[dependabot]

Bumps the pip-dependencies group in /requirements.d with 2 updates: pip and tox.

Updates pip from 26.2.1 to 26.2.2

Changelog

Sourced from pip's changelog.

26.2.2 (2026-10-20)

Vendored Libraries

• Upgrade certifi to 2026.10.19

Commits

• b3b696f Bump for release
• b0c56c1 Upgrade certifi to 2026.10.19
• See full diff in compare view

Updates tox from 4.63.0 to 4.64.3

Release notes

Sourced from tox's releases.

v4.64.3

Bug fixes - 4.64.3

• A set_env written as a list of tables in TOML now keeps every file entry and honors the order of the entries, so merging one environment's set_env into another no longer drops the environment file it referenced (#4093) - by Rodrigo-Palma.

  • Each { file = "..." } entry is read; previously only the last one survived, because the entries were merged into a single table first and a table cannot hold the key twice.
  • A variable set after a file entry wins over the value the file provides, matching the file| form in INI; previously a repeated variable was pulled back to its first position, letting the file override it.
  • A later entry that sets a variable without a marker clears the marker an earlier entry gave it, again matching the INI form. (#4093)

• Create the package build environment change_dir directory before running the build commands, as the documentation already promises. (#4095)

PyPI release

Full Changelog: tox-dev/tox@4.64.2...4.64.3

v4.64.2

Bug fixes - 4.64.2

• A tox environment with env_dir = "{tox_root}/.venv" no longer crashes with FileExistsError after another environment ran (#4090) - by gaborbernat.

  • With venv_redirect unset, the new default, tox writes the redirect file unless a tox environment lives at .venv; with true, tox fails the run with an error naming that environment.
  • tox deletes a redirect file it wrote where an environment should live, and fails the environment with an error naming any other file there. (#4091)

• The 832 .venv redirect file now names a deliberate development environment - by gaborbernat.

  • tox picks venv_redirect_env, else an environment named dev, else the first that installs the project in development mode, and writes nothing without one, so a project that uses tox for tests alone gets no file.
  • tox devenv points the redirect at the environment it creates, and later runs leave it in place.
  • tox tells virtualenv to write no redirect file of its own beside the environments it builds. (#4092)

PyPI release

Full Changelog: tox-dev/tox@4.64.1...4.64.2

v4.64.1

Bug fixes - 4.64.1

• Apply -x/--override and TOX_OVERRIDE values that target a section the configuration file does not define,

... (truncated)

Changelog

Sourced from tox's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-67-1:

---

4.67.1 (2026-10-18)

---

.. _release-4-67-1-fixed:

Fixed

• Preserve ignore (-) and invert (!) exit code prefixes on commands when referenced via TOML { replace = "ref", ... }. (:issue:4169)
• Installing from a pylock.toml with no :ref:dependency_groups selected now uses the lock file's default-groups, as :PEP:751 specifies. Previously packages marked 'default' in dependency_groups (as written by pdm export -f pylock) were skipped - by :user:pcbeingused333. (:issue:4173)
• A positional {factor:N} label in an env_base now resolves against that table's own factors, so with several env_base tables or an env_list product it no longer expands to an empty string. (:issue:4174)

.. _release-4-67-0:

---

4.67.0 (2026-10-17)

---

.. _release-4-67-0-added:

Added

• Allow opting in to tox substitutions within TOML positional arguments with substitute = true. (:issue:4165)

.. _release-4-67-0-fixed:

Fixed

• Keep capturing the output of the packaging backend with --no-capture, so tox --no-capture no longer hangs at started backend while waiting for the backend's reply. (:issue:4163)
• A leading UTF-8 byte order mark in tox.ini, setup.cfg, tox.toml or a TOML pyproject.toml no longer stops the configuration from loading - editors on Windows may add one. (:issue:4166)
• tox --no-provision <command> no longer treats the command as the JSON output path: a global option placed before a

... (truncated)

Commits

• f46060e release 4.64.3
• ca35bdb Keep every file entry of a set_env list of tables (#4094)
• 31ed8d9 Create change_dir before running the external package build command (#4095)
• 9cd0f4e release 4.64.2
• c2b87d2 🐛 fix(run): point .venv at a deliberate dev env (#4092)
• a8fa8cc 🐛 fix(run): keep .venv redirect off for a .venv env (#4091)
• e40e8e6 release 4.64.1
• eacd4e9 🐛 fix(config): apply overrides to sections the file lacks (#4089)
• fff62f6 release 4.64.0
• 5c56ce0 ✨ feat(config): write a PEP 832 .venv redirect file (#4013)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
tox	[>= 4.49.dev0, < 4.50]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions