Update dependency wheel to ^0.48.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
wheel (changelog)	^0.36.2 → ^0.48.0

---

Release Notes

pypa/wheel (wheel)

v0.48.0

Compare Source

• Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel (#​570)
• Fixed wheel convert unnecessarily upgrading compatible core metadata versions (#​643)
• Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (#​692)
• Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw)

v0.47.0

Compare Source

• Added the wheel info subcommand to display metadata about wheel files without unpacking them (#​639)
• Fixed WheelFile raising Missing RECORD file when the wheel filename contains uppercase characters (e.g. Django-3.2.5.whl) but the .dist-info directory inside uses normalized lowercase naming (#​411)

v0.46.3

Compare Source

• Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command (#​676)

v0.46.2

Compare Source

• Restored the bdist_wheel command for compatibility with setuptools older than v70.1
• Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning
• Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

v0.46.1

Compare Source

• Temporarily restored the wheel.macosx_libfile module (#​659)

v0.46.0

Compare Source

• Dropped support for Python 3.8
• Removed the bdist_wheel setuptools command implementation and entry point. The wheel.bdist_wheel module is now just an alias to setuptools.command.bdist_wheel, emitting a deprecation warning on import.
• Removed vendored packaging in favor of a run-time dependency on it
• Made the wheel.metadata module private (with a deprecation warning if it's imported
• Made the wheel.cli package private (no deprecation warning)
• Fixed an exception when calling the convert command with an empty description field

v0.45.1

Compare Source

• Fixed pure Python wheels converted from eggs and wininst files having the ABI tag in the file name

v0.45.0

Compare Source

• Refactored the convert command to not need setuptools to be installed

• Don't configure setuptools logging unless running bdist_wheel

• Added a redirection from wheel.bdist_wheel.bdist_wheel to setuptools.command.bdist_wheel.bdist_wheel to improve compatibility with setuptools' latest fixes.

  Projects are still advised to migrate away from the deprecated module and import the setuptools' implementation explicitly. (PR by @​abravalheri)

v0.44.0

Compare Source

• Canonicalized requirements in METADATA file (PR by Wim Jeantine-Glenn)
• Deprecated the bdist_wheel module, as the code was migrated to setuptools itself

v0.43.0

Compare Source

• Dropped support for Python 3.7
• Updated vendored packaging to 24.0

v0.42.0

Compare Source

• Allowed removing build tag with wheel tags --build ""
• Fixed wheel pack and wheel tags writing updated WHEEL fields after a blank line, causing other tools to ignore them
• Fixed wheel pack and wheel tags writing WHEEL with CRLF line endings or a mix of CRLF and LF
• Fixed wheel pack --build-number "" not removing build tag from WHEEL (above changes by Benjamin Gilbert)

v0.41.3

Compare Source

• Updated vendored packaging to 23.2
• Fixed ABI tag generation for CPython 3.13a1 on Windows (PR by Sam Gross)

v0.41.2

Compare Source

v0.41.1

Compare Source

v0.41.0

Compare Source

v0.40.0

Compare Source

v0.38.4

Compare Source

v0.38.3

Compare Source

v0.38.2

Compare Source

v0.38.1

Compare Source

v0.38.0

Compare Source

v0.37.1

Compare Source

v0.37.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock

The current project's Python requirement (>=3.7.10,<3.11) is not compatible with some of the required packages Python requirement:
  - wheel requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9

Because wheel (0.48.0) requires Python >=3.9
 and no versions of wheel match >0.48.0,<0.49.0, wheel is forbidden.
So, because godel depends on wheel (^0.48.0), version solving failed.

  • Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties
    
    For wheel, a possible solution would be to set the `python` property to ">=3.9,<3.11"

    https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
    https://python-poetry.org/docs/dependency-specification/#using-environment-markers