Bump pdm from 2.9.3 to 2.10.0

[dependabot]

Bumps pdm from 2.9.3 to 2.10.0.

Release notes

Sourced from pdm's releases.

v2.10.0

Note This is the last minor release that supports installing on Python 3.7. Please upgrade your Python to 3.8 or higher.

Features & Improvements

• Allow binding packages to specific sources with include_packages and exclude_packages config under tool.pdm.source table. #1645
• Show warnings when a package is rejected by the resolve because of uncovered requires-python range. And provide a way to ignore them per-package. #2304
• Add -q/--quiet option to suppress some warnings printed to the console. This option is mutually exclusive with -v/--verbose. #2304
• Introduce a new --strategy/-S option for lock command, to specify one or more strategy flags for resolving dependencies. --static-urls and --no-cross-platform are deprecated at the same time. #2310
• Add lock option to resolve direct dependencies to the minimal versions available. #2310
• Report the progress of download and unpacking when installing packages. #2328
• Refactor find_project_root() and find_pypackage() to look for the project root recursively, and remove the project_max_depth configuration variable and the corresponding PDM_PROJECT_MAX_DEPTH environment variable. #2286

Bug Fixes

• Change the venv backend clean function pdm.cli.commands.venv.backend.Backend._ensure_clean to empty the .venv folder instead of deleting it. #2282
• Fix a bug that dependency groups from Poetry 1.2+ do not migrate properly to PDM. #2285
• Fix a bug that build requirements are installed into wrong location when using --venv option. #2314
• Fix a bug that global repository setting results in TypeError . #2330
• Fix a credentials error when working with two indices on the same host #2333

Miscellany

• Officially supports python3.12 now. #2301

Changelog

Sourced from pdm's changelog.

Release v2.10.0 (2023-10-26)

Features & Improvements

• Allow binding packages to specific sources with include_packages and exclude_packages config under tool.pdm.source table. #1645
• Show warnings when a package is rejected by the resolve because of uncovered requires-python range. And provide a way to ignore them per-package. #2304
• Add -q/--quiet option to suppress some warnings printed to the console. This option is mutually exclusive with -v/--verbose. #2304
• Introduce a new --strategy/-S option for lock command, to specify one or more strategy flags for resolving dependencies. --static-urls and --no-cross-platform are deprecated at the same time. #2310
• Add lock option to resolve direct dependencies to the minimal versions available. #2310
• Report the progress of download and unpacking when installing packages. #2328

Bug Fixes

• Change the venv backend clean function pdm.cli.commands.venv.backend.Backend._ensure_clean to empty the .venv folder instead of deleting it. #2282
• Fix a bug that dependency groups from Poetry 1.2+ do not migrate properly to PDM. #2285
• Fix a bug that build requirements are installed into wrong location when using --venv option. #2314
• Fix a bug that global repository setting results in TypeError . #2330
• Fix a credentials error when working with two indices on the same host #2333

Miscellany

• Officially supports python3.12 now. #2301

Commits

• 2458ae3 chore: Release 2.10.0
• 99e7877 fix: Credentials error when working with 2 indices on the same host (#2334)
• d45461e fix: Global repository setting results in TypeError (#2331)
• 2c104aa doc: Minor UI fixes for the new lock strategy arguments (#2329)
• 8799761 doc: add a note about miminal version
• e51e5ab feat: report progress when downloading packages (#2328)
• 5e88184 chore: update issue templates
• 70f4985 feat: Add lock option to resolve direct dependencies to the minimal versions ...
• a7f4e37 feat: shoot a warning when python 3.7 is detected
• e40a300 feat: per-package source configuration (#2323)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)