build(deps): bump pdm from 2.28.0 to 2.28.1

[dependabot]

Bumps pdm from 2.28.0 to 2.28.1.

Release notes

Sourced from pdm's releases.

v2.28.1

Features & Improvements

• Defer command action and Python installer imports until their corresponding runtime paths execute. (#3673)
• Add {run_cwd} placeholder for scripts to reference the original working directory. (#3734)
• Add opt-in canonical lock input freshness via tool.pdm.resolution.lock_inputs while retaining sticky lockfile behavior and legacy hash fallback for existing lock files. (#3821)
• Integrate argcomplete for simplified command-line completion scripts. (#3823)

Bug Fixes

• Keep workspace members in their explicitly declared dependency groups instead of adding them to default in the lockfile. (#3816)
• Keep the cached parsed version intact when stripping the local segment in comparable_version(). (#3817)
• Make use_uv support adding local files. (#3822)
• Add a Poetry optional dependency to every extra that lists it when importing, instead of only the first one. (#3831)
• Do not write null values into the generated pyproject.toml when importing a flit project that omits author-email/maintainer-email or sets only one of include and exclude in [tool.flit.sdist]. (#3832)

Miscellany

• Add Python 3.15 preview version to the CI matrix. (#3827)

Changelog

Sourced from pdm's changelog.

Release v2.28.1 (2026-08-11)

Features & Improvements

• Defer command action and Python installer imports until their corresponding runtime paths execute. (#3673)
• Add {run_cwd} placeholder for scripts to reference the original working directory. (#3734)
• Add opt-in canonical lock input freshness via tool.pdm.resolution.lock_inputs while retaining sticky lockfile behavior and legacy hash fallback for existing lock files. (#3821)
• Integrate argcomplete for simplified command-line completion scripts. (#3823)

Bug Fixes

• Keep workspace members in their explicitly declared dependency groups instead of adding them to default in the lockfile. (#3816)
• Keep the cached parsed version intact when stripping the local segment in comparable_version(). (#3817)
• Make use_uv support adding local files. (#3822)
• Add a Poetry optional dependency to every extra that lists it when importing, instead of only the first one. (#3831)
• Do not write null values into the generated pyproject.toml when importing a flit project that omits author-email/maintainer-email or sets only one of include and exclude in [tool.flit.sdist]. (#3832)

Miscellany

• Add Python 3.15 preview version to the CI matrix. (#3827)

Commits

• 6514f59 chore: Release 2.28.1
• d6d4b66 feat(scripts): add {run_cwd} placeholder for cross-platform scripts (#3815)
• 410a651 fix(flit): don't emit null values when importing a flit project (#3832)
• c6e265b fix(poetry): add an optional dependency to every extra that lists it (#3831)
• d56e0e7 chore(deps): bump the actions group with 4 updates (#3830)
• 86d462a [pre-commit.ci] pre-commit autoupdate (#3833)
• 4f8f6d9 docs: hyphenate "next-generation" in README (#3835)
• d98f6bb perf: defer Python installer import (#3836)
• b3cb02e chore: improve test coverage (#3828)
• 8ddfa3a feat: add support for Python 3.15 in CI and project configuration (#3827)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)