[dependabot]

Bumps filelock from 3.32.3 to 4.0.0.

Release notes

Sourced from filelock's releases.

4.0.0

What's Changed

• 🐛 fix(soft-rw): replace the state mutex with a generation log by @​gaborbernat in tox-dev/filelock#738

Full Changelog: tox-dev/filelock@3.32.7...4.0.0

3.32.7

What's Changed

• Fix final symlink test on musl by @​lprnmns in tox-dev/filelock#737
• 📝 docs: say acquire() falls back to the lock's blocking attribute by @​hxperl in tox-dev/filelock#733

New Contributors

• @​hxperl made their first contribution in tox-dev/filelock#733

Full Changelog: tox-dev/filelock@3.32.6...3.32.7

3.32.6

What's Changed

• 🐛 fix(lease): reject a duration no marker can carry by @​lprnmns in tox-dev/filelock#723
• 🐛 fix(soft-rw): reject non-finite timing options by @​lprnmns in tox-dev/filelock#724
• fix: preserve exception notes when copying and pickling by @​jackwalkerlabs in tox-dev/filelock#729
• test(soft-rw): reuse existing test module by @​gaborbernat in tox-dev/filelock#730
• fix: respect ACL write access when the owner write bit is absent by @​jackwalkerlabs in tox-dev/filelock#728
• Fix SoftReadWriteLock state lock timeout by @​Sohel2309 in tox-dev/filelock#726

New Contributors

• @​jackwalkerlabs made their first contribution in tox-dev/filelock#729
• @​Sohel2309 made their first contribution in tox-dev/filelock#726

Full Changelog: tox-dev/filelock@3.32.5...3.32.6

3.32.5

What's Changed

• 🧪 test(fork): report where a stalled fork stops by @​gaborbernat in tox-dev/filelock#715
• 📝 docs: say that mode is read-only in the thread-local section by @​Gares95 in tox-dev/filelock#716
• 🐛 fix(lease): clear token after failed acquire by @​lprnmns in tox-dev/filelock#721

New Contributors

• @​lprnmns made their first contribution in tox-dev/filelock#721

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.1 (2026-09-19)

---

• poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739

---

4.0.0 (2026-09-17)

---

• The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
• :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
• :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

---

3.32.7 (2026-09-16)

---

• Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
• Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

---

3.32.6 (2026-09-08)

---

• SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
• Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724

... (truncated)

Commits

• 7e57436 Release 4.0.0
• f974328 🐛 fix(soft-rw): replace the state mutex with a generation log (#738)
• 20929f7 Release 3.32.7
• 35f07c4 [pre-commit.ci] pre-commit autoupdate (#736)
• e860d39 📝 docs: say acquire() falls back to the lock's blocking attribute (#733)
• c530efe Fix final symlink test on musl (#737)
• 4efd93e Release 3.32.6
• 7b7b7a8 Fix SoftReadWriteLock state lock timeout (#726)
• f2f7b86 fix: respect ACL write access when the owner write bit is absent (#728)
• e947a69 test(soft-rw): reuse existing test module (#730)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

• Chores
  • Updated the minimum required filelock version to 4.0.0.
  • Updated the test environment to use filelock 4.0.0.

[coderabbitai]

Understand this PR’s impact

Explore downstream dependencies and potential security impact with Blast Radius.

View blast radius →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fdba47fa-60b1-4c12-8259-41a4ccba59b1

📥 Commits

Reviewing files that changed from the base of the PR and between 0850416 and bc7a9b3.

📒 Files selected for processing (2)

• requirements-core.txt
• requirements-test.txt

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates filelock to version 4.0.0 in the core minimum dependency and the test-suite dependency.

Changes

Filelock dependency update

Layer / File(s)	Summary
Dependency version alignment requirements-core.txt, requirements-test.txt	The core minimum changes to >=4.0.0. The test dependency changes to 4.0.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: d-ogi

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the dependency upgrade and includes release information, but it does not follow the required template. It omits the Problem and resulting behavior, Scope, Validation, and Revi…	Add the required template sections. Describe the problem and resulting behavior, affected components and compatibility risks, exact validation commands with environments and results, and the completed review checklist. State that validation…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency and the target version. It accurately summarizes the main change, although the production requirement changes from 3.16 rather than 3.32.3.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the dependency upgrade and includes release information, but it does not follow the required template. It omits the Problem and resulting behavior, Scope, Validation, and Review checklist sections.

Resolution

Add the required template sections. Describe the problem and resulting behavior, affected components and compatibility risks, exact validation commands with environments and results, and the completed review checklist. State that validation was not run when applicable and explain why.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #102.