[dependabot]

Bumps the dev-dependencies group with 2 updates: coverage and pytest-asyncio.

Updates coverage from 7.17.0 to 7.17.2

Release notes

Sourced from coverage's releases.

7.17.2

Version 7.17.2 — 2026-11-04

• Fix: two different scenarios failed with “attempt to write a readonly database”. These were regressions in 7.17.1. They are fixed, closing issue 2356:
  • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.
  • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can’t read is now reported like any other unusable data file, and is left in place.

➡️  PyPI page: coverage 7.17.2. :arrow_right:  To install: python3 -m pip install coverage==7.17.2

7.17.1

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167 and issue 2337.
• Fix: the HTML report only rewrites a file’s page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.
• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message “total of 0.4 is less than fail-under=0.5”. Previously, the comparison rounded the total to zero and the message could claim “1 is less than 0”. Closes issue 2295.
• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.
• Fix: --source=/ measured no files. A file system root can’t be a source directory, so now it is an error. Closes issue 2291.
• In an abundance of caution, prevent forged SQLite journal files from deleting files they shouldn’t.

➡️  PyPI page: coverage 7.17.1. :arrow_right:  To install: python3 -m pip install coverage==7.17.1

Changelog

Sourced from coverage's changelog.

Version 7.17.2 — 2026-11-04

• Fix: two different scenarios failed with "attempt to write a readonly database". These were regressions in 7.17.1. They are fixed, closing issue 2356_:

  • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.

  • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can't read is now reported like any other unusable data file, and is left in place.

.. _issue 2356: coveragepy/coveragepy#2356

.. _changes_7-17-1:

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167_ and issue 2337_.

• Fix: the HTML report only rewrites a file's page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.

• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message "total of 0.4 is less than fail-under=0.5". Previously, the comparison rounded the total to zero and the message could claim "1 is less than 0". Closes issue 2295_.

• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.

• Fix: --source=/ measured no files. A file system root can't be a source directory, so now it is an error. Closes issue 2291_.

... (truncated)

Commits

• d0d3e1d docs: combine the two 'combine' failure descriptions
• 33cb85f fix: don't initialize a data file we can only read (#2360)
• 6e71bac docs: prep for 7.17.2
• 8273f72 test: fix two tests that failed on the Rocky 8 old_sqlite job
• ce216fd build: a test environment for old version of SQLite
• 36e4a18 fix: combine failed on SQLite<3.34.0 #2356
• d80ed19 build: bump version to 7.17.2
• 1941ee1 docs: prep for 7.17.1
• 474bba1 chore: make upgrade
• 1ab58b3 chore: bump the action-dependencies group with 6 updates (#2355)
• Additional commits viewable in compare view

Updates pytest-asyncio from 1.4.1 to 1.4.1.post1

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.1.post1

1.4.1.post1 - 2026-11-01

Changed

• Removed the upper version bound on the pytest dependency. (#1605)

Commits

• e420349 Bump mypy pre-commit hook to v2.4.0 (#1601)
• 16a1ba4 chore: Prepare release of v1.4.1.post1.
• 7087e7f build: drop pytest upper bound (#1605) (#1606)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions