[dependabot]

Updates the requirements on flit-core to permit the latest version.

Changelog

Sourced from flit-core's changelog.

Release history

Version 4.1

• License expressions with named exceptions, the WITH syntax, are accepted (:ghpull:809).
• flit init allows dotted module names, for a component of a namespace package (:ghissue:822).
• Fix line endings in .cmd script wrappers on Windows (:ghpull:824).

Version 4.0.3

• Fix built wheels being created with overly restrictive 0600 permissions instead of the normal, world-readable 0644 (:ghpull:806).

Version 4.0.2

• Fix invalid metadata files with Import-Name (:ghissue:813).

Version 4.0.1

No changes, but a new tag to trigger an upload to PyPI now that twine will accept it.

Version 4.0

This version contains breaking changes, but most projects which are already using the [project] table for metadata shouldn't be affected, and can simply change the flit_core <4 constraint to <5.

• The [tool.flit.metadata] table is no longer used for project metadata (:ghpull:771). Use the newer :ref:[project] table <pyproject_toml_project> instead (or if that is not possible, build with flit_core <4).
• :ref:build_cmd and :ref:publish_cmd no longer include files in the sdist based on what is committed in git or Mercurial (:ghpull:772). These commands now build packages more like Flit does when called as a backend by e.g. python -m build. Specify :ref:sdist include & exclude patterns <pyproject_toml_sdist> instead (Flit can help to generate these), or pass the --use-vcs option to get the old behaviour back.
• flit_core now requires Python 3.8 or above (:ghpull:738)
• The --setup-py option to generate sdists containing a setup.py file is no longer available (:ghpull:776).
• Making typing stubs packages with a -stubs suffix will now work (:ghpull:742).

... (truncated)

Commits

• 75b1c90 Merge pull request #826 from pypa/prepare-4.1
• b5ad0d7 Add release note about PR #824
• 9fb48c1 Bump version: 4.0.2 → 4.1.0
• a4ea331 Prepare release notes for 4.1
• 337c499 Merge pull request #824 from r3wretrhy/fix-win-cmd-crlf
• 04cfa08 Merge pull request #825 from hxperl/docs-dynamic-fields
• 33be607 doc: list all four fields accepted in project.dynamic
• d538cb4 install: keep explicit CRLF in Windows .cmd wrappers
• 3c92604 Merge pull request #809 from yangfan-yf-yf/fix/spdx-with-exceptions
• 33a7a39 Clarify SPDX WITH version requirement and error message
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

🟢 Approval recommended

The project uses compatible PEP 621 metadata and the dependency constraint update is valid.

0 open findings

What changed in this PR

Updates the Python package build backend constraint to permit Flit Core 4.x.

Changes:

• Expands the supported flit-core range from <4.0 to <5.0.

File	Description
python/​pyproject.toml	Allows Flit Core 4.x for Python package builds.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Eduard van Valkenburg (eavanvalkenburg)]

Consolidated into #14720 for the Python 1.47.0 release, including the dependency changes and regenerated lockfiles. The release branch includes the merged Python 3.10 removal from #14708. Closing this PR as superseded; the combined changes remain under review in #14720.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.