nab-python 0.0.7__py3-none-any.whl → 0.0.8__py3-none-any.whl

nab_python/_packaging_provider.py

@@ -4,12 +4,13 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
+from ._vendor.packaging.ranges import VersionRange
+
 if TYPE_CHECKING:
     from collections.abc import Mapping
 
     from nab_resolver.types import Incompatibility, RangeProtocol
 
-    from ._vendor.packaging.ranges import VersionRange
     from ._vendor.packaging.specifiers import SpecifierSet
     from ._vendor.packaging.version import Version
 
@@ -47,12 +48,21 @@ class PackagingProvider:
                 return version
         return None
 
+    def has_satisfying_version(
+        self, package: str, version_range: RangeProtocol[Version]
+    ) -> bool:
+        """Report whether any available version falls in the range."""
+        return any(v in version_range for v in self._get_versions(package))
+
     def get_dependencies(
         self, package: str, version: Version
     ) -> dict[str, VersionRange]:
         """Convert SpecifierSet deps to VersionRange deps."""
         raw = self._packages.get(package, {}).get(version, {})
-        return {dep: spec.to_range() for dep, spec in raw.items()}
+        return {
+            dep: (spec.to_range() if spec else VersionRange.full(admit_arbitrary=False))
+            for dep, spec in raw.items()
+        }
 
     _CONFLICT_THRESHOLD = 5
 
@@ -96,3 +106,15 @@ class PackagingProvider:
     def consume_force_backtrack_targets(self) -> list[str]:
         """No force-backtrack signal from this in-memory provider."""
         return []
+
+    def widen_decision(self, package: str, version: Version) -> VersionRange | None:
+        """No widening: dependency clauses keep the exact decided version."""
+        del package, version
+        return None
+
+    def narrow_for_display(
+        self, package: str, constraint: RangeProtocol[Version]
+    ) -> RangeProtocol[Version]:
+        """Identity: constraints render as stored."""
+        del package
+        return constraint

nab_python/_provider/extras.py

@@ -43,26 +43,43 @@ def choose_extra_version(
     _, _, normalized = provider.split_and_normalize(base)
     version_list = provider.fetch_versions(base)
     all_versions = provider.versions_only(normalized, version_list)
-    candidates = list(version_range.filter(all_versions))
 
-    # Filter by base's positive range so we don't pick a proxy version
-    # that would force base==V into a known-conflicting state.
+    # Filter by the base's positive range so we don't pick a proxy version
+    # that would force base==V into a known-conflicting state.  Intersect
+    # rather than test membership: the base's range carries the pre-release
+    # admission granted by the requirement that named the extra, while the
+    # proxy's own range is built full.
     base_range = provider.solution_ranges.get(normalized)
-    excluded_by_base: list[Version] = []
-    if base_range is not None:
-        kept: list[Version] = []
-        for v in candidates:
-            if v in base_range:
-                kept.append(v)
-            else:
-                excluded_by_base.append(v)
-        candidates = kept
+    if base_range is None:
+        logger.debug(
+            "no base range for %s; base admission cannot be applied to %s",
+            normalized,
+            package,
+        )
+        candidates = list(version_range.filter(all_versions))
+    else:
+        candidates = list((version_range & base_range).filter(all_versions))
 
     if provider.wants_lowest(normalized):
         candidates = list(reversed(candidates))
 
     chosen = _pick_in_mode(provider, base, extra, candidates)
-    if chosen is None and excluded_by_base and base_range is not None:
+    # Enumerate pre-releases too: default filtering buffers a pre-release
+    # behind any matching final and would drop one that the base's bounds
+    # exclude, so it would never be recorded and the proxy would keep a
+    # permanent NO_VERSIONS clause past the backjump lifting the base
+    # decision.  Membership below is bounds-only, so the blocks stay sound.
+    if (
+        chosen is None
+        and base_range is not None
+        and (
+            excluded_by_base := [
+                v
+                for v in version_range.filter(all_versions, prereleases=True)
+                if v not in base_range
+            ]
+        )
+    ):
         _record_base_range_blocks(
             provider, package, normalized, base_range, excluded_by_base
         )

nab_python/_provider/metadata_resolver.py

@@ -11,7 +11,7 @@ from __future__ import annotations
 from typing import TYPE_CHECKING
 
 from nab_index.client import SdistFile, WheelFile
-from nab_index.local_index import read_wheel_metadata
+from nab_index.local_index import UnsupportedWheelError, read_wheel_metadata
 
 from .._conflict_kind import EMPTY_MEMBERSHIP_SETS
 from .._vcs_admission import admit_vcs_url
@@ -86,7 +86,11 @@ def resolve_metadata(
             raise integrity_error
         metadata_text = provider.coordinator.index.get_metadata(normalized, ver_str)
     elif isinstance(dist, WheelFile) and dist.local_path is not None:
-        metadata_text = read_wheel_metadata(dist.local_path)
+        try:
+            metadata_text = read_wheel_metadata(dist.local_path)
+        except UnsupportedWheelError:
+            # A contradictory .dist-info is unusable, like an unreadable wheel.
+            metadata_text = None
     else:
         metadata_text = None
 
@@ -554,16 +558,22 @@ def add_classified_dep(
     from ..provider import join_extra
 
     name = canonicalize_name(req.name)
-    vi = req.specifier.to_range()
+    # A bare dependency enters the solver without arbitrary-string admission;
+    # the accumulator identities stay arbitrary-admitting for === literals.
+    vi = (
+        req.specifier.to_range()
+        if req.specifier
+        else VersionRange.full(admit_arbitrary=False)
+    )
     dep_extras: set[str] = req.extras
 
     if not req_extras:
         base_deps[name] = base_deps.get(name, VersionRange.full()) & vi
         for re in dep_extras:
-            base_deps[join_extra(name, re)] = VersionRange.full()
+            base_deps[join_extra(name, re)] = VersionRange.full(admit_arbitrary=False)
     else:
         for extra_name in req_extras:
             edeps = extra_deps_map[extra_name]
             edeps[name] = edeps.get(name, VersionRange.full()) & vi
             for re in dep_extras:
-                edeps[join_extra(name, re)] = VersionRange.full()
+                edeps[join_extra(name, re)] = VersionRange.full(admit_arbitrary=False)

nab_python/_vcs_admission.py

@@ -15,6 +15,7 @@ after admission lets the URL through.
 from __future__ import annotations
 
 import enum
+import posixpath
 from dataclasses import dataclass
 from urllib.parse import urlsplit, urlunsplit
 
@@ -142,7 +143,15 @@ def _repo_prefix_matches(inner_url: str, prefix: str) -> bool:
     prefix and skipped once on the candidate before the boundary check.
     Both URLs have their authority ``user[:pass]@`` / ``git@`` stripped
     by the caller.
+
+    A path git would rewrite is refused first: git applies RFC 3986
+    dot-segment removal at fetch time, so a raw ``..`` path could pass the
+    string match while git fetches a repo outside the prefix.
     """
+    path = urlsplit(inner_url).path
+    if path and posixpath.normpath(path) != path:
+        return False
+
     prefix = prefix.removesuffix(".git")
     if not inner_url.startswith(prefix):
         return False

nab_python/_vendor/packaging/PROVENANCE.md

@@ -1,92 +1,61 @@
 # Vendored `packaging` snapshot
 
-This directory holds a copy of the `packaging` library taken from
-`pypa/packaging:main`, vendored so nab can use the public `VersionRange`
-API before a `packaging` release containing it is published to PyPI.
-
-## Source
-
-- Upstream repository: https://github.com/pypa/packaging
-- Source branch: `pypa/packaging:main`
-- Pinned commit: `0a85b41e24c9b55b83f05ae696d73e8294a5b094`
-- Snapshot date: 2026-07-06
-
-The snapshot is the full `src/packaging/` tree at that commit, plus
-`LICENSE`, `LICENSE.APACHE`, and `LICENSE.BSD` from the repository
-root, except that `ranges.py` and `_ranges.py` diverge from the pinned
-commit (see "Pre-release opt-in change" below). Relative imports inside
-`packaging` (`from .version import Version`, etc.) keep working when the
-package is loaded as `nab_python._vendor.packaging`.
-
-## Pre-release opt-in change
-
-`ranges.py` and `_ranges.py` carry the clipped pre-release opt-in region
-proposed as the successor to packaging PR #1304, rebased on the
-difference-policy guard of PR #1306. `VersionRange` scopes the
-autodetected pre-release opt-in to a per-specifier region clipped to the
-bounds, so union and difference never force-admit a pre-release no
-operand asked for. This closes the whole-range opt-in leak that the flag
-model on `pypa/packaging:main` reaches through nab's conflict-resolution
-union path. Refresh both files from that branch until the change lands
-upstream, then snapshot plain `main` again.
+This directory is a copy of the `packaging` library, vendored so nab can use
+the public `VersionRange` API before a `packaging` release containing it is
+published to PyPI. The tree is pristine `pypa/packaging` at a pinned commit
+plus at most one checked-in patch, and nothing else.
+
+## Model
+
+- `tasks/vendoring/packaging.pin` holds the upstream commit the tree is pinned
+  to.
+- `tasks/vendoring/packaging.patch`, when present, is the only divergence from
+  pristine; the rebuild reapplies it after refreshing. With no patch file the
+  tree is byte-identical to upstream at the pin. The current patch adds
+  `VersionRange.from_bounds` and `VersionRange.snap_bounds` to `ranges.py`,
+  generated from the `range-from-bounds` branch of the packaging fork
+  (`git diff upstream/main..range-from-bounds -- src/packaging/ranges.py`,
+  paths rewritten to this directory). An upstream PR is planned; until it
+  lands the patch carries the two methods.
+- `tasks/vendor-packaging.sh` fetches `pypa/packaging` at the pin, replaces this
+  package with the pristine `src/packaging/` tree plus the repo-root license
+  texts, and reapplies the patch. `--check` rebuilds into a temp location and
+  fails if the committed tree has drifted. This file is nab's own and stays out
+  of both the rebuild and the comparison.
+- CI runs `tasks/vendor-packaging.sh --check`, so the committed tree is proven
+  to equal pristine-at-pin plus the patch on every push.
+
+## Refreshing
+
+1. Bump `tasks/vendoring/packaging.pin` to the new upstream commit.
+2. If the patch no longer applies, rebase its source branch onto the new pin
+   and regenerate `packaging.patch` from it.
+3. Run `tasks/vendor-packaging.sh`, then the test suite.
 
 ## License
 
-`packaging` is dual-licensed under the Apache License 2.0 and the
-2-Clause BSD License. The LICENSE files in this directory are the
-upstream texts; nothing here is relicensed.
+`packaging` is dual-licensed under the Apache License 2.0 and the 2-Clause BSD
+License. The LICENSE files here are the upstream texts; nothing is relicensed.
 
 ## Why vendor instead of depending on it
 
 `packaging` now ships a public `VersionRange` class with set algebra
-(intersection, union, complement, difference), the `is_subset` /
-`is_superset` / `is_disjoint` relation predicates, `is_empty`, `filter`,
-and a `SpecifierSet.to_range()` factory that nab's PubGrub solver depends
-on. The class landed in `main` via
-https://github.com/pypa/packaging/pull/1267, and the difference operator
-(`-`) plus the relation predicates via
-https://github.com/pypa/packaging/pull/1298. None of this has appeared in
-a PyPI release yet, so there is no version we can pin in `pyproject.toml`.
-Vendoring is a temporary measure.
+(intersection, union, complement, difference), the `is_subset` / `is_superset`
+/ `is_disjoint` predicates, `is_empty`, `filter`, and a `SpecifierSet.to_range()`
+factory that nab's PubGrub solver depends on. The class landed in `main` via
+https://github.com/pypa/packaging/pull/1267 and the difference operator plus the
+relation predicates via https://github.com/pypa/packaging/pull/1298. None of
+this has appeared in a PyPI release yet, so there is no version to pin in
+`pyproject.toml`. Vendoring is a temporary measure.
 
 ## Removal plan
 
-Delete this entire directory and reinstate `packaging` as a normal
-dependency once a `packaging` release containing the merged
-`VersionRange` class has been published to PyPI.
-
-Once that holds:
+Delete this directory and reinstate `packaging` as a normal dependency once a
+release containing the merged `VersionRange` class reaches PyPI:
 
 - Add `packaging>=<release>` back to `nab-python/pyproject.toml`
   `[project].dependencies`.
-- Search-replace `from nab_python._vendor.packaging` ->
-  `from packaging` and `import nab_python._vendor.packaging` ->
-  `import packaging` across the workspace.
-- Remove this `_vendor/` tree.
-
-## Updating the snapshot
-
-To refresh against a newer `pypa/packaging:main`:
-
-```
-cd packaging  # the upstream fork checkout
-git fetch upstream main
-NEW_SHA=$(git rev-parse upstream/main)
-DEST=/path/to/nab/nab-python/src/nab_python/_vendor/packaging
-for f in $(git ls-tree -r --name-only upstream/main -- src/packaging); do
-    rel=${f#src/packaging/}
-    # ranges.py/_ranges.py carry the clip change; refresh them from the clip
-    # successor branch, not plain main (see "Pre-release opt-in change").
-    case "$rel" in ranges.py | _ranges.py) continue ;; esac
-    mkdir -p "$(dirname "$DEST/$rel")"
-    git show "upstream/main:$f" > "$DEST/$rel"
-done
-for f in LICENSE LICENSE.APACHE LICENSE.BSD; do
-    git show "upstream/main:$f" > "$DEST/$f"
-done
-```
-
-Refresh `ranges.py` and `_ranges.py` from the clip successor branch until
-the change lands upstream; overwriting them from plain `main` reintroduces
-the whole-range opt-in leak. Then update the **Pinned commit** and
-**Snapshot date** lines above.
+- Search-replace `from nab_python._vendor.packaging` -> `from packaging` and
+  `import nab_python._vendor.packaging` -> `import packaging` across the
+  workspace.
+- Remove this `_vendor/` tree and the `tasks/vendoring/` files.

nab_python/_vendor/packaging/_manylinux.py

@@ -30,8 +30,6 @@ _ALLOWED_ARCHS = {
 }
 
 
-# `os.PathLike` not a generic type until Python 3.9, so sticking with `str`
-# as the type for `path` until then.
 @contextlib.contextmanager
 def _parse_elf(path: str) -> Generator[ELFFile | None, None, None]:
     try:

nab_python/_vendor/packaging/_musllinux.py

@@ -84,5 +84,5 @@ if __name__ == "__main__":  # pragma: no cover
     print("plat:", plat)
     print("musl:", _get_musl_version(sys.executable))
     print("tags:", end=" ")
-    for t in platform_tags(re.sub(r"[.-]", "_", plat.split("-", 1)[-1])):
+    for t in platform_tags([re.sub(r"[.-]", "_", plat.split("-", 1)[-1])]):
         print(t, end="\n      ")

nab_python/_vendor/packaging/_ranges.py

@@ -292,13 +292,13 @@ class UpperBound:
 
 
 if TYPE_CHECKING:
-    #: A single contiguous version range, as a (lower, upper) pair.
-    VersionRange = tuple[LowerBound, UpperBound]
+    #: A single contiguous interval as a (lower, upper) bound pair.
+    Interval = tuple[LowerBound, UpperBound]
 
 
 NEG_INF: Final[LowerBound] = LowerBound(None, False)
 POS_INF: Final[UpperBound] = UpperBound(None, False)
-FULL_RANGE: Final[tuple[VersionRange]] = ((NEG_INF, POS_INF),)
+FULL_RANGE: Final[tuple[Interval]] = ((NEG_INF, POS_INF),)
 
 
 def trim_release(release: tuple[int, ...]) -> tuple[int, ...]:
@@ -501,11 +501,11 @@ def range_is_empty(lower: LowerBound, upper: UpperBound) -> bool:
 
 
 def intersect_ranges(
-    left: Sequence[VersionRange],
-    right: Sequence[VersionRange],
-) -> list[VersionRange]:
+    left: Sequence[Interval],
+    right: Sequence[Interval],
+) -> list[Interval]:
     """Intersect two sorted, non-overlapping range lists (two-pointer merge)."""
-    result: list[VersionRange] = []
+    result: list[Interval] = []
     left_index = right_index = 0
     while left_index < len(left) and right_index < len(right):
         left_lower, left_upper = left[left_index]
@@ -527,11 +527,11 @@ def intersect_ranges(
 
 
 def filter_by_ranges(
-    ranges: Sequence[VersionRange],
+    ranges: Sequence[Interval],
     iterable: Iterable[Any],
     key: Callable[[Any], Version | str] | None,
     prereleases: bool | None,
-    region: Sequence[VersionRange] = (),
+    region: Sequence[Interval] = (),
 ) -> Iterator[Any]:
     """Filter *iterable* against precomputed version *ranges*.
 
@@ -663,7 +663,7 @@ def _lowest_release_at_or_above(value: Version | BoundaryVersion | None) -> Vers
     return _nearest_release_above_prerelease(value)
 
 
-def ranges_are_prerelease_only(ranges: Sequence[VersionRange]) -> bool:
+def ranges_are_prerelease_only(ranges: Sequence[Interval]) -> bool:
     """True when every range in *ranges* contains only pre-releases.
 
     Used to detect unsatisfiable specifier sets when ``prereleases=False``:
@@ -678,7 +678,7 @@ def ranges_are_prerelease_only(ranges: Sequence[VersionRange]) -> bool:
     return True
 
 
-def wildcard_ranges(op: str, base: Version) -> list[VersionRange]:
+def wildcard_ranges(op: str, base: Version) -> list[Interval]:
     """Ranges for ==V.* and !=V.*.
 
     ==1.2.* -> [1.2.dev0, 1.3.dev0);  !=1.2.* -> complement.
@@ -694,7 +694,7 @@ def wildcard_ranges(op: str, base: Version) -> list[VersionRange]:
     ]
 
 
-def standard_ranges(op: str, version: Version, has_local: bool) -> list[VersionRange]:
+def standard_ranges(op: str, version: Version, has_local: bool) -> list[Interval]:
     """Ranges for the standard PEP 440 operators (no wildcard, no ===).
 
     *has_local* indicates whether the spec string included a ``+local``
@@ -763,7 +763,7 @@ def standard_ranges(op: str, version: Version, has_local: bool) -> list[VersionR
     raise ValueError(f"Unknown operator: {op!r}")  # pragma: no cover
 
 
-def bounds_for_spec(op: str, version_str: str, version: Version) -> list[VersionRange]:
+def bounds_for_spec(op: str, version_str: str, version: Version) -> list[Interval]:
     """Ranges for one specifier's ``(op, version_str)``.
 
     Dispatches between the wildcard and standard builders. ``version`` is the
@@ -778,14 +778,14 @@ def bounds_for_spec(op: str, version_str: str, version: Version) -> list[Version
 
 
 def intersect_specifier_bounds(
-    per_specifier_ranges: Iterable[Sequence[VersionRange]],
-) -> Sequence[VersionRange]:
+    per_specifier_ranges: Iterable[Sequence[Interval]],
+) -> Sequence[Interval]:
     """Intersect each specifier's ranges into a single sequence.
 
     Short-circuits once the running intersection is empty, since no later
     specifier can revive it. Callers must pass at least one specifier.
     """
-    result: Sequence[VersionRange] | None = None
+    result: Sequence[Interval] | None = None
     for sub in per_specifier_ranges:
         if result is None:
             result = sub
@@ -800,7 +800,7 @@ def intersect_specifier_bounds(
     return result
 
 
-def matches_bounds_only(ranges: Sequence[VersionRange], version: Version) -> bool:
+def matches_bounds_only(ranges: Sequence[Interval], version: Version) -> bool:
     """Whether ``version`` falls within any of ``ranges``.
 
     The pure bounds membership test, for a single already-parsed version with

nab_python/_vendor/packaging/dependency_groups.py

@@ -4,7 +4,7 @@ import re
 from collections.abc import Mapping, Sequence
 
 from .errors import _ErrorCollector
-from .requirements import Requirement
+from .requirements import InvalidRequirement, Requirement
 
 __all__ = [
     "CyclicDependencyGroup",
@@ -241,9 +241,10 @@ class DependencyGroupResolver:
         for item in raw_group:
             if isinstance(item, str):
                 # packaging.requirements.Requirement parsing ensures that this is a
-                # valid PEP 508 Dependency Specifier
-                # raises InvalidRequirement on failure
-                elements.append(Requirement(item))
+                # valid PEP 508 Dependency Specifier. Collect InvalidRequirement
+                # if it throws that.
+                with errors.collect(InvalidRequirement):
+                    elements.append(Requirement(item))
             elif isinstance(item, Mapping):
                 if tuple(item.keys()) != ("include-group",):
                     errors.error(

nab_python/_vendor/packaging/direct_url.py

@@ -9,6 +9,7 @@ from typing import TYPE_CHECKING, Any, Protocol, TypeVar
 if TYPE_CHECKING:  # pragma: no cover
     import sys
     from collections.abc import Collection
+    from urllib.parse import SplitResult
 
     if sys.version_info >= (3, 11):
         from typing import Self
@@ -109,6 +110,10 @@ def _strip_url(url: str, safe_user_passwords: Collection[str]) -> str:
     )
 
 
+def _file_url_has_absolute_path(parsed_url: SplitResult) -> bool:
+    return parsed_url.path.startswith("/")
+
+
 class DirectUrlValidationError(Exception):
     """Raised when when input data is not spec-compliant.
 
@@ -289,14 +294,18 @@ class DirectUrl:
             raise DirectUrlValidationError(
                 "Exactly one of vcs_info, archive_info, dir_info must be present"
             )
-        if (
-            direct_url.dir_info is not None
-            and urllib.parse.urlsplit(direct_url.url).scheme != "file"
-        ):
-            raise DirectUrlValidationError(
-                "URL scheme must be file:// when dir_info is present",
-                context="url",
-            )
+        if direct_url.dir_info is not None:
+            parsed_url = urllib.parse.urlsplit(direct_url.url)
+            if parsed_url.scheme != "file":
+                raise DirectUrlValidationError(
+                    "URL scheme must be file:// when dir_info is present",
+                    context="url",
+                )
+            if not _file_url_has_absolute_path(parsed_url):
+                raise DirectUrlValidationError(
+                    "File URL must be absolute when dir_info is present",
+                    context="url",
+                )
         # XXX subdirectory must be relative, can we, should we validate that here?
         return direct_url
 

nab_python/_vendor/packaging/markers.py

@@ -4,6 +4,7 @@
 
 from __future__ import annotations
 
+import functools
 import operator
 import os
 import platform
@@ -172,6 +173,18 @@ def _normalize_extras(
     elif isinstance(rhs, Variable) and rhs.value == "extra" and isinstance(lhs, Value):
         normalized_extra = canonicalize_name(lhs.value)
         lhs = Value(normalized_extra)
+    elif (
+        isinstance(rhs, Variable)
+        and rhs.value in MARKERS_ALLOWING_SET
+        and isinstance(lhs, Value)
+    ):
+        # PEP 685 (extras) / PEP 735 (dependency_groups): the set-valued membership
+        # literal must also be normalized. evaluate() already canonicalizes both
+        # operands for these keys (see _normalize), so normalizing the literal at
+        # parse time keeps __str__/__eq__/__hash__ consistent with evaluate() -- e.g.
+        # Marker('"Foo" in extras') and Marker('"foo" in extras') must compare and
+        # hash equal (the membership variable is always the right-hand operand).
+        lhs = Value(canonicalize_name(lhs.value))
     return lhs, op, rhs
 
 
@@ -288,7 +301,13 @@ def _evaluate_markers(
                 environment_key = rhs.value
                 rhs_value = _lookup_environment(environment, environment_key)
 
-            assert isinstance(lhs_value, str), "lhs must be a string"
+            if not isinstance(lhs_value, str):
+                raise UndefinedComparison(
+                    f"Set-valued marker {environment_key!r} can only be used "
+                    f'with the membership form (e.g. "<name>" in '
+                    f"{environment_key}); it cannot appear on the left-hand "
+                    f"side of {op.serialize()!r}."
+                )
             lhs_value, rhs_value = _normalize(lhs_value, rhs_value, key=environment_key)
             groups[-1].append(_eval_op(lhs_value, op, rhs_value, key=environment_key))
         elif marker == "or":
@@ -309,10 +328,14 @@ def _format_full_version(info: sys._version_info) -> str:
     return version
 
 
-def default_environment() -> Environment:
-    """Return the default marker environment for the current Python process.
+@functools.cache
+def _cached_default_environment() -> Environment:
+    """Build the default marker environment for the current Python process.
 
-    This is the base environment used by :meth:`Marker.evaluate`.
+    The values are derived from process-constant data (the running interpreter
+    and the host platform), so this is cached and built only once. The result is
+    shared between callers and must never be mutated; :func:`default_environment`
+    returns a fresh copy.
     """
     iver = _format_full_version(sys.implementation.version)
     implementation_name = sys.implementation.name
@@ -331,6 +354,22 @@ def default_environment() -> Environment:
     }
 
 
+def default_environment() -> Environment:
+    """Return the default marker environment for the current Python process.
+
+    This is the base environment used by :meth:`Marker.evaluate`. A fresh copy
+    is returned on every call so callers may freely mutate the result; a shallow
+    copy suffices because all values are immutable strings.
+
+    .. versionchanged:: 26.3
+        The environment is computed once per process and cached, since it is
+        derived from process-constant data. Patching ``platform``/``sys``/``os``
+        after the first call has no effect; pass an explicit ``environment`` to
+        :meth:`Marker.evaluate` to evaluate against different values.
+    """
+    return cast("Environment", dict(_cached_default_environment()))
+
+
 class Marker:
     """Represents a parsed dependency marker expression.
 

nab_python/_vendor/packaging/metadata.py

@@ -228,13 +228,19 @@ def _get_payload(msg: email.message.Message, source: bytes | str) -> str:
     # and we don't need to deal with it.
     if isinstance(source, str):
         payload = msg.get_payload()
-        assert isinstance(payload, str)
+        # A multipart payload makes get_payload() return a list of messages
+        # rather than a str; route it to ``unparsed``.
+        if not isinstance(payload, str):
+            raise ValueError("payload is not a string")  # noqa: TRY004
         return payload
     # If our source is a bytes, then we're managing the encoding and we need
     # to deal with it.
     else:
         bpayload = msg.get_payload(decode=True)
-        assert isinstance(bpayload, bytes)
+        # A multipart payload makes get_payload(decode=True) return None;
+        # route it to ``unparsed``.
+        if not isinstance(bpayload, bytes):
+            raise ValueError("payload in an invalid encoding")  # noqa: TRY004
         try:
             return bpayload.decode("utf8", "strict")
         except UnicodeDecodeError as exc:

nab_python/_vendor/packaging/pylock.py

@@ -105,7 +105,10 @@ def _get(d: Mapping[str, Any], expected_type: type[_T], key: str) -> _T | None:
     """Get a value from the dictionary and verify it's the expected type."""
     if (value := d.get(key)) is None:
         return None
-    if not isinstance(value, expected_type):
+    if not isinstance(value, expected_type) or (
+        # Special case: bool is a subclass of int, but TOML distinguishes the two
+        expected_type is int and isinstance(value, bool)
+    ):
         raise PylockValidationError(
             f"Unexpected type {type(value).__name__} "
             f"(expected {expected_type.__name__})",