Scheduled weekly dependency update for week 13

[pyup-bot]

Update attrs from 25.4.0 to 26.1.0.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/attrs

Update black from 25.12.0 to 26.3.1.

Changelog

26.3.1

Stable style

- Prevent Jupyter notebook magic masking collisions from corrupting cells by using
exact-length placeholders for short magics and aborting if a placeholder can no longer
be unmasked safely (5038)

Configuration

- Always hash cache filename components derived from `--python-cell-magics` so custom
magic names cannot affect cache paths (5038)

_Blackd_

- Disable browser-originated requests by default, add configurable origin allowlisting
and request body limits, and bound executor submissions to improve backpressure
(5039)

26.3.0

Stable style

- Don't double-decode input, causing non-UTF-8 files to be corrupted (4964)
- Fix crash on standalone comment in lambda default arguments (4993)
- Preserve parentheses when ` type: ignore` comments would be merged with other
comments on the same line, preventing AST equivalence failures (4888)

Preview style

- Fix bug where `if` guards in `case` blocks were incorrectly split when the pattern had
a trailing comma (4884)
- Fix `string_processing` crashing on unassigned long string literals with trailing
commas (one-item tuples) (4929)
- Simplify implementation of the power operator "hugging" logic (4918)

Packaging

- Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in
frozen environments (4930)

Performance

- Introduce winloop for windows as an alternative to uvloop (4996)
- Remove deprecated function `uvloop.install()` in favor of `uvloop.new_event_loop()`
(4996)
- Rename `maybe_install_uvloop` function to `maybe_use_uvloop` to simplify loop
installation and creation of either a uvloop/winloop evenloop or default eventloop
(4996)

Output

- Emit a clear warning when the target Python version is newer than the running Python
version, since AST safety checks cannot parse newer syntax. Also replace the
misleading "INTERNAL ERROR" message with an actionable error explaining the version
mismatch (4983)

_Blackd_

- Introduce winloop to be used when windows in use which enables blackd to run faster on
windows when winloop is installed. (4996)

Integrations

- Remove unused gallery script (5030)
- Harden parsing of `black` requirements in the GitHub Action when `use_pyproject` is
enabled so that only version specifiers are accepted and direct references such as
`black  https://...` are rejected. Users should upgrade to the latest version of the
action as soon as possible. This update is received automatically when using
`psf/blackstable`, and is independent of the version of Black installed by the
action. (5031)

Documentation

- Expand preview style documentation with detailed examples for `wrap_comprehension_in`,
`simplify_power_operator_hugging`, and `wrap_long_dict_values_in_parens` features
(4987)
- Add detailed documentation for formatting Jupyter Notebooks (5009)

26.1.0

Highlights

Introduces the 2026 stable style (4892), stabilizing the following changes:

- `always_one_newline_after_import`: Always force one blank line after import
statements, except when the line after the import is a comment or an import statement
(4489)
- `fix_fmt_skip_in_one_liners`: Fix ` fmt: skip` behavior on one-liner declarations,
such as `def foo(): return "mock"  fmt: skip`, where previously the declaration would
have been incorrectly collapsed (4800)
- `fix_module_docstring_detection`: Fix module docstrings being treated as normal
strings if preceded by comments (4764)
- `fix_type_expansion_split`: Fix type expansions split in generic functions (4777)
- `multiline_string_handling`: Make expressions involving multiline strings more compact
(1879)
- `normalize_cr_newlines`: Add `\r` style newlines to the potential newlines to
normalize file newlines both from and to (4710)
- `remove_parens_around_except_types`: Remove parentheses around multiple exception
types in `except` and `except*` without `as` (4720)
- `remove_parens_from_assignment_lhs`: Remove unnecessary parentheses from the left-hand
side of assignments while preserving magic trailing commas and intentional multiline
formatting (4865)
- `standardize_type_comments`: Format type comments which have zero or more spaces
between `` and `type:` or between `type:` and value to ` type: (value)` (4645)

The following change was not in any previous stable release:

- Regenerated the `_width_table.py` and added tests for the Khmer language (4253)

This release alo bumps `pathspec` to v1 and fixes inconsistencies with Git's
`.gitignore` logic (4958). Now, files will be ignored if a pattern matches them, even
if the parent directory is directly unignored. For example, Black would previously
format `exclude/not_this/foo.py` with this `.gitignore`:


exclude/
!exclude/not_this/


Now, `exclude/not_this/foo.py` will remain ignored. To ensure `exclude/not_this/` and
all of it's children are included in formatting (and in Git), use this `.gitignore`:


*/exclude/*
!*/exclude/not_this/


This new behavior matches Git. The leading `*/` are only necessary if you wish to ignore
matching subdirectories (like the previous behavior did), and not just matching root
directories.

Output

- Explicitly shutdown the multiprocessing manager when run in diff mode too (4952)

Integrations

- Upgraded PyPI upload workflow to use Trusted Publishing (4611)

Links

• PyPI: https://pypi.org/project/black
• Changelog: https://data.safetycli.com/changelogs/black/

Update certifi from 2025.11.12 to 2026.2.25.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/certifi
• Repo: https://github.com/certifi/python-certifi

Update chardet from 5.2.0 to 7.4.0.post2.

Changelog

7.4.0

-------------------

**Performance:**

- Switched to dense zlib-compressed model format (v2): models are now
stored as contiguous ``memoryview`` slices of a single decompressed
blob, eliminating per-model ``struct.unpack`` overhead. Cold start
(import + first detect) dropped from ~75ms to ~13ms with mypyc.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`354 <https://github.com/chardet/chardet/pull/354>`_)

**Accuracy:**

- Accuracy improved from 98.6% to 99.3% (2499/2517 files) through
a combination of training and scoring improvements:

- Eliminated train/test data overlap by content-fingerprinting test
 suite articles and excluding them from training data
 (`351 <https://github.com/chardet/chardet/pull/351>`_)
- Added MADLAD-400 and Wikipedia as supplemental training sources to
 fill gaps left by exclusion filtering
 (`351 <https://github.com/chardet/chardet/pull/351>`_)
- Improved non-ASCII bigram scoring: high-byte bigrams are now
 preserved during training (instead of being crushed by global
 normalization), and weighted by per-bigram IDF so encoding-specific
 byte patterns contribute proportionally to how discriminative they
 are (`352 <https://github.com/chardet/chardet/pull/352>`_)
- Added encoding-aware substitution filtering: character substitutions
 during training now only apply for characters the target encoding
 cannot represent
- Increased training samples from 15K to 25K per language/encoding pair
 (`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

**Bug Fixes:**

- Added dedicated structural analyzers for CP932, CP949, and
Big5-HKSCS: these superset encodings previously shared their base
encoding's byte-range analyzer, missing extended ranges unique to each
superset
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`353 <https://github.com/chardet/chardet/pull/353>`_)

7.3.0

-------------------

**License:**

- **0BSD license** — the project license has been changed from MIT to
`0BSD <https://opensource.org/license/0bsd>`_, a maximally permissive
license with no attribution requirement. All prior 7.x releases
should also be considered 0BSD licensed as of this release.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

**Features:**

- Added ``mime_type`` field to detection results — identifies file types
for both binary (via magic number matching) and text content. Returned
in all ``detect()``, ``detect_all()``, and ``UniversalDetector`` results.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`350 <https://github.com/chardet/chardet/pull/350>`_)
- New ``pipeline/magic.py`` module detects 40+ binary file formats
including images, audio/video, archives, documents, executables, and
fonts. ZIP-based formats (XLSX, DOCX, JAR, APK, EPUB, wheel,
OpenDocument) are distinguished by entry filenames.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`350 <https://github.com/chardet/chardet/pull/350>`_)

**Bug Fixes:**

- Fixed incorrect equivalence between UTF-16-LE and UTF-16-BE in
accuracy testing — these are distinct encodings with different byte
order, not interchangeable
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

