[dependabot]

Bumps the uv-dependencies group with 21 updates:

Package	From	To
mypy	2.3.1	2.4.1
ruff	0.16.9	0.17.3
pytest	9.1.1	9.2.0
ast-serialize	0.11.2	0.13.1
black	26.5.1	26.10.1
certifi	2026.7.22	2026.10.23
charset-normalizer	3.5.1	3.5.2
distlib	0.4.3	0.4.4
executing	2.2.1	2.3.0
filelock	3.32.7	4.1.0
iniconfig	2.3.0	2.3.1
jedi	0.20.0	0.20.1
librt	0.15.0	0.16.0
markupsafe	3.0.3	3.0.4
platformdirs	4.12.1	4.12.4
pluggy	1.6.0	1.7.0
python-discovery	1.6.1	1.6.7
sphinxcontrib-jsmath	1.0.1	2.0.0
tomli	2.4.1	2.5.0
virtualenv	21.13.0	21.15.1
wcwidth	0.9.1	0.9.4

Updates mypy from 2.3.1 to 2.4.1

Changelog

Sourced from mypy's changelog.

Mypy 2.4.1

• Process overloads as a whole in two-phase type checking (Ivan Levkivskyi, PR 22231)
• Skip recursive setup for frame-private nested functions in mypyc (Piotr Sawicki, PR 22187)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• A5rocks
• Adam Dangoor
• Alex Waygood
• Ali Hamdan
• Brian Helba
• Chad Dombrova
• David Foster
• dnwpark
• Edgar Ramírez Mondragón
• Giorgos Michas
• Ivan Levkivskyi
• Jelle Zijlstra
• Jukka Lehtosalo
• Marc Mueller
• Michael R. Crusoe
• NIYONSHUTI Emmanuel
• Piotr Sawicki
• Shantanu
• themylogin
• Vaggelis Danias
• Willy Bruns

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

... (truncated)

Commits

• ad02a35 Skip test for 2.4.1
• cad7794 Finalize version to 2.4.1
• d9cbcbc Add changelog for Mypy 2.4.1 (#22310)
• 2860baa Process overloads as a whole in two-phase type-checking (#22231)
• 9b3e307 [mypyc] Skip recursive setup for frame-private nested functions (#22187)
• 10ad5f6 Bump ast-serialize to 0.12.1 (#22093)
• 350052f Bump ast-serialize to 0.12.0 (#22087)
• f7d08cf Bump version to 2.4.1+dev
• 935ba8a Bump version to 2.4.0
• 334a678 Add link for PR 22066 in mypy 2.4 changelog (#22082)
• Additional commits viewable in compare view

Updates ruff from 0.16.9 to 0.17.3

Release notes

Sourced from ruff's releases.

0.17.3

Release Notes

Released on 2026-10-26.

Preview features

• [suspicious] Add shared-clock-mock (#29074)

Bug fixes

• [pyupgrade] Avoid incorrect conversions to f-strings (UP032) (#25485)

Performance

• Buffer stdout in ruff format (#29631)
• Specialize ASCII identifier lexing (#29503)
• Speed up identifier and keyword lexing (#29463)

Documentation

• [flake8-bandit] Describe what the rule actually checks for httpx (S113) (#27936)

Contributors

• @​itsvedantkumar
• @​charliermarsh
• @​anishgirianish

Install ruff 0.17.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.ps1 | iex"

Download ruff 0.17.3

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.3

Released on 2026-10-26.

Preview features

• [suspicious] Add shared-clock-mock (#29074)

Bug fixes

• [pyupgrade] Avoid incorrect conversions to f-strings (UP032) (#25485)

Performance

• Buffer stdout in ruff format (#29631)
• Specialize ASCII identifier lexing (#29503)
• Speed up identifier and keyword lexing (#29463)

Documentation

• [flake8-bandit] Describe what the rule actually checks for httpx (S113) (#27936)

Contributors

• @​itsvedantkumar
• @​charliermarsh
• @​anishgirianish

0.17.2

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

... (truncated)

Commits

• ba65abf Bump version to 0.17.3 (#29745)
• fb2f921 [ty] Fix narrowing of strings and integers compared with enum members (#29743)
• d181287 [ty] Index nominal union alternatives (#29196)
• 07872ad [ty] Preserve string literals in comparisons with LiteralString (#29741)
• 95888b2 [ty] Preserve narrowing after guarded match subject captures (#29558)
• 3c8166b [ty] Fix hang when negating recursive unions of instance types (#29652)
• 3fd20e0 [ty] Preserve generic callback specializations during return refinement (#29667)
• 2f0a29e [ty] Record predicate truthiness alongside expression inference (#29706)
• 60f104a [ty] Honor @​override on overload implementations in stubs (#29470)
• 207ec3a [ty] Add diagnostic baseline support (#27636)
• Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

• #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

• #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

  Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

• #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

  • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
  • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

  pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

• #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

• #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

• #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

  They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

• #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

• #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

• #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
• #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
• #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

• #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits

• ae1d0ff Prepare release version 9.2.0
• 143ce31 pre-commit: exclude codespell on generated release announcements
• 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
• a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
• 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
• 41d12cd docs: clarify typing for yield fixtures
• b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
• 16f87a7 docs: improve getting-started.rst test execution description
• 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
• ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
• Additional commits viewable in compare view

Updates ast-serialize from 0.11.2 to 0.13.1

Commits

• e83de7d Bump version to 0.13.1
• 4b10d47 Make file-level type: ignore consistent with mypy: ignore (#97)
• 42628bd Bump version to 0.13.0
• 67659a0 Straighten type comment parsing (#95)
• 8d0a5c6 Bump version to 0.12.1
• a7f11b1 Fix parsing plain None type in a string (#96)
• bcf707f Bump version to 0.12.0
• 89b6e83 Allow colon in error codes (#94)
• See full diff in compare view

Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
• Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

• Add --cache-dir to configure the cache directory from the command line (#5433)
• Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)
• Keep the parentheses around a walrus that is the only item in a set (for example {(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't parse it without them (#5502)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
• Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

... (truncated)

Commits

• 258e7db Prepare release 26.10.1 (#5511)
• ac1f715 Action: validate required-version better (#5510)
• fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
• 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
• 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
• c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
• 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
• c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
• eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
• 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
• Additional commits viewable in compare view

Updates certifi from 2026.7.22 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• 662df63 Restore unaffected emSign roots (#439) (#440)
• 5cb238c Remove emsign (#437)
• 69494a7 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)
• 029c7b0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)
• 9d0a8f1 Add support for Python 3.15 (#432)
• db472ab Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)
• See full diff in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates distlib from 0.4.3 to 0.4.4

Changelog

Sourced from distlib's changelog.

0.4.4

Released: 2026-10-16


compat

Fixed a missing import. Thanks to Andrej730 for the patch.



markers

Fixed #273: Enforce compatible-release bounds in environment markers.
Thanks to Luochenchen for the patch.



metadata

Fix #194: Add an urls property to expose project and home URLs. Thanks to
Sinkleberg for the patch.



scripts


Raise the correct exception when a launcher can't be written. Thanks to
candygoogy for the patch.


Fix #144: Detect shell-script Python executables in ScriptMaker shebangs.
Thanks to Alex Chen for the patch.




util


Improve performance of export entry search to take linear time. Thanks to
Brian Willows for the patch.


Use tarfile.data_filter rather than tarfile.tar_filter in unarchive()
when extraction filters are available, matching the Python 3.14 default. Path and
link containment checks now use os.path.realpath and no longer fail with
IndexError for members such as . or ./. Thanks to Kobain for the patch.


unarchive() now resolves member paths through symlinks seen earlier in the
same archive, so a chain of individually harmless-looking links cannot be used
to write outside the destination on Pythons without extraction filters. Thanks to
Kobain for the patch.




version


Improve NormalizedVersion by addressing correctness and performance gaps
found by comparison with packaging. Thanks to Damian Shaw for the patch.


Improve SemanticVersion by comparing numeric prerelease identifiers,
including those longer than 8 digits. Thanks to Muneeb Sheikh for the
patch.

Commits

• 25eed06 Changes for 0.4.4.
• 8ffee6f Resolve member paths through earlier archive symlinks in unarchive()
• ef4a390 Test that data_filter rejects absolute symlinks with check=False
• 380b6a9 Use data_filter and realpath containment checks in unarchive()
• 7b7c572 fix: enforce compatible-release bounds in markers (#274)
• 38811dd Detect shell-script Python executables in ScriptMaker shebangs (#144) (#264)
• 06ddb5d Compare numeric prerelease identifiers without a digit limit (#270)
• e54dd8c Raise the original error when a launcher can't be written (#269)
• c6270e3 Fix NormalizedVersion gaps found by comparison with packaging (#271)
• 5b3092b Search export entries in linear time (#266)
• Additional commits viewable in compare view

Updates executing from 2.2.1 to 2.3.0

Commits

• 57917e8 remove tox from release script
• 7719501 formatting (#108)
• 3a52bb2 3.15 support (#109)
• 0dc8a1c refactor: convert type comments to type annotations (#105)
• ae10d56 build(deps): bump ipython from 4.2.1 to 8.10.0 (#106)
• 3646ef3 build(deps): bump pygments from 2.19.2 to 2.20.0 (#104)
• 82a0574 chore: use pyproject.toml (#103)
• See full diff in compare view

Updates filelock from 3.32.7 to 4.1.0

Release notes

Sourced from filelock's releases.

4.1.0

Features

• Import OwnerMode, CompromiseReason and has_fcntl from filelock. #790 by @​gaborbernat.
• AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. #803 by @​gaborbernat.
• A Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. #815 by @​gaborbernat.
• Every option given in seconds takes a Decimal or Fraction, as a file lock's timeout already did, and a read-write lock or lease refuses a bool or string one. #815 by @​gaborbernat.

Bug fixes

• is_lock_held_by_us and is_lock_held_by_us return False for a marker an earlier process with the same PID left behind. #774 by @​lprnmns.
• SoftFileLock removes its marker when writing it fails and closing the descriptor fails too, so the lock path no longer stays blocked. #775 by @​harbinresearcher.
• acquire and acquire no longer wait past timeout when poll_interval is longer than the time left. #777 by @​feiiiiii5.
• SoftReadWriteLock ignores a generation-log entry whose name is not 20 ASCII digits, which used to stop its heartbeat thread or delete real generations. #778 by @​dxbjavid.
• ReadWriteLock, SoftReadWriteLock and their async wrappers treat a inf timeout like -1 and raise ValueError for a blocking nan one. #779 by @​darrenhuai.
• ReadWriteLock and SoftReadWriteLock accept a timeout above TIMEOUT_MAX instead of raising OverflowError. #780 by @​darrenhuai.
• acquire raises ValueError for a blocking nan timeout or a poll_interval above TIMEOUT_MAX, and treats a inf timeout like -1. #781 by @​gaborbernat.
• SoftFileLock and MarkerSoftFileLock treat a marker cut before its final newline as malformed, so a crash-truncated record self-heals and a read mid-write no longer breaks a live lock. #782 by @​gaborbernat.
• UnixFileLock no longer deletes another process's live marker when it falls back to a soft lock on ENOSYS, and on macOS a lock path ending in a separator raises FileNotFoundError instead of retrying. #785 by @​gaborbernat.
• SoftFileLock and SoftFileLease put back a live successor's marker that a racing stale break moved aside, so a third contender no longer acquires beside the successor. #786 by @​gaborbernat.
• StrictSoftFileLock removes every claim a failed acquire published, counts an EEXIST link that landed as published, and no longer reports is_locked after a failed claim cleanup. #787 by @​gaborbernat.
• On Python 3.10 without the exceptiongroup backport, a release failure under the default context_error_policy no longer turns into ModuleNotFoundError; cleanup failures chain instead of grouping, and on_acquired is allowed. #788 by @​gaborbernat.
• AsyncReadWriteLock and AsyncSoftReadWriteLock drop a task's hold when a caller cancels it during a release that still completes, instead of blocking every later writer. #789 by @​gaborbernat.
• SoftFileLease releases a lease dropped while held, at garbage collection or interpreter exit, and raises ValueError for a heartbeat_interval above TIMEOUT_MAX. #791 by @​gaborbernat.
• StrictSoftFileLock judges an abandoned private record's age by the filesystem's clock, so a client clock ahead of an NFS server no longer aborts live publications. #792 by @​gaborbernat.
• BaseAsyncFileLock raises RuntimeError instead of CancelledError when its executor shuts down with the call still queued, and a waiter interrupted by anything else no longer wedges later calls. #793 by @​gaborbernat.
• Constructing or closing a second ReadWriteLock on a held database no longer drops the holder's lock, so other processes stay excluded. #794 by @​gaborbernat.
• SoftReadWriteLock no longer admits a second writer after <path>.rw is removed under a live instance, and flushes each snapshot before publishing it so a crash cannot leave an empty one that wedges every peer. #795 by @​gaborbernat.
• SoftFileLease reclaims a dead MarkerSoftFileLock owner, and expires a lease or a malformed soft marker after it stays unchanged on the contender's own monotonic clock, so clock skew cannot break it. #796 by @​gaborbernat.
• A soft lock marker written in a Linux container records its PID namespace with the hostname, so a sibling container that shares the hostname and volume no longer breaks a live lock. #797 by @​gaborbernat.
• SoftReadWriteLock.close() makes an acquire still waiting in another thread raise RuntimeError, where it used to take the lock on the closed instance and hold it until the process exited. #798 by @​gaborbernat.
• SoftReadWriteLock reads the head from gen/HEAD, so a client whose cached directory listing is more than 64 generations stale no longer takes an old generation for the head and forks the log. #799 by @​gaborbernat.
• When the garbage collector finalizes a held BaseAsyncFileLock, it releases on a loop running in another thread, or in place once no loop is left; the lifetime check and path resolution now run in the executor. #800 by @​gaborbernat.
• SoftReadWriteLock waits out a holder's own stale_threshold before evicting it, keys its singleton on the path its log sits beside, and no longer leaks ledger entries or the holder record of a failed acquire. #801 by @​gaborbernat.
• lock_descriptor raises ValueError for a blocking poll_interval above TIMEOUT_MAX up front, instead of OverflowError once the descriptor is contended. #802 by @​sricharanreddycheruku.
• BaseFileLock rejects a bool or string timeout, an out-of-range mode and a non-bool blocking set at any time, rejects unknown options on a singleton cache hit, and tracks an on_acquired reacquire. #803 by @​gaborbernat.
• StrictSoftFileLock raises SoftFileLockProtocolError naming a directory, symlink or exited soft-lock owner's marker at the lock path, and lock_path_occupant shows what blocks it. #804 by @​gaborbernat.
• ReadWriteLock raises ValueError for a WAL-mode database instead of disk I/O error, and its /dev/fd fallback links beside the database, so a lock off the TMPDIR filesystem no longer fails with EXDEV. #805 by @​gaborbernat.
• ReadWriteLock.release() from a thread that holds no read level raises RuntimeError instead of ending another thread's read lock and letting a writer in. #806 by @​gaborbernat.
• SoftFileLockLifetimeWarning derives from FutureWarning instead of DeprecationWarning, so Python shows it by default outside __main__. #807 by @​gaborbernat.
• SoftFileLock applies an explicit mode past the umask as UnixFileLock does, and reads a marker number spelled other than in ASCII digits, or a lease with an empty token, as malformed. #807 by @​gaborbernat.
• ReadWriteLock raises OSError when its database is unlinked or replaced while an acquisition waits, instead of taking a lock that no later opener sees. #808 by @​gaborbernat.
• On a thread-local synchronous lock, release with force=True and garbage collection release holds exited threads left, and a release() re-entered from a signal handler closes the descriptor once. #810 by @​gaborbernat.
• SoftFileLease records a lease_duration given as a float subclass, such as NumPy's, in a form every contender parses, so a live lease is no longer evicted as malformed. #815 by @​gaborbernat.
• StrictSoftFileLock raises SoftFileLockProtocolError for a file at the lock path it cannot parse once it stays unchanged for two seconds, instead of waiting on it forever. #815 by @​gaborbernat.
• A lock finalized at interpreter exit no longer hangs when a daemon thread stopped inside filelock's fork bookkeeping. #815 by @​gaborbernat.

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-6:

---

4.2.6 (2026-10-31)

---

.. _release-4-2-6-fixed:

Fixed

• Fix a race in :class:~filelock.SoftFileLock, :class:~filelock.MarkerSoftFileLock and :class:~filelock.SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (:pr:899) by :user:dxbjavid and :user:gaborbern...

  Description has been truncated

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
src/bam2tensor
metadata.py
Project Total

This report was generated by python-coverage-comment-action