deps: bump the python-dependencies group with 2 updates

[dependabot]

Bumps the python-dependencies group with 2 updates: hatchling and vcs-versioning.

Updates hatchling from 1.32.0 to 1.32.3

Release notes

Sourced from hatchling's releases.

Hatchling v1.32.3

Fixed:

• Preserve the version string exactly as written in core metadata, so stylized versions such as CalVer 2026.08.10 are no longer stripped of leading zeros. Distribution file names and .dist-info directories continue to use the PEP 440 normalized form.

Commits

• 0941887 release Hatchling v1.32.3 (#2436)
• 6a2b14f release Hatchling v1.32.2 (#2434)
• 081013f Hatchling 1.32.2 release (#2433)
• 248141c Use hatchling plugin manager (#2432)
• 4b17561 release Hatch v1.18.1 (#2426)
• b6aaa1a release Hatchling v1.32.1 (#2425)
• 47f333a Prepare for hatch and hatchling releases (#2424)
• d5f7bfe Fix version metadata to preserve leading zeros in CalVer (#2398)
• cbfc465 Context formatting support for lock-filename (#2412)
• 929362c Mark a few more tests that require Internet access (#2400)
• Additional commits viewable in compare view

Updates vcs-versioning from 2.3.4 to 2.4.1

Release notes

Sourced from vcs-versioning's releases.

vcs-versioning v2.4.1

Fixed

• The error raised when a .jj/ directory is found but jj is not installed now names the environment variables that actually disable jj discovery (SETUPTOOLS_SCM_DISABLE_JJ=1 / VCS_VERSIONING_DISABLE_JJ=1) instead of an unprefixed DISABLE_JJ=1, which was never read. (#1537)

• The "unable to detect version" error now names the environment variables the running integration actually reads. It previously suggested SETUPTOOLS_SCM_PRETEND_VERSION_FOR_${NORMALIZED_DIST_NAME} unconditionally, which is not read by vcs-versioning on its own (or by any other integrator), and it named setuptools-scm as the failing tool regardless of which one ran.

  When the distribution name is known the suggested variable is spelled out in full. When it is not, the generic variables are suggested instead, with a note that the per-distribution ..._FOR_<DIST> form needs a dist name to match -- the previous message offered a ${NORMALIZED_DIST_NAME} template that could never be filled in. (#1539)

• Warn when file discovery is suppressed while a VCS marker sits in the project directory. scm_search_known_failed() means an integrator already looked and found no checkout, so a .git, .hg or .jj right there contradicts it and the artifact is about to lose every tracked file. That combination was the signature of the pretend-version regression and stayed invisible for three releases. Parent directories are not searched, since an unpacked sdist inside an unrelated checkout is the case the suppression exists for, and roots listed in IGNORE_VCS_ROOTS are skipped. (#1540)

Miscellaneous

• Environment variable names are now built in one place (env_var_name / EnvReader.candidate_names), shared by the lookup in EnvReader.read and by every error message that suggests a variable, so a message cannot name a variable the lookup would not honour.

  The "repository found in a parent directory" error no longer offers a get_version(relative_to=...) call to integrators that do not ship one; the remaining options are renumbered instead. (#1539)

vcs-versioning v2.4.0

Added

• Add scm.git.distance_scope and scm.git.distance_count, restricting the distance count to the commits that touch a monorepo project (and optionally further shared directories) instead of every commit in the repository. Counting uses --full-history by default, or --first-parent; git's default history simplification is not offered because it can make the distance shrink across a merge. Git only. (#1056)

Fixed

• Select file finders by the VCS marker their entry point is named for (.git, .hg, .jj) instead of running every backend's command in turn. A tree with no VCS marker -- an unpacked sdist, say -- now spawns no subprocess at all, so a slow hg on PATH can no longer fail an unrelated build.

  The finders also survive a subprocess timeout: subprocess.TimeoutExpired was uncaught and aborted the build, and is now treated like any other failed probe. (#1212)

• Prefer the fallback metadata nearest the project directory. A .git_archival.txt or PKG-INFO at the VCS root no longer shadows a monorepo project's own, which silently produced the root project's version. (#1522)

Commits

• 41edffe Merge pull request #1538 from pypa/release/main
• 850dfec Prepare release: setuptools-scm v10.3.3, vcs-versioning v2.4.1
• 74463ee Merge pull request #1541 from RonnyPfannschmidt/fix/pretend-version-keeps-fil...
• d447d74 Merge pull request #1539 from RonnyPfannschmidt/fix/error-messages-name-real-...
• de73860 feat(file-finders): warn when suppression contradicts a present marker
• 6f131a8 fix(setuptools): discover the workdir on demand, not never
• a093579 chore: number the changelog fragments after the PR
• 9e863d8 fix: only offer advice the running integration can act on
• 78e3451 fix: name the running tool and its real env vars when no version is found
• 79d0f18 refactor: build env var names in exactly one place
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.