[dependabot]

Bumps coverage from 7.15.4 to 7.16.0.

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
• The Coverage.switch_context() method now returns the previous context.
• Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
• Fixes to validation of options and configuration settings:
  • Negative precision settings now always cause useful error messages (pull 2261).
  • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
  • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
  • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
• Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

• The :meth:.Coverage.switch_context method now returns the previous context.

• Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

• Fixes to validation of options and configuration settings:

  • Negative precision settings now always cause useful error messages (pull 2261_).

  • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

  • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

  • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with "Can't combine statement coverage data with branch data". Each named concurrency library is now properly considered (pull 2270_).

• Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: coveragepy/coveragepy#2261 .. _pull 2262: coveragepy/coveragepy#2262 .. _pull 2263: coveragepy/coveragepy#2263 .. _pull 2265: coveragepy/coveragepy#2265 .. _issue 2266: coveragepy/coveragepy#2266 .. _pull 2268: coveragepy/coveragepy#2268

... (truncated)

Commits

• 3e9fc16 docs: prep for 7.16.0
• 38be8d1 build: control check-manifest explicitly
• 8eb1266 docs(build): no longer commit sample_html
• 1a8b3fa docs: remove sample_html
• aeaa79b docs: linklint is now sphinx-linklint
• d5eaf3f test: a branchless way to re-add extensions
• 57e52fd docs: adjust CHANGES for #2270
• b9d304d fix: check for multiprocessing in a --concurrency list (#2270)
• a6ef928 chore: make upgrade
• 070461f chore: bump the action-dependencies group with 4 updates (#2271)
• Additional commits viewable in compare view

[github-actions]

🤖 Claude Code Review

This PR (a Dependabot version bump of coverage 7.15.4 → 7.16.0 in pyproject.toml) is trivial and low-risk. Here's the review against the checklist:

Code Quality

• ✅ Style/formatting: consistent TOML syntax maintained.
• ✅ No commented-out code.
• ✅ N/A — no variables/logic introduced.
• ✅ DRY: the version is updated consistently in both locations it appears — pyproject.toml:38 (development group) and pyproject.toml:87 (test group). Note this duplication is pre-existing (same constraint listed twice across dependency groups) and not introduced by this PR, but it is a latent maintenance risk since a future bump could update one location and miss the other — not a blocker here since both were updated correctly.
• ✅ No defects. coverage==7.16.0 is applied consistently under the same python_version > '3.11' marker in both spots, matching the pattern of coverage==7.10.7 for python_version <= '3.11' left unchanged.
• ✅ CLAUDE.md: unaffected by this change; nothing in it is local-environment-specific.

Testing

• N/A — no new functions or endpoints; this is a version pin bump with no test coverage implications for the mapper itself.

Documentation

• ❌ CHANGELOG.md not updated. Checking git log -- CHANGELOG.md, this repo's changelog hasn't been touched for dependency bumps historically either (last touched at initial content / a sphinx-toolbox bump under Bump sphinx-toolbox from 4.0.0 to 4.1.1 #20, but recent bumps like isort, build, virtualenv in the current history did not update it) — so this is consistent with existing repo convention for Dependabot PRs, not a regression. Flagging only for completeness; not a blocker.
• N/A — no README/API docs impact.
• N/A — no inline comments needed.

Security

• ✅ No hardcoded credentials.
• ✅ N/A input validation — no code touched.
• ✅ N/A error handling — no code touched.
• ✅ No sensitive data in logs.
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff.

Overall: Safe, mechanical dependency bump consistent with the repo's existing Dependabot pattern. No blocking issues found.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

This is a trivial Dependabot version bump (coverage 7.15.4 → 7.16.0, applied consistently to both the development and test dependency groups for Python > 3.11). Here's the review:

Code Quality

• ✅ Follows existing style/format conventions in pyproject.toml (matches surrounding pinned-version pattern)
• ✅ No commented-out code
• ✅ N/A — no variable naming involved
• ✅ DRY — the same version bump is applied consistently in both places it appears (lines 38 and 87); no duplication introduced
• ✅ No defects found — version bump only touches dependency pins, no logic changes. coverage==7.10.7 for python_version <= '3.11' is correctly left untouched, and the > '3.11' pin is updated consistently in both development (line 38) and test (line 87) groups
• ✅ No .claude/CLAUDE.md changes in this diff — not applicable

Testing

• ✅ N/A — dependency version bump, no new functions/endpoints
• ⚠️ Not verified in this review whether CI actually passed with coverage==7.16.0 on Python 3.12/3.13 (no CI logs included in the diff) — recommend confirming the Dependabot CI check is green before merge

Documentation

• ✅ N/A — no README/API/docstring changes needed for a devtool version bump
• ❌ CHANGELOG.md not updated. The repo does maintain one (confirmed present at repo root) and per the checklist it should be updated, though most projects exempt routine dependency-only bumps from changelog entries — flagging per checklist but likely acceptable per this project's actual practice (compare to prior bump commits abc222e, bba6744, 3e66608, which also didn't touch CHANGELOG.md, suggesting this is intentional/established practice for dependabot bumps)
• ✅ No markdown files touched — CommonMark/prettier item N/A

Security

• ✅ No hardcoded credentials
• ✅ N/A — input validation not applicable to a version pin change
• ✅ N/A — no error-handling code changed
• ✅ No sensitive data/logs touched
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff

Overall: ✅ Approve. This is a low-risk, mechanical dependency bump consistent with the project's established Dependabot pattern (matches prior merged bumps for virtualenv, build, isort). No blocking issues.

Automated code review analyzing defects and coding standards