dependabot[bot] opened a new pull request, #76609: URL: https://github.com/apache/airflow/pull/76609
Bumps the uv-dependency-updates group in /dev/breeze with 3 updates: [filelock](https://github.com/tox-dev/filelock), [prek](https://github.com/j178/prek) and [boto3](https://github.com/boto/boto3). Updates `filelock` from 4.2.4 to 4.2.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/filelock/releases";>filelock's releases</a>.</em></p> <blockquote> <h2>4.2.7</h2> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h3>Bug fixes</h3> <ul> <li>A <code>SoftFileLease</code> reclaims a dead holder's lease marker even when that holder published another <code>lease_duration</code>. It used to raise <code>LeaseSettingsMismatch</code> on every attempt instead, so after a holder crashed and its peers restarted with a changed duration the lock stayed wedged until <code>force_break()</code>. A live holder with another duration still raises (<a href="https://redirect.github.com/tox-dev/filelock/pull/900";>#900</a>) by <a href="https://github.com/dxbjavid";><code>@dxbjavid</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> </ul> <p><a href="https://pypi.org/project/filelock/4.2.7/";>PyPI release</a></p> <p><a href="https://github.com/tox-dev/filelock/compare/4.2.6...4.2.7";>Full Changelog</a></p> <h2>4.2.6</h2> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h3>Bug fixes</h3> <ul> <li>Fix a race in <code>SoftFileLock</code>, <code>MarkerSoftFileLock</code> and <code>SoftFileLease</code> when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (<a href="https://redirect.github.com/tox-dev/filelock/pull/899";>#899</a>) by <a href="https://github.com/dxbjavid";><code>@dxbjavid</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> </ul> <p><a href="https://pypi.org/project/filelock/4.2.6/";>PyPI release</a></p> <p><a href="https://github.com/tox-dev/filelock/compare/4.2.5...4.2.6";>Full Changelog</a></p> <h2>4.2.5</h2> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h3>Bug fixes</h3> <ul> <li><code>acquire</code> and <code>acquire</code> raise <code>TypeError</code> for a <em>blocking</em> that is not a <code>bool</code>, as the constructor and the <code>blocking</code> setter already do. A truthy value such as the string <code>"false"</code> used to count as <code>True</code>, so a call meant as a single attempt waited for the instance's <code>timeout</code>, and without a limit at the default <code>-1</code> (<a href="https://redirect.github.com/tox-dev/filelock/pull/870";>#870</a>) by <a href="https://github.com/simpleqt";><code>@simpleqt</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> <li>A <code>SoftFileLock</code> acquisition whose first read of its new marker's identity failed reads it again before rolling back. On Windows the rollback could otherwise not recognize the marker it had created, and the empty marker it left blocked the path for every later acquisition, since no contender breaks an empty marker (<a href="https://redirect.github.com/tox-dev/filelock/pull/869";>#869</a>) by <a href="https://github.com/simpleqt";><code>@simpleqt</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> <li>A <code>fork()</code> child of a process holding a <code>SoftFileLease</code> starts from an unheld claim. It used to inherit the parent's token, last compromise and heartbeat, so <code>token</code> and <code>compromise</code> reported a claim the child never held while <code>is_locked</code> reported it unheld (<a href="https://redirect.github.com/tox-dev/filelock/pull/868";>#868</a>) by <a href="https://github.com/dxbjavid";><code>@dxbjavid</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> <li>A nested acquire of a held <code>FileLock</code> or <code>SoftFileLock</code> no longer creates the lock file's parent directory. After a rename of that directory during the hold, the nested acquire recreated the old name, and when a file had taken the name it raised <code>FileExistsError</code> and left the hold's recursion count incremented (<a href="https://redirect.github.com/tox-dev/filelock/pull/878";>#878</a>) by <a href="https://github.com/0x5t4l1n";><code>@0x5t4l1n</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> <li>Fix <code>ReadWriteLock</code> failing every acquire with "link directory ... was replaced while opening" in a group-writable directory whose inherited ACL, such as an NFSv4 one on ZFS, opens the link directory to the group. The lock now closes the empty link directory to its owner, and where the filesystem refuses that, such as ZFS with <code>aclmode=restricted</code>, it names the directory to make writable by its owner only (<a href="https://redirect.github.com/tox-dev/filelock/pull/898";>#898</a>) by <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> <li>Fix <code>SoftFileLock</code>, <code>MarkerSoftFileLock</code> and <code>SoftFileLease</code> raising <code>OverflowError</code> out of <code>acquire()</code>, or never reclaiming a dead holder's lock, when a stranded restore claim beside the lock names a process number outside <code>1..2**31-1</code> or spells it in non-ASCII digits. Such a claim is now ignored, as no filelock writes one (<a href="https://redirect.github.com/tox-dev/filelock/pull/871";>#871</a>) by <a href="https://github.com/dxbjavid";><code>@dxbjavid</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> <li>Fix soft locks on Windows keeping the marker of a holder that has exited while another process still holds a handle to it, such as a parent's <code>subprocess.Popen</code> after <code>wait()</code> or <code>multiprocessing.Process</code> after <code>join()</code>. Acquiring such a lock with the default <code>timeout=-1</code> waited forever (<a href="https://redirect.github.com/tox-dev/filelock/pull/874";>#874</a>) by <a href="https://github.com/nk-batman21";><code>@nk-batman21</code></a>.</li> <li>Fix the read-only reopen of a lock file this account cannot write resolving a relative path against the working directory of the moment. A <code>chdir</code> between the refused <code>O_RDWR</code> open and the reopen made the acquisition wait on a file that is not there, or probe one in another directory. The reopen now uses the path the acquisition pinned (<a href="https://redirect.github.com/tox-dev/filelock/pull/889";>#889</a>) by <a href="https://github.com/dxbjavid";><code>@dxbjavid</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> <li>Handle <code>EMLINK</code>, the error FreeBSD reports when a no-follow open refuses a symlink, in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership there rather than a transient refresh error (<a href="https://redirect.github.com/tox-dev/filelock/pull/866";>#866</a>) by <a href="https://github.com/pacocartones";><code>@pacocartones</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> <li>Resolving <code>ReadWriteLock</code> or <code>AsyncReadWriteLock</code> raises the <code>ImportError</code> when a module other than Python's <code>sqlite3</code> is missing, as in a frozen application that left out a filelock submodule. The names are <code>None</code> only without SQLite (<a href="https://redirect.github.com/tox-dev/filelock/pull/880";>#880</a>) by <a href="https://github.com/pintu544";><code>@pintu544</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h3>Documentation</h3> <ul> <li>The lock-probing recipe in the how-to guide probes with <code>blocking=False</code> instead of a tiny <code>timeout</code> (<a href="https://redirect.github.com/tox-dev/filelock/pull/873";>#873</a>) by <a href="https://github.com/tongwentao";><code>@tongwentao</code></a> and <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h3>Packaging</h3> <ul> <li>Releases now run on the shared tox-dev/github-workflows pipeline, with a locked release toolchain and generated GitHub Release notes (<a href="https://redirect.github.com/tox-dev/filelock/pull/885";>#885</a>) by <a href="https://github.com/gaborbernat";><code>@gaborbernat</code></a>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst";>filelock's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <p>.. towncrier-draft-entries:: Unreleased</p> <p>.. towncrier release notes start</p> <p>.. _release-4-2-9:</p> <hr /> <p>4.2.9 (2026-11-04)</p> <hr /> <p>.. _release-4-2-9-fixed:</p> <h1>Fixed</h1> <ul> <li>:class:<code>~filelock.ReadWriteLock</code>, :class:<code>~filelock.SoftReadWriteLock</code> and their async wrappers now raise :class:<code>TypeError</code> for a <em>blocking</em> that is not a :class:<code>bool</code>, in the constructor and on acquire, as :class:<code>~filelock.FileLock</code> already does. Before, <code>blocking=0</code> waited out the full timeout on a contended :class:<code>~filelock.ReadWriteLock</code> while <code>blocking=False</code> failed at once, and a truthy value such as <code>"false"</code> turned a single attempt into a blocking wait (:pr:<code>908</code>) by :user:<code>abhishekcpp007</code> and :user:<code>gaborbernat</code>.</li> </ul> <p>.. _release-4-2-8:</p> <hr /> <p>4.2.8 (2026-11-04)</p> <hr /> <p>.. _release-4-2-8-documentation:</p> <h1>Documentation</h1> <ul> <li>Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (:pr:<code>905</code>) by :user:<code>boyfeiyu</code>.</li> </ul> <p>.. _release-4-2-7:</p> <hr /> <p>4.2.7 (2026-11-02)</p> <hr /> <p>.. _release-4-2-7-fixed:</p> <h1>Fixed</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/filelock/commit/5fd486b3a45864d7c39081bd3d2905321c7f6640";><code>5fd486b</code></a> release 4.2.7</li> <li><a href="https://github.com/tox-dev/filelock/commit/ff847352b212753800ee74494ad67e78673dcfdf";><code>ff84735</code></a> 🐛 fix(lease): reclaim dead holders after duration changes (<a href="https://redirect.github.com/tox-dev/filelock/issues/900";>#900</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/f71acb14b202e1fd76282ea8cb2de6ce86a18a23";><code>f71acb1</code></a> release 4.2.6</li> <li><a href="https://github.com/tox-dev/filelock/commit/77eb01a21ce842659e7beb9fd50a3dc935647416";><code>77eb01a</code></a> 🐛 fix(soft): restore raced stale markers (<a href="https://redirect.github.com/tox-dev/filelock/issues/899";>#899</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/b0cc0073cae88ae8c9c4364184e3f507d4348bd2";><code>b0cc007</code></a> release 4.2.5</li> <li><a href="https://github.com/tox-dev/filelock/commit/21bc250542497ff2d74151cdf7f98069d929465a";><code>21bc250</code></a> 🐛 fix(rw): close a link directory an ACL opened (<a href="https://redirect.github.com/tox-dev/filelock/issues/898";>#898</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/715a8deed5fd1158f1e08cf303d192307ddb9252";><code>715a8de</code></a> 📝 docs(security): add a threat model and align the policy (<a href="https://redirect.github.com/tox-dev/filelock/issues/896";>#896</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/b0f1b73b3f2e87764a0b75ec176ca758689ff123";><code>b0f1b73</code></a> 🧪 test: tolerate a preloaded sqlite3 (<a href="https://redirect.github.com/tox-dev/filelock/issues/894";>#894</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/a2e26ac210162b7e5e701e36fbbf5630fa492435";><code>a2e26ac</code></a> 🧪 test: count descriptors behind an incomplete /dev/fd (<a href="https://redirect.github.com/tox-dev/filelock/issues/877";>#877</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/160141c4733b5320aec3617c0c761b040164445c";><code>160141c</code></a> 🐛 fix(import): raise for a missing read-write module (<a href="https://redirect.github.com/tox-dev/filelock/issues/880";>#880</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tox-dev/filelock/compare/4.2.4...4.2.7";>compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.5.7 to 0.5.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases";>prek's releases</a>.</em></p> <blockquote> <h2>0.5.9</h2> <h2>Release Notes</h2> <p>Released on 2026-10-30.</p> <h3>Enhancements</h3> <ul> <li>Add <code>normalize-indentation</code> builtin hook (<a href="https://redirect.github.com/j178/prek/pull/2967";>#2967</a>)</li> <li>Allow overriding the uv install version (<a href="https://redirect.github.com/j178/prek/pull/2923";>#2923</a>)</li> <li>Embed dependency metadata in release binaries (<a href="https://redirect.github.com/j178/prek/pull/2976";>#2976</a>)</li> <li>Select musl Bun builds when glibc is unavailable (<a href="https://redirect.github.com/j178/prek/pull/2972";>#2972</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Improve workspace discovery performance (<a href="https://redirect.github.com/j178/prek/pull/2936";>#2936</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve clean-filtered files during stashing (<a href="https://redirect.github.com/j178/prek/pull/2915";>#2915</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178";><code>@j178</code></a></li> <li><a href="https://github.com/tchernobog";><code>@tchernobog</code></a></li> </ul> <h2>Install prek 0.5.9</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.ps1 | iex" </code></pre> <h3>Install prebuilt binaries via Homebrew</h3> <pre lang="sh"><code>brew install prek </code></pre> <h2>Download prek 0.5.9</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz";>prek-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz.sha256";>checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/main/CHANGELOG.md";>prek's changelog</a>.</em></p> <blockquote> <h2>0.5.9</h2> <p>Released on 2026-10-30.</p> <h3>Enhancements</h3> <ul> <li>Add <code>normalize-indentation</code> builtin hook (<a href="https://redirect.github.com/j178/prek/pull/2967";>#2967</a>)</li> <li>Allow overriding the uv install version (<a href="https://redirect.github.com/j178/prek/pull/2923";>#2923</a>)</li> <li>Embed dependency metadata in release binaries (<a href="https://redirect.github.com/j178/prek/pull/2976";>#2976</a>)</li> <li>Select musl Bun builds when glibc is unavailable (<a href="https://redirect.github.com/j178/prek/pull/2972";>#2972</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Improve workspace discovery performance (<a href="https://redirect.github.com/j178/prek/pull/2936";>#2936</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve clean-filtered files during stashing (<a href="https://redirect.github.com/j178/prek/pull/2915";>#2915</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178";><code>@j178</code></a></li> <li><a href="https://github.com/tchernobog";><code>@tchernobog</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/48c8a3ec465a8e98bb8b5b88c8bfacaca84cf84b";><code>48c8a3e</code></a> Bump version to 0.5.9</li> <li><a href="https://github.com/j178/prek/commit/9f23bb8204f8a9be707966c5803e5c16d65b0f80";><code>9f23bb8</code></a> Bump version to 0.5.8 (<a href="https://redirect.github.com/j178/prek/issues/2978";>#2978</a>)</li> <li><a href="https://github.com/j178/prek/commit/b209d5399481cac5385c2895df8d4df56d534790";><code>b209d53</code></a> Bump dependencies (<a href="https://redirect.github.com/j178/prek/issues/2977";>#2977</a>)</li> <li><a href="https://github.com/j178/prek/commit/e935fd611556a708c30429c2762dd97af2b08ca8";><code>e935fd6</code></a> Embed dependency metadata in release binaries (<a href="https://redirect.github.com/j178/prek/issues/2976";>#2976</a>)</li> <li><a href="https://github.com/j178/prek/commit/7ca1efa86853c0b2124cef23dd7921cfba61a3ee";><code>7ca1efa</code></a> Select musl Bun builds when glibc is unavailable (<a href="https://redirect.github.com/j178/prek/issues/2972";>#2972</a>)</li> <li><a href="https://github.com/j178/prek/commit/69b23d8c04c9c42ca0d93bf39140b0b9403fa62d";><code>69b23d8</code></a> Detect available glibc and musl runtimes (<a href="https://redirect.github.com/j178/prek/issues/2975";>#2975</a>)</li> <li><a href="https://github.com/j178/prek/commit/08098ac39c258bf582c3458eba9378dbe0f1d8e4";><code>08098ac</code></a> Add <code>normalize-indentation</code> builtin hook (<a href="https://redirect.github.com/j178/prek/issues/2967";>#2967</a>)</li> <li><a href="https://github.com/j178/prek/commit/aa757d3871eccf0acc6113c4ee296f3120b0889f";><code>aa757d3</code></a> Revert "Add expand-tabs builtin hook (<a href="https://redirect.github.com/j178/prek/issues/2918";>#2918</a>)" (<a href="https://redirect.github.com/j178/prek/issues/2968";>#2968</a>)</li> <li><a href="https://github.com/j178/prek/commit/310a66f0b2e7c4174bfd71281a02132356b9ce2e";><code>310a66f</code></a> Lock mise development tool versions (<a href="https://redirect.github.com/j178/prek/issues/2965";>#2965</a>)</li> <li><a href="https://github.com/j178/prek/commit/36f4502f808c69ddd3729440db82e045cf2fb600";><code>36f4502</code></a> Report precise cargo-bloat sizes and symbol changes (<a href="https://redirect.github.com/j178/prek/issues/2963";>#2963</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.5.7...v0.5.9";>compare view</a></li> </ul> </details> <br /> Updates `boto3` from 1.43.121 to 1.43.123 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/boto/boto3/commit/6334d9fe689238b537caa35ee960abd15d356bb0";><code>6334d9f</code></a> Merge branch 'release-1.43.123'</li> <li><a href="https://github.com/boto/boto3/commit/51224ed93cf0772b7dea74735e70625bfb8b69bf";><code>51224ed</code></a> Bumping version to 1.43.123</li> <li><a href="https://github.com/boto/boto3/commit/3dfd2b6acb4dcbc6128e912196d34d596e5aa073";><code>3dfd2b6</code></a> Add changelog entries from botocore</li> <li><a href="https://github.com/boto/boto3/commit/f89caef1da6ee10114a3f71455a2d4e801ac951c";><code>f89caef</code></a> Merge branch 'release-1.43.122'</li> <li><a href="https://github.com/boto/boto3/commit/f0464ef1e875c0958bc734dd7d368306fa3e3f1a";><code>f0464ef</code></a> Merge branch 'release-1.43.122' into develop</li> <li><a href="https://github.com/boto/boto3/commit/5af8c5fcc5f9c4a6751b4b7dd979f4c08daa2e24";><code>5af8c5f</code></a> Bumping version to 1.43.122</li> <li><a href="https://github.com/boto/boto3/commit/1af5d4770fef4db0ad7b0c837ca6e9f89795cedd";><code>1af5d47</code></a> Add changelog entries from botocore</li> <li><a href="https://github.com/boto/boto3/commit/807ecf82324a46c9b75c9135c24205a4bd16bfab";><code>807ecf8</code></a> Merge branch 'release-1.43.121' into develop</li> <li>See full diff in <a href="https://github.com/boto/boto3/compare/1.43.121...1.43.123";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
