build(deps): bump github.com/posit-dev/go-python-packaging from 0.7.0 to 0.10.0

[dependabot]

Bumps github.com/posit-dev/go-python-packaging from 0.7.0 to 0.10.0.

Changelog

Sourced from github.com/posit-dev/go-python-packaging's changelog.

[0.10.0] - 2026-09-18

Added

• wheelname: ParseTags reads a wheel's compatibility tags without requiring its version to parse, returning a WheelTags of name, build tag and tags.

  Parse rejects the whole filename when only the version segment fails PEP 440, and the version contributes nothing to a PEP 425 tag. PEP 427 escapes runs of non-alphanumeric characters to _, so a legal local version like 1.0+cpu reaches disk as 1.0_cpu and does not parse. Measured over a full-corpus sweep of 14.3M mirrored PyPI wheels, 221 of the 299 rejected filenames failed on the version alone with their tags fully readable — and that silently understated real platform compatibility for the affected releases.

  Un-escaping inside Parse was considered and rejected: the escaping is not losslessly invertible. Both 2.5.0+post1_cpu and 2.5.0_post1+cpu parse from the escaped 2.5.0_post1_cpu and only the second is correct, so un-escaping would return a plausible wrong version with no error. Parse's behaviour is unchanged.

  ⚠️ One trade-off worth knowing: dropping version validation also drops the only signal that rejected some malformed names. too-few-py3-none-any.whl has five fields and few where a version belongs, so ParseTags accepts it while Parse does not. Re-validating the version to close that gap would defeat the function's purpose. Use Parse when you need the version.

[0.9.0] - 2026-08-28

Added

• marker: Marker.EvaluateUndecidable reports whether a marker is satisfied and which of its comparisons could not be decided, and Marker.Variables reports the environment variables a marker references.

  Evaluate returns a bare bool, so a caller cannot distinguish "false" from "could not tell". Two things produce the latter: ~= and === reaching the generic string-operator table, which has no semantics for them (pypa/packaging raises UndefinedComparison), and an environment variable that resolves to "", which EnvironmentFromTarget legitimately does for platform_release and platform_version, since a declared target has no kernel to report.

  A consumer that must not discard a dependency edge (building a mirror or an offline bundle, where a dropped edge means a missing package and no fallback) previously had to scan Marker.String() for those operators and variable names, with false positives on quoted literals and a token list to keep in sync by hand.

  Variables covers the half this library cannot decide for the caller: a declared 3.13 forces the caller to invent a PythonFullVersion, and an

... (truncated)

Commits

• 68c7c5c chore(release): date 0.10.0 (#57)
• b8ef6ef feat(wheelname): add ParseTags, which does not require a parseable version (#56)
• a9c99ee chore(release): date 0.9.0
• 2a1fc87 chore(deps): bump testify, x/text, and x/crypto (#50)
• 7231c32 reqtxt: record entry provenance, and close three pip-parity gaps (#49)
• b9a950b tags: accept newer platforms than declared, any-libc targets, exported arch l...
• fc63895 marker: report which comparisons could not be decided (#44) (#47)
• fd79ab2 tags: floor riscv64 and loongarch64 at glibc 2.17 like every other arch (#42)...
• cb5d9cd chore(release): date 0.8.0
• 9c866d5 license: derive a license from the free-form License field (#40)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)