[renovate-coveo]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update	Pending
flake8 (changelog)	7.3.0 → 7.4.1					test	minor	7.5.0
isort (changelog)	9.0.1 → 9.0.2					test	patch
mypy (changelog)	2.3.1 → 2.4.0					test	minor	2.4.1
poetry (changelog)	2.4.3 → 2.5.1					project.dependencies	minor
poetry (changelog)	2.4.3 → 2.5.1					dependencies	minor
poetry-plugin-export	1.10.0 → 1.10.1					project.dependencies	patch
poetry-plugin-export	1.10.0 → 1.10.1					dependencies	patch
pypa/gh-action-pypi-publish	v1.14.2 → v1.14.3					action	patch
step-security/harden-runner	v2.21.1 → v2.22.2					action	minor	v2.22.3
tomlkit (changelog)	0.15.1 → 0.15.2					project.dependencies	patch
tomlkit (changelog)	0.15.1 → 0.15.2					dependencies	patch

[skip release]

---

Release Notes

pycqa/flake8 (flake8)

v7.4.1

Compare Source

v7.4.0

Compare Source

PyCQA/isort (isort)

v9.0.2

Compare Source

🪲 Fixes

• Preserve blank lines before comment-only sections by @​fzlzjerry in #​2655
• Preserve trailing-comma layout when sorting reexports by @​PSR94 in #​2605
• fix: treat EOF on stdin as 'quit' in --interactive prompt by @​Eljees in #​2653
• Fix multi_line_output=10 emitting unparsable code around trailing comments by @​dylanpulver in #​2651
• Stop configuration discovery at Git worktree boundaries by @​vzer200 in #​2654
• fix: preserve trailing comments when sorting literals by @​Manny7717 in #​2647
• Preserve LF stdin output on Windows by @​AleksZyro in #​2616
• Handle star imports better when using parenthesis by @​DanielNoord in #​2665
• Sort unwrapped lines in force_sort_within_sections by @​DanielNoord in #​2667
• Preserve file line endings when sorting reexports by @​vyrnsynx in #​2669
• Fix float_to_top hoisting indented semicolon imports by @​Pajimo in #​2671
• Preserve CRLF blank lines during float-to-top preprocessing by @​hansu650 in #​2683
• mypy: type-check tests and use pathlib fixtures by @​DanielNoord in #​2685

Other changes

• Fix codecov build reports by @​DanielNoord in #​2666
• Refactors in process by @​DanielNoord in #​2677
• Core developers revision by @​staticdev in #​2691

Full Changelog: PyCQA/isort@9.0.1...9.0.2

python/mypy (mypy)

v2.4.0

Compare Source

python-poetry/poetry (poetry)

v2.5.1

Compare Source

Fixed

• Fix an issue where uninstalling a package with installer.builtin-uninstall set failed with a TypeError (#​11077).

v2.5.0

Compare Source

Added

• Add an installer.builtin-uninstall setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall (#​10931).
• Add official support for Python 3.15 (#​11046).

Changed

• Do not send credentials configured for an https repository via http (#​11073).
• Fail with an error when the current Python version is not compatible with the project and virtualenvs.create is false (#​10941).
• Validate version constraints that are entered interactively in poetry init (#​10909).
• Include the path of the pyproject.toml file in the message about already present packages in poetry add (#​10908).
• Improve performance of processing package links and repository pages (#​10895,
  #​10896,
  #​10903,
  #​10949,
  #​10951,
  #​10953).
• Improve performance of dependency resolution (#​10907,
  #​10954).
• Improve performance of choosing and installing wheels (#​10905,
  #​10958).
• Improve performance by avoiding redundant keyring lookups for repositories without credentials (#​10959).
• Improve performance by reducing the number of subprocesses to discover virtual environment data (#​11042).
• Improve performance of poetry search for single-token queries (#​10906).
• Improve startup time by deferring the import of requests (#​11004).
• Improve performance of schema validation by caching compiled JSON schema validators (#​11033).

Fixed

• Fix an issue where credentials of the wrong repository were used under certain circumstances when multiple repositories were configured on the same host (#​11072).
• Fix an issue where credentials of a repository on another host were used for git dependencies if the path of the URL was the same (#​11074).
• Fix an issue where dependency resolution failed for conflicting requirements of different packages even though the requirements had mutually exclusive markers (#​10944).
• Fix an issue where dependency resolution failed when the same package was required with different extras in several optional dependencies or dependency groups (#​10943).
• Fix an issue where dependency resolution failed with a KeyError (#​11008).
• Fix an issue where the dependencies of an extra were missing in the lock file after adding the extra to a locked dependency, e.g. a git dependency, in the pyproject.toml file (#​10987).
• Fix an issue where a path or git dependency was not reinstalled when its develop setting changed (#​11022).
• Fix an issue where scripts of type file were not installed when installing the project (#​10736).
• Fix an issue where GUI scripts were not installed when installing the project (#​10973).
• Fix an issue where a relative path was written to direct_url.json for path dependencies (#​10917).
• Fix an issue where poetry show <package> showed a version that was not relevant for the current environment if there were multiple versions of the package in the lock file (#​11003).
• Fix an issue where poetry show --outdated did not find newer versions of packages from sources with explicit priority (#​10982).
• Fix an issue where poetry env activate ignored the environment that was determined by the application, e.g. when using --directory (#​10916).
• Fix an issue where poetry init proposed an invalid package name if the directory name was not a valid package name (#​10975).

Docs

• Document the --license option of poetry init and poetry new (#​11064).
• Clarify which dependencies are locked when running poetry update with dependency groups (#​11024).
• Clarify the portability of path dependencies (#​11020).
• Clarify the usage of poetry run with console scripts (#​10984).
• Clarify what --no-cache disables (#​10915).
• Document how to use package sources for poetry self update (#​10923).
• Fix the stale minimum Python version (#​11050).
• Update outdated links (#​10913,
  #​10938,
  #​11000,
  #​11043).

poetry-core (2.5.0)

• Add Python 3.15 to the automatically generated classifiers (#​961).
• Fix an issue where a <V version constraint wrongly allowed pre-releases of V in some cases (#​939).
• Fix an issue where version ranges with coincident bounds were not recognized as empty (#​939).
• Fix an issue where the string representation of a version union did not describe the same constraint after being parsed again (#​939).
• Fix an issue where the intersection of a version range with a local version resulted in a wrong constraint (#​949).
• Fix an issue where the union of a version range and a public version did not include all local versions of the public version (#​950).
• Fix an issue where the union of a public version and one of its local versions did not result in the public version (#​966).
• Fix an issue where the difference between a public version and one of its local versions still allowed the local version, which could result in an infinite loop during dependency resolution (#​953).
• Fix an issue where a version range that excluded some local versions of a public version was wrongly considered to allow all versions of the public version (#​959).
• Fix an issue where a != <value> constraint was wrongly considered to allow all values of a <value> not in constraint (#​955).
• Fix an issue where merging platform_release markers with incompatible constraint types failed (#​956).
• Fix an issue where the string representation of a version range whose upper bound only consists of zeros raised an IndexError (#​964).
• Fix an issue where formatting a Python constraint that only allows unknown Python versions raised an IndexError (#​971).
• Fix an issue where marker values containing spaces could not be parsed (#​972).
• Fix an issue where the upper bound of a ~= constraint was wrong for versions with more than three release segments (#​973).
• Fix an issue where the filename of a link created from a Windows path was wrong and reject filenames containing path separators (#​974).

python-poetry/poetry-plugin-export (poetry-plugin-export)

v1.10.1

Compare Source

Fixed

• Fix export of marker unions with extras (requires poetry-core 2.5.0) (#​365).

pypa/gh-action-pypi-publish

v1.14.3

Compare Source

Keeping the community safe is a collaborative effort! 💛💙

[!important]
🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #​427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via #​420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

step-security/harden-runner

v2.22.2

Compare Source

What's Changed

• Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS
• Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)
• Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

v2.22.1

Compare Source

What's Changed

• Fixed security rules not initializing on GHES self-hosted runners
• Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

Compare Source

What's Changed

• Linux ARM64 support for community tier
• GHES support for self-hosted VMs (enterprise tier)
• MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

python-poetry/tomlkit (tomlkit)

v0.15.2

Compare Source

Changed

• Write the ESC control character as \u001b instead of \e, which is only valid in TOML 1.1, so the output stays readable by TOML 1.0 parsers such as tomllib. (#​641)
• key_value() now raises UnexpectedCharError on anything other than whitespace or a comment after the pair, instead of silently discarding it (e.g. key_value("a = 1 b = 2")), matching parse(). (#​594)
• integer() given a string now validates it against the TOML integer grammar and keeps the original text, so grouping underscores (e.g. integer("1_000")) survive dumps(); strings that are not valid TOML integers (e.g. "010") now raise ValueError. (#​336)
• Add a fold argument to DateTime and Time, mirroring the stdlib, and carry fold through item(), arithmetic (including datetime subtraction) and unwrap(), so a folded local time no longer converts an hour off. (#​619, #​623, #​626)
• Declare the project metadata in the PEP 621 [project] table; building from source now requires poetry-core>=2.2.0. (#​607, #​609)

Fixed

• Fix valid TOML being rejected when an out-of-order table reopens an implicit super-table with a dotted key: [a.b.c] then [a] with b.z = 1 extends the implicit a.b super-table rather than redefining it (stdlib tomllib accepts it), so it now parses and round-trips instead of raising Redefinition of an existing table. The concrete-table case ([a.b] then [a] b.z = 1) stays rejected. (#​565)
• Fix uppercase E exponent after a leading-zero mantissa (e.g. 0E2) being rejected as an invalid number while 0e2 parsed fine. (#​586)
• Fix non-lowercase special floats (e.g. Inf, NaN, -INF) being accepted; TOML only allows lowercase inf and nan, so they now raise ParseError. (#​628)
• Fix parse errors reporting the wrong line and column in documents with CRLF or mixed line endings. (#​642)
• Fix item() reordering the keys of an inline table (dict-valued keys were forced last) under the default sort_keys=False. (#​546)
• Fix unwrap() moving a key to the end after its value was replaced (e.g. doc["b"] = 9), while dumps() and keys() kept the original order. (#​591)
• Fix appending a key to a parsed inline table that uses ", " separators emitting a bare "," for the new entry, leaving the table inconsistently spaced (e.g. {x = 1, y = 2,z = 3}). (#​595)
• Fix an emptied array of tables being dropped from the output: it now renders as key = [], placed and keyed relative to the nearest table header so it parses back into the same table. (#​567)
• Fix a single-line array whose last element is a trailing comment (e.g. from add_line(value, comment=...)) rendering its closing ] on the comment line, producing unparseable output. (#​580)
• Fix del array[start:stop:step] with a negative or omitted bound removing the wrong elements from the rendered output. (#​599)
• Fix array slice assignment mutating the array before raising ValueError("slice assignment is not supported"). (#​600)
• Fix String.__add__ splicing the appended text into a basic string without escaping it, so appending a quote or backslash produced invalid TOML. (#​612)
• Fix a bare carriage return in a multiline string producing invalid TOML: it is now escaped as \r in a multiline basic string and rejected with InvalidStringError in a multiline literal string; CRLF line endings are left intact. (#​539)
• Fix a tz-aware datetime.time rendering with a UTC offset (e.g. 07:32:00+02:00), which TOML local times do not allow; it now renders as a local time. (#​613)
• Fix arithmetic on a signed float producing +-0.0 (e.g. -1.5 times 0), which does not parse. (#​629)
• Fix two Bool items never comparing equal to each other; they now compare by value. (#​660)

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • "before 6:00am on Tuesday"
• Automerge
  • "after 9:00am and before 12:00pm on tuesday, wednesday, thursday"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.