From be6f6a9ce377f1a8952c6e1e2672f3bdfacb7443 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 29 Sep 2026 11:15:47 +0000
Subject: [PATCH 1/2] Bump filelock from 3.32.7 to 4.0.3 (#13862)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.7 to
4.0.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/py-filelock/releases">filelock's
releases</a>.</em></p>
<blockquote>
<h2>4.0.3</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🐛 fix(api): skip the fork audit hook on CPython &lt;3.12 by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/filelock/pull/747">tox-dev/filelock#747</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/filelock/compare/4.0.2...4.0.3">https://github.com/tox-dev/filelock/compare/4.0.2...4.0.3</a></p>
<h2>4.0.2</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>docs: create the data directory in the async cache example by <a
href="https://github.com/agammann"><code>@​agammann</code></a> in <a
href="https://redirect.github.com/tox-dev/filelock/pull/740">tox-dev/filelock#740</a></li>
<li>fix: ignore broken sphinx-llm release by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/filelock/pull/742">tox-dev/filelock#742</a></li>
<li>🐛 fix(api): serialize concurrent transitions on shared locks by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/filelock/pull/745">tox-dev/filelock#745</a></li>
<li>🐛 fix(async-rw): give each task its own hold by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/filelock/pull/746">tox-dev/filelock#746</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/agammann"><code>@​agammann</code></a>
made their first contribution in <a
href="https://redirect.github.com/tox-dev/filelock/pull/740">tox-dev/filelock#740</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/filelock/compare/4.0.1...4.0.2">https://github.com/tox-dev/filelock/compare/4.0.1...4.0.2</a></p>
<h2>4.0.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>fix: reject invalid poll_interval before sleep by <a
href="https://github.com/Pitchfork-and-Torch"><code>@​Pitchfork-and-Torch</code></a>
in <a
href="https://redirect.github.com/tox-dev/filelock/pull/739">tox-dev/filelock#739</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/Pitchfork-and-Torch"><code>@​Pitchfork-and-Torch</code></a>
made their first contribution in <a
href="https://redirect.github.com/tox-dev/filelock/pull/739">tox-dev/filelock#739</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/filelock/compare/4.0.0...4.0.1">https://github.com/tox-dev/filelock/compare/4.0.0...4.0.1</a></p>
<h2>4.0.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🐛 fix(soft-rw): replace the state mutex with a generation log by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/filelock/pull/738">tox-dev/filelock#738</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/filelock/compare/3.32.7...4.0.0">https://github.com/tox-dev/filelock/compare/3.32.7...4.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst">filelock's
changelog</a>.</em></p>
<blockquote>
<p>###########
Changelog
###########</p>
<p>.. towncrier-draft-entries:: Unreleased</p>
<p>.. towncrier release notes start</p>
<hr />
<p>4.0.6 (2026-09-28)</p>
<hr />
<ul>
<li>Reject negative blocking timeouts other than <code>-1</code> before
reentrant <code>ReadWriteLock</code> and <code>SoftReadWriteLock</code>
acquisition. Preserve unlimited waits and nonblocking acquisition.
:pr:<code>756</code></li>
</ul>
<hr />
<p>4.0.5 (2026-09-28)</p>
<hr />
<ul>
<li>Fix <code>MarkerSoftFileLock</code> acquisition and prevent
contenders from evicting live protocol-2 owners after two seconds.
Reclaim recognized records after owner death; preserve unknown
contracts. :pr:<code>749</code></li>
<li>Honor instance <code>timeout</code> and <code>blocking</code>
settings in sync and async <code>ReadWriteLock</code> acquisition,
including waits
between tasks on one instance. Preserve explicit per-call overrides.
:pr:<code>750</code></li>
<li>Skip access-denial checks when the process can read
mode-<code>0o000</code> files. Keep mode-bit checks enabled for
privileged
processes on filesystems that support POSIX permissions.
:pr:<code>753</code></li>
<li>Skip vanished <code>StrictSoftFileLock</code> claims after a
read-permission retry expires. Recheck the directory before raising
a protocol error so concurrent removal does not turn a stale claim
listing into an acquisition failure. :pr:<code>754</code></li>
<li>Reject negative timeouts other than <code>-1</code> in blocking
<code>AsyncReadWriteLock</code> and <code>AsyncSoftReadWriteLock</code>
acquisitions.
Keep <code>-1</code> as an unlimited wait and ignore timeouts when
<code>blocking=False</code>. :pr:<code>755</code></li>
</ul>
<hr />
<p>4.0.4 (2026-09-26)</p>
<hr />
<ul>
<li>Hostnames that still differ after their first 253 escaped characters
now publish distinct owners, so a soft lock no
longer takes another such host's live holder for its own and reclaims
its marker. :pr:<code>748</code></li>
</ul>
<hr />
<p>4.0.3 (2026-09-23)</p>
<hr />
<ul>
<li>Importing filelock on CPython 3.10 or 3.11 no longer makes new
threads fail with <code>RuntimeError: Cannot install a trace function
while another trace function is being installed</code> under coverage or
a debugger. filelock skips its fork-safety
audit hook there, so forking from inside a thread's own lock-state
transition no longer raises immediately on those
versions. :pr:<code>747</code></li>
</ul>
<hr />
<p>4.0.2 (2026-09-23)</p>
<hr />
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tox-dev/filelock/commit/5283806e06da4fb85b6ba9b1b0c3afbaea5b8798"><code>5283806</code></a>
Release 4.0.3</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/fd10e07710dd560eb14b18573ca65d6a2af0b8df"><code>fd10e07</code></a>
🐛 fix(api): skip the fork audit hook on CPython &lt;3.12 (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/747">#747</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/2d4530f621dc5fed042fb8e73e5f2bacadb37fbd"><code>2d4530f</code></a>
Release 4.0.2</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/6c46312e5aaaa3aaf89215668e05fd59e02e886d"><code>6c46312</code></a>
🐛 fix(async-rw): give each task its own hold (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/746">#746</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/fe0e99d00f3a98f1df1e7b0d5fa9c4ce79023803"><code>fe0e99d</code></a>
🐛 fix(api): serialize concurrent transitions on shared locks (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/745">#745</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/b26beda0d5d0cc0721554f342bc3e6da8df46f30"><code>b26beda</code></a>
build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the
github-acti...</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/10572ec692a6bdaff60d2aea38e43e165203f53e"><code>10572ec</code></a>
fix: ignore broken sphinx-llm release (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/742">#742</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/6c10af3ff28b3272646abb4c4a215d9a32783914"><code>6c10af3</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/741">#741</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/9380408f5552987fad1045c1665f5ea2f92e2d22"><code>9380408</code></a>
docs: create the data directory in the async cache example (<a
href="https://redirect.github.com/tox-dev/py-filelock/issues/740">#740</a>)</li>
<li><a
href="https://github.com/tox-dev/filelock/commit/b5016c46cdb90296b3fb3060ec8767b8176d5b84"><code>b5016c4</code></a>
Release 4.0.1</li>
<li>Additional commits viewable in <a
href="https://github.com/tox-dev/py-filelock/compare/3.32.7...4.0.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.32.7&new-version=4.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements/constraints.txt | 2 +-
 requirements/dev.txt         | 2 +-
 requirements/lint.txt        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index 36697d2bb0a..a9b007f1e74 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -87,7 +87,7 @@ exceptiongroup==1.3.1
     #   pytest
 execnet==2.1.2
     # via pytest-xdist
-filelock==3.32.7
+filelock==4.0.3
     # via
     #   python-discovery
     #   virtualenv
diff --git a/requirements/dev.txt b/requirements/dev.txt
index af815b6717e..85250338fc3 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -85,7 +85,7 @@ exceptiongroup==1.3.1
     #   pytest
 execnet==2.1.2
     # via pytest-xdist
-filelock==3.32.7
+filelock==4.0.3
     # via
     #   python-discovery
     #   virtualenv
diff --git a/requirements/lint.txt b/requirements/lint.txt
index 681fd47cd0d..205f97e535a 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -44,7 +44,7 @@ exceptiongroup==1.3.1
     # via
     #   aiofastnet
     #   pytest
-filelock==3.32.7
+filelock==4.0.3
     # via
     #   python-discovery
     #   virtualenv

From 47f3c6f171c84b2a45eb92475cea0a2efaf3043e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 29 Sep 2026 11:20:20 +0000
Subject: [PATCH 2/2] Bump platformdirs from 4.11.14 to 4.11.15 (#13863)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from
4.11.14 to 4.11.15.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/platformdirs/releases">platformdirs's
releases</a>.</em></p>
<blockquote>
<h2>4.11.15</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🐛 fix(android): detect Android builds without ANDROID_* variables by
<a href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a>
in <a
href="https://redirect.github.com/tox-dev/platformdirs/pull/581">tox-dev/platformdirs#581</a></li>
<li>🐛 fix(android): use the current user's shared storage by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/platformdirs/pull/582">tox-dev/platformdirs#582</a></li>
<li>🐛 fix(android): return shared folders apps can create by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/platformdirs/pull/583">tox-dev/platformdirs#583</a></li>
<li>🐛 fix(android): read directories through a real Context by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/tox-dev/platformdirs/pull/580">tox-dev/platformdirs#580</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tox-dev/platformdirs/compare/4.11.14...4.11.15">https://github.com/tox-dev/platformdirs/compare/4.11.14...4.11.15</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst">platformdirs's
changelog</a>.</em></p>
<blockquote>
<p>###########
Changelog
###########</p>
<p>.. towncrier-draft-entries:: Unreleased</p>
<p>.. towncrier release notes start</p>
<hr />
<p>4.12.1 (2026-09-28)</p>
<hr />
<ul>
<li>Avoid <code>PytestAssertRewriteWarning</code> when importing
<code>platformdirs</code> before invoking pytest.
:pr:<code>601</code></li>
</ul>
<hr />
<p>4.12.0 (2026-09-26)</p>
<hr />
<ul>
<li>Add <code>place_*_file</code> methods that return a file path under
a user directory and create its missing parents with mode
<code>0o700</code>. :pr:<code>585</code></li>
<li>Add <code>find_&lt;kind&gt;_file</code> and
<code>find_&lt;kind&gt;_files</code> to look up an existing file across
the user and site directories of
each kind that has an <code>iter_&lt;kind&gt;_paths</code> method.
:pr:<code>586</code></li>
<li>Add :func:<code>platformdirs.testing.isolated_dirs</code> and the
<code>platformdirs_isolated</code> pytest fixture to resolve every
directory under one test root. :pr:<code>590</code></li>
<li>Emit :class:<code>~platformdirs.RuntimeDirWarning</code> when the
Unix :func:<code>~platformdirs.user_runtime_dir</code> falls back from
<code>XDG_RUNTIME_DIR</code>. :pr:<code>599</code></li>
<li>Read <code>user_templates_dir</code>,
<code>user_publicshare_dir</code> and <code>user_bin_dir</code> on
Windows from their known folders.
:pr:<code>587</code></li>
<li>Create missing user app directories and their parents with mode
<code>0700</code> under <code>ensure_exists</code> on POSIX platforms.
:pr:<code>588</code></li>
<li>Raise <code>RuntimeError</code> for a Unix or macOS directory under
the home when no home resolves, and read the password
database for an empty <code>HOME</code>. :pr:<code>589</code></li>
<li>Skip an <code>XDG_RUNTIME_DIR</code> or
<code>/run/user/&lt;uid&gt;</code> that is not a private directory of
the user, and reject a symlink
or file as the <code>runtime-&lt;uid&gt;</code> fallback.
:pr:<code>599</code></li>
<li>Use the app container layout on iOS, such as
<code>~/Library/Application Support</code> for data.
:pr:<code>600</code></li>
<li>Document that a Homebrew Python puts the Homebrew prefix first in
the macOS shared directories, with or without
<code>multipath</code>. :pr:<code>591</code></li>
<li>Document that the macOS media directories honor the
<code>XDG_*_DIR</code> variables. :pr:<code>592</code></li>
<li>Document the <code>WIN_PD_OVERRIDE_COMMON_PROGRAMS</code> variable.
:pr:<code>593</code></li>
<li>Document <code>/usr/local/share/applications</code> as the Linux
<code>site_applications_dir</code> default. :pr:<code>594</code></li>
<li>Correct the BSD <code>user_runtime_dir</code> defaults and describe
the temporary directory fallback. :pr:<code>595</code></li>
<li>Describe how platformdirs detects Android, finds the app folder and
places the shared folders. :pr:<code>596</code></li>
<li>Document that Microsoft Store Python redirects only new files and
folders under <code>AppData</code>. :pr:<code>597</code></li>
<li>Show how to load a font on Windows after copying it into
<code>user_fonts_dir</code>. :pr:<code>598</code></li>
</ul>
<hr />
<p>4.11.15 (2026-09-26)</p>
<hr />
<ul>
<li>Fix the pyjnius lookup of the Android app folder and media
directories, which always failed. :pr:<code>580</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/205aab7acb4d31a5800ecb742792fcddd879b49a"><code>205aab7</code></a>
Release 4.11.15</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/bd5d0e6b8f01a75b3efd108e748d4a69e4314464"><code>bd5d0e6</code></a>
🐛 fix(android): read directories through a real Context (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/580">#580</a>)</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/3853267f1756e2cecb7e586b6f5e71f9831f02e9"><code>3853267</code></a>
🐛 fix(android): return shared folders apps can create (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/583">#583</a>)</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/c2f3a165e56eabb793f27746199fb3609e189d1a"><code>c2f3a16</code></a>
🐛 fix(android): use the current user's shared storage (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/582">#582</a>)</li>
<li><a
href="https://github.com/tox-dev/platformdirs/commit/09efe26346caabadf0e0d619b29f4aaa1faea43f"><code>09efe26</code></a>
🐛 fix(android): detect Android builds without ANDROID_* variables (<a
href="https://redirect.github.com/tox-dev/platformdirs/issues/581">#581</a>)</li>
<li>See full diff in <a
href="https://github.com/tox-dev/platformdirs/compare/4.11.14...4.11.15">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.11.14&new-version=4.11.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements/constraints.txt | 2 +-
 requirements/dev.txt         | 2 +-
 requirements/lint.txt        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index a9b007f1e74..7bad5eb0a8e 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -168,7 +168,7 @@ pip-tools==7.6.1
     # via -r requirements/dev.in
 pkgconfig==1.6.0
     # via -r requirements/test-common-base.in
-platformdirs==4.11.14
+platformdirs==4.11.15
     # via virtualenv
 pluggy==1.6.0
     # via
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 85250338fc3..eae60f3d183 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -165,7 +165,7 @@ pip-tools==7.6.1
     # via -r requirements/dev.in
 pkgconfig==1.6.0
     # via -r requirements/test-common-base.in
-platformdirs==4.11.14
+platformdirs==4.11.15
     # via virtualenv
 pluggy==1.6.0
     # via
diff --git a/requirements/lint.txt b/requirements/lint.txt
index 205f97e535a..ca3d745e35e 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -86,7 +86,7 @@ packaging==26.3
     # via pytest
 pathspec==1.1.1
     # via mypy
-platformdirs==4.11.14
+platformdirs==4.11.15
     # via virtualenv
 pluggy==1.6.0
     # via pytest