Bump the all group with 16 updates

[dependabot]

Bumps the all group with 16 updates:

Package	From	To
aiosignal	1.3.1	1.4.0
async-timeout	4.0.3	5.0.1
frozenlist	1.4.0	1.8.0
idna	3.15	3.18
multidict	6.0.4	6.7.1
yarl	1.9.4	1.24.5
ast-serialize	0.6.0	0.7.0
librt	0.13.0	0.14.0
nbformat	5.10.4	5.11.0
packaging	26.2	26.3
pip	26.2	26.2.1
platformdirs	4.11.0	4.11.1
pydantic-core	2.47.0	2.48.0
soupsieve	2.9.1	2.9.2
tornado	6.5.7	6.5.8
traitlets	5.15.1	5.16.1

Updates aiosignal from 1.3.1 to 1.4.0

Release notes

Sourced from aiosignal's releases.

1.4.0

Features

• Added decorator functionality to Signal as a convenient way to add a callback -- by @Vizonex. [#699](https://github.com/aio-libs/aiosignal/issues/699) <https://github.com/aio-libs/aiosignal/pulls/699>_

• Improved type safety by allowing callback parameters to be type checked (typing-extensions is now required for Python <3.13). Parameters for a Signal callback should now be defined like Signal[int, str] -- by @​Vizonex and @​Dreamsorcerer. [#699](https://github.com/aio-libs/aiosignal/issues/699) <https://github.com/aio-libs/aiosignal/pulls/699>, [#710](https://github.com/aio-libs/aiosignal/issues/710) <https://github.com/aio-libs/aiosignal/pulls/710>

Misc

• Removed the sphinxcontrib-asyncio documentation dependency. [#528](https://github.com/aio-libs/aiosignal/issues/528) <https://github.com/aio-libs/aiosignal/pull/528>_

---

1.3.2

Deprecations and Removals

• Dropped Python 3.7 support. (#413)

• Dropped Python 3.8 support. (#645)

Misc

• (#362)

---

Changelog

Sourced from aiosignal's changelog.

1.4.0 (2025-07-03)

Features

• Added decorator functionality to Signal as a convenient way to add a callback -- by @Vizonex. [#699](https://github.com/aio-libs/aiosignal/issues/699) <https://github.com/aio-libs/aiosignal/pulls/699>_

• Improved type safety by allowing callback parameters to be type checked (typing-extensions is now required for Python <3.13). Parameters for a Signal callback should now be defined like Signal[int, str] -- by @​Vizonex and @​Dreamsorcerer. [#699](https://github.com/aio-libs/aiosignal/issues/699) <https://github.com/aio-libs/aiosignal/pulls/699>, [#710](https://github.com/aio-libs/aiosignal/issues/710) <https://github.com/aio-libs/aiosignal/pulls/710>

Misc

• Removed the sphinxcontrib-asyncio documentation dependency. [#528](https://github.com/aio-libs/aiosignal/issues/528) <https://github.com/aio-libs/aiosignal/pull/528>_

---

1.3.2 (2024-12-13)

Deprecations and Removals

• Dropped Python 3.7 support. [#413](https://github.com/aio-libs/aiosignal/issues/413) <https://github.com/aio-libs/aiosignal/issues/413>_

• Dropped Python 3.8 support. [#645](https://github.com/aio-libs/aiosignal/issues/645) <https://github.com/aio-libs/aiosignal/issues/645>_

Misc

• [#362](https://github.com/aio-libs/aiosignal/issues/362) <https://github.com/aio-libs/aiosignal/issues/362>_

---

Commits

• 1cf8014 Fix deploy
• 892494c Release v1.4 (#718)
• fa36082 [pre-commit.ci] pre-commit autoupdate (#719)
• b7f68f1 [pre-commit.ci] pre-commit autoupdate (#717)
• 2b1acac Build(deps): Bump sigstore/gh-action-sigstore-python from 3.0.0 to 3.0.1 (#716)
• 17456ed Build(deps): Bump tox from 4.26.0 to 4.27.0 (#715)
• 4c23690 Build(deps): Bump pytest from 8.4.0 to 8.4.1 (#714)
• 7be2f68 Build(deps): Bump mypy from 1.16.0 to 1.16.1 (#713)
• 5d62945 Build(deps): Bump coverage from 7.9.0 to 7.9.1 (#712)
• a6d85c1 Build(deps): Bump dependabot/fetch-metadata from 2.3.0 to 2.4.0 (#694)
• Additional commits viewable in compare view

Updates async-timeout from 4.0.3 to 5.0.1

Release notes

Sourced from async-timeout's releases.

