chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
tox (changelog)	==4.64.2 → ==4.64.4
werkzeug (changelog)	==3.1.8 → ==3.1.9

---

Release Notes

tox-dev/tox (tox)

v4.64.4

Compare Source

What's Changed

• fix(pip): pass --pre once in the default command by @​Rodrigo-Palma in #​4097
• fix(cli): parse list-valued defaults by nargs by @​januththedev in #​4098

New Contributors

• @​januththedev made their first contribution in #​4098

Full Changelog: tox-dev/tox@4.64.3...4.64.4

v4.64.3

Compare Source

What's Changed

• Create change_dir before running the external package build command by @​Rodrigo-Palma in #​4095
• Keep every file entry of a set_env list of tables by @​Rodrigo-Palma in #​4094

New Contributors

• @​Rodrigo-Palma made their first contribution in #​4095

Full Changelog: tox-dev/tox@4.64.2...4.64.3

pallets/werkzeug (werkzeug)

v3.1.9

Compare Source

Released 2026-09-27

• safe_join on Windows does not allow special devices names with empty ADS
  markers on NTFS. :ghsa:g6x2-hccm-hh4m
• ProfilerMiddleware uses profiling.tracing on Python 3.15.
  :issue:3207
• uri_to_iri and iri_to_uri preserve empty username, password, and
  port 0. :issue:3189
• Improve performance of parse_options_header. :pr:3231
• Improve performance of parse_etags. :pr:3231
• Improve performance of parse_cookie. :pr:3231
• get_host also checks that the port is in the valid range. :pr:3236
• The int URL converter returns a 404 instead of 500 error when the value
  is longer than sys.get_int_max_str_digits(). :issue:3237
• Improve debugger PIN generation from cgroup data inside Podman.
  :issue:3245
• Authorization parsing basic auth disallows non-base64 characters.
  :pr:3248
• application/x-www-form-urlencoded form data is no longer limited to
  max_form_memory_size, only max_content_length. :pr:3251
• LimitedStream.readinto does not resize the buffer when it reads less
  than the remaining size. :pr:3253
• Rules with 10 or more converters in a single part assign matched values
  correctly. :pr:3254
• The invalid Range suffix length -0 is no longer accepted. :pr:3255

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.