Bump build from 1.4.4 to 1.5.0

[dependabot]

Bumps build from 1.4.4 to 1.5.0.

Release notes

Sourced from build's releases.

1.5.0

What's Changed

• ci: try to improve release docs by @​henryiii in pypa/build#1051
• feat: drop 3.9, require 3.10+ by @​henryiii in pypa/build#1036
• chore: tox toml by @​henryiii in pypa/build#1033
• fix: api should not ignore installed, only CLI by @​henryiii in pypa/build#1056

Full Changelog: pypa/build@1.4.4...1.5.0

Changelog

Sourced from build's changelog.

#################### 1.5.0 (2026-04-30) ####################

---

Features

---

• Drop Python 3.9 support - by :user:henryiii (:issue:1036)

---

Bugfixes

---

• Make --ignore-installed opt-in from the API via fresh=True - by :user:henryiii (:issue:1056)

---

Miscellaneous

---

• :issue:1033

#################### 1.4.4 (2026-04-22) ####################

---

Bugfixes

---

• Fix release pipeline generating CHANGELOG.rst entries with inconsistent heading levels, which broke sphinx -W and pinned Read the Docs stable at 1.4.0 - by :user:gaborbernat. (:issue:1031)
• Revert :pr:1039 from build 1.4.3, no longer check direct_url (for now) - by :user:henryiii (:issue:1039)
• Add --ignore-installed to pip install command to prevent issues with packages already present in the isolated build environment - by :user:henryiii (:issue:1037) (:issue:1040)
• Partial revert of :pr:973, keeping log messages in one entry, multiple lines. (:issue:1044)

---

Miscellaneous

---

• :issue:1048, :issue:1049

#################### 1.4.3 (2026-04-10) ####################

---

Features

---

... (truncated)

Commits

• 615d04c chore: prepare for 1.5.0
• 776f702 fix: api should not ignore installed, only CLI (#1056)
• 42da4c4 pre-commit: bump repositories (#1055)
• b445cd2 chore: tox toml (#1033)
• c44c143 feat: drop 3.9, require 3.10+ (#1036)
• a9bb456 build(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 in the actions group...
• cb33511 ci: try to improve release docs (#1051)
• See full diff in compare view

[github-actions]

🤖 Claude Code Review

PR Code Review

Summary: This PR bumps the build package from 1.4.4 to 1.5.0 in the development dependency group of pyproject.toml.

---

Code Quality

• ✅ Style guide: Single-line version bump, no style concerns.
• ✅ No commented-out code: N/A.
• ✅ Meaningful variable names: N/A.
• ✅ DRY principle: N/A.
• ✅ Defects: No logic errors; straightforward dependency version bump. build 1.5.0 is a development/build tool, not a runtime dependency, so blast radius is minimal.
• ✅ CLAUDE.md: No issues — the project instructions reference build as a dev tool, consistent with this change.

Testing

• ✅ Unit/integration tests: No new logic introduced; no tests required for a dev-dependency version bump.
• ✅ Test coverage: N/A.

Documentation

• ✅ README: No update needed.
• ✅ API docs: N/A.
• ✅ Inline comments: N/A.
• ✅ CHANGELOG.md: Not included, but dependency bumps of this nature (automated/Dependabot-style) typically don't require changelog entries unless the project policy mandates it.
• ✅ Markdown formatting: No markdown changes.

Security

• ✅ No hardcoded credentials: N/A.
• ✅ Input validation: N/A.
• ✅ Error handling: N/A.
• ✅ No sensitive data in logs: N/A.
• ✅ No license files (.lic) or AQAAAD-prefixed content: None present.

---

Verdict: Approved. This is a clean, minimal dependency bump for a development-only tool (build). No concerns.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Code Review

PR Summary: Bumps the build development dependency from 1.4.4 to 1.5.0 in pyproject.toml.

---

Code Quality

• ✅ Style guide: Single-line change in a TOML config file — nothing to evaluate stylistically.
• ✅ No commented-out code: None present.
• ✅ Meaningful variable names: N/A.
• ✅ DRY principle: N/A.
• ✅ Defects / logic errors: The bump is from 1.4.4 → 1.5.0 (minor version). build is a dev-only dependency used to build Python packages and is not part of the runtime. The change is isolated to the development dependency group and does not affect production behavior.
• ✅ CLAUDE.md: No conflict. The project CLAUDE.md references python -m pip install --group all ., which would install development dependencies including this one; the version bump is compatible with that workflow.

---

Testing

• ✅ N/A: A development tooling version bump does not require new unit or integration tests.

---

Documentation

• ❌ CHANGELOG.md: Not updated in this diff. Dependency bumps are typically worth noting in a changelog. This is low severity, but worth a flag.

---

Security

• ✅ No hardcoded credentials: None.
• ✅ No license files (.lic / AQAAAD strings): None.
• ✅ No other security concerns: build is a well-known PyPA tool; bumping to a published minor release is low risk.

---

Summary

This is a routine, low-risk dependency bump. The only minor gap is the missing CHANGELOG entry. Everything else looks clean.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

PR Code Review

Summary: This PR bumps the build dependency from 1.4.4 to 1.5.0 in pyproject.toml.

---

Code Quality

• ✅ Style guide: Single-line version bump, no style concerns.
• ✅ No commented-out code: N/A.
• ✅ Meaningful variable names: N/A.
• ✅ DRY principle: N/A.
• ✅ Defects / bugs / security: No logic changes. build is a dev-only dependency (development group), so no runtime impact. 1.5.0 is a minor version bump — no breaking changes expected per semver.
• ✅ CLAUDE.md: No issues; this change is consistent with the project's dependency management approach.

Testing

• ✅ No new functions or endpoints introduced; no test changes required.

Documentation

• ❌ CHANGELOG.md: Not updated. Dependency bumps are typically worth noting in a changelog entry (e.g., under a "Dependencies" or "Chores" section). Verify whether this project's convention requires it.
• ✅ README/API docs: No changes needed for a dev-dependency bump.
• ✅ Markdown formatting: N/A.

Security

• ✅ No hardcoded credentials.
• ✅ No sensitive data.
• ✅ No .lic files or AQAAAD-prefixed content.
• ✅ build is a development-only dependency — zero production attack surface change.

---

Overall: Minor change, low risk. The only actionable item is confirming whether a CHANGELOG entry is required per project convention.

Automated code review analyzing defects and coding standards