fix(deps): update minor and patch dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
coverage	>=7.12.0,<7.13 → >=7.14.2,<7.15
fastparquet	>=2026.3.0,<2026.4.0 → >=2026.5.0,<2026.6.0
hatchling (source, changelog)	==1.29.0 → ==1.30.1
idc-index-data (changelog)	==24.0.3 → ==24.2.1
pyright	>=1.1.408,<1.1.409 → >=1.1.410,<1.1.411

---

Release Notes

coveragepy/coveragepy (coverage)

v7.14.2

Compare Source

• Fix: some messages were being written to stdout, making coverage json -o - useless for capturing JSON output. Now messages are written to stderr,
  fixing issue 2197_.

• Fix: CoverageData kept one SQLite connection per thread that recorded
  coverage, but never closed them when those threads terminated. On long runs
  with many short-lived threads this leaked one file descriptor per dead
  thread, eventually failing with OSError: [Errno 24] Too many open files.
  Connections belonging to terminated threads are now closed and dropped.
  Fixes issue 2192_.

• Fix: when using sys.monitoring, we were assuming we could use the
  COVERAGE_ID tool id. But other tools might also assume they could use
  that id. Pre-allocated ids don't really make sense, so now we search for a
  usable one instead. Fixes issue 2187. Thanks, Matthew Lloyd <pull 2198_>.

• Following the advice of cibuildwheel <no-13t_>_, we no longer distribute
  wheels for Python 3.13 free-threaded.

.. _issue 2187: #​2187
.. _issue 2192: #​2192
.. _issue 2197: #​2197
.. _pull 2198: #​2198
.. _no-13t: https://py-free-threading.github.io/ci/#building-free-threaded-wheels-with-cibuildwheel

.. _changes_7-14-1:

v7.14.1

Compare Source

• Fix: the HTML report used typographic niceties to make file paths more
  readable by adding a small amount of space around slashes. Those spaces
  interfered with searching the page for file paths of interest. Now the report
  uses CSS to accomplish the same visual tweak so that searches with slashes
  work correctly. Closes issue 2170_.

• Add a 3.16 PyPI classifier <hugo-316_>_ since we test on the 3.16 main
  branch.

.. _issue 2170: #​2170
.. _hugo-316: https://mastodon.social/@​hugovk/116588523571204490

.. _changes_7-14-0:

v7.14.0

Compare Source

• Feature: now when running one of the reporting commands, if there are
  parallel data files that need combining, they will be implicitly combined
  before creating the report. There is no option to avoid the combination; let
  us know if you have a use case that requires it. Thanks, Tim Hatch <pull 2162_>. Closes issue 1781.

• Fix: the output from combine was too verbose, listing each file
  considered. Now it shows a single line with the counts of files combined,
  files skipped, and files with errors. The -q flag suppresses this line.
  The old detailed lines are available with the new --debug=combine option.

• Fix: running a Python file through a symlink now sets the sys.path correctly,
  matching regular Python behavior. Fixes issue 2157_.

• Fix: Collector.flush_data could fail with "RuntimeError: Set changed
  size during iteration" when a tracer in another thread added a line to the
  per-file set that add_lines (or add_arcs) was iterating. The values
  passed to CoverageData are now snapshotted via dict.copy() and
  set.copy(), which are atomic under the GIL. Thanks, Alex Vandiver <pull 2165_>_.

• Fix: the soft keyword lazy is now bolded in HTML reports.

• We are no longer testing eventlet support. Eventlet started issuing stern
  deprecation warnings that break our tests. Our support code is still there.

.. _issue 1781: #​1781
.. _issue 2157: #​2157
.. _pull 2162: #​2162
.. _pull 2165: #​2165

.. _changes_7-13-5:

v7.13.5

Compare Source

• Fix: issue 2138_ describes a memory leak that happened when repeatedly
  using the Coverage API with in-memory data. This is now fixed.

• Fix: the markdown-formatted coverage report didn't fully escape special
  characters in file paths (issue 2141). This would be very unlikely to
  cause a problem, but now it's done properly, thanks to Ellie Ayla <pull 2142_>.

• Fix: the C extension wouldn't build on VS2019, but now it does (issue 2145_).

.. _issue 2138: #​2138
.. _issue 2141: #​2141
.. _pull 2142: #​2142
.. _issue 2145: #​2145

.. _changes_7-13-4:

v7.13.4

Compare Source

• Fix: the third-party code fix in 7.13.3 required examining the parent
  directories where coverage was run. In the unusual situation that one of the
  parent directories is unreadable, a PermissionError would occur, as
  described in issue 2129_. This is now fixed.

• Fix: in test suites that change sys.path, coverage.py could fail with
  "RuntimeError: Set changed size during iteration" as described and fixed in
  pull 2130_. Thanks, Noah Fatsi.

• We now publish ppc64le wheels, thanks to Pankhudi Jain <pull 2121_>_.

.. _pull 2121: #​2121
.. _issue 2129: #​2129
.. _pull 2130: #​2130

.. _changes_7-13-3:

v7.13.3

Compare Source

• Fix: in some situations, third-party code was measured when it shouldn't have
  been, slowing down test execution. This happened with layered virtual
  environments such as uv sometimes makes. The problem is fixed, closing issue 2082_. Now any directory on sys.path that is inside a virtualenv is
  considered third-party code.

.. _issue 2082: #​2082

.. _changes_7-13-2:

v7.13.2

Compare Source

• Fix: when Python is installed via symlinks, for example with Homebrew, the
  standard library files could be incorrectly included in coverage reports.
  This is now fixed, closing issue 2115_.

• Fix: if a data file is created with no read permissions, the combine step
  would fail completely. Now a warning is issued and the file is skipped.
  Closes issue 2117_.

.. _issue 2115: #​2115
.. _issue 2117: #​2117

.. _changes_7-13-1:

v7.13.1

Compare Source

• Added: the JSON report now includes a "start_line" key for function and
  class regions, indicating the first line of the region in the source. Closes
  issue 2110_.

• Added: The debug data command now takes file names as arguments on the
  command line, so you can inspect specific data files without needing to set
  the COVERAGE_FILE environment variable.

• Fix: the JSON report used to report module docstrings as executed lines,
  which no other report did, as described in issue 2105_. This is now fixed,
  thanks to Jianrong Zhao.

• Fix: coverage.py uses a more disciplined approach to detecting where
  third-party code is installed, and avoids measuring it. This shouldn't change
  any behavior. If you find that it does, please get in touch.

• Performance: data files that will be combined now record their hash as part
  of the file name. This lets us skip duplicate data more quickly, speeding the
  combining step.

• Docs: added a section explaining more about what is considered a missing
  branch and how it is reported: :ref:branch_explain, as requested in issue 1597. Thanks to Ayisha Mohammed <pull 2092_>.

• Tests: the test suite misunderstood what core was being tested if
  COVERAGE_CORE wasn't set on 3.14+. This is now fixed, closing issue 2109_.

.. _issue 1597: #​1597
.. _pull 2092: #​2092
.. _issue 2105: #​2105
.. _issue 2109: #​2109
.. _issue 2110: #​2110

.. _changes_7-13-0:

v7.13.0

Compare Source

• Feature: coverage.py now supports :file:.coveragerc.toml configuration
  files. These files use TOML syntax and take priority over
  :file:pyproject.toml but lower priority than :file:.coveragerc files.
  Closes issue 1643_ thanks to Olena Yefymenko <pull 1952_>_.

• Fix: we now include a permanent .pth file which is installed with the code,
  fixing issue 2084. In 7.12.1b1 this was done incorrectly: it didn't work
  when using the source wheel (py3-none-any). This is now fixed. Thanks,
  Henry Schreiner <pull 2100_>.

• Deprecated: when coverage.py is installed, it creates three command entry
  points: coverage, coverage3, and coverage-3.10 (if installed for
  Python 3.10). The second and third of these are not needed and will
  eventually be removed. They still work for now, but print a message about
  their deprecation.

.. _issue 1643: #​1643
.. _pull 1952: #​1952
.. _pull 2100: #​2100

.. _changes_7-12-1b1:

dask/fastparquet (fastparquet)

v2026.5.0

Compare Source

pypa/hatch (hatchling)

v1.30.1: Hatchling v1.30.1

Compare Source

Fixed

• Default core metadata version kept at 2.4 until more tools support 2.5

v1.30.0

Compare Source

ImagingDataCommons/idc-index-data (idc-index-data)

v24.2.1

Compare Source

What's Changed

• enh: add parquet provenance — version metadata and SHA256 checksums by @​fedorov in #​151

Full Changelog: ImagingDataCommons/idc-index-data@24.2.0...24.2.1

v24.2.0

Compare Source

What's Changed

• enh: add ct_index, mr_index, and pt_index with modality-specific acquisition parameters by @​fedorov in #​145

Full Changelog: ImagingDataCommons/idc-index-data@24.1.0...24.2.0

v24.1.0

Compare Source

What's Changed

• Improve versioning, add SQL query/result caching, optimize main index query by @​fedorov in #​142

Full Changelog: ImagingDataCommons/idc-index-data@24.0.4...24.1.0

v24.0.4

Compare Source

What's Changed

• Update analysis_results column names; drop GDC cases that do not have matched case ID by @​fedorov in #​141

Full Changelog: ImagingDataCommons/idc-index-data@24.0.3...24.0.4

RobertCraigie/pyright-python (pyright)

v1.1.410

Compare Source

v1.1.409

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 12:00 AM and 05:59 AM (* 0-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[helmut-hoffer-von-ankershoffen]

❌ CI failing — known coverage 7.13.x regression

This PR bumps coverage from >=7.12.0,<7.13 to >=7.13.5,<7.14, but the regression that motivated the original pin is still present in 7.13.5. All runners fail with the same CTracer INTERNALERROR during the sequential integration test run:

INTERNALERROR> AssertionError: Expected current collector to be <Collector at 0x...: CTracer>,
               but it's <Collector at 0x...: CTracer>

Full call chain: pytest_cov/plugin.py → cov_controller.finish() → cov.stop() → coverage/collector.py:344

This is the exact bug documented in the pin comment in pyproject.toml:

coverage 7.13.x introduced a regression where pytest-cov fails with "INTERNALERROR: Expected current collector to be ..." when tests spawn subprocesses (e.g., marimo server). Re-evaluate when coverage releases a fix.

Setting to draft until coverage ships a fix. Consider adding a Renovate ignore rule for coverage so the bot does not keep reopening this.

---

Posted by Claude Sonnet 4.6 via Claude Code.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pyproject.toml

Artifact update for coverage resolved to version 7.14.3, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 7.14.2
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud