[dependabot]

Updates the requirements on wheel to permit the latest version.

Release notes

Sourced from wheel's releases.

0.48.0

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel (#570)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions (#643)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (#692)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw)

Changelog

Sourced from wheel's changelog.

Release Notes

UNRELEASED

• Fixed wheel unpack taking the mode of the unpack directory itself from the archive when a wheel contains a member whose name is made up entirely of empty, . or .. path components (such as ../), which let a malicious wheel leave the unpacked tree world-writable
• Fixed wheel pack --build-number accepting build tags that are invalid in a wheel file name (not starting with a digit, or containing -), the same validation wheel tags --build already performs
• Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target ([#697](https://github.com/pypa/wheel/issues/697) <https://github.com/pypa/wheel/pull/697>_)

0.48.0 (2026-08-12)

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel ([#570](https://github.com/pypa/wheel/issues/570) <https://github.com/pypa/wheel/issues/570>_)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions ([#643](https://github.com/pypa/wheel/issues/643) <https://github.com/pypa/wheel/issues/643>_)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header ([#692](https://github.com/pypa/wheel/issues/692) <https://github.com/pypa/wheel/issues/692>_)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw>_)

0.47.0 (2026-04-22)

• Added the wheel info subcommand to display metadata about wheel files without unpacking them ([#639](https://github.com/pypa/wheel/issues/639) <https://github.com/pypa/wheel/issues/639>_)
• Fixed WheelFile raising Missing RECORD file when the wheel filename contains uppercase characters (e.g. Django-3.2.5.whl) but the .dist-info directory inside uses normalized lowercase naming ([#411](https://github.com/pypa/wheel/issues/411) <https://github.com/pypa/wheel/issues/411>_)

0.46.3 (2026-01-22)

• Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command ([#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676>_)

0.46.2 (2026-01-22)

• Restored the bdist_wheel command for compatibility with setuptools older than

... (truncated)

Commits

• 21c4da4 Fixed the release heading format
• f06d4db Flit no longer supports --setup-py
• 1a96c3e Created a new release
• d7d625d Fixed wheel convert writing outside the target directory on malicious input (...
• 986a440 Strip ZIP64 extra field when retagging wheels (#692) (#695)
• 0ca6f24 feat: add --local-version option to wheel pack (#694)
• 4a63caf Preserve compatible metadata versions in convert (#690)
• 33650c6 [pre-commit.ci] pre-commit autoupdate (#691)
• 197012d Increased the upper bound for flit-core as a build requirement
• efd83a7 Created a new release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.73%. Comparing base (5230eb4) to head (9d6adf2).

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #275   +/-   ##
=======================================
  Coverage   98.73%   98.73%           
=======================================
  Files          12       12           
  Lines        2123     2123           
  Branches      201      201           
=======================================
  Hits         2096     2096           
  Misses          6        6           
  Partials       21       21           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.