deps(deps): update filelock requirement from <4.0.0,>=3.32.5 to >=4.0.1,<5.0.0

[dependabot]

Updates the requirements on filelock to permit the latest version.

Release notes

Sourced from filelock's releases.

4.0.1

What's Changed

• fix: reject invalid poll_interval before sleep by @​Pitchfork-and-Torch in tox-dev/filelock#739

New Contributors

• @​Pitchfork-and-Torch made their first contribution in tox-dev/filelock#739

Full Changelog: tox-dev/filelock@4.0.0...4.0.1

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.1 (2026-09-19)

---

• poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739

---

4.0.0 (2026-09-17)

---

• The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
• :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
• :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

---

3.32.7 (2026-09-16)

---

• Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
• Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

---

3.32.6 (2026-09-08)

---

• SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
• Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724

... (truncated)

Commits

• b5016c4 Release 4.0.1
• 6ee6db6 fix: reject invalid poll_interval before sleep (#739)
• 7e57436 Release 4.0.0
• f974328 🐛 fix(soft-rw): replace the state mutex with a generation log (#738)
• 20929f7 Release 3.32.7
• 35f07c4 [pre-commit.ci] pre-commit autoupdate (#736)
• e860d39 📝 docs: say acquire() falls back to the lock's blocking attribute (#733)
• c530efe Fix final symlink test on musl (#737)
• 4efd93e Release 3.32.6
• 7b7b7a8 Fix SoftReadWriteLock state lock timeout (#726)
• Additional commits viewable in compare view

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 30 pull requests across this workspace.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dependabot]

Superseded by #308.