[pull] main from pypa:main - #42
Open
pull[bot] wants to merge 404 commits into
Open
Conversation
…n /.github/workflows (#2964) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Signed-off-by: Bernát Gábor <bgabor8@bloomberg.net>
Co-authored-by: Emre Şafak <3928300+esafak@users.noreply.github.com>
for more information, see https://pre-commit.ci
for more information, see https://pre-commit.ci
fix: Prevent NameError when accessing _DISTUTILS_PATCH during file ov…
updates: - [github.com/python-jsonschema/check-jsonschema: 0.34.0 → 0.34.1](python-jsonschema/check-jsonschema@0.34.0...0.34.1) - [github.com/tox-dev/tox-ini-fmt: 1.6.0 → 1.7.0](tox-dev/tox-ini-fmt@1.6.0...1.7.0) - [github.com/tox-dev/pyproject-fmt: v2.8.0 → v2.11.0](tox-dev/pyproject-fmt@v2.8.0...v2.11.0) - [github.com/astral-sh/ruff-pre-commit: v0.14.0 → v0.14.2](astral-sh/ruff-pre-commit@v0.14.0...v0.14.2)
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
<!--pre-commit.ci start--> updates: - [github.com/astral-sh/ruff-pre-commit: v0.16.0 → v0.16.1](astral-sh/ruff-pre-commit@v0.16.0...v0.16.1) - [github.com/zizmorcore/zizmor-pre-commit: v1.28.0 → v1.29.0](zizmorcore/zizmor-pre-commit@v1.28.0...v1.29.0) <!--pre-commit.ci end--> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
…3203) Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: gaborbernat <690238+gaborbernat@users.noreply.github.com>
`ListType.split_values` declares `-> list[str]`, but the string branch
ended with `values = filter(None, [...])` and returned that, so callers
got a one-shot iterator whose second pass came up empty and whose
`len()` raised. 🐛 List input went through `list(value)`, so which type
you got back depended on which branch ran. The `ty:
ignore[invalid-return-type]` on the return statement was masking the
mismatch. Since the only caller, `ListType.convert`, iterates the result
once, no user hits this today; it is a contract violation and a trap for
the next caller.
Building the list in the string branch fixes that half. The `bytes` case
was messier. Both `splitlines` and `strip` accept `bytes`, so
`split_values(b"a\nb")` returned `[b'a', b'b']`, but input with no
newline fell through to `value.split(",")` and raised `TypeError` on the
`str` separator, which the second `ty: ignore[invalid-argument-type]`
was hiding. Decoding `bytes` on entry repairs the comma path, leaves the
newline path working, and lets the result match the `list[str]`
annotation, where before `self.as_type(i)` downstream would turn `b"a"`
into `"b'a'"`. Both ignore comments are gone and `ty check` still
passes, the clearest evidence they were covering nothing but these two
problems.
The signature stays `str | bytes | list[str]`, so nothing public
narrows. Callers passing `bytes` now get `str` elements back instead of
`bytes`.
---------
Co-authored-by: Bernat Gabor <gaborjbernat@gmail.com>
<!--pre-commit.ci start--> updates: - [github.com/python-jsonschema/check-jsonschema: 0.37.4 → 0.38.0](python-jsonschema/check-jsonschema@0.37.4...0.38.0) - [github.com/tox-dev/pyproject-fmt: v2.26.0 → v2.27.0](tox-dev/pyproject-fmt@v2.26.0...v2.27.0) - [github.com/astral-sh/ruff-pre-commit: v0.16.1 → v0.16.2](astral-sh/ruff-pre-commit@v0.16.1...v0.16.2) <!--pre-commit.ci end--> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: gaborbernat <690238+gaborbernat@users.noreply.github.com>
The type environment fails on every PR since python-discovery 1.5.2 reached PyPI today, for example in [this job](https://github.com/pypa/virtualenv/actions/runs/31618753498/job/94187986986). The release added class-level annotations to `PythonInfo`, widening `prefix` to `str | None` and the `sysconfig_vars` values to `str | int | None`, and ty rejects two call sites that assumed the narrower types. The annotations match what the collector produces: `prefix` comes from `getattr(sys, "prefix", None)` and `sysconfig_vars` values from `sysconfig.get_config_var`, which returns strings, ints, or None. `Py_ENABLE_SHARED` for instance is an int. `Describe._calc_config_vars` returns the vars unchanged when `prefix` is None, since no value can point inside a prefix that does not exist. `CPython3Posix._shared_libpython` narrows `INSTSONAME` and `LIBDIR` to non-empty strings before joining them into a path; an int in either slot cannot name a shared library, so it bails out the same way it did for missing values. On a regular CPython host `prefix` is a string and both vars are strings, so runtime behavior stays the same. `tox r -e type` and `tox r -e fix` pass against 1.5.2. So do the describe and cpython3 unit tests. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
The "Rename changelog with PR number" step in `upgrade.yaml` checks out the local `auto/upgrade-embedded-deps` branch that create-pull-request left behind (no upstream configured) and then runs a bare `git push`, which fails with `fatal: The current branch auto/upgrade-embedded-deps has no upstream branch` (https://github.com/pypa/virtualenv/actions/runs/31094988576, https://github.com/pypa/virtualenv/actions/runs/31307714056); the runs since then are green only because no upgrade was pending. The step now checks out `FETCH_HEAD` from the fetch it already does, so it works on what is actually on the remote for both the created and updated paths, and pushes explicitly with `git push origin HEAD:auto/upgrade-embedded-deps`.
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 9.0.0 to 10.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features</h2> <h2>Changes</h2> <p>Another breaking release, directly after v9.0.0 but we think the added security justifies that.</p> <h3>Extra security by default</h3> <p>If you use the default <code>enable-cache: auto</code> this will now <strong>DISABLE THE CACHE</strong> to protect against cache poisoning for the following events:</p> <ul> <li><code>pull_request_target</code></li> <li><code>workflow_run</code></li> <li><code>release</code></li> </ul> <p>You can read the full reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/984">astral-sh/setup-uv#984</a></p> <h3><code>version: latest-known</code></h3> <pre lang="yaml"><code>- name: Install the latest version of uv known to setup-uv uses: astral-sh/setup-uv@v10.0.0 with: version: "latest-known" </code></pre> <p>This will now install the latest version with a checksum that is known by this action. The <a href="https://github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts">known <code>uv</code> checksums</a> are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.</p> <h3>Read python version from <code>.tool-versions</code></h3> <pre lang="yaml"><code>- name: Install uv based on the version defined in .tool-versions and also set python uses: astral-sh/setup-uv@v10.0.0 with: version-file: "pyproject.toml" </code></pre> <p>Will now also set the python version if it is defined in <code>.tool-versions</code>. You can read the details <a href="https://github.com/astral-sh/setup-uv/blob/main/docs/advanced-version-configuration.md#install-a-version-defined-in-a-requirements-or-config-file">in the docs</a></p> <h2>🚨 Breaking changes</h2> <ul> <li>Disable automatic caching for sensitive events <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/992">#992</a>)</li> </ul> <h2>🐛 Bug fixes</h2> <ul> <li>Reject paths in .tool-versions <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1007">#1007</a>)</li> </ul> <h2>🚀 Enhancements</h2> <ul> <li>Read Python version from .tool-versions <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/996">#996</a>)</li> <li>Add latest-known version selector <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/993">#993</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d"><code>ae62891</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1013">#1013</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f9cdb47d487aee2be8925d1e57290177ad9e1ac2"><code>f9cdb47</code></a> Reject paths in .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1007">#1007</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4f6036f71cec78afb113b323f220c9185d983c12"><code>4f6036f</code></a> Require pull requests for Dependabot rollups (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1005">#1005</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8d6402c9b71205b2d8d0b82de531d8fed8430182"><code>8d6402c</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1004">#1004</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/46f427bd47c794e99536b75ffaa9f27602425027"><code>46f427b</code></a> Read Python version from .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/996">#996</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8ed89c51143f65ea13eaba62db51dbb8ea52d0a3"><code>8ed89c5</code></a> ci: pin Alpine container image (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/995">#995</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8473c7fea42cdfd540f4b01317a17ac5f54126ae"><code>8473c7f</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/994">#994</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/18d451d679e1650bc59f25f17116168d04f30748"><code>18d451d</code></a> Add latest-known version selector (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/993">#993</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f45168497b927d08c229345a5ab9ad5c85418d0b"><code>f451684</code></a> Disable automatic caching for sensitive events (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/992">#992</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/b68407c192114b6e47cc45b98289832c3df00d5e"><code>b68407c</code></a> chore: update known checksums for 0.12.3 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/991">#991</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/c771a70e6277c0a99b617c7a806ffedaca235ff9...ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.0 to 10.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.0.1 🌈 Tolerate transient manifest timeouts</h2> <h2>Changes</h2> <p>Thank you <a href="https://github.com/arguile"><code>@arguile</code></a>- for making this action more resilient.</p> <h2>🐛 Bug fixes</h2> <ul> <li>Tolerate transient manifest timeouts <a href="https://github.com/arguile"><code>@arguile</code></a>- (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.12.4 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.0.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/20cfd1bf945f4377ade1205e4dbc17946fc9a30d"><code>20cfd1b</code></a> chore: update known checksums for 0.12.4 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/d73a0cab66a532d7afa440d9df4a67ea9fe65a30"><code>d73a0ca</code></a> Tolerate transient manifest timeouts (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae3b92d1bdb308a10adfe7b8f408e5cc8c30f3f6"><code>ae3b92d</code></a> docs: update version references to v10.0.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> <li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d...20cfd1bf945f4377ade1205e4dbc17946fc9a30d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Dependabot opened a separate pull request for every bump here, which turned routine maintenance into a stream of near-identical reviews. 🔁 `.github/dependabot.yaml` now runs weekly on Tuesday with a catch-all `groups` entry per ecosystem, so one pull request carries the week's bumps. The other projects I maintain are moving to the same schedule.
Hello In PR actualize max support pythonVersion 3.14 -> 3.15 (like https://github.com/pypa/virtualenv/blob/main/pyproject.toml#L37) Co-authored-by: vyuroshchin <>
Co-authored-by: Bernat Gabor <gaborjbernat@gmail.com>
### Thanks for contributing, make sure you address all the checklists (for details on how see [development documentation](https://virtualenv.pypa.io/en/latest/development.html#development)) - [x] ran the linter to address style issues (`tox -e fix`) - [x] wrote descriptive pull request text - [x] ensured there are test(s) validating the fix - [x] added news fragment in `docs/changelog` folder - [ ] updated/extended the documentation --- `safe_delete` hands `shutil.rmtree` a chmod-and-retry handler and sets `ignore_errors=True` at the same time: ```python def onerror(func, path, exc_info): if not os.access(path, os.W_OK): os.chmod(path, S_IWUSR) func(path) else: raise shutil.rmtree(str(dest), ignore_errors=True, onexc=onerror) ``` `rmtree` overwrites whatever handler it is given when `ignore_errors` is set — `onexc = _onexc = lambda *args: None` — so this handler has never run. Every deletion failure was swallowed and `safe_delete` returned as if it had worked. That matters on Windows, where the read-only attribute blocks `os.unlink`, and virtualenv marks every file in a wheel image read-only itself via `set_tree`. So: - `--reset-app-data` kept the image trees it reported removing - recreating an env with `--clear` could leave read-only files from the old one behind - replacing a seed package could leave a mix of old and new files I found this by asking what the `# ty: ignore[call-non-callable]` on the `func(path)` line was hiding. The suppression was there because `func` is annotated `object`, and `func` is annotated `object` because nothing ever called it. Before the fix, on Windows, `rmtree` left the tree in place and the handler was invoked zero times. Dropping `ignore_errors` lets the handler do what it was written to do: clear the read-only bit, retry, and surface anything it genuinely cannot delete instead of pretending the delete succeeded. Typing `func` properly removes the `ty` suppression — `ty check src/virtualenv` still passes without it. One caller needed a guard. `AppDataDiskFolder.reset` is the only one that calls `safe_delete` without an `exists()` check first, so a missing directory used to be absorbed by `ignore_errors`. `onerror` now returns early on `FileNotFoundError` to keep that a no-op. Three tests: a read-only tree is actually removed, a missing path stays a no-op, and an undeletable entry now raises instead of being swallowed. The first and third fail on `main`. The third is Windows-only, since it needs an open file handle to block deletion; the first passes on POSIX either way, because there deleting a file depends on the parent directory's permissions rather than the file's own. `tests/unit` is green locally on Windows / 3.13 (296 passed, 31 skipped), along with ruff and `ty`. --------- Co-authored-by: Bernat Gabor <gaborjbernat@gmail.com>
Co-authored-by: Bernat Gabor <gaborjbernat@gmail.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: vyuroshchin <>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )