build(deps): bump vcs-versioning from 2.2.4 to 2.3.1

[dependabot]

Bumps vcs-versioning from 2.2.4 to 2.3.1.

Release notes

Sourced from vcs-versioning's releases.

vcs-versioning v2.3.1

Fixed

• Fix a FileNotFoundError crash in the git file finder when a submodule is tracked in the index but its working tree directory does not exist - such gitlinks are now skipped like not checked out submodules. (#1500)

vcs-versioning v2.3.0

Added

• Add a vcs_versioning.dynamic_metadata provider for the dynamic-metadata system. (#1465)

Fixed

• Make the tag.strict and scm.git.describe_command diagnostics actionable and non-conflicting.

  The tag.strict future-default notice is now reported by the git backend rather than at configuration time, and only when the future default would actually select a different tag for the repository -- the message names both the current and the future version string. Projects the change cannot affect are silent, and setting an explicit describe_command no longer triggers it at all, so the two warnings can no longer contradict each other.

  The describe_command notice is likewise limited to the case where it and an explicit tag.strict really disagree, and no longer claims that tag.prefix has no effect -- prefix stripping applies regardless of how the tag was selected.

  Both are logged at warning level instead of raised as warnings, so SETUPTOOLS_SCM_DEBUG=ERROR silences them. (#1429)

• Honour export-ignore on directories and submodules again in the git file finder.

  The switch from git archive to git ls-files --recurse-submodules lost two parts of the archive semantics: --recurse-submodules listed every submodule regardless of export-ignore, and the :(exclude,attr:export-ignore) pathspec only matches files, so an export-ignore on a directory no longer excluded the files below it. Projects that kept vendored submodules in an export-ignored directory suddenly shipped them in their sdists.

  The finder now lists a repository without recursion, checks export-ignore for directories via git check-attr (which is what git archive effectively does when it skips a tree), and only then descends into the submodules that survived. Submodule contents are still listed - with their own .gitattributes applied - so export-ignore in the parent repository now controls exactly which submodules get packaged. Submodules that are not checked out are skipped instead of failing the listing. (#1469)

• Honour tag.strict on Mercurial changesets that carry tags of their own, and report the coming strict default for Mercurial repositories.

  tag.strict was only applied when looking for the latest tag, so a checked-out changeset tagged event-2024 still produced version 2024 even with tag.strict = true, while git rejected the same tag. Strict matching now applies to the tags on the changeset too: a changeset carrying only event-style tags is treated as untagged and versioning continues from the last real version tag, matching git describe --match. When several tags sit on one changeset, the version-shaped one is now selected instead of whichever Mercurial happened to list first.

  The tag.strict divergence diagnostic added in #1429 now covers Mercurial as well, naming the current and future version whenever the coming default would change them. Both backends share the message, and the git-only helpers moved to _backends/_scm_workdir.py.

  Note that the Mercurial backend required a dot in version tags before setuptools-scm 9, so for Mercurial projects the coming strict default restores the historical behavior. (#1495)

Commits

• ffa8d49 Merge pull request #1502 from pypa/release/main
• 21a40e6 Prepare release: vcs-versioning v2.3.1
• 3c9c18d Merge pull request #1501 from RonnyPfannschmidt/fix-1500-missing-submodule-wo...
• f6b41bb fix: skip gitlinks whose working tree is absent in file finding
• 8ee692f Merge pull request #1493 from pypa/release/main
• 784eb38 Prepare release: vcs-versioning v2.3.0
• b815737 Merge pull request #1498 from RonnyPfannschmidt/fix-1469-export-ignore-submod...
• 217ab54 fix: honour export-ignore for directories and submodules in file discovery (#...
• 46ff855 Merge pull request #1497 from RonnyPfannschmidt/fix-1495-hg-tag-strict
• 9be8078 test: cover hg tag selection as pure logic instead of via hg update
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)