Merge upstream into master

.devcontainer/Dockerfile

@@ -1,5 +1,5 @@
 # renovate: datasource=github-tags depName=devbox packageName=jetify-com/devbox
-ARG DEVBOX_VERSION=0.15.0
+ARG DEVBOX_VERSION=0.16.0
 FROM jetpackio/devbox:${DEVBOX_VERSION}
 
 WORKDIR /code

.github/workflows/autofix.yml

@@ -9,17 +9,17 @@ permissions:
 
 env:
   # renovate: datasource=github-tags depName=devbox packageName=jetify-com/devbox
-  DEVBOX_VERSION: "0.15.0"
+  DEVBOX_VERSION: "0.16.0"
 
 jobs:
   autofix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       # Install Devbox
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@v0.13.0
+        uses: jetify-com/devbox-install-action@v0.14.0
         with:
           devbox-version: ${{ env.DEVBOX_VERSION }}
           enable-cache: "true"

.github/workflows/ci.yml

@@ -19,9 +19,9 @@ env:
   PYTEST_ADDOPTS: ${{ github.event.inputs.pytest_addopts }}
   PYTHONIOENCODING: "UTF-8"
   # renovate: datasource=devbox depName=uv
-  UV_VERSION: "0.7.21"
+  UV_VERSION: "0.10.2"
   # renovate: datasource=github-tags depName=devbox packageName=jetify-com/devbox
-  DEVBOX_VERSION: "0.15.0"
+  DEVBOX_VERSION: "0.16.0"
 
 jobs:
   build:
@@ -32,7 +32,7 @@ jobs:
           - macos-latest
           - ubuntu-latest
           - windows-latest
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
         include:
           # HACK: Limit the number of pytest workers on macOS to 3 to avoid a
           #   timeout for a few test cases. For unknown reasons, the number of
@@ -43,17 +43,18 @@ jobs:
             pytest-xdist-maxprocesses: 3
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Needs all tags to compute dynamic version
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7
         with:
           version: ${{ env.UV_VERSION }}
+          python-version: ${{ matrix.python-version }}
           enable-cache: "true"
           cache-suffix: ${{ matrix.python-version }}
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
@@ -97,9 +98,9 @@ jobs:
     permissions:
       contents: write # Allow pushing back pre-commit changes
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@v0.13.0
+        uses: jetify-com/devbox-install-action@v0.14.0
         with:
           devbox-version: ${{ env.DEVBOX_VERSION }}
           enable-cache: "true"

.github/workflows/release.yml

@@ -7,20 +7,20 @@ on:
 
 env:
   # renovate: datasource=devbox depName=uv
-  UV_VERSION: "0.7.21"
+  UV_VERSION: "0.10.2"
 
 jobs:
   build:
     name: Build project for distribution
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7
         with:
           version: ${{ env.UV_VERSION }}
 
@@ -39,7 +39,7 @@ jobs:
         run: uv build
 
       - name: Upload artifact containing distribution files
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: dist
           path: dist/
@@ -58,7 +58,7 @@ jobs:
 
     steps:
       - name: Download artifact containing distribution files
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: dist
           path: dist/
@@ -82,7 +82,7 @@ jobs:
 
     steps:
       - name: Download artifact containing distribution files
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: dist
           path: dist/

.pre-commit-config.yaml

@@ -24,6 +24,7 @@ repos:
       - id: prettier
         name: prettier
         entry: prettier --write --list-different --ignore-unknown
+        stages: [pre-commit]
         language: system
         types: [text]
         exclude: |

.python-version

@@ -1 +1 @@
-3.9
+3.10

CHANGELOG.md

@@ -4,6 +4,124 @@ All notable changes to this project will be documented in this file. This projec
 adheres to [PEP 440](https://www.python.org/dev/peps/pep-0440/) versioning schema, and
 the changelog itself conforms to [Keep A Changelog](https://keepachangelog.com/).
 
+## v9.12.0 (2026-02-21)
+
+### Feat
+
+-   add new settings API with minimal surface
+-   re-export `Phase` enum at package level
+
+### Fix
+
+-   **updating**: apply skip-if-exists patterns as gitignore-style at subproject root in
+    update algorithm
+-   **updating**: anchor removed file paths to project root in update algorithm
+-   **updating**: normalize user-deleted paths before skip-if-exists pattern matching
+    during updates
+
+### Refactor
+
+-   **typing**: use builtin types in public API signatures
+-   deprecate public `settings` module and its symbols
+-   replace `**kwargs` with explicit parameters in `run_{copy,recopy,update}` functions
+
+## v9.11.3 (2026-01-23)
+
+### Fix
+
+-   **updating**: include non-question answers when generating fresh copy of new
+    template
+-   **updating**: ignore Git hooks on internal checkout before 3-way merging file with
+    conflicts (#2432)
+-   avoid pattern deprecation warning for `pathspec` v1.0.0+
+
+## v9.11.2 (2026-01-20)
+
+### Fix
+
+-   **updating**: restore support for preserved symlinks pointing outside subproject
+    (#2427)
+
+### Security
+
+-   disallow symlink-based includes outside template root
+-   disallow symlink-following write operations outside destination directory (#2427)
+
+## v9.11.1 (2026-01-10)
+
+### Fix
+
+-   **updating**: avoid circular reference when rendering JSON-serialized `_copier_conf`
+    variable
+
+## v9.11.0 (2025-11-20)
+
+### Feat
+
+-   **updating**: allow updating a dirty Git repository when the subproject directory is
+    clean (#2369)
+-   add support for custom question icons (#2381)
+-   add support for conditionally unsetting a question's default value
+
+### Fix
+
+-   raise warning instead of error when `chmod` is not allowed
+-   fix using default answers from settings for required questions (#2374)
+
+### Refactor
+
+-   drop support for Python 3.9
+
+## v9.10.3 (2025-10-17)
+
+### Fix
+
+-   **updating**: render templated skip-if-exists patterns before applying patch with
+    excluded paths
+-   **updating**: exclude only Git-ignored files when applying patch
+-   **updating**: ignore paths added to the `_exclude` list in new template version when
+    updating
+
+## v9.10.2 (2025-09-09)
+
+### Fix
+
+-   **deps**: remove prompt-toolkit version cap
+
+## v9.10.1 (2025-08-28)
+
+### Fix
+
+-   **deps**: cap prompt-toolkit to <3.0.52
+
+## v9.10.0 (2025-08-26)
+
+### Feat
+
+-   add support for nested multi-document includes in `copier.yml` (#2251)
+
+### Fix
+
+-   disable default answer validator for secret questions
+
+## v9.9.1 (2025-08-18)
+
+### Security
+
+-   disallow render paths outside destination directory
+-   cast Jinja context path variables to `pathlib.PurePath`
+
+## v9.9.0 (2025-08-01)
+
+### Feat
+
+-   add support for prompting filesystem paths (#2210)
+
+### Fix
+
+-   **updating**: disable secret question validator when replaying old copy
+-   **vcs**: fix cloning local dirty template repo when `core.fsmonitor=true` (#2151)
+
 ## v9.8.0 (2025-07-07)
 
 ### Feat

CONTRIBUTING.md

@@ -129,6 +129,28 @@ Ready to contribute? Here's how to set up the project for local development.
     uv run poe lint
     ```
 
+    !!! note
+
+        If you get fails due to
+        `pexpect.exceptions.TIMEOUT: <pexpect.popen_spawn.PopenSpawn object at 0x............>`,
+        you can adjust the timeout to a longer one (default: `10`), or remove the
+        timeout (`0`). Either add it as an argument in your command:
+
+        ```shell
+        uv run poe test --spawn-timeout 0
+        ```
+
+        Or modify pytest arguments in VS Code workspace settings:
+
+        ```json title=".vscode/settings.json"
+        {
+          ...
+          "python.testing.pytestArgs": [
+            "--spawn-timeout=0"
+          ]
+        }
+        ```
+
 1.  Optionally, use pyclean to remove Python bytecode and build artifacts, e.g.
 
     ```shell
@@ -165,7 +187,7 @@ Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) st
 
 We use [Commitizen](https://commitizen-tools.github.io/commitizen/) to handle Copier
 releases. This tool generates the appropriate tag based on that standard. It also writes
-our [changelog](CHANGELOG.md). Changes that are included there are of type `fix`, `feat`
+our [changelog](changelog.md). Changes that are included there are of type `fix`, `feat`
 and `refactor`; also `BREAKING CHANGE:` trailers will appear. If your change is not
 meaningful in the changelog, then please don't use one of those categories.
 
@@ -215,8 +237,8 @@ Now the tag is released, but GitHub won't display it in the releases page. For t
 1. [Draft a new release](https://github.com/copier-org/copier/releases/new).
 1. Choose the tag you just pushed.
 1. Set the tag also as release title.
-1. Copy the just added changelog entry from [CHANGELOG](./CHANGELOG.md) and paste it as
-   a description.
+1. Copy the just added changelog entry from [CHANGELOG](changelog.md) and paste it as a
+   description.
 1. Enable "Set as the latest release".
 1. Optionally, enable "Create a discussion for this release".
 1. Click on "Publish release".

README.md

@@ -23,18 +23,19 @@ A library and CLI app for rendering project templates.
 
 ## Installation
 
-1. Install Python 3.9 or newer.
+1. Install Python 3.10 or newer.
 1. Install Git 2.27 or newer.
 1. To use as a CLI app: [`pipx install copier`](https://github.com/pypa/pipx) or
    [`uv tool install copier`](https://docs.astral.sh/uv/#tool-management)
 1. To use as a library: `pip install copier` or `conda install -c conda-forge copier`
 
-### Nix flake
+### Homebrew formula
 
-To install latest Copier release with 100% reproducibility:
+To install the latest Copier release using
+[its Homebrew formula](https://formulae.brew.sh/formula/copier) for macOS or Linux:
 
 ```shell
-nix profile install 'https://flakehub.com/f/copier-org/copier/*.tar.gz'
+brew install copier
 ```
 
 ## Quick start
@@ -50,6 +51,8 @@ To create a template:
 └── 📄 {{_copier_conf.answers_file}}.jinja   # answers are recorded here
 ```
 
+Content of the `copier.yml` file:
+
 ```yaml title="copier.yml"
 # questions
 project_name:
@@ -61,10 +64,14 @@ module_name:
     help: What is your Python module name?
 ```
 
+Content of the `{{project_name}}/{{module_name}}.py.jinja` file:
+
 ```python+jinja title="{{project_name}}/{{module_name}}.py.jinja"
 print("Hello from {{module_name}}!")
 ```
 
+Content of the `{{_copier_conf.answers_file}}.jinja` file:
+
 ```yaml+jinja title="{{_copier_conf.answers_file}}.jinja"
 # Changes here will be overwritten by Copier
 {{ _copier_answers|to_nice_yaml -}}

copier/__init__.py

@@ -8,7 +8,8 @@
 
 from . import _main
 from ._deprecation import deprecate_member_as_internal
-from ._types import VcsRef as VcsRef
+from ._settings import Settings, load_settings
+from ._types import Phase, VcsRef
 
 if TYPE_CHECKING:
     from ._main import *  # noqa: F403
@@ -27,3 +28,14 @@ def __getattr__(name: str) -> Any:
     }:
         deprecate_member_as_internal(name, __name__)
     return getattr(_main, name)
+
+
+__all__ = [
+    "load_settings",
+    "run_copy",  # noqa: F405
+    "run_recopy",  # noqa: F405
+    "run_update",  # noqa: F405,
+    "Phase",
+    "Settings",
+    "VcsRef",
+]