[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
coverage	==7.17.0 → ==7.17.3

---

Release Notes

coveragepy/coveragepy (coverage)

v7.17.3

• Fix: using patch = fork, a child process wasn't measured unless patch = subprocess was also used, as described in issue 2340. This is now fixed
  in pull 2342.

• Fix: the JSON report keys functions and classes by name, but names can
  repeat, for example a property getter and setter. Only the last one was
  kept, so the others were missing from the report. Now repeated names get a
  @<line number> suffix, as in the LCOV report. pull 2353_.

• Fix: when combining parallel data files, a file that disappears after it
  has been listed (for example, when the process writing it is still finishing
  its write) is now reported with a warning, instead of stopping the combine
  with a DataError. This was a regression in 7.17.1. Closes issue 2364_.

• Fix: with patch = subprocess on Python 3.13, a measured subprocess that
  was stopped with SIGINT would exit with status 1 instead of dying from the
  signal. This was a regression in 7.17.1, and is now fixed, closing issue 2362_.

• Performance: on Python 3.13 and later, using the C tracer should result in
  test suites running about 8% to 12% faster (pull 2371_).

.. _issue 2340: #​2340
.. _pull 2342: #​2342
.. _pull 2353: #​2353
.. _issue 2364: #​2364
.. _issue 2362: #​2362
.. _pull 2371: #​2371

.. _changes_7-17-2:

v7.17.2

Compare Source

• Fix: two different scenarios failed with "attempt to write a readonly
  database". These were regressions in 7.17.1. They are fixed, closing issue 2356_:

  • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or
    Ubuntu 20.04, coverage combine (and pytest-cov, which combines
    automatically) always failed.

  • coverage combine and coverage debug data failed when a data file
    existed but had no coverage schema, for example an empty file left behind
    by a worker that died. A file we can't read is now reported like any other
    unusable data file, and is left in place.

.. _issue 2356: #​2356

.. _changes_7-17-1:

v7.17.1

Compare Source

• Fix: a one-line class or function body immediately followed by another
  statement (such as class Foo: ... on its own line) was incorrectly
  reported as a missing branch when using the sys.monitoring core. This is now
  fixed, closing issue 2167_ and issue 2337_.

• Fix: the HTML report only rewrites a file's page when the file or its data
  has changed, but each page also links to the previous and next files. When
  the set of reported files changed, unchanged pages kept their old links. For
  example, with skip_covered, a file that became 100% covered had its page
  deleted, but the pages next to it still linked to it. Now a page is also
  rewritten when its neighbors change.

• Fix: --fail-under now uses at least the decimal precision of the
  threshold for both the comparison and failure message. With precision=0,
  a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5
  with the message "total of 0.4 is less than fail-under=0.5". Previously, the
  comparison rounded the total to zero and the message could claim "1 is less
  than 0". Closes issue 2295_.

• Fix: the HTML report escaped file names twice, so a name with &, <,
  or quotes in it was shown with entities like &. Now they are properly
  escaped only once.

• Fix: --source=/ measured no files. A file system root can't be a source
  directory, so now it is an error. Closes issue 2291_.

• In an abundance of caution, prevent forged SQLite journal files from deleting
  files they shouldn't.

.. _issue 2167: #​2167
.. _issue 2291: #​2291
.. _issue 2295: #​2295
.. _issue 2337: #​2337

.. _changes_7-17-0:

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

LGTM. This is a routine lockfile bump of coverage from 7.16.2 to 7.17.0.

What was reviewed:

• Python 3.10 support: coverage 7.17.0 drops 3.10, but this lockfile was compiled with Python 3.14, and CONTRIBUTING.md already says the dev environment needs 3.11+. The 3.10 CI job installs .[test] without this lockfile, so pip will pick an older coverage there.
• The only consumer of requirements-dev.txt in CI is publish-docs.yaml.
• The new pin still meets the # via pytest-cov constraint, with pytest-cov pinned at 7.1.0.

Extended reasoning...

The only change is one version pin in the pip-compile lockfile requirements-dev.txt (coverage 7.16.2 to 7.17.0). It touches no source code and no security-sensitive surface. The one possible risk was the upstream drop of Python 3.10. That doesn't matter here: the lockfile is compiled for 3.14, the dev environment already requires 3.11+, and the 3.10 test job installs from pyproject extras without this file. There are no CODEOWNERS files and no other reviewer activity on the PR.

[claude]

LGTM. This is a patch bump of a dev-only tool.

What was reviewed:

• The diff only changes the coverage pin in requirements-dev.txt, from 7.17.0 to 7.17.1. The "# via pytest-cov" annotation is unchanged.
• pyproject.toml requires pytest-cov>=7.0.0 and doesn't pin coverage itself, so the lock stays consistent with its source.
• The 7.17.1 release notes list only bug fixes: branch reporting, HTML report escaping and links, --fail-under precision, and the SQLite journal hardening. None of them changes the [tool.coverage] config the project uses.

Extended reasoning...

The change is one line in requirements-dev.txt, a patch-level bump of the coverage dev/test dependency, which reaches the project through pytest-cov. It touches no runtime dependencies, no source code and no security-sensitive surface. The repository has no CODEOWNERS file, and the timeline shows no open objections from other reviewers. The bug hunt ran until it found nothing more (dry_streak) and reported nothing. The PR now targets a new upstream release, 7.17.1, which differs from what the earlier review saw.

[claude]

LGTM. This is a patch-level dev dependency bump, and the PR now targets coverage 7.17.2.

What was reviewed:

• The one-line pin change in requirements-dev.txt (coverage 7.17.0 to 7.17.2). The pip-compile "# via pytest-cov" annotation is still there.
• coverage is pulled in only through the pytest-cov>=7.0.0 dev dependency in pyproject.toml, and nothing else in the repo pins it.
• 7.17.2 fixes the "readonly database" regressions from 7.17.1 that broke coverage combine and pytest-cov's automatic combine.

Extended reasoning...

The PR changes one pinned version in requirements-dev.txt and touches no source, test or CI files. It doesn't touch auth, crypto or data handling, and the package is a dev and test tool only. The repo has no CODEOWNERS file. The new commit replaces the target version the earlier reviews saw with 7.17.2, a patch release that fixes regressions, so this is a substantive change from those reviews.

[claude]

LGTM. This is a patch-level bump of a dev-only test dependency.

What was reviewed:

• requirements-dev.txt: the only change is coverage going from 7.17.0 to 7.17.3. The "# via pytest-cov" annotation is unchanged and no other pins moved.
• pyproject.toml only requires pytest-cov>=7.0.0 and puts no constraint on coverage, so the new pin doesn't conflict with it. The [tool.coverage] settings there need no changes.
• I didn't regenerate the lockfile with pip-compile or run the test suite. Both checks were done by reading only.

Extended reasoning...

The change is a single line in requirements-dev.txt that moves the coverage pin from 7.17.0 to 7.17.3 within the same minor series. coverage is a development-only dependency that comes in through pytest-cov, and runtime or library code doesn't use it. No security-sensitive surface is involved. The repository has no CODEOWNERS file, and the timeline shows no outstanding objections from other reviewers. The bump is mechanical, which is why this is an approval.