build(deps): bump wheel from 0.47.0 to 0.48.0

[dependabot]

Bumps wheel from 0.47.0 to 0.48.0.

Release notes

Sourced from wheel's releases.

0.48.0

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel (#570)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions (#643)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (#692)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw)

Changelog

Sourced from wheel's changelog.

Release Notes

UNRELEASED

• Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target ([#697](https://github.com/pypa/wheel/issues/697) <https://github.com/pypa/wheel/pull/697>_)

0.48.0 (2026-08-12)

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel ([#570](https://github.com/pypa/wheel/issues/570) <https://github.com/pypa/wheel/issues/570>_)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions ([#643](https://github.com/pypa/wheel/issues/643) <https://github.com/pypa/wheel/issues/643>_)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header ([#692](https://github.com/pypa/wheel/issues/692) <https://github.com/pypa/wheel/issues/692>_)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw>_)

0.47.0 (2026-04-22)

• Added the wheel info subcommand to display metadata about wheel files without unpacking them ([#639](https://github.com/pypa/wheel/issues/639) <https://github.com/pypa/wheel/issues/639>_)
• Fixed WheelFile raising Missing RECORD file when the wheel filename contains uppercase characters (e.g. Django-3.2.5.whl) but the .dist-info directory inside uses normalized lowercase naming ([#411](https://github.com/pypa/wheel/issues/411) <https://github.com/pypa/wheel/issues/411>_)

0.46.3 (2026-01-22)

• Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command ([#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676>_)

0.46.2 (2026-01-22)

• Restored the bdist_wheel command for compatibility with setuptools older than v70.1
• Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning
• Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1 (2025-04-08)

... (truncated)

Commits

• 21c4da4 Fixed the release heading format
• f06d4db Flit no longer supports --setup-py
• 1a96c3e Created a new release
• d7d625d Fixed wheel convert writing outside the target directory on malicious input (...
• 986a440 Strip ZIP64 extra field when retagging wheels (#692) (#695)
• 0ca6f24 feat: add --local-version option to wheel pack (#694)
• 4a63caf Preserve compatible metadata versions in convert (#690)
• 33650c6 [pre-commit.ci] pre-commit autoupdate (#691)
• 197012d Increased the upper bound for flit-core as a build requirement
• See full diff in compare view