From dc3b8902c0a4d7427d721f97dd7fdfffc6e583d9 Mon Sep 17 00:00:00 2001
From: Ruda Porto Filgueiras <rudazz@gmail.com>
Date: Sat, 15 Oct 2022 15:38:40 +0200
Subject: [PATCH 1/7] fix combined coverage report

---
 .meta.toml | 39 ++++++++++++++++-----------------------
 tox.ini    | 27 ++++++---------------------
 2 files changed, 22 insertions(+), 44 deletions(-)

diff --git a/.meta.toml b/.meta.toml
index bb6c0730..ed872c7d 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -2,7 +2,7 @@
 # https://github.com/zopefoundation/meta/tree/master/config/pure-python
 [meta]
 template = "pure-python"
-commit-id = "b5df3766ff8923477f3d24729b19504f0c401a2e"
+commit-id = "54e37f7de7149c0d4003e40bbe300d012a851ce7"
 
 [python]
 with-pypy = false
@@ -16,7 +16,6 @@ with-future-python = true
 use-flake8 = true
 additional-envlist = [
     "py39-datetime",
-    "combined-coverage",
     ]
 testenv-deps = [
     "datetime: DateTime",
@@ -31,33 +30,27 @@ testenv-commands = [
     "pip list",
     "pytest --cov=src --cov=tests --cov-report= {posargs}",
     ]
-testenv-additional = [
-    "",
-    "[testenv:combined-coverage]",
-    "basepython = python3",
-    "allowlist_externals =",
-    "    mkdir",
-    "deps =",
-    "    coverage",
-    "    -cconstraints.txt",
-    "setenv =",
-    "    COVERAGE_FILE=.coverage",
-    "commands =",
-    "    mkdir -p {toxinidir}/parts/htmlcov",
-    "    coverage erase",
-    "    coverage combine",
-    "    coverage html",
-    "    coverage report -m --fail-under=100",
-    "depends = py36,py37,py38,py39,py39-datetime,py310,py311,coverage",
+coverage-basepython = "python3"
+coverage-deps = [
+    "coverage",
+    "-cconstraints.txt",
+    ]
+coverage-command = [
+    "mkdir -p {toxinidir}/parts/htmlcov",
+    "coverage combine",
+    "coverage html",
+    "coverage report -m --fail-under=100",
     ]
-coverage-basepython = "python3.8"
-coverage-command = "pytest --cov=src --cov=tests --cov-report= {posargs}"
+coverage-depends = "py36,py37,py38,py39,py39-datetime,py310,py311"
 coverage-setenv = [
     "COVERAGE_FILE=.coverage",
     ]
+coverage-allowlist_externals = [
+    "mkdir",
+    ]
 
 [coverage]
-fail-under = 98.8
+fail-under = 100.0
 
 [isort]
 additional-sources = "{toxinidir}/tests"
diff --git a/tox.ini b/tox.ini
index 3226a984..cbd11157 100644
--- a/tox.ini
+++ b/tox.ini
@@ -13,7 +13,6 @@ envlist =
     docs
     coverage
     py39-datetime
-    combined-coverage
 
 [testenv]
 usedevelop = true
@@ -34,23 +33,6 @@ extras =
     test
     docs
 
-[testenv:combined-coverage]
-basepython = python3
-allowlist_externals =
-    mkdir
-deps =
-    coverage
-    -cconstraints.txt
-setenv =
-    COVERAGE_FILE=.coverage
-commands =
-    mkdir -p {toxinidir}/parts/htmlcov
-    coverage erase
-    coverage combine
-    coverage html
-    coverage report -m --fail-under=100
-depends = py36,py37,py38,py39,py39-datetime,py310,py311,coverage
-
 [testenv:lint]
 basepython = python3
 skip_install = true
@@ -83,7 +65,7 @@ commands =
     sphinx-build -b doctest -d docs/_build/doctrees docs docs/_build/doctest
 
 [testenv:coverage]
-basepython = python3.8
+basepython = python3
 allowlist_externals =
     mkdir
 deps =
@@ -96,10 +78,13 @@ setenv =
     COVERAGE_FILE=.coverage
 commands =
     mkdir -p {toxinidir}/parts/htmlcov
-    pytest --cov=src --cov=tests --cov-report= {posargs}
+    mkdir -p {toxinidir}/parts/htmlcov
+    coverage combine
+    coverage html
+    coverage report -m --fail-under=100
     coverage run -a -m sphinx -b doctest -d {envdir}/.cache/doctrees docs {envdir}/.cache/doctest
     coverage html
-    coverage report -m --fail-under=98.8
+    coverage report -m --fail-under=100.0
 
 [coverage:run]
 branch = True

From 95272c290cd27fc481d2c5a692d13ac4ed1618e3 Mon Sep 17 00:00:00 2001
From: Ruda Porto Filgueiras <rudazz@gmail.com>
Date: Sat, 15 Oct 2022 15:53:24 +0200
Subject: [PATCH 2/7] fix: combined coverage report

---
 .github/workflows/tests.yml |  2 ++
 .meta.toml                  | 15 +++------------
 tox.ini                     |  6 ++----
 3 files changed, 7 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 14244e4c..6b95bd21 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -58,10 +58,12 @@ jobs:
         python -m pip install --upgrade pip
         pip install tox
     - name: Test
+      if: matrix.config[1] != 'coverage'
       run: tox -e ${{ matrix.config[1] }}
     - name: Coverage
       if: matrix.config[1] == 'coverage'
       run: |
+        tox -e py36,py37,py38,py39,py39-datetime,py310,py311,coverage
         pip install coveralls
         coveralls --service=github
       env:
diff --git a/.meta.toml b/.meta.toml
index ed872c7d..5f54a5ad 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -31,23 +31,14 @@ testenv-commands = [
     "pytest --cov=src --cov=tests --cov-report= {posargs}",
     ]
 coverage-basepython = "python3"
-coverage-deps = [
-    "coverage",
-    "-cconstraints.txt",
-    ]
 coverage-command = [
-    "mkdir -p {toxinidir}/parts/htmlcov",
-    "coverage combine",
-    "coverage html",
-    "coverage report -m --fail-under=100",
-    ]
+    "coverage erase",
+    "coverage combine"
+]
 coverage-depends = "py36,py37,py38,py39,py39-datetime,py310,py311"
 coverage-setenv = [
     "COVERAGE_FILE=.coverage",
     ]
-coverage-allowlist_externals = [
-    "mkdir",
-    ]
 
 [coverage]
 fail-under = 100.0
diff --git a/tox.ini b/tox.ini
index cbd11157..ec3a21e1 100644
--- a/tox.ini
+++ b/tox.ini
@@ -11,8 +11,8 @@ envlist =
     py310
     py311
     docs
-    coverage
     py39-datetime
+    coverage
 
 [testenv]
 usedevelop = true
@@ -78,10 +78,8 @@ setenv =
     COVERAGE_FILE=.coverage
 commands =
     mkdir -p {toxinidir}/parts/htmlcov
-    mkdir -p {toxinidir}/parts/htmlcov
+    coverage erase
     coverage combine
-    coverage html
-    coverage report -m --fail-under=100
     coverage run -a -m sphinx -b doctest -d {envdir}/.cache/doctrees docs {envdir}/.cache/doctest
     coverage html
     coverage report -m --fail-under=100.0

From f3704f2c1929d94ae1361d3bd7c097f1b691a3c8 Mon Sep 17 00:00:00 2001
From: Ruda Porto Filgueiras <rudazz@gmail.com>
Date: Sun, 16 Oct 2022 10:21:00 +0200
Subject: [PATCH 3/7] coverage: add new job to run after build

Build job:
- add upload artifact step after each test in the matrix.
- update coveralls step to upload partial data.

Converage job (new):
- complete the coveralls in the coverage job.
- add step to download all uploaded artifacts
- add step to combine coverage data, create report and fail if not
  enough
- add step to upload html report if coverage is not enough
---
 .github/workflows/tests.yml | 57 ++++++++++++++++++++++++++++++-------
 1 file changed, 46 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 6b95bd21..d55ec841 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -29,12 +29,10 @@ jobs:
         - ["3.10",  "py310"]
         - ["3.11.0-rc.2",  "py311"]
         - ["3.9",   "docs"]
-        - ["3.9",   "coverage"]
         - ["3.9",   "py39-datetime"]
         exclude:
           - { os: windows, config: ["3.9",   "lint"] }
           - { os: windows, config: ["3.9",   "docs"] }
-          - { os: windows, config: ["3.9",   "coverage"] }
 
     runs-on: ${{ matrix.os }}-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
@@ -58,13 +56,50 @@ jobs:
         python -m pip install --upgrade pip
         pip install tox
     - name: Test
-      if: matrix.config[1] != 'coverage'
       run: tox -e ${{ matrix.config[1] }}
-    - name: Coverage
-      if: matrix.config[1] == 'coverage'
-      run: |
-        tox -e py36,py37,py38,py39,py39-datetime,py310,py311,coverage
-        pip install coveralls
-        coveralls --service=github
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Upload coverage artifact
+      uses: actions/upload-artifact@v2
+      if: matrix.os != 'windows'
+      with:
+        name: coverage-data
+        path: .coverage.${{ matrix.config[1] }}
+        if-no-files-found: ignore
+
+  coverage:
+    name: Combined coverage
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-python@v2
+        with:
+          # Use latest, so it understands all syntax.
+          python-version: "3.10"
+      - run: python -m pip install --upgrade coveralls coverage[toml]
+
+      - name: Download coverage data.
+        uses: actions/download-artifact@v2
+        with:
+          name: coverage-data
+
+      - name: Indicate completion to coveralls.io
+        run: |
+          python -m coverage combine
+          coveralls --service=github
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Coverage report and fail if it's <100%.
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          python -m coverage html --skip-covered --skip-empty
+          python -m coverage report --fail-under=100
+
+      - name: Upload HTML report if check failed.
+        uses: actions/upload-artifact@v2
+        with:
+          name: html-report
+          path: htmlcov
+        if: ${{ failure() }}

From ffb1c3f037125780324ac5e2243bc6c940ed9f78 Mon Sep 17 00:00:00 2001
From: Michael Howitz <icemac@gmx.net>
Date: Fri, 7 Aug 2026 09:27:22 +0200
Subject: [PATCH 4/7] Fix the combined coverage report
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `coverage` tox environment now combines the coverage data of all
supported Python versions instead of measuring a single one, and enforces
100% coverage.

Previously the `combined-coverage` environment was supposed to do this, but
it depended on the `coverage` environment and both wrote to `.coverage`, so
its `coverage erase` threw away the data it was meant to combine -- including
the Sphinx doctest coverage, which was measