[dependabot]

Bumps the pip-patch-minor group with 1 update: tox.

Updates tox from 4.67.4 to 4.67.11

Release notes

Sourced from tox's releases.

v4.67.11

Bug fixes

• Package staging no longer fails on a .tox that only the project's own writers can change, such as one owned by the workspace owner while root runs tox, or a 777 build directory on Bitbucket. A work directory that other accounts could change, such as a 777 .tox left by an older tox under umask 000 or restored from a CI cache, is made private and emptied once at the start of a run, so tox recreates its environments instead of failing. When staging still refuses a path, the error names its owner and mode (#4386) by @​gaborbernat. (#4376)

🐍 PyPI release

📜 Full Changelog

v4.67.10

Bug fixes

• A pair of numbers after a - is no longer read as a range, so py-django-4-2 keeps its name instead of splitting into py-django-4, 3 and 2. Braced ranges such as py-django-{4-5} still expand (#4380) by @​ericdelorefice and @​gaborbernat.
• On Windows, quoted option values in requirements files and deps, such as -r "sub dir/base.txt", now have their quotes removed as they do on other platforms and in pip; before, the quotes stayed in the path and the file could not be opened. On every platform, a quoted -r, -c or -f value in deps keeps its spaces as written instead of gaining literal backslashes (#4381) by @​abo3losh1 and @​gaborbernat.

New Contributors

• @​abo3losh1 made their first contribution in tox-dev/tox#4381

🐍 PyPI release

📜 Full Changelog

v4.67.9

🐍 PyPI release

📜 Full Changelog

v4.67.8

Bug fixes

• A .tox created under umask 002 no longer fails the package staging check. When the current user owns a group-writable work directory left by an older tox, tox makes it owner-only and removes group write from the staging directories inside it. Provisioning runs the same repair before starting the provisioned tox, which may be a release without it, and creates a missing work directory owner-only. Previously, such checkouts failed until .tox was deleted, and a fresh .tox also failed when tox provisioned itself (#4377) by @​gaborbernat. (#4376)

🐍 PyPI release

📜 Full Changelog

v4.67.7

Bug fixes

• PEP 723 metadata lines with content now require a space after #. Empty blocks count when detecting duplicates, and invalid requires-python values report a configuration error. Previously, malformed content lines could make tox read metadata that other script runners ignored (#4371) by @​abhishekcpp007 and @​gaborbernat.

... (truncated)

Changelog

Sourced from tox's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-67-13:

---

4.67.13 (2026-11-06)

---

.. _release-4-67-13-fixed:

Fixed

• Relative {glob:...} and TOML replace = "glob" patterns now match files when :ref:tox_root contains [, * or ?. tox treats those characters in the project path literally while keeping wildcards in the configured pattern (:pr:4389) by :user:qodelicious and :user:gaborbernat.
• When :ref:work_dir or :ref:tox_root contains [, * or ?, tox now treats those characters literally in its own executable paths and in default or relative :ref:package_glob patterns. This lets it run environment commands and find packages built by package = external (:pr:4390) by :user:qodelicious and :user:gaborbernat.

.. _release-4-67-12:

---

4.67.12 (2026-11-05)

---

.. _release-4-67-12-fixed:

Fixed

• A quoted set_env value that ends with a literal backslash and contains a semicolon no longer loses its quote protection, so WINPATH="C:\tools;C:\bin\\" keeps the whole value instead of failing with invalid marker. tox now counts the backslashes in front of a quote: an even number leaves the quote unescaped (:pr:4388) by :user:haigou-web and :user:gaborbernat. (:issue:4387)

.. _release-4-67-11:

---

4.67.11 (2026-11-04)

---

.. _release-4-67-11-fixed:

... (truncated)

Commits

• 11a2097 release 4.67.11
• 514b084 🐛 fix(staging): trust project writers, rebuild exposed .tox (#4386)
• e63f763 👷 ci: run release notes before PyPI publish (#4384)
• be99e7f 👷 ci: reduce macOS runner use (#4385)
• 9af3141 🧪 test(pylock): install from a local wheel (#4383)
• f8cf729 release 4.67.10
• cf02931 🐛 fix(pip): keep quoted requirement paths intact (#4381)
• abcba3a 🐛 fix(config): don't read dashed version factors as a range (#4380)
• 2103eeb 🧪 test: find tools without relying on PATH (#4382)
• d0c5cf0 release 4.67.9
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Auto-approved for safe Dependabot update policy.