chore(deps): update dependency coverage to v7.16.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
coverage	==7.15.4 → ==7.16.0

---

Release Notes

coveragepy/coveragepy (coverage)

v7.16.0

Compare Source

• When combining files, now path separator slashes will automatically be
  converted to the local file system style. This makes it less necessary to
  define [paths] configuration to combine data across operating systems.
  Fixes issue 2266_.

• The :meth:.Coverage.switch_context method now returns the previous context.

• Fix: previously, a [paths] pattern would be replaced everywhere in a file
  path when it was only meant to be replaced once, in the leading portion of
  the path. This is now fixed, in pull 2268_.

• Fixes to validation of options and configuration settings:

  • Negative precision settings now always cause useful error messages (pull 2261_).

  • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...:
    user-defined function raised exception" error. Now it raises a proper
    configuration error naming the bad regex, like other regex settings do
    (pull 2262_).

  • Non-string values in TOML configuration settings now produce a helpful
    error message instead of a traceback. This affects list settings whose
    elements aren't strings (like omit, exclude_lines, or a [paths]
    entry), file settings like data_file, and any wrong-typed value in the
    [paths] section (pull 2263_).

  • coverage run refuses run-affecting command-line options like
    --branch alongside --concurrency=multiprocessing, since they can't
    reach the subprocesses. The check only recognized multiprocessing as
    the entire option value, so --concurrency=multiprocessing,thread
    slipped through and failed later with "Can't combine statement coverage
    data with branch data". Each named concurrency library is now properly
    considered (pull 2270_).

• Fix: coverage annotate -d DIR raised an AssertionError if any
  measured file had an extension other than .py, such as a .pyw file on
  Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: #​2261
.. _pull 2262: #​2262
.. _pull 2263: #​2263
.. _pull 2265: #​2265
.. _issue 2266: #​2266
.. _pull 2268: #​2268
.. _pull 2270: #​2270

.. _changes_7-15-4:

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

LGTM, straightforward dev dependency version bump.

What was reviewed: the single-line change bumping coverage from 7.15.4 to 7.16.0 in requirements-dev.txt (a lockfile-style pinned dev dependency used transitively via pytest-cov). Confirmed via git diff that only this one line changed, no other files or pins were touched. Release notes are bug fixes/validation improvements with no breaking API changes affecting this project's test tooling.

Extended reasoning...

Overview

The diff touches only requirements-dev.txt, bumping the pinned coverage package from 7.15.4 to 7.16.0. This is a transitive dev-only dependency pulled in via pytest-cov. No application source code, configuration, or CI files are modified.

Security risks

None identifiable. This is a well-known, widely-used test coverage tool maintained by a reputable maintainer (Ned Batchelder), and it only runs in dev/test environments, never in production. The version bump is a patch/minor release containing bug fixes to path handling and configuration validation, not a security patch, and does not add new capabilities or attack surface.

Level of scrutiny

Low. This is exactly the kind of mechanical, low-risk dependency bump (single line, dev-only tool, no source changes) that fits the approval guidelines' criteria for simple/obvious changes.

Other factors

The PR is generated by Renovate, a trusted automated dependency-update bot, and the changelog confirms the version change is legitimate and non-breaking for this project's usage (coverage via pytest-cov). No CODEOWNERS restrictions apply to this file, and no outstanding review objections exist in the timeline.