Skip to content

Bump the workflows-dependencies group across 1 directory with 3 updates - #128

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/workflows/workflows-dependencies-c2b72cffba
Open

Bump the workflows-dependencies group across 1 directory with 3 updates#128
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/workflows/workflows-dependencies-c2b72cffba

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the workflows-dependencies group with 3 updates in the /.github/workflows directory: nox, pip and poetry.

Updates nox from 2026.2.9 to 2026.8.10

Release notes

Sourced from nox's releases.

2026.08.10 🔀

This release can run sessions in parallel with --parallel/-j (experimental for now, report any bugs!). Requires session opt-in, or use --allow-parallel. Interpreter discovery now uses the python-discovery package, which should be better at finding Python and supports version specifier sets. Using this, script mode reads requires-python. Many bugs were fixed, mostly in Python version handling, conda version specifiers, and option precedence. Unrecognized global options are now an error.

We'd like to thank the following folks who contributed to this release:

Features:

Fixes:

Documentation:

Internal changes:

... (truncated)

Changelog

Sourced from nox's changelog.

Changelog

2026.08.10

This release can run sessions in parallel with --parallel/-j (experimental for now, report any bugs!). Requires session opt-in, or use --allow-parallel. Interpreter discovery now uses the python-discovery package, which should be better at finding Python and supports version specifier sets. Using this, script mode reads requires-python. Many bugs were fixed, mostly in Python version handling, conda version specifiers, and option precedence. Unrecognized global options are now an error.

We'd like to thank the following folks who contributed to this release:

Features:

Fixes:

Documentation:

... (truncated)

Commits
  • 57f9e10 docs: prepare 2026.08.10 release notes (#1156)
  • c7134d4 fix: isolate script mode from inherited PYTHONPATH (#1157)
  • aad0ea8 fix: require virtualenv 21+ on Python 3.15 (#1158)
  • 00c9566 fix: conda version constraints on Windows (#1146)
  • 1d6b258 fix: drop stale type ignores for argcomplete 3.7.2 (#1155)
  • 94b833b docs: fix broken examples, stale versions, and typos (#1154)
  • c213de6 chore(deps): bump the pre-commit group with 6 updates (#1152)
  • 2b1ad76 test: make the remaining uv download tests pass without uv installed (#1153)
  • 7519a98 chore(deps): bump the github-actions group with 5 updates (#1151)
  • 1ff9327 feat: support requires-python in script mode (#1142)
  • Additional commits viewable in compare view

Updates pip from 26.1.2 to 26.2.1

Changelog

Sourced from pip's changelog.

26.2.1 (2026-08-04)

Bug Fixes

  • Reallow keyring installed in a (non-activated) virtual environment to be be used via the import provider method while installing build dependencies. ([#14227](https://github.com/pypa/pip/issues/14227) <https://github.com/pypa/pip/issues/14227>_)

26.2 (2026-07-29)

Deprecations and Removals

  • Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use --refresh-package. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

  • Drop support for detecting legacy, non-:pep:405, virtualenv (< 20) environments. ([#14062](https://github.com/pypa/pip/issues/14062) <https://github.com/pypa/pip/issues/14062>_)

  • Constraints files, including PIP_CONSTRAINT, no longer affect isolated build environments. Use --build-constraint or the PIP_BUILD_CONSTRAINT environment variable to constrain build dependencies instead.

    The --use-feature=build-constraint flag is now always enabled and has no effect. ([#14094](https://github.com/pypa/pip/issues/14094) <https://github.com/pypa/pip/issues/14094>_)

Features

  • Declare support for Python 3.15 ([#14208](https://github.com/pypa/pip/issues/14208) <https://github.com/pypa/pip/issues/14208>_)

  • Support self-referential extras officially. pip has supported this by accident since version 21.2. ([#11296](https://github.com/pypa/pip/issues/11296) <https://github.com/pypa/pip/issues/11296>_)

  • Add --only-deps flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with --no-deps, -r, --group, or --requirements-from-script. ([#11440](https://github.com/pypa/pip/issues/11440) <https://github.com/pypa/pip/issues/11440>_)

  • Cache simple responses in accordance to their Cache-Control header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use --refresh-package <package>. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

  • Add --no-require-hashes to disable automatic enablement of --require-hashes when encountering a requirement with hashes. ([#14169](https://github.com/pypa/pip/issues/14169) <https://github.com/pypa/pip/issues/14169>_)

  • Honor --only-final when sourcing requirements with -r pylock.toml. ([#13950](https://github.com/pypa/pip/issues/13950) <https://github.com/pypa/pip/issues/13950>_)

  • Add support for pylock.toml upload-time field, so --uploaded-prior-to works with -r pylock.toml. ([#14168](https://github.com/pypa/pip/issues/14168) <https://github.com/pypa/pip/issues/14168>_)

  • Better error messages in case of conflicts with requirements from -r pylock.toml. ([#13963](https://github.com/pypa/pip/issues/13963) <https://github.com/pypa/pip/issues/13963>_)

  • Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via --use-feature=venv-isolation and will be enabled by default in a future release.

    Note that the feature has limited compatibility with --use-feature=inprocess-build-deps.

... (truncated)

Commits
  • 634a6ec Bump for release
  • ae2eb4f Revert build dependency installer isolation for legacy build environment (#14...
  • 6236392 Merge pull request #14213 from pypa/release/26.2
  • da4b2cc Bump for development
  • 4b6ae5c Bump for release
  • 50b6d3c Update AUTHORS.txt
  • dbddfbd Tweak news entries for pip 26.2 (#14212)
  • 6576b75 Merge pull request #14165 from sbidoul/refactor-pylock-hanling-sbi
  • 0090e00 Address a variety of typos detected in code review
  • e12ddd9 Add support for --uploaded-prior-to with -r pylock.toml
  • Additional commits viewable in compare view

Updates poetry from 2.3.2 to 2.4.1

Release notes

Sourced from poetry's releases.

2.4.1

Changed

  • Re-allow installer==0.7.0 (#10887).

Fixed

  • Fix an issue where poetry update <package> failed when <package> was a transitive dependency (#10885).

2.4.0

Added

  • Add solver.min-release-age setting to require package releases to be a certain number of days old before they are considered during dependency resolution (#10824).
  • Add solver.min-release-age-exclude to exclude selected packages from age filtering (#10824).
  • Add solver.min-release-age-exclude-source to exclude all packages from selected package indexes from age filtering (#10824).

Changed

  • Raise an error instead of silently ignoring a package name that is not a dependency when it is passed to poetry update (#10721).
  • Automatically add a trailing slash to legacy repository URLs (used for publishing) if missing (#10785).
  • Require installer>=1.0.0 (#10869).
  • Allow findpython>=0.8 (#10874).

Fixed

  • Fix an issue where requires-plugins fails on Windows if scheme paths are on different drives (#10869).
  • Fix an issue where the order of markers in the lock file was not deterministic (#10720).
  • Fix an issue where the wrong command was suggested when poetry self commands failed due to an outdated lock file (#10715).
  • Fix an issue where poetry env activate did not work for bash on Windows (#10716).
  • Fix an issue where poetry debug resolve failed when there was a package with a marker (#10807).
  • Fix an issue where the error message about a build backend failure contained garbled --config-settings (#10804).
  • Fix an issue where a false warning about a circular dependency was printed (#10811).
  • Fix an issue where falsy config values were incorrectly treated as not set (#10808).
  • Fix an issue where poetry publish --build ignored failing builds and uploaded stale artifacts (#10802).
  • Fix an issue where poetry publish was aborted instead of retrying after package registration (#10801).
  • Fix an issue where zip files were not closed after fetching metadata via lazy-wheel (#10800).
  • Fix an issue where data fetched via lazy-wheel was corrupted when part of it had already been cached (#10806).
  • Fix an issue where further packages were installed even though installation should be aborted (#10742).
  • Fix an issue where installed packages without a METADATA file caused an exception on Python 3.15+ (#10860).
  • Fix an issue where http-basic could not be set for repository names with periods (#10845).
  • Fix an issue where calculating the hash of large wheels failed with a memory error (#10814).

Docs

  • Clarify the precedence of configuration sources (#10757).
  • Add a note about the influence of .gitignore on tool.poetry.packages (#10835).

poetry-core (2.4.0)

  • Update vendored packaging to 26.2 (#936).

... (truncated)

Changelog

Sourced from poetry's changelog.

[2.4.1] - 2026-05-09

Changed

  • Re-allow installer==0.7.0 (#10887).

Fixed

  • Fix an issue where poetry update <package> failed when <package> was a transitive dependency (#10885).

[2.4.0] - 2026-05-03

Added

  • Add solver.min-release-age setting to require package releases to be a certain number of days old before they are considered during dependency resolution (#10824).
  • Add solver.min-release-age-exclude to exclude selected packages from age filtering (#10824).
  • Add solver.min-release-age-exclude-source to exclude all packages from selected package indexes from age filtering (#10824).

Changed

  • Raise an error instead of silently ignoring a package name that is not a dependency when it is passed to poetry update (#10721).
  • Automatically add a trailing slash to legacy repository URLs (used for publishing) if missing (#10785).
  • Require installer>=1.0.0 (#10869).
  • Allow findpython>=0.8 (#10874).

Fixed

  • Fix an issue where requires-plugins fails on Windows if scheme paths are on different drives (#10869).
  • Fix an issue where the order of markers in the lock file was not deterministic (#10720).
  • Fix an issue where the wrong command was suggested when poetry self commands failed due to an outdated lock file (#10715).
  • Fix an issue where poetry env activate did not work for bash on Windows (#10716).
  • Fix an issue where poetry debug resolve failed when there was a package with a marker (#10807).
  • Fix an issue where the error message about a build backend failure contained garbled --config-settings (#10804).
  • Fix an issue where a false warning about a circular dependency was printed (#10811).
  • Fix an issue where falsy config values were incorrectly treated as not set (#10808).
  • Fix an issue where poetry publish --build ignored failing builds and uploaded stale artifacts (#10802).
  • Fix an issue where poetry publish was aborted instead of retrying after package registration (#10801).
  • Fix an issue where zip files were not closed after fetching metadata via lazy-wheel (#10800).
  • Fix an issue where data fetched via lazy-wheel was corrupted when part of it had already been cached (#10806).
  • Fix an issue where further packages were installed even though installation should be aborted (#10742).
  • Fix an issue where installed packages without a METADATA file caused an exception on Python 3.15+ (#10860).
  • Fix an issue where http-basic could not be set for repository names with periods (#10845).
  • Fix an issue where calculating the hash of large wheels failed with a memory error (#10814).

Docs

  • Clarify the precedence of configuration sources (#10757).
  • Add a note about the influence of .gitignore on tool.poetry.packages (#10835).

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 1, 2026
@dependabot
Bump the workflows-dependencies group across 1 directory with 3 updates
f2fb4a3 
Bumps the workflows-dependencies group with 3 updates in the /.github/workflows directory: [nox](https://github.com/wntrblm/nox), [pip](https://github.com/pypa/pip) and [poetry](https://github.com/python-poetry/poetry).


Updates `nox` from 2026.2.9 to 2026.8.10
- [Release notes](https://github.com/wntrblm/nox/releases)
- [Changelog](https://github.com/wntrblm/nox/blob/main/CHANGELOG.md)
- [Commits](wntrblm/nox@2026.02.09...2026.08.10)

Updates `pip` from 26.1.2 to 26.2.1
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@26.1.2...26.2.1)

Updates `poetry` from 2.3.2 to 2.4.1
- [Release notes](https://github.com/python-poetry/poetry/releases)
- [Changelog](https://github.com/python-poetry/poetry/blob/main/CHANGELOG.md)
- [Commits](python-poetry/poetry@2.3.2...2.4.1)

---
updated-dependencies:
- dependency-name: nox
  dependency-version: 2026.7.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workflows-dependencies
- dependency-name: pip
  dependency-version: 26.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workflows-dependencies
- dependency-name: poetry
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workflows-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the workflows-dependencies group in /.github/workflows with 3 updates Bump the workflows-dependencies group across 1 directory with 3 updates Aug 17, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/dot-github/workflows/workflows-dependencies-c2b72cffba branch from 20f9bd9 to f2fb4a3 Compare August 17, 2026 11:40

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@EdvardGarmannslund EdvardGarmannslund Awaiting requested review from EdvardGarmannslund

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants