From 259ae74b3421de5243b7d44604c4ddafe0c2abb6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:23:37 +0000
Subject: [PATCH 1/6] Bump pip from 26.1.2 to 26.2 (#13309)

Bumps [pip](https://github.com/pypa/pip) from 26.1.2 to 26.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's
changelog</a>.</em></p>
<blockquote>
<h1>26.2 (2026-07-29)</h1>
<h2>Deprecations and Removals</h2>
<ul>
<li>
<p>Newly published packages will no longer be immediately visible to pip
if the index uses caching. To install a newly published package, use
<code>--refresh-package</code>.
(<code>[#13680](https://github.com/pypa/pip/issues/13680)
&lt;https://github.com/pypa/pip/issues/13680&gt;</code>_)</p>
</li>
<li>
<p>Drop support for detecting legacy, non-:pep:<code>405</code>,
<code>virtualenv</code> (&lt; 20)
environments. (<code>[#14062](https://github.com/pypa/pip/issues/14062)
&lt;https://github.com/pypa/pip/issues/14062&gt;</code>_)</p>
</li>
<li>
<p>Constraints files, including <code>PIP_CONSTRAINT</code>, no longer
affect isolated
build environments. Use <code>--build-constraint</code> or the
<code>PIP_BUILD_CONSTRAINT</code>
environment variable to constrain build dependencies instead.</p>
<p>The <code>--use-feature=build-constraint</code> flag is now always
enabled and has no
effect. (<code>[#14094](https://github.com/pypa/pip/issues/14094)
&lt;https://github.com/pypa/pip/issues/14094&gt;</code>_)</p>
</li>
</ul>
<h2>Features</h2>
<ul>
<li>
<p>Declare support for Python 3.15
(<code>[#14208](https://github.com/pypa/pip/issues/14208)
&lt;https://github.com/pypa/pip/issues/14208&gt;</code>_)</p>
</li>
<li>
<p>Support self-referential extras officially. pip has supported this by
accident since version 21.2.
(<code>[#11296](https://github.com/pypa/pip/issues/11296)
&lt;https://github.com/pypa/pip/issues/11296&gt;</code>_)</p>
</li>
<li>
<p>Add <code>--only-deps</code> flag to instruct pip to select only the
dependencies
of supplied packages. It cannot be used with <code>--no-deps</code>,
<code>-r</code>, <code>--group</code>,
or <code>--requirements-from-script</code>.
(<code>[#11440](https://github.com/pypa/pip/issues/11440)
&lt;https://github.com/pypa/pip/issues/11440&gt;</code>_)</p>
</li>
<li>
<p>Cache simple responses in accordance to their
<code>Cache-Control</code> header
instead of always revalidating on every request. To refresh cached
package index responses
and ensure newly published packages are found, use
<code>--refresh-package &lt;package&gt;</code>.
(<code>[#13680](https://github.com/pypa/pip/issues/13680)
&lt;https://github.com/pypa/pip/issues/13680&gt;</code>_)</p>
</li>
<li>
<p>Add <code>--no-require-hashes</code> to disable automatic enablement
of
<code>--require-hashes</code> when encountering a requirement with
hashes. (<code>[#14169](https://github.com/pypa/pip/issues/14169)
&lt;https://github.com/pypa/pip/issues/14169&gt;</code>_)</p>
</li>
<li>
<p>Honor <code>--only-final</code> when sourcing requirements with
<code>-r pylock.toml</code>.
(<code>[#13950](https://github.com/pypa/pip/issues/13950)
&lt;https://github.com/pypa/pip/issues/13950&gt;</code>_)</p>
</li>
<li>
<p>Add support for <code>pylock.toml</code> <code>upload-time</code>
field, so <code>--uploaded-prior-to</code> works with <code>-r
pylock.toml</code>.
(<code>[#14168](https://github.com/pypa/pip/issues/14168)
&lt;https://github.com/pypa/pip/issues/14168&gt;</code>_)</p>
</li>
<li>
<p>Better error messages in case of conflicts with requirements from
<code>-r pylock.toml</code>.
(<code>[#13963](https://github.com/pypa/pip/issues/13963)
&lt;https://github.com/pypa/pip/issues/13963&gt;</code>_)</p>
</li>
<li>
<p>Add experimental support for isolating build subprocesses by creating
standard
virtual environments. This will fix most (if not all) subtle isolation
issues
that can lead to broken builds exclusive to pip. The feature can be
enabled
via <code>--use-feature=venv-isolation</code> and will be enabled by
default in a future
release.</p>
<p>Note that the feature has limited compatibility with
<code>--use-feature=inprocess-build-deps</code>.
While most builds should work with both features enabled, there are
known edge cases.
<code>inprocess-build-deps</code> will not be enabled by default until
they are fixed.
(<code>[#14070](https://github.com/pypa/pip/issues/14070)
&lt;https://github.com/pypa/pip/issues/14070&gt;</code>_)</p>
</li>
<li>
<p>Present more informative diagnostic errors on uncaught network
errors. (<code>[#14115](https://github.com/pypa/pip/issues/14115)
&lt;https://github.com/pypa/pip/issues/14115&gt;</code>_)</p>
</li>
<li>
<p>Allow opting out of Git partial clones with
<code>PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER</code>.
(<code>[#11043](https://github.com/pypa/pip/issues/11043)
&lt;https://github.com/pypa/pip/issues/11043&gt;</code>_)</p>
</li>
<li>
<p>Add a <code>--no-proxy-env</code> (or <code>--proxy
&quot;&quot;</code>) option to ignore proxies
configured via non-pip environment variables or configuration files.
A proxy set with <code>--proxy</code> is still used.
(<code>[#5378](https://github.com/pypa/pip/issues/5378)
&lt;https://github.com/pypa/pip/issues/5378&gt;</code>_)</p>
</li>
<li>
<p>Add support for pulling username from keyring subprocess provider
(<code>[#12543](https://github.com/pypa/pip/issues/12543)
&lt;https://github.com/pypa/pip/issues/12543&gt;</code>_)</p>
</li>
<li>
<p>Speedup tab autocompletion by lazy-importing certain modules.
(<code>[#4768](https://github.com/pypa/pip/issues/4768)
&lt;https://github.com/pypa/pip/issues/4768&gt;</code>_)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/pip/commit/4b6ae5c4d7d63a61a99fbecbead8dbc35cc8b357"><code>4b6ae5c</code></a>
Bump for release</li>
<li><a
href="https://github.com/pypa/pip/commit/50b6d3cf998e141d106e72ba17380c39f979188d"><code>50b6d3c</code></a>
Update AUTHORS.txt</li>
<li><a
href="https://github.com/pypa/pip/commit/dbddfbde3a2f57401c9ad1b910aee6d195af7b8d"><code>dbddfbd</code></a>
Tweak news entries for pip 26.2 (<a
href="https://redirect.github.com/pypa/pip/issues/14212">#14212</a>)</li>
<li><a
href="https://github.com/pypa/pip/commit/6576b7596c97bb95ce02098303d25bf82dd44943"><code>6576b75</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/14165">#14165</a> from
sbidoul/refactor-pylock-hanling-sbi</li>
<li><a
href="https://github.com/pypa/pip/commit/0090e0065ae0087d5d6c171a4eb1821e127aa120"><code>0090e00</code></a>
Address a variety of typos detected in code review</li>
<li><a
href="https://github.com/pypa/pip/commit/e12ddd958df6878f38f2a6f777e4653613eb4821"><code>e12ddd9</code></a>
Add support for --uploaded-prior-to with -r pylock.toml</li>
<li><a
href="https://github.com/pypa/pip/commit/5eefdbcb09ab9783ab89f33fb85c48abf45eb7be"><code>5eefdbc</code></a>
Better conflict report for requirements from -r pylock.toml</li>
<li><a
href="https://github.com/pypa/pip/commit/6d71ff83d64b36504761990911e797c0f5d259d1"><code>6d71ff8</code></a>
Test --only-final with -r pylock.toml</li>
<li><a
href="https://github.com/pypa/pip/commit/e7d6eb9983980a6380a12e0822da2c1c560e1bb4"><code>e7d6eb9</code></a>
Refactor -r pylock.toml</li>
<li><a
href="https://github.com/pypa/pip/commit/756506d154a5b5b5746e9c66bc6e52d6ae3803a9"><code>756506d</code></a>
Add TODO about pylock.select and --no-binary</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/pip/compare/26.1.2...26.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=26.1.2&new-version=26.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements/constraints.txt | 2 +-
 requirements/dev.txt         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index 2017ff8b303..29209b8ae88 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -161,7 +161,7 @@ packaging==26.2
     #   wheel
 pathspec==1.1.1
     # via mypy
-pip==26.1.2
+pip==26.2
     # via pip-tools
 pip-tools==7.6.0
     # via -r requirements/dev.in
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 205e020c906..125239f61c7 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -158,7 +158,7 @@ packaging==26.2
     #   wheel
 pathspec==1.1.1
     # via mypy
-pip==26.1.2
+pip==26.2
     # via pip-tools
 pip-tools==7.6.0
     # via -r requirements/dev.in

From 0dbe3d62fd80246b649a4db6dab40813beb91019 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:23:52 +0000
Subject: [PATCH 2/6] Bump github/codeql-action from 4.37.3 to 4.37.4 (#13308)

Bumps [github/codeql-action](https://github.com/github/codeql-action)
from 4.37.3 to 4.37.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.4</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/f205ea1c3313d32999d8d6a48b4f6530d4437b38"><code>f205ea1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4053">#4053</a>
from github/update-v4.37.4-9130ce0f7</li>
<li><a
href="https://github.com/github/codeql-action/commit/e40d079dd9dd4a5c74f625cecd83867c8208aa71"><code>e40d079</code></a>
Update changelog for v4.37.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/9130ce0f733a0d17b9e1b9692c2af19be6c69dda"><code>9130ce0</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4051">#4051</a>
from github/update-bundle/codeql-bundle-v2.26.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/c62d82468641dca0f8df108ab73e2a8407ac9cf7"><code>c62d824</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/da0c1901011e62af9c02aae8bf5b8885b11f7741"><code>da0c190</code></a>
Update default bundle to codeql-bundle-v2.26.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/18420e3271f74589575af831a523c833acda327f"><code>18420e3</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4043">#4043</a>
from github/mbg/ts/changelog</li>
<li><a
href="https://github.com/github/codeql-action/commit/7e8d8970f03ec5a78ab372fc0778e8e4194111a5"><code>7e8d897</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4046">#4046</a>
from github/mbg/repo-prop/code-quality</li>
<li><a
href="https://github.com/github/codeql-action/commit/2d4c474c2ca5ea2965b9e53fabb7b67b0100016c"><code>2d4c474</code></a>
Log <code>!analysisKindSupported</code> case</li>
<li><a
href="https://github.com/github/codeql-action/commit/98c05a17d327d7c4055fca83114434ab56baacf6"><code>98c05a1</code></a>
Fix argument validation in <code>rollback-changelog.ts</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/8289a49271cbb335d374e7e2e7a50c1576be0afe"><code>8289a49</code></a>
Ignore repository property for unsupported analysis kinds</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/v4.37.3...v4.37.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4.37.3&new-version=4.37.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1a48f1b324d..a2201ec7c0a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,17 +29,17 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.3
+        uses: github/codeql-action/init@v4.37.4
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql.yml
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.37.3
+        uses: github/codeql-action/autobuild@v4.37.4
         if: ${{ matrix.language == 'python' || matrix.language == 'javascript' }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.3
+        uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:${{ matrix.language }}"

From 9b70452f5bb356ce8ba508786f4c62e63222b50f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:34:28 +0000
Subject: [PATCH 3/6] Bump filelock from 3.32.0 to 3.32.2 (#13310)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.0 to
3.32.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/py-filelock/releases">filelock's
releases</a>.</em></p>
<blockquote>
<h2>3.32.2</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Fix test failures on NetBSD (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/689">#689</a>)
by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/filelock/pull/693">tox-dev/filelock#693</a></li>
<li>🧪 test(soft-rw): deflake writer phase-2 peer-marker test by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/filelock/pull/694">tox-dev/filelock#694</a></li>
<li>hand back the claim when a heartbeat thread fails to start by <a
href="https://github.com/dxbjavid"><code>@​dxbjavid</code></a> in <a
href="https://redirect.github.com/tox-dev/filelock/pull/691">tox-dev/filelock#691</a></li>
<li>🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/filelock/pull/695">tox-dev/filelock#695</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/filelock/compare/3.32.1...3.32.2">https://github.com/tox-dev/filelock/compare/3.32.1...3.32.2</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst">filelock's
changelog</a>.</em></p>
<blockquote>
<p>###########
Changelog
###########</p>
<p>.. towncrier-draft-entries:: Unreleased</p>
<p>.. towncrier release notes start</p>
<hr />
<p>3.32.2 (2026-07-29)</p>
<hr />
<ul>
<li>A <code>SoftReadWriteLock</code> or <code>SoftFileLease</code>
acquire whose heartbeat thread fails to start now unlinks its marker and
hands the claim back, instead of leaving an unrefreshed marker a peer
takes while the caller believes it still holds
the lock. :pr:<code>691</code></li>
</ul>
<hr />
<p>3.32.1 (2026-07-26)</p>
<hr />
<ul>
<li>Canceling an <code>AsyncSoftReadWriteLock</code> acquire now
releases the claim instead of leaking a marker whose heartbeat
wedges every contender. :pr:<code>686</code></li>
</ul>
<hr />
<p>3.32.0 (2026-07-21)</p>
<hr />
<ul>
<li><code>SoftReadWriteLock</code> closes the directory handle it opens
to scan for readers as soon as a scan stops early, rather
than holding it until the generator is collected.
:pr:<code>685</code></li>
<li>Declare support for Python 3.15 and run the test suite against it
and its free-threaded build, both currently in beta.
:pr:<code>683</code></li>
<li>The source distribution ships the capability probes the tests
import, and reading one no longer needs <code>coverage</code>
installed, so the suite runs from an unpacked sdist instead of failing
on a missing <code>coverage_pragmas</code>. :pr:<code>685</code></li>
</ul>
<hr />
<p>3.31.2 (2026-07-21)</p>
<hr />
<ul>
<li><code>filelock</code> imports again on runtimes whose
<code>errno</code> omits <code>ENOTSUP</code>, such as GraalPy, where
importing the package
raised <code>ImportError</code>. It probes the code instead, preferring
<code>ENOTSUP</code>, falling back to <code>EOPNOTSUPP</code> where that
name is absent, and dropping to <code>ENOSYS</code>/<code>EXDEV</code>
where neither exists. Platforms defining <code>ENOTSUP</code> keep their
behavior. :pr:<code>681</code></li>
</ul>
<hr />
<p>3.31.1 (2026-07-20)</p>
<hr />
<ul>
<li>A <code>SoftFileLease</code> acquired on one thread keeps its claim
when another thread fails to acquire the same lease object,
so its heartbeat carries on refreshing the marker instead of being torn
down and letting a peer take the live claim. :pr:<code>680</code></li>
</ul>
<hr />
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tox-dev/filelock/commit/9a6cc4365b1e47368bce33ab005beb749983f3e5"><code>9a6cc43</code></a>
Release 3.32.2</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/56879c7fcbc2ffc412ce575c612a2003df2be2d3"><code>56879c7</code></a>
🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/695">#695</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/ecf5be040662529d093b1b70dd8ec564666b5a55"><code>ecf5be0</code></a>
hand back the claim when a heartbeat thread fails to start (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/691">#691</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/ee70d2edff7f9824987758445b51a22d81003017"><code>ee70d2e</code></a>
🧪 test(soft-rw): deflake writer phase-2 peer-marker test (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/694">#694</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/1eb14ddb6b979f49bc0c6818e8daba7dd08c28c1"><code>1eb14dd</code></a>
Fix test failures on NetBSD (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/689">#689</a>)
(<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/693">#693</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/d81e85936c51fa88430a0d91db595e989c0a088b"><code>d81e859</code></a>
build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/692">#692</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/6fbc90559e8e7efa5c24e66392aea662b19369c8"><code>6fbc905</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/690">#690</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/34d1c38260dc50d6b5d3c4b83f8b5f7125c17436"><code>34d1c38</code></a>
build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/688">#688</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/bf13ec7338eca96b2d09c719f464a0f1b8a1f093"><code>bf13ec7</code></a>
Release 3.32.1</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/887f1142cde10ba49c7270b7f0a8614239df1df3"><code>887f114</code></a>
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/687">#687</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tox-dev/py-filelock/compare/3.32.0...3.32.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.32.0&new-version=3.32.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements/constraints.txt | 2 +-
 requirements/dev.txt         | 2 +-
 requirements/lint.txt        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index 29209b8ae88..3144a5fd626 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -85,7 +85,7 @@ exceptiongroup==1.3.1
     #   pytest
 execnet==2.1.2
     # via pytest-xdist
-filelock==3.32.0
+filelock==3.32.2
     # via
     #   python-discovery
     #   virtualenv
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 125239f61c7..5bee177fcf2 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -83,7 +83,7 @@ exceptiongroup==1.3.1
     #   pytest
 execnet==2.1.2
     # via pytest-xdist
-filelock==3.32.0
+filelock==3.32.2
     # via
     #   python-discovery
     #   virtualenv
diff --git a/requirements/lint.txt b/requirements/lint.txt
index c7c84776f8a..d60522a0ef0 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -42,7 +42,7 @@ exceptiongroup==1.3.1
     # via
     #   aiofastnet
     #   pytest
-filelock==3.32.0
+filelock==3.32.2
     # via
     #   python-discovery
     #   virtualenv

From 12975720a6e93d4f03128ccb6330ec127745ebaf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:57:57 +0000
Subject: [PATCH 4/6] Bump virtualenv from 21.7.0 to 21.7.1 (#13314)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.0 to
21.7.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/releases">virtualenv's
releases</a>.</em></p>
<blockquote>
<h2>21.7.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>📝 docs(branding): clarify official logo vs favicon by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3200">pypa/virtualenv#3200</a></li>
<li>Upgrade embedded pip/setuptools/wheel by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3201">pypa/virtualenv#3201</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.0...21.7.1">https://github.com/pypa/virtualenv/compare/21.7.0...21.7.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's
changelog</a>.</em></p>
<blockquote>
<h1>Bugfixes - 21.7.1</h1>
<ul>
<li>
<p>Upgrade embedded wheels:</p>
<ul>
<li>pip to <code>26.2</code> from <code>26.1.2</code>
(:issue:<code>u</code>)</li>
</ul>
</li>
</ul>
<h1>Improved Documentation - 21.7.1</h1>
<ul>
<li>Document that <code>virtualenv.png</code> is the official logo and
<code>virtualenv.svg</code> is a simplified favicon-only mark - by
:user:<code>gaborbernat</code>. (:issue:<code>3199</code>)</li>
</ul>
<hr />
<p>v21.7.0 (2026-07-21)</p>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/virtualenv/commit/e46c8e94d63b4214da3c24e1bc4febcfbfee7395"><code>e46c8e9</code></a>
release 21.7.1</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/b66560a65d38d2ea7fe29829685b86a8d55146b5"><code>b66560a</code></a>
Upgrade embedded pip/setuptools/wheel (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3201">#3201</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/bf5f5206ec83e7536068e6f9525f8c8a9cda69ab"><code>bf5f520</code></a>
📝 docs(branding): clarify official logo vs favicon (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3200">#3200</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/8507c7b0a0210eaa67c5c81d4d081d7c49fa679f"><code>8507c7b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3197">#3197</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/694406aeafe8a16011e6c04bb7728d1cd531df12"><code>694406a</code></a>
chore(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3198">#3198</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/b486255413664ba1e7e264a7807e361feda5367b"><code>b486255</code></a>
chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3196">#3196</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/ac2ad97d67d2ecd6ceaaffde99586d98b7cfc8ea"><code>ac2ad97</code></a>
chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3195">#3195</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/df94b342b732f96859595104bebbcfa74a88616b"><code>df94b34</code></a>
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3194">#3194</a>)</li>
<li>See full diff in <a
href="https://github.com/pypa/virtualenv/compare/21.7.0...21.7.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements/constraints.txt | 2 +-
 requirements/dev.txt         | 2 +-
 requirements/lint.txt        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index 3144a5fd626..063d2cbe655 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -333,7 +333,7 @@ uvloop==0.22.1 ; platform_system != "Windows"
     #   -r requirements/lint.in
 valkey==6.1.1
     # via -r requirements/lint.in
-virtualenv==21.7.0
+virtualenv==21.7.1
     # via pre-commit
 wheel==0.47.0
     # via pip-tools
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 5bee177fcf2..87ad532db85 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -323,7 +323,7 @@ uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpytho
     #   -r requirements/lint.in
 valkey==6.1.1
     # via -r requirements/lint.in
-virtualenv==21.7.0
+virtualenv==21.7.1
     # via pre-commit
 wheel==0.47.0
     # via pip-tools
diff --git a/requirements/lint.txt b/requirements/lint.txt
index d60522a0ef0..0e27dcc65bd 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -166,7 +166,7 @@ uvloop==0.22.1 ; platform_system != "Windows"
     # via -r requirements/lint.in
 valkey==6.1.1
     # via -r requirements/lint.in
-virtualenv==21.7.0
+virtualenv==21.7.1
     # via pre-commit
 yarl==1.24.5
     # via aiohttp

From 58bae08b7e4831c6c184fe22233bfc19941c700b Mon Sep 17 00:00:00 2001
From: Rodrigo Nogueira <rodrigo.b.nogueira@gmail.com>
Date: Mon, 3 Aug 2026 10:11:36 -0300
Subject: [PATCH 5/6] Add METH_QUERY and treat QUERY as an idempotent method
 (#13301)

---
 aiohttp/client.py        |  5 ++++-
 aiohttp/hdrs.py          |  1 +
 tests/test_test_utils.py | 25 ++++++++++++++++++++++++-
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/aiohttp/client.py b/aiohttp/client.py
index 481663128fd..9e634a66290 100644
--- a/aiohttp/client.py
+++ b/aiohttp/client.py
@@ -216,7 +216,10 @@ class _WSConnectOptions(TypedDict, total=False):
 
 
 # https://www.rfc-editor.org/rfc/rfc9110#section-9.2.2
-IDEMPOTENT_METHODS = frozenset({"GET", "HEAD", "OPTIONS", "TRACE", "PUT", "DELETE"})
+# https://www.rfc-editor.org/info/rfc10008/#section-1-12
+IDEMPOTENT_METHODS = frozenset(
+    {"GET", "HEAD", "OPTIONS", "TRACE", "PUT", "DELETE", "QUERY"}
+)
 
 _RetType_co = TypeVar(
     "_RetType_co",
diff --git a/aiohttp/hdrs.py b/aiohttp/hdrs.py
index 1082da3f4cc..1f7aa7d7d7d 100644
--- a/aiohttp/hdrs.py
+++ b/aiohttp/hdrs.py
@@ -16,6 +16,7 @@
 METH_PATCH: Final[str] = "PATCH"
 METH_POST: Final[str] = "POST"
 METH_PUT: Final[str] = "PUT"
+METH_QUERY: Final[str] = "QUERY"
 METH_TRACE: Final[str] = "TRACE"
 
 METH_ALL: Final[set[str]] = {
diff --git a/tests/test_test_utils.py b/tests/test_test_utils.py
index 0d13b062bf0..068210bee0f 100644
--- a/tests/test_test_utils.py
+++ b/tests/test_test_utils.py
@@ -12,7 +12,7 @@
 from yarl import URL
 
 import aiohttp
-from aiohttp import web
+from aiohttp import hdrs, web
 from aiohttp.helpers import HeadersDictProxy
 from aiohttp.test_utils import (
     REUSE_ADDRESS,
@@ -356,6 +356,29 @@ async def handler(request: web.Request) -> web.Response:
     assert num_requests == 2
 
 
+async def test_retry_persistent_connection_query_method(
+    aiohttp_client: AiohttpClient,
+) -> None:
+    """QUERY is safe and idempotent, so it must trigger retry."""
+    num_requests = 0
+
+    async def handler(request: web.Request) -> web.Response:
+        nonlocal num_requests
+        num_requests += 1
+        if num_requests == 1:
+            request.protocol.force_close()
+        return web.Response()
+
+    app = web.Application()
+    app.router.add_route(hdrs.METH_QUERY, "/", handler)
+    client = await aiohttp_client(app)
+    client.session._retry_connection = True
+    async with client.request(hdrs.METH_QUERY, "/") as resp:
+        assert resp.status == 200
+
+    assert num_requests == 2
+
+
 async def test_server_context_manager(app: web.Application) -> None:
     async with TestServer(app) as server:
         async with aiohttp.ClientSession() as client:

From d5d068cb541ab7df5ecca14515475f9d4a379c5e Mon Sep 17 00:00:00 2001
From: Javid Khan <dxbjavid@gmail.com>
Date: Mon, 3 Aug 2026 18:42:41 +0530
Subject: [PATCH 6/6] parse cookie expires date as ascii-only (#13278)

---
 CHANGES/13278.bugfix.rst |  1 +
 aiohttp/cookiejar.py     | 12 +++++++-----
 tests/test_cookiejar.py  |  6 ++++++
 3 files changed, 14 insertions(+), 5 deletions(-)
 create mode 100644 CHANGES/13278.bugfix.rst

diff --git a/CHANGES/13278.bugfix.rst b/CHANGES/13278.bugfix.rst
new file mode 100644
index 00000000000..a036e50ada8
--- /dev/null
+++ b/CHANGES/13278.bugfix.rst
@@ -0,0 +1 @@
+Restricted cookie ``Expires`` date parsing to ASCII digits -- by :user:`dxbjavid`.
diff --git a/aiohttp/cookiejar.py b/aiohttp/cookiejar.py
index 8e945f3470d..d4e474ab98a 100644
--- a/aiohttp/cookiejar.py
+++ b/aiohttp/cookiejar.py
@@ -44,21 +44,23 @@
 class CookieJar(AbstractCookieJar):
     """Implements cookie storage adhering to RFC 6265."""
 
+    # https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.1
     DATE_TOKENS_RE = re.compile(
         r"[\x09\x20-\x2F\x3B-\x40\x5B-\x60\x7B-\x7E]*"
-        r"(?P<token>[\x00-\x08\x0A-\x1F\d:a-zA-Z\x7F-\xFF]+)"
+        r"(?P<token>[\x00-\x08\x0A-\x1F\d:a-zA-Z\x7F-\xFF]+)",
+        re.ASCII,
     )
 
-    DATE_HMS_TIME_RE = re.compile(r"(\d{1,2}):(\d{1,2}):(\d{1,2})")
+    DATE_HMS_TIME_RE = re.compile(r"(\d{1,2}):(\d{1,2}):(\d{1,2})", re.ASCII)
 
-    DATE_DAY_OF_MONTH_RE = re.compile(r"(\d{1,2})")
+    DATE_DAY_OF_MONTH_RE = re.compile(r"(\d{1,2})", re.ASCII)
 
     DATE_MONTH_RE = re.compile(
         "(jan)|(feb)|(mar)|(apr)|(may)|(jun)|(jul)|(aug)|(sep)|(oct)|(nov)|(dec)",
-        re.I,
+        re.I | re.ASCII,
     )
 
-    DATE_YEAR_RE = re.compile(r"(\d{2,4})")
+    DATE_YEAR_RE = re.compile(r"(\d{2,4})", re.ASCII)
 
     # calendar.timegm() fails for timestamps after datetime.datetime.max
     # Minus one as a loss of precision occurs when timestamp() is called.
diff --git a/tests/test_cookiejar.py b/tests/test_cookiejar.py
index 0c24df71c0b..9fa150a5d9a 100644
--- a/tests/test_cookiejar.py
+++ b/tests/test_cookiejar.py
@@ -141,6 +141,12 @@ def test_date_parsing() -> None:
     # Invalid time
     assert parse_func("Tue, 1 Jan 1970 77:88:99 GMT") is None
 
+    # Invalid digits
+    # https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.1
+    assert parse_func("Tue, ١ Jan ١٩٧٠ ٠٠:٠٠:٠٠ GMT") is None
+    assert parse_func("Tue, １ Jan １９７０ ００:００:００ GMT") is None
+    assert parse_func("Tue, 1 Jan 1970 ٠٠:٠٠:٠٠ GMT") is None
+
 
 def test_domain_matching() -> None:
     test_func = CookieJar._is_domain_match