PyPI release
📜 Full Changelog
v1.18.13Compare Source
No user-facing changes.
🐍 PyPI release
📜 Full Changelog
v1.18.12Compare Source
Security
pipx runnow treats requirements with a version, extras, a marker or a direct URL as packages, and script URLs as downloads, even when the working directory contains a matching file (#2408) by @gaborbernat.🐍 PyPI release
📜 Full Changelog
v1.18.11Compare Source
Bug fixes
pipx pinnow lists the packages it pins without--injected-onlyor--skip(#2405) by @hemcharan710-afk and @gaborbernat.PyPI release
Full Changelog
v1.18.10Compare Source
Changes
Bug fixes
pipx upgrade pipxorpipx reinstall pipxfor example, no longer crashes with anImportErrorwhen another pipx command empties the trash while it is still running, such as during the rest ofpipx upgrade-all. The copy of its environment it imports from now stays in the trash until the process exits (#2397) by @gaborbernat.pipx reinstall-allwith Ctrl-C now gives a restored environment back the shared app, man page or completion links another environment took while the rebuild had it in the trash, as a failed rebuild already did (#2386) by @gaborbernat.pipx run --refreshor--no-cacheof a local script no longer deletes the cached environment while another run of the same script is still executing in it, and neither does the expiry sweep. Such a run builds a throwaway environment for itself instead, and after--refreshthe next run to find the cached one idle rebuilds it (#2387) by @gaborbernat.pipx upgrade pipxon a pipx that manages itself no longer fails withAccess is deniedand rolls back. uv deletes the files it replaces, which Windows refuses for the runningpipx.exe, so pipx now moves that launcher to its trash first, where the next pipx command deletes it (#2396) by @gaborbernat.pipx reinstallandpipx install --forceno longer warnOverwriting filefor the package's own launcher. Windows.exelaunchers embed their build time, so a rebuilt one never matched its old copy byte for byte and every reinstall warned. pipx now recognises its own copy by the interpreter it names and replaces it without a warning; a file another venv or the user put there still gets one (#2394) by @gaborbernat.UV_LINK_MODE=symlink,pipx uninstallnow removes the man page and shell completion links it exposed, andpipx listno longer reports those man pages as missing. uv makes the environment's own copies symlinks into its cache, and pipx followed them there instead of stopping at the environment (#2380) by @gaborbernat.--fetch-pythonandpipx interpreter upgradenow download and unpack the standalone Python build next to the interpreter directory instead of in the system temp dir, so a tmpfs/tmpor a/tmpon another btrfs subvolume no longer forces a full copy of the build into the pipx home or splits its hard links into separate files (#2403) by @gaborbernat.pipx inject pipxwithout--include-appsandpipx runpip pipxon a pipx that manages itself no longer mix old and new pipx code when they change the pipx package. Likepipx upgrade pipx, they now load late imports from a copy of the environment, which the next pipx command deletes from the trash (#2393) by @gaborbernat.pipx list --jsonno longer exports the interpreter a self-managed pipx recorded when that path no longer leads to the interpreter its environment runs on, such as a removed bootstrap environment'spython3.pipx install-allthen builds that environment on the default interpreter instead of whatever appears at the old path (#2389) by @gaborbernat.pipx reinstall pipxon a pipx that manages itself no longer crashes with anImportErrorwhen it installs a different pipx version. Modules the running pipx imported late came from the version it was installing, so old and new code mixed. It now loads them from its own moved environment, which the next pipx command deletes from the trash (#2377) by @gaborbernat.pipx upgrade pipx,pipx upgrade-allandpipx install --force pipxon a pipx that manages itself no longer crash with anImportErrorwhen they install a different pipx version. The running pipx now loads its late imports from a copy of its environment, which the next pipx command deletes from the trash (#2388) by @gaborbernat.#!/bin/shline that hands over to the interpreter, and pipx took/bin/shfor the interpreter, sopipx reinstallkept a stale copy and warned "File exists ... Not modifying." (#2392) by @gaborbernat.Security
pipx runnow names its cached environments with an HMAC keyed by a random per-user secret, stored with mode0600in.run-keyinside the run cache. Before, the name was a plain hash of inputs that include tokens and proxy passwords from the environment, so another account that could list the cache could check guesses at those values against it. Existing cache entries are not reused and expire as usual (#2370) by @gaborbernat.--requirem FILE, which pip 24.0 reads as--requirement FILE. With such a shared pip, a laterpipx upgradeorpipx reinstallused to replay it and install from whatever another account had put at that path. An existing record drops it when read, and an abbreviation that could name a source option such as--constraintgoes through the same replay check as that option (#2390) by @gaborbernat.python3of an activated bootstrap environment or of one made withpython3 -m venv --copies. It records the base interpreter named in that environment'spyvenv.cfg, which outlives the bootstrap.pipx install-allalso stops building on an exported interpreter that sits inside a virtual environment or that another account can change, and uses the default Python with a message instead, so a snapshot taken before the bootstrap was removed no longer runs whatever another account later puts at its old path (#2402) by @gaborbernat.PyPI release
Full Changelog
v1.18.9Compare Source
Bug fixes
--group. pipx no longer records--group, which names apyproject.tomlto read packages from, like-r. On POSIX, a recorded--config-file,--project,--directory,--overrides/--overrideor--excludes/--excludethat points at a path another account could change stopspipx upgrade,pipx reinstalland the other replaying commands with the same error as--find-links.pipx list --outdatedruns the same check and reports such an environment as failed instead of querying the recorded location.pipx runpipreads its install arguments with the same parser, so it records an install written as-qe ./projector-e./projectas editable (#2363) by @gaborbernat.pipx reinstall-all, the restored environment gets back the shared app, man page or completion links another environment took while the rebuild had it in the trash, unless something outside this run has replaced them since (#2371) by @gaborbernat.pipx runno longer reuses a cached environment after a change to a variable outsidePIP_*andUV_*that decides which config file pip or uv reads, which proxy or index answers, which certificate is trusted or which credentials are sent, such asXDG_CONFIG_HOME,SSL_CERT_FILE,HTTPS_PROXYorNETRC. The values only feed the cache key's hash, so secrets in them stay out of cache paths and logs (#2364) by @gaborbernat.PyPI release
Full Changelog
v1.18.8Compare Source
Bug fixes
pipx runthat names an app the package does not provide, such aspipx run --spec black blackk, no longer expires the cached environment, so the corrected command reuses it instead of rebuilding. A failed venv creation or install still expires the entry (#2354) by @gaborbernat.Configuration
📅 Schedule: (in timezone UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.