[dependabot]

Updates the requirements on setuptools, sentence-transformers, transformers, pytest, pytest-asyncio, ruff, pip-audit, build, twine and pymdown-extensions to permit the latest version.
Updates setuptools to 84.0.0

Changelog

Sourced from setuptools's changelog.

v84.0.0

Features

• Newline-separated keywords and platformspypa/setuptools#4887old specification <https://peps.python.org/pep-0345/>_ separated items with spaces and the current one uses commas. (#4887)
• Extensionpypa/distutils#373#5022)
• The C compiler modules now emit log messages through their own compilers.C.* loggers instead of the distutils root logger, part of decoupling the compilers package from distutils. The logger names are normalized to a stable compilers.C.* prefix so they remain constant as the package migrates toward a standalone compilers.C distribution. (#5266)
• The C compilers gained a Compiler.call method -- a thin wrapper over subprocess.check_call (with macOS deployment-target env injection) that is the modern replacement for Compiler.spawn. The compilers no longer depend on distutils.spawn, distutils.dir_util, distutils.file_util, distutils._modified, or distutils.util.execute/split_quoted: the generic newer/newer_group and split_quoted helpers are vendored into the compilers package, and Compiler.mkpath/move_file/execute are implemented directly on the standard library (os.makedirs/shutil.move). The methods are retained for backward compatibility. (#5267)
• The compilers no longer depend on distutils.util, distutils.version, distutils.compat, or distutils._macos_compat. The platform-identification helpers (get_platform/get_host_platform/is_mingw) now live in distutils.compilers.platform.detect and the macOS deployment-target logic and compiler_fixup in distutils.compilers.platform.macos; CygwinCCompiler.gcc_version returns a packaging.version.Version. distutils.util re-exports the platform/macOS helpers from their new homes for backward compatibility rather than keeping duplicate copies. (sysconfig lookups still route through distutils pending its own decoupling.) (#5268)
• The compilers now read their build configuration from the standard library's sysconfig instead of distutils.sysconfig. Per-compiler customization -- previously distutils.sysconfig.customize_compiler -- has moved into Compiler.configure_system(): a no-op on the base class, with UnixCCompiler applying the compiler/flag/archiver settings CPython recorded in sysconfig (and the usual CC/CFLAGS/LDSHARED/… environment overrides). distutils.sysconfig.customize_compiler is retained as a thin wrapper that calls compiler.configure_system(). (#5269)

Bugfixes

• The MSVC linker now passes its arguments through a response file when the command line would exceed the Windows maximum length, fixing failures when linking a large number of objects. (#4177)
• The Cygwin and MinGW compilers now pass -O1 instead of a bare -O. The two are equivalent to GCC, but cc1 rejected the bare form when building 32-bit extensions with -m32. -- by :user:dchaudhari7177 (#4873)
• copy_filepypa/distutils#379#5079)
• Setuptools wheels no longer bundled the project's own test modules. -- by :user:itscloud0 (#5212)
• build_ext no longer fails when cross-compiling with a compiler other than MSVC (such as MinGW). Compiler now provides a no-op initialize()pypa/distutils#399

Improved Documentation

• Clarified what "correspond exactly to the directory structure" means in the packages section of the Package Discovery user guide. (#4109)
• Documented how bdist_wheel's py_limited_api option controls abi3 wheel tagging for extension modules -- by :user:Himanshuagrawal4 (#4741)

