Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pytest-cov (changelog)	==7.0.0 → ==7.1.0
tox (changelog)	==4.50.1 → ==4.50.3
uv_build (source, changelog)	>=0.10.11,<0.11.0 → >=0.11.0,<0.12.0
werkzeug (changelog)	==3.1.6 → ==3.1.7

---

Release Notes

pytest-dev/pytest-cov (pytest-cov)

v7.1.0

Compare Source

• Fixed total coverage computation to always be consistent, regardless of reporting settings.
  Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on
  reporting options.
  See #&#8203;641 <https://github.com/pytest-dev/pytest-cov/issues/641>_.

• Improve handling of ResourceWarning from sqlite3.

  The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0).
  It checks if there is already existing plugin for this message by comparing filter regular expression.
  When filter is specified on command line the message is escaped and does not match an expected message.
  A check for an escaped regular expression is added to handle this case.

  With this fix one can suppress ResourceWarning from sqlite3 from command line::

  pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

• Various improvements to documentation.
  Contributed by Art Pelling in #&#8203;718 <https://github.com/pytest-dev/pytest-cov/pull/718>_ and
  "vivodi" in #&#8203;738 <https://github.com/pytest-dev/pytest-cov/pull/738>.
  Also closed #&#8203;736 <https://github.com/pytest-dev/pytest-cov/issues/736>.

• Fixed some assertions in tests.
  Contributed by in Markéta Machová in #&#8203;722 <https://github.com/pytest-dev/pytest-cov/pull/722>_.

• Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

tox-dev/tox (tox)

v4.50.3

Compare Source

What's Changed

• 🐛 fix(pkg): distinguish free-threaded Python in wheel build env by @​gaborbernat in #​3891

Full Changelog: tox-dev/tox@4.50.2...4.50.3

v4.50.2

Compare Source

What's Changed

• fix(sdist): include docs/man/tox.1.rst by @​branchv in #​3890

New Contributors

• @​branchv made their first contribution in #​3890

Full Changelog: tox-dev/tox@4.50.1...4.50.2

astral-sh/uv (uv_build)

v0.11.0

Compare Source

Released on 2026-03-23.

Breaking changes

This release includes changes to the networking stack used by uv. While we think that breakage will be rare, it is possible that these changes will result in the rejection of certificates previously trusted by uv so we have marked the change as breaking out of an abundance of caution.

The changes are largely driven by the upgrade of reqwest, which powers uv's HTTP clients, to v0.13 which included some breaking changes to TLS certificate verification.

The following changes are included:

• rustls-platform-verifier is used instead of rustls-native-certs and webpki for certificate verification

  This change should have no effect unless you are using the native-tls option to enable reading system certificates.

  rustls-platform-verifier delegates to the system for certificate validation (e.g., Security.framework on macOS) instead of eagerly loading certificates from the system and verifying them via webpki. The effects of this change will vary based on the operating system. In general, uv's certificate validation should now be more consistent with browsers and other native applications. However, this is the most likely cause of breaking changes in this release. Some previously failing certificate chains may succeed, and some previously accepted certificate chains may fail. In either case, we expect the validation to be more correct and welcome reports of regressions.

  In particular, because more responsibility for validating the certificate is transferred to your system's security library, some features like CA constraints or revocation of certificates via OCSP and CRLs may now be used.

  This change should improve performance when using system certificate on macOS, as uv no longer needs to load all certificates from the keychain at startup.

• aws-lc is used instead of ring for a cryptography backend

  There should not be breaking changes from this change. We expect this to expand support for certificate signature algorithms.

• --native-tls is deprecated in favor of a new --system-certs flag

  The --native-tls flag is still usable and has identical behavior to --system-certs.

  This change was made to reduce confusion about the TLS implementation uv uses. uv always uses rustls not native-tls.

• Building uv on x86-64 and i686 Windows requires NASM

  NASM is required by aws-lc. If not found on the system, a prebuilt blob provided by aws-lc-sys will be used.

  If you are not building uv from source, this change has no effect.

  See the CONTRIBUTING guide for details.

• Empty SSL_CERT_FILE values are ignored (for consistency with SSL_CERT_DIR)

See #​18550 for details.

Python

• Enable frame pointers for improved profiling on Linux x86-64 and aarch64

See the python-build-standalone release notes for details.

Enhancements

• Treat 'Dynamic' values as case-insensitive (#​18669)
• Use a dedicated error for invalid cache control headers (#​18657)
• Enable checksum verification in the generated installer script (#​18625)

Preview features

• Add --service-format and --service-url to uv audit (#​18571)

Performance

• Avoid holding flat index lock across indexes (#​18659)

Bug fixes

• Find the dynamic linker on the file system when sniffing binaries fails (#​18457)
• Fix export of conflicting workspace members with dependencies (#​18666)
• Respect installed settings in uv tool list --outdated (#​18586)
• Treat paths originating as PEP 508 URLs which contain expanded variables as relative (#​18680)
• Fix uv export for workspace member packages with conflicts (#​18635)
• Continue to alternative authentication providers when the pyx store has no token (#​18425)
• Use redacted URLs for log messages in cached client (#​18599)

Documentation

• Add details on Linux versions to the platform policy (#​18574)
• Clarify FLASH_ATTENTION_SKIP_CUDA_BUILD guidance for flash-attn installs (#​18473)
• Split the dependency bots page into two separate pages (#​18597)
• Split the alternative indexes page into separate pages (#​18607)

pallets/werkzeug (werkzeug)

v3.1.7

Compare Source

Released 2026-03-23

• parse_list_header preserves partially quoted items, discards empty
  items, and returns empty for unclosed quoted values. :pr:3128
• WWWAuthenticate.to_header does not produce a trailing space when there
  are no parameters. :issue:3127
• Transfer-Encoding is parsed as a set. :pr:3134
• Request.host, get_host, and host_is_trusted validate the
  characters of the value. An empty value is no longer allowed. A Unix socket
  server address is ignored. The trusted_list argument to
  host_is_trusted is optional. :pr:3113
• Fix multipart form parser handling of newline at boundary. :issue:3088
• Response.make_conditional sets the Accept-Ranges header even if it
  is not a satisfiable range request. :issue:3108
• merge_slashes merges any number of consecutive slashes. :issue:3121

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.