pip: bump the pip-updates group with 3 updates

[dependabot]

Updates the requirements on idna, propcache and coverage to permit the latest version.
Updates idna from 3.13 to 3.14

Changelog

Sourced from idna's changelog.

3.14 (2026-05-10) +++++++++++++++++

• Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [GHSA-65pc-fj4g-8rjx]

Thanks to Stan Ulbrych for reporting the issue.

Commits

• 37b6b74 Release v3.14
• 628fef8 Use valid_string_length() for early oversized-input check
• 1e26c7f Tweak release wording
• ab5668f Pre-release 3.14
• c0dda45 Merge commit from fork
• b7391f4 Add docstrings to package (#226)
• 0f4a28d Raise IDNAError on non-string input to encode/decode (#224)
• 7e6df71 Address type issues found by ty (#225)
• 6ebfaab Merge pull request #221 from kjd/release-3.13
• See full diff in compare view

Updates propcache from 0.4.1 to 0.5.2

Release notes

Sourced from propcache's releases.

0.5.2

0.5.0 and 0.5.1 were tagged earlier today but never reached PyPI: 0.5.0's deploy failed at cibuildwheel's post-build pytest on free-threaded armv7l musllinux (SIGBUS under QEMU emulation while importing the C extension), and 0.5.1's deploy hit a transient sigstore Rekor 502 during the attestation step. 0.5.2 is the first of the three to actually publish.

Features

• Added support for newer type hints and remove Optional and Union from all annotations -- by :user:Vizonex

  Related issues and pull requests on GitHub: #193.

Removals and backward incompatible breaking changes

• Dropped support for Python 3.9 as it has reached end of life.

  Related issues and pull requests on GitHub: #216.

Packaging updates and notes for downstreams

• Changed the Cython build dependency from ~= 3.1.0 to >= 3.2.0, removing the upper version bound to avoid conflicts for downstream packagers -- by :user:jameshilliard and :user:gundalow.

  The upstream Cython version is pinned to 3.2.4 in the CI/CD environment.

  Related issues and pull requests on GitHub: #184, #188, #214.

• Start building and shipping riscv64 wheels -- by :user:justeph.

  Related issues and pull requests on GitHub: #194.

• The :pep:517 build backend now supports a new build-inplace config setting (and PROPCACHE_BUILD_INPLACE environment variable) for controlling whether to build the project in-tree or in a temporary directory. It only affects wheels and is set up to build in a temporary directory by default. It does not affect editable wheel builds; they will keep being built in-tree regardless.

  Here's an example of using this setting:

  .. code-block:: console

... (truncated)

Changelog

Sourced from propcache's changelog.

0.5.2

(2026-05-08)

No significant changes.

---

0.5.1

(2026-05-08)

No significant changes.

---

0.5.0

(2026-05-08)

Features

• Added support for newer type hints and remove Optional and Union from all annotations -- by :user:Vizonex

  Related issues and pull requests on GitHub: :issue:193.

Removals and backward incompatible breaking changes

• Dropped support for Python 3.9 as it has reached end of life.

  Related issues and pull requests on GitHub: :issue:216.

Packaging updates and notes for downstreams

... (truncated)

Commits

• 041f7af Release 0.5.2 (#222)
• 9c374aa Release 0.5.1 (#221)
• c4e2b78 Skip cibuildwheel test on free threaded armv7l musllinux (#220)
• e60bded Release 0.5.0 (#219)
• b88f846 Make wheel builds reproducible (#218)
• fdacd6c Update Typehint annotations (#193)
• 483e9d3 [pre-commit.ci] pre-commit autoupdate (#204)
• d0d45e1 Drop Python 3.9 support (#216)
• c0bacf5 Update pytest-cov requirement from >=2.3.1 to >=7.1.0 (#210)
• 9bfb3e4 Bump pytest-codspeed from 4.3.0 to 4.5.0 (#211)
• Additional commits viewable in compare view

Updates coverage to 7.14.0

Changelog

Sourced from coverage's changelog.

Version 7.14.0 — 2026-05-10

• Feature: now when running one of the reporting commands, if there are parallel data files that need combining, they will be implicitly combined before creating the report. There is no option to avoid the combination; let us know if you have a use case that requires it. Thanks, Tim Hatch <pull 2162_>. Closes issue 1781.

• Fix: the output from combine was too verbose, listing each file considered. Now it shows a single line with the counts of files combined, files skipped, and files with errors. The -q flag suppresses this line. The old detailed lines are available with the new --debug=combine option.

• Fix: running a Python file through a symlink now sets the sys.path correctly, matching regular Python behavior. Fixes issue 2157_.

• Fix: Collector.flush_data could fail with "RuntimeError: Set changed size during iteration" when a tracer in another thread added a line to the per-file set that add_lines (or add_arcs) was iterating. The values passed to CoverageData are now snapshotted via dict.copy() and set.copy(), which are atomic under the GIL. Thanks, Alex Vandiver <pull 2165_>_.

• Fix: the soft keyword lazy is now bolded in HTML reports.

• We are no longer testing eventlet support. Eventlet started issuing stern deprecation warnings that break our tests. Our support code is still there.

.. _issue 1781: coveragepy/coveragepy#1781 .. _issue 2157: coveragepy/coveragepy#2157 .. _pull 2162: coveragepy/coveragepy#2162 .. _pull 2165: coveragepy/coveragepy#2165

.. _changes_7-13-5:

Version 7.13.5 — 2026-03-17

• Fix: issue 2138_ describes a memory leak that happened when repeatedly using the Coverage API with in-memory data. This is now fixed.

• Fix: the markdown-formatted coverage report didn't fully escape special characters in file paths (issue 2141). This would be very unlikely to cause a problem, but now it's done properly, thanks to Ellie Ayla <pull 2142_>.

• Fix: the C extension wouldn't build on VS2019, but now it does (issue 2145_).

... (truncated)

Commits

• 646351b docs: sample HTML for 7.14.0
• 39cd015 docs: prep for 7.14.0
• 649e8aa docs: thanks Alex Vandiver for #2165
• 8cd392e fix: snapshot data in Collector.flush_data to avoid threading race (#2165)
• c48e0ed fix: less output for combining
• c2a3a28 docs: explain the change from #2162
• 1cd47aa fix: implicit combine-during-report now removes the combined data files
• 2d99fd7 feat: automatically combine coverage in report, thanks Tim Hatch (#2162)
• 9fbdcdf fix: lazy soft keywords are bolded
• 5de7d02 build: oops, misplaced quote
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions