deps: bump the prod-deps group across 1 directory with 3 updates

[dependabot]

Bumps the prod-deps group with 3 updates in the / directory: mypy, pytest-xdist and tox.

Updates mypy from 1.16.1 to 1.17.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 1.17

We’ve just uploaded mypy 1.17 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Optionally Check That Match Is Exhaustive

Mypy can now optionally generate an error if a match statement does not match exhaustively, without having to use assert_never(...). Enable this by using --enable-error-code exhaustive-match.

Example:

# mypy: enable-error-code=exhaustive-match
import enum
class Color(enum.Enum):
RED = 1
BLUE = 2
def show_color(val: Color) -> None:
# error: Unhandled case for values of type "Literal[Color.BLUE]"
match val:
case Color.RED:
print("red")

This feature was contributed by Donal Burns (PR 19144).

Further Improvements to Attribute Resolution

This release includes additional improvements to how attribute types and kinds are resolved. These fix many bugs and overall improve consistency.

• Handle corner case: protocol/class variable/descriptor (Ivan Levkivskyi, PR 19277)
• Fix a few inconsistencies in protocol/type object interactions (Ivan Levkivskyi, PR 19267)
• Refactor/unify access to static attributes (Ivan Levkivskyi, PR 19254)
• Remove inconsistencies in operator handling (Ivan Levkivskyi, PR 19250)
• Make protocol subtyping more consistent (Ivan Levkivskyi, PR 18943)

... (truncated)

Commits

• 0260991 Update version string
• 3901aa2 Updates to 1.17 changelog (#19436)
• 7d13396 Initial changelog for 1.17 release (#19427)
• a182dec Combine the revealed types of multiple iteration steps in a more robust manne...
• ab4fd57 Improve the handling of "iteration dependent" errors and notes in finally cla...
• 09ba1f6 [mypyc] Fix exception swallowing in async try/finally blocks with await (#19353)
• 5c65e33 [mypyc] Fix AttributeError in async try/finally with mixed return paths (#19361)
• 934ec50 Lessen dmypy suggest path limitations for Windows machines (#19337)
• a4801f9 Type ignore comments erroneously marked as unused by dmypy (#15043)
• c3bfa0d Handle corner case: protocol vs classvar vs descriptor (#19277)
• Additional commits viewable in compare view

Updates pytest-xdist from 3.7.0 to 3.8.0

Changelog

Sourced from pytest-xdist's changelog.

pytest-xdist 3.8.0 (2025-06-30)

Features

• [#1083](https://github.com/pytest-dev/pytest-xdist/issues/1083) <https://github.com/pytest-dev/pytest-xdist/issues/1083>_: Add --no-loadscope-reorder and --loadscope-reorder option to control whether to automatically reorder tests in loadscope for tests where relative ordering matters. This only applies when using loadscope.

  For example, [test_file_1, test_file_2, ..., test_file_n] are given as input test files, if --no-loadscope-reorder is used, for either worker, the test_file_a will be executed before test_file_b only if a < b.

  The default behavior is to reorder the tests to maximize the number of tests that can be executed in parallel.

Commits

• 1e3e4dc Release 3.8.0
• 600aad5 Ensure all xdist group names are strings (#1216)
• 9d7ba5b Add --no-loadscope-reorder and --loadscope-reorder options (#1217)
• 532f07f Merge pull request #1210 from pytest-dev/pre-commit-ci-update-config
• 0883ad0 Fix Path usage in test_rsync_roots_no_roots
• 58a51bc [pre-commit.ci] pre-commit autoupdate
• 59a2ad0 Merge pull request #1220 from pytest-dev/dependabot/github_actions/github-act...
• d42b9c7 build(deps): bump hynek/build-and-inspect-python-package
• ebfcb99 Merge pull request #1206 from pytest-dev/release-3.7.0
• 23b7fd6 [pre-commit.ci] pre-commit autoupdate (#1207)
• See full diff in compare view

Updates tox from 4.27.0 to 4.28.0

Release notes

Sourced from tox's releases.

4.28.0

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in tox-dev/tox#3548
• [docs] Document how to require a plugin by @​stephenfin in tox-dev/tox#3552
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in tox-dev/tox#3554
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in tox-dev/tox#3558
• Add [testenv] constraints option by @​stephenfin in tox-dev/tox#3556
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in tox-dev/tox#3562
• Allow disabling plugins on a one-off by @​gaborbernat in tox-dev/tox#3560

Full Changelog: tox-dev/tox@4.27.0...4.28.0

Changelog

Sourced from tox's changelog.

v4.28.0 (2025-07-20)

Features - 4.28.0

- Added ``constraints`` to allow specifying constraints files for all dependencies. (:issue:`3550`)
- Allow disabling tox plugins via the ``TOX_DISABLED_EXTERNAL_PLUGINS`` environment variable - by :user:`gaborbernat`. (:issue:`3468`)
Improved Documentation - 4.28.0

• The min_version/minversion config option is deprecated in favor of the requires option. (:issue:3553)

Commits

• af94e62 release 4.28.0
• 55af14a Allow disabling plugins on a one-off (#3560)
• 57b5dc6 [pre-commit.ci] pre-commit autoupdate (#3562)
• e2ff114 Add [testenv] constraints option (#3556)
• 7138c38 [pre-commit.ci] pre-commit autoupdate (#3558)
• 3c4497c [pre-commit.ci] pre-commit autoupdate (#3554)
• 452c174 [docs] Document how to require a plugin (#3552)
• cb8e0fb [pre-commit.ci] pre-commit autoupdate (#3548)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.