Skip to content

Bump the workflows-dependencies group across 1 directory with 4 updates - #220

Merged
aecorn merged 1 commit into
mainfrom
dependabot/pip/dot-github/workflows/workflows-dependencies-821b8ffc3f
Sep 2, 2026
Merged

Bump the workflows-dependencies group across 1 directory with 4 updates#220
aecorn merged 1 commit into
mainfrom
dependabot/pip/dot-github/workflows/workflows-dependencies-821b8ffc3f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the workflows-dependencies group with 4 updates in the /.github/workflows directory: pip, nox, poetry and virtualenv.

Updates pip from 26.1 to 26.2.1

Changelog

Sourced from pip's changelog.

26.2.1 (2026-08-04)

Bug Fixes

  • Reallow keyring installed in a (non-activated) virtual environment to be be used via the import provider method while installing build dependencies. ([#14227](https://github.com/pypa/pip/issues/14227) <https://github.com/pypa/pip/issues/14227>_)

26.2 (2026-07-29)

Deprecations and Removals

  • Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use --refresh-package. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

  • Drop support for detecting legacy, non-:pep:405, virtualenv (< 20) environments. ([#14062](https://github.com/pypa/pip/issues/14062) <https://github.com/pypa/pip/issues/14062>_)

  • Constraints files, including PIP_CONSTRAINT, no longer affect isolated build environments. Use --build-constraint or the PIP_BUILD_CONSTRAINT environment variable to constrain build dependencies instead.

    The --use-feature=build-constraint flag is now always enabled and has no effect. ([#14094](https://github.com/pypa/pip/issues/14094) <https://github.com/pypa/pip/issues/14094>_)

Features

  • Declare support for Python 3.15 ([#14208](https://github.com/pypa/pip/issues/14208) <https://github.com/pypa/pip/issues/14208>_)

  • Support self-referential extras officially. pip has supported this by accident since version 21.2. ([#11296](https://github.com/pypa/pip/issues/11296) <https://github.com/pypa/pip/issues/11296>_)

  • Add --only-deps flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with --no-deps, -r, --group, or --requirements-from-script. ([#11440](https://github.com/pypa/pip/issues/11440) <https://github.com/pypa/pip/issues/11440>_)

  • Cache simple responses in accordance to their Cache-Control header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use --refresh-package <package>. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

  • Add --no-require-hashes to disable automatic enablement of --require-hashes when encountering a requirement with hashes. ([#14169](https://github.com/pypa/pip/issues/14169) <https://github.com/pypa/pip/issues/14169>_)

  • Honor --only-final when sourcing requirements with -r pylock.toml. ([#13950](https://github.com/pypa/pip/issues/13950) <https://github.com/pypa/pip/issues/13950>_)

  • Add support for pylock.toml upload-time field, so --uploaded-prior-to works with -r pylock.toml. ([#14168](https://github.com/pypa/pip/issues/14168) <https://github.com/pypa/pip/issues/14168>_)

  • Better error messages in case of conflicts with requirements from -r pylock.toml. ([#13963](https://github.com/pypa/pip/issues/13963) <https://github.com/pypa/pip/issues/13963>_)

  • Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via --use-feature=venv-isolation and will be enabled by default in a future release.

    Note that the feature has limited compatibility with --use-feature=inprocess-build-deps.

... (truncated)

Commits
  • 634a6ec Bump for release
  • ae2eb4f Revert build dependency installer isolation for legacy build environment (#14...
  • 6236392 Merge pull request #14213 from pypa/release/26.2
  • da4b2cc Bump for development
  • 4b6ae5c Bump for release
  • 50b6d3c Update AUTHORS.txt
  • dbddfbd Tweak news entries for pip 26.2 (#14212)
  • 6576b75 Merge pull request #14165 from sbidoul/refactor-pylock-hanling-sbi
  • 0090e00 Address a variety of typos detected in code review
  • e12ddd9 Add support for --uploaded-prior-to with -r pylock.toml
  • Additional commits viewable in compare view

Updates nox from 2026.7.11 to 2026.8.17

Release notes

Sourced from nox's releases.

2026.08.17 🪟

This is a small follow-up release to better support running the parallel mode on legacy windows.

We'd like to thank the following folks who contributed to this release:

Fixes:

Internal changes:

2026.08.10 🔀

This release can run sessions in parallel with --parallel/-j (experimental for now, report any bugs!). Requires session opt-in, or use --allow-parallel. Interpreter discovery now uses the python-discovery package, which should be better at finding Python and supports version specifier sets. Using this, script mode reads requires-python. Many bugs were fixed, mostly in Python version handling, conda version specifiers, and option precedence. Unrecognized global options are now an error.

We'd like to thank the following folks who contributed to this release:

Features:

Fixes:

... (truncated)

Changelog

Sourced from nox's changelog.

Changelog

2026.08.17

This is a small follow-up release to better support running the parallel mode on legacy windows.

We'd like to thank the following folks who contributed to this release:

Fixes:

Internal changes:

2026.08.10

This release can run sessions in parallel with --parallel/-j (experimental for now, report any bugs!). Requires session opt-in, or use --allow-parallel. Interpreter discovery now uses the python-discovery package, which should be better at finding Python and supports version specifier sets. Using this, script mode reads requires-python. Many bugs were fixed, mostly in Python version handling, conda version specifiers, and option precedence. Unrecognized global options are now an error.

We'd like to thank the following folks who contributed to this release:

Features:

... (truncated)

Commits
  • a976d7e docs: prepare 2026.08.17 release notes (#1168)
  • ade83de chore: tighten mypy and pytest config (#1167)
  • c699c47 fix: support legacy encodings in parallel reporter (#1160)
  • f85d050 chore(deps): bump pre-commit hooks, hold pyproject-fmt at 2.26.0 (#1163)
  • 4b9d946 chore(deps): bump the github-actions group with 2 updates (#1162)
  • 57f9e10 docs: prepare 2026.08.10 release notes (#1156)
  • c7134d4 fix: isolate script mode from inherited PYTHONPATH (#1157)
  • aad0ea8 fix: require virtualenv 21+ on Python 3.15 (#1158)
  • 00c9566 fix: conda version constraints on Windows (#1146)
  • 1d6b258 fix: drop stale type ignores for argcomplete 3.7.2 (#1155)
  • Additional commits viewable in compare view

Updates poetry from 2.4.1 to 2.4.2

Release notes

Sourced from poetry's releases.

2.4.2

Fixed

  • Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
  • Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
  • Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).
Changelog

Sourced from poetry's changelog.

[2.4.2] - 2026-08-29

Fixed

  • Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
  • Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
  • Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).
Commits
  • 15ce1fc release: bump version to 2.4.2
  • 3dd0f2d perf: avoid unnecessary downloads when the index does not provide hashes
  • c2f9af2 Fail closed when a locked hash cannot be checked
  • 3a194dd fix: reject invalid link filenames when downloading files (#11029)
  • 22173fd fix: refuse to write files outside the target directory during sdist extracti...
  • See full diff in compare view

Updates virtualenv from 21.7.0 to 21.7.7

Release notes

Sourced from virtualenv's releases.

21.7.7

What's Changed

Full Changelog: pypa/virtualenv@21.7.6...21.7.7

21.7.6

What's Changed

Full Changelog: pypa/virtualenv@21.7.5...21.7.6

21.7.5

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@21.7.4...21.7.5

21.7.4

What's Changed

Full Changelog: pypa/virtualenv@21.7.3...21.7.4

21.7.3

What's Changed

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.7

  • Bump the python-discovery minimum to >=1.6 for PythonInfo.system_exe, which reports the system interpreter without the nullable typing of system_executable - by :user:gaborbernat. (:issue:3224)

Improved Documentation - 21.7.7

  • Document the names the interpreter answers to inside a created environment. A new :doc:reference/environment-layout page lists them per platform, the tutorial and the usage guide point at it, and the explanation of creators covers why an environment carries several names and why Windows copies a redirector - by :user:gaborbernat. (:issue:3225)

v21.7.6 (2026-08-28)

Bugfixes - 21.7.6

  • On Windows, virtualenv no longer copies the CPython 3.13+ venvlauncher.exe shim into Scripts under the shim's own name, and a host such as python_d.exe gets its alias back. The alias set took its names from the shim that stands in for the interpreter, so every environment gained a stray launcher copy and lost the interpreter's own file name - by :user:darrenhuai. (:issue:3223)

v21.7.5 (2026-08-25)

Bugfixes - 21.7.5

  • Fix the type check against python-discovery 1.5.2, whose annotations allow a None prefix and integer sysconfig_vars values: config var substitution now skips a missing prefix and locating the shared libpython requires string INSTSONAME/LIBDIR values. (:issue:3211)
  • ExePathRef.can_run now checks the group and other execute bits instead of only the owner one, and returns False rather than None when a file carries none of the three - by :user:darrenhuai. (:issue:3217)
  • safe_delete no longer passes ignore_errors=True to shutil.rmtree, which replaced its own chmod-and-retry handler with a no-op and swallowed every failure. Read-only files - every file in a wheel image, which set_tree marks - survived, so --reset-app-data and --clear kept trees they reported deleting. The handler now retries only the deletion itself, keeps the other mode bits, and raises the original error for anything it cannot clear - by :user:darrenhuai. (:issue:3222)

v21.7.4 (2026-08-10)

Bugfixes - 21.7.4

... (truncated)

Commits
  • b65d93d release 21.7.7
  • 72776f2 🎨 refactor(create): read the system exe without narrowing (#3224)
  • 8fab8d6 📄 docs: document the interpreter names in an environment (#3225)
  • 267f4cd release 21.7.6
  • 28c4cd1 🐛 fix(create): name Windows venv exes after the interpreter (#3223)
  • 2a645ae release 21.7.5
  • a48bf4b 🐛 fix(util): make safe_delete's error handler actually run (#3222)
  • 31b5081 🐛 fix(create): check every execute bit in ExePathRef.can_run (#3217)
  • 5640eef [pre-commit.ci] pre-commit autoupdate (#3221)
  • 1ebcab6 docs: actualize python support version (#3220)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 1, 2026
@aecorn

aecorn commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
Bump the workflows-dependencies group across 1 directory with 4 updates
1a8f193 
Bumps the workflows-dependencies group with 4 updates in the /.github/workflows directory: [pip](https://github.com/pypa/pip), [nox](https://github.com/wntrblm/nox), [poetry](https://github.com/python-poetry/poetry) and [virtualenv](https://github.com/pypa/virtualenv).


Updates `pip` from 26.1 to 26.2.1
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@26.1...26.2.1)

Updates `nox` from 2026.7.11 to 2026.8.17
- [Release notes](https://github.com/wntrblm/nox/releases)
- [Changelog](https://github.com/wntrblm/nox/blob/main/CHANGELOG.md)
- [Commits](wntrblm/nox@2026.07.11...2026.08.17)

Updates `poetry` from 2.4.1 to 2.4.2
- [Release notes](https://github.com/python-poetry/poetry/releases)
- [Changelog](https://github.com/python-poetry/poetry/blob/main/CHANGELOG.md)
- [Commits](python-poetry/poetry@2.4.1...2.4.2)

Updates `virtualenv` from 21.7.0 to 21.7.7
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.7.0...21.7.7)

---
updated-dependencies:
- dependency-name: nox
  dependency-version: 2026.8.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workflows-dependencies
- dependency-name: pip
  dependency-version: 26.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workflows-dependencies
- dependency-name: poetry
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: workflows-dependencies
- dependency-name: virtualenv
  dependency-version: 21.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: workflows-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the workflows-dependencies group in /.github/workflows with 4 updates Bump the workflows-dependencies group across 1 directory with 4 updates Sep 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/dot-github/workflows/workflows-dependencies-821b8ffc3f branch from 33086d8 to 1a8f193 Compare September 2, 2026 11:12
@aecorn
aecorn merged commit aa00dee into main Sep 2, 2026
16 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/dot-github/workflows/workflows-dependencies-821b8ffc3f branch September 2, 2026 11:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aecorn aecorn aecorn approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@aecorn