Update dependency tox to v4.56.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
tox (changelog)	4.55.1 → 4.56.0

---

Release Notes

tox-dev/tox (tox)

v4.56.0

Compare Source

What's Changed

• Fix type errors flagged by ty 0.0.43 by @​gaborbernat in #​3952
• Drop obsolete ty: ignore directives by @​gaborbernat in #​3957
• docs: Use double backquotes for git command in development.rst by @​mushitoriami in #​3961
• docs: Fix indent misalignment in reference/config.rst by @​mushitoriami in #​3962
• docs: replace http://tox.readthedocs.org with https://tox.wiki by @​TejasAmle in #​3963
• 🐛 fix(config): restore skip_missing_interpreters default to False by @​gaborbernat in #​3966
• ✨ feat(virtualenv): auto-pin virtualenv for end-of-life Python by @​gaborbernat in #​3967

New Contributors

• @​TejasAmle made their first contribution in #​3963

Full Changelog: tox-dev/tox@4.55.1...4.56.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy Security Scan

Python

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	cryptography	46.0.7	48.0.1	GHSA-537c-gmf6-5ccf	Vulnerable OpenSSL included in cryptography wheels
🟠 HIGH	urllib3	2.6.3	2.7.0	CVE-2026-44431	urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
🟠 HIGH	urllib3	2.6.3	2.7.0	CVE-2026-44432	urllib3: urllib3: Denial of Service due to excessive HTTP response decompression

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-27145	*x509.Certificate).VerifyHostname previously called matchHostnames in ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	*x509.Certificate).VerifyHostname previously called matchHostnames in ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	*x509.Certificate).VerifyHostname previously called matchHostnames in ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...