[dependabot]

Bumps filelock from 3.29.0 to 4.2.9.

Release notes

Sourced from filelock's releases.

4.2.9

Bug fixes

• ReadWriteLock, SoftReadWriteLock and their async wrappers now raise TypeError for a blocking that is not a bool, in the constructor and on acquire, as FileLock already does. Before, blocking=0 waited out the full timeout on a contended ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (#908) by @​abhishekcpp007 and @​gaborbernat.

New Contributors

• @​abhishekcpp007 made their first contribution in tox-dev/filelock#908

🐍 PyPI release

📜 Full Changelog

4.2.8

Documentation

• Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (#905) by @​boyfeiyu.

New Contributors

• @​boyfeiyu made their first contribution in tox-dev/filelock#905

🐍 PyPI release

📜 Full Changelog

4.2.7

Bug fixes

• A SoftFileLease reclaims a dead holder's lease marker even when that holder published another lease_duration. It used to raise LeaseSettingsMismatch on every attempt instead, so after a holder crashed and its peers restarted with a changed duration the lock stayed wedged until force_break(). A live holder with another duration still raises (#900) by @​dxbjavid and @​gaborbernat.

PyPI release

Full Changelog

4.2.6

Bug fixes

• Fix a race in SoftFileLock, MarkerSoftFileLock and SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (#899) by @​dxbjavid and @​gaborbernat.

PyPI release

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-10:

---

4.2.10 (2026-11-09)

---

.. _release-4-2-10-fixed:

Fixed

• Contended :class:~filelock.FileLock and :class:~filelock.SoftFileLock acquisitions now raise :class:~filelock.Timeout when elapsed time reaches the requested timeout. A clock that landed exactly on the deadline previously left a waiter retrying with zero-length sleeps indefinitely (:pr:922) by :user:gaborbernat.

.. _release-4-2-10-packaging:

Packaging

• Every wheel now carries a PEP 770 <https://peps.python.org/pep-0770/>_ CycloneDX SBOM in its .dist-info/sboms directory, written at build time by python-sbom <https://github.com/tox-dev/python-sbom>_ (:pr:921) by :user:gaborbernat.

.. _release-4-2-9:

---

4.2.9 (2026-11-04)

---

.. _release-4-2-9-fixed:

Fixed

• :class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers now raise :class:TypeError for a blocking that is not a :class:bool, in the constructor and on acquire, as :class:~filelock.FileLock already does. Before, blocking=0 waited out the full timeout on a contended :class:~filelock.ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (:pr:908) by :user:abhishekcpp007 and :user:gaborbernat.

.. _release-4-2-8:

... (truncated)

Commits

• 8803429 release 4.2.9
• 030c5e2 🐛 fix(rw): reject a non-bool blocking (#908)
• 90760d8 release 4.2.8
• 19af0ad 👷 ci: adopt shared check, CodeQL and release workflows (#907)
• 2ac1e92 📝 docs(descriptor): clarify native lock protocol compatibility (#905)
• 6223054 build(deps): refresh project lock (#906)
• bee5ab3 🔧 build(deps): refresh CI and docs tools (#904)
• 825f3b5 👷 ci(scorecard): publish OpenSSF results (#903)
• e386afb 🔧 build(deps): use release-creator 4.4 (#902)
• 4257ca7 👷 ci(news): stop cancelling the news check (#901)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)