[dependabot]

Bumps tox from 4.67.2 to 4.67.4.

Release notes

Sourced from tox's releases.

v4.67.4

Bug fixes

• A dependency group entry that refers to the project's own extra with an environment marker, such as demo[dev]; python_version < "3.10", now keeps that marker on the extra's requirements instead of installing them on every interpreter (#4211) by @​ericdelorefice and @​gaborbernat.

PyPI release

Full Changelog

v4.67.3

Bug fixes

• An open-ended factor range whose explicit bound sits outside the supported CPython window no longer expands to nothing. An INI env_list such as py3{16-} used to fail with ValueError: py3{}, and a TOML range dict expanded to an empty axis, dropping that dimension from the matrix (#4176) by @​HyperionBurn and @​gaborbernat.
• A TOML replace = "glob" table now substitutes its pattern and default, matching the INI {glob:PATTERN:DEFAULT} form, so pattern = "{env_name}/*.whl" matches files instead of a literal {env_name} directory (#4180) by @​ag3ntsc4rn and @​gaborbernat. (#4178)
• --force-dep now matches dependency names after PEP 503 normalization, so --force-dep typing-extensions==4.9.0 replaces Typing_Extensions==4.12.2 in deps instead of passing both pins to pip, and replaces a Typing_Extensions requirement from the package metadata, where tox used to drop the forced pin (#4181) by @​ag3ntsc4rn and @​gaborbernat. (#4179)
• {glob:PATTERN:DEFAULT} with a single-letter pattern and an absolute default, such as {glob:z:/fallback}, no longer expands to an empty string on POSIX: tox now looks for a Windows drive letter in the pattern only on Windows (#4183) by @​JingHao-Leon and @​gaborbernat. (#4182)
• A TOML { replace = "env" } table in set_env whose default ends in a backslash now resolves to the variable or the default, instead of the literal {env:...} text (#4185) by @​JingHao-Leon and @​gaborbernat. (#4184)
• --no-index in a requirements file or deps now wins over --index-url and --extra-index-url on the same or a later line, as in pip. Previously tox dropped it and installed from those indexes, and from PyPI too when given an --extra-index-url (#4187) by @​syahra712 and @​gaborbernat.
• A leading UTF-8 byte order mark in pyproject.toml no longer breaks dependency_groups or reading the package's static dependencies from [project], and one in a base_python_file such as .python-version is no longer read as part of the Python version (#4188) by @​pcbeingused333 and @​gaborbernat.
• --parallel auto now counts the CPUs tox may run on instead of every CPU in the machine, so it respects the CPU affinity mask set by taskset or a container's cpuset (and PYTHON_CPU_COUNT on Python 3.13+) (#4190) by @​mehdimirzafaruk and @​gaborbernat.
• A TOML { replace = "ref", env = ..., key = ... } now takes a path (change_dir, env_dir), set (extras, labels, dependency_groups) or environment list (depends) value from another environment, instead of failing validation of the referencing key (#4192) by @​pcbeingused333 and @​gaborbernat.
• --result-json is now always written as UTF-8 instead of the locale's preferred encoding. Captured output that a legacy Windows code page cannot represent, or that holds bytes which are not valid UTF-8, no longer crashes the run at the end with a truncated file; the invalid bytes are stored as \uXXXX escapes (#4194) by @​mehdimirzafaruk and @​gaborbernat.
• Glob character sets such as lint-[ab] and lint-[!a] in an ini depends now load, as the depends reference documents, instead of failing to load the configuration (#4195) by @​nk-batman21 and @​gaborbernat.
• Disable the parallel spinner by default in CI for the legacy command, as tox run-parallel does (#4196) by @​Rodrigo-Palma and @​gaborbernat.
• Leave extras, editables, local directories and source archives out of the constrain_package_deps constraints file, so pip no longer rejects it (#4203) by @​ericdelorefice and @​gaborbernat.
• An empty PYTHONHASHSEED no longer makes every tox command fail with ValueError. tox treats it as unset, as Python does, and picks a random seed (#4205) by @​devYRPauli and @​gaborbernat.

Documentation

• Explain how to quote command arguments built from [vars] values that contain spaces, and how quotes stored in those values pair with the quotes around them (#4197) by @​Blues-berry and @​gaborbernat. (#4191)

New Contributors

• @​devYRPauli made their first contribution in tox-dev/tox#4205
• @​JingHao-Leon made their first contribution in tox-dev/tox#4183
• @​HyperionBurn made their first contribution in tox-dev/tox#4176
• @​ag3ntsc4rn made their first contribution in tox-dev/tox#4180
• @​ericdelorefice made their first contribution in tox-dev/tox#4203
• @​nk-batman21 made their first contribution in tox-dev/tox#4195
• @​mehdimirzafaruk made their first contribution in tox-dev/tox#4194
• @​Blues-berry made their first contribution in tox-dev/tox#4197

PyPI release

... (truncated)

Changelog

Sourced from tox's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-67-5:

---

4.67.5 (2026-10-31)

---

.. _release-4-67-5-fixed:

Fixed

• A packaging environment whose base_python (or default_base_python) is not installed no longer crashes with KeyError: 'skip_missing_interpreters'. It now fails with the missing interpreter, or skips the run environment when skip_missing_interpreters is true, as tox did before 4.36.0 (:pr:4213) by :user:gaborbernat. (:issue:4212)

• Keep environment markers when a package extra refers to another extra of the same package.

  For example, demo[dev]; python_version < '3.10' keeps the version condition on dependencies from dev (:pr:4216) by :user:ericdelorefice and :user:gaborbernat.

• A pylock.toml or a tox user configuration file (TOX_USER_CONFIG_FILE) saved with a UTF-8 byte order mark, as some Windows editors do, is now read instead of failing with a TOML decode error or being ignored with failed to read config file (:pr:4217) by :user:pcbeingused333.

• With args_are_paths enabled, a positional argument naming an existing file whose rewritten path relative to change_dir starts with - (for example tests/--config=evil.cfg) is now prefixed with ./ so the command still receives a path instead of an option (:pr:4317) by :user:rahuldevikar and :user:gaborbernat. (:issue:4218)

• An extending TOML replace table with a nonempty marker now raises an error instead of adding its internal value and marker keys to :ref:deps or :ref:requires. Markers on set_env values remain supported (:pr:4320) by :user:rahuldevikar and :user:gaborbernat. (:issue:4220)

• A TOML type mismatch no longer includes an expanded string or container value. A malformed commands setting with {env:...} reports its type instead of the substituted text (:pr:4327) by :user:rahuldevikar and :user:gaborbernat. (:issue:4221)

• Keep artifacts supplied with --installpkg out of tox's provisioning environment while installing them in the requested test environments (:pr:4304) by :user:Pratham2511 and :user:gaborbernat. (:issue:4222)

• A file: URI passed to --installpkg is now percent-decoded once instead of twice, so a path containing a literal % sequence, such as a directory named feature%2Flogin, selects the package the user named (:pr:4300) by :user:pcbeingused333 and :user:gaborbernat. (:issue:4223)

• A relative TOX_INSTALL_PKG or user configuration install_pkg path is now resolved against the invocation directory, as --installpkg already was, so tox inspects and installs from the same path (:pr:4333) by :user:rahuldevikar and :user:gaborbernat. (:issue:4224)

• tox refuses a symlink or Windows junction at meta_dir because the build frontend empties that directory during

... (truncated)

Commits

• ff5def6 release 4.67.4
• 0255ed0 🐛 fix(deps): keep marker on self-referencing extra (#4211)
• 9178b69 release 4.67.3
• 5d15d9b 🐛 fix(config): resolve TOML env defaults ending in a backslash (#4185)
• af9eabf 🐛 fix(config): let TOML env refs take path, set and env list values (#4192)
• 070a72c 🐛 fix(parallel): size --parallel auto by the CPUs tox may use (#4190)
• 5b4b7a7 📝 docs(config): explain quoting spaced substitutions (#4197)
• 6bf3afe 🐛 fix(journal): write --result-json as UTF-8 (#4194)
• 4931a47 🐛 fix(config): allow glob character sets in ini depends (#4195)
• f736d1c 🐛 fix(force-dep): match dependency names after normalization (#4181)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)