Build(deps-dev): bump tox from 4.36.1 to 4.38.0

[dependabot]

Bumps tox from 4.36.1 to 4.38.0.

Release notes

Sourced from tox's releases.

v4.38.0

What's Changed

• 🐛 fix(test): resolve Windows CI flake in provision integration tests by @​gaborbernat in tox-dev/tox#3732
• Scope deps rejection to pure PEP-517 build types by @​rahuldevikar in tox-dev/tox#3730

Full Changelog: tox-dev/tox@4.37.0...4.38.0

v4.37.0

What's Changed

• ✨ feat(config): add extra_setup_commands for --notest phase by @​gaborbernat in tox-dev/tox#3716
• 🐛 fix(release): format changelog with pre-commit before committing by @​gaborbernat in tox-dev/tox#3717
• 📝 docs: restructure documentation using Diátaxis framework by @​gaborbernat in tox-dev/tox#3718
• 🐛 fix(pip): set PIP_USER=0 to prevent --user installs in virtualenvs by @​gaborbernat in tox-dev/tox#3719
• 🐛 fix(config): prevent env_run_base deps from being clobbered by @​gaborbernat in tox-dev/tox#3721
• Fix env name with dot losing description in TOML config by @​Fridayai700 in tox-dev/tox#3722
• 🐛 fix(ci): add completion extras to type checker environments by @​gaborbernat in tox-dev/tox#3728
• Fix factor selection via TOX_FACTORS environment variable by @​Fridayai700 in tox-dev/tox#3725
• Fix setenv PATH modifications being overwritten by @​Fridayai700 in tox-dev/tox#3723
• Fix extras with underscores not matching hyphenated metadata by @​Fridayai700 in tox-dev/tox#3727
• Fix install_command ignored from TOML config by @​Fridayai700 in tox-dev/tox#3724
• Fix deps with ~= version specifier treated as local paths by @​Fridayai700 in tox-dev/tox#3726

New Contributors

• @​Fridayai700 made their first contribution in tox-dev/tox#3722

Full Changelog: tox-dev/tox@4.36.1...4.37.0

Changelog

Sourced from tox's changelog.

Features - 4.38.0

• Scope dependency rejection in PEP-517 package environments to only pure PEP-517 build types (sdist, wheel, editable), allowing non-standard package types like editable-legacy to specify dependencies - by :user:rahuldevikar. (:issue:3731)

---

v4.37.0 (2026-02-17)

---

Features - 4.37.0

• Add extra_setup_commands configuration option to run commands after dependency and package installation but before test commands, useful with --notest for separating setup from execution - by :user:gaborbernat. (:issue:1504)

Bugfixes - 4.37.0

• Set PIP_USER=0 environment variable when running pip commands in virtualenvs to prevent pip from attempting --user installs when users have pip config --user configured globally — by :user:gaborbernat. (:issue:3010)
• Fix TOML env_run_base and env_pkg_base deps being clobbered when referenced with additional deps in testenv configuration (:issue:3393)
• Normalize extra names when resolving dependencies so that underscores and hyphens are treated equivalently (e.g. extras = snake_case now matches Provides-Extra: snake-case in wheel metadata) - by :user:Fridayai700. (:issue:3433)
• Fix setenv modifications to PATH being overwritten when tox environment paths are set up - by :user:Fridayai700 (:issue:3445)
• Fix deps entries with ~= version specifier being incorrectly treated as local paths instead of being passed through to pip - by :user:Fridayai700. (:issue:3447)
• Fix factor selection via TOX_FACTORS environment variable producing wrong results because append + nargs="+" actions need nested list types for proper env var conversion - by :user:Fridayai700. (:issue:3557)
• Fix custom install_command being ignored when specified in TOML configuration (tox.toml/pyproject.toml) - by :user:Fridayai700. (:issue:3574)
• Fix env names containing dots (e.g. py3.11) losing their description in TOML configuration - by :user:Fridayai700. (:issue:3590)
• Run pre-commit on changelog.rst after towncrier build to ensure proper formatting before committing the release (:issue:3717)
• Fix type checker CI failure by adding completion extras to type and type-min environments so ty can resolve the argcomplete import - by :user:gaborbernat. (:issue:3728)

Documentation - 4.37.0

• Restructured documentation using the Diátaxis framework to separate Tutorial, How-to guides, Reference, and Explanation content for better discoverability and user experience. (:issue:3718)

---

... (truncated)

Commits

• 7c2180b release 4.38.0
• 6b54516 Scope deps rejection to pure PEP-517 build types (#3730)
• 559e89c 🐛 fix(test): resolve Windows CI flake in provision integration tests (#3732)
• ab4fc8c release 4.37.0
• f80405e Fix deps with ~= version specifier treated as local paths (#3726)
• e84002a Fix install_command ignored from TOML config (#3724)
• 00f79b9 Fix extras with underscores not matching hyphenated metadata (#3727)
• d81aae7 Fix setenv PATH modifications being overwritten (#3723)
• e7a0800 Fix factor selection via TOX_FACTORS environment variable (#3725)
• 0d3f901 🐛 fix(ci): add completion extras to type checker environments (#3728)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

I'm approving this pull request because it includes a patch or minor update

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud