[dependabot]

Bumps tox from 4.65.0 to 4.67.7.

Release notes

Sourced from tox's releases.

v4.67.7

Bug fixes

• PEP 723 metadata lines with content now require a space after #. Empty blocks count when detecting duplicates, and invalid requires-python values report a configuration error. Previously, malformed content lines could make tox read metadata that other script runners ignored (#4371) by @​abhishekcpp007 and @​gaborbernat.

New Contributors

• @​abhishekcpp007 made their first contribution in tox-dev/tox#4371

🐍 PyPI release

📜 Full Changelog

v4.67.6

Bug fixes

• Package builds now work under umasks such as 0002 because tox creates new staging directories and missing parents with owner-only access. Existing directories keep their permissions (#4360) by @​stephenfin and @​gaborbernat.
• tox config no longer fails with an AssertionError when an environment uses a runner whose plugin is not installed. It skips that environment, as tox run and tox list already do (#4361) by @​nk-batman21 and @​gaborbernat.
• Invalid set_env markers now report the key. For INI values, the error explains how to write a literal semicolon as \; (#4364) by @​faresrafat3 and @​gaborbernat.
• Restore built-in runner choices for --runner so --runner virtualenv does not fail with an empty choices list (#4365) (#4367) by @​gaborbernat.
• Compare interpreter implementation names without regard to case when validating base_python against environment names (#4369) by @​mayankdhingra02 and @​gaborbernat.
• Accept --config-settings (-C) on requirement lines in requirements files, which pip supports, instead of failing with unrecognized arguments; it is still rejected when written in deps directly, like --hash (#4366) by @​mmporong and @​gaborbernat.

New Contributors

• @​mmporong made their first contribution in tox-dev/tox#4366
• @​mayankdhingra02 made their first contribution in tox-dev/tox#4369

PyPI release

Full Changelog

v4.67.5

Bug fixes

• A packaging environment whose base_python (or default_base_python) is not installed no longer crashes with KeyError: 'skip_missing_interpreters'. It now fails with the missing interpreter, or skips the run environment when skip_missing_interpreters is true, as tox did before 4.36.0 (#4213) by @​gaborbernat. (#4212)
• Keep environment markers when a package extra refers to another extra of the same package. For example, demo[dev]; python_version < '3.10' keeps the version condition on dependencies from dev (#4216) by @​ericdelorefice and @​gaborbernat.
• A pylock.toml or a tox user configuration file (TOX_USER_CONFIG_FILE) saved with a UTF-8 byte order mark, as some Windows editors do, is now read instead of failing with a TOML decode error or being ignored with failed to read config file (#4217) by @​pcbeingused333.
• With args_are_paths enabled, a positional argument naming an existing file whose rewritten path relative to change_dir starts with - (for example tests/--config=evil.cfg) is now prefixed with ./ so the command still receives a path instead of an option (#4317) by @​rahuldevikar and @​gaborbernat. (#4218)
• An extending TOML replace table with a nonempty marker now raises an error instead of adding its internal value and marker keys to deps or requires. Markers on set_env values remain supported (#4320) by @​rahuldevikar and @​gaborbernat. (#4220)
• A TOML type mismatch no longer includes an expanded string or container value. A malformed commands setting with {env:...} reports its type instead of the substituted text (#4327) by @​rahuldevikar and @​gaborbernat. (#4221)
• Keep artifacts supplied with --installpkg out of tox's provisioning environment while installing them in the requested test environments (#4304) by @​Pratham2511 and @​gaborbernat. (#4222)
• A file: URI passed to --installpkg is now percent-decoded once instead of twice, so a path containing a literal % sequence, such as a directory named feature%2Flogin, selects the package the user named (#4300) by @​pcbeingused333 and @​gaborbernat. (#4223)
• A relative TOX_INSTALL_PKG or user configuration install_pkg path is now resolved against the invocation directory, as --installpkg already was, so tox inspects and installs from the same path (#4333) by @​rahuldevikar and @​gaborbernat. (#4224)

... (truncated)

Changelog

Sourced from tox's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-67-12:

---

4.67.12 (2026-11-05)

---

.. _release-4-67-12-fixed:

Fixed

• A quoted set_env value that ends with a literal backslash and contains a semicolon no longer loses its quote protection, so WINPATH="C:\tools;C:\bin\\" keeps the whole value instead of failing with invalid marker. tox now counts the backslashes in front of a quote: an even number leaves the quote unescaped (:pr:4388) by :user:haigou-web and :user:gaborbernat. (:issue:4387)

.. _release-4-67-11:

---

4.67.11 (2026-11-04)

---

.. _release-4-67-11-fixed:

Fixed

• Package staging no longer fails on a .tox that only the project's own writers can change, such as one owned by the workspace owner while root runs tox, or a 777 build directory on Bitbucket. A work directory that other accounts could change, such as a 777 .tox left by an older tox under umask 000 or restored from a CI cache, is made private and emptied once at the start of a run, so tox recreates its environments instead of failing. When staging still refuses a path, the error names its owner and mode (:pr:4386) by :user:gaborbernat. (:issue:4376)

.. _release-4-67-10:

---

4.67.10 (2026-11-04)

---

.. _release-4-67-10-fixed:

Fixed

... (truncated)

Commits

• 0dbb40c release 4.67.7
• 8f84692 🔧 build(deps): use release-creator 4.4 (#4372)
• a44622f 🐛 fix(pep723): validate inline metadata (#4371)
• 6392d0b 👷 ci(news): stop cancelling the news check (#4370)
• 860bf90 release 4.67.6
• 0e7938f 🐛 fix(python): compare interpreter names without case (#4369)
• 68a05ba 🔧 fix(ci): keep news runs for label changes (#4368)
• 88ee49e 🐛 fix(cli): restore --runner choices (#4367)
• 1abab12 🐛 fix(staging): create private directories (#4360)
• 1a0e08d 🐛 fix(set_env): name invalid marker keys (#4364)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1534.