Bump wheel from 0.47.0 to 0.48.0

[dependabot]

Bumps wheel from 0.47.0 to 0.48.0.

Release notes

Sourced from wheel's releases.

0.48.0

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel (#570)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions (#643)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (#692)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw)

Changelog

Sourced from wheel's changelog.

Release Notes

UNRELEASED

• Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target ([#697](https://github.com/pypa/wheel/issues/697) <https://github.com/pypa/wheel/pull/697>_)

0.48.0 (2026-08-12)

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel ([#570](https://github.com/pypa/wheel/issues/570) <https://github.com/pypa/wheel/issues/570>_)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions ([#643](https://github.com/pypa/wheel/issues/643) <https://github.com/pypa/wheel/issues/643>_)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header ([#692](https://github.com/pypa/wheel/issues/692) <https://github.com/pypa/wheel/issues/692>_)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw>_)

0.47.0 (2026-04-22)

• Added the wheel info subcommand to display metadata about wheel files without unpacking them ([#639](https://github.com/pypa/wheel/issues/639) <https://github.com/pypa/wheel/issues/639>_)
• Fixed WheelFile raising Missing RECORD file when the wheel filename contains uppercase characters (e.g. Django-3.2.5.whl) but the .dist-info directory inside uses normalized lowercase naming ([#411](https://github.com/pypa/wheel/issues/411) <https://github.com/pypa/wheel/issues/411>_)

0.46.3 (2026-01-22)

• Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command ([#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676>_)

0.46.2 (2026-01-22)

• Restored the bdist_wheel command for compatibility with setuptools older than v70.1
• Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning
• Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1 (2025-04-08)

... (truncated)

Commits

• 21c4da4 Fixed the release heading format
• f06d4db Flit no longer supports --setup-py
• 1a96c3e Created a new release
• d7d625d Fixed wheel convert writing outside the target directory on malicious input (...
• 986a440 Strip ZIP64 extra field when retagging wheels (#692) (#695)
• 0ca6f24 feat: add --local-version option to wheel pack (#694)
• 4a63caf Preserve compatible metadata versions in convert (#690)
• 33650c6 [pre-commit.ci] pre-commit autoupdate (#691)
• 197012d Increased the upper bound for flit-core as a build requirement
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

Review Summary

PR: Bump wheel from 0.47.0 → 0.48.0 in pyproject.toml (dependabot).

Code Quality

• ✅ Single-line version pin change, follows TOML formatting conventions, consistent with other dependency entries in pyproject.toml:47.
• ✅ No commented-out code.
• ✅ N/A — no new variables/logic introduced.
• ✅ N/A — no duplication concerns for a version bump.
• ✅ No defects identified. wheel is a development-group build dependency, not a runtime dependency, so blast radius is limited to packaging/build steps.
• ✅ .claude/CLAUDE.md reviewed — general project guidance, no local-environment-specific content, nothing this PR affects.

Testing

• ✅ N/A — no new functions or endpoints; this is a dependency version bump.

Documentation

• ✅ CHANGELOG.md not updated, but this is consistent with prior dependency-bump commits in this repo's history (e.g. 054c58b, 70fede2, 8ad2f27) which also did not touch CHANGELOG.md — established project convention for dependabot PRs.
• ✅ No README/API doc changes needed.

Security

• ✅ No hardcoded credentials.
• ✅ N/A — no input handling changed.
• ✅ N/A — no error handling changed.
• ✅ No sensitive data introduced.
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff.

Verdict: No issues found. This is a low-risk, routine dependency version bump consistent with the repository's existing Dependabot update pattern.

Automated code review analyzing defects and coding standards