Bump build from 1.4.4 to 1.5.0

[dependabot]

Bumps build from 1.4.4 to 1.5.0.

Release notes

Sourced from build's releases.

1.5.0

What's Changed

• ci: try to improve release docs by @​henryiii in pypa/build#1051
• feat: drop 3.9, require 3.10+ by @​henryiii in pypa/build#1036
• chore: tox toml by @​henryiii in pypa/build#1033
• fix: api should not ignore installed, only CLI by @​henryiii in pypa/build#1056

Full Changelog: pypa/build@1.4.4...1.5.0

Changelog

Sourced from build's changelog.

#################### 1.5.0 (2026-04-30) ####################

---

Features

---

• Drop Python 3.9 support - by :user:henryiii (:issue:1036)

---

Bugfixes

---

• Make --ignore-installed opt-in from the API via fresh=True - by :user:henryiii (:issue:1056)

---

Miscellaneous

---

• :issue:1033

#################### 1.4.4 (2026-04-22) ####################

---

Bugfixes

---

• Fix release pipeline generating CHANGELOG.rst entries with inconsistent heading levels, which broke sphinx -W and pinned Read the Docs stable at 1.4.0 - by :user:gaborbernat. (:issue:1031)
• Revert :pr:1039 from build 1.4.3, no longer check direct_url (for now) - by :user:henryiii (:issue:1039)
• Add --ignore-installed to pip install command to prevent issues with packages already present in the isolated build environment - by :user:henryiii (:issue:1037) (:issue:1040)
• Partial revert of :pr:973, keeping log messages in one entry, multiple lines. (:issue:1044)

---

Miscellaneous

---

• :issue:1048, :issue:1049

#################### 1.4.3 (2026-04-10) ####################

---

Features

---

... (truncated)

Commits

• 615d04c chore: prepare for 1.5.0
• 776f702 fix: api should not ignore installed, only CLI (#1056)
• 42da4c4 pre-commit: bump repositories (#1055)
• b445cd2 chore: tox toml (#1033)
• c44c143 feat: drop 3.9, require 3.10+ (#1036)
• a9bb456 build(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 in the actions group...
• cb33511 ci: try to improve release docs (#1051)
• See full diff in compare view

[github-actions]

🤖 Claude Code Review

Code Review

PR Summary: Bumps build dependency from 1.4.4 to 1.5.0 in pyproject.toml.

---

Code Quality

• ✅ Style guide: Single-line change in pyproject.toml, no style concerns.
• ✅ No commented-out code: N/A.
• ✅ Meaningful variable names: N/A.
• ✅ DRY principle: N/A.
• ✅ Defects: No logic change; this is a dependency version pin update. No bugs, race conditions, or security issues introduced.
• ✅ CLAUDE.md: No project-memory concerns relevant to this change.

Testing

• ✅ Unit/integration tests: No code logic changed; no new tests required.
• ✅ Test coverage: N/A — dependency bump only.

Documentation

• ✅ README: No update needed.
• ✅ API docs: N/A.
• ✅ Inline comments: N/A.
• ✅ CHANGELOG.md: Dependency bumps of this nature (dev tooling, not runtime dependencies) typically don't require changelog entries. No concern.
• ✅ Markdown formatting: N/A.

Security

• ✅ No hardcoded credentials: N/A.
• ✅ Input validation: N/A.
• ✅ Error handling: N/A.
• ✅ No sensitive data in logs: N/A.
• ✅ No license files (.lic) or AQAAAD-prefixed strings: None present.

---

Verdict: Approved. This is a straightforward dev-dependency version bump (build is only in the development dependency group, not runtime). No concerns.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Code Review: Bump build from 1.4.4 to 1.5.0

PR Summary: Single dependency version bump in pyproject.toml — build package updated from 1.4.4 to 1.5.0 in the development dependency group.

---

Code Quality

• ✅ Style guide — Single-line change, no style concerns.
• ✅ No commented-out code — N/A.
• ✅ Meaningful variable names — N/A.
• ✅ DRY principle — N/A.
• ✅ Defects / bugs / security — This is a patch/minor version bump to a dev-only build tool. No logic changes introduced. build 1.5.0 is a legitimate PyPA release with no known CVEs.

Testing

• ✅ Unit/integration tests — No new code; no tests required. CI matrix (Python 3.10–3.13) will exercise the updated build tooling.
• ✅ Edge cases / coverage — N/A for a dependency bump.

Documentation

• ✅ README — No update needed; build is a dev dependency not referenced in user-facing docs.
• ✅ CHANGELOG.md — Dependency bumps of this nature are typically tracked automatically (e.g., by Dependabot); no manual changelog entry is required unless project convention demands it.
• ✅ Inline comments — N/A.

Security

• ✅ No hardcoded credentials — N/A.
• ✅ No license files (.lic / AQAAAD) — None present.
• ✅ build is a dev-only dependency — Not shipped in the runtime package, so the attack surface for end users is unchanged.

---

Summary

This is a clean, low-risk dependency bump. No issues found. ✅ Approved.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

---

Code Review: build dependency bump 1.4.4 → 1.5.0

This is a single-line dependency version bump in pyproject.toml, generated by Dependabot.

---

Code Quality

• ✅ Style guide: Config file change only; no style concerns.
• ✅ No commented-out code: N/A.
• ✅ Meaningful variable names: N/A.
• ✅ DRY principle: N/A.
• ✅ Defects: The build package is a development-only dependency (under [dependency-groups] development), used for packaging. Version 1.5.0 is a minor bump and unlikely to introduce breaking changes. No logic or runtime impact.
• ✅ CLAUDE.md: Not relevant to this change.

---

Testing

• ✅ Unit/integration tests: No new functions introduced; no tests required for a dev dependency bump.
• ✅ CI coverage: The project tests against Python 3.10–3.13 via CI, which will validate compatibility of this bump.

---

Documentation

• ❌ CHANGELOG.md: The existing CHANGELOG.md contains placeholder content (Thing 1–Thing 6, yyyy-mm-dd dates) and has not been updated for this change. While a dev dependency bump may not require a changelog entry by convention, the placeholder content is a concern that should be addressed independently.
• ✅ README: No update needed.
• ✅ Inline comments: N/A.

---

Security

• ✅ No hardcoded credentials.
• ✅ No sensitive data in logs.
• ✅ No .lic files containing AQAAAD strings detected.
• ✅ Input validation: N/A for a config change.

---

Summary

This is a clean, minimal Dependabot-generated dependency bump with no functional impact. The one notable finding is that CHANGELOG.md contains unfinished placeholder content (Thing 1–Thing 6, yyyy-mm-dd) that should be addressed — this is pre-existing and out of scope for this PR, but worth flagging.

Verdict: Approve. No issues with the change itself.

Automated code review analyzing defects and coding standards