[dependabot]

Bumps the pre-commit group with 1 update: https://github.com/tox-dev/pyproject-fmt.

Updates https://github.com/tox-dev/pyproject-fmt from v2.30.1 to 2.30.3

Release notes

Sourced from https://github.com/tox-dev/pyproject-fmt's releases.

v2.30.3

What's Changed

• feat(python): default to Python 3.15 by @​gaborbernat in tox-dev/pyproject-fmt#369

Full Changelog: tox-dev/pyproject-fmt@v2.30.2...v2.30.3

v2.30.2

Full Changelog: tox-dev/pyproject-fmt@v2.30.1...v2.30.2

Commits

• 50e0f3a Mirror: 2.30.3
• 9c26649 Mirror: 2.30.3
• 5607d09 feat(python): default to Python 3.15 (#369)
• a50cac6 Mirror: 2.30.2
• 5985c25 Mirror: 2.30.2
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[hleroy]

SAFE TO MERGE

Checks: ci / tests ✅ · conventional-title ✅ · GitGuardian Security Checks ✅ · MERGEABLE / CLEAN
Release age: pyproject-fmt 2.30.2 → 2026-10-09, 2.30.3 → 2026-10-10 (14–15 days). Past the 7-day cooldown:, not fresh; neither is yanked on PyPI. Tag v2.30.3 exists upstream and the file keeps the v prefix (rev: v2.30.3) even though the PR title drops it — so the rev still resolves.

Package	Old → New	Type	Finding
tox-dev/pyproject-fmt (pre-commit rev)	v2.30.1 → v2.30.3	patch	Two real upstream changes across the range: 2.30.2 — fix(cli): format every input after an earlier one changes (toml-fmt#479): run() built its exit code with any() over a generator, so processing short-circuited at the first file that changed and left later inputs unformatted; it now collects all results first. 2.30.3 — feat(python): require 3.11 and default to 3.15 (toml-fmt#480): requires-python >=3.10 → >=3.11, pyo3 abi3-py310 → abi3-py311, and the upstream project's own CI/pre-commit/tox matrix moved to 3.15.

Research note — the mirror's release notes are misleading, so this came from a source diff. tox-dev/pyproject-fmt is only the pre-commit mirror (pre_commit_placeholder_package, a setup.py pinning pyproject-fmt==2.30.3); its auto-generated release notes describe the mirror repo's own config commits, which is why v2.30.3 reads "default to Python 3.15" and v2.30.2 reads as empty. The tool itself lives in the tox-dev/toml-fmt monorepo. I cloned it and diffed pyproject-fmt/2.30.1..pyproject-fmt/2.30.3 directly:

• No .rs file changes at all — only Cargo.toml (version + the abi3 feature). The Rust formatting rules (classifier generation, requires-python handling, key ordering) are therefore byte-identical between the two versions. The "default to Python 3.15" headline is about upstream's build/test matrix, not about the tool's output.
• The only Python-level behavioural change is the four-line run() fix in toml-fmt-common/src/toml_fmt_common/__init__.py, covered by two new tests (test_every_input_is_formatted_after_an_earlier_one_changes, …_is_rejected). Everything else in the diff is CI workflows, tox.toml, docs, uv.lock, and tomli → tomllib import modernisation now that the 3.10 floor is gone.

Impact on this codebase: The hook runs on this repo's single pyproject.toml, so the multi-input short-circuit fix is a no-op here — it only changes behaviour when two or more files are passed and an earlier one is rewritten. Since no rule code changed, the formatting this hook produces for pyproject.toml is unchanged, which means no reformat churn and no risk to the explicit requires-python = "==3.14.*" / Programming Language :: Python :: 3.14 classifier block. Grepped: this repo has exactly one pyproject.toml, and the hook carries no args.

Invariants:

• A pre-commit hook bump changes what runs on every local commit — considered, and this is the main reason the bump needed the source diff rather than the mirror's notes. Verdict: output identical, so nothing new fires on commit.
• Python 3.14 only — the raised >=3.11 floor and abi3-py311 wheels are satisfied by default_language_version: python: python3.14; cp311-abi3 wheels load fine on 3.14. Nothing moves the interpreter, and no tool here has to parse project source (pyproject-fmt reads TOML, not Python), so PEP 758 is not in play.
• conventional-pre-commit must keep the pr-title.yml type list / gitleaks must keep honouring .gitleaks.toml — neither hook rev is touched by this PR.
• Ruff's two-place pin — not a ruff PR; the ruff-pre-commit rev in this same file is left at v0.16.9 by this diff (see chore(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.9 to 0.17.0 in the ruff-pre-commit group across 1 directory #46/chore(deps-dev): bump ruff from 0.16.9 to 0.17.0 in the ruff group #52 for that pair).
• Dev tooling only: no runtime code, migration, provider abstraction, tile path or attribution surface.

Note on CI evidence: ci / tests runs ruff check and the dockerized pytest suite — it does not run pre-commit, so its green status is no evidence about this hook. The verdict rests entirely on the upstream source diff above, which is why that was done in full rather than relying on the release notes.

Verdict rationale: A patch-range rev bump whose entire content is a multi-input CLI fix that cannot trigger on a single-file hook, plus a Python floor this project already clears. The formatting rules are provably unchanged (no Rust source touched), so the hook's effect on pyproject.toml is identical to today's. Checks green, branch clean, nothing unresolved.

_{Automated weekly Dependabot triage.}

---

Generated by Claude Code