deps: bump twine from 6.2.0 to 7.0.0

[dependabot]

Bumps twine from 6.2.0 to 7.0.0.

Changelog

Sourced from twine's changelog.

twine 7.0.0 (2026-07-27)

Bugfixes ^^^^^^^^

• Specify UTF-8 encoding when reading .pypirc files. ([#1268](https://github.com/pypa/twine/issues/1268) <https://github.com/pypa/twine/issues/1268>_)
• Add missing subdependencies to --version output. ([#1275](https://github.com/pypa/twine/issues/1275) <https://github.com/pypa/twine/issues/1275>_)
• The dependency on rich has been bumped to avoid a hang in some environments. ([#1308](https://github.com/pypa/twine/issues/1308) <https://github.com/pypa/twine/issues/1308>_)
• Indices that respond with non-standard HTTP codes are now handled more gracefully. ([#1309](https://github.com/pypa/twine/issues/1309) <https://github.com/pypa/twine/issues/1309>_)

Deprecations and Removals ^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix uploading packages with metadata version 2.5. The fix no longer allows metadata version 2.0, which was never officially standardised. ([#1317](https://github.com/pypa/twine/issues/1317) <https://github.com/pypa/twine/issues/1317>_)

Misc ^^^^

• [#1298](https://github.com/pypa/twine/issues/1298) <https://github.com/pypa/twine/issues/1298>_

Commits

• fdb86cb Update changelog for 7.0.0 (#1344)
• bfa7f7f changelog: backfill entries from PRs (#1330)
• 4f20c0d Remove monkeypatch allowing Metadata 2.0 (#1317)
• 1df249e build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#1318)
• bea9607 fix: bump minimum rich dependency to 14.3.3 to prevent verbose hang (#1308)
• ac17a17 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1311)
• 039cedf build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#1313)
• d465cb0 Handle non-standard HTTP status codes (#1309)
• cab618f Bump packaging >= 26.1 (#1310)
• 2d06e11 build(deps): bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (#1307)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: deps. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[helebest]

Code Review — twine 6.2.0 → 7.0.0

Consistency: PR description accurately reflects the diff — pyproject.toml and uv.lock bump the twine dev dependency floor from >=5.0 to >=7.0.0, and the lock's resolved twine entry moves 6.2.0 → 7.0.0. No other files touched.

Correctness: twine is a dev-only tool used at build/release time (twine check --strict in .github/workflows/release.yml and tests/packaging/test_artifacts.py), not a runtime dependency of any published package. No application code paths are affected.

Security: No CVEs are called out in this release. The notable change is the removal of a monkeypatch that allowed uploading packages with metadata version 2.0 (never officially standardized) — tightens validation rather than loosening it.

Effectiveness: Achieves the stated purpose of bumping to the latest release without net-new risk to this repo's build tooling.

Test coverage: This is a tooling version bump — no new test cases are expected or needed. Existing tests/packaging/test_artifacts.py::test_twine_check_passes continues to exercise twine check --strict against this repo's built artifacts.

Regression verification

Ran the full local check suite (mirroring CI) against this branch:

• uv lock --locked — lockfile in sync ✅
• uv sync --all-packages --all-extras — resolves cleanly ✅
• uv run ruff check . — all checks passed ✅
• uv run mypy packages/*/src — no issues in 14 source files ✅
• uv run pytest -v --ignore=tests/packaging — 107 passed ✅
• uv run pytest tests/packaging -v — 27 passed, including twine check --strict against all three built packages ✅
• uv build --all-packages — all three packages (epub, example, mineru) built successfully ✅

No regressions found. Proceeding to monitor CI, then squash-merge if green.

---

Generated by Claude Code

[helebest]

CI Status

All required checks are green on 0aa0c4a:

• test (3.12) ✅
• test (3.13) ✅
• CodeQL analyze ✅
• CodeQL ✅

Decision

Review, regression verification, and CI are all clean. Proceeding with squash merge.

---

Generated by Claude Code

[helebest]

Automated review: twine 6.2.0 → 7.0.0

Consistency: PR description matches the diff — a single dev-dependency bump in pyproject.toml (twine>=5.0 → twine>=7.0.0) with the corresponding uv.lock update. No other files touched.

Correctness: twine is a dev-only tool, used for twine check --strict in .github/workflows/release.yml and exercised by tests/packaging/test_artifacts.py via scripts/check-package.py. No plugin/runtime code depends on it, so this bump can't affect the converter plugin contract.

Security / breaking changes: Reviewed the 7.0.0 changelog. Notable item is the metadata-2.0 handling fix ("no longer allows metadata version 2.0, which was never officially standardised") — irrelevant here since packages are built with uv build/hatchling, which emit modern metadata versions. No CVEs called out in this release; the rest is bugfixes (UTF‑8 .pypirc reads, rich bump to fix a hang, friendlier handling of non-standard HTTP responses from indexes).

Effectiveness: Achieves the stated purpose — twine is now pinned at a current, non-vulnerable floor.

Test coverage: No functional code changed; nothing new to cover. Existing packaging tests already exercise the twine check --strict path.

Verification performed

• uv sync --all-packages --all-extras — resolves cleanly, twine==7.0.0 installed.
• uv run twine --version — confirms 7.0.0 active.
• uv run pytest (full suite) — 134 passed.
• uv run pytest tests/packaging -v — 27 passed, including the twine check --strict artifact gate for both plugin packages.
• CI (test (3.12), test (3.13), CodeQL analyze) — all green.

Decision

All gates pass. Proceeding to squash merge.

---

Generated by Claude Code