Bump pdm from 2.6.1 to 2.7.0

[dependabot]

Bumps pdm from 2.6.1 to 2.7.0.

Release notes

Sourced from pdm's releases.

v2.7.0

Features & Improvements

• When keyring is available, either by importing or by CLI, the credentials of repositories and PyPI indexes will be saved into it. #1908
• Add support for reading metadata from simple index directly. #1919
• Add a configuration to specify constant command arguments for every pdm invocation. #1923
• Add ability to skip SSL verification for publish repositories via repository.custom.verify_ssl config option as well as new command line argument of publish command. #1928
• Use lazy import to reduce the startup time of the CLI. #1929
• Add the local plugin scripts to PATH env var. #1944

Bug Fixes

• Don't use install cache when installing build requirements to avoid race condition. #1869
• Fix a number of ResourceWarnings when running the test suite with warnings enabled. #1915
• Fix a bug that dev-dependencies group gets updated with the optional dependencies, causing the hash mismatch. #1916
• Fix format conversion error from Poetry when tool.poetry.build doesn't exist. #1935
• Add timeout when fetching .gitignore from GitHub. #1937
• Keep the variables in the URL credentials when exporting. #1939
• Convert to boolean when setting verify_ssl for custom indexes. #1945
• pdm import clobbers build-system.requires value in pyproject.toml. #1948

Documentation

• Update publish.md to use run instead of runs to match GitHub Actions steps documentation #1936
• Update advanced.md to use pdm sync instead of pdm install --no-lock. #1947

Changelog

Sourced from pdm's changelog.

Release v2.7.0 (2023-05-29)

Features & Improvements

• When keyring is available, either by importing or by CLI, the credentials of repositories and PyPI indexes will be saved into it. #1908
• Add support for reading metadata from simple index directly. #1919
• Add a configuration to specify constant command arguments for every pdm invocation. #1923
• Add ability to skip SSL verification for publish repositories via repository.custom.verify_ssl config option as well as new command line argument of publish command. #1928
• Use lazy import to reduce the startup time of the CLI. #1929
• Add the local plugin scripts to PATH env var. #1944

Bug Fixes

• Don't use install cache when installing build requirements to avoid race condition. #1869
• Fix a number of ResourceWarnings when running the test suite with warnings enabled. #1915
• Fix a bug that dev-dependencies group gets updated with the optional dependencies, causing the hash mismatch. #1916
• Fix format conversion error from Poetry when tool.poetry.build doesn't exist. #1935
• Add timeout when fetching .gitignore from GitHub. #1937
• Keep the variables in the URL credentials when exporting. #1939
• Convert to boolean when setting verify_ssl for custom indexes. #1945
• pdm import clobbers build-system.requires value in pyproject.toml. #1948

Documentation

• Update publish.md to use run instead of runs to match GitHub Actions steps documentation #1936
• Update advanced.md to use pdm sync instead of pdm install --no-lock. #1947

Commits

• 168ddcd chore: Release 2.7.0
• 2d6f4c7 feat: add --no-verify-ssl option to publish command
• c906c7f feat: An option to specify constant command arguments via pyproject.toml (#1959)
• c8099a9 feat: Add repository config verify ssl (#1954)
• ac63d76 doc: list repository configs in config list
• d78a7e2 doc(advanced): use pdm sync instead of pdm install --no-lock (#1947)
• 86306bb fix: pdm import clobbers build-system.requires value in pyproject.toml ...
• 4ab8292 fix: convert to boolean when setting verify_ssl for custom indexes (#1949)
• 1638e62 feat: add local plugin scripts to PATH env (#1944)
• 29518e4 fix: replace cachecontrol with cacheyou
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

Patch and project coverage have no change.

Comparison is base (4af9059) 99.69% compared to head (91079b8) 99.69%.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1612   +/-   ##
=======================================
  Coverage   99.69%   99.69%           
=======================================
  Files          71       71           
  Lines        4940     4940           
  Branches      646      646           
=======================================
  Hits         4925     4925           
  Misses         13       13           
  Partials        2        2           

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.