[dependabot]

Bumps the python-minor-and-patch group with 11 updates:

Package	From	To
click	8.4.2	8.5.0
coverage	7.15.4	7.16.0
filelock	3.32.3	3.32.5
fonttools	4.63.0	4.64.0
imagesize	2.0.0	2.0.1
joblib	1.5.3	1.6.0
kiwisolver	1.5.0	1.5.1
narwhals	2.24.0	2.25.0
platformdirs	4.11.3	4.11.6
python-discovery	1.5.2	1.6.0
virtualenv	21.7.4	21.7.7

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](https://github.com/pallets/click/discussions/3527). #3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](https://github.com/pallets/click/discussions/3527). {pr}3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits

• 8b19813 Release version 8.5.0
• 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
• 131c86a Add FAQ entry about UnicodeEncodeError on Windows
• e1fd594 Add support of pathlib.Path to edit (#3781)
• a1d8785 Add support of pathlib.Path to edit
• 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
• a6256bf Forwards all user's parameters set in PAGER
• 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
• 9835b0f Resolve the pager command once, in _pager_contextmanager
• f36d58b Refactor pager stream handling (#3767)
• Additional commits viewable in compare view

Updates coverage from 7.15.4 to 7.16.0

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
• The Coverage.switch_context() method now returns the previous context.
• Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
• Fixes to validation of options and configuration settings:
  • Negative precision settings now always cause useful error messages (pull 2261).
  • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
  • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
  • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
• Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

• The :meth:.Coverage.switch_context method now returns the previous context.

• Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

• Fixes to validation of options and configuration settings:

  • Negative precision settings now always cause useful error messages (pull 2261_).

  • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

  • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

  • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with "Can't combine statement coverage data with branch data". Each named concurrency library is now properly considered (pull 2270_).

• Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: coveragepy/coveragepy#2261 .. _pull 2262: coveragepy/coveragepy#2262 .. _pull 2263: coveragepy/coveragepy#2263 .. _pull 2265: coveragepy/coveragepy#2265 .. _issue 2266: coveragepy/coveragepy#2266 .. _pull 2268: coveragepy/coveragepy#2268

... (truncated)

Commits

• 3e9fc16 docs: prep for 7.16.0
• 38be8d1 build: control check-manifest explicitly
• 8eb1266 docs(build): no longer commit sample_html
• 1a8b3fa docs: remove sample_html
• aeaa79b docs: linklint is now sphinx-linklint
• d5eaf3f test: a branchless way to re-add extensions
• 57e52fd docs: adjust CHANGES for #2270
• b9d304d fix: check for multiprocessing in a --concurrency list (#2270)
• a6ef928 chore: make upgrade
• 070461f chore: bump the action-dependencies group with 4 updates (#2271)
• Additional commits viewable in compare view

Updates filelock from 3.32.3 to 3.32.5

Release notes

Sourced from filelock's releases.

3.32.5

What's Changed

• 🧪 test(fork): report where a stalled fork stops by @​gaborbernat in tox-dev/filelock#715
• 📝 docs: say that mode is read-only in the thread-local section by @​Gares95 in tox-dev/filelock#716
• 🐛 fix(lease): clear token after failed acquire by @​lprnmns in tox-dev/filelock#721

New Contributors

• @​lprnmns made their first contribution in tox-dev/filelock#721

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

3.32.4

What's Changed

• 🐛 fix: retry transient denials on open and claim read by @​gaborbernat in tox-dev/filelock#705
• 🧪 test: deflake six scheduled-run failures by @​gaborbernat in tox-dev/filelock#704
• 🧪 test: cover a reclaimed private record for real by @​gaborbernat in tox-dev/filelock#706
• 🧪 test(fork): fork once the event loop has closed by @​gaborbernat in tox-dev/filelock#714
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in tox-dev/filelock#713
• escape the hostname every marker publishes by @​dxbjavid in tox-dev/filelock#709

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

3.32.5 (2026-08-31)

---

• SoftFileLease.token and AsyncSoftFileLease.token now read None after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:721
• Document that mode has no setter: unlike poll_interval, timeout, blocking and lifetime, it is fixed at construction and lock.mode = ... raises AttributeError. :pr:716

---

3.32.4 (2026-08-23)

---

• StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
• WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
• Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

---

3.32.3 (2026-08-13)

---

• The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

---

3.32.2 (2026-07-29)

---

• A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

---

3.32.1 (2026-07-26)

---

• Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

... (truncated)

Commits

• 1585dfe Release 3.32.5
• 00177c3 🐛 fix(lease): clear token after failed acquire (#721)
• 5aeb9b6 📝 docs: say that mode is read-only in the thread-local section (#716)
• 2634dd1 [pre-commit.ci] pre-commit autoupdate (#720)
• 37dccf0 🧪 test(fork): report where a stalled fork stops (#715)
• cb493d6 Release 3.32.4
• fe07a11 escape the hostname every marker publishes (#709)
• 232732f 🔧 chore: batch dependency updates weekly on Tuesday (#713)
• 2966eb5 🧪 test(fork): fork once the event loop has closed (#714)
• 61511eb build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#712)
• Additional commits viewable in compare view

Updates fonttools from 4.63.0 to 4.64.0

Release notes

Sourced from fonttools's releases.

4.64.0

• [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
• [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
• [subset] Keep East Asian spacing palt by default (#4094).
• [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
• [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
• [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
• [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
• [ttLib] Add support for TrueType Collection version 2 (#4100).
• [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
• [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
• [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
• [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
• [misc.roundTools] Add types and documentation (#4123).
• [varLib.instancer] Instance the BASE table (#4137).
• [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
• [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
• [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
• [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
• [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
• [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
• [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
• [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
• [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
• [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
• [cmap] Don't drop subtables in unsupported formats when compiling or dumping a font read from binary (#4136).
• [ttLib] Implement splitSinglePos so GPOS lookup type 1 offset overflows can be recovered by splitting the subtable (#4091, #4108).
• [cmap] Round-trip empty Macintosh format 2 subtables (#3663, #4117).
• [glyf] Raise TTLibError instead of RecursionError when recalcBounds() hits a composite-component reference cycle (#3899, #4116).
• [svgLib] Fix crash parsing an SVG path with consecutive closepath commands (Z Z) (#4122).
• [ttLib] Fix DefaultTable type annotations (#4126).
• [ttLib] Add support for the EBSC (Embedded Bitmap Scaling) table (#4113).
• [svgLib] Suppress spurious close segments caused by floating-point drift in relative path commands (#3860, #4127).
• [qu2cu] Fix TypeError in the Cython-compiled build when Qu2CuPen passes tuple splines (#4160).
• [mort] Add semantic decompilation, TTX, and compilation support for rearrangement, contextual-substitution, ligature, and insertion subtables (#4158, #4159, #4161).
• [svgLib] Start a new subpath at the just-closed subpath's initial point when a drawto command follows a closepath, per SVG spec (#4154, #4155).
• [misc.filesystem] SECURITY Reject paths that resolve outside the filesystem root: a malicious UFO could read arbitrary files via .. components in contents.plist, and a crafted .ufoz could create files outside its temporary mirror (#4124).
• [ttLib] SECURITY Sanitise glyph names used as filenames in EBDT/CBDT ttx -z extfile export, preventing arbitrary file writes from untrusted fonts (#4128).
• [misc.etree] SECURITY Don't resolve external XML entities in XMLParser when lxml is used, preventing XXE file disclosure on lxml < 5.0 (#4145).
• [subset] Fully prune VARC auxiliary data: collect and remap variation indices referenced by condition tables when subsetting the MultiVarStore, and drop the AxisIndicesList, ConditionList, and MultiVarStore when they end up empty (#4162).

Changelog

Sourced from fonttools's changelog.

4.64.0 (released 2026-08-31)

• [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
• [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
• [subset] Keep East Asian spacing palt by default (#4094).
• [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
• [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
• [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
• [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
• [ttLib] Add support for TrueType Collection version 2 (#4100).
• [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
• [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
• [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
• [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
• [misc.roundTools] Add types and documentation (#4123).
• [varLib.instancer] Instance the BASE table (#4137).
• [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
• [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
• [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
• [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
• [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
• [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
• [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
• [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
• [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
• [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
• [cmap] Don't drop subtables in unsupported formats when compiling or dumping a

... (truncated)

Commits

• 37dfa71 Release 4.64.0
• 5cab496 Update NEWS.rst [skip ci]
• 6f1429b [subset] Fully prune VARC auxiliary data (#4162)
• 93fc470 Merge pull request #4145 from insaf021/etree-no-external-entities
• 1ce6993 [misc.etree] only override resolve_entities on lxml < 5.0
• 9c10287 Merge pull request #4128 from insaf021/ebdt-extfile-basename
• 53e2b0b [E_B_D_T_] don't let sanitised glyph names collide
• 3bbd268 Merge pull request #4124 from insaf021/osfs-path-containment
• 6840516 [misc.filesystem] simplify containment check, pin symlink strictness
• 8f4b4ee [misc.filesystem] don't publish a half-built zip directory mirror
• Additional commits viewable in compare view

Updates imagesize from 2.0.0 to 2.0.1

Release notes

Sourced from imagesize's releases.

Bug fix

• Optimize metadata parsing and HTTP range reads.
• Fix JPEG2000 box parsing.
• Accept single-quoted SVG dimensions.
• Return positive heights for top-down BMP images.
• Remove the upper Python version cap, migrate packaging to pyproject.toml, and add Python 3.15 CI coverage.
• Bump the package version to 2.0.1 and add recent feedback contributors to the README.

Related issues: shibukawa/imagesize_py#64 shibukawa/imagesize_py#83 shibukawa/imagesize_py#84

Related pull requests: shibukawa/imagesize_py#86 shibukawa/imagesize_py#87 shibukawa/imagesize_py#88 shibukawa/imagesize_py#89 shibukawa/imagesize_py#90 shibukawa/imagesize_py#91 shibukawa/imagesize_py#92

Commits

• cf87fc0 Prepare release 2.0.1
• 24992f6 Merge pull request #92 from shibukawa/feature/add-test-python315
• cda8b07 Add Python 3.15 test coverage
• a42d408 Merge pull request #91 from shibukawa/feature/fix-issue83
• a83b14f Merge remote-tracking branch 'origin/master' into feature/fix-issue84
• a1374b1 Optimize metadata parsing and HTTP range reads
• d088634 Merge pull request #90 from shibukawa/feature/fix-issue84
• fde3b5e Fix JPEG2000 box parsing for issue 84
• 7d5c748 Merge pull request #87 from stephenfin/pyproject
• efe3db1 Merge pull request #89 from jdillard/fix-64-svg-single-quotes
• Additional commits viewable in compare view

Updates joblib from 1.5.3 to 1.6.0

Changelog

Sourced from joblib's changelog.

Release 1.6.0 - 2026/08/31

• Fix caching of functions whose source cannot be retrieved, such as functions defined in a notebook cell. Their identity fell back to str(hash(func.__code__)), which is salted by PYTHONHASHSEED and so differed between processes. A worker reading the func_code.py written by another one concluded that the function had changed and wiped the whole cache directory for it, discarding results computed by its peers. func_code.py is also no longer rewritten in place, so a reader can no longer catch it half-written and draw the same conclusion. joblib/joblib#1694

• Drop python 3.9 support. The oldest supported Python version is now Python 3.10. joblib/joblib#1773

• Fix eval_expr (used to evaluate the pre_dispatch argument of Parallel) to raise a ValueError as documented instead of leaking a ZeroDivisionError for expressions that divide or take a modulo by zero. joblib/joblib#1810

• MemorizedResult now forwards mmap_mode to its store backend, so a cached array reconstructed from a location is memory-mapped as requested instead of being loaded fully into memory. joblib/joblib#1799

• Unvendor cloudpickle to more quickly benefit from maintenance releases of cloudpickle joblib/joblib#1775

• Fix Memory.cache for functions with a keyword-only argument that has a default declared before a keyword-only argument without a default. joblib/joblib#1731

• Fix behavior of filter_args on some precise cases. joblib/joblib#1800

• Fix a concurrency error that could happen with unordered generator. joblib/joblib#1789

• Fix: dump() now accepts any input os.PathLike object to be consistent with load. joblib/joblib#1812

• The documentation now uses pydata sphinx theme. Furthermore, optional dependencies test and docs have been added to pyproject.toml. joblib/joblib#1774

• Vendor loky 3.6.0

... (truncated)

Commits

• cd9a6b0 Release 1.6.0 (#1844)
• d873f97 MNT vendor loky 3.6.0 (#1843)
• 4ff61af Bump the github-actions group with 4 updates (#1832)
• 804f472 FIX make func_code stable across processes when the source is unavailable (#1...
• 65cc49d TST Restore RNG sequence in hash compatibility test (#1837)
• c1b6541 CI Use pytest-run-parallel on free-threaded build (#1819)
• f6b80d3 MNT Simplify isinstance check in hashing (#1835)
• fa4d5af MNT remove python 3.9 from CI (#1773)
• 53cea7b DOC Update release docs to reflect usage of trusted publishing (#1826)
• 26500e9 Bump the github-actions group across 1 directory with 3 updates (#1790)
• Additional commits viewable in compare view

Updates kiwisolver from 1.5.0 to 1.5.1

Release notes

Sourced from kiwisolver's releases.

1.5.1

What's Changed

• build(deps): bump docker/setup-qemu-action from 2 to 4 by @​dependabot[bot] in nucleic/kiwi#218
• build(deps): bump actions/download-artifact from 5.0.0 to 8.0.0 by @​dependabot[bot] in nucleic/kiwi#219
• build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @​dependabot[bot] in nucleic/kiwi#222
• build(deps): bump sigstore/gh-action-sigstore-python from 3.2.0 to 3.3.0 by @​dependabot[bot] in nucleic/kiwi#233
• build(deps): bump sigstore/gh-action-sigstore-python from 3.3.0 to 3.4.0 by @​dependabot[bot] in nucleic/kiwi#236
• build(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in nucleic/kiwi#237
• build(deps): bump codecov/codecov-action from 5 to 7 by @​dependabot[bot] in nucleic/kiwi#235
• build(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in nucleic/kiwi#239
• Add iOS build configuration. by @​freakboy3742 in nucleic/kiwi#238
• build(deps): bump sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0 by @​dependabot[bot] in nucleic/kiwi#242
• ci: start testing on Python 3.15 by @​MatthieuDartiailh in nucleic/kiwi#243

New Contributors

• @​freakboy3742 made their first contribution in nucleic/kiwi#238

Full Changelog: nucleic/kiwi@1.5.0...1.5.1

Changelog

Sourced from kiwisolver's changelog.

Wrappers 1.5.1 | Solver 1.5.1 | 28/08/2026

• add support for Python 3.15 PR #243
• fix bad version reported in C++ code PR #243

Commits

• 166899b cut release 1.5.1
• 1af7c11 ci: start testing on Python 3.15 (#243)
• 2e7291d build(deps): bump sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0 (#242)
• e8acf1e Add iOS build configuration. (#238)
• bd4b983 build(deps): bump actions/setup-python from 6 to 7 (#239)
• 00be78d build(deps): bump codecov/codecov-action from 5 to 7 (#235)
• 91a75dd build(deps): bump actions/checkout from 6 to 7 (#237)
• 9f56ae2 build(deps): bump sigstore/gh-action-sigstore-python from 3.3.0 to 3.4.0 (#236)
• 613c5bc build(deps): bump sigstore/gh-action-sigstore-python from 3.2.0 to 3.3.0 (#233)
• a7331ee build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 (#222)
• Additional commits viewable in compare view

Updates narwhals from 2.24.0 to 2.25.0

Release notes

Sourced from narwhals's releases.

Narwhals v2.25.0

Changes

🚀 Performance improvements

• perf: remove redundant work in eager when/then, schema resolution, selectors, and module lookups (#3797)

✨ Enhancements

• feat: add str.strip_chars_{start,end} (#3843)
• feat: Add maintain_order argument to {Expr, Series}.list.unique (#3697)
• feat(typing): Introduce PluginName NewType so plugin backends can type check (#3794)
• feat(ibis): Add support for Expr.list.median for ibis backend (#3791)

🐞 Bug fixes

Description has been truncated