build(deps-user): Bump the "user-facing" group with 1 update across multiple ecosystems (#4378) Bumps the user-facing group with 2 updates in the /tools directory: [certifi](https://github.com/certifi/python-certifi) and [importlib-metadata](https://github.com/python/importlib_metadata). Bumps the user-facing group with 2 updates in the /tools/publish directory: [certifi](https://github.com/certifi/python-certifi) and [importlib-metadata](https://github.com/python/importlib_metadata). Updates `certifi` from 2026.10.19 to 2026.10.23 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/certifi/python-certifi/commit/b60466c9f2882d9cf088943c650b0faac06c080c"><code>b60466c</code></a> 2026.10.23 (<a href="https://redirect.github.com/certifi/python-certifi/issues/445">#445</a>)</li> <li>See full diff in <a href="https://github.com/certifi/python-certifi/compare/2026.10.19...2026.10.23">compare view</a></li> </ul> </details> <br /> Updates `importlib-metadata` from 9.0.1 to 10.1.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/importlib_metadata/blob/main/NEWS.rst">importlib-metadata's changelog</a>.</em></p> <blockquote> <h1>v10.1.0</h1> <h2>Features</h2> <ul> <li>Detecting whether a distribution supplies metadata no longer reads or parses that metadata where the metadata directory can be inspected instead, so retrieving a distribution by name, which prefers the valid candidates, is substantially faster.</li> <li>Reverted the preference for the greater metadata directory added in v9.1.0. The ordering was lexicographic on the directory name and not on the parsed version, so it only approximated a preference for the newer version. Where a path supplies more than one metadata directory for a distribution, discovery once again reports them in the order the path supplies <code>python/cpython#100666</code></li> </ul> <h2>Bugfixes</h2> <ul> <li><code>entry_points()</code> now prefers distributions whose metadata is readable, so an empty metadata directory left behind by an unclean upgrade no longer shadows the valid one of the same name and suppresses its entry points. Invalid distributions are deferred to the end of the enumeration rather than dropped. (<a href="https://redirect.github.com/python/importlib_metadata/issues/534">#534</a>)</li> <li>The preference for valid distributions no longer propagates the <code>MetadataNotFound</code> of a distribution that a provider derived from <code>importlib.metadata</code>, whose exception is a different class from this package's and so escaped the preference rather than marking the distribution invalid.</li> </ul> <h1>v10.0.0</h1> <h2>Features</h2> <ul> <li>Added <code>IDistribution</code> and <code>IPackagePath</code> protocols so consumers can target a stable, shared interface across <code>importlib.metadata</code> and <code>importlib_metadata</code>. A provider supplying its own <code>Distribution</code> subclass is warned about only when the class omits members that interface requires, not merely because it derives from <code>importlib.metadata</code>. <code>origin</code> is exempt from that expectation until support for Python 3.12 is dropped, as there is none to inherit before Python 3.13. (<a href="https://redirect.github.com/python/importlib_metadata/issues/486">#486</a>)</li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>When providers supply objects from <code>importlib.metadata</code>, they are now adapted to the classes from <code>importlib_metadata</code>. (<a href="https://redirect.github.com/python/importlib_metadata/issues/486">#486</a>)</li> </ul> <h1>v9.1.0</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python/importlib_metadata/commit/d196fdbd3ebf90542b51f7215c230c17ef376cb0"><code>d196fdb</code></a> Finalize</li> <li><a href="https://github.com/python/importlib_metadata/commit/5d253aecaafb2fe88f2c0f6ff9d579fa95b24f09"><code>5d253ae</code></a> Merge pull request <a href="https://redirect.github.com/python/importlib_metadata/issues/553">#553</a> from python/bugfix/534-entry-points-prefer-valid</li> <li><a href="https://github.com/python/importlib_metadata/commit/0aa24f3392439c552a89fbd7fcc3cdc20d8f0105"><code>0aa24f3</code></a> Prefer valid distributions when collecting entry points.</li> <li><a href="https://github.com/python/importlib_metadata/commit/e52be782b23218fff2dff7024654fae2d4410801"><code>e52be78</code></a> Detect the presence of metadata without reading it.</li> <li><a href="https://github.com/python/importlib_metadata/commit/60bbaca797424d8234a703f0b076a12592079883"><code>60bbaca</code></a> Merge pull request <a href="https://redirect.github.com/python/importlib_metadata/issues/552">#552</a> from python/debt/revert-prefer-greater-version</li> <li><a href="https://github.com/python/importlib_metadata/commit/7e162d8a86815484cc26291e39052be5fbcf7514"><code>7e162d8</code></a> Revert "Prefer the greater metadata directory when a path supplies several."</li> <li><a href="https://github.com/python/importlib_metadata/commit/3be14168f846b406b0f3a48bb1907fe70c5fb7c8"><code>3be1416</code></a> Finalize</li> <li><a href="https://github.com/python/importlib_metadata/commit/e3dad222d3ed33f6b68306eb92e537e2bfc83690"><code>e3dad22</code></a> Merge pull request <a href="https://redirect.github.com/python/importlib_metadata/issues/505">#505</a> from python/bugfix/486-local-objects</li> <li><a href="https://github.com/python/importlib_metadata/commit/301b791a4b4281dd5100eb26fa53466e75b28fe5"><code>301b791</code></a> Finalize</li> <li><a href="https://github.com/python/importlib_metadata/commit/4b7c45f3d1a5ad3fed28bf52db377770b754ef4f"><code>4b7c45f</code></a> Avoid a dot in the news fragment id.</li> <li>Additional commits viewable in <a href="https://github.com/python/importlib_metadata/compare/v9.0.1...v10.1.0">compare view</a></li> </ul> </details> <br /> Updates `certifi` from 2026.10.19 to 2026.10.23 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/certifi/python-certifi/commit/b60466c9f2882d9cf088943c650b0faac06c080c"><code>b60466c</code></a> 2026.10.23 (<a href="https://redirect.github.com/certifi/python-certifi/issues/445">#445</a>)</li> <li>See full diff in <a href="https://github.com/certifi/python-certifi/compare/2026.10.19...2026.10.23">compare view</a></li> </ul> </details> <br /> Updates `importlib-metadata` from 9.0.1 to 10.1.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/importlib_metadata/blob/main/NEWS.rst">importlib-metadata's changelog</a>.</em></p> <blockquote> <h1>v10.1.0</h1> <h2>Features</h2> <ul> <li>Detecting whether a distribution supplies metadata no longer reads or parses that metadata where the metadata directory can be inspected instead, so retrieving a distribution by name, which prefers the valid candidates, is substantially faster.</li> <li>Reverted the preference for the greater metadata directory added in v9.1.0. The ordering was lexicographic on the directory name and not on the parsed version, so it only approximated a preference for the newer version. Where a path supplies more than one metadata directory for a distribution, discovery once again reports them in the order the path supplies <code>python/cpython#100666</code></li> </ul> <h2>Bugfixes</h2> <ul> <li><code>entry_points()</code> now prefers distributions whose metadata is readable, so an empty metadata directory left behind by an unclean upgrade no longer shadows the valid one of the same name and suppresses its entry points. Invalid distributions are deferred to the end of the enumeration rather than dropped. (<a href="https://redirect.github.com/python/importlib_metadata/issues/534">#534</a>)</li> <li>The preference for valid distributions no longer propagates the <code>MetadataNotFound</code> of a distribution that a provider derived from <code>importlib.metadata</code>, whose exception is a different class from this package's and so escaped the preference rather than marking the distribution invalid.</li> </ul> <h1>v10.0.0</h1> <h2>Features</h2> <ul> <li>Added <code>IDistribution</code> and <code>IPackagePath</code> protocols so consumers can target a stable, shared interface across <code>importlib.metadata</code> and <code>importlib_metadata</code>. A provider supplying its own <code>Distribution</code> subclass is warned about only when the class omits members that interface requires, not merely because it derives from <code>importlib.metadata</code>. <code>origin</code> is exempt from that expectation until support for Python 3.12 is dropped, as there is none to inherit before Python 3.13. (<a href="https://redirect.github.com/python/importlib_metadata/issues/486">#486</a>)</li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>When providers supply objects from <code>importlib.metadata</code>, they are now adapted to the classes from <code>importlib_metadata</code>. (<a href="https://redirect.github.com/python/importlib_metadata/issues/486">#486</a>)</li> </ul> <h1>v9.1.0</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python/importlib_metadata/commit/d196fdbd3ebf90542b51f7215c230c17ef376cb0"><code>d196fdb</code></a> Finalize</li> <li><a href="https://github.com/python/importlib_metadata/commit/5d253aecaafb2fe88f2c0f6ff9d579fa95b24f09"><code>5d253ae</code></a> Merge pull request <a href="https://redirect.github.com/python/importlib_metadata/issues/553">#553</a> from python/bugfix/534-entry-points-prefer-valid</li> <li><a href="https://github.com/python/importlib_metadata/commit/0aa24f3392439c552a89fbd7fcc3cdc20d8f0105"><code>0aa24f3</code></a> Prefer valid distributions when collecting entry points.</li> <li><a href="https://github.com/python/importlib_metadata/commit/e52be782b23218fff2dff7024654fae2d4410801"><code>e52be78</code></a> Detect the presence of metadata without reading it.</li> <li><a href="https://github.com/python/importlib_metadata/commit/60bbaca797424d8234a703f0b076a12592079883"><code>60bbaca</code></a> Merge pull request <a href="https://redirect.github.com/python/importlib_metadata/issues/552">#552</a> from python/debt/revert-prefer-greater-version</li> <li><a href="https://github.com/python/importlib_metadata/commit/7e162d8a86815484cc26291e39052be5fbcf7514"><code>7e162d8</code></a> Revert "Prefer the greater metadata directory when a path supplies several."</li> <li><a href="https://github.com/python/importlib_metadata/commit/3be14168f846b406b0f3a48bb1907fe70c5fb7c8"><code>3be1416</code></a> Finalize</li> <li><a href="https://github.com/python/importlib_metadata/commit/e3dad222d3ed33f6b68306eb92e537e2bfc83690"><code>e3dad22</code></a> Merge pull request <a href="https://redirect.github.com/python/importlib_metadata/issues/505">#505</a> from python/bugfix/486-local-objects</li> <li><a href="https://github.com/python/importlib_metadata/commit/301b791a4b4281dd5100eb26fa53466e75b28fe5"><code>301b791</code></a> Finalize</li> <li><a href="https://github.com/python/importlib_metadata/commit/4b7c45f3d1a5ad3fed28bf52db377770b754ef4f"><code>4b7c45f</code></a> Avoid a dot in the news fragment id.</li> <li>Additional commits viewable in <a href="https://github.com/python/importlib_metadata/compare/v9.0.1...v10.1.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
diff --git a/tools/publish/requirements_darwin.txt b/tools/publish/requirements_darwin.txt index be273c8..6fe7cee 100644 --- a/tools/publish/requirements_darwin.txt +++ b/tools/publish/requirements_darwin.txt
@@ -6,9 +6,9 @@ --hash=sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34 \ --hash=sha256:d75e02c268746e1b8144c278978b6e98e85de6ad16f8e4b0844a154557eca991 # via jaraco-context -certifi==2026.10.19 \ - --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ - --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b +certifi==2026.10.23 \ + --hash=sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd \ + --hash=sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1 # via requests charset-normalizer==3.5.2 \ --hash=sha256:01077390b03f7988f11d700a2194e69b119741a86b1a638b1db88891e3eced8e \ @@ -196,9 +196,9 @@ --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \ --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c # via requests -importlib-metadata==9.0.1 \ - --hash=sha256:ab830580bc0ef3db61ce8fae716389e5462b67e033018bab6d8f80ef17172f99 \ - --hash=sha256:bba5600596a7e21f3eef53281cf28d6a5195634d2f2b78ff9501a3272c6eaab0 +importlib-metadata==10.1.0 \ + --hash=sha256:82b04047fa09792c1a8cfeddfe08bec79e4b13c29c8469b0d3949860f61017e8 \ + --hash=sha256:cf45ce66a929c64e994185a809c04840d0501db17e663810d993d0f4829265c7 # via keyring jaraco-classes==3.4.0 \ --hash=sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd \
diff --git a/tools/publish/requirements_linux.txt b/tools/publish/requirements_linux.txt index a4921dc..9d870a4 100644 --- a/tools/publish/requirements_linux.txt +++ b/tools/publish/requirements_linux.txt
@@ -6,9 +6,9 @@ --hash=sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34 \ --hash=sha256:d75e02c268746e1b8144c278978b6e98e85de6ad16f8e4b0844a154557eca991 # via jaraco-context -certifi==2026.10.19 \ - --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ - --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b +certifi==2026.10.23 \ + --hash=sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd \ + --hash=sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1 # via requests cffi==2.1.1 \ --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \ @@ -359,9 +359,9 @@ --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \ --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c # via requests -importlib-metadata==9.0.1 \ - --hash=sha256:ab830580bc0ef3db61ce8fae716389e5462b67e033018bab6d8f80ef17172f99 \ - --hash=sha256:bba5600596a7e21f3eef53281cf28d6a5195634d2f2b78ff9501a3272c6eaab0 +importlib-metadata==10.1.0 \ + --hash=sha256:82b04047fa09792c1a8cfeddfe08bec79e4b13c29c8469b0d3949860f61017e8 \ + --hash=sha256:cf45ce66a929c64e994185a809c04840d0501db17e663810d993d0f4829265c7 # via keyring jaraco-classes==3.4.0 \ --hash=sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd \
diff --git a/tools/publish/requirements_universal.txt b/tools/publish/requirements_universal.txt index 979347f..572dfab 100644 --- a/tools/publish/requirements_universal.txt +++ b/tools/publish/requirements_universal.txt
@@ -6,9 +6,9 @@ --hash=sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34 \ --hash=sha256:d75e02c268746e1b8144c278978b6e98e85de6ad16f8e4b0844a154557eca991 # via jaraco-context -certifi==2026.10.19 \ - --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ - --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b +certifi==2026.10.23 \ + --hash=sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd \ + --hash=sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1 # via requests cffi==2.1.1 ; platform_machine != 'ppc64le' and platform_machine != 's390x' and platform_python_implementation != 'PyPy' and sys_platform == 'linux' \ --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \
diff --git a/tools/publish/requirements_windows.txt b/tools/publish/requirements_windows.txt index 41d5efd..6f6083d 100644 --- a/tools/publish/requirements_windows.txt +++ b/tools/publish/requirements_windows.txt
@@ -6,9 +6,9 @@ --hash=sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34 \ --hash=sha256:d75e02c268746e1b8144c278978b6e98e85de6ad16f8e4b0844a154557eca991 # via jaraco-context -certifi==2026.10.19 \ - --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ - --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b +certifi==2026.10.23 \ + --hash=sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd \ + --hash=sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1 # via requests charset-normalizer==3.5.2 \ --hash=sha256:01077390b03f7988f11d700a2194e69b119741a86b1a638b1db88891e3eced8e \ @@ -196,9 +196,9 @@ --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \ --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c # via requests -importlib-metadata==9.0.1 \ - --hash=sha256:ab830580bc0ef3db61ce8fae716389e5462b67e033018bab6d8f80ef17172f99 \ - --hash=sha256:bba5600596a7e21f3eef53281cf28d6a5195634d2f2b78ff9501a3272c6eaab0 +importlib-metadata==10.1.0 \ + --hash=sha256:82b04047fa09792c1a8cfeddfe08bec79e4b13c29c8469b0d3949860f61017e8 \ + --hash=sha256:cf45ce66a929c64e994185a809c04840d0501db17e663810d993d0f4829265c7 # via keyring jaraco-classes==3.4.0 \ --hash=sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd \