chore(deps): bump filelock from 3.13.1 to 3.20.3

[dependabot]

Bumps filelock from 3.13.1 to 3.20.3.

Release notes

Sourced from filelock's releases.

3.20.3

What's Changed

• Fix TOCTOU symlink vulnerability in SoftFileLock by @​gaborbernat in tox-dev/filelock#465

Full Changelog: tox-dev/filelock@3.20.2...3.20.3

3.20.2

What's Changed

• Support Unix systems without O_NOFOLLOW by @​mwilliamson in tox-dev/filelock#463
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in tox-dev/filelock#464

New Contributors

• @​mwilliamson made their first contribution in tox-dev/filelock#463

Full Changelog: tox-dev/filelock@3.20.1...3.20.2

3.20.1

What's Changed

• CVE-2025-68146: Fix TOCTOU symlink vulnerability in lock file creation by @​gaborbernat in tox-dev/filelock#461

Full Changelog: tox-dev/filelock@3.20.0...3.20.1

3.20.0

What's Changed

• Add tox.toml to sdist by @​mtelka in tox-dev/filelock#436
• Update docs with example by @​znichollscr in tox-dev/filelock#438
• Add 3.14 support and drop 3.9 by @​gaborbernat in tox-dev/filelock#448

New Contributors

• @​mtelka made their first contribution in tox-dev/filelock#436
• @​znichollscr made their first contribution in tox-dev/filelock#438

Full Changelog: tox-dev/filelock@3.19.1...3.20.0

3.19.1

What's Changed

• add 3.14t (free threading) to matrix by @​paultiq in tox-dev/filelock#433
• Increase test coverage by @​paultiq in tox-dev/filelock#434

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

3.30.3 (2026-07-17)

---

• AsyncFileLock and AsyncSoftFileLock no longer raise a deadlock RuntimeError when a different asyncio task waits for a lock they hold; the check now scopes holders to the owning task, so only a same-task reacquire is refused. :pr:676
• Keep both tables of contents on screen at any browser font size. The widened body column sized itself in em against the reader's font size while the breakpoints that fold the layout resolve em against a fixed 16px, so a reader whose default font is larger than 16px had the right-hand table of contents clipped off the edge. The body column now flexes instead, and the right-hand table of contents hides only at the mobile breakpoint. :pr:673
• Color the mermaid diagrams from whichever theme is active. They previously carried a light palette baked into each diagram's source, which stayed light on a dark page. :pr:674

---

3.30.2 (2026-07-16)

---

• Stop :class:~filelock.SoftFileLease deleting a live marker whose mode it does not implement. An unrecognized mode now names its owner instead of reading as malformed, so a record written by a newer filelock survives the grace window rather than being evicted after two seconds. :pr:672
• Stop :class:~filelock.StrictSoftFileLock and :class:~filelock.AsyncStrictSoftFileLock calling themselves a native OS lock when they warn that they ignore lifetime; they now say a strict claim is only ever cleared by force_break(). :pr:672
• Cover every lock type in the tutorials and how-to guides, with examples drawn from projects that use filelock, and color the mermaid diagrams. Correct the claims that StrictSoftFileLock exposes owner, that :class:~filelock.SoftFileLock evicts a strict sentinel, that :class:~filelock.ReadWriteLock requires a .db extension, and that every log record is DEBUG. :pr:672

---

3.30.1 (2026-07-16)

---

• StrictSoftFileLock and AsyncStrictSoftFileLock no longer abort acquisition when a peer's claim vanishes as an NFSv3 stale filehandle instead of a clean removal; the reader revalidates and skips it, so strict locks hold mutual exclusion across independent NFSv3 client caches. :pr:669
• SoftFileLease reads a marker whose lease duration is nan or inf as malformed rather than as a valid lease, so such a marker ages out through the grace window instead of raising LeaseSettingsMismatch on every contender. :pr:670

---

3.30.0 (2026-07-16)

---

• Add context_error_policy to surface body and release failures as a :exc:BaseExceptionGroup. :pr:618
• Add close_error_policy to control an :func:os.close failure after the OS unlock. :pr:619
• Add :func:~filelock.lock_descriptor and :func:~filelock.unlock_descriptor to lock a caller-owned file descriptor. :pr:620
• Add fallback_to_soft to fail closed instead of downgrading to :class:~filelock.SoftFileLock on ENOSYS. :pr:622
• Add preserve_lock_file so native locks keep the lock pathname on release. :pr:624
• Add an on_acquired hook that runs a callback on the locked descriptor once the lock is held. :pr:625
• Add StrictSoftFileLock, which treats every marker it did not publish as contention, and SoftFileLease, whose claim expires and whose holder learns through on_compromise when it is lost. SoftFileLock(lifetime=...) now warns and names them. Both publish a record SoftFileLock evicts, so do not mix contracts on one path. :pr:636

... (truncated)

Commits

• 41b42dd Fix TOCTOU symlink vulnerability in SoftFileLock (#465)
• f2e7d40 [pre-commit.ci] pre-commit autoupdate (#464)
• 5088854 Support Unix systems without O_NOFOLLOW (#463)
• 377f622 [pre-commit.ci] pre-commit autoupdate (#460)
• 4724d7f Fix TOCTOU symlink vulnerability in lock file creation (#461)
• cb69414 Bump actions/upload-artifact from 5 to 6 (#459)
• 0769294 Bump actions/download-artifact from 6 to 7 (#458)
• 414193a [pre-commit.ci] pre-commit autoupdate (#457)
• 1456797 [pre-commit.ci] pre-commit autoupdate (#456)
• 8d6bf90 Bump actions/checkout from 5 to 6 (#455)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[doistbot]

This Dependabot PR bumps filelock from 3.13.1 to 3.20.3, an update that also patches a TOCTOU symlink vulnerability (CVE-2025-68146).

Few things worth tightening:

• Since filelock 3.20.x dropped Python 3.9 support and the project still declares requires-python >= 3.9 with CI on 3.9, uv now resolves a separate dev toolchain for 3.9 (tox 3.4.0, pre-commit 2.3.0, virtualenv 16.7.12, pluggy 0.13.1, plus new py and toml packages) instead of the single shared resolution used before. Consider either dropping Python 3.9 support to keep a single clean resolution, or verifying that the 3.9 dev toolchain still works correctly in CI.

I also included a few optional follow-up notes in the details below.

Optional follow-up note (1)

• uv.lock:113: filelock 3.20.3 dropped Python 3.9 support (per release notes). Since the project declares requires-python >= 3.9 and CI tests on 3.9, uv now resolves a separate dev toolchain for Python 3.9 — tox 3.4.0 (was 4.11.4), pre-commit 2.3.0 (was 3.6.0), virtualenv 16.7.12 (was 20.26.6), pluggy 0.13.1 (was 1.3.0), plus newly added py and toml packages that only exist for the 3.9 resolution. Before this PR, all supported Python versions shared a single resolution. Consider dropping Python 3.9 support to keep a single resolution, or verify the 3.9 dev toolchain still works for CI.

_{Share Feedback • Review Logs}