[dependabot]

Bumps coverage from 7.16.2 to 7.17.1.

Release notes

Sourced from coverage's releases.

7.17.1

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167 and issue 2337.
• Fix: the HTML report only rewrites a file’s page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.
• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message “total of 0.4 is less than fail-under=0.5”. Previously, the comparison rounded the total to zero and the message could claim “1 is less than 0”. Closes issue 2295.
• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.
• Fix: --source=/ measured no files. A file system root can’t be a source directory, so now it is an error. Closes issue 2291.
• In an abundance of caution, prevent forged SQLite journal files from deleting files they shouldn’t.

➡️  PyPI page: coverage 7.17.1. :arrow_right:  To install: python3 -m pip install coverage==7.17.1

7.17.0

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.
• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
• Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.
• Fixes for obscure but legal file names:
  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.
  • A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.
• Fixes in the implementation of the C tracer:
  • If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.
  • The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.
  • The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.
  • An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.
• Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.
• Performance: HTML reports should be about 5% faster to produce.
• Kept the political banner in the README. Closes issue 2344.

➡️  PyPI page: coverage 7.17.0. :arrow_right:  To install: python3 -m pip install coverage==7.17.0

Changelog

Sourced from coverage's changelog.

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167_ and issue 2337_.

• Fix: the HTML report only rewrites a file's page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.

• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message "total of 0.4 is less than fail-under=0.5". Previously, the comparison rounded the total to zero and the message could claim "1 is less than 0". Closes issue 2295_.

• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.

• Fix: --source=/ measured no files. A file system root can't be a source directory, so now it is an error. Closes issue 2291_.

• In an abundance of caution, prevent forged SQLite journal files from deleting files they shouldn't.

.. _issue 2167: coveragepy/coveragepy#2167 .. _issue 2291: coveragepy/coveragepy#2291 .. _issue 2295: coveragepy/coveragepy#2295 .. _issue 2337: coveragepy/coveragepy#2337

.. _changes_7-17-0:

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.

• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the

... (truncated)

Commits

• 1941ee1 docs: prep for 7.17.1
• 474bba1 chore: make upgrade
• 1ab58b3 chore: bump the action-dependencies group with 6 updates (#2355)
• a0e922a test: clear instructions if coverage is missing (#2354)
• 64cb3a7 fix: another one-line body test. #2337
• 795306e fix: false missing branch for one-line class body with sysmon core (#2167) (#...
• 44d8622 refactor: use re.fullmatch
• a87a20d fix: make --source=/ an error #2291 (#2351)
• dccc5fc fix: prevent contradictory --fail-under failure message (#2312)
• 86b22e3 doc: fix the changelog from #2343
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.43%. Comparing base (57b00c8) to head (62afb99).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #819      +/-   ##
==========================================
- Coverage   98.57%   98.43%   -0.15%     
==========================================
  Files          18       18              
  Lines        1408     1408              
  Branches       74       74              
==========================================
- Hits         1388     1386       -2     
- Misses         17       18       +1     
- Partials        3        4       +1     

Flag	Coverage Δ
unit	97.15% <ø> (-0.08%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[codspeed]

Merging this PR will improve performance by ×18

3 warnings

⚠️ 15 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

⚠️ 1 benchmark with a significant change ran on different hardware

Its base and head results were measured on machines with a different CPU, core count or memory, so the change might not come from the code. Run base and head on the same runner type.

Learn more about Macro Runners

See affected benchmarks

⚠️ 1 benchmark with a significant change ran in a different software environment

Its base and head results were measured with a different OS or toolchain, such as compiler, runtime or library versions, so the change might come from this difference rather than from the code. Open the benchmark to see what changed.

See affected benchmarks

⚡ 1 improved benchmark
✅ 62 untouched benchmarks
⏩ 4 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	test_cache_hit_benchmark[func-bounded-ttl]	196.1 ms	11.1 ms	×18

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/pip/coverage-7.17.1 (62afb99) with master (57b00c8)²}

Footnotes

1. 4 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on master (894e9c7) during the generation of this report, so 57b00c8 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