chore(deps): bump the python-dependencies group with 3 updates

[dependabot]

Bumps the python-dependencies group with 3 updates: filelock, pytest-bdd and msgpack.

Updates filelock from 4.0.3 to 4.0.7

Release notes

Sourced from filelock's releases.

4.0.7

What's Changed

• 🐛 fix(mode): require owner read and write by @​gaborbernat in tox-dev/filelock#760

Full Changelog: tox-dev/filelock@4.0.6...4.0.7

4.0.6

What's Changed

• fix(read-write): validate reentrant timeouts by @​feiiiiii5 in tox-dev/filelock#756

Full Changelog: tox-dev/filelock@4.0.5...4.0.6

4.0.5

What's Changed

• fix(marker): preserve live owners by @​DawnofGenX in tox-dev/filelock#751
• fix(tests): separate mode and access checks by @​pasmud in tox-dev/filelock#753
• fix(read-write): honor instance defaults by @​DawnofGenX in tox-dev/filelock#752
• fix(async): validate blocking read-write timeouts by @​pasmud in tox-dev/filelock#755
• fix(strict): handle vanished unreadable claims by @​januththedev in tox-dev/filelock#754

New Contributors

• @​DawnofGenX made their first contribution in tox-dev/filelock#751
• @​pasmud made their first contribution in tox-dev/filelock#753
• @​januththedev made their first contribution in tox-dev/filelock#754

Full Changelog: tox-dev/filelock@4.0.4...4.0.5

4.0.4

What's Changed

• 🐛 fix(identity): digest the cut tail of long hostnames by @​feiiiiii5 in tox-dev/filelock#748

New Contributors

• @​feiiiiii5 made their first contribution in tox-dev/filelock#748

Full Changelog: tox-dev/filelock@4.0.3...4.0.4

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.12 (2026-10-05)

---

• Fix read-lock acquisition on SQLite versions older than 3.33.0 by using sqlite_master for the schema probe. :pr:769

---

4.0.11 (2026-10-05)

---

• ReadWriteLock and AsyncReadWriteLock use a validated private hard link when /dev/fd has no entry for the database descriptor, supporting NetBSD's static descriptor directory beyond descriptor 63. The temporary location must share a filesystem with the database. The symlink refusal test accepts NetBSD's error wording.

---

4.0.10 (2026-10-03)

---

• Reusing a singleton AsyncFileLock with another loop, executor or run_in_executor, or a singleton SoftFileLease with another lease_duration, heartbeat_interval or on_compromise, now raises ValueError instead of returning the lock with its original options. :pr:765

---

4.0.9 (2026-10-01)

---

• ReadWriteLock and AsyncReadWriteLock close the descriptor that checks the database path once SQLite has connected, so on PyPy a dropped lock leaves no descriptor open until garbage collection runs. :pr:763
• ReadWriteLock and AsyncReadWriteLock refuse a symlink at the database path instead of following it, so a user who can create names in a shared lock directory cannot point the lock at another file (GHSA-j8f7-rjxc-mr56).

---

4.0.8 (2026-10-01)

---

• ReadWriteLock.release() and SoftReadWriteLock.release() from a thread that does not hold the write lock now raise RuntimeError instead of dropping the holder's lock and letting a second writer in. :pr:761

---

4.0.7 (2026-09-29)

---

... (truncated)

Commits

• 9ed62ac Release 4.0.7
• 2f2c4a7 🐛 fix(mode): require owner read and write (#760)
• d4ffe9c build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
• 61ce360 Release 4.0.6
• d9dedd5 [pre-commit.ci] pre-commit autoupdate (#757)
• b5fae95 fix(read-write): validate reentrant timeouts (#756)
• bbb843e Release 4.0.5
• 83fa216 test(read-write): cover omitted arguments (#754)
• aaa26f2 fix(async): validate blocking read-write timeouts (#755)
• 218e49e fix(read-write): honor instance defaults (#752)
• Additional commits viewable in compare view

Updates pytest-bdd from 8.1.0 to 9.0.0

Changelog

Sourced from pytest-bdd's changelog.

[9.0.0] - 2026-09-30

Added +++++

Changed +++++++

• Relaxed gherkin-official dependency requirement to >=29.0.0 to allow for newer versions of the gherkin-official package.
• Excluded gherkin-official 31.0.0 and 32.0.0, which crash with StopIteration when parsing empty descriptions (fixed upstream in 32.0.1).
• The --gherkin-terminal-reporter incompatibility errors (with another terminal reporter or with xdist) are now raised as pytest.UsageError instead of a bare Exception.

Deprecated ++++++++++

Removed +++++++

• Dropped support for python 3.9 (end-of-life, and its locked dev dependencies had unfixable security alerts). Supported python versions: 3.10, 3.11, 3.12, 3.13, 3.14.
• The following private attributes are not available anymore ([#658](https://github.com/pytest-dev/pytest-bdd/issues/658) <https://github.com/pytest-dev/pytest-bdd/pull/658>_):
  • _pytest.reports.TestReport.scenario; replaced by pytest_bdd.reporting.test_report_context WeakKeyDictionary (internal use)
  • __scenario__ attribute of test functions generated by the @scenario (and @scenarios) decorator; replaced by pytest_bdd.scenario.scenario_wrapper_template_registry WeakKeyDictionary (internal use)
  • _pytest.nodes.Item.__scenario_report__; replaced by pytest_bdd.reporting.scenario_reports_registry WeakKeyDictionary (internal use)
  • _pytest_bdd_step_context attribute of internal test function markers; replaced by pytest_bdd.steps.step_function_context_registry WeakKeyDictionary (internal use)

Fixed +++++

• Backslashes in datatable and examples table cells are no longer over-quoted. A cell containing a single backslash now reaches the step as a single backslash, matching the Gherkin escaping rules. If you compensated by doubling backslashes in feature files, undo that. [#769](https://github.com/pytest-dev/pytest-bdd/issues/769) <https://github.com/pytest-dev/pytest-bdd/issues/769>_
• Made type annotations stronger and removed most of the typing.Any usages and # type: ignore annotations. [#658](https://github.com/pytest-dev/pytest-bdd/issues/658) <https://github.com/pytest-dev/pytest-bdd/pull/658>_
• Empty docstrings are now correctly forwarded to step functions as an empty string instead of being silently dropped, which previously caused pytest to report a missing docstring fixture. [#809](https://github.com/pytest-dev/pytest-bdd/issues/809) <https://github.com/pytest-dev/pytest-bdd/issues/809>_
• Injecting a target_fixture no longer emits PytestRemovedIn10Warning on pytest 9.1+, which deprecated passing nodeid to _register_fixture. [#823](https://github.com/pytest-dev/pytest-bdd/issues/823) <https://github.com/pytest-dev/pytest-bdd/issues/823>_

Security ++++++++

Commits

• c6cea53 Bump to version 9.0.0
• 9eb8a78 Merge pull request #836 from pytest-dev/ruff-extend-select
• 75c12e6 Don't require xdist to test the xdist incompatibility error
• 673bddc Test gherkin-terminal-reporter incompatibility usage errors
• c352767 Use ruff lint.extend-select to keep ruff's default rules
• f67096a [pre-commit.ci] pre-commit autoupdate (#826)
• 33b2b30 Merge pull request #834 from pytest-dev/switch-to-uv
• e0346d3 Reintroduce license
• 38d6b2f Update CI configuration to use --only-group flag for twine commands
• f120acf Migrate project from Poetry to UV for dependency management and build processes
• Additional commits viewable in compare view

Updates msgpack from 1.2.2 to 1.2.3

Release notes

Sourced from msgpack's releases.

v1.2.3

What's Changed

• Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.
• wheels: also build for pyodide using emscripten. by @​mr-c in msgpack/msgpack-python#732
• Support packing Python 3.15 frozentdict (PEP 814) by @​edgarrmondragon in msgpack/msgpack-python#738
• Reject negative array and map header sizes by @​jakezwang in msgpack/msgpack-python#742
• Bump the all-dependencies group across 1 directory with 2 updates by @​dependabot[bot] in msgpack/msgpack-python#741

New Contributors

• @​mr-c made their first contribution in msgpack/msgpack-python#732
• @​jakezwang made their first contribution in msgpack/msgpack-python#742

Full Changelog: msgpack/msgpack-python@v1.2.2...v1.2.3

Changelog

Sourced from msgpack's changelog.

1.2.3

Release Date: 2026-09-29

• Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.
• Fix use-after-free errors when cleaning up an incomplete or failed Unpacker.skip() after previously unpacking a nested object in the C extension.
• Raise ValueError in the C extension when switching between unpacking, skipping, header readers, or read_bytes() while an object is incomplete. Resume with the same method after feeding more data; unpack() and iteration remain interchangeable.
• Prevent reentrant unpacking, header reads, read_bytes(), and reinitialization of the same C Unpacker while unpacking is in progress.
• Reject negative sizes in Packer.pack_array_header() and Packer.pack_map_header(). #742
• Support packing Python 3.15 frozendict objects. #738
• Update Cython from 3.2.5 to 3.3.0. #738
• Build wheels for Pyodide using Emscripten. #732
• Update cibuildwheel to 4.2.1 and the QEMU setup action to 4.4.0. #741

Commits

• 742cb6d release v1.2.3
• 620b0eb Merge commit from fork
• 475c1b7 Bump the all-dependencies group across 1 directory with 2 updates (#741)
• 0014ca9 Reject negative array and map header sizes (#742)
• 7a63920 Support packing Python 3.15 frozentdict (PEP 814) (#738)
• 9f4909c wheels: also build for pyodide using emscripten. (#732)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Preview Links

Website	Validation Report
https://posit-dev.github.io/vip/pr-preview-site/pr-766/	https://posit-dev.github.io/vip/pr-preview/pr-766/