Bump twine from 6.2.0 to 7.0.0

[dependabot]

Bumps twine from 6.2.0 to 7.0.0.

Changelog

Sourced from twine's changelog.

twine 7.0.0 (2026-07-27)

Bugfixes ^^^^^^^^

• Specify UTF-8 encoding when reading .pypirc files. ([#1268](https://github.com/pypa/twine/issues/1268) <https://github.com/pypa/twine/issues/1268>_)
• Add missing subdependencies to --version output. ([#1275](https://github.com/pypa/twine/issues/1275) <https://github.com/pypa/twine/issues/1275>_)
• The dependency on rich has been bumped to avoid a hang in some environments. ([#1308](https://github.com/pypa/twine/issues/1308) <https://github.com/pypa/twine/issues/1308>_)
• Indices that respond with non-standard HTTP codes are now handled more gracefully. ([#1309](https://github.com/pypa/twine/issues/1309) <https://github.com/pypa/twine/issues/1309>_)

Deprecations and Removals ^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix uploading packages with metadata version 2.5. The fix no longer allows metadata version 2.0, which was never officially standardised. ([#1317](https://github.com/pypa/twine/issues/1317) <https://github.com/pypa/twine/issues/1317>_)

Misc ^^^^

• [#1298](https://github.com/pypa/twine/issues/1298) <https://github.com/pypa/twine/issues/1298>_

Commits

• fdb86cb Update changelog for 7.0.0 (#1344)
• bfa7f7f changelog: backfill entries from PRs (#1330)
• 4f20c0d Remove monkeypatch allowing Metadata 2.0 (#1317)
• 1df249e build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#1318)
• bea9607 fix: bump minimum rich dependency to 14.3.3 to prevent verbose hang (#1308)
• ac17a17 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1311)
• 039cedf build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#1313)
• d465cb0 Handle non-standard HTTP status codes (#1309)
• cab618f Bump packaging >= 26.1 (#1310)
• 2d06e11 build(deps): bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (#1307)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

PR Review — Bump twine 6.2.0 → 7.0.0

This is a single-line dependency version bump in pyproject.toml (Dependabot-style PR, part of a merged bot PR chain). Reviewed against the checklist:

Code Quality

• ✅ Style/formatting: pyproject.toml:45 — the entry is alphabetically placed correctly among the development group (twine before virtualenv, after pytest pins), consistent with the rest of the file.
• ✅ No commented-out code
• ✅ Meaningful names — N/A, pure dependency pin change
• ✅ DRY — N/A
• ⚠️ Defects: This is a major version bump (6.x → 7.0.0), not a patch/minor. Twine major releases have historically changed minimum-supported-Python or CLI/config behavior (e.g., .pypirc handling, keyring integration). Nothing in the repo directly invokes twine from Python code (grep found no imports), so risk is limited to the packaging/release workflow (build/twine upload steps in CI or release docs). Recommend confirming the release workflow (e.g., .github/workflows/*.yml publish step) still runs twine check/twine upload successfully against this version before merging, since I don't have network access to check twine's 7.0.0 changelog for breaking changes.
• ✅ CLAUDE.md — no changes to .claude/CLAUDE.md in this diff; nothing to flag here.

Testing

• N/A — no testable code changed, this is a dev-only tooling dependency (used for packaging, not runtime).

Documentation

• ✅ No README/API doc changes needed.
• ✅ CHANGELOG.md — not updated, but confirmed via git log that no prior Dependabot bump PR (virtualenv, cryptography, mypy, coverage, etc.) has ever updated CHANGELOG.md either, so this is consistent with existing project convention rather than a gap introduced by this PR.
• N/A — no new inline comments needed.

Security

• ✅ No hardcoded credentials.
• ✅ No input validation concerns — dependency pin only.
• ✅ No error handling changes.
• ✅ No sensitive data touched.
• ✅ No .lic files or AQAAAD-prefixed license strings introduced by this diff. (Note: I did find files containing AQAAAD in the working tree — prompt-header.md, prompt-temp.md, build-resources/claude/pr-prompt.md, build-resources/.claude/CLAUDE.md — but these are pre-existing untracked files unrelated to this PR's diff; they contain this review checklist's own instructional text referencing the AQAAAD string pattern, not actual license keys. Not part of the change under review.)

Summary

No blocking issues. This is a low-risk, mechanical dependency bump consistent with the repo's established Dependabot pattern. Only recommendation is to verify the packaging/release CI step still succeeds with twine 7.0.0 given it's a major version jump.

Automated code review analyzing defects and coding standards