build(deps): bump the other-packages group across 1 directory with 4 updates

[dependabot]

Bumps the other-packages group with 4 updates in the / directory: altcha, tox, tox-uv and ruff.

Updates altcha from 2.0.2 to 2.1.0

Commits

• 04b3b2b v2.1.0
• 2f70cdb fix: enforce key_prefix in PoW v2 fallback verification
• 7fc795f feat: verify_server function for remote server verification
• See full diff in compare view

Updates tox from 4.56.4 to 4.58.0

Release notes

Sourced from tox's releases.

v4.58.0

What's Changed

• 👷 ci: run the test matrix against Python 3.15 by @​gaborbernat in tox-dev/tox#4001

Full Changelog: tox-dev/tox@4.57.2...4.58.0

v4.57.2

What's Changed

• 🐛 fix(session): fix package env failure cascade and state corruption by @​gaborbernat in tox-dev/tox#3991
• 🐛 fix(pkg): repair editable fallback and sdist-wheel root handling by @​gaborbernat in tox-dev/tox#3992
• 🐛 fix(pylock): install exactly what the lock file specifies by @​gaborbernat in tox-dev/tox#3994
• 🐛 fix(cache): self-heal wrong-shape tox-info content by @​gaborbernat in tox-dev/tox#3996
• 🐛 fix(config): rebuild loader chains per config set by @​gaborbernat in tox-dev/tox#3993
• 🐛 fix(pip): stable rendering of set options in install cache by @​gaborbernat in tox-dev/tox#3995
• 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks by @​gaborbernat in tox-dev/tox#3997
• 🐛 fix(run): honor the fail-fast contract, resilient teardown by @​gaborbernat in tox-dev/tox#3999
• 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin by @​gaborbernat in tox-dev/tox#3998
• 🐛 fix(ux): four run-edge polish fixes by @​gaborbernat in tox-dev/tox#4000

Full Changelog: tox-dev/tox@4.57.1...4.57.2

v4.57.1

What's Changed

• Run sequentially for run-parallel -p 0 instead of at CPU count by @​chuenchen309 in tox-dev/tox#3989
• Do not let a lone quote in a set_env value swallow the marker by @​chuenchen309 in tox-dev/tox#3988

Full Changelog: tox-dev/tox@4.57.0...4.57.1

v4.57.0

What's Changed

• 💰 Surface the org itself in the FUNDING config by @​webknjaz in tox-dev/tox#3979
• Replace prettier with mdformat and yamlfmt by @​gaborbernat in tox-dev/tox#3984
• 📦 build: use test dependency group in internal envs by @​gaborbernat in tox-dev/tox#3985
• ✨ feat(python): match free-threaded and debug interpreter builds by @​chuenchen309 in tox-dev/tox#3986

New Contributors

• @​chuenchen309 made their first contribution in tox-dev/tox#3986

Full Changelog: tox-dev/tox@4.56.4...4.57.0

Changelog

Sourced from tox's changelog.

Miscellaneous internal changes - 4.58.0

• Test against Python 3.15 (beta) in CI and declare its classifier - by :user:gaborbernat. (:issue:4001)

---

v4.57.2 (2026-07-21)

---

Bug fixes - 4.57.2

• Fix package environment creation failures being misreported:

  • discard the partially registered configuration on failure, so the real error surfaces instead of a spurious duplicate configuration definition;
  • report the first creation failure in definition order, not a hash-random one;
  • build the PEP 517 frontend lazily, so tox c and tox l work when pyproject.toml cannot be read. (:issue:3987)

• Fix state corruption in the environment creation machinery:

  • a failed run environment build no longer removes shared package environments other run environments still use;
  • a run environment registers with its package environment once, not twice with triple-counted usage;
  • circular depends reports the cycle as an error instead of a raw traceback;
  • Skip raised by a plugin for a package environment marks the run environment package-skipped instead of crashing with UnboundLocalError. (:issue:3991)

• Fix two packaging regressions:

  • package = editable on a build backend without PEP-660 support now falls back to editable-legacy with a warning instead of crashing, also when the project metadata is static;
  • editable and wheel environments running after an sdist-wheel environment build from the project sources again, instead of a stale temporary copy that made source edits invisible. (:issue:3992)

• An environment serving as both a run environment and a package environment now behaves predictably:

  • one defined through a [testenv:...]-style section and referenced by package_env inherits from pkgenv/env_pkg_base as documented, instead of silently keeping run environment defaults;
  • one listed in env_list while referenced as a package environment is reported as a configuration conflict up front, instead of failing late with cannot run packaging environment or silently disappearing from tox l. (:issue:3993)

• pylock.toml installs now match the lock file:

  • a package locked once per Python range installs only the version matching the environment's interpreter;
  • packages locked to a local directory, VCS repository, or archive install from that source instead of resolving the name against the package index;
  • locked hashes are verified when every entry carries one;
  • changing a pip environment variable such as PIP_INDEX_URL reinstalls, as it already did for deps.

... (truncated)

Commits

• 69e1bdc release 4.58.0
• ea8734e 👷 ci: run the test matrix against Python 3.15 (#4001)
• 2d8d5ae release 4.57.2
• b74d78b 🐛 fix(ux): four run-edge polish fixes (#4000)
• 09dad3d 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin (#3...
• fa6ec2b 🐛 fix(run): honor the fail-fast contract, resilient teardown (#3999)
• b1b0159 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks (#3997)
• a111ec6 🐛 fix(pip): stable rendering of set options in install cache (#3995)
• e969723 🐛 fix(config): rebuild loader chains per config set (#3993)
• 6a9b6a5 🐛 fix(cache): self-heal wrong-shape tox-info content (#3996)
• Additional commits viewable in compare view

Updates tox-uv from 1.35.2 to 1.36.0

Release notes

Sourced from tox-uv's releases.

1.36.0

What's Changed

• Fix flaky na-interpreter test for skip_missing_interpreters default by @​gaborbernat in tox-dev/tox-uv#349
• Replace prettier with mdformat and yamlfmt by @​gaborbernat in tox-dev/tox-uv#356
• 👷 ci: add Python 3.15 to the test matrix by @​gaborbernat in tox-dev/tox-uv#358

Full Changelog: tox-dev/tox-uv@1.35.2...1.36.0

Commits

• 6268ef9 👷 ci: add Python 3.15 to the test matrix (#358)
• 12edb70 [pre-commit.ci] pre-commit autoupdate (#357)
• a6d24f8 Replace prettier with mdformat and yamlfmt (#356)
• 8bab275 build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 (#355)
• 75c7409 build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 (#354)
• a4ef4f2 [pre-commit.ci] pre-commit autoupdate (#353)
• 16203a1 build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 (#352)
• af040e7 [pre-commit.ci] pre-commit autoupdate (#351)
• 1a09434 💰 Surface GitHub Sponsors + thanks.dev
• 9781bb7 [pre-commit.ci] pre-commit autoupdate (#350)
• Additional commits viewable in compare view

Updates ruff from 0.15.22 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions