[dependabot]

Bumps tox from 4.65.0 to 4.67.13.

Release notes

Sourced from tox's releases.

v4.67.13

Bug fixes

• Relative {glob:...} and TOML replace = "glob" patterns now match files when tox_root contains [, * or ?. tox treats those characters in the project path literally while keeping wildcards in the configured pattern (#4389) by @​qodelicious and @​gaborbernat.
• When work_dir or tox_root contains [, * or ?, tox now treats those characters literally in its own executable paths and in default or relative package_glob patterns. This lets it run environment commands and find packages built by package = external (#4390) by @​qodelicious and @​gaborbernat.

New Contributors

• @​qodelicious made their first contribution in tox-dev/tox#4390

🐍 PyPI release

📜 Full Changelog

v4.67.12

Bug fixes

• A quoted set_env value that ends with a literal backslash and contains a semicolon no longer loses its quote protection, so WINPATH="C:\tools;C:\bin\\" keeps the whole value instead of failing with invalid marker. tox now counts the backslashes in front of a quote: an even number leaves the quote unescaped (#4388) by @​haigou-web and @​gaborbernat. (#4387)

🐍 PyPI release

📜 Full Changelog

v4.67.11

Bug fixes

• Package staging no longer fails on a .tox that only the project's own writers can change, such as one owned by the workspace owner while root runs tox, or a 777 build directory on Bitbucket. A work directory that other accounts could change, such as a 777 .tox left by an older tox under umask 000 or restored from a CI cache, is made private and emptied once at the start of a run, so tox recreates its environments instead of failing. When staging still refuses a path, the error names its owner and mode (#4386) by @​gaborbernat. (#4376)

🐍 PyPI release

📜 Full Changelog

v4.67.10

Bug fixes

• A pair of numbers after a - is no longer read as a range, so py-django-4-2 keeps its name instead of splitting into py-django-4, 3 and 2. Braced ranges such as py-django-{4-5} still expand (#4380) by @​ericdelorefice and @​gaborbernat.
• On Windows, quoted option values in requirements files and deps, such as -r "sub dir/base.txt", now have their quotes removed as they do on other platforms and in pip; before, the quotes stayed in the path and the file could not be opened. On every platform, a quoted -r, -c or -f value in deps keeps its spaces as written instead of gaining literal backslashes (#4381) by @​abo3losh1 and @​gaborbernat.

New Contributors

• @​abo3losh1 made their first contribution in tox-dev/tox#4381

... (truncated)

Changelog

Sourced from tox's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-67-13:

---

4.67.13 (2026-11-06)

---

.. _release-4-67-13-fixed:

Fixed

• Relative {glob:...} and TOML replace = "glob" patterns now match files when :ref:tox_root contains [, * or ?. tox treats those characters in the project path literally while keeping wildcards in the configured pattern (:pr:4389) by :user:qodelicious and :user:gaborbernat.
• When :ref:work_dir or :ref:tox_root contains [, * or ?, tox now treats those characters literally in its own executable paths and in default or relative :ref:package_glob patterns. This lets it run environment commands and find packages built by package = external (:pr:4390) by :user:qodelicious and :user:gaborbernat.

.. _release-4-67-12:

---

4.67.12 (2026-11-05)

---

.. _release-4-67-12-fixed:

Fixed

• A quoted set_env value that ends with a literal backslash and contains a semicolon no longer loses its quote protection, so WINPATH="C:\tools;C:\bin\\" keeps the whole value instead of failing with invalid marker. tox now counts the backslashes in front of a quote: an even number leaves the quote unescaped (:pr:4388) by :user:haigou-web and :user:gaborbernat. (:issue:4387)

.. _release-4-67-11:

---

4.67.11 (2026-11-04)

---

.. _release-4-67-11-fixed:

... (truncated)

Commits

• fee635f release 4.67.13
• b7f091f 🐛 fix(config): match relative globs in literal roots (#4389)
• 4860d69 🐛 fix(env): handle glob characters in paths (#4390)
• e06518d release 4.67.12
• a6ce4cc 🐛 fix(set_env): keep quotes around a value ending with a backslash (#4388)
• 11a2097 release 4.67.11
• 514b084 🐛 fix(staging): trust project writers, rebuild exposed .tox (#4386)
• e63f763 👷 ci: run release notes before PyPI publish (#4384)
• be99e7f 👷 ci: reduce macOS runner use (#4385)
• 9af3141 🧪 test(pylock): install from a local wheel (#4383)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.07%. Comparing base (1b0fd26) to head (a836e1c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #722   +/-   ##
=======================================
  Coverage   97.07%   97.07%           
=======================================
  Files          32       32           
  Lines        3490     3490           
=======================================
  Hits         3388     3388           
  Misses        102      102           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.