Bumps the other-dependencies group with 16 updates in the / directory:

Package	From	To
aiohttp	3.14.1	3.14.3
anyio	4.14.1	4.14.2
certifi	2026.6.17	2026.7.22
cffi	2.1.0	2.1.1
cryptography	49.0.0	50.0.0
h2	4.3.0	4.4.1
idna	3.18	3.19
mypy	2.2.0	2.3.1
packaging	26.2	26.3
platformdirs	4.10.0	4.11.3
portalocker	2.10.1	4.1.0
time-machine	3.2.0	3.4.0
tomlkit	0.15.0	0.15.1
tzdata	2026.2	2026.3
wrapt	2.2.2	2.3.0
yarl	1.24.2	1.24.5

Updates aiohttp from 3.14.1 to 3.14.3
Updates anyio from 4.14.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

• Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
• Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
• Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
• Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
• Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
• Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
• Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
• Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)

Commits

• c384f99 Bumped up the version
• dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
• 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
• 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
• be24b04 Relaxed timeouts to fix test flakiness
• 8113506 Fix test flakiness caused by slow callback duration logging
• 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
• 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
• f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
• 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
• Additional commits viewable in compare view

Updates certifi from 2026.6.17 to 2026.7.22

Commits

• f4bc676 2026.07.22 (#428)
• 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
• 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
• eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
• 474e6fc Include tests in the source distribution (#424)
• a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420)
• 98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
• See full diff in compare view

Updates cffi from 2.1.0 to 2.1.1

Release notes

Sourced from cffi's releases.

v2.1.1

What's Changed

• Minimize internal Python API usage for interpreter and thread state sampling where possible. Avoids breaking ABI change in Python >= 3.15.0b4 (python-cffi/cffi#269).

Full Changelog: python-cffi/cffi@v2.1.0...v2.1.1

Commits

• fd33e77 New release 2.1.1
• 56a7876 Use PyGILState_Ensure to avoid accessing CPython internals (#269) (#270)
• See full diff in compare view

Updates cryptography from 49.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31

* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table> 

... (truncated)

Commits

• dcb7050 Prepare for 50.0.0 release (#15372)
• 53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
• d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
• 908773d Bump downstream dependencies in CI (#15368)
• 2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
• c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
• 67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
• 95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
• 6954733 Release the GIL during DH and DSA parameter generation (#15364)
• 6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
• Additional commits viewable in compare view

Updates h2 from 4.3.0 to 4.4.1

Changelog

Sourced from h2's changelog.

4.4.1 (2026-08-03)

Bugfixes

• Performance improvement: remove consumed frames in-place from data buffer.
• Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.

4.4.0 (2026-07-23)

API Changes (Backward Incompatible)

• Support for Python 3.9 has been removed.
• Support for PyPy 3.9 has been removed.
• Stream.end_stream() now raises NoSuchStreamError or StreamClosedError exceptions, instead of a generic KeyError.
• Duplicate content-length headers with different values now raise ProtocolError. Previously, the first content-length header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.
• Parse content-length headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.
• backfill from v4.3.0 Convert emitted events into Python dataclass, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

• Support for Python 3.14 has been added.
• H2Connection.receive_data now accepts any byte-like object that implements the buffer protocol, such as bytes, bytearray, and memoryview. Existing bytes callers are unaffected.
• Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. Ordinary CONNECT now requires :method=CONNECT and :authority, and forbids :scheme/:path. Extended CONNECT (e.g., WebSocket) requires :scheme, :path, :authority plus :protocol. (PR #1309)
• Fix incorrect substring matching of secure header in cookie and :method.

Bugfixes

• Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
• Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.

