Update to attrs 25.3.0

tools/third_party/attrs/.git_archival.txt

@@ -1,4 +1,3 @@
 node: $Format:%H$
 node-date: $Format:%cI$
 describe-name: $Format:%(describe:tags=true,match=*[0-9]*)$
-ref-names: $Format:%D$

tools/third_party/attrs/.github/CODE_OF_CONDUCT.md

@@ -6,7 +6,7 @@
 We as members, contributors, and leaders pledge to make participation in our
 community a harassment-free experience for everyone, regardless of age, body
 size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
+identity and expression, level of experience, education, socioeconomic status,
 nationality, personal appearance, race, caste, color, religion, or sexual
 identity and orientation.
 

tools/third_party/attrs/.github/PULL_REQUEST_TEMPLATE.md

@@ -16,7 +16,7 @@ If your pull request is a documentation fix or a trivial typo, feel free to dele
 
 - [ ] Do **not** open pull requests from your `main` branch – **use a separate branch**!
   - There's a ton of footguns waiting if you don't heed this warning. You can still go back to your project, create a branch from your main branch, push it, and open the pull request from the new branch.
-  - This is not a pre-requisite for your your pull request to be accepted, but **you have been warned**.
+  - This is not a pre-requisite for your pull request to be accepted, but **you have been warned**.
 - [ ] Added **tests** for changed code.
   Our CI fails if coverage is not 100%.
 - [ ] New features have been added to our [Hypothesis testing strategy](https://github.com/python-attrs/attrs/blob/main/tests/strategies.py).
@@ -25,12 +25,13 @@ If your pull request is a documentation fix or a trivial typo, feel free to dele
     - [ ] If they've been added to `attr/__init__.pyi`, they've *also* been re-imported in `attrs/__init__.pyi`.
 - [ ] Updated **documentation** for changed code.
     - [ ] New functions/classes have to be added to `docs/api.rst` by hand.
-    - [ ] Changes to the signature of `@attr.s()` have to be added by hand too.
+    - [ ] Changes to the signatures of `@attr.s()` and `@attrs.define()` have to be added by hand too.
     - [ ] Changed/added classes/methods/functions have appropriate `versionadded`, `versionchanged`, or `deprecated` [directives](http://www.sphinx-doc.org/en/stable/markup/para.html#directive-versionadded).
           The next version is the second number in the current release + 1.
           The first number represents the current year.
           So if the current version on PyPI is 22.2.0, the next version is gonna be 22.3.0.
           If the next version is the first in the new year, it'll be 23.1.0.
+      - [ ] If something changed that affects both `attrs.define()` and `attr.s()`, you have to add version directives to both.
 - [ ] Documentation in `.rst` and `.md` files is written using [semantic newlines](https://rhodesmill.org/brandon/2012/one-sentence-per-line/).
 - [ ] Changes (and possible deprecations) have news fragments in [`changelog.d`](https://github.com/python-attrs/attrs/blob/main/changelog.d).
 - [ ] Consider granting [push permissions to the PR branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork), so maintainers can fix minor issues themselves without pestering you.

tools/third_party/attrs/.github/SECURITY.md

@@ -2,13 +2,13 @@
 
 ## Supported Versions
 
-We are following [*CalVer*](https://calver.org) with generous backwards-compatibility guarantees.
+We are following [Calendar Versioning](https://calver.org) with generous backwards-compatibility guarantees.
 Therefore we only support the latest version.
 
 Put simply, you shouldn't ever be afraid to upgrade as long as you're only using our public APIs.
 Whenever there is a need to break compatibility, it is announced in the changelog, and raises a `DeprecationWarning` for a year (if possible) before it's finally really broken.
 
-> **Warning**
+> [!WARNING]
 > The structure of the `attrs.Attribute` class is exempt from this rule.
 > It *will* change in the future, but since it should be considered read-only, that shouldn't matter.
 >

tools/third_party/attrs/.github/workflows/build-docset.yml

@@ -10,8 +10,8 @@ env:
   PIP_DISABLE_PIP_VERSION_CHECK: "1"
   PIP_NO_PYTHON_VERSION_WARNING: "1"
 
-permissions:
-  contents: read
+permissions: {}
+
 
 jobs:
   docset:
@@ -20,15 +20,15 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v4
+          persist-credentials: false
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.x"
+      - uses: hynek/setup-cached-uv@v2
 
-      - run: python -Im pip install tox
-
-      - run: python -Im tox run -e docset
+      - run: uvx --with=tox-uv tox run -e docset
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: docset
           path: attrs.tgz

tools/third_party/attrs/.github/workflows/ci.yml

@@ -7,155 +7,205 @@ on:
     branches: [main]
     tags: ["*"]
   pull_request:
-    branches: [main]
   workflow_dispatch:
 
 env:
-  FORCE_COLOR: "1" # Make tools pretty.
+  FORCE_COLOR: "1"
   PIP_DISABLE_PIP_VERSION_CHECK: "1"
   PIP_NO_PYTHON_VERSION_WARNING: "1"
-  # Use oldest version used in doctests / examples.
-  SETUPTOOLS_SCM_PRETEND_VERSION: "19.2.0"
 
 permissions: {}
 
+
 jobs:
+  build-package:
+    name: Build & verify package
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: hynek/build-and-inspect-python-package@v2
+        id: baipp
+
+    outputs:
+      # Used to define the matrix for tests below. The value is based on
+      # packaging metadata (trove classifiers).
+      supported-python-versions: ${{ steps.baipp.outputs.supported_python_classifiers_json_array }}
+
   tests:
     name: Tests & Mypy on ${{ matrix.python-version }}
     runs-on: ubuntu-latest
+    needs: build-package
 
     strategy:
       fail-fast: false
       matrix:
-        python-version:
-          - "3.7"
-          - "3.8"
-          - "3.9"
-          - "3.10"
-          - "3.11"
-          - "3.12"
-          # - "pypy-3.7"
-          - "pypy-3.8"
-          - "pypy-3.9"
-          - "pypy-3.10"
+        # Created by the build-and-inspect-python-package action above.
+        python-version: ${{ fromJson(needs.build-package.outputs.supported-python-versions) }}
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - name: Download pre-built packages
+        uses: actions/download-artifact@v4
         with:
-          python-version: ${{ matrix.python-version }}
-          allow-prereleases: true
-          cache: pip
+          name: Packages
+          path: dist
+      - run: tar xf dist/*.tar.gz --strip-components=1
+      - uses: hynek/setup-cached-uv@v2
 
       - name: Prepare tox
+        env:
+          V: ${{ matrix.python-version }}
         run: |
-          V=${{ matrix.python-version }}
-
-          if [[ "$V" = pypy-* ]]; then
-            V=pypy3
-            IS_PYPY=1
-          else
-            V=py$(echo $V | tr -d .)
-            IS_PYPY=0
+          DO_MYPY=1
+
+          if [[ "$V" == "3.8" || "$V" == "3.9" ]]; then
+            DO_MYPY=0
           fi
 
-          echo IS_PYPY=$IS_PYPY >>$GITHUB_ENV
-          echo TOX_PYTHON=$V >>$GITHUB_ENV
+          echo DO_MYPY=$DO_MYPY >>$GITHUB_ENV
+          echo TOX_PYTHON=py$(echo $V | tr -d .) >>$GITHUB_ENV
+
+      - run: >
+          uvx --with=tox-uv
+          tox run
+          -e $TOX_PYTHON-mypy
+        if: env.DO_MYPY == '1'
 
-          python -Im pip install tox
+      - name: Remove src to ensure tests run against wheel
+        run: rm -rf src
 
-      - run: python -Im tox run -e ${{ env.TOX_PYTHON }}-tests
-      - run: python -Im tox run -e ${{ env.TOX_PYTHON }}-mypy
-        if: env.IS_PYPY == '0' && matrix.python-version != '3.7'
+      - run: >
+          uvx --with=tox-uv
+          tox run
+          --installpkg dist/*.whl
+          -e $TOX_PYTHON-tests
 
       - name: Upload coverage data
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: coverage-data
+          name: coverage-data-${{ matrix.python-version }}
           path: .coverage.*
+          include-hidden-files: true
           if-no-files-found: ignore
 
+  tests-pypy:
+    name: Tests on ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    needs: build-package
+
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version:
+          - pypy-3.10
+
+    steps:
+      - name: Download pre-built packages
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+      - run: |
+          tar xf dist/*.tar.gz --strip-components=1
+          rm -rf src  # ensure tests run against wheel
+      - uses: hynek/setup-cached-uv@v2
+
+      - run: >
+          uvx --with=tox-uv
+          tox run
+          --installpkg dist/*.whl
+          -e pypy3-tests
+
   coverage:
-    name: Combine & check coverage.
+    name: Combine & check coverage
     runs-on: ubuntu-latest
     needs: tests
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - name: Download pre-built packages
+        uses: actions/download-artifact@v4
         with:
-          python-version-file: .python-version-default
-          cache: pip
+          name: Packages
+          path: dist
+      - run: tar xf dist/*.tar.gz --strip-components=1
+      - uses: hynek/setup-cached-uv@v2
 
       - name: Download coverage data
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
-          name: coverage-data
+          pattern: coverage-data-*
+          merge-multiple: true
 
       - name: Combine coverage & fail if it's <100%.
         run: |
-          python -Im pip install coverage[toml]
+          uv tool install --python $(cat .python-version-default) coverage
 
-          python -Im coverage combine
-          python -Im coverage html --skip-covered --skip-empty
+          coverage combine
+          coverage html --skip-covered --skip-empty
 
           # Report and write to summary.
-          python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
+          coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
 
           # Report again and fail if under 100%.
-          python -Im coverage report --fail-under=100
+          coverage report --fail-under=100
 
       - name: Upload HTML report if check failed.
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: html-report
           path: htmlcov
         if: ${{ failure() }}
 
   docs:
-    name: Build docs & run doctests
+    name: Run doctests & render changelog
     runs-on: ubuntu-latest
+    needs: build-package
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - name: Download pre-built packages
+        uses: actions/download-artifact@v4
         with:
-          # Keep in sync with tox/docs and .readthedocs.yaml.
-          python-version: "3.12"
-          cache: pip
+          name: Packages
+          path: dist
+      - run: tar xf dist/*.tar.gz --strip-components=1
+      - uses: hynek/setup-cached-uv@v2
 
-      - run: python -Im pip install tox
-      - run: python -Im tox run -e docs,changelog
+      - run: uvx --with=tox-uv tox run -e docs-doctests,changelog
 
   pyright:
     name: Check types using pyright
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
         with:
-          python-version-file: .python-version-default
-          cache: pip
+          persist-credentials: false
+      - uses: hynek/setup-cached-uv@v2
 
-      - run: python -Im pip install tox
-      - run: python -Im tox run -e pyright
+      - run: >
+          uvx --with=tox-uv
+          --python $(cat .python-version-default)
+          tox run -e pyright
 
   install-dev:
     name: Verify dev env
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest]
+    runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
         with:
-          python-version-file: .python-version-default
-          cache: pip
+          persist-credentials: false
+      - uses: hynek/setup-cached-uv@v2
+
+      - run: uv venv --python $(cat .python-version-default)
+      - run: uv pip install -e .[dev]
 
-      - name: Install in dev mode & import
+      - name: Ensure we can import attr and attrs packages
         run: |
-          python -Im pip install -e .[dev]
+          source .venv/bin/activate
+
           python -Ic 'import attr; print(attr.__version__)'
           python -Ic 'import attrs; print(attrs.__version__)'
 
@@ -165,6 +215,7 @@ jobs:
 
     needs:
       - coverage
+      - tests-pypy
       - docs
       - install-dev
       - pyright

tools/third_party/attrs/.github/workflows/codeql-analysis.yml

@@ -25,11 +25,16 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
 
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3