[dependabot]

Bumps the dependencies group with 18 updates in the / directory:

Package	From	To
iniconfig	2.3.0	2.3.1
pluggy	1.6.0	1.7.0
pycparser	3.0	3.11
pytest	9.1.1	9.2.0
tomli	2.4.1	2.5.0
ast-serialize	0.11.2	0.13.1
black	26.5.1	26.10.1
distlib	0.4.3	0.4.4
filelock	3.32.7	4.1.0
mypy	2.3.1	2.4.1
nox	2026.8.17	2026.10.20
platformdirs	4.12.2	4.12.4
python-discovery	1.6.1	1.9.0
types-setuptools	84.0.0.20260812	84.0.0.20261006
virtualenv	21.14.1	21.15.2
certifi	2026.7.22	2026.10.23
markupsafe	3.0.3	3.0.4
sphinxcontrib-jsmath	1.0.1	2.0.0

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

• Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
• A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

• iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

• The README example now uses IniConfig.parse() (#79, thanks @​MbappeWU).
• Fixed the issue tracker link (#74, thanks @​stefan6419846).

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#71
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#72
• Fix link to issues by @​stefan6419846 in pytest-dev/iniconfig#74
• parse_lines: keep values as list of lines, join once by @​RonnyPfannschmidt in pytest-dev/iniconfig#78
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#73
• test: expect sorted all after ruff autofix by @​RonnyPfannschmidt in pytest-dev/iniconfig#80
• docs: use parse API in the README example by @​MbappeWU in pytest-dev/iniconfig#79
• Strip leading UTF-8 BOM when reading INI files by @​Pitchfork-and-Torch in pytest-dev/iniconfig#76
• changelog: add BOM stripping (#76) to 2.3.1 by @​RonnyPfannschmidt in pytest-dev/iniconfig#81

New Contributors

• @​stefan6419846 made their first contribution in pytest-dev/iniconfig#74
• @​MbappeWU made their first contribution in pytest-dev/iniconfig#79
• @​Pitchfork-and-Torch made their first contribution in pytest-dev/iniconfig#76

Full Changelog: pytest-dev/iniconfig@v2.3.0...v2.3.1

Changelog

Sourced from iniconfig's changelog.

2.3.1

• fix quadratic parse time for values with many continuation lines (#78, regarding #77)
• strip a leading UTF-8 BOM when reading INI files, which previously raised ParseError (#76)
• internal: iniconfig._parse.ParsedLine.value is now a list of lines

Commits

• 316fbfa changelog: add BOM stripping (#76) to 2.3.1 (#81)
• d2dcb72 Strip leading UTF-8 BOM when reading INI files (#76)
• 40d8c03 Merge pull request #79 from MbappeWU/codex/docs-parse-inline-comments
• 48359c3 Merge pull request #80 from pytest-dev/claude/fix-iniconfig-test-eukh2n
• b153213 test: expect sorted all after ruff RUF022 autofix
• 4fddfab Merge pull request #73 from pytest-dev/pre-commit-ci-update-config
• 15852c2 [pre-commit.ci] auto fixes from pre-commit.com hooks
• 2e68639 [pre-commit.ci] pre-commit autoupdate
• 23c9e08 docs: use parse API in the README example
• e038536 Merge pull request #78 from RonnyPfannschmidt/claude/dazzling-einstein-h8zq7m
• Additional commits viewable in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

• [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

• [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

• [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

  A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

• [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

• [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

• [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

• [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

  As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits

• 4c7f636 Preparing release 1.7.0
• 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
• 628959b docs: remove outdated hookimpl default args paragraph
• 2edab5e Merge pull request #752 from bluetech/register-none-allow
• 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
• 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
• 6a7e84e Add changelog fragment for #776
• d22cfb5 Drop tox from the dev dependency group
• 74cbfa2 Relock pytest and tox that dependabot downgraded
• 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
• Additional commits viewable in compare view

Updates pycparser from 3.0 to 3.11

Release notes

Sourced from pycparser's releases.

release_v3.11

Enhanced C11 support

Full Changelog: eliben/pycparser@release_v3.01...release_v3.11

release_v3.01

What's Changed

• Drop an unneeded direct build depndency on wheel by @​hroncok in eliben/pycparser#597
• fix: handle integer suffix in #line directive without crashing by @​SAY-5 in eliben/pycparser#601
• Update default branch to main by @​myd7349 in eliben/pycparser#602
• fix: raise ParseError instead of AssertionError on unmatched '}' by @​patchwright in eliben/pycparser#604
• Add support for Python 3.15 by @​kytta in eliben/pycparser#605
• Fix empty compound literal (type){} raising ParseError by @​IMGillusion in eliben/pycparser#606
• Fix compound literal statements in C generator by @​Rayan-and-beyond in eliben/pycparser#607
• Keep the contents of adjacent u8 string literals by @​SashaMIT in eliben/pycparser#609

Full Changelog: eliben/pycparser@release_v3.00...release_v3.01

Commits

• ccb3439 Prepare for release 3.11
• 1d31981 Fix concatenation escapes
• dbcd5fd Add missing fake types
• 8bc38aa Fix dropped specifiers in lists
• 17da57c Fix generation of _Alignas and _Atomic
• 61f979c Add C11's fake headers and some tests
• dfbe88b Fix unicode escapes
• 74588ec Unify string literal parsing
• 7adecd5 Fix implementation of _Static_assert
• b7f48c8 C generation for _Generic
• Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

• #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

• #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

  Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

• #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

  • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
  • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

  pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

• #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

• #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

• #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

  They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

• #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

• #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

• #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
• #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
• #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

• #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits

• ae1d0ff Prepare release version 9.2.0
• 143ce31 pre-commit: exclude codespell on generated release announcements
• 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
• a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
• 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
• 41d12cd docs: clarify typing for yield fixtures
• b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
• 16f87a7 docs: improve getting-started.rst test execution description
• 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
• ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
• Additional commits viewable in compare view

Updates tomli from 2.4.1 to 2.5.0

Changelog

Sourced from tomli's changelog.

2.5.0

• Added
  • Binary wheels for Python 3.15
• Fixed
  • Set nested inline array/table limit to 400 to fix mypyc generated binaries crashing unrecoverably in constrained environments (e.g. worker thread in a python:3.13-alpine image)

2.3.1

• Fixed
  • Backport: Limit number of parts of a TOML key to address quadratic time complexity

Commits

• a2a5789 Bump version: 2.4.1 → 2.5.0
• 94a6081 Add 2.5.0 changelog
• 85f8748 Update README.md
• 70fd460 Allow flit_core v4
• 00d0610 Update pre-commit
• eb93c12 Improve tomllib compatibility and sync docs (#299)
• 18d8d59 Bump cibuildwheel for Python 3.15 wheels (#317)
• 1e6e869 Set smaller MAX_INLINE_NESTING to avoid python:3.13-alpine worker thread crash
• c329998 Use Trusted Publishing
• ba611c5 Add zizmor security scanner to pre-commit (#301)
• Additional commits viewable in compare view

Updates ast-serialize from 0.11.2 to 0.13.1

Commits

• e83de7d Bump version to 0.13.1
• 4b10d47 Make file-level type: ignore consistent with mypy: ignore (#97)
• 42628bd Bump version to 0.13.0
• 67659a0 Straighten type comment parsing (#95)
• 8d0a5c6 Bump version to 0.12.1
• a7f11b1 Fix parsing plain None type in a string (#96)
• bcf707f Bump version to 0.12.0
• 89b6e83 Allow colon in error codes (#94)
• See full diff in compare view

Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
• Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

• Add --cache-dir to configure the cache directory from the command line (#5433)
• Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)
• Keep the parentheses around a walrus that is the only item in a set (for example {(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't parse it without them (#5502)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
• Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

... (truncated)

Commits

• 258e7db Prepare release 26.10.1 (#5511)
• ac1f715 Action: validate required-version better (#5510)
• fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
• 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
• 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
• c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
• 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
• c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
• eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
• 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
• Additional commits viewable in compare view

Updates distlib from 0.4.3 to 0.4.4

Changelog

Sourced from distlib's changelog.

0.4.4

Released: 2026-10-16


compat

Fixed a missing import. Thanks to Andrej730 for the patch.



markers

Fixed #273: Enforce compatible-release bounds in environment markers.
Thanks to Luochenchen for the patch.



metadata

Fix #194: Add an urls property to expose project and home URLs. Thanks to
Sinkleberg for the patch.



scripts


Raise the correct exception when a launcher can't be written. Thanks to
candygoogy for the patch.


Fix #144: Detect shell-script Python executables in ScriptMaker shebangs.
Thanks to Alex Chen for the patch.




util


Improve performance of export entry search to take linear time. Thanks to
Brian Willows for the patch.


Use tarfile.data_filter rather than tarfile.tar_filter in unarchive()
when extraction filters are available, matching the Python 3.14 default. Path and
link containment checks now use os.path.realpath and no longer fail with
IndexError for members such as . or ./. Thanks to Kobain for the patch.


unarchive() now resolves member paths through symlinks seen earlier in the
same archive, so a chain of individually harmless-looking links cannot be used
to write outside the destination on Pythons without extraction filters. Thanks to
Kobain for the patch.




version


Improve NormalizedVersion by addressing correctness and performance gaps
found by comparison with packaging. Thanks to Damian Shaw for the patch.


Improve SemanticVersion by comparing numeric prerelease identifiers,
including those longer than 8 digits. Thanks to Muneeb Sheikh for the
patch.

Commits

• 25eed06 Changes for 0.4.4.
• 8ffee6f Resolve member paths through earlier archive symlinks in unarchive()
• ef4a390 Test that data_filter rejects absolute symlinks with check=False
• 380b6a9 Use data_filter and realpath containment checks in unarchive()
• 7b7c572 fix: enforce compatible-release bounds in markers (#274)
• 38811dd Detect shell-script Python executables in ScriptMaker shebangs (#144) (#264)
• 06ddb5d Compare numeric prerelease identifiers without a digit limit (#270)
• e54dd8c Raise the original error when a launcher can't be written (#269)
• c6270e3 Fix NormalizedVersion gaps found by comparison with packaging (#271)
• 5b3092b Search export entries in linear time (#266)
• Additional commits viewable in compare view

Updates filelock from 3.32.7 to 4.1.0

Release notes

Sourced from filelock's releases.

4.1.0

Features

• Import OwnerMode, CompromiseReason and has_fcntl from filelock. #790 by @​gaborbernat.
• AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. #803 by @​gaborbernat.
• A Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. #815 by @​gaborbernat.
• Every option given in seconds takes a Decimal or Fraction, as a file lock's timeout already did, and a read-write lock or lease refuses a bool or string one. #815 by @​gaborbernat.

Bug fixes

• is_lock_held_by_us and is_lock_held_by_us return False for a marker an earlier process with the same PID left behind. #774 by @​lprnmns.
• SoftFileLock removes its marker when writing it fails and closing the descriptor fails too, so the lock path no longer stays blocked. #775 by @​harbinresearcher.
• acquire and acquire no longer wait past timeout when poll_interval is longer than the time left. #777 by @​feiiiiii5.
• SoftReadWriteLock ignores a generation-log entry whose name is not 20 ASCII digits, which used to stop its heartbeat thread or delete real generations. #778 by @​dxbjavid.
• ReadWriteLock, SoftReadWriteLock and their async wrappers treat a inf timeout like -1 and raise ValueError for a blocking nan one. #779 by @​darrenhuai.
• ReadWriteLock and SoftReadWriteLock accept a timeout above TIMEOUT_MAX instead of raising OverflowError. #780 by @​darrenhuai.
• acquire raises ValueError for a blocking nan timeout or a poll_interval above TIMEOUT_MAX, and treats a inf timeout like -1. #781 by @​gaborbernat.
• SoftFileLock and MarkerSoftFileLock treat a marker cut before its final newline as malformed, so a crash-truncated record self-heals and a read mid-write no longer breaks a live lock. #782 by @​gaborbernat.
• UnixFileLock no longer deletes another process's live marker when it falls back to a soft lock on ENOSYS, and on macOS a lock path ending in a separator raises FileNotFoundError instead of retrying. #785 by @​gaborbernat.
• SoftFileLock and SoftFileLease put back a live successor's marker that a racing stale break moved aside, so a third contender no longer acquires beside the successor. #786 by @​gaborbernat.
• StrictSoftFileLock removes every claim a failed acquire published, counts an EEXIST link that landed as published, and no longer reports is_locked after a failed claim cleanup. #787 by @​gaborbernat.
• On Python 3.10 without the exceptiongroup backport, a release failure under the default context_error_policy no longer turns into ModuleNotFoundError; cleanup failures chain instead of grouping, and on_acquired is allowed. #788 by @​gaborbernat.
• AsyncReadWriteLock and AsyncSoftReadWriteLock drop a task's hold when a caller cancels it during a release that still completes, instead of blocking every later writer. #789 by @​gaborbernat.
• SoftFileLease releases a lease dropped while held, at garbage collection or interpreter exit, and raises ValueError for a heartbeat_interval above TIMEOUT_MAX. #791 by @​gaborbernat.
• StrictSoftFileLock judges an abandoned private record's age by the filesystem's clock, so a client clock ahead of an NFS server no longer aborts live publications. #792 by @​gaborbernat.
• BaseAsyncFileLock raises RuntimeError instead of CancelledError when its executor shuts down with the call still queued, and a waiter interrupted by anything else no longer wedges later calls. #793 by @​gaborbernat.
• Constructing or closing a second ReadWriteLock on a held database no longer drops the holder's lock, so other processes stay excluded. #794 by @​gaborbernat.
• SoftReadWriteLock no longer admits a second writer after <path>.rw is removed under a live instance, and flushes each snapshot before publishing it so a crash cannot leave an empty one that wedges every peer. #795 by @​gaborbernat.
• SoftFileLease reclaims a dead MarkerSoftFileLock owner, and expires a lease or a malformed soft marker after it stays unchanged on the contender's own monotonic clock, so clock skew cannot break it. #796 by @​gaborbernat.
• A soft lock marker written in a Linux container records its PID namespace with the hostname, so a sibling container that shares the hostname and volume no longer breaks a live lock. #797 by @​gaborbernat.
• SoftReadWriteLock.close() makes an acquire still waiting in another thread raise RuntimeError, where it used to take the lock on the closed instance and hold it until the process exited. #798 by @​gaborbernat.
• SoftReadWriteLock reads the head from gen/HEAD, so a client whose cached directory listing is more than 64 generations stale no longer takes an old generation for the head and forks the log. #799 by @​gaborbernat.
• When the garbage collector finalizes a held BaseAsyncFileLock, it releases on a loop running in another thread, or in place once no loop is left; the lifetime check and path resolution now run in the executor. #800 by @​gaborbernat.
• SoftReadWriteLock waits out a holder's own stale_threshold before evicting it, keys its singleton on the path its log sits beside, and no longer leaks ledger entries or the holder record of a failed acquire. #801 by @​gaborbernat.
• lock_descriptor raises ValueError for a blocking poll_interval above TIMEOUT_MAX up front, instead of OverflowError once the descriptor is contended. #802 by @​sricharanreddycheruku.
• BaseFileLock rejects a bool or string timeout, an out-of-range mode and a non-bool blocking set at any time, rejects unknown options on a singleton cache hit, and tracks an on_acquired reacquire. #803 by @​gaborbernat.
• StrictSoftFileLock raises SoftFileLockProtocolError naming a directory, symlink or exited soft-lock owner's marker at the lock path, and lock_path_occupant shows what blocks it. #804 by @​gaborbernat.
• ReadWriteLock raises ValueError for a WAL-mode database instead of disk I/O error, and its /dev/fd fallback links beside the database, so a lock off the TMPDIR filesystem no longer fails with EXDEV. #805 by @​gaborbernat.
• ReadWriteLock.release() from a thread that holds no read level raises RuntimeError instead of ending another thread's read lock and letting a writer in. #806 by @​gaborbernat.
• SoftFileLockLifetimeWarning derives from FutureWarning instead of DeprecationWarning, so Python shows it by default outside __main__. #807 by @​gaborbernat.
• SoftFileLock applies an explicit mode past the umask as UnixFileLock does, and reads a marker number spelled other than in ASCII digits, or a lease with an empty token, as malformed. #807 by @​gaborbernat.
• ReadWriteLock raises OSError when its database is unlinked or replaced while an acquisition waits, instead of taking a lock that no later opener sees. #808 by @​gaborbernat.
• On a thread-local synchronous lock, release with force=True and garbage collection release holds exited threads left, and a release() re-entered from a signal handler closes the descriptor once. #810 by @​gaborbernat.
• SoftFileLease records a lease_duration given as a float subclass, such as NumPy's, in a form every contender parses, so a live lease is no longer evicted as malformed. #815 by @​gaborbernat.
• StrictSoftFileLock raises SoftFileLockProtocolError for a file at the lock path it cannot parse once it stays unchanged for two seconds, instead of waiting on it forever. #815 by @​gaborbernat.
• A lock finalized at interpreter exit no longer hangs when a daemon thread stopped inside filelock's fork bookkeeping. #815 by @​gaborbernat.

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-6:

---

4.2.6 (2026-10-31)

---

.. _release-4-2-6-fixed:

Fixed

• Fix a race in :class:~filelock.SoftFileLock, :class:~filelock.MarkerSoftFileLock and :class:~filelock.SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (:pr:899) by :user:dxbjavid and :user:gaborbernat.

.. _release-4-2-5:

---

4.2.5 (2026-10-30)

---

.. _release-4-2-5-fixed:

Fixed

• :meth:~filelock.BaseFileLock.acquire and :meth:~filelock.BaseAsyncFileLock.acquire raise :class:TypeError for a blocking that is not a :class:bool, as the constructor and the blocking setter already do. A truthy value such as the string "false" used to count as True, so a call meant as a single attempt waited for the instance's timeout, and without a limit at the default -1Description has been truncated