Bump the production-dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #2030 · opensafely/documentation

dependabot · 2026-08-10T07:06:31Z

Bumps the production-dependencies group with 5 updates in the / directory:

Package	From	To
markdown	`3.10.2`	`3.10.3`
filelock	`3.32.0`	`3.32.2`
python-discovery	`1.5.0`	`1.5.1`
virtualenv	`21.7.0`	`21.7.1`
pip	`26.1.2`	`26.2`

Updates markdown from 3.10.2 to 3.10.3

Release notes

Sourced from markdown's releases.

Release 3.10.3

Fixed

Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).

Add AI Policy to Contributing Guide.

Officially document all included extensions as being in maintenance mode.

Link the Extension API documentation to the API Reference (#1612).

Changelog

Sourced from markdown's changelog.

[3.10.3] - 2026-07-30

Fixed

Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).

Add AI Policy to Contributing Guide.

Officially document all included extensions as being in maintenance mode.

Link the Extension API documentation to the API Reference (#1612).

Commits

bb50627 Bump version to 3.10.3
8453df0 Update Extension API documentation
93ac448 Document that all extensions are in maintenance mode
d38fd4a Create AI Policy
ddead47 Prevent mixed =/- chars in Setext-style headings
See full diff in compare view

Updates filelock from 3.32.0 to 3.32.2

Release notes

Sourced from filelock's releases.

3.32.2

What's Changed

Fix test failures on NetBSD (#689) by @gaborbernat in tox-dev/filelock#693

🧪 test(soft-rw): deflake writer phase-2 peer-marker test by @gaborbernat in tox-dev/filelock#694

hand back the claim when a heartbeat thread fails to start by @dxbjavid in tox-dev/filelock#691

🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy by @gaborbernat in tox-dev/filelock#695

Full Changelog: tox-dev/filelock@3.32.1...3.32.2

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.2 (2026-07-29)

A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

3.32.0 (2026-07-21)

SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685

Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683

The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

3.31.2 (2026-07-21)

filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

3.31.1 (2026-07-20)

A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

... (truncated)

Commits

9a6cc43 Release 3.32.2
56879c7 🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy (#695)
ecf5be0 hand back the claim when a heartbeat thread fails to start (#691)
ee70d2e 🧪 test(soft-rw): deflake writer phase-2 peer-marker test (#694)
1eb14dd Fix test failures on NetBSD (#689) (#693)
d81e859 build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#692)
6fbc905 [pre-commit.ci] pre-commit autoupdate (#690)
34d1c38 build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#688)
bf13ec7 Release 3.32.1
887f114 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#687)
Additional commits viewable in compare view

Updates python-discovery from 1.5.0 to 1.5.1

Release notes

Sourced from python-discovery's releases.

v1.5.1

What's Changed

🐛 fix(uv): match uv's interpreter store lookup by @gaborbernat in tox-dev/python-discovery#111

🐛 fix(uv): pick store installs by directory name by @gaborbernat in tox-dev/python-discovery#112

Full Changelog: tox-dev/python-discovery@1.5.0...1.5.1

Changelog

Sourced from python-discovery's changelog.

Bug fixes - 1.5.1

Locate uv's interpreter store the way uv does, using XDG on macOS (~/.local/share/uv/python) and roaming %APPDATA%\uv\python on Windows, neither of which platformdirs reported. The uv variables now come from the env mapping rather than os.environ - by :user:gaborbernat. (:issue:109)

Pick uv-managed interpreters by install directory name instead of globbing the store. A bare 3.8 now means CPython, the way uv resolves it, rather than whichever implementation the filesystem happened to list first, and probing runs newest version first - by :user:gaborbernat. (:issue:110)

Packaging updates and notes for downstreams - 1.5.1

Drop the platformdirs runtime dependency; locating uv's store was the only thing it did - by :user:gaborbernat. (:issue:109)

v1.5.0 (2026-07-21)

Commits

73a8369 release 1.5.1
f2bd713 🐛 fix(uv): pick store installs by directory name (#112)
b94b232 🐛 fix(uv): match uv's interpreter store lookup (#111)
97db92f build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#108)
dae1a0b [pre-commit.ci] pre-commit autoupdate (#107)
45d10b6 build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#106)
35f701e build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#105)
See full diff in compare view

Updates virtualenv from 21.7.0 to 21.7.1

Release notes

Sourced from virtualenv's releases.

21.7.1

What's Changed

📝 docs(branding): clarify official logo vs favicon by @gaborbernat in pypa/virtualenv#3200

Upgrade embedded pip/setuptools/wheel by @github-actions[bot] in pypa/virtualenv#3201

Full Changelog: pypa/virtualenv@21.7.0...21.7.1

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.1

Upgrade embedded wheels:

pip to 26.2 from 26.1.2 (:issue:u)

Improved Documentation - 21.7.1

Document that virtualenv.png is the official logo and virtualenv.svg is a simplified favicon-only mark - by :user:gaborbernat. (:issue:3199)

v21.7.0 (2026-07-21)

Commits

e46c8e9 release 21.7.1
b66560a Upgrade embedded pip/setuptools/wheel (#3201)
bf5f520 📝 docs(branding): clarify official logo vs favicon (#3200)
8507c7b [pre-commit.ci] pre-commit autoupdate (#3197)
694406a chore(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#3198)
b486255 chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#3196)
ac2ad97 chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#3195)
df94b34 chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#3194)
See full diff in compare view

Updates pip from 26.1.2 to 26.2

Changelog

Sourced from pip's changelog.

26.2 (2026-07-29)

Deprecations and Removals

Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use --refresh-package. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

Drop support for detecting legacy, non-:pep:405, virtualenv (< 20) environments. ([#14062](https://github.com/pypa/pip/issues/14062) <https://github.com/pypa/pip/issues/14062>_)

Constraints files, including PIP_CONSTRAINT, no longer affect isolated build environments. Use --build-constraint or the PIP_BUILD_CONSTRAINT environment variable to constrain build dependencies instead.

The --use-feature=build-constraint flag is now always enabled and has no effect. ([#14094](https://github.com/pypa/pip/issues/14094) <https://github.com/pypa/pip/issues/14094>_)

Features

Declare support for Python 3.15 ([#14208](https://github.com/pypa/pip/issues/14208) <https://github.com/pypa/pip/issues/14208>_)

Support self-referential extras officially. pip has supported this by accident since version 21.2. ([#11296](https://github.com/pypa/pip/issues/11296) <https://github.com/pypa/pip/issues/11296>_)

Add --only-deps flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with --no-deps, -r, --group, or --requirements-from-script. ([#11440](https://github.com/pypa/pip/issues/11440) <https://github.com/pypa/pip/issues/11440>_)

Cache simple responses in accordance to their Cache-Control header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use --refresh-package <package>. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

Add --no-require-hashes to disable automatic enablement of --require-hashes when encountering a requirement with hashes. ([#14169](https://github.com/pypa/pip/issues/14169) <https://github.com/pypa/pip/issues/14169>_)

Honor --only-final when sourcing requirements with -r pylock.toml. ([#13950](https://github.com/pypa/pip/issues/13950) <https://github.com/pypa/pip/issues/13950>_)

Add support for pylock.toml upload-time field, so --uploaded-prior-to works with -r pylock.toml. ([#14168](https://github.com/pypa/pip/issues/14168) <https://github.com/pypa/pip/issues/14168>_)

Better error messages in case of conflicts with requirements from -r pylock.toml. ([#13963](https://github.com/pypa/pip/issues/13963) <https://github.com/pypa/pip/issues/13963>_)

Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via --use-feature=venv-isolation and will be enabled by default in a future release.

Note that the feature has limited compatibility with --use-feature=inprocess-build-deps. While most builds should work with both features enabled, there are known edge cases. inprocess-build-deps will not be enabled by default until they are fixed. ([#14070](https://github.com/pypa/pip/issues/14070) <https://github.com/pypa/pip/issues/14070>_)

Present more informative diagnostic errors on uncaught network errors. ([#14115](https://github.com/pypa/pip/issues/14115) <https://github.com/pypa/pip/issues/14115>_)

Allow opting out of Git partial clones with PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER. ([#11043](https://github.com/pypa/pip/issues/11043) <https://github.com/pypa/pip/issues/11043>_)

Add a --no-proxy-env (or --proxy "") option to ignore proxies configured via non-pip environment variables or configuration files. A proxy set with --proxy is still used. ([#5378](https://github.com/pypa/pip/issues/5378) <https://github.com/pypa/pip/issues/5378>_)

Add support for pulling username from keyring subprocess provider ([#12543](https://github.com/pypa/pip/issues/12543) <https://github.com/pypa/pip/issues/12543>_)

Speedup tab autocompletion by lazy-importing certain modules. ([#4768](https://github.com/pypa/pip/issues/4768) <https://github.com/pypa/pip/issues/4768>_)

... (truncated)

Commits

4b6ae5c Bump for release
50b6d3c Update AUTHORS.txt
dbddfbd Tweak news entries for pip 26.2 (#14212)
6576b75 Merge pull request #14165 from sbidoul/refactor-pylock-hanling-sbi
0090e00 Address a variety of typos detected in code review
e12ddd9 Add support for --uploaded-prior-to with -r pylock.toml
5eefdbc Better conflict report for requirements from -r pylock.toml
6d71ff8 Test --only-final with -r pylock.toml
e7d6eb9 Refactor -r pylock.toml
756506d Add TODO about pylock.select and --no-binary
Additional commits viewable in compare view

tomodwyer · 2026-08-10T10:50:25Z

@dependabot rebase

dependabot · 2026-08-10T10:50:29Z

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

tomodwyer · 2026-08-10T10:50:39Z

@dependabot recreate

Bumps the production-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [markdown](https://github.com/Python-Markdown/markdown) | `3.10.2` | `3.10.3` | | [filelock](https://github.com/tox-dev/py-filelock) | `3.32.0` | `3.32.2` | | [python-discovery](https://github.com/tox-dev/python-discovery) | `1.5.0` | `1.5.1` | | [virtualenv](https://github.com/pypa/virtualenv) | `21.7.0` | `21.7.1` | | [pip](https://github.com/pypa/pip) | `26.1.2` | `26.2` | Updates `markdown` from 3.10.2 to 3.10.3 - [Release notes](https://github.com/Python-Markdown/markdown/releases) - [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md) - [Commits](Python-Markdown/markdown@3.10.2...3.10.3) Updates `filelock` from 3.32.0 to 3.32.2 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.32.0...3.32.2) Updates `python-discovery` from 1.5.0 to 1.5.1 - [Release notes](https://github.com/tox-dev/python-discovery/releases) - [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst) - [Commits](tox-dev/python-discovery@1.5.0...1.5.1) Updates `virtualenv` from 21.7.0 to 21.7.1 - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](pypa/virtualenv@21.7.0...21.7.1) Updates `pip` from 26.1.2 to 26.2 - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](pypa/pip@26.1.2...26.2) --- updated-dependencies: - dependency-name: filelock dependency-version: 3.32.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: markdown dependency-version: 3.10.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: pip dependency-version: '26.2' dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: python-discovery dependency-version: 1.5.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: virtualenv dependency-version: 21.7.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 10, 2026

dependabot Bot changed the title ~~Bump the production-dependencies group with 5 updates~~ Bump the production-dependencies group across 1 directory with 5 updates Aug 10, 2026

dependabot Bot force-pushed the dependabot/pip/production-dependencies-aea1406fa2 branch from 7684095 to 071bfc0 Compare August 10, 2026 10:09

dependabot Bot force-pushed the dependabot/pip/production-dependencies-aea1406fa2 branch from 071bfc0 to 53b2c96 Compare August 10, 2026 10:55

tomodwyer approved these changes Aug 10, 2026

View reviewed changes

tomodwyer merged commit 884203c into main Aug 10, 2026
1 check passed

tomodwyer deleted the dependabot/pip/production-dependencies-aea1406fa2 branch August 10, 2026 11:18

Navigation Menu

Uh oh!

Bump the production-dependencies group across 1 directory with 5 updates - #2030

Bump the production-dependencies group across 1 directory with 5 updates#2030
tomodwyer merged 1 commit into
mainfrom
dependabot/pip/production-dependencies-aea1406fa2

dependabot Bot commented on behalf of github Aug 10, 2026 •

edited

Loading

Uh oh!

tomodwyer commented Aug 10, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

tomodwyer commented Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release 3.10.3

Fixed

[3.10.3] - 2026-07-30

Fixed

3.32.2

What's Changed

v1.5.1

What's Changed

Bug fixes - 1.5.1

Packaging updates and notes for downstreams - 1.5.1

21.7.1

What's Changed

Bugfixes - 21.7.1

Improved Documentation - 21.7.1

26.2 (2026-07-29)

Deprecations and Removals

Features

Uh oh!

tomodwyer commented Aug 10, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

tomodwyer commented Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 10, 2026 •

edited

Loading