Bump build from 1.5.0 to 1.6.0 in /.github/requirements

[dependabot]

Bumps build from 1.5.0 to 1.6.0.

Release notes

Sourced from build's releases.

1.6.0

What's Changed

• Replace prettier with mdformat and yamlfmt by @​gaborbernat in pypa/build#1133
• Let yamlfmt format the workflows by @​gaborbernat in pypa/build#1134
• 🐛 fix(release): semver auto bump, changelog reflow, and roll back 1.5.1 by @​gaborbernat in pypa/build#1132
• fix: hash verification in --dependency-constraints-txt could be silently skipped by @​manfred-kaiser in pypa/build#1140
• 🐛 fix(ci): bump build-and-inspect-python-package to v3.0.1 by @​gaborbernat in pypa/build#1147
• 🐛 fix(ci): pin coverage core to ctrace so test contexts record by @​gaborbernat in pypa/build#1148
• chore: run mypy on more parts of the code by @​henryiii in pypa/build#1151
• chore: turn up strictness on mypy by @​henryiii in pypa/build#1153
• chore: faster mypy, fix merge error by @​henryiii in pypa/build#1156
• 🐛 fix(ci): rerun integration tests on transient network errors by @​gaborbernat in pypa/build#1150
• chore: clean up unused casts in tests by @​henryiii in pypa/build#1154
• refactor(typing): apply review feedback from #1093 by @​henryiii in pypa/build#1155
• chore: Generator is more accurate than Iterator by @​henryiii in pypa/build#1152
• tests: mark test_main_sdist_input_end_to_end with pytest.mark.network by @​frenzymadness in pypa/build#1144
• Revert "⚠️ feat(util): deprecate project_wheel_metadata" by @​henryiii in pypa/build#1158
• tests: download integration sources once per run by @​henryiii in pypa/build#1157
• Use stdlib importlib.metadata for typing by @​layday in pypa/build#1162
• Drop redundant exc_info parameter from backend exception wrapper by @​layday in pypa/build#1161
• Drop a few PyPy-specific test skips by @​layday in pypa/build#1164
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in pypa/build#1165
• 👷 ci: use app token for releases by @​gaborbernat in pypa/build#1169

New Contributors

• @​manfred-kaiser made their first contribution in pypa/build#1140
• @​frenzymadness made their first contribution in pypa/build#1144

Full Changelog: pypa/build@1.5.1...1.6.0

1.5.1

What's Changed

• ✨ feat(cli): accept sdist tarball as srcdir argument by @​gaborbernat in pypa/build#1057
• chore: drop 3.9 branches for version_info checks by @​henryiii in pypa/build#1059
• tests: skip test_uv_install_strips_pythonpath with missing uv by @​mtelka in pypa/build#1063
• chore: remove myself from codeowners by @​FFY00 in pypa/build#1066
• refactor: safe_extractall to use pathlib.Path by @​henryiii in pypa/build#1060
• ci: secure GitHub Actions workflows by @​henryiii in pypa/build#1068
• test: cover config settings forwarding in build_package and build_package_via_sdist by @​terminalchai in pypa/build#1058
• Revert "build(deps): bump virtualenv from 20.17 to 20.36.1" by @​layday in pypa/build#1076
• Revert "build(deps): bump wheel from 0.36.0 to 0.38.1" by @​layday in pypa/build#1075
• Revert "build(deps): bump pip from 22.3 to 26.1" by @​layday in pypa/build#1074
• 👷 ci: enforce lazy imports with flake8-lazy by @​gaborbernat in pypa/build#1088
• ✨ feat(deps): show wanted vs found in missing-deps error by @​gaborbernat in pypa/build#1082
• 👷 ci: align action pin version comments by @​gaborbernat in pypa/build#1091
• docs: update isolated env example to use DefaultIsolatedEnv by @​shenxianpeng in pypa/build#1090

... (truncated)

Changelog

Sourced from build's changelog.

#################### 1.6.0 (2026-08-27) ####################

---

Features

---

• Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
• The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
• The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
• Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
• Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
  • by :user:gaborbernat (:issue:655)
• Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
• On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

---

Bugfixes

---

• Drain verbose subprocess output inline instead of using a ThreadPoolExecutor, which silently swallowed logging errors - by :user:henryiii (:issue:1098)
• Reject a file passed as --env-dir with a clear error instead of a raw FileExistsError - by :user:henryiii (:issue:1100)
• Emit CLI warnings to stderr instead of stdout, so they no longer corrupt --metadata JSON output on stdout - by :user:ymyzk (:issue:1111)
• Fix the Windows symlink support probe always returning False due to a stale object interpolated into the destination path - by :user:henryiii (:issue:1118)
• Fix metadata_path's build-backend fallback returning a nonexistent dist-info path for wheels with a build tag - by :user:henryiii (:issue:1119)
• Write pip/uv requirements and constraints files with \n instead of os.linesep, avoiding doubled \r\r\n line endings on Windows - by :user:henryiii (:issue:1120)
• Batch of small robustness fixes: correct macOS release parsing for the minimum pip version, avoid sharing the mutable default build-system table between builders, keep the original error when isolated-environment setup fails early, and raise BuildException for an invalid wheel - by :user:henryiii (:issue:1121)
• Decide color support independently for stdout and stderr instead of only checking stdout.isatty(), so redirecting one stream no longer disables or leaks ANSI colors on the other - by :user:henryiii (:issue:1123)
• Pass --dependency-constraints-txt files through to the installer unmodified instead of re-parsing them into a deduplicated set of lines, fixing a case where a hashed requirement (e.g. from pip-compile --generate-hashes) could have its --hash continuation line separated from its requirement line and silently dropped, depending on the interpreter's hash seed - by :user:manfred-kaiser (:issue:1140)

---

... (truncated)

Commits

• 7ac9efe chore: prepare for 1.6.0
• e57e2bf 👷 ci: use app token for releases (#1169)
• 66438ab pre-commit: bump repositories (#1167)
• 4ed9658 build(deps): bump the github-actions group with 3 updates (#1166)
• c76707f 🔧 chore: batch dependency updates weekly on Tuesday (#1165)
• b317437 Drop a few PyPy-specific test skips (#1164)
• 561f331 pre-commit: bump repositories (#1163)
• 9456281 refactor: drop redundant exc_info parameter from backend exception wrapper ...
• 3e7a445 Use stdlib importlib.metadata for typing (#1162)
• 9a2e1e9 tests: download integration sources once per run (#1157)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
CI-only dependency pin for package building; no application runtime or auth/data-path changes.

Overview
Updates the pinned release toolchain used by nightly publication (install from .github/requirements/release.txt, then python -m build, twine, and check-wheel-contents) by bumping build from 1.5.0 to 1.6.0 in release.in and regenerating the hashed lockfile.

The lockfile refresh also drops the explicit setuptools==84.0.0 entry that was previously installed alongside the other release tools (it remains listed in release.in but no longer appears in release.txt), and normalizes a few # via -r … comments to reference release.in instead of the full path.

^{Reviewed by Cursor Bugbot for commit 780cd8b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 780cd8b. Configure here.}

[cursor]

Lockfile drops pinned setuptools

High Severity

The regenerated release.txt lockfile no longer includes setuptools==84.0.0 even though release.in still pins it. The publish workflow installs only this hashed lockfile and then runs python -m build --no-isolation, and pyproject.toml requires exactly that setuptools version as the build backend, so publication can fail or silently use an unpinned runner copy.

Additional Locations (1)

• .github/requirements/release.in#L2-L3

 

^{Reviewed by Cursor Bugbot for commit 780cd8b. Configure here.}