build(deps): bump tox from 4.56.1 to 4.56.2

[dependabot]

Bumps tox from 4.56.1 to 4.56.2.

Release notes

Sourced from tox's releases.

v4.56.2

What's Changed

• 🔧 chore(type): drop stale ty invalid-assignment ignores by @​gaborbernat in tox-dev/tox#3970
• Fix 17 bugs found in a deep codebase sweep by @​gaborbernat in tox-dev/tox#3974

Full Changelog: tox-dev/tox@4.56.1...4.56.2

Changelog

Sourced from tox's changelog.

Bug fixes - 4.56.2

• Fix a batch of latent defects found in a codebase audit:

  • stop duplicating --extra-index-url when a merged requirements line repeats an already-seen index;
  • render --no-binary/--only-binary as comma-joined strings instead of leaking the internal set into the pip command line;
  • report a clear error instead of IndexError for a bare one-argument flag (-c, -r, -f, -e) in deps or constraints;
  • canonicalize optional-dependencies keys and self-referential (recursive) extra names so non-canonical spellings no longer silently drop dependencies;
  • raise a clear error instead of KeyError when dependency_groups is requested without a [dependency-groups] table;
  • stop a native TOML { replace = "env" } reference from leaking its resolution chain into sibling list entries and tripping a spurious circular chain error;
  • expand the range that actually matched in a factor expression rather than the first identical digit-range substring;
  • strip the backslash from an escaped \; in set_env values;
  • skip option values during command auto-detection so an environment named like a subcommand (e.g. tox -e list) is no longer misread;
  • treat an empty list-typed environment variable (e.g. TOX_DISCOVER=) as an empty list rather than [""];
  • report an environment whose name is an empty string as present in Config membership tests;
  • fail evaluation gracefully instead of crashing the driver thread when tox p -p all is run with an empty selection;
  • avoid rebuilding a throwaway PEP 517 frontend against the previous root when a package environment's root is reassigned before a frontend exists;
  • avoid crashing create_session_view when the package and its session copy share no common path (e.g. different Windows drives);
  • close the pseudo-terminal file descriptors that leaked on every command run under a tty and on the terminal-attribute inheritance error path;
  • honor the stop signal in the Windows overlapped-I/O reader while a read is still pending, so shutdown no longer risks hanging on a child that holds its pipe open without producing output. (:issue:3974)

---

v4.56.1 (2026-06-25)

---

Commits

• 5458a28 release 4.56.2
• d3dc2d1 Fix 17 bugs found in a deep codebase sweep (#3974)
• b55fe2f [pre-commit.ci] pre-commit autoupdate (#3973)
• 7ba0f81 💰 Surface GitHub Sponsors + thanks.dev
• 03c2d58 build(deps): bump actions/cache from 5.0.5 to 6.1.0 (#3972)
• 34962f1 [pre-commit.ci] pre-commit autoupdate (#3971)
• 0df25f4 🔧 chore(type): drop stale ty invalid-assignment ignores (#3970)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)