Merge branch 'main' into 3512-hangs-on-installpkg-sdist

Author: gaborbernat

.github/workflows/check.yaml

@@ -30,11 +30,11 @@ jobs:
           - "3.10"
           - "3.9"
         os:
-          - ubuntu-latest
-          - windows-latest
-          - macos-latest
+          - ubuntu-24.04
+          - windows-2025
+          - macos-15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Install the latest version of uv
@@ -70,12 +70,12 @@ jobs:
           - docs
           - pkg_meta
         os:
-          - ubuntu-latest
-          - windows-latest
+          - ubuntu-24.04
+          - windows-2025
         exclude:
           - { os: windows-latest, tox_env: docs }
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Install the latest version of uv

.github/workflows/release.yaml

@@ -9,9 +9,9 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Install the latest version of uv
@@ -31,15 +31,15 @@ jobs:
   release:
     needs:
       - build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     environment:
       name: release
       url: https://pypi.org/project/tox/${{ github.ref_name }}
     permissions:
       id-token: write
     steps:
       - name: Download all the dists
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: ${{ env.dists-artifact-name }}
           path: dist/

.pre-commit-config.yaml

@@ -1,11 +1,11 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.33.0
+    rev: 0.33.3
     hooks:
       - id: check-github-workflows
         args: ["--verbose"]
@@ -15,19 +15,19 @@ repos:
       - id: codespell
         additional_dependencies: ["tomli>=2.2.1"]
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "v2.5.1"
+    rev: "v2.6.0"
     hooks:
       - id: pyproject-fmt
   - repo: https://github.com/abravalheri/validate-pyproject
     rev: "v0.24.1"
     hooks:
       - id: validate-pyproject
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "v0.11.9"
+    rev: "v0.12.11"
     hooks:
-      - id: ruff-format
-      - id: ruff
+      - id: ruff-check
         args: ["--fix", "--unsafe-fixes", "--exit-non-zero-on-fix"]
+      - id: ruff-format
   - repo: https://github.com/asottile/blacken-docs
     rev: 1.19.1
     hooks:
@@ -38,7 +38,7 @@ repos:
     hooks:
       - id: rst-backticks
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: "v3.5.3"
+    rev: "v3.6.2"
     hooks:
       - id: prettier
   - repo: local

docs/changelog.rst

@@ -4,6 +4,82 @@ Release History
 
 .. towncrier release notes start
 
+v4.29.0 (2025-08-29)
+--------------------
+
+Features - 4.29.0
+~~~~~~~~~~~~~~~~~
+- A new tox life cycle event is now exposed for use via :doc:`Plugins
+  API </plugins>` -- by :user:`webknjaz`.
+
+  The corresponding hook point is :func:`tox_extend_envs
+  <tox.plugin.spec.tox_extend_envs>`. It allows plugin authors to
+  declare ephemeral environments that they can then populate through
+  the in-memory configuration loader interface.
+
+  This patch was made possible thanks to pair programming with
+  :user:`gaborbernat` at PyCon US 2025. (:issue:`3510`, :issue:`3591`)
+
+v4.28.4 (2025-07-31)
+--------------------
+
+Features - 4.28.4
+~~~~~~~~~~~~~~~~~
+- Pass ssh-agent variables ``SSH_AGENT_PID`` and ``SSH_AUTH_SOCK`` in ``pass_env`` by default.
+  - by :user:`daniilgankov` (:issue:`3572`)
+
+v4.28.3 (2025-07-25)
+--------------------
+
+No significant changes.
+
+
+v4.28.2 (2025-07-25)
+--------------------
+
+Bugfixes - 4.28.2
+~~~~~~~~~~~~~~~~~
+- Don't pass in the filter argument to tar.extractall on old Python versions - by :user:`gaborbernat`. (:issue:`3568`)
+
+v4.28.1 (2025-07-22)
+--------------------
+
+Bugfixes - 4.28.1
+~~~~~~~~~~~~~~~~~
+- Use `tarfile.data_filter <https://docs.python.org/3/library/tarfile.html#tarfile.data_filter>`_ with ``extractall``
+  only on supported Python versions:
+
+  - ``>= 3.11.4``
+  - ``>= 3.10.12`` and ``< 3.11``
+  - ``>= 3.9.17`` and ``< 3.10``
+
+  by :user:`gaborbernat`. (:issue:`3565`)
+
+v4.28.0 (2025-07-20)
+--------------------
+
+Features - 4.28.0
+~~~~~~~~~~~~~~~~~
+- Added ``constraints`` to allow specifying constraints files for all dependencies. (:issue:`3550`)
+- Allow disabling tox plugins via the ``TOX_DISABLED_EXTERNAL_PLUGINS`` environment variable - by :user:`gaborbernat`. (:issue:`3468`)
+
+Improved Documentation - 4.28.0
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+- The ``min_version``/``minversion`` config option is deprecated in favor of the ``requires`` option. (:issue:`3553`)
+
+v4.27.0 (2025-06-17)
+--------------------
+
+Features - 4.27.0
+~~~~~~~~~~~~~~~~~
+- Add ``free_threaded`` flag to to ``"python"`` entries in json output of ``--result-json``. (:issue:`3534`)
+
+Bugfixes - 4.27.0
+~~~~~~~~~~~~~~~~~
+- Fix dependency-group name normalization. (:issue:`3539`)
+- Improves logging of environment variables by sorting them by key and redacting
+  the values for the ones that are likely to contain secrets. (:issue:`3542`)
+
 v4.26.0 (2025-05-13)
 --------------------
 

docs/changelog/3442.feature.rst

@@ -0,0 +1 @@
+Add ``__TOX_ENVIRONMENT_VARIABLE_ORIGINAL_CI``, which passes through the ``CI`` variable if present. This is intended for use by other libraries to detect if tox is running under CI.

docs/changelog/3534.feature.rst

@@ -0,0 +1,2 @@
+Makes the error message more clear when pyproject.toml file cannot be loaded
+or is missing expected keys.

docs/changelog/3578.bugfix.rst

@@ -46,7 +46,8 @@ For example:
 .. code-block:: ini
 
     [tox]
-    min_version = 4.20
+    requires =
+        tox >= 4.20
     env_list =
         3.13
         3.12
@@ -74,7 +75,8 @@ This configuration file uses:
 .. code-block:: ini
 
     [tox:tox]
-    min_version = 4.0
+    requires =
+        tox >= 4.0
     env_list =
         3.13
         3.12
@@ -98,7 +100,8 @@ instead inside the ``pyproject.toml`` file under the ``tool.tox`` table and ``le
     [tool.tox]
     legacy_tox_ini = """
         [tox]
-        min_version = 4.0
+        requires =
+            tox >= 4.0
         env_list =
             py310
             py39
@@ -203,6 +206,9 @@ The following options are set in the ``[tox]`` section of ``tox.ini`` or the ``[
 .. conf::
    :keys: min_version, minversion
    :default: <current version of tox>
+   :version_deprecated: 4.28.0
+
+   **DEPRECATED** Prefer requiring a minimum tox version via :ref:`requires`.
 
    A string to define the minimal tox version required to run. If the host's tox version is less than this, it will
    automatically create a provisioned tox environment that satisfies this requirement. See :ref:`provision_tox_env`
@@ -546,6 +552,16 @@ Base options
             - ✅
             - ✅
             - ✅
+        *   - SSH_AGENT_PID
+            - ✅
+            - ✅
+            - ❌
+        *   - SSH_AUTH_SOCK
+            - ✅
+            - ✅
+            - ❌
+
+   If the environment variable ``CI`` is present, ``__TOX_ENVIRONMENT_VARIABLE_ORIGINAL_CI`` will be set to the value of ``CI``. The ``CI`` variable itself will not be passed through.
 
    More environment variable-related information can be found in :ref:`environment variable substitutions`.
 
@@ -561,7 +577,7 @@ Base options
        .. code-block:: toml
 
           [tool.tox.env_run_base]
-          set_env = { file = "conf{/}local.env", TEST_TIMEOUT = 30 }
+          set_env = { file = "conf{/}local.env", TEST_TIMEOUT = "30" }
 
     .. tab:: INI
 
@@ -936,15 +952,15 @@ Python run
    :keys: deps
    :default: <empty list>
 
-   Name of the Python dependencies. Installed into the environment prior to project after environment creation, but
+   Python dependencies. Installed into the environment prior to project after environment creation, but
    before package installation. All installer commands are executed using the :ref:`tox_root` as the current working
    directory. Each value must be one of:
 
    - a Python dependency as specified by :pep:`440`,
    - a `requirement file <https://pip.pypa.io/en/stable/user_guide/#requirements-files>`_ when the value starts with
-     ``-r`` (followed by a file path),
+     ``-r`` (followed by a file path or URL),
    - a `constraint file <https://pip.pypa.io/en/stable/user_guide/#constraints-files>`_ when the value starts with
-     ``-c`` (followed by a file path).
+     ``-c`` (followed by a file path or URL).
 
    If you are only defining :pep:`508` requirements (aka no pip requirement files), you should use
    :ref:`dependency_groups` instead.
@@ -971,6 +987,21 @@ Python run
             -r requirements.txt
             -c constraints.txt
 
+   .. note::
+
+      :ref:`constraints` is the preferred way to specify constraints files since they will apply to package dependencies
+      also.
+
+.. conf::
+   :keys: constraints
+   :default: <empty list>
+   :version_added: 4.28.0
+
+   `Constraints files <https://pip.pypa.io/en/stable/user_guide/#constraints-files>`_ to use during package and
+   dependency installation. Provided constraints files will be used when installing package dependencies and any
+   additional dependencies specified in :ref:`deps`, but will not be used when installing the package itself.
+   Each value must be a file path or URL.
+
 .. conf::
    :keys: use_develop, usedevelop
    :default: false
@@ -1204,7 +1235,6 @@ Pip installer
    This command will be executed only if executing on Continuous Integrations is detected (for example set environment
    variable ``CI=1``) or if journal is active.
 
-
 .. conf::
    :keys: pip_pre
    :default: false
@@ -1221,7 +1251,7 @@ Pip installer
 
    If ``constrain_package_deps`` is true, then tox will create and use ``{env_dir}{/}constraints.txt`` when installing
    package dependencies during ``install_package_deps`` stage. When this value is set to false, any conflicting package
-   dependencies will override explicit dependencies and constraints passed to ``deps``.
+   dependencies will override explicit dependencies and constraints passed to :ref:`deps`.
 
 .. conf::
    :keys: use_frozen_constraints

docs/config.rst

@@ -2,10 +2,10 @@ Installation
 ============
 
 As tool
---------
+-------
 
 :pypi:`tox` is a CLI tool that needs a Python interpreter (version 3.9 or higher) to run. We recommend either
-:pypi:`pipx` or  :pypi:`uv` to install tox into an isolated environment. This has the added benefit that later you'll
+:pypi:`pipx` or :pypi:`uv` to install tox into an isolated environment. This has the added benefit that later you'll
 be able to upgrade tox without affecting other parts of the system. We provide method for ``pip`` too here but we
 discourage that path if you can:
 
@@ -17,7 +17,6 @@ discourage that path if you can:
         uv tool install tox
         tox --help
 
-
 .. tab:: pipx
 
     .. code-block:: bash
@@ -40,6 +39,7 @@ discourage that path if you can:
 
 wheel
 ~~~~~
+
 Installing tox via a wheel (default with pip) requires an installer that can understand the ``python-requires`` tag (see
 :pep:`503`), with pip this is version ``9.0.0`` (released in November 2016). Furthermore, in case you're not installing
 it via PyPI you need to use a mirror that correctly forwards the ``python-requires`` tag (notably the OpenStack mirrors
@@ -49,19 +49,22 @@ don't do this, or older :gh_repo:`devpi/devpi` versions - added with version ``4
 
 sdist
 ~~~~~
+
 When installing via a source distribution you need an installer that handles the :pep:`517` specification. In case of
 ``pip`` this is version ``18.0.0`` or later (released in July 2018). If you cannot upgrade your pip to support this you
 need to ensure that the build requirements from :gh:`pyproject.toml <tox-dev/tox/blob/main/pyproject.toml>` are
 satisfied before triggering the installation.
 
 via ``setup.py``
 ----------------
+
 We don't recommend and officially support this method. You should prefer using an installer that supports :pep:`517`
 interface, such as pip ``19.0.0`` or later. That being said you might be able to still install a package via this method
 if you satisfy build dependencies before calling the installation command (as described under :ref:`sdist`).
 
 latest unreleased
 -----------------
+
 Installing an unreleased version is discouraged and should be only done for testing purposes. If you do so you'll need
 a pip version of at least ``18.0.0`` and use the following command: