build(deps): Update portalocker requirement from >=3.2.0 to >=4.0.0

[dependabot]

Updates the requirements on portalocker to permit the latest version.

Release notes

Sourced from portalocker's releases.

v4.0.0

4.0.0:

• Fixed open_atomic() replacing a destination created while its context was open on POSIX; publication now raises FileExistsError and preserves the concurrent winner (#114)
• Python 3.10 or later is now required; Python 3.9 (EOL) support dropped
• pywin32 is no longer installed by default on Windows; the msvcrt-based locker is the default and works dependency-free for exclusive locks. Shared locks on Windows require portalocker[win32], and an informative ImportError is raised otherwise (#104)
• POSIX lock exceptions now populate .strerror and pass the message as a second positional argument, matching the Windows exception contract. This changes the str() output of these exceptions on POSIX from the bare OSError text to a 2-tuple repr
• LockBase is now generic over the acquire return type (typing-only change; downstream Lock subclasses are unaffected)
• Added PidFileLock for pidfile-based locking (#106)
• Added PidFileLock.fail_closed() for ownership-only contexts; contention raises AlreadyLocked before entering the body and exposes the competing PID through AlreadyLocked.holder_pid when readable (#118)
• Packaging switched to the uv_build backend; releases are published to PyPI through GitHub Actions Trusted Publishing
• python -m portalocker combine: --output-file now opens lazily; the vendored single-file output correctly includes RedisLock (it was always None before); the smoke-run now uses sys.executable (fixes Windows)
• Fixed PidFileLock ignoring timeout when fail_when_locked=False; all PID-publication failures now transactionally release the sidecar and preserve the publication error if cleanup also fails (#116)
• Fixed a TemporaryFileLock/PidFileLock unlock-then-unlink race that could let two processes hold the same lock (split-brain); release now unlinks before unlocking on POSIX and acquire re-verifies file identity (inode) after locking (#115)
• Fixed BoundedSemaphore staying permanently "Already locked" after a non-contention error (e.g. a missing directory)
• Fixed RedisLock crashed-holder detection: the liveness check was always satisfied by its own subscribe confirmation, so dead holders were never reaped; the ping is now published only after the subscription is confirmed active, pubsub connections no longer leak on the reap path, fail_when_locked=True fails fast instead of polling the full timeout, internally-created connections are closed on release, and a failed acquire() rolls back cleanly so the lock can be retried
• Added shared RedisLock readers through LockFlags.SHARED. Waiting writers gate new readers to prevent starvation, holder-specific heartbeats preserve stale-client cleanup, and legacy Redis lock responses are treated as exclusive for mixed-version safety (#124)
• Fixed FlockLocker/LockfLocker on POSIX to use their named syscall (previously silently used the global LOCKER); the module-level lock()/unlock() on POSIX now accept all documented LOCKER

... (truncated)

Changelog

Sourced from portalocker's changelog.

4.0.0:

• Fixed open_atomic() replacing a destination created while its context was open on POSIX; publication now raises FileExistsError and preserves the concurrent winner (#114)
• Python 3.10 or later is now required; Python 3.9 (EOL) support dropped
• pywin32 is no longer installed by default on Windows; the msvcrt-based locker is the default and works dependency-free for exclusive locks. Shared locks on Windows require portalocker[win32], and an informative ImportError is raised otherwise (#104)
• POSIX lock exceptions now populate .strerror and pass the message as a second positional argument, matching the Windows exception contract. This changes the str() output of these exceptions on POSIX from the bare OSError text to a 2-tuple repr
• LockBase is now generic over the acquire return type (typing-only change; downstream Lock subclasses are unaffected)
• Added PidFileLock for pidfile-based locking (#106)
• Added PidFileLock.fail_closed() for ownership-only contexts; contention raises AlreadyLocked before entering the body and exposes the competing PID through AlreadyLocked.holder_pid when readable (#118)
• Packaging switched to the uv_build backend; releases are published to PyPI through GitHub Actions Trusted Publishing
• python -m portalocker combine: --output-file now opens lazily; the vendored single-file output correctly includes RedisLock (it was always None before); the smoke-run now uses sys.executable (fixes Windows)
• Fixed PidFileLock ignoring timeout when fail_when_locked=False; all PID-publication failures now transactionally release the sidecar and preserve the publication error if cleanup also fails (#116)
• Fixed a TemporaryFileLock/PidFileLock unlock-then-unlink race that could let two processes hold the same lock (split-brain); release now unlinks before unlocking on POSIX and acquire re-verifies file identity (inode) after locking (#115)
• Fixed BoundedSemaphore staying permanently "Already locked" after a non-contention error (e.g. a missing directory)
• Fixed RedisLock crashed-holder detection: the liveness check was always satisfied by its own subscribe confirmation, so dead holders were never reaped; the ping is now published only after the subscription is confirmed active, pubsub connections no longer leak on the reap path, fail_when_locked=True fails fast instead of polling the full timeout, internally-created connections are closed on release, and a failed acquire() rolls back cleanly so the lock can be retried
• Added shared RedisLock readers through LockFlags.SHARED. Waiting writers gate new readers to prevent starvation, holder-specific heartbeats preserve stale-client cleanup, and legacy Redis lock responses are treated as exclusive for mixed-version safety (#124)
• Fixed FlockLocker/LockfLocker on POSIX to use their named syscall (previously silently used the global LOCKER); the module-level lock()/unlock() on POSIX now accept all documented LOCKER forms (tuple/instance/class)

... (truncated)

Commits

• cf1e80d 4.0.0:
• 4172e4b Merge pull request #132 from wolph/release/4.0.0-integration
• 34fa2ee fix: address release review feedback
• 42a0d85 Merge master into develop before v4.0.0
• 8ccd355 docs: plan portalocker 4.0.0 release
• 73fec6f docs: design portalocker 4.0.0 release
• 4b60c8e Merge pull request #128 from wolph/dependabot/github_actions/master/actions-4...
• ae893a4 Bump the actions group across 1 directory with 4 updates
• 9e06adf Merge pull request #131 from wolph/fix/appveyor-64bit
• 0e8b3cf Merge pull request #130 from wolph/fix/appveyor-develop
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #214.