5.0.1

Misc

• [#423](https://github.com/aio-libs/async-timeout/issues/423) <https://github.com/aio-libs/async-timeout/issues/423>_

5.0.0

Features

• Make asyncio_timeout fully compatible with the standard asyncio.Timeout but keep backward compatibility with existing asyncio_timeout.Timeout API. ([#422](https://github.com/aio-libs/async-timeout/issues/422) <https://github.com/aio-libs/async-timeout/issues/422>_)

Improved Documentation

• On the CHANGES/README.rst <https://github.com/aio-libs/async-timeout/tree/master/CHANGES/README.rst>_ page, a link to the Towncrier philosophy has been fixed. ([#388](https://github.com/aio-libs/async-timeout/issues/388) <https://github.com/aio-libs/async-timeout/issues/388>_)

Deprecations and Removals

• Drop deprecated sync context manager support, use async with timeout(...): ... instead. ([#421](https://github.com/aio-libs/async-timeout/issues/421) <https://github.com/aio-libs/async-timeout/issues/421>_)

Changelog

Sourced from async-timeout's changelog.

5.0.1 (2024-11-06)

Misc

• [#423](https://github.com/aio-libs/async-timeout/issues/423) <https://github.com/aio-libs/async-timeout/issues/423>_

5.0.0 (2024-10-31)

Features

• Make asyncio_timeout fully compatible with the standard asyncio.Timeout but keep backward compatibility with existing asyncio_timeout.Timeout API. ([#422](https://github.com/aio-libs/async-timeout/issues/422) <https://github.com/aio-libs/async-timeout/issues/422>_)

Improved Documentation

• On the CHANGES/README.rst <https://github.com/aio-libs/async-timeout/tree/master/CHANGES/README.rst>_ page, a link to the Towncrier philosophy has been fixed. ([#388](https://github.com/aio-libs/async-timeout/issues/388) <https://github.com/aio-libs/async-timeout/issues/388>_)

Deprecations and Removals

• Drop deprecated sync context manager support, use async with timeout(...): ... instead. ([#421](https://github.com/aio-libs/async-timeout/issues/421) <https://github.com/aio-libs/async-timeout/issues/421>_)

Commits

• cc52d41 Bump to 5.0.1
• 1af7d71 Bump to 5.0.1
• 3bf26d9 Fix #423: add requirements.txt to sdist package (#425)
• 380e8ba Mention condition import of asyncio.timeout / async_timeout.timeout in README...
• 8a232d0 Update README
• 3d3e3e4 Bump to 5.0.0
• d5c21f3 Mimic asyncio.Timeout behavior (#422)
• a1111c2 Drop deprecated sync context manager support (#421)
• 00fd343 Imports cleanup
• 7b61b33 Update CI config file
• Additional commits viewable in compare view

Updates frozenlist from 1.4.0 to 1.8.0

Release notes

Sourced from frozenlist's releases.

1.8.0

Contributor-facing changes

• The :file:reusable-cibuildwheel.yml workflow has been refactored to be more generic and :file:ci-cd.yml now holds all the configuration toggles -- by :user:webknjaz.

  Related issues and pull requests on GitHub: #668.

• When building wheels, the source distribution is now passed directly to the cibuildwheel invocation -- by :user:webknjaz.

  Related issues and pull requests on GitHub: #669.

• Builds and tests have been added to ci-cd.yml for arm64 Windows wheels -- by :user:finnagin.

  Related issues and pull requests on GitHub: #677.

• Started building wheels for CPython 3.14 -- by :user:kumaraditya303.

  Related issues and pull requests on GitHub: #681, #682.

• Removed --config-settings=pure-python=false from :file:requirements/dev.txt. Developers on CPython still get accelerated builds by default. To explicitly build a pure Python wheel, use pip install -e . --config-settings=pure-python=true -- by :user:bdraco.

  Related issues and pull requests on GitHub: #687.

---

1.7.0

Features

• Added deepcopy support to FrozenList -- by :user:bdraco.

  Related issues and pull requests on GitHub: #659.

Packaging updates and notes for downstreams

... (truncated)

Changelog

Sourced from frozenlist's changelog.

v1.8.0

(2025-10-05)

Contributor-facing changes

• The :file:reusable-cibuildwheel.yml workflow has been refactored to be more generic and :file:ci-cd.yml now holds all the configuration toggles -- by :user:webknjaz.

  Related issues and pull requests on GitHub: :issue:668.

• When building wheels, the source distribution is now passed directly to the cibuildwheel invocation -- by :user:webknjaz.

  Related issues and pull requests on GitHub: :issue:669.

• Builds and tests have been added to ci-cd.yml for arm64 Windows wheels -- by :user:finnagin.

  Related issues and pull requests on GitHub: :issue:677.

• Started building wheels for CPython 3.14 -- by :user:kumaraditya303.

  Related issues and pull requests on GitHub: :issue:681, :issue:682.

• Removed --config-settings=pure-python=false from :file:requirements/dev.txt. Developers on CPython still get accelerated builds by default. To explicitly build a pure Python wheel, use pip install -e . --config-settings=pure-python=true -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:687.

---

v1.7.0

(2025-06-09)

... (truncated)

Commits

• 48324af Release 1.8.0 (#698)
• 7e5eab0 Add windows arm64 support (#678)
• a2c22c2 Build(deps): Bump sphinx from 7.2.6 to 7.4.7 (#691)
• 752b80a Build(deps): Bump types-setuptools from 75.8.0.20250210 to 80.9.0.20250822 (#...
• 6b9d557 Build(deps): Bump cython from 3.1.1 to 3.1.4 (#690)
• 7c4ad20 Build(deps-dev): Bump tox from 4.11.4 to 4.30.3 (#693)
• 65f35d6 Build(deps): Bump pre-commit from 3.5.0 to 4.3.0 (#697)
• 1ad0263 Build(deps): Bump pytest from 7.4.3 to 8.4.2 (#694)
• 884ee49 Build(deps): Bump aiohttp-theme from 0.1.6 to 0.1.7 (#689)
• b2d6180 Fix dependabot updates (#687)
• Additional commits viewable in compare view

Updates idna from 3.15 to 3.18

Changelog

Sourced from idna's changelog.

3.18 (2026-06-02)

• When decoding a domain, add a display argument that will pass through invalid labels rather than raising an exception.

3.17 (2026-05-28)

• Substantial 75% reduction in memory usage through new data structures and some optimization in processing speed.
• Added a general 1024-character input length cap to the public validation, conversion, and codec entry points. This is well above any legitimate domain or label and guards against pathological inputs.

3.16 (2026-05-22)

• Add a command-line interface (python -m idna, also available as the idna script). Encodes or decodes one or more domains supplied as arguments or on standard input, with options to select A-label or U-label output and control error handling.
• Raise the minimum supported Python version to 3.9
• Various code quality improvements

Commits

• f39ea90 Release 3.18
• 40f4e40 Pre-release 3.18rc0
• 1a5bf80 Merge pull request #253 from kjd/lenient-decode
• 5bbb26f Merge branch 'master' into lenient-decode
• c532bae Rename decode() lenient= option to display= (issue #248)
• 0b1758b Merge pull request #252 from kjd/release-3.17
• f48619c Release 3.17
• 7421ba8 Pre-release 3.17rc0
• 22ebb73 Merge pull request #251 from kjd/structure-optimizations
• 2a7ac0a Drop redundant parallel-arrays comment from uts46data
• Additional commits viewable in compare view

Updates multidict from 6.0.4 to 6.7.1

Release notes

Sourced from multidict's releases.

6.7.1

Bug fixes

• Fixed slow memory leak caused by identity by adding Py_DECREF to identity value before leaving md_pop_one on success -- by :user:Vizonex.

  Related issues and pull requests on GitHub: #1284.

---

6.7.0

Contributor-facing changes

• Updated tests and added CI for CPython 3.14 -- by :user:kumaraditya303.

  Related issues and pull requests on GitHub: #1235.

---

6.6.4

Bug fixes

• Fixed MutliDict & CIMultiDict memory leak when deleting values or clearing them -- by :user:Vizonex

  Related issues and pull requests on GitHub: #1233.

Contributor-facing changes

• The type preciseness coverage report generated by MyPy <https://mypy-lang.org>__ is now uploaded to Coveralls <https://coveralls.io/github/aio-libs/multidict>__ and will not be included in the Codecov views <https://app.codecov.io/gh/aio-libs/multidict>__ going forward -- by :user:webknjaz.

  Related issues and pull requests on GitHub: #1122, #1231.

• Added memory leak test for popping or deleting attributes from a multidict to prevent future issues or bogus claims.

... (truncated)

Changelog

Sourced from multidict's changelog.

6.7.1

(2026-01-25)

Bug fixes

• Fixed slow memory leak caused by identity by adding Py_DECREF to identity value before leaving md_pop_one on success -- by :user:Vizonex.

  Related issues and pull requests on GitHub: :issue:1284.

---

6.7.0

(2025-10-05)

Contributor-facing changes

• Updated tests and added CI for CPython 3.14 -- by :user:kumaraditya303.

  Related issues and pull requests on GitHub: :issue:1235.

---

6.6.4

(2025-08-11)

Bug fixes

• Fixed MutliDict & CIMultiDict memory leak when deleting values or clearing them -- by :user:Vizonex

  Related issues and pull requests on GitHub:

... (truncated)

Commits

• 39d3c32 Release 6.7.1 (#1289)
• 77bb95e Fix memory leak caused by identity when default value is inplace (#1284)
• 87dd4a4 Bump dependabot/fetch-metadata from 2.4.0 to 2.5.0 (#1287)
• 6c76412 Bump actions/cache from 4 to 5 (#1275)
• b91a033 Bump actions/upload-artifact from 4 to 6 (#1277)
• 84bf82c Bump psutil from 7.1.3 to 7.2.1 (#1279)
• 3f7b3ce Bump pypa/cibuildwheel from 3.3.0 to 3.3.1 (#1280)
• bbae902 Bump sigstore/gh-action-sigstore-python from 3.1.0 to 3.2.0 (#1274)
• 000b5b0 Remove follow_untyped_imports for mypy-sphinx (#1286)
• 3d2d630 Bump actions/download-artifact from 6 to 7 (#1276)
• Additional commits viewable in compare view

Updates yarl from 1.9.4 to 1.24.5

Release notes

Sourced from yarl's releases.

1.24.5

[!IMPORTANT] The v1.24.3 and v1.24.4 releases never published: their wheel builds failed on the emulated odd architectures, so no packages reached PyPI and no GitHub release was created for either version. No changes were lost; everything intended for v1.24.3 and v1.24.4 shipped in v1.24.5. Their changelog entries are reproduced below.

---

Contributor-facing changes

• Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

  Related issues and pull requests on GitHub: #1806.

---

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

• Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

  Related issues and pull requests on GitHub: #1804.

---

v1.24.3

(2026-07-19)

Bug fixes

... (truncated)

Changelog

Sourced from yarl's changelog.

v1.24.5

(2026-07-19)

Contributor-facing changes

• Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1806.

---

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

• Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1804.

---

v1.24.3

(2026-07-19)

... (truncated)

Commits

• 0b30cb0 Release 1.24.5 (#1807)
• 56150c8 Run the IDNA sweep test only on native Linux x86_64 (#1806)
• 515adca Release 1.24.4 (#1805)
• ab5dec2 Do not install hypothesis in the wheel-build test env (#1804)
• f9d10fb Release 1.24.3 (#1803)
• 058b7cb Test lone surrogate handling in encoded and parsed URL paths (#991)
• a181cee Update hypothesis requirement from >=6.156.4 to >=6.157.0 in /requirements (#...
• 28c1bcc Encode scheme-shaped path colon in relative-path builders (#1802)
• 51e2802 Reject hosts with Unicode default-ignorable code points (#1801)
• 3921a73 Drop lone surrogates that split a percent escape in the Cython quoter (#1752)
• Additional commits viewable in compare view

Updates ast-serialize from 0.6.0 to 0.7.0

Commits

• 74193f3 Bump version to 0.7.0
• 5b7276c Minor update after adding wheels for Python 3.15 (#73)
• 49e34a5 Vendor Ruff crates (#70)
• fbca1af Build musllinux wheels for ppc64le and riscv64 (#72)
• c2db11c Build wheels for Python 3.15 (#71)
• See full diff in compare view

Updates librt from 0.13.0 to 0.14.0

Commits

• 3c133fa Sync mypy and bump version
• c963cc9 Build wheels for Python 3.15 (#43)
• See full diff in compare view

Updates nbformat from 5.10.4 to 5.11.0

Changelog

Sourced from nbformat's changelog.

5.11.0

(Full Changelog)

Enhancements made

• Add context manager support to NotebookNotary #436 (@​Carreau)

Maintenance and upkeep improvements

• Add GitHub Actions security auditing with zizmor #444 (@​Carreau, @​claude)
• chore: update pre-commit hooks #443 (@​Carreau, @​claude)
• Fix validators cache key type annotation #440 (@​Carreau, @​claude)
• Refactor validation to separate deprecated kwarg handling #439 (@​Carreau, @​claude)
• Bump pre-commit hook pins and fix resulting lint/typing fallout #438 (@​Carreau, @​claude)
• Add Python 3.14 to CI #437 (@​Carreau, @​claude)
• Bump actions/checkout from 5 to 6 in the actions group #422 (@​Carreau)
• chore: update pre-commit hooks #421 (@​Carreau)
• Make security deprecated slow to nudge people #418 (@​Carreau)
• bump pre-commit #417 (@​Carreau)
• Drop 3.8, CI does not work on 3.8 #416 (@​Carreau)
• Bump the actions group across 1 directory with 2 updates #414 (@​Carreau)
• Add security.md #411 (@​Carreau, @​jasongrout)
• Drop pep440 dependency #408 (@​LecrisUT, @​Carreau)
• chore: update pre-commit hooks #401 (@​blink1073)

Documentation improvements

• Use intersphinx_registry for intersphinx_mapping #415 (@​Carreau)

Other merged PRs

• Remove deprecated kwargs from validate() function #447 (@​Carreau, @​claude)
• Bump github/codeql-action from 4 to 4.37.3 in the actions group #446 (@​Carreau)
• Remove enforce-label workflow #445 (@​Carreau, @​claude)
• Bump the actions group with 2 updates #441 (@​Carreau)
• fix typo with quotes in docs #409 (@​crypdick, @​Carreau)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​blink1073 (activity) | @​Carreau (activity) | @​claude (activity) | @​crypdick (activity) | @​jasongrout (activity) | @​LecrisUT (activity) | @​rgbkrk (activity)

Commits

• 8e973f5 Publish 5.11.0
• 434f6ca chore: update pre-commit hooks
• 813fcfe Remove deprecated repair_duplicate_cell_ids/strip_invalid_metadata kwargs fro...
• 1cf0b65 Bump github/codeql-action from 4 to 4.37.3 in the actions group
• 0d3c9a3 chore: update pre-commit hooks
• 58940d6 Add zizmor GitHub Actions auditing and fix its findings
• 369a741 Remove the enforce PR label workflow
• f3c331c Add context manager support to NotebookNotary
• 31c6067 Bump the actions group with 2 updates
• 580da52 Fix validators cache key type annotation
• Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates pip from 26.2 to 26.2.1

Changelog

Sourced from pip's changelog.

26.2.1 (2026-08-04)

Bug Fixes

• Reallow keyring installed in a (non-activated) virtual environment to be be used via the import provider method while installing build dependencies. ([#14227](https://github.com/pypa/pip/issues/14227) <https://github.com/pypa/pip/issues/14227>_)

Commits

• 634a6ec Bump for release
• ae2eb4f Revert build dependency installer isolation for legacy build environment (#14...
• 6236392 Merge pull request #14213 from pypa/release/26.2
• da4b2cc Bump for development
• See full diff in compare view

Updates platformdirs from 4.11.0 to 4.11.1

Release notes

Sourced from platformdirs's releases.

4.11.1

What's Changed

• Let the non-ctypes resolvers find the desktop folder by @​darrenhuai in tox-dev/platformdirs#519

New Contributors

• @​darrenhuai made their first contribution in tox-dev/platformdirs#519

Full Changelog: tox-dev/platformdirs@4.11.0...4.11.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.1 (2026-08-07)

---

• Fix :func:~platformdirs.user_desktop_dir on Windows builds without ctypes. CSIDL_DESKTOPDIRECTORY appeared only in the ctypes lookup table, so the registry and environment variable resolvers raised ValueError for it. :pr:519

---

4.11.0 (2026-07-21)

---

• Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

---

4.10.1 (2026-07-18)

---

• Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

---

4.10.0 (2026-05-28)

---

• Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
• Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
• Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

---

4.9.6 (2026-04-09)

---

• Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen
• Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

---

4.9.4 (2026-03-05)

... (truncated)

Commits

• a9f2ba9 Release 4.11.1
• 30a9549 Let the non-ctypes resolvers find the desktop folder (#519)
• cc97359 build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the al...
• 328e15d [pre-commit.ci] pre-commit autoupdate (#517)
• 76fd346 build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 in the all group (#516)
• 13a531d [pre-commit.ci] pre-commit autoupdate (