Bump wheel from 0.47.0 to 0.48.0

[dependabot]

Bumps wheel from 0.47.0 to 0.48.0.

Release notes

Sourced from wheel's releases.

0.48.0

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel (#570)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions (#643)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (#692)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw)

Changelog

Sourced from wheel's changelog.

Release Notes

UNRELEASED

• Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target ([#697](https://github.com/pypa/wheel/issues/697) <https://github.com/pypa/wheel/pull/697>_)

0.48.0 (2026-08-12)

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel ([#570](https://github.com/pypa/wheel/issues/570) <https://github.com/pypa/wheel/issues/570>_)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions ([#643](https://github.com/pypa/wheel/issues/643) <https://github.com/pypa/wheel/issues/643>_)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header ([#692](https://github.com/pypa/wheel/issues/692) <https://github.com/pypa/wheel/issues/692>_)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw>_)

0.47.0 (2026-04-22)

• Added the wheel info subcommand to display metadata about wheel files without unpacking them ([#639](https://github.com/pypa/wheel/issues/639) <https://github.com/pypa/wheel/issues/639>_)
• Fixed WheelFile raising Missing RECORD file when the wheel filename contains uppercase characters (e.g. Django-3.2.5.whl) but the .dist-info directory inside uses normalized lowercase naming ([#411](https://github.com/pypa/wheel/issues/411) <https://github.com/pypa/wheel/issues/411>_)

0.46.3 (2026-01-22)

• Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command ([#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676>_)

0.46.2 (2026-01-22)

• Restored the bdist_wheel command for compatibility with setuptools older than v70.1
• Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning
• Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1 (2025-04-08)

... (truncated)

Commits

• 21c4da4 Fixed the release heading format
• f06d4db Flit no longer supports --setup-py
• 1a96c3e Created a new release
• d7d625d Fixed wheel convert writing outside the target directory on malicious input (...
• 986a440 Strip ZIP64 extra field when retagging wheels (#692) (#695)
• 0ca6f24 feat: add --local-version option to wheel pack (#694)
• 4a63caf Preserve compatible metadata versions in convert (#690)
• 33650c6 [pre-commit.ci] pre-commit autoupdate (#691)
• 197012d Increased the upper bound for flit-core as a build requirement
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

Code Review: Bump wheel 0.47.0 → 0.48.0

This is a single-line dependency version bump in pyproject.toml. Checklist evaluated below.

Code Quality

• ✅ Style conventions — Change matches existing formatting in the development array (pyproject.toml:47).
• ✅ No commented-out code — N/A.
• ✅ Meaningful variable names — N/A.
• ✅ DRY — N/A.
• ✅ Defects — Pinned version bump only; no logic to introduce bugs. wheel is a build-time dependency (packaging), not used in runtime source, so no downstream code impact expected.
• ✅ CLAUDE.md considerations — No .claude/CLAUDE.md changes in this diff; existing project instructions are general (not local-environment-specific).

Testing

• ✅ N/A — Version bump of a build tool; no new functions, endpoints, or logic requiring tests.

Documentation

• ✅ README — Not applicable, no user-facing change.
• ✅ CHANGELOG.md — Not updated. Minor: repo appears to auto-generate dependency bump PRs (likely via Dependabot given commit style Bump wheel from 0.47.0 to 0.48.0), so a CHANGELOG entry is typically not expected for these. Not flagging as blocking.
• ✅ Markdown/CommonMark — N/A, no markdown files changed.

Security

• ✅ No hardcoded credentials — Confirmed, none present.
• ✅ Input validation — N/A.
• ✅ Error handling — N/A.
• ✅ No sensitive data in logs — N/A.
• ✅ License file (.lic) check — No .lic files or AQAAAD-prefixed strings present in this diff.

Summary

No issues found. This is a routine, low-risk automated dependency bump (wheel 0.47.0 → 0.48.0) with no functional or security concerns. Approve.

Automated code review analyzing defects and coding standards