Commits

• bc239af v4.4.1
• 92b925e add test for duplicate host headers
• 292a408 reject duplicate Host headers in request headers
• 04d3b87 update changelog
• 439b970 prepare for next release cycle
• 9a7ff74 performance: remove consumed frames in place from data buffer (#1321)
• 6cce763 v4.4.0
• dfafda3 Bump pytest from 8.4.2 to 9.0.3 (#1320)
• b45207c dependencies and packaging++
• c40145f parse content-length headers according to RFC9110 grammar for numbers (1*DI...
• Additional commits viewable in compare view

Updates idna from 3.18 to 3.19

Release notes

Sourced from idna's releases.

v3.19

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document thread safety.
• Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
• The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
• Reject A-labels that are not the canonical Punycode encoding of their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.19 (2026-08-18)

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document thread safety.
• Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
• The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
• Reject A-labels that are not the canonical Punycode encoding of their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits

• 03a9a11 Release 3.19
• 2d2a7ef Pre-release 3.19rc0
• 5cce130 Merge pull request #268 from kjd/fix-std3-regex-alert
• 3914b75 Split the STD3 disallowed-character range so uppercase is explicit
• ce9fd98 Merge pull request #267 from kjd/housekeeping
• 809240c Fail CI when the license copyright year is behind the current year
• d9e16c5 Consolidate test fixtures, prune stale gitignore entries, and fix doc typos
• ef30fee Remove dead code and pare back superfluous comments
• b907913 Tighten the version support and Unicode notes in the README
• 6204cbe Ignore local build artifacts and stop packaging stray tooling config
• Additional commits viewable in compare view

Updates mypy from 2.2.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates platformdirs from 4.10.0 to 4.11.3

Release notes

Sourced from platformdirs's releases.

4.11.3

What's Changed

• 📄 docs: publish llms.txt from the docs build by @​gaborbernat in tox-dev/platformdirs#522
• fix: don't crash when an XDG dirs variable holds only separators by @​darrenhuai in tox-dev/platformdirs#523

Full Changelog: tox-dev/platformdirs@4.11.2...4.11.3

4.11.2

What's Changed

• fix: stop the remaining iter_*_dirs yielding duplicate or joined paths by @​darrenhuai in tox-dev/platformdirs#520

Full Changelog: tox-dev/platformdirs@4.11.1...4.11.2

4.11.1

What's Changed

• Let the non-ctypes resolvers find the desktop folder by @​darrenhuai in tox-dev/platformdirs#519

New Contributors

• @​darrenhuai made their first contribution in tox-dev/platformdirs#519

Full Changelog: tox-dev/platformdirs@4.11.0...4.11.1

4.11.0

What's Changed

• 👷 ci: run the test suite against Python 3.15 by @​gaborbernat in tox-dev/platformdirs#512

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

4.10.1

What's Changed

• 🐛 fix(windows): stop leaking memory on repeated folder lookups by @​gaborbernat in tox-dev/platformdirs#507
• 🚀 ci(release): towncrier changelog + publish on tag push by @​gaborbernat in tox-dev/platformdirs#509
• 📝 docs(changelog): rebuild against release history by @​gaborbernat in tox-dev/platformdirs#510

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.3 (2026-08-13)

---

• python -m platformdirs now lists :func:~platformdirs.user_desktop_dir, which was missing from the properties it prints. :pr:523
• Stop :func:~platformdirs.site_data_dir, :func:~platformdirs.site_config_dir and :func:~platformdirs.site_applications_dir raising IndexError on Unix and macOS when $XDG_DATA_DIRS or $XDG_CONFIG_DIRS holds only separators and whitespace, such as ":". These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:523

---

4.11.2 (2026-08-10)

---

• Stop :meth:~platformdirs.PlatformDirs.iter_cache_dirs, :meth:~platformdirs.PlatformDirs.iter_state_dirs, :meth:~platformdirs.PlatformDirs.iter_log_dirs and :meth:~platformdirs.PlatformDirs.iter_runtime_dirs yielding the same directory twice on Unix when use_site_for_root is active - :pr:469 fixed this for the config and data iterators only. On macOS, :meth:~platformdirs.PlatformDirs.iter_cache_dirs now yields the Homebrew and /Library/Caches entries separately rather than one os.pathsep-joined string when multipath is set. :pr:520

---

4.11.1 (2026-08-07)

---

• Fix :func:~platformdirs.user_desktop_dir on Windows builds without ctypes. CSIDL_DESKTOPDIRECTORY appeared only in the ctypes lookup table, so the registry and environment variable resolvers raised ValueError for it. :pr:519

---

4.11.0 (2026-07-21)

---

• Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

---

4.10.1 (2026-07-18)

---

• Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built

... (truncated)

Commits

• 7f3960a Release 4.11.3
• c8af984 fix: don't crash when an XDG dirs variable holds only separators (#523)
• 6d2105a 📄 docs: publish llms.txt from the docs build (#522)
• 7e4746c [pre-commit.ci] pre-commit autoupdate (#521)
• a58fb90 Release 4.11.2
• a01396c fix: stop the remaining iter_*_dirs yielding duplicate or joined paths (#520)
• a9f2ba9 Release 4.11.1
• 30a9549 Let the non-ctypes resolvers find the desktop folder (#519)
• cc97359 build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the al...
• 328e15d [pre-commit.ci] pre-commit autoupdate (#517)
• Additional commits viewable in compare view

Updates portalocker from 2.10.1 to 4.1.0

Release notes

Sourced from portalocker's releases.

v4.1.0

4.1.0:

• Documentation release. No runtime behaviour changed; the only edits to executable code replaced two ... bodies on the abstract LockBase.acquire/LockBase.release stubs with docstrings.
• Every module, class, function, private helper and dunder method in the package now carries a Google-style docstring. ruff's pydocstyle rules are enabled for portalocker/ with no exemptions
• Added seven narrative guides: quickstart, lock types, platform behaviour, Redis locks, the combine CLI, troubleshooting, and a 3.x to 4.0.0 migration guide. The API reference moved under docs/api/ and a changelog page was added
• docs/platforms.rst documents the advisory-versus-mandatory distinction, flock versus lockf, msvcrt versus pywin32, and the networked-filesystem caveats that cause most locking confusion
• docs/cli.rst documents the combiner's ASCII-only requirement on portalocker/*.py, README.rst and LICENSE, which was previously only discoverable by reading __main__.py
• Doctests now run for docs/*.rst and README.rst as well as the package, so every documented example is executed on each supported platform and interpreter. No # doctest: +SKIP remains anywhere
• Fixed the README telling readers to unlock a filehandle it had already closed, which raised ValueError: I/O operation on closed file
• Fixed the README demonstrating BoundedSemaphore without a name, which the library itself deprecates in favour of NamedBoundedSemaphore
• Removed the obsolete Python 2 installation section from the README

v4.0.0

4.0.0:

• Fixed open_atomic() replacing a destination created while its context was open on POSIX; publication now raises FileExistsError and preserves the concurrent winner (#114)
• Python 3.10 or later is now required; Python 3.9 (EOL) support dropped
• pywin32 is no longer installed by default on Windows; the msvcrt-based locker is the default and works dependency-free for exclusive locks. Shared locks on Windows require portalocker[win32], and an informative ImportError is raised otherwise (#104)
• POSIX lock exceptions now populate .strerror and pass the message as a second positional argument, matching the Windows exception contract. This changes the str() output of these exceptions on POSIX from the bare OSError text to a 2-tuple repr
• LockBase is now generic over the acquire return type (typing-only change; downstream Lock subclasses are unaffected)
• Added PidFileLock for pidfile-based locking (#106)
• Added PidFileLock.fail_closed() for ownership-only contexts; contention raises AlreadyLocked before entering the body and exposes the competing PID through AlreadyLocked.holder_pid when readable (#118)
• Packaging switched to the uv_build backend; releases are published to

... (truncated)

Changelog

Sourced from portalocker's changelog.

4.1.0:

• Documentation release. No runtime behaviour changed; the only edits to executable code replaced two ... bodies on the abstract LockBase.acquire/LockBase.release stubs with docstrings.
• Every module, class, function, private helper and dunder method in the package now carries a Google-style docstring. ruff's pydocstyle rules are enabled for portalocker/ with no exemptions
• Added seven narrative guides: quickstart, lock types, platform behaviour, Redis locks, the combine CLI, troubleshooting, and a 3.x to 4.0.0 migration guide. The API reference moved under docs/api/ and a changelog page was added
• docs/platforms.rst documents the advisory-versus-mandatory distinction, flock versus lockf, msvcrt versus pywin32, and the networked-filesystem caveats that cause most locking confusion
• docs/cli.rst documents the combiner's ASCII-only requirement on portalocker/*.py, README.rst and LICENSE, which was previously only discoverable by reading __main__.py
• Doctests now run for docs/*.rst and README.rst as well as the package, so every documented example is executed on each supported platform and interpreter. No # doctest: +SKIP remains anywhere
• Fixed the README telling readers to unlock a filehandle it had already closed, which raised ValueError: I/O operation on closed file
• Fixed the README demonstrating BoundedSemaphore without a name, which the library itself deprecates in favour of NamedBoundedSemaphore
• Removed the obsolete Python 2 installation section from the README

4.0.0:

• Fixed open_atomic() replacing a destination created while its context was open on POSIX; publication now raises FileExistsError and preserves the concurrent winner (#114)
• Python 3.10 or later is now required; Python 3.9 (EOL) support dropped
• pywin32 is no longer installed by default on Windows; the msvcrt-based locker is the default and works dependency-free for exclusive locks. Shared locks on Windows require portalocker[win32], and an informative ImportError is raised otherwise (#104)
• POSIX lock exceptions now populate .strerror and pass the message as a second positional argument, matching the Windows exception contract. This changes the str() output of these exceptions on POSIX from the bare OSError text to a 2-tuple repr
• LockBase is now generic over the acquire return type (typing-only change; downstream Lock subclasses are unaffected)
• Added PidFileLock for pidfile-based locking (#106)
• Added PidFileLock.fail_closed() for ownership-only contexts; contention raises AlreadyLocked before entering the body and exposes the competing PID through AlreadyLocked.holder_pid when readable (#118)
• Packaging switched to the uv_build backend; releases are published to PyPI through GitHub Actions Trusted Publishing
• python -m portalocker combine: --output-file now opens lazily;

... (truncated)

Commits

• 5bf95b2 bumped the version to 4.1.0 and documented the release in the changelog
• 505156d Merge branch 'feature/elaborate-documentation' into develop
• 16772fd Bump the actions group with 5 updates (#134)
• 430e863 Update uv-build requirement in the actions group (#133)
• 2436b0b gave the redis doctests the timeout their contention scenarios need
• 62ca97f documented the whole package and added seven narrative guides
• cf1e80d 4.0.0:
• 4172e4b Merge pull request #132 from wolph/release/4.0.0-integration
• 34fa2ee fix: address release review feedback
• 42a0d85 Merge master into develop before v4.0.0
• Additional commits viewable in compare view

Updates time-machine from 3.2.0 to 3.4.0

Changelog

Sourced from time-machine's changelog.

3.4.0 (2026-08-10)

• Publish wheels for Python 3.15.

  Thanks to Edgar Ramírez Mondragón in PR [#655](https://github.com/adamchainz/time-machine/issues/655) <https://github.com/adamchainz/time-machine/pull/655>__.

• Fix a reference leak in the patched datetime.datetime.utcnow() that occurred when its Python 3.12+ DeprecationWarning was raised as an error, such as under -W error. Each such call leaked a reference to the active traveller object.

  PR [#656](https://github.com/adamchainz/time-machine/issues/656) <https://github.com/adamchainz/time-machine/pull/656>__.

• Extend the :ref:Migration CLI <migration-cli> to migrate patterns from freezegun’s pytest plugins, pytest-freezegun and pytest-freezer: the freezer fixture and the pytest.mark.freeze_time marker. Also make it migrate freeze_time() context managers that bind the result with as, including converting tick() method calls to shift().

  PR [#658]...

  Description has been truncated