Bug fixes

• Relative {glob:...} and TOML replace = "glob" patterns now match files when tox_root contains [, * or ?. tox treats those characters in the project path literally while keeping wildcards in the configured pattern (#4389) by @qodelicious and @gaborbernat.
• When work_dir or tox_root contains [, * or ?, tox now treats those characters literally in its own executable paths and in default or relative package_glob patterns. This lets it run environment commands and find packages built by package = external (#4390) by @qodelicious and @gaborbernat.

New Contributors

• @qodelicious made their first contribution in #4390

🐍 PyPI release

📜 Full Changelog

Bug fixes

• A quoted set_env value that ends with a literal backslash and contains a semicolon no longer loses its quote protection, so WINPATH="C:\tools;C:\bin\\" keeps the whole value instead of failing with invalid marker. tox now counts the backslashes in front of a quote: an even number leaves the quote unescaped (#4388) by @haigou-web and @gaborbernat. (#4387)

🐍 PyPI release

📜 Full Changelog

Bug fixes

• Package staging no longer fails on a .tox that only the project's own writers can change, such as one owned by the workspace owner while root runs tox, or a 777 build directory on Bitbucket. A work directory that other accounts could change, such as a 777 .tox left by an older tox under umask 000 or restored from a CI cache, is made private and emptied once at the start of a run, so tox recreates its environments instead of failing. When staging still refuses a path, the error names its owner and mode (#4386) by @gaborbernat. (#4376)

🐍 PyPI release

📜 Full Changelog

Bug fixes

• A pair of numbers after a - is no longer read as a range, so py-django-4-2 keeps its name instead of splitting into py-django-4, 3 and 2. Braced ranges such as py-django-{4-5} still expand (#4380) by @ericdelorefice and @gaborbernat.
• On Windows, quoted option values in requirements files and deps, such as -r "sub dir/base.txt", now have their quotes removed as they do on other platforms and in pip; before, the quotes stayed in the path and the file could not be opened. On every platform, a quoted -r, -c or -f value in deps keeps its spaces as written instead of gaining literal backslashes (#4381) by @abo3losh1 and @gaborbernat.

New Contributors

• @abo3losh1 made their first contribution in #4381

🐍 PyPI release

📜 Full Changelog

🐍 PyPI release

📜 Full Changelog

Bug fixes

• A .tox created under umask 002 no longer fails the package staging check. When the current user owns a group-writable work directory left by an older tox, tox makes it owner-only and removes group write from the staging directories inside it. Provisioning runs the same repair before starting the provisioned tox, which may be a release without it, and creates a missing work directory owner-only. Previously, such checkouts failed until .tox was deleted, and a fresh .tox also failed when tox provisioned itself (#4377) by @gaborbernat. (#4376)

🐍 PyPI release

📜 Full Changelog

Bug fixes

• PEP 723 metadata lines with content now require a space after #. Empty blocks count when detecting duplicates, and invalid requires-python values report a configuration error. Previously, malformed content lines could make tox read metadata that other script runners ignored (#4371) by @abhishekcpp007 and @gaborbernat.

New Contributors

• @abhishekcpp007 made their first contribution in #4371

🐍 PyPI release

📜 Full Changelog

Bug fixes

• Package builds now work under umasks such as 0002 because tox creates new staging directories and missing parents with owner-only access. Existing directories keep their permissions (#4360) by @stephenfin and @gaborbernat.
• tox config no longer fails with an AssertionError when an environment uses a runner whose plugin is not installed. It skips that environment, as tox run and tox list already do (#4361) by @nk-batman21 and @gaborbernat.
• Invalid set_env markers now report the key. For INI values, the error explains how to write a literal semicolon as \; (#4364) by @faresrafat3 and @gaborbernat.
• Restore built-in runner choices for --runner so --runner virtualenv does not fail with an empty choices list (#4365) (#4367) by @gaborbernat.
• Compare interpreter implementation names without regard to case when validating base_python against environment names (#4369) by @mayankdhingra02 and @gaborbernat.
• Accept --config-settings (-C) on requirement lines in requirements files, which pip supports, instead of failing with unrecognized arguments; it is still rejected when written in deps directly, like --hash (#4366) by @mmporong and @gaborbernat.

New Contributors

• @mmporong made their first contribution in #4366
• @mayankdhingra02 made their first contribution in #4369

PyPI release

Full Changelog

Bug fixes

• A packaging environment whose base_python (or default_base_python) is not installed no longer crashes with KeyError: 'skip_missing_interpreters'. It now fails with the missing interpreter, or skips the run environment when skip_missing_interpreters is true, as tox did before 4.36.0 (#4213) by @gaborbernat. (#4212)
• Keep environment markers when a package extra refers to another extra of the same package. For example, demo[dev]; python_version < '3.10' keeps the version condition on dependencies from dev (#4216) by @ericdelorefice and @gaborbernat.
• A pylock.toml or a tox user configuration file (TOX_USER_CONFIG_FILE) saved with a UTF-8 byte order mark, as some Windows editors do, is now read instead of failing with a TOML decode error or being ignored with failed to read config file (#4217) by @pcbeingused333.
• With args_are_paths enabled, a positional argument naming an existing file whose rewritten path relative to change_dir starts with - (for example tests/--config=evil.cfg) is now prefixed with ./ so the command still receives a path instead of an option (#4317) by @rahuldevikar and @gaborbernat. (#4218)
• An extending TOML replace table with a nonempty marker now raises an error instead of adding its internal value and marker keys to deps or requires. Markers on set_env values remain supported (#4320) by @rahuldevikar and @gaborbernat. (#4220)
• A TOML type mismatch no longer includes an expanded string or container value. A malformed commands setting with {env:...} reports its type instead of the substituted text (#4327) by @rahuldevikar and @gaborbernat. (#4221)
• Keep artifacts supplied with --installpkg out of tox's provisioning environment while installing them in the requested test environments (#4304) by @Pratham2511 and @gaborbernat. (#4222)
• A file: URI passed to --installpkg is now percent-decoded once instead of twice, so a path containing a literal % sequence, such as a directory named feature%2Flogin, selects the package the user named (#4300) by @pcbeingused333 and @gaborbernat. (#4223)
• A relative TOX_INSTALL_PKG or user configuration install_pkg path is now resolved against the invocation directory, as --installpkg already was, so tox inspects and installs from the same path (#4333) by @rahuldevikar and @gaborbernat. (#4224)
• tox refuses a symlink or Windows junction at meta_dir because the build frontend empties that directory during metadata preparation (#4332) by @rahuldevikar and @gaborbernat. (#4225)
• An explicitly empty base_python (for example {env:TOXPYTHON:python3.11} with TOXPYTHON empty) now fails during configuration with base_python for env <name> is empty. Blank entries in a base_python list are ignored (#4326) by @rahuldevikar and @gaborbernat. (#4226)
• A path setting that expands to an empty value, such as env_tmp_dir = {env:SCRATCH_DIR} with SCRATCH_DIR unset, now fails with a configuration error instead of resolving to the current directory, which tox could then clear (#4330) by @rahuldevikar and @gaborbernat. (#4227)
• Keep every value of a multi-value command line flag, such as -f py legacy, with that flag. The command scanner took a later value matching a subcommand as the command, causing environments without that factor to run (#4319) by @rahuldevikar and @gaborbernat. (#4228)
• Unreadable wheels, invalid wheel metadata, and unreadable or empty source archives supplied through --installpkg now produce errors that name the artifact instead of internal error tracebacks (#4287) by @santhiprakash and @gaborbernat. (#4230)
• Reject NUL characters in set_env file assignments with a handled input error instead of a subprocess traceback (#4279) by @Doomguy-BFG9000 and @gaborbernat. (#4231)
• Limit each requirement or constraint file to 10 MiB, so oversized and endless includes fail with a size error. For remote files, tox checks a 120-second deadline between response body reads. Slow HTTP framing can delay that check (#4312) by @rahuldevikar and @gaborbernat. (#4232)
• tox now validates inline script dependencies as requirements before installing them. An invalid entry such as a pip option fails before tox passes the dependencies to pip (#4306) by @santhiprakash and @gaborbernat. (#4233)
• Read static package dependencies and the editable-legacy install path from the packaging environment's package_root instead of the core one, so a package_root set in [testenv:.pkg] no longer pairs the built package with the dependencies declared next to tox.ini (#4321) by @rahuldevikar and @gaborbernat. (#4234)
• A package environment path that is already a symlink no longer causes tox list to create file.lock under the link target (#4311) by @rahuldevikar and @gaborbernat. (#4235)
• tox now expands ${VAR} in requirements and constraints files using the environment running pip, including pass_env and set_env, instead of the tox process. A variable absent from that environment stays literal, so tox cannot put its host value in a fetched URL. To retain expansion, add it to pass_env or define it with set_env (#4323) by @rahuldevikar and @gaborbernat. (#4236)
• Mask values when a flag or environment variable name contains a secret keyword after a newline (#4259) by @haigou-web and @gaborbernat. (#4237)
• tox -h no longer prints secret-looking --key=value values from TOX_OVERRIDE. Conversion warnings also mask those values in invalid TOX_ options (#4303) by @faresrafat3 and @gaborbernat. (#4238)
• A tox.toml or pyproject.toml string with literal braces around text containing a colon, such as a JSON argument holding a URL or a time, is now kept as written, as in tox.ini, instead of being read as a {key:default} reference. Positional arguments such as set_env:x passed into such braces through {posargs} no longer expand into the value of that setting (#4269) by @Anandb71 and @gaborbernat. (#4239)
• Reject wheel metadata entries over 8 MiB uncompressed, limiting memory use during package installation (#4328) by @rahuldevikar and @gaborbernat. (#4240)
• Recreate an environment when its .tox-info.json contains a non-mapping value for a section that requires a mapping (#4258) by @haigou-web and @gaborbernat. (#4241)
• Preserve empty positional arguments when rewriting relative paths for change_dir (#4256) by @Fire162 and @gaborbernat. (#4242)
• base_python_file rejects non-regular files, undecodable content, and version lines over 1024 characters with a handled error naming the file. It reads comments in bounded chunks, so a long comment can still precede the version (#4325) by @rahuldevikar and @gaborbernat. (#4243)
• base_python_file now accepts only a Python version specifier (such as 3.13 or pypy3.10) from the version file. A path or program name there no longer makes tox start that program during interpreter discovery, and the rejected line is not echoed in the error message (#4324) by @rahuldevikar and @gaborbernat. (#4244)
• An inline deps or constraints entry that directly substitutes a host variable via {env:NAME} or a TOML replace = "env" table now passes ${OTHER} text in that value to pip unchanged. A TOML reference to the loaded entry keeps the same behavior. A ${NAME} reference written in the configuration or a substitution default still expands (#4329) by @rahuldevikar and @gaborbernat. (#4245)
• `pylo...

Bug fixes

• A dependency group entry that refers to the project's own extra with an environment marker, such as demo[dev]; python_version < "3.10", now keeps that marker on the extra's requirements instead of installing them on every interpreter (#4211) by @ericdelorefice and @gaborbernat.

PyPI release

Full Changelog