[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

coverage (dependency) 7.16.2 -> 7.17.0, tomli (dependency) 2.5.0 -> removed

Risk: 🟢 Safe

The Deep Dive

Update Scope

Lock-file maintenance on renovate-eval/uv.lock, the dev-only test environment for the renovate-eval Python package. The only version bump is coverage 7.16.2 → 7.17.0. Because coverage 7.17.0 drops Python 3.10 and no longer declares the toml extra, uv removed the coverage[toml] edge from pytest-cov and dropped tomli 2.5.0. That package was only pulled in under the marker python_full_version <= '3.11'. Unchanged: pytest 9.1.1, pytest-cov 7.1.0, pyyaml, pluggy, and every other locked package; pyproject.toml (requires-python = ">=3.11"); and the composite action/workflow runtime. That runtime uses the Nix python3.withPackages [pyyaml], not this lock.

Performance & Stability

• Lower coverage report memory use: the text summary no longer holds every file's parsed source until it finishes (issue 2277). The pre-commit hook runs --cov-report=term-missing, so this applies, but lib/ is small and the gain won't matter in practice.
• C tracer hardening: fixes for reference counting and free-threaded safety (release notes). These apply automatically and are invisible on the dev shell's standard (GIL) CPython.

Security

• There are no CVEs or GHSA advisories for coverage or tomli in this range (the coveragepy advisories list is empty).
• 7.17.0 now sanitizes control characters in file names in its XML, text and Markdown reports, and fixes a hang on newline-containing include/omit patterns (release notes). This hardening only affects odd file names; this repo's lib/ paths are ordinary.

Key Fixes

• Branch-coverage fixes for phantom partial branches in nested with statements (issue 1987) and for if True: text inside comments (issue 2314). These don't apply here: pyproject.toml sets no branch = true, so only line coverage is measured against fail_under = 95.
• Parallel data-file loss fix (issue 2338). This doesn't apply: there is no parallel setting and no xdist.
• XML/lcov report fixes (issue 2293, issue 2335). These don't apply because only the terminal report is produced.

Newer Versions

• 7.17.0 is the latest coverage release (published 2026-10-22). There is nothing newer and no known regression.

Hazards & Risks

• coverage drops Python 3.10 (7.17.0 notes): this has no impact. The project already declares requires-python = ">=3.11", and the Nix dev shell uses CPython 3.14.
• coverage[toml] extra and tomli removed: coverage reads [tool.coverage.*] from pyproject.toml using stdlib tomllib, which exists on every supported Python (3.11+). tomli was only ever installed for python_full_version <= '3.11', and no repo code imports tomli.
• The PR's Lint CI run passed. It runs ./scripts/lint --all-files, which includes the uv run pytest --cov hook with the 95% threshold.

Sources

• coverage 7.17.0 release notes
• coveragepy releases
• coveragepy security advisories
• coverage 7.17.0 on PyPI
• PR #65 Lint CI run

---

🟢 Verdict: Safe

This is a dev-only test-tool bump (coverage 7.17.0) whose only breaking change is dropping Python 3.10, which the project (>=3.11) and dev shell (3.14) already exceed. tomli removal is a no-op on 3.11+, and the lint CI that runs the coverage-gated test suite passed.