Skip to content

⬆️ Update flit-core requirement from <4,>=3.4 to >=3.4,<5 - #1185

Merged
chrisjsewell merged 2 commits into
masterfrom
dependabot/pip/flit-core-gte-3.4-and-lt-5
Nov 10, 2026
Merged

⬆️ Update flit-core requirement from <4,>=3.4 to >=3.4,<5#1185
chrisjsewell merged 2 commits into
masterfrom
dependabot/pip/flit-core-gte-3.4-and-lt-5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on flit-core to permit the latest version.

Changelog

Sourced from flit-core's changelog.

Version 4.0.2

  • Fix invalid metadata files with Import-Name (:ghissue:813).

Version 4.0.1

No changes, but a new tag to trigger an upload to PyPI now that twine will accept it.

Version 4.0

This version contains breaking changes, but most projects which are already using the [project] table for metadata shouldn't be affected, and can simply change the flit_core <4 constraint to <5.

  • The [tool.flit.metadata] table is no longer used for project metadata (:ghpull:771). Use the newer :ref:[project] table <pyproject_toml_project> instead (or if that is not possible, build with flit_core <4).
  • :ref:build_cmd and :ref:publish_cmd no longer include files in the sdist based on what is committed in git or Mercurial (:ghpull:772). These commands now build packages more like Flit does when called as a backend by e.g. python -m build. Specify :ref:sdist include & exclude patterns <pyproject_toml_sdist> instead (Flit can help to generate these), or pass the --use-vcs option to get the old behaviour back.
  • flit_core now requires Python 3.8 or above (:ghpull:738)
  • The --setup-py option to generate sdists containing a setup.py file is no longer available (:ghpull:776).
  • Making typing stubs packages with a -stubs suffix will now work (:ghpull:742).
  • The default glob patterns for license files have been extended to include NOTICE* and AUTHORS* (:ghpull:758).
  • license-files glob patterns can contain spaces (:ghpull:797).
  • Fix a bug where license files could be found twice on Windows (:ghpull:752).
  • The new Import-Name and Import-Namespace metadata fields (metadata 2.5) are now supported (:ghpull:774). In most cases no new input is required, as Flit will create this metadata automatically.
  • Fix creating RECORD files when file names include commas (:ghpull:744).
  • The --use-vcs option now correctly recognises git from inside a git worktree folder (:ghpull:799).
  • On Python 3.12 and above, flit build now uses the 'data' filter when extracting the just-created sdist prior to building a wheel (:ghpull:775). This restricts some special features of tar files, but sdists are unlikely to use these features, and they would probably break in other scenarios if you did.
  • The vendorised readme_renderer package was updated to version 44.0 (:ghpull:760).

... (truncated)

Commits
  • 60c0b3d Merge pull request #814 from pypa/i813
  • 58e7f41 Bump version: 4.0.1 → 4.0.2
  • 666e3c2 Fix METADATA format issue
  • 81ac51d Merge pull request #812 from pypa/prepare-4.0.1
  • 41bdff1 Add release note about 4.0.1
  • ff5bfad Bump version: 4.0.0 → 4.0.1
  • 8faf734 Bump actions/setup-python from 6 to 7 (#807)
  • ef7f319 Merge pull request #800 from pypa/prepare-4.0
  • 431fbaf Remind people in release notes to allow flit_core <5
  • 38297e7 Version number -> 4.0.0
  • Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
⬆️ Update flit-core requirement from <4,>=3.4 to >=3.4,<5
c2786d6 
Updates the requirements on [flit-core](https://github.com/pypa/flit) to permit the latest version.
- [Changelog](https://github.com/pypa/flit/blob/main/doc/history.rst)
- [Commits](pypa/flit@3.4.0...4.0.2)

---
updated-dependencies:
- dependency-name: flit-core
  dependency-version: 4.0.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 10, 2026
@chrisjsewell chrisjsewell mentioned this pull request Nov 9, 2026
Merged
chrisjsewell added a commit that referenced this pull request Nov 9, 2026
@chrisjsewell
🐛 FIX: Build both distributions in CI and publish those exact files (#…
13b79a2 
…1221)

> Draft: the publish path can only be fully exercised by a tag push.

## What and why

The release build is broken for both distributions, so the next tag push
cannot publish anything.

Both publish jobs in `tests.yml` run `pip install flit~=3.4` and then
`flit build`.
That specifier now resolves flit 3.12.0, which requires
`flit_core>=3.12` with no cap, so it pulls in flit_core 4.2.0, and `flit
build` crashes:

```
TypeError: SdistBuilder.build() got an unexpected keyword argument 'gen_setup_py'
```

This PR changes `.github/workflows/tests.yml` (the file name is
unchanged, because both PyPI trusted publishers name it):

- **A new `build` job runs on every push and pull request.**
  It builds myst-parser with `python -m build --outdir dist-parser`.
It then rewrites the project with the existing
`.github/workflows/docutils_setup.py`, unchanged, and builds
myst-docutils with `python -m build --outdir dist-docutils`.
- `python -m build` uses the `[build-system]` pin in `pyproject.toml`
(`flit_core >=3.4,<4`), so the release build cannot drift away from it
again.
  - It runs `twine check --strict` on all four files.
- It checks that each directory holds exactly one wheel and one sdist,
and that they belong to the expected project. This catches a rewrite
that silently did nothing.
  - On a tag, it checks that the built version equals the tag.
- It uploads each directory as its own artifact, `dist-parser` and
`dist-docutils`.
They are kept for the repository's default retention period, not a short
one,
so a publish job that runs late (after a slow environment approval, or
as a re-run) still finds them.
  - It checks out with `persist-credentials: false`.
- **`build` is added to the `check` aggregator**, so a broken release
build fails a PR instead of a tag push.
- **`publish` and `publish-docutils` no longer check out or build
anything.**
Each one downloads its own artifact and uploads it with
`pypa/gh-action-pypi-publish` from its own `packages-dir`, using trusted
publishing (environment `pypi`, `id-token: write`, both unchanged).
  So what is published is exactly what CI built and checked.
  `publish-docutils` still runs only after `publish` succeeds.

## How it was tested

The red run reproduces the bug on `master` (`723cffc`):

```console
$ uv venv -p 3.13 venv-flit && uv pip install --python venv-flit/bin/python "flit~=3.4" tomlkit
  # resolves flit 3.12.0 and flit-core 4.2.0
$ flit build
TypeError: SdistBuilder.build() got an unexpected keyword argument 'gen_setup_py'   # rc=1
```

For the green runs, the new job's steps were run locally with Python
3.13, build 1.6.1, twine 7.0.0 and tomlkit 0.15.2, at both `v5.1.0` and
this branch:

- `python -m build --outdir dist-parser`, then `docutils_setup.py`, then
`python -m build --outdir dist-docutils`: rc=0 at both refs.
- `twine check --strict` on all four files: PASSED.
- The name and version check script, extracted from the workflow file
and run directly:
  - no tag: rc=0;
  - `TAG=v5.1.0`: rc=0;
- `TAG=v5.2.0`: rc=1, with `tag v5.2.0 != built version(s) ['5.1.0']`
for each directory;
- with the `docutils_setup.py` step skipped: rc=1, with `dist-docutils:
expected myst_docutils, got ['myst_parser']`.

These builds were compared with the files on PyPI for 5.1.0, built from
the `v5.1.0` tag with the new job:

| | myst-parser | myst-docutils |
|---|---|---|
| wheel file list | identical (35 entries) | identical (35 entries) |
| wheel `METADATA` | byte-identical | byte-identical |
| sdist `PKG-INFO` | byte-identical | byte-identical |
| sdist file list | 34 entries vs 51 (see below) | 34 entries vs 51 (see
below) |

On this branch the only file-list change from that comparison is the new
`myst_parser/slugs.py` module, in both wheels and both sdists.
The contents of other modules differ too, because `master` has moved on
since 5.1.0.

Linting:

- `actionlint .github/workflows/tests.yml` reports no new findings. The
one finding left is a SC2102 info at line 93, which is already on
`master`, in the unchanged `check-myst-docutils` install step.
- `pre-commit run --all-files`: all hooks pass.

## Notes for the reviewer

- **The sdists get smaller.** The flit CLI built sdists in VCS mode, so
they included every git-tracked file not excluded. `python -m build`
goes through the flit_core backend, which ships only the package plus
`pyproject.toml`, `README.md`, `LICENSE` and `PKG-INFO`.
  These files drop out of both sdists:
  - `.github/`
  - `.gitignore`
  - `.pre-commit-config.yaml`
  - `.readthedocs.yml`
  - `AGENTS.md`
  - `CHANGELOG.md`
  - `codecov.yml`
  - `example-include.md`
  - `tox.ini`

`tests/` and `docs/` were already excluded, by `[tool.flit.sdist]
exclude` in `pyproject.toml`. None of these files is needed to build or
install, and the wheels are unchanged.
If `CHANGELOG.md` or `tox.ini` should stay in the sdist, a
`[tool.flit.sdist] include` list in `pyproject.toml` adds them back. I
left that out because it is a packaging-policy choice.
The same goes for shipping `tests/` in the sdist, which would also mean
dropping it from the existing `exclude` list.
- **What myst-docutils declares is unchanged.** `docutils_setup.py` is
untouched, so myst-docutils still declares no runtime docutils
requirement: docutils and sphinx stay in its `[sphinx]` extra, as in
5.1.0. Whether to change that is a separate decision.
- **The tag path cannot be fully tested before a tag.** The download and
upload steps follow the PyPA trusted-publishing guide's pattern. Trusted
publishers are registered for both projects, against workflow
`tests.yml` and environment `pypi`.
- **Kept out of scope:**
  - the test-matrix work;
  - flit_core `<5` (#1185);
  - a top-level `permissions: contents: read`;
  - creating GitHub releases automatically.
@chrisjsewell
chrisjsewell merged commit dde8f25 into master Nov 10, 2026
25 checks passed
@chrisjsewell
chrisjsewell deleted the dependabot/pip/flit-core-gte-3.4-and-lt-5 branch November 10, 2026 11:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chrisjsewell