[dependabot]

Bumps github.com/posit-dev/go-python-packaging from 0.7.0 to 0.11.0.

Changelog

Sourced from github.com/posit-dev/go-python-packaging's changelog.

[0.11.0] - 2026-09-25

Breaking

• marker, requirement, reqtxt: marker string literals now decode Python escape sequences, and malformed escapes are rejected. "line\nbreak" compares as a real newline, not a backslash and n, matching pypa/packaging. A truncated \u/\U, a \U above U+10FFFF, or an octal \8/\9 is now a parse error where it used to be accepted. (#58, rstudio/package-manager#19401)

Added

• version: UpstreamPackagingSHA names the one pypa/packaging commit that every ported-code citation in this module is pinned to. (#60)

Fixed

• requirement: in name @ url, the URL now ends at a space or tab only, matching pypa/packaging. A bare trailing line break is kept in the URL rather than handled by a special case. (#59, rstudio/package-manager#19402)
• distribution: NewArchiveReader no longer leaks an open file when a .tar.gz holds no readable tar header.

Notes

• NOTICE: uv-pep508 is credited as Apache-2.0 OR BSD-2-Clause (Copyright (c) 2023 konstin), not Apache-2.0 OR MIT, and the Aqua Security copyright for version/ is now included. Source files now carry provenance headers. There is no code change. (#60, rstudio/package-manager#19394, rstudio/package-manager#19395)

[0.10.0] - 2026-09-18

Added

• wheelname: ParseTags reads a wheel's compatibility tags without requiring its version to parse, returning a WheelTags of name, build tag and tags.

  Parse rejects the whole filename when only the version segment fails PEP 440, and the version contributes nothing to a PEP 425 tag. PEP 427 escapes runs of non-alphanumeric characters to _, so a legal local version like 1.0+cpu reaches disk as 1.0_cpu and does not parse. Measured over a full-corpus sweep of 14.3M mirrored PyPI wheels, 221 of the 299 rejected filenames failed on the version alone with their tags fully readable — and that silently understated real platform compatibility for the affected releases.

  Un-escaping inside Parse was considered and rejected: the escaping is not losslessly invertible. Both 2.5.0+post1_cpu and 2.5.0_post1+cpu parse from the escaped 2.5.0_post1_cpu and only the second is correct, so un-escaping would return a plausible wrong version with no error. Parse's behaviour is unchanged.

... (truncated)

Commits

• 063bc51 chore(release): add missing entries and date 0.11.0 (#63)
• 08a3aa5 Add Apache-2.0 §4(b)/(c) provenance blocks and normalize upstream citations (...
• fbcb5d3 marker/extras: port pypa conformance tables + uv-pep508 carets (rstudio/packa...
• c899b98 distribution: default-CI parse coverage + archive_reader leak fix (rstudio/pa...
• 52ec9ed pep508: bound the URL token at horizontal whitespace (#59)
• 273595c pep508: decode Python string escapes in marker literals (#58)
• 68c7c5c chore(release): date 0.10.0 (#57)
• b8ef6ef feat(wheelname): add ParseTags, which does not require a parseable version (#56)
• a9c99ee chore(release): date 0.9.0
• 2a1fc87 chore(deps): bump testify, x/text, and x/crypto (#50)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #76.