**Performance:**

- Added 4 new modules to mypyc compilation (orchestrator, confusion,
magic, ascii), bringing the total to 11 compiled modules
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Capped statistical scoring at 16 KB — bigram models converge quickly,
so large files no longer score the full 200 KB. Worst-case detection
time dropped from 62ms to 26ms with no accuracy loss.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Replaced ``dataclasses.replace()`` with direct ``DetectionResult``
construction on hot paths, eliminating ~354k function calls per full
test suite run
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

**Build:**

- Added riscv64 to the mypyc wheel build matrix — prebuilt wheels are
now published for RISC-V Linux alongside existing architectures
(`Bruno Verachten <https://github.com/gounthar>`_,
`348 <https://github.com/chardet/chardet/pull/348>`_)

7.2.0

-------------------

**Features:**

- Added ``include_encodings`` and ``exclude_encodings`` parameters to
:func:`~chardet.detect`, :func:`~chardet.detect_all`, and
:class:`~chardet.UniversalDetector` — restrict or exclude specific
encodings from the candidate set, with corresponding
``-i``/``--include-encodings`` and ``-x``/``--exclude-encodings``
CLI flags
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`343 <https://github.com/chardet/chardet/pull/343>`_)
- Added ``no_match_encoding`` (default ``"cp1252"``) and
``empty_input_encoding`` (default ``"utf-8"``) parameters — control
which encoding is returned when no candidate survives the pipeline or
the input is empty, with corresponding CLI flags
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`343 <https://github.com/chardet/chardet/pull/343>`_)
- Added ``-l``/``--language`` flag to ``chardetect`` CLI — shows the
detected language (ISO 639-1 code and English name) alongside the encoding
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`342 <https://github.com/chardet/chardet/pull/342>`_)

7.1.0

-------------------

**Features:**

- Added PEP 263 encoding declaration detection — `` -*- coding: ... -*-``
and `` coding=...`` declarations on lines 1–2 of Python source files are
now recognized with confidence 0.95
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`249 <https://github.com/chardet/chardet/issues/249>`_)
- Added ``chardet.universaldetector`` backward-compatibility stub so that
``from chardet.universaldetector import UniversalDetector`` works with a
deprecation warning
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`341 <https://github.com/chardet/chardet/issues/341>`_)

**Fixes:**

- Fixed false UTF-7 detection of ASCII text containing ``++`` or ``+word``
patterns
(`Dan Blanchard <https://github.com/dan-blanchard>`_,
`332 <https://github.com/chardet/chardet/issues/332>`_,
`335 <https://github.com/chardet/chardet/pull/335>`_)
- Fixed 0.5s startup cost on first ``detect()`` call — model norms are now
computed during loading instead of lazily iterating 21M entries
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`333 <https://github.com/chardet/chardet/issues/333>`_,
`336 <https://github.com/chardet/chardet/pull/336>`_)
- Fixed undocumented encoding name changes between chardet 5.x and 7.0 —
``detect()`` now returns chardet 5.x-compatible names by default
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`338 <https://github.com/chardet/chardet/pull/338>`_)
- Improved ISO-2022-JP family detection — recognizes ESC sequences for
ISO-2022-JP-2004 (JIS X 0213) and ISO-2022-JP-EXT (JIS X 0201 Kana)
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Fixed silent truncation of corrupt model data (``iter_unpack`` yielded
fewer tuples instead of raising)
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Fixed incorrect date in LICENSE
(`Dan Blanchard <https://github.com/dan-blanchard>`_)

**Performance:**

- 5.5x faster first-detect time (~0.42s → ~0.075s) by computing model
norms as a side-product of ``load_models()``
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- ~40% faster model parsing via ``struct.iter_unpack`` for bulk entry
extraction (eliminates ~305K individual ``unpack`` calls)
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

**New API parameters:**

- Added ``compat_names`` parameter (default ``True``) to
:func:`~chardet.detect`, :func:`~chardet.detect_all`, and
:class:`~chardet.UniversalDetector` — set to ``False`` to get raw Python
codec names instead of chardet 5.x/6.x compatible display names
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Added ``prefer_superset`` parameter (default ``False``) — remaps legacy
ISO/subset encodings to their modern Windows/CP superset equivalents
(e.g., ASCII → Windows-1252, ISO-8859-1 → Windows-1252).
**This will default to ``True`` in the next major version (8.0).**
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Deprecated ``should_rename_legacy`` in favor of ``prefer_superset`` —
a deprecation warning is emitted when used
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

**Improvements:**

- Switched internal canonical encoding names to Python codec names
(e.g., ``"utf-8"`` instead of ``"UTF-8"``), with ``compat_names``
controlling the public output format.  See :doc:`usage` for the full
mapping table.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Added ``lookup_encoding()`` to ``registry`` for case-insensitive
resolution of arbitrary encoding name input to canonical names
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Achieved 100% line coverage across all source modules (+31 tests)
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Updated benchmark numbers: 98.2% encoding accuracy, 95.2% language
accuracy on 2,510 test files
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Pinned test-data cloning to chardet release version tags for
reproducible builds
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

7.0.1

-------------------

**Fixes:**

- Fixed false UTF-7 detection of SHA-1 git hashes
(`Alex Rembish <https://github.com/rembish>`_,
`324 <https://github.com/chardet/chardet/pull/324>`_)
- Fixed ``_SINGLE_LANG_MAP`` missing aliases for single-language encoding
lookup (e.g., ``big5`` → ``big5hkscs``)
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- Fixed PyPy ``TypeError`` in UTF-7 codec handling
(`Dan Blanchard <https://github.com/dan-blanchard>`_)

**Improvements:**

- Retrained bigram models — 24 previously failing test cases now pass
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Updated language equivalences for mutual intelligibility (Slovak/Czech,
East Slavic + Bulgarian, Malay/Indonesian, Scandinavian languages)
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

7.0.0

-------------------

Ground-up, 0BSD-licensed rewrite of chardet
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`322 <https://github.com/chardet/chardet/pull/322>`_). Same package name,
same public API — drop-in replacement for chardet 5.x/6.x.

**Highlights:**

- **0BSD license** (previous versions were LGPL)
- **96.8% accuracy** on 2,179 test files (+2.3pp vs chardet 6.0.0,
+7.7pp vs charset-normalizer)
- **41x faster** than chardet 6.0.0 with mypyc (**28x** pure Python),
**7.5x faster** than charset-normalizer
- **Language detection** for every result (90.5% accuracy across 49
languages)
- **99 encodings** across six eras (MODERN_WEB, LEGACY_ISO, LEGACY_MAC,
LEGACY_REGIONAL, DOS, MAINFRAME)
- **12-stage detection pipeline** — BOM, UTF-16/32 patterns, escape
sequences, binary detection, markup charset, ASCII, UTF-8 validation,
byte validity, CJK gating, structural probing, statistical scoring,
post-processing
- **Bigram frequency models** trained on CulturaX multilingual corpus
data for all supported language/encoding pairs
- **Optional mypyc compilation** — 1.49x additional speedup on CPython
- **Thread-safe** ``detect()`` and ``detect_all()`` with no measurable
overhead; scales on free-threaded Python 3.13t+
- **Negligible import memory** (96 B)
- **Zero runtime dependencies**

6.0.0.post1

-------------------------

- Fixed ``__version__`` not being set correctly in the package
(`Dan Blanchard <https://github.com/dan-blanchard>`_)

6.0.0

-------------------

**Features:**

- Unified single-byte charset detection with proper language-specific
bigram models for all single-byte encodings (replaces ``Latin1Prober``
and ``MacRomanProber`` heuristics)
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- 38 new languages: Arabic, Belarusian, Breton, Croatian, Czech, Danish,
Dutch, English, Esperanto, Estonian, Farsi, Finnish, French, German,
Icelandic, Indonesian, Irish, Italian, Kazakh, Latvian, Lithuanian,
Macedonian, Malay, Maltese, Norwegian, Polish, Portuguese, Romanian,
Scottish Gaelic, Serbian, Slovak, Slovene, Spanish, Swedish, Tajik,
Ukrainian, Vietnamese, Welsh
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- ``EncodingEra`` filtering via new ``encoding_era`` parameter
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- ``max_bytes`` and ``chunk_size`` parameters for ``detect()``,
``detect_all()``, and ``UniversalDetector``
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- ``-e``/``--encoding-era`` CLI flag
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- EBCDIC detection (CP037, CP500)
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- Direct GB18030 support (replaces redundant GB2312 prober)
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- Binary file detection
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- Python 3.12, 3.13, and 3.14 support
(`Hugo van Kemenade <https://github.com/hugovk>`_,
`283 <https://github.com/chardet/chardet/pull/283>`_)
- GitHub Codespaces support
(`oxygen dioxide <https://github.com/oxygen-dioxide>`_,
`312 <https://github.com/chardet/chardet/pull/312>`_)

**Breaking changes:**

- Dropped Python 3.7, 3.8, and 3.9 (requires Python 3.10+)
- Removed ``Latin1Prober`` and ``MacRomanProber``
- Removed EUC-TW support
- Removed ``LanguageFilter.NONE``
- ``detect()`` default changed to ``encoding_era=EncodingEra.MODERN_WEB``

**Fixes:**

- Fixed CP949 state machine
(`nenw* <https://github.com/HelloWorld017>`_,
`268 <https://github.com/chardet/chardet/pull/268>`_)
- Fixed SJIS distribution analysis (second-byte range >= 0x80)
(`Kadir Can Ozden <https://github.com/bysiber>`_,
`315 <https://github.com/chardet/chardet/pull/315>`_)
- Fixed ``max_bytes`` not being passed to ``UniversalDetector``
(`Kadir Can Ozden <https://github.com/bysiber>`_,
`314 <https://github.com/chardet/chardet/pull/314>`_)
- Fixed UTF-16/32 detection for non-ASCII-heavy text
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- Fixed GB18030 ``char_len_table``
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- Fixed UTF-8 state machine
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- Fixed ``detect_all()`` returning inactive probers
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- Fixed early cutoff bug
(`Dan Blanchard <https://github.com/dan-blanchard>`_)
- Updated LGPLv2.1 license text for remote-only FSF address
(`Ben Beasley <https://github.com/musicinmybrain>`_,
`307 <https://github.com/chardet/chardet/pull/307>`_)

Links

• PyPI: https://pypi.org/project/chardet
• Changelog: https://data.safetycli.com/changelogs/chardet/

Update coverage from 7.13.0 to 7.13.5.

Changelog

7.13.5

---------------------------

- Fix: `issue 2138`_ describes a memory leak that happened when repeatedly
using the Coverage API with in-memory data. This is now fixed.

- Fix: the markdown-formatted coverage report didn't fully escape special
characters in file paths (`issue 2141`_). This would be very unlikely to
cause a problem, but now it's done properly, thanks to `Ellie Ayla
<pull 2142_>`_.

- Fix: the C extension wouldn't build on VS2019, but now it does (`issue
2145`_).

.. _issue 2138: https://github.com/coveragepy/coveragepy/issues/2138
.. _issue 2141: https://github.com/coveragepy/coveragepy/issues/2141
.. _pull 2142: https://github.com/coveragepy/coveragepy/pull/2142
.. _issue 2145: https://github.com/coveragepy/coveragepy/issues/2145

.. _changes_7-13-4:

7.13.4

---------------------------

- Fix: the third-party code fix in 7.13.3 required examining the parent
directories where coverage was run. In the unusual situation that one of the
parent directories is unreadable, a PermissionError would occur, as
described in `issue 2129`_. This is now fixed.

- Fix: in test suites that change sys.path, coverage.py could fail with
"RuntimeError: Set changed size during iteration" as described and fixed in
`pull 2130`_. Thanks, Noah Fatsi.

- We now publish ppc64le wheels, thanks to `Pankhudi Jain <pull 2121_>`_.

.. _pull 2121: https://github.com/coveragepy/coveragepy/pull/2121
.. _issue 2129: https://github.com/coveragepy/coveragepy/issues/2129
.. _pull 2130: https://github.com/coveragepy/coveragepy/pull/2130


.. _changes_7-13-3:

7.13.3

---------------------------

- Fix: in some situations, third-party code was measured when it shouldn't have
been, slowing down test execution. This happened with layered virtual
environments such as uv sometimes makes. The problem is fixed, closing `issue
2082`_. Now any directory on sys.path that is inside a virtualenv is
considered third-party code.

.. _issue 2082: https://github.com/coveragepy/coveragepy/issues/2082


.. _changes_7-13-2:

7.13.2

---------------------------

- Fix: when Python is installed via symlinks, for example with Homebrew, the
standard library files could be incorrectly included in coverage reports.
This is now fixed, closing `issue 2115`_.

- Fix: if a data file is created with no read permissions, the combine step
would fail completely. Now a warning is issued and the file is skipped.
Closes `issue 2117`_.

.. _issue 2115: https://github.com/coveragepy/coveragepy/issues/2115
.. _issue 2117: https://github.com/coveragepy/coveragepy/issues/2117


.. _changes_7-13-1:

7.13.1

---------------------------

- Added: the JSON report now includes a ``"start_line"`` key for function and
class regions, indicating the first line of the region in the source. Closes
`issue 2110`_.

- Added: The ``debug data`` command now takes file names as arguments on the
command line, so you can inspect specific data files without needing to set
the ``COVERAGE_FILE`` environment variable.

- Fix: the JSON report used to report module docstrings as executed lines,
which no other report did, as described in `issue 2105`_. This is now fixed,
thanks to Jianrong Zhao.

- Fix: coverage.py uses a more disciplined approach to detecting where
third-party code is installed, and avoids measuring it. This shouldn't change
any behavior. If you find that it does, please get in touch.

- Performance: data files that will be combined now record their hash as part
of the file name. This lets us skip duplicate data more quickly, speeding the
combining step.

- Docs: added a section explaining more about what is considered a missing
branch and how it is reported: :ref:`branch_explain`, as requested in `issue
1597`_. Thanks to `Ayisha Mohammed <pull 2092_>`_.

- Tests: the test suite misunderstood what core was being tested if
``COVERAGE_CORE`` wasn't set on 3.14+. This is now fixed, closing `issue
2109`_.

.. _issue 1597: https://github.com/coveragepy/coveragepy/issues/1597
.. _pull 2092: https://github.com/coveragepy/coveragepy/pull/2092
.. _issue 2105: https://github.com/coveragepy/coveragepy/issues/2105
.. _issue 2109: https://github.com/coveragepy/coveragepy/issues/2109
.. _issue 2110: https://github.com/coveragepy/coveragepy/issues/2110


.. _changes_7-13-0:

Links

• PyPI: https://pypi.org/project/coverage
• Changelog: https://data.safetycli.com/changelogs/coverage/
• Repo: https://github.com/coveragepy/coveragepy

Update docutils from 0.22.3 to 0.22.4.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/docutils

Update filelock from 3.20.0 to 3.25.2.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/filelock

Update Pygments from 2.19.2 to 2.20.0.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/pygments

Update pytest-cov from 7.0.0 to 7.1.0.

Changelog

7.1.0

------------------

* Fixed total coverage computation to always be consistent, regardless of reporting settings.
Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on
reporting options.
See `641 <https://github.com/pytest-dev/pytest-cov/issues/641>`_.

* Improve handling of ResourceWarning from sqlite3.

The plugin adds warning filter for sqlite3 ``ResourceWarning`` unclosed database (since 6.2.0).
It checks if there is already existing plugin for this message by comparing filter regular expression.
When filter is specified on command line the message is escaped and does not match an expected message.
A check for an escaped regular expression is added to handle this case.

With this fix one can suppress ``ResourceWarning`` from sqlite3 from command line::

 pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...
* Various improvements to documentation.
Contributed by Art Pelling in `718 <https://github.com/pytest-dev/pytest-cov/pull/718>`_ and
"vivodi" in `738 <https://github.com/pytest-dev/pytest-cov/pull/738>`_.
Also closed `736 <https://github.com/pytest-dev/pytest-cov/issues/736>`_.
* Fixed some assertions in tests.
Contributed by in Markéta Machová in `722 <https://github.com/pytest-dev/pytest-cov/pull/722>`_.
* Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

Links

• PyPI: https://pypi.org/project/pytest-cov
• Changelog: https://data.safetycli.com/changelogs/pytest-cov/

Update requests from 2.32.5 to 2.33.0.

Changelog

2.33.0

--------------------

**Announcements**
- 📣 Requests is adding inline types. If you have a typed code base that
uses Requests, please take a look at 7271. Give it a try, and report
any gaps or feedback you may have in the issue. 📣

**Security**
- CVE-2026-25645 ``requests.utils.extract_zipped_paths`` now extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.

**Improvements**
- Migrated to a PEP 517 build system using setuptools. (7012)

**Bugfixes**
- Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (7205)

**Deprecations**
- Dropped support for Python 3.9 following its end of support. (7196)

**Documentation**
- Various typo fixes and doc improvements.

Links

• PyPI: https://pypi.org/project/requests
• Changelog: https://data.safetycli.com/changelogs/requests/

Update tox from 4.32.0 to 4.51.0.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/tox
• Changelog: https://data.safetycli.com/changelogs/tox/

Update tqdm from 4.67.1 to 4.67.3.

Changelog

4.67.3

- fix py3.7 dependencies (1706 <- 1705)

4.67.2

- support `pandas>=3` (1703 <- 1701, 1650, 1700)
- fix `format_interval` for negative numbers (1703)
- misc linting
- framework updates (1704)
+ bump CI workflow & `pre-commit` dependencies
+ add `pyupgrade`
+ add py3.13 support
+ fix py3.7 tests
+ update `setuptools-scm` usage
+ support auto-dedented docstrings when building docs in py3.13
- tests: relax flaky benchmarks

Links

• PyPI: https://pypi.org/project/tqdm
• Changelog: https://data.safetycli.com/changelogs/tqdm/

Update urllib3 from 2.6.2 to 2.6.3.

Changelog

2.6.3

==================

- Fixed a high-severity security issue where decompression-bomb safeguards of
the streaming API were bypassed when HTTP redirects were followed.
(`GHSA-38jv-5279-wg99 <https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99>`__)
- Started treating ``Retry-After`` times greater than 6 hours as 6 hours by
default. (`3743 <https://github.com/urllib3/urllib3/issues/3743>`__)
- Fixed ``urllib3.connection.VerifiedHTTPSConnection`` on Emscripten.
(`3752 <https://github.com/urllib3/urllib3/issues/3752>`__)

Links

• PyPI: https://pypi.org/project/urllib3
• Changelog: https://data.safetycli.com/changelogs/urllib3/

Update virtualenv from 20.35.4 to 21.2.0.

Changelog

21.2.0

=================

- Pass ``--without-scm-ignore-files`` to subprocess venv on Python 3.13+ so virtualenv controls ``.gitignore`` creation,
fixing flaky ``test_create_no_seed`` and ``--no-vcs-ignore`` being ignored in subprocess path - by
:user:`gaborbernat`. (:issue:`3089`)
- Use ``BASH_SOURCE[0]`` instead of ``$0`` in the bash activate script relocation fallback, fixing incorrect ``PATH``
when sourcing the activate script from a different directory - by :user:`gaborbernat`. (:issue:`3090`)

**********************
v21.1.0 (2026-02-27)
**********************

21.1.0

=================

- Add comprehensive type annotations across the entire codebase and ship a PEP 561 ``py.typed`` marker so downstream
consumers and type checkers recognize virtualenv as an inline-typed package - by :user:`rahuldevikar`. (:issue:`3075`)

**********************
v21.0.0 (2026-02-25)
**********************

21.0.0

==================================

- The Python discovery logic has been extracted into a standalone ``python-discovery`` package on PyPI (`documentation
<https://python-discovery.readthedocs.io/>`_) and is now consumed as a dependency. If you previously imported
discovery internals directly (e.g. ``from virtualenv.discovery.py_info import PythonInfo``), switch to ``from
python_discovery import PythonInfo``. Backward-compatibility re-export shims are provided at
``virtualenv.discovery.py_info``, ``virtualenv.discovery.py_spec``, and ``virtualenv.discovery.cached_py_info``,
however these are considered unsupported and may be removed in a future release - by :user:`gaborbernat`.
(:issue:`3070`)

***********************
v20.39.1 (2026-02-25)
***********************

20.39.1

==================

- Add support for creating virtual environments with RustPython - by :user:`elmjag`. (:issue:`3010`)

***********************
v20.39.0 (2026-02-23)
***********************

20.39.0

==================

- Automatically resolve version manager shims (pyenv, mise, asdf) to the real Python binary during discovery, preventing
incorrect interpreter selection when shims are on ``PATH`` - by :user:`gaborbernat`. (:issue:`3049`)
- Add architecture (ISA) awareness to Python discovery — users can now specify a CPU architecture suffix in the
``--python`` spec string (e.g. ``cpython3.12-64-arm64``) to distinguish between interpreters that share the same
version and bitness but target different architectures. Uses ``sysconfig.get_platform()`` as the data source, with
cross-platform normalization (``amd64`` ↔ ``x86_64``, ``aarch64`` ↔ ``arm64``). Omitting the suffix preserves existing
behavior - by :user:`rahuldevikar`. (:issue:`3059`)

***********************
v20.38.0 (2026-02-19)
***********************

20.38.0

==================

- Exclude pywin32 DLLs (``pywintypes*.dll``, ``pythoncom*.dll``) from being copied to the Scripts directory during
virtualenv creation on Windows. This fixes compatibility issues with pywin32, which expects its DLLs to be installed
in ``site-packages/pywin32_system32`` by its own post-install script - by :user:`rahuldevikar`. (:issue:`2662`)
- Preserve symlinks in ``pyvenv.cfg`` paths to match ``venv`` behavior. Use ``os.path.abspath()`` instead of
``os.path.realpath()`` to normalize paths without resolving symlinks, fixing issues with Python installations accessed
via symlinked directories (common in network-mounted filesystems) - by :user:`rahuldevikar`. Fixes :issue:`2770`.
(:issue:`2770`)
- Fix Windows activation scripts to properly quote ``python.exe`` path, preventing failures when Python is installed in
a path with spaces (e.g., ``C:\Program Files``) and a file named ``C:\Program`` exists on the filesystem - by
:user:`rahuldevikar`. (:issue:`2985`)
- Fix ``bash -u`` (``set -o nounset``) compatibility in bash activation script by using ``${PKG_CONFIG_PATH:-}`` and
``${PKG_CONFIG_PATH:+:${PKG_CONFIG_PATH}}`` to handle unset ``PKG_CONFIG_PATH`` - by :user:`Fridayai700`.
(:issue:`3044`)
- Gracefully handle corrupted on-disk cache and invalid JSON from Python interrogation subprocess instead of crashing
with unhandled ``JSONDecodeError`` or ``KeyError`` - by :user:`gaborbernat`. (:issue:`3054`)

***********************
v20.36.1 (2026-01-09)
***********************

20.36.1

==================

- Fix TOCTOU vulnerabilities in app_data and lock directory creation that could be exploited via symlink attacks -
reported by :user:`tsigouris007`, fixed by :user:`gaborbernat`. (:issue:`3013`)

***********************
v20.36.0 (2026-01-07)
***********************

20.36.0

==================

- Add support for PEP 440 version specifiers in the ``--python`` flag. Users can now specify Python versions using
operators like ``>=``, ``<=``, ``~=``, etc. For example: ``virtualenv --python=">=3.12" myenv`` `. (:issue:`2994`)

***********************
v20.35.4 (2025-10-28)
***********************

Links

• PyPI: https://pypi.org/project/virtualenv
• Changelog: https://data.safetycli.com/changelogs/virtualenv/

[pyup-bot]

Closing this in favor of #332