Python: Bump flit from 3.12.0 to 4.0.2 in /python

[dependabot]

Bumps flit from 3.12.0 to 4.0.2.

Changelog

Sourced from flit's changelog.

Version 4.0.2

• Fix invalid metadata files with Import-Name (:ghissue:813).

Version 4.0.1

No changes, but a new tag to trigger an upload to PyPI now that twine will accept it.

Version 4.0

This version contains breaking changes, but most projects which are already using the [project] table for metadata shouldn't be affected, and can simply change the flit_core <4 constraint to <5.

• The [tool.flit.metadata] table is no longer used for project metadata (:ghpull:771). Use the newer :ref:[project] table <pyproject_toml_project> instead (or if that is not possible, build with flit_core <4).
• :ref:build_cmd and :ref:publish_cmd no longer include files in the sdist based on what is committed in git or Mercurial (:ghpull:772). These commands now build packages more like Flit does when called as a backend by e.g. python -m build. Specify :ref:sdist include & exclude patterns <pyproject_toml_sdist> instead (Flit can help to generate these), or pass the --use-vcs option to get the old behaviour back.
• flit_core now requires Python 3.8 or above (:ghpull:738)
• The --setup-py option to generate sdists containing a setup.py file is no longer available (:ghpull:776).
• Making typing stubs packages with a -stubs suffix will now work (:ghpull:742).
• The default glob patterns for license files have been extended to include NOTICE* and AUTHORS* (:ghpull:758).
• license-files glob patterns can contain spaces (:ghpull:797).
• Fix a bug where license files could be found twice on Windows (:ghpull:752).
• The new Import-Name and Import-Namespace metadata fields (metadata 2.5) are now supported (:ghpull:774). In most cases no new input is required, as Flit will create this metadata automatically.
• Fix creating RECORD files when file names include commas (:ghpull:744).
• The --use-vcs option now correctly recognises git from inside a git worktree folder (:ghpull:799).
• On Python 3.12 and above, flit build now uses the 'data' filter when extracting the just-created sdist prior to building a wheel (:ghpull:775). This restricts some special features of tar files, but sdists are unlikely to use these features, and they would probably break in other scenarios if you did.
• The vendorised readme_renderer package was updated to version 44.0 (:ghpull:760).

... (truncated)

Commits

• 60c0b3d Merge pull request #814 from pypa/i813
• 58e7f41 Bump version: 4.0.1 → 4.0.2
• 666e3c2 Fix METADATA format issue
• 81ac51d Merge pull request #812 from pypa/prepare-4.0.1
• 41bdff1 Add release note about 4.0.1
• ff5bfad Bump version: 4.0.0 → 4.0.1
• 8faf734 Bump actions/setup-python from 6 to 7 (#807)
• ef7f319 Merge pull request #800 from pypa/prepare-4.0
• 431fbaf Remind people in release notes to allow flit_core <5
• 38297e7 Version number -> 4.0.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates the Python dev tooling dependencies by bumping the pinned flit version in the pyproject.toml dependency group.

Changes:

• Bumped flit from 3.12.0 to 4.0.2 in the dev dependency group

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.