0.8.3

Release notes for pymetadata 0.8.3

Security

• The lock of the development environment, uv.lock, has filelock 4.2.6 instead of 4.1.0 (#111), which fixes the advisories of filelock before 4.2.1 (GHSA-2g95-wg33-c5x2, GHSA-v4x8-3wr5-3wq8, GHSA-crv4-6mhj-j5jh and 14 more). filelock reaches only the development environment, through tox, virtualenv and python-discovery, so the dependencies of pymetadata are unchanged. virtualenv moves from 21.14.12 to 21.15.2.

Dependencies

• The lock moves to the newest releases (#110, #111), among them certifi 2026.10.23, pydantic 2.14.2, pronto 2.7.4, ruff 0.17.3, ty 0.0.95, pytest 9.2.0, zensical 0.0.74 and mkdocstrings-python 2.0.10. The lower bounds in pyproject.toml are unchanged.

Development

• The dev extra excludes tox 4.67.5 (tox>=4.61.2,!=4.67.5), the lock keeps tox 4.67.4 (#111). tox 4.67.5 refuses its package staging directory when tox created it under umask 002, so every environment of tox run-parallel in a fresh checkout fails with an internal error (tox-dev/tox#4357).
• The pre-commit hooks of ruff and ty follow the locked versions, ruff 0.17.3 and ty 0.0.95 (#111).
• Continuous integration uses astral-sh/setup-uv 10.3.3 (#109).

Your pymetadata team