[dependabot]

Bumps filelock from 4.0.4 to 4.0.5.

Release notes

Sourced from filelock's releases.

4.0.5

What's Changed

• fix(marker): preserve live owners by @​DawnofGenX in tox-dev/filelock#751
• fix(tests): separate mode and access checks by @​pasmud in tox-dev/filelock#753
• fix(read-write): honor instance defaults by @​DawnofGenX in tox-dev/filelock#752
• fix(async): validate blocking read-write timeouts by @​pasmud in tox-dev/filelock#755
• fix(strict): handle vanished unreadable claims by @​januththedev in tox-dev/filelock#754

New Contributors

• @​DawnofGenX made their first contribution in tox-dev/filelock#751
• @​pasmud made their first contribution in tox-dev/filelock#753
• @​januththedev made their first contribution in tox-dev/filelock#754

Full Changelog: tox-dev/filelock@4.0.4...4.0.5

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.8 (2026-10-01)

---

• ReadWriteLock.release() and SoftReadWriteLock.release() from a thread that does not hold the write lock now raise RuntimeError instead of dropping the holder's lock and letting a second writer in. :pr:761

---

4.0.7 (2026-09-29)

---

• File locks now raise ValueError at construction when mode denies the owner read or write, such as mode=0o444, instead of failing on a later acquire and staying broken until someone deletes the lock file. :pr:760

---

4.0.6 (2026-09-28)

---

• Reject negative blocking timeouts other than -1 before reentrant ReadWriteLock and SoftReadWriteLock acquisition. Preserve unlimited waits and nonblocking acquisition. :pr:756

---

4.0.5 (2026-09-28)

---

• Fix MarkerSoftFileLock acquisition and prevent contenders from evicting live protocol-2 owners after two seconds. Reclaim recognized records after owner death; preserve unknown contracts. :pr:749
• Honor instance timeout and blocking settings in sync and async ReadWriteLock acquisition, including waits between tasks on one instance. Preserve explicit per-call overrides. :pr:750
• Skip access-denial checks when the process can read mode-0o000 files. Keep mode-bit checks enabled for privileged processes on filesystems that support POSIX permissions. :pr:753
• Skip vanished StrictSoftFileLock claims after a read-permission retry expires. Recheck the directory before raising a protocol error so concurrent removal does not turn a stale claim listing into an acquisition failure. :pr:754
• Reject negative timeouts other than -1 in blocking AsyncReadWriteLock and AsyncSoftReadWriteLock acquisitions. Keep -1 as an unlimited wait and ignore timeouts when blocking=False. :pr:755

---

4.0.4 (2026-09-26)

---

• Hostnames that still differ after their first 253 escaped characters now publish distinct owners, so a soft lock no longer takes another such host's live holder for its own and reclaims its marker. :pr:748

... (truncated)

Commits

• bbb843e Release 4.0.5
• 83fa216 test(read-write): cover omitted arguments (#754)
• aaa26f2 fix(async): validate blocking read-write timeouts (#755)
• 218e49e fix(read-write): honor instance defaults (#752)
• 2e973f2 fix(tests): separate mode and access checks (#753)
• 585e01c fix(marker): preserve live owners (#751)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no		no	6.84s
✅ JSON	prettier	7	0	0		0	0.81s
✅ JSON	v8r	7		0		0	3.55s
✅ MARKDOWN	markdownlint	68	0	0		0	2.3s
✅ MARKDOWN	markdown-table-formatter	68	0	0		0	0.51s
✅ PYTHON	black	2040	0	0		0	56.29s
✅ PYTHON	isort	2040	0	0		0	2.86s
✅ REPOSITORY	betterleaks	yes		no		no	1.34s
✅ REPOSITORY	checkov	yes		no		no	32.23s
✅ REPOSITORY	git_diff	yes		no		no	0.14s
✅ REPOSITORY	secretlint	yes		no		no	6.95s
✅ REPOSITORY	syft	yes		no		no	3.26s
✅ REPOSITORY	trivy-sbom	yes		no		no	2.79s
✅ YAML	prettier	11	0	0		0	0.63s
✅ YAML	v8r	11		0		0	12.65s
✅ YAML	yamllint	11		0		0	0.71s

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: MAKEFILE_CHECKMAKE. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters PYTHON_BLACK,PYTHON_ISORT,COPYPASTE_JSCPD,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.