build(deps): bump filelock from 3.32.7 to 4.0.0

[dependabot]

Bumps filelock from 3.32.7 to 4.0.0.

Release notes

Sourced from filelock's releases.

4.0.0

What's Changed

• 🐛 fix(soft-rw): replace the state mutex with a generation log by @​gaborbernat in tox-dev/filelock#738

Full Changelog: tox-dev/filelock@3.32.7...4.0.0

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.1 (2026-09-19)

---

• poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739

---

4.0.0 (2026-09-17)

---

• The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
• :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
• :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

---

3.32.7 (2026-09-16)

---

• Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
• Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

---

3.32.6 (2026-09-08)

---

• SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
• Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724

... (truncated)

Commits

• 7e57436 Release 4.0.0
• f974328 🐛 fix(soft-rw): replace the state mutex with a generation log (#738)
• See full diff in compare view

[ReSerendipity]

暂不合并（不关闭）：filelock 3.32.7 → 4.0.0 跨大版本，且它同样是传递依赖（pyproject.toml / requirements.txt 里没有直接声明，锁里 filelock==3.32.7，主要由 torch / transformers 使用）。

本仓对文件锁的实际用法集中在模型加载/卸载与配置读写那条链上（跨进程共享 model/ 目录时的串行化），4.0 的破坏性改动是否碰到我们用的 API，需要按锁重装一次环境、跑三引擎真推理才能判；CI 上跑绿的 12 个矩阵是无 GPU 的 CPU 环境，不含真加载，绿不构成证据。

处置与 #90/#91 一致：并入 B1 那次 pip-compile 复算 + 一次真机复验，能抬的一批一起抬，不逐条撞。