Bump the ci-constraints group across 1 directory with 9 updates

[dependabot]

Bumps the ci-constraints group with 9 updates in the /ci directory:

Package	From	To
pygments	2.20.0	2.21.0
setuptools	83.0.0	84.0.0
wheel	0.47.0	0.48.0
charset-normalizer	3.4.9	3.5.1
cyclonedx-python-lib	11.11.0	11.12.0
filelock	3.32.2	3.32.3
idna	3.18	3.19
platformdirs	4.11.0	4.11.3
webencodings	0.5.1	0.6.1

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
  • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits

• a43b45d Get ready for the 2.21.0 release.
• d8f14cb Fix version_added for Purescript.
• 19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
• 9992e09 Merge pull request #3191 from jvoisin/dupes
• bd22577 Fix regexlint warnings after latest update.
• 6a62df1 Release preparation: Update the changelog.
• aabba32 Merge pull request #3221 from jvoisin/alter
• d3441d0 Merge pull request #3225 from jvoisin/caddy
• c593f3f Add a lexer for Caddy
• 0644b53 Simplify single-character regex alternations to character classes
• Additional commits viewable in compare view

Updates setuptools from 83.0.0 to 84.0.0

Changelog

Sourced from setuptools's changelog.

v84.0.0

Features

• Newline-separated keywords and platformspypa/setuptools#4887old specification <https://peps.python.org/pep-0345/>_ separated items with spaces and the current one uses commas. (#4887)
• Extensionpypa/distutils#373#5022)
• The C compiler modules now emit log messages through their own compilers.C.* loggers instead of the distutils root logger, part of decoupling the compilers package from distutils. The logger names are normalized to a stable compilers.C.* prefix so they remain constant as the package migrates toward a standalone compilers.C distribution. (#5266)
• The C compilers gained a Compiler.call method -- a thin wrapper over subprocess.check_call (with macOS deployment-target env injection) that is the modern replacement for Compiler.spawn. The compilers no longer depend on distutils.spawn, distutils.dir_util, distutils.file_util, distutils._modified, or distutils.util.execute/split_quoted: the generic newer/newer_group and split_quoted helpers are vendored into the compilers package, and Compiler.mkpath/move_file/execute are implemented directly on the standard library (os.makedirs/shutil.move). The methods are retained for backward compatibility. (#5267)
• The compilers no longer depend on distutils.util, distutils.version, distutils.compat, or distutils._macos_compat. The platform-identification helpers (get_platform/get_host_platform/is_mingw) now live in distutils.compilers.platform.detect and the macOS deployment-target logic and compiler_fixup in distutils.compilers.platform.macos; CygwinCCompiler.gcc_version returns a packaging.version.Version. distutils.util re-exports the platform/macOS helpers from their new homes for backward compatibility rather than keeping duplicate copies. (sysconfig lookups still route through distutils pending its own decoupling.) (#5268)
• The compilers now read their build configuration from the standard library's sysconfig instead of distutils.sysconfig. Per-compiler customization -- previously distutils.sysconfig.customize_compiler -- has moved into Compiler.configure_system(): a no-op on the base class, with UnixCCompiler applying the compiler/flag/archiver settings CPython recorded in sysconfig (and the usual CC/CFLAGS/LDSHARED/… environment overrides). distutils.sysconfig.customize_compiler is retained as a thin wrapper that calls compiler.configure_system(). (#5269)

Bugfixes

• The MSVC linker now passes its arguments through a response file when the command line would exceed the Windows maximum length, fixing failures when linking a large number of objects. (#4177)
• The Cygwin and MinGW compilers now pass -O1 instead of a bare -O. The two are equivalent to GCC, but cc1 rejected the bare form when building 32-bit extensions with -m32. -- by :user:dchaudhari7177 (#4873)
• copy_filepypa/distutils#379#5079)
• Setuptools wheels no longer bundled the project's own test modules. -- by :user:itscloud0 (#5212)
• build_ext no longer fails when cross-compiling with a compiler other than MSVC (such as MinGW). Compiler now provides a no-op initialize()pypa/distutils#399

Improved Documentation

• Clarified what "correspond exactly to the directory structure" means in the packages section of the Package Discovery user guide. (#4109)
• Documented how bdist_wheel's py_limited_api option controls abi3 wheel tagging for extension modules -- by :user:Himanshuagrawal4 (#4741)

Deprecations and Removals

• Compiler.spawn is deprecated in favor of the new Compiler.call. call raises native subprocess exceptions; spawn remains as a shim that emits a DeprecationWarning and translates them to DistutilsExecError. The MSVC spawn compatibility shim for third-party monkeypatches predating the env argument (numpy.distutils before 1.19, per pypa/distutils#15) has been removed. distutils.spawn.spawn is likewise reduced to a thin wrapper around subprocess.check_call: it no longer resolves cmd[0] via shutil.which (subprocess searches PATH itself) nor injects MACOSX_DEPLOYMENT_TARGET (that now lives with the compilers, the only callers to which it applied). (#5267)
• Building an extension with a MACOSX_DEPLOYMENT_TARGET lower than the interpreter's configured value now raises compilers.errors.PlatformError instead of distutils.errors.DistutilsPlatformError (the macOS deployment-target check moved into the compilers package). CygwinCCompiler.gcc_version returns a packaging.version.Version rather than the removed distutils.version.LooseVersion. Completing the transition begun in pypa/distutils#246, UnixCCompiler.runtime_library_dir_option now returns the ["-Wl,--enable-new-dtags", "-Wl,-rpath,<dir>"] list directly for GNU ld rather than collapsing it into a single string, and the temporary distutils.compat.consolidate_linker_args shim has been removed. (#5268)
• The compilers now define their own exception vocabulary instead of borrowing distutils' framework errors. Language-agnostic exceptions (Error, UnknownFileType, and a new PlatformError) live at distutils.compilers.errors, leaving room for future compilers.<language> siblings; the C/C++-specific CompileError/LinkError/LibError/PreprocessError remain in distutils.compilers.C.errors. The compilers now raise compilers.errors.PlatformError where they previously raised distutils.errors.DistutilsPlatformError/DistutilsModuleError, and compilers._modified.newer raises the stdlib FileNotFoundError. distutils.errors keeps its own framework exceptions and re-exports the compiler ones (CCompilerError, CompileError, etc.) for backward compatibility; because CCompilerError is compilers.errors.Error, code catching it (as distutils' top-level handlers do) still catches the new PlatformError. (#5270)
• customize_compiler now asserts that the compiler-related config variables (CC, CXX, CFLAGS, etc.) resolve to strings, raising AssertionError if any are unexpectedly Nonepypa/distutils#363

Commits

• 72e919a Merge pull request #5293 from pypa/bugfix/integration-pip-flit-backend
• 1b29701 Select the top-level pyproject.toml when reading build requirements
• bb1b381 Bump version: 83.0.0 → 84.0.0
• ee6fdd7 Sync with distutils @ e8eb87855 (#5292)
• 2a4a9e4 Merge remote-tracking branch 'origin/main' into distutils-e8eb87855
• cbd1195 Merge https://github.com/jaraco/skeleton
• bd3594e Merge pull request #5287 from Avasam/Configuring-lint.flake8-comprehensions.a...
• f02e90a Configure C408 to allow dict(a=1) rather than disabling it
• c55f52b Configuring lint.flake8-comprehensions.allow-dict-calls-with-keyword-argument...
• e9904b0 Match the distutils sdist base type for the user_options override
• Additional commits viewable in compare view

Updates wheel from 0.47.0 to 0.48.0

Release notes

Sourced from wheel's releases.

0.48.0

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel (#570)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions (#643)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (#692)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw)

Changelog

Sourced from wheel's changelog.

Release Notes

UNRELEASED

• Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target ([#697](https://github.com/pypa/wheel/issues/697) <https://github.com/pypa/wheel/pull/697>_)

0.48.0 (2026-08-12)

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel ([#570](https://github.com/pypa/wheel/issues/570) <https://github.com/pypa/wheel/issues/570>_)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions ([#643](https://github.com/pypa/wheel/issues/643) <https://github.com/pypa/wheel/issues/643>_)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header ([#692](https://github.com/pypa/wheel/issues/692) <https://github.com/pypa/wheel/issues/692>_)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw>_)

0.47.0 (2026-04-22)

• Added the wheel info subcommand to display metadata about wheel files without unpacking them ([#639](https://github.com/pypa/wheel/issues/639) <https://github.com/pypa/wheel/issues/639>_)
• Fixed WheelFile raising Missing RECORD file when the wheel filename contains uppercase characters (e.g. Django-3.2.5.whl) but the .dist-info directory inside uses normalized lowercase naming ([#411](https://github.com/pypa/wheel/issues/411) <https://github.com/pypa/wheel/issues/411>_)

0.46.3 (2026-01-22)

• Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command ([#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676>_)

0.46.2 (2026-01-22)

• Restored the bdist_wheel command for compatibility with setuptools older than v70.1
• Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning
• Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1 (2025-04-08)

... (truncated)

Commits

• 21c4da4 Fixed the release heading format
• f06d4db Flit no longer supports --setup-py
• 1a96c3e Created a new release
• d7d625d Fixed wheel convert writing outside the target directory on malicious input (...
• 986a440 Strip ZIP64 extra field when retagging wheels (#692) (#695)
• 0ca6f24 feat: add --local-version option to wheel pack (#694)
• 4a63caf Preserve compatible metadata versions in convert (#690)
• 33650c6 [pre-commit.ci] pre-commit autoupdate (#691)
• 197012d Increased the upper bound for flit-core as a build requirement
• See full diff in compare view

Updates charset-normalizer from 3.4.9 to 3.5.1

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.1

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

Changelog

Sourced from charset-normalizer's changelog.

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

Commits

• e239bdc Merge pull request #795 from jawah/release-3.5.1
• 648ad77 docs: update faq
• fab2749 docs: write changelog for 3.5.1
• 7d32774 chore: bump version to 3.5.1
• 9a69f60 docs: update data/info
• 5dcc6dd perf: charinfo cache access optimization in cython
• ea3b447 fix: do not validate-decode large payload when md says it's noise
• a05917f chore: allow setuptools 84 builds (#794)
• 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
• 77203b1 chore: reformat noxfile.py
• Additional commits viewable in compare view

Updates cyclonedx-python-lib from 11.11.0 to 11.12.0

Release notes

Sourced from cyclonedx-python-lib's releases.

v11.12.0 (2026-08-13)

Features

• Add isExternal property to Component for CycloneDX v1.7 (#959, 6993dea)

---

What's Changed

• tests: add Python 3.14 to tox tests by @​jkowalleck in CycloneDX/cyclonedx-python-lib#1029
• feat: add isExternal property to Component for CycloneDX v1.7 by @​tonal in CycloneDX/cyclonedx-python-lib#959

New Contributors

• @​tonal made their first contribution in CycloneDX/cyclonedx-python-lib#959

Full Changelog: CycloneDX/cyclonedx-python-lib@v11.11.2...v11.12.0

v11.11.2 (2026-08-12)

Bug Fixes

• Encode paths when loading XML schemas (#1028, 17a0136)

---

What's Changed

• fix: encode paths when loading XML schemas by @​CAOShurong in CycloneDX/cyclonedx-python-lib#1028

New Contributors

• @​CAOShurong made their first contribution in CycloneDX/cyclonedx-python-lib#1028

Full Changelog: CycloneDX/cyclonedx-python-lib@v11.11.1...v11.11.2

v11.11.1 (2026-08-10)

Bug Fixes

• Comparablepackageurl includes name (#1022, d718ac2)

---

What's Changed

• chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#1012
• chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#1011
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#1008
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#1020
• chore(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#1025
• chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#1024
• chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#1023
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in CycloneDX/cyclonedx-python-lib#1019

... (truncated)

Changelog

Sourced from cyclonedx-python-lib's changelog.

v11.12.0 (2026-08-13)

Features

• Add isExternal property to Component for CycloneDX v1.7 (#959, 6993dea)

v11.11.2 (2026-08-12)

Bug Fixes

• Encode paths when loading XML schemas (#1028, 17a0136)

v11.11.1 (2026-08-10)

Bug Fixes

• Comparablepackageurl includes name (#1022, d718ac2)

Commits

• 52cb3c9 chore(release): 11.12.0
• 6993dea feat: add isExternal property to Component for CycloneDX v1.7 (#959)
• 27b2d43 tests: add Python 3.14 to tox tests (#1029)
• a092c49 chore(release): 11.11.2
• 17a0136 fix: encode paths when loading XML schemas (#1028)
• 8edee5c chore(release): 11.11.1
• 7b5350c chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#1026)
• 72e4e4c chore(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#1027)
• d718ac2 fix: ComparablePackageURL includes name (#1022)
• cb1a4e2 chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1019)
• Additional commits viewable in compare view

Updates filelock from 3.32.2 to 3.32.3

Release notes

Sourced from filelock's releases.

3.32.3

What's Changed

• 🧪 test(strict): deflake close-fault injections on graalpy by @​gaborbernat in tox-dev/filelock#697
• 📄 docs: publish llms.txt from the docs build by @​gaborbernat in tox-dev/filelock#700
• 🐛 fix(fork): survive audit events during interpreter shutdown by @​gaborbernat in tox-dev/filelock#703

Full Changelog: tox-dev/filelock@3.32.2...3.32.3

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

3.32.4 (2026-08-23)

---

• StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
• WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
• Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

---

3.32.3 (2026-08-13)

---

• The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

---

3.32.2 (2026-07-29)

---

• A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

---

3.32.1 (2026-07-26)

---

• Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

---

3.32.0 (2026-07-21)

---

• SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685
• Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683

... (truncated)

Commits

• 4aa742c Release 3.32.3
• fb5ab3e 🐛 fix(fork): survive audit events during interpreter shutdown (#703)
• 35f759c 📄 docs: publish llms.txt from the docs build (#700)
• 4b6e966 [pre-commit.ci] pre-commit autoupdate (#699)
• 0e0f666 build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#698)
• 6689d82 🧪 test(strict): deflake close-fault injections on graalpy (#697)
• df67bf7 [pre-commit.ci] pre-commit autoupdate (#696)
• See full diff in compare view

Updates idna from 3.18 to 3.19

Release notes

Sourced from idna's releases.

v3.19

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document thread safety.
• Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
• The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
• Reject A-labels that are not the canonical Punycode encoding of their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.19 (2026-08-18)

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document thread safety.
• Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
• The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
• Reject A-labels that are not the canonical Punycode encoding of their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits

• 03a9a11 Release 3.19
• 2d2a7ef Pre-release 3.19rc0
• 5cce130 Merge pull request #268 from kjd/fix-std3-regex-alert
• 3914b75 Split the STD3 disallowed-character range so uppercase is explicit
• ce9fd98 Merge pull request #267 from kjd/housekeeping
• 809240c Fail CI when the license copyright year is behind the current year
• d9e16c5 Consolidate test fixtures, prune stale gitignore entries, and fix doc typos
• ef30fee Remove dead code and pare back superfluous comments
• b907913 Tighten the version support and Unicode notes in the README
• 6204cbe Ignore local build artifacts and stop packaging stray tooling config
• Additional commits viewable in compare view

Updates platformdirs from 4.11.0 to 4.11.3

Release notes

Sourced from platformdirs's releases.

4.11.3

What's Changed

• 📄 docs: publish llms.txt from the docs build by @​gaborbernat in tox-dev/platformdirs#522
• fix: don't crash when an XDG dirs variable holds only separators by @​darrenhuai in tox-dev/platformdirs#523

Full Changelog: tox-dev/platformdirs@4.11.2...4.11.3

4.11.2

What's Changed

• fix: stop the remaining iter_*_dirs yielding duplicate or joined paths by @​darrenhuai in tox-dev/platformdirs#520

Full Changelog: tox-dev/platformdirs@4.11.1...4.11.2

4.11.1

What's Changed

• Let the non-ctypes resolvers find the desktop folder by @​darrenhuai in tox-dev/platformdirs#519

New Contributors

• @​darrenhuai made their first contribution in tox-dev/platformdirs#519

Full Changelog: tox-dev/platformdirs@4.11.0...4.11.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.3 (2026-08-13)

---

• python -m platformdirs now lists :func:~platformdirs.user_desktop_dir, which was missing from the properties it prints. :pr:523
• Stop :func:~platformdirs.site_data_dir, :func:~platformdirs.site_config_dir and :func:~platformdirs.site_applications_dir raising IndexError on Unix and macOS when $XDG_DATA_DIRS or $XDG_CONFIG_DIRS holds only separators and whitespace, such as ":". These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:523

---

4.11.2 (2026-08-10)

---

• Stop :meth:~platformdirs.PlatformDirs.iter_cache_dirs, :meth:~platformdirs.PlatformDirs.iter_state_dirs, :meth:~platformdirs.PlatformDirs.iter_log_dirs and :meth:~platformdirs.PlatformDirs.iter_runtime_dirs yielding the same directory twice on Unix when use_site_for_root is active - :pr:469 fixed this for the config and data iterators only. On macOS, :meth:~platformdirs.PlatformDirs.iter_cache_dirs now yields the Homebrew and /Library/Caches entries separately rather than one os.pathsep-joined string when multipath is set. :pr:520

---

4.11.1 (2026-08-07)

---

• Fix :func:~platformdirs.user_desktop_dir on Windows builds without ctypes. CSIDL_DESKTOPDIRECTORY appeared only in the ctypes lookup table, so the registry and environment variab...

  Description has been truncated