Deprecations and Removals

• Compiler.spawn is deprecated in favor of the new Compiler.call. call raises native subprocess exceptions; spawn remains as a shim that emits a DeprecationWarning and translates them to DistutilsExecError. The MSVC spawn compatibility shim for third-party monkeypatches predating the env argument (numpy.distutils before 1.19, per pypa/distutils#15) has been removed. distutils.spawn.spawn is likewise reduced to a thin wrapper around subprocess.check_call: it no longer resolves cmd[0] via shutil.which (subprocess searches PATH itself) nor injects MACOSX_DEPLOYMENT_TARGET (that now lives with the compilers, the only callers to which it applied). (#5267)
• Building an extension with a MACOSX_DEPLOYMENT_TARGET lower than the interpreter's configured value now raises compilers.errors.PlatformError instead of distutils.errors.DistutilsPlatformError (the macOS deployment-target check moved into the compilers package). CygwinCCompiler.gcc_version returns a packaging.version.Version rather than the removed distutils.version.LooseVersion. Completing the transition begun in pypa/distutils#246, UnixCCompiler.runtime_library_dir_option now returns the ["-Wl,--enable-new-dtags", "-Wl,-rpath,<dir>"] list directly for GNU ld rather than collapsing it into a single string, and the temporary distutils.compat.consolidate_linker_args shim has been removed. (#5268)
• The compilers now define their own exception vocabulary instead of borrowing distutils' framework errors. Language-agnostic exceptions (Error, UnknownFileType, and a new PlatformError) live at distutils.compilers.errors, leaving room for future compilers.<language> siblings; the C/C++-specific CompileError/LinkError/LibError/PreprocessError remain in distutils.compilers.C.errors. The compilers now raise compilers.errors.PlatformError where they previously raised distutils.errors.DistutilsPlatformError/DistutilsModuleError, and compilers._modified.newer raises the stdlib FileNotFoundError. distutils.errors keeps its own framework exceptions and re-exports the compiler ones (CCompilerError, CompileError, etc.) for backward compatibility; because CCompilerError is compilers.errors.Error, code catching it (as distutils' top-level handlers do) still catches the new PlatformError. (#5270)
• customize_compiler now asserts that the compiler-related config variables (CC, CXX, CFLAGS, etc.) resolve to strings, raising AssertionError if any are unexpectedly Nonepypa/distutils#363

v83.0.0

Features

• Require Python 3.10 or later.

... (truncated)

Commits

• 72e919a Merge pull request #5293 from pypa/bugfix/integration-pip-flit-backend
• 1b29701 Select the top-level pyproject.toml when reading build requirements
• bb1b381 Bump version: 83.0.0 → 84.0.0
• ee6fdd7 Sync with distutils @ e8eb87855 (#5292)
• 2a4a9e4 Merge remote-tracking branch 'origin/main' into distutils-e8eb87855
• cbd1195 Merge https://github.com/jaraco/skeleton
• bd3594e Merge pull request #5287 from Avasam/Configuring-lint.flake8-comprehensions.a...
• f02e90a Configure C408 to allow dict(a=1) rather than disabling it
• c55f52b Configuring lint.flake8-comprehensions.allow-dict-calls-with-keyword-argument...
• e9904b0 Match the distutils sdist base type for the user_options override
• Additional commits viewable in compare view

Updates sentence-transformers to 6.0.1

Release notes

Sourced from sentence-transformers's releases.

v6.0.1 - Restore the PyLate prefix on prompted checkpoints, 80 documented multi-vector models

This patch release fixes a multi-vector loading bug: PyLate checkpoints that carry both a [Q]/[D] prefix and a text prompt lost the prefix, so they were encoded without a marker they were trained with. It also grows the documented multi-vector model tables from 51 checkpoints to 80.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==6.0.1
Inference only, use one of:
pip install sentence-transformers==6.0.1
pip install sentence-transformers[onnx-gpu]==6.0.1
pip install sentence-transformers[onnx]==6.0.1
pip install sentence-transformers[openvino]==6.0.1
Multimodal dependencies (optional):
pip install sentence-transformers[image]==6.0.1
pip install sentence-transformers[audio]==6.0.1
pip install sentence-transformers[video]==6.0.1
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==6.0.1

Compose the PyLate prefix with the saved prompt (#3968)

PyLate supports a prefix as well as prompt text, and Sentence Transformers assumed that these were mutually exclusive. However, the following three checkpoints carry both a prefix and a prompt, and were trained with the prefix prepended to the prompt text:

• lightonai/ColBERT-Zero
• lightonai/ColBERT-Zero-unsupervised
• lightonai/ColBERT-Zero-supervised

PyLate trained these checkpoints on [CLS] [Q] search_query: ... and [CLS] [D] search_document: ..., but Sentence Transformers dropped the prefix and encoded them as [CLS] search_query: ... and [CLS] search_document: .... After the fix, the performance of the ColBERT-Zero model improved from 0.6569 NDCG@10 to 0.6824 on the NanoBEIR benchmark. To my knowledge, only these 3 checkpoints used both a prefix and a prompt, so this is the only case where the bug would have affected you.

Forward task to routed modules in Router.preprocess (#3967)

Router.forward has always passed task down to the routed module, but Router.preprocess did not, so anything a module does with the task at preprocessing time did nothing behind a Router: query_length and document_length caps, query_expansion, and the chat-template task keyword. No released checkpoint combines a Router with those settings, so this is a latent bug rather than one you are likely to have hit. It would have affected anyone building such a model themselves, with no error to indicate it.

Documentation

• The multi-vector pretrained models tables grew from 29 text and 22 visual document retrieval checkpoints to 38 and 42 (#3963, #3969), with revision and trust_remote_code notes refreshed as upstream pull requests merged (#3972).
• Documented which Hub tag to filter on for each model type (#3964), and linked the Multi-Vector Encoder blogposts from the docs (#3966).
• Added MultiVectorEncoder to the Agent Skill README and refreshed the SauerkrautLM scores (#3955).
• Corrected the minimum versions in the README (#3952). It still recommended PyTorch 1.11.0+ and transformers v4.41.0+, where v6.0 requires PyTorch 2.2+ and transformers v5.0+. This is the text rendered as the PyPI project description.

All Changes

• docs: Add MultiVectorEncoder to the skills README, refresh the SauerkrautLM scores by @​tomaarsen in huggingface/sentence-transformers#3955
• Fix the README dependency versions by @​tomaarsen in huggingface/sentence-transformers#3952
• [docs] Add more MultiVectorEncoder models to the pretrained models tables by @​tomaarsen in huggingface/sentence-transformers#3963
• [docs] Clarify which Hub tags to filter on for each model type by @​tomaarsen in huggingface/sentence-transformers#3964
• [docs] Link the Multi-Vector Encoder blogposts by @​tomaarsen in huggingface/sentence-transformers#3966

... (truncated)

Commits

• b0acd1a Update README installation versions
• 9b415ac Release v6.0.1
• cc0669c Add/update revisions for pretrained MVE models (#3972)
• f8390f4 [docs] Refresh the MultiVectorEncoder pretrained models tables (#3969)
• 4b51722 [fix] Compose the PyLate prefix with the saved prompt (#3968)
• e99c4a9 [fix] Forward task to routed modules in Router.preprocess (#3967)
• 5d2ec93 [docs] Link the Multi-Vector Encoder blogposts (#3966)
• 9c5de2a [docs] Clarify which Hub tags to filter on for each model type (#3964)
• 83680bd [docs] Add more MultiVectorEncoder models to the pretrained models tables (#3...
• 1a43278 docs: Add MultiVectorEncoder to the skills README, refresh the SauerkrautLM s...
• Additional commits viewable in compare view

Updates transformers to 5.17.0

Release notes

Sourced from transformers's releases.

Release 5.17.0

Release v5.17.0

New Model additions

HYV4

Hy4-Preview is a 780B-parameter mixture-of-experts language model that activates 49B parameters per token. Each MoE layer holds 256 routed experts plus one always-active shared expert and routes every token to 8 of them. The context window is 1M tokens.

The architecture combines four features:

• Multi-head Latent Attention (MLA) compresses keys and values into a low-rank latent (kv_lora_rank) that kv_b_proj expands back to one key/value per query head.
• DeepSeek Sparse Attention (DSA) selects index_topk keys per query with a lightweight indexer. Following IndexShare, only the layers marked "full" in indexer_types run an indexer; "shared" layers reuse the previous full layer's selection.
• Gated MLA with learnable attention sinks, where each head owns a sink logit that participates in the softmax and contributes no value, as in GPT-OSS.
• Independent Hyper-Connections (iHC) replace the plain residual path with hc_mult parallel residual streams that are collapsed before, and redistributed after, every sublayer.

The implementation does not execute the multi-token prediction (MTP) layers. Released checkpoints keep those weights so that other runtimes can use them for speculative decoding; they are ignored at load time.

Links: Documentation

• Add h4 (#48473) by @​ArthurZucker in #48473

VibeVoice

VibeVoice is a novel framework for synthesizing high-fidelity, long-form speech with multiple speakers by employing a next-token diffusion approach within a Large Language Model (LLM) structure. It's designed to capture the authentic conversational "vibe" and is particularly suited for generating audio content like podcasts and multi-participant audiobooks.

Links: Documentation

• Implement VibeVoice (#40546) by @​pengzhiliang in #40546

NeoMME

NeoMME is a family of efficient 260M and 800M parameter multimodal-native multilingual foundation encoders from H Company. It processes multilingual text tokens and raw image patches in a single bidirectional Transformer encoder, without a separately pretrained vision tower or causal language model.

NeoMME-Retriever is a model fine-tuned from the NeoMME backbone for visual document retrieval with joint late-interaction and dense objectives. It takes text queries and documents (text or page screenshots) and produces multi-vector embeddings for MeanMaxSim scoring (late-interaction) and mean-pooled embeddings for cosine similarity (dense).

Links: Documentation

... (truncated)

Commits

• 856157a v5.17.0
• 5b7dcb0 MRoPE continued (#48594)
• 50bbcc6 [fix] Update stale expected strings in HunYuanVL integration tests (#48646)
• e8bcd79 [Quantizaiton]support 5/6/7 bits in AutoRound (#48481)
• 3283d5f [fix] Update stale golden values and fix expected_logits shape in FlavaForPre...
• 5f47b5a [tests] Fix integration test golden values broken by fast image processor def...
• fc50134 Add Fun-ASR-Nano model (#46180)
• d9fe823 Fix YOLOS device mismatch with device_map="auto" (#46886)
• cbc1651 [Generate] Avoid unconditionally downloading remote hub file (#48620)
• bd05a4b Honor shift_labels in decoder-only LLM/VLM losses (#48493)
• Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates pytest-asyncio to 1.4.0

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.0

1.4.0 - 2026-05-26

Deprecated

• Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

• Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

  The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged.

  Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

• Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)
• Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)
• Updated minimum supported pytest version to v8.4.0. (#1397)

Fixed

• Fixed a ResourceWarning: unclosed event loop warning that could occur when a synchronous test called asyncio.run() or otherwise unset the current event loop after pytest-asyncio had run an async test or fixture. (#724)

Notes for Downstream Packagers

• Added dependency on sphinx-tabs >= 3.5 to organize documentation examples into tabs. (#1395)

Commits

• 6e14cd2 chore: Prepare release of v1.4.0.
• 4b900fb Build(deps): Bump codecov/codecov-action from 6.0.0 to 6.0.1
• ab9f632 Build(deps): Bump zipp from 3.23.1 to 4.1.0
• a56fc77 Build(deps): Bump hypothesis from 6.152.6 to 6.152.8
• e8bae9b Build(deps): Bump requests from 2.34.0 to 2.34.2
• fc43340 Build(deps): Bump idna from 3.14 to 3.15
• 762eaf5 Build(deps): Bump jaraco-functools from 4.4.0 to 4.5.0
• b62e222 Build(deps): Bump click from 8.3.3 to 8.4.0
• 9190447 Build(deps): Bump pydantic from 2.13.3 to 2.13.4
• 82a393c ci: Remove unnecessary debug output.
• Additional commits viewable in compare view

Updates ruff to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits

• 62914c4 Bump version to 0.16.8 (#28648)
• c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
• ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
• 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
• 50020fb [ty] Avoid storing constraint nodes twice (#28375)
• 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
• 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
• d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
• fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
• 31131db [ty] Support type[A & B] (#27124)
• Additional commits viewable in compare view

Updates pip-audit to 2.10.1

Release notes

Sourced from pip-audit's releases.

v2.10.1

Fixed

• Fixed a KeyError crash when an OSV vulnerability record contains an affected entry that omits the optional ranges field (#1046)

Changelog

Sourced from pip-audit's changelog.

[2.10.1]

Fixed

• Fixed a KeyError crash when an OSV vulnerability record contains an affected entry that omits the optional ranges field (#1046)

[2.10.0]

Added

• pip-audit now supports the --osv-url URL flag, which can be used to retrieve vulnerabilities from a custom OSV service. This is useful for organizations that host their own mirror of the OSV database, or that have custom OSV records (#810)

• pip-audit now supports the Ecosyste.ms vulnerability service with --vulnerability-service=esms (#903).

Changed

• The minimum version of Python is now 3.10 (#905)

Fixed

• Fixed a bug where pip-audit would fail to parse pyproject.toml files containing TOML 1.0.0 features (#910)

• CycloneDX JSON/XML output now correctly links vulnerabilities to their affected components via the affects field (#980)

[2.9.0]

Added

• pip-audit now supports PEP 751 lockfiles. These lockfiles can be audited in "project" mode by passing --locked to pip-audit (#888)

[2.8.0]

Added

... (truncated)

Commits

• 8894eb8 Merge pull request #1056 from pypa/copilot/release-2101
• 1c625b7 Update version in README.md to 2.10.1
• fd2094b Prep 2.10.1 release
• 58d2488 build(deps): bump github/codeql-action from 4.35.2 to 4.36.1 (#1052)
• 8df9420 build(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (#1044)
• 3f618d3 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1053)
• 4849132 Restrict OIDC token to publish job (#1050)
• c1eb69a Fix KeyError when OSV affected entry omits optional ranges field (#1046)
• 68de07f Merge pull request #1054 from pypa/fix/1047
• ef31c9e Formatting fixes
• Additional commits viewable in compare view

Updates build to 1.6.1

Release notes

Sourced from build's releases.

1.6.1

What's Changed

• chore[v1]: prepare for v1.6.1 by @​henryiii in pypa/build#1181

Full Changelog: pypa/build@1.6.0...1.6.1

Changelog

Sourced from build's changelog.

#################### 1.6.1 (2026-09-10) ####################

---

Bugfixes

---

• Avoid trying to detect symlinks on Windows, regression in 1.6.0 - by :user:henryiii (:issue:1175) (:issue:1175)

---

Documentation

---

• Fix doubled backslashes in the Windows pip config path (%APPDATA%\pip\pip.ini) in the docs - by :user:aroh3006 (:issue:1149)

---

Miscellaneous

---

• :issue:1168, :issue:1170, :issue:1178

#################### 1.6.0 (2026-08-27) ####################

---

Features

---

• Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
• The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
• The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
• Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
• Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
  • by :user:gaborbernat (:issue:655)
• Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
• On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

---

Bugfixes

---

... (truncated)

Commits

• 89cccef chore: prepare for 1.6.1
• a6f707a ci: support releases from v* branches (#1178)
• 7785161 docs: fix doubled backslashes in Windows pip config path (#1149)
• 244b250 fix: always use copies for the isolated venv on Windows (#1176)
• c93ca6f build(deps): bump re-actors/alls-green from 1.2.2 to 1.3.0 in the github-acti...
• e02ffd3 pre-commit: bump repositories (#1173)
• aad39a8 docs: fix changelog page heading levels and sidebar (#1171)
• 5c3fd46 docs: use PyPI ref directly (#1172)
• 1c5bd6c 🐛 fix(release): format generated changelog (#1170)
• 7f0cc7e 🔧 build(type): replace mypy with pyrefly (#1168)
• Additional commits viewable in compare view

Updates twine to 7.0.0

Changelog

Sourced from twine's changelog.

twine 7.0.0 (2026-07-27)

Bugfixes ^^^^^^^^

• Specify UTF-8 encoding when reading .pypirc files. ([#1268](https://github.com/pypa/twine/issues/1268) <https://github.com/pypa/twine/issues/1268>_)
• Add missing subdependencies to --version output. ([#1275](https://github.com/pypa/twine/issues/1275) <https://github.com/pypa/twine/issues/1275>_)
• The dependency on rich has been bumped to avoid a hang in some environments. ([#1308](https://github.com/pypa/twine/issues/1308) <https://github.com/pypa/twine/issues/1308>_)
• Indices that respond with non-standard HTTP codes are now handled more gracefully. ([#1309](https://github.com/pypa/twine/issues/1309) <https://github.com/pypa/twine/issues/1309>_)

Deprecations and Removals ^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix uploading packages with metadata version 2.5. The fix no longer allows metadata version 2.0, which was never officially standardised. ([#1317](https://github.com/pypa/twine/issues/1317) <https://github.com/pypa/twine/issues/1317>_)

Misc ^^^^

• [#1298](https://github.com/pypa/twine/issues/1298) <https://github.com/pypa/twine/issues/1298>_

twine 6.2.0 (2025-09-04)

Features ^^^^^^^^

• Automatically refresh short-lived PyPI token in long running Trusted Publishing uploads.

  In the event that a trusted publishing upload job is taking longer than the validity period of a trusted publishing token (15 minutes at the time of this writing), and we are already 10 minutes into that validity period, we will begin to attempt to replace the token on each subsequent request. ([#1246](https://github.com/pypa/twine/issues/1246) <https://github.com/pypa/twine/issues/1246>_)

Bugfixes ^^^^^^^^

• Fix compatibility kludge for invalid License-File metadata entries emitted by build backends to work also with packaging version 24.0. ([#1217](https://github.com/pypa/twine/issues/1217) <https://github.com/pypa/twine/issues/1217>_)
• Fix a couple of incorrectly rendered error messages. ([#1224](https://github.com/pypa/twine/issues/1224) <https://github.com/pypa/twine/issues/1224>_)
• twine now enforces keyring >= 21.2.0, which was previously implicitly required by API usage. ([#1229](https://github.com/pypa/twine/issues/1229) <https://github.com/pypa/twine/issues/1229>_)
• twine now catches configparser.Error to prevent accidental leaks of secret tokens or passwords to the user's console. ([#1240](https://github.com/pypa/twine/issues/1240) <https://github.com/pypa/twine/issues/1240>_)

... (truncated)

Commits

• fdb86cb Update changelog for 7.0.0 (#1344)
• bfa7f7f changelog: backfill entries from PRs (#1330)
• 4f20c0d Remove monkeypatch allowing Metadata 2.0 (#1317)
• 1df249e build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#1318)
• bea9607 fix: bump minimum rich dependency to 14.3.3 to prevent verbose hang (#1308)
• ac17a17 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1311)
• 039cedf build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#1313)
• d465cb0 Handle non-standard HTTP status codes (#1309)
• cab618f Bump packaging >= 26.1 (#1310)
• 2d06e11 build(deps): bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (#1307)
• Additional commits viewable in compare view

Updates pymdown-extensions to 12.0.1

Release notes

Sourced from pymdown-extensions's releases.

12.0.1

Description has been truncated