[dependabot]

Bumps tox from 4.64.1 to 4.64.9.

Release notes

Sourced from tox's releases.

v4.64.9

What's Changed

• 🐛 fix(config): substitute inside set_env override values by @​Rodrigo-Palma in tox-dev/tox#4116

Full Changelog: tox-dev/tox@4.64.8...4.64.9

v4.64.8

What's Changed

• 🐛 fix(pip): combine --no-binary and --only-binary across requirement lines by @​SulimanAbdulrazzaq in tox-dev/tox#4110
• 🐛 fix(config): let TOML ref read deps and commands by @​gaborbernat in tox-dev/tox#4112
• 🐛 fix(config): keep in-line INI references one command by @​gaborbernat in tox-dev/tox#4113
• 🐛 fix(config): describe requires in the JSON schema by @​gaborbernat in tox-dev/tox#4115
• 📝 docs(config): fix five wrong defaults in the reference by @​Rodrigo-Palma in tox-dev/tox#4114
• 🐛 fix(config): show deps, constraints and set_env as tox run uses them by @​gaborbernat in tox-dev/tox#4111

New Contributors

• @​SulimanAbdulrazzaq made their first contribution in tox-dev/tox#4110

Full Changelog: tox-dev/tox@4.64.7...4.64.8

v4.64.7

What's Changed

• fix(man): give each shell a working MANPATH line by @​Rodrigo-Palma in tox-dev/tox#4109

Full Changelog: tox-dev/tox@4.64.6...4.64.7

v4.64.6

What's Changed

• fix(config): tie spliced set_env markers to their value by @​feiiiiii5 in tox-dev/tox#4107
• fix(env): accept every documented interpreter name with -e by @​breken-ai in tox-dev/tox#4106
• fix(config): resolve set_env values when read by @​gaborbernat in tox-dev/tox#4108

New Contributors

• @​feiiiiii5 made their first contribution in tox-dev/tox#4107
• @​breken-ai made their first contribution in tox-dev/tox#4106

Full Changelog: tox-dev/tox@4.64.5...4.64.6

v4.64.5

... (truncated)

Changelog

Sourced from tox's changelog.

Bug fixes - 4.64.10

• Report an invalid configuration value as a one-line error naming the environment and key instead of a traceback, including -x overrides and values set by plugins - by :user:hfycium. (:issue:4118)
• A command prefixed with ! that exits with 0 now fails the environment with exit code 1; before, tox reported it as a success - by :user:feiiiiii5. (:issue:4119)
• Recreating an environment or clearing its temporary and log directories removes symlinks to directories, leaving their targets intact - by :user:gaborbernat. (:issue:4121)
• A command prefixed with ! that cannot start, such as a missing executable, now fails the environment instead of passing - by :user:feiiiiii5. (:issue:4125)

---

v4.64.9 (2026-10-05)

---

Bug fixes - 4.64.9

• Resolve substitutions and file| entries in :ref:set_env overrides passed through -x or TOX_OVERRIDE. Appended blocks replace inherited values while preserving explicit keys in the same or later overrides. Preserve these rules through section references, including native TOML arrays with extend = true. Resolve env-file selectors and values in the consuming environment. Prevent included values from overriding tox's own variables - by :user:Rodrigo-Palma. (:issue:4116)

---

v4.64.8 (2026-10-03)

---

Bug fixes - 4.64.8

• tox combines --no-binary and --only-binary across the lines of deps and of requirements files the way pip does, where the last line used to replace the earlier ones. With --only-binary :all: and a --no-binary exception, tox passes --only-binary to pip first, so pip keeps the exception. tox config shows the merged values tox passes to pip - by :user:SulimanAbdulrazzaq. (:issue:4110)
• tox config shows deps with every global option merged the way tox passes it to pip, a later -i replacing an earlier one and repeated flags shown once, and reports the error tox run would raise for invalid deps. constraints shows the configured files instead of the path of tox.ini, and a comment line in constraints no longer fails the run. deps that give pip nothing to install no longer conflict with pylock. set_env includes PIP_USER, TOX_ENV_DIR, TOX_ENV_NAME, TOX_WORK_DIR and VIRTUAL_ENV, the values tox sets for commands - by :user:gaborbernat. (:issue:4111)
• A TOML ref to another environment's deps, constraints or commands works in tox config and tox run. It used to fail with 'PythonDeps' object is not iterable or Command(args=[...]) is not list - by :user:gaborbernat. (:issue:4112)
• In INI commands, commands_pre and commands_post, a reference such as pip install {[testenv:x]deps} that shares its line with other text joins the referenced lines into that one command as arguments, as in tox 3. tox used to run each referenced line after the first as a separate command. A reference alone on its line still expands to one command per referenced line. This changes echo {[testenv:x]commands}, which now runs one echo with every referenced command as its arguments - by :user:gaborbernat. (:issue:4113)

... (truncated)

Commits

• 7fb5ac1 release 4.64.9
• 09e8ee8 🐛 fix(config): substitute inside set_env override values (#4116)
• e2b0ccb release 4.64.8
• 1df83f1 🐛 fix(config): show deps, constraints and set_env as tox run uses them (#4111)
• 7ed4d2a 📝 docs(config): fix five wrong defaults in the reference (#4114)
• 4f6fbe2 🐛 fix(config): describe requires in the JSON schema (#4115)
• 7b877e6 🐛 fix(config): keep in-line INI references one command (#4113)
• 3cb3208 🐛 fix(config): let TOML ref read deps and commands (#4112)
• 21b212b 🐛 fix(pip): combine --no-binary and --only-binary across requirement lines (#...
• a45f1fa release 4.64.7
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​tox@​4.64.1 ⏵ 4.64.9	+1

View full report

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.