Bump pip-upgrader from 2.4.5 to 2.4.13

[dependabot]

Bumps pip-upgrader from 2.4.5 to 2.4.13.

Release notes

Sourced from pip-upgrader's releases.

v2.4.11

See CHANGELOG.rst for details.

v2.4.10

See CHANGELOG.rst for details.

v2.4.9

See CHANGELOG.rst for details.

v2.4.8

See CHANGELOG.rst for details.

v2.4.7 — cooldown period for new packages

Adds --min-age-days=<N> flag to skip packages whose latest version was published less than N days ago. Protects against malicious packages that appear briefly on PyPI. Closes #66.

v2.4.6 — constraint-aware upgrades

Adds --respect-constraints flag (on by default with --non-interactive) that validates proposed version upgrades against pip's resolver before writing them to disk. On a conflict, each offending package is clamped to the highest version pip can actually resolve together, instead of the absolute latest. Prevents unsatisfiable pins when packages have cross-dependencies. Validation is skipped with a warning on pip < 22.2. Disable with --no-respect-constraints. Fixes #83.

Changelog

Sourced from pip-upgrader's changelog.

2.4.13 (2026-08-10)

• fix --respect-constraints surgical revert over-blaming unrelated packages (#83)
• pip lists every package it downloads in Collecting X lines before the error block; the previous broad name search matched those lines and reverted every pending upgrade, not just the offending one
• the fix parses pip's explicit The user requested X==Y conflict attribution lines, which only appear for the packages we pinned that pip cannot satisfy; falls back to the broad search only for pips that don't emit those lines

2.4.12 (2026-08-10)

• fix --respect-constraints with multi-file requirements using -r includes (#83)
• relative -r paths (e.g. -r base.txt) could not be resolved when the temp file was written to an isolated temp directory, causing pip to error with "Could not open requirements file" and fall back to reverting all packages
• -r includes are now recursively inlined into the temp file; -c constraint paths are rewritten to absolute so they also resolve correctly

2.4.11 (2026-08-10)

• fix --respect-constraints surgical hard-conflict handling: when pip names specific packages in the conflict error, only those packages are reverted to their current pin — unrelated upgrades in the same run now proceed normally (#83)
• the fallback (revert all) still applies when the conflict output cannot be parsed to identify the offending package

2.4.10 (2026-08-10)

• fix --respect-constraints hard-conflict case: when pip can find no compatible set and produces no report, packages are now reverted to their current pins instead of writing the unsatisfiable upgrade (#83)

2.4.9 (2026-08-10)

• fix --respect-constraints false-pass when a non-upgraded package constrains one of the bumped packages (#83)
• the resolver now sees the full requirements set (all existing pins + proposed new versions) rather than only the upgraded packages, so cross-package caps like django-celery-beat<6.1 are caught and honoured

2.4.8 (2026-08-10)

• add --cve-only flag that runs pip-audit and upgrades only packages with known CVEs, each to the minimum version that clears every vulnerability affecting it (rather than the latest PyPI release) (#65)
• the minimum safe version is the max across each vulnerability's own minimum fix version, so the resulting pin is free of all reported CVEs
• vulnerable packages with no available fix are skipped with a warning; if pip-audit is missing the flag degrades gracefully and skips CVE filtering
• composes with --non-interactive, --dry-run and --respect-constraints

2.4.7 (2026-08-10)

• add --min-age-days=<N> flag that skips candidate versions published less than N days ago, providing a cooldown period that protects against malicious packages that appear briefly on PyPI (#66)
• the cutoff is taken from the latest upload_time across all distribution files of a candidate version; when a version has no upload time metadata it is kept (fail open)

2.4.6 (2026-08-10)

• add --respect-constraints flag that validates proposed upgrades against pip's resolver and clamps any that would produce unsatisfiable pins to the highest compatible version (#83)
• constraint validation runs by default with --non-interactive; disable it with --no-respect-constraints
• validation is skipped with a warning when pip is older than 22.2 (--report support)

1.4.0 (2017-05-12)

• support for custom index-url, scanned from several sources (pip configs, PIP_INDEX_URL environment variable)
• option to disable detection of custom index url, and use default pypi index
• virtualenv detection + warning if you're about to install packages in system's python interpreter. Can be bypassed with --skip-virtualenv-check or --skip-package-installation
• support for parsing plain html indexes (tested with devpi and Artifactory)

... (truncated)

Commits

• a32d03c fix: parse pip's 'The user requested' lines to avoid over-reverting (v2.4.13)
• a0b6d70 fix: inline -r includes in constraint validator temp file (v2.4.12)
• 4bb5a00 fix: surgical hard-conflict revert — only hold back the offending package (#83)
• 9b3517b fix: revert to current pins when pip resolver finds no compatible set (#83)
• 726c021 style: apply ruff format
• bbbf81a fix: rename ambiguous variable l -> line (ruff E741)
• 46adbf0 fix: --respect-constraints false-pass when non-upgraded package caps an upgra...
• 68d9530 feat: add --cve-only flag for CVE-targeted upgrades (closes #65)
• 6c4b01a feat: add --min-age-days to skip recently published versions (#66)
• 5ac581a Merge pull request #78 from simion/dependabot/uv/ipython-8.10.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)