chore(deps): update filelock requirement from >=3.32.5 to >=4.0.8

[dependabot]

Updates the requirements on filelock to permit the latest version.

Release notes

Sourced from filelock's releases.

4.0.8

What's Changed

• 🐛 fix(read-write): refuse cross-thread write release by @​feiiiiii5 in tox-dev/filelock#761

Full Changelog: tox-dev/filelock@4.0.7...4.0.8

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.10 (2026-10-03)

---

• Reusing a singleton AsyncFileLock with another loop, executor or run_in_executor, or a singleton SoftFileLease with another lease_duration, heartbeat_interval or on_compromise, now raises ValueError instead of returning the lock with its original options. :pr:765

---

4.0.9 (2026-10-01)

---

• ReadWriteLock and AsyncReadWriteLock close the descriptor that checks the database path once SQLite has connected, so on PyPy a dropped lock leaves no descriptor open until garbage collection runs. :pr:763
• ReadWriteLock and AsyncReadWriteLock refuse a symlink at the database path instead of following it, so a user who can create names in a shared lock directory cannot point the lock at another file (GHSA-j8f7-rjxc-mr56).

---

4.0.8 (2026-10-01)

---

• ReadWriteLock.release() and SoftReadWriteLock.release() from a thread that does not hold the write lock now raise RuntimeError instead of dropping the holder's lock and letting a second writer in. :pr:761

---

4.0.7 (2026-09-29)

---

• File locks now raise ValueError at construction when mode denies the owner read or write, such as mode=0o444, instead of failing on a later acquire and staying broken until someone deletes the lock file. :pr:760

---

4.0.6 (2026-09-28)

---

• Reject negative blocking timeouts other than -1 before reentrant ReadWriteLock and SoftReadWriteLock acquisition. Preserve unlimited waits and nonblocking acquisition. :pr:756

---

4.0.5 (2026-09-28)

---

... (truncated)

Commits

• 9376e9b Release 4.0.8
• 34f4657 🐛 fix(read-write): refuse cross-thread write release (#761)
• 9ed62ac Release 4.0.7
• 2f2c4a7 🐛 fix(mode): require owner read and write (#760)
• d4ffe9c build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
• 61ce360 Release 4.0.6
• d9dedd5 [pre-commit.ci] pre-commit autoupdate (#757)
• b5fae95 fix(read-write): validate reentrant timeouts (#756)
• bbb843e Release 4.0.5
• 83fa216 test(read-write): cover omitted arguments (#754)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[YauhenBichel]

Thanks, Dependabot. The uv lock has to be regenerated for this one, so it's now part of #113, together with the other floors. Closing this one.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.