Bump coverage[toml] from 7.6.12 to 7.13.5

[dependabot]

Bumps coverage[toml] from 7.6.12 to 7.13.5.

Release notes

Sourced from coverage[toml]'s releases.

7.13.5

Version 7.13.5 — 2026-03-17

• Fix: issue 2138 describes a memory leak that happened when repeatedly using the Coverage API with in-memory data. This is now fixed.
• Fix: the markdown-formatted coverage report didn’t fully escape special characters in file paths (issue 2141). This would be very unlikely to cause a problem, but now it’s done properly, thanks to Ellie Ayla.
• Fix: the C extension wouldn’t build on VS2019, but now it does (issue 2145).

➡️  PyPI page: coverage 7.13.5. :arrow_right:  To install: python3 -m pip install coverage==7.13.5

7.13.4

Version 7.13.4 — 2026-02-09

• Fix: the third-party code fix in 7.13.3 required examining the parent directories where coverage was run. In the unusual situation that one of the parent directories is unreadable, a PermissionError would occur, as described in issue 2129. This is now fixed.
• Fix: in test suites that change sys.path, coverage.py could fail with “RuntimeError: Set changed size during iteration” as described and fixed in pull 2130. Thanks, Noah Fatsi.
• We now publish ppc64le wheels, thanks to Pankhudi Jain.

➡️  PyPI page: coverage 7.13.4. :arrow_right:  To install: python3 -m pip install coverage==7.13.4

7.13.3

Version 7.13.3 — 2026-02-03

• Fix: in some situations, third-party code was measured when it shouldn’t have been, slowing down test execution. This happened with layered virtual environments such as uv sometimes makes. The problem is fixed, closing issue 2082. Now any directory on sys.path that is inside a virtualenv is considered third-party code.

➡️  PyPI page: coverage 7.13.3. :arrow_right:  To install: python3 -m pip install coverage==7.13.3

7.13.2

Version 7.13.2 — 2026-01-25

• Fix: when Python is installed via symlinks, for example with Homebrew, the standard library files could be incorrectly included in coverage reports. This is now fixed, closing issue 2115.
• Fix: if a data file is created with no read permissions, the combine step would fail completely. Now a warning is issued and the file is skipped. Closes issue 2117.

➡️  PyPI page: coverage 7.13.2. :arrow_right:  To install: python3 -m pip install coverage==7.13.2

7.13.1

Version 7.13.1 — 2025-12-28

• Added: the JSON report now includes a "start_line" key for function and class regions, indicating the first line of the region in the source. Closes issue 2110.
• Added: The debug data command now takes file names as arguments on the command line, so you can inspect specific data files without needing to set the COVERAGE_FILE environment variable.
• Fix: the JSON report used to report module docstrings as executed lines, which no other report did, as described in issue 2105. This is now fixed, thanks to Jianrong Zhao.
• Fix: coverage.py uses a more disciplined approach to detecting where third-party code is installed, and avoids measuring it. This shouldn’t change any behavior. If you find that it does, please get in touch.
• Performance: data files that will be combined now record their hash as part of the file name. This lets us skip duplicate data more quickly, speeding the combining step.
• Docs: added a section explaining more about what is considered a missing branch and how it is reported: Examples of missing branches, as requested in issue 1597. Thanks to Ayisha Mohammed.
• Tests: the test suite misunderstood what core was being tested if COVERAGE_CORE wasn’t set on 3.14+. This is now fixed, closing issue 2109.

➡️  PyPI page: coverage 7.13.1. :arrow_right:  To install: python3 -m pip install coverage==7.13.1

... (truncated)

Changelog

Sourced from coverage[toml]'s changelog.

Version 7.13.5 — 2026-03-17

• Fix: issue 2138_ describes a memory leak that happened when repeatedly using the Coverage API with in-memory data. This is now fixed.

• Fix: the markdown-formatted coverage report didn't fully escape special characters in file paths (issue 2141). This would be very unlikely to cause a problem, but now it's done properly, thanks to Ellie Ayla <pull 2142_>.

• Fix: the C extension wouldn't build on VS2019, but now it does (issue 2145_).

.. _issue 2138: coveragepy/coveragepy#2138 .. _issue 2141: coveragepy/coveragepy#2141 .. _pull 2142: coveragepy/coveragepy#2142 .. _issue 2145: coveragepy/coveragepy#2145

.. _changes_7-13-4:

Version 7.13.4 — 2026-02-09

• Fix: the third-party code fix in 7.13.3 required examining the parent directories where coverage was run. In the unusual situation that one of the parent directories is unreadable, a PermissionError would occur, as described in issue 2129_. This is now fixed.

• Fix: in test suites that change sys.path, coverage.py could fail with "RuntimeError: Set changed size during iteration" as described and fixed in pull 2130_. Thanks, Noah Fatsi.

• We now publish ppc64le wheels, thanks to Pankhudi Jain <pull 2121_>_.

.. _pull 2121: coveragepy/coveragepy#2121 .. _issue 2129: coveragepy/coveragepy#2129 .. _pull 2130: coveragepy/coveragepy#2130

.. _changes_7-13-3:

Version 7.13.3 — 2026-02-03

• Fix: in some situations, third-party code was measured when it shouldn't have been, slowing down test execution. This happened with layered virtual environments such as uv sometimes makes. The problem is fixed, closing issue 2082_. Now any directory on sys.path that is inside a virtualenv is considered third-party code.

... (truncated)

Commits

• c88da14 docs: sample HTML for 7.13.5
• e2ac3e1 build: sample HTML shouldn't include the status.json file
• 910f8f3 docs: prep for 7.13.5
• 3a4819c style: make workflows more uniform
• 2a53705 chore: bump the action-dependencies group across 1 directory with 4 updates (...
• e7c878d chore: make upgrade
• ab4db40 build: use --generate-hashes when pinning
• a438753 chore: make upgrade
• 7b33457 refactor: some leftover pyupgrade 3.10 bits
• 2ff968d refactor: this type wasn't used anywhere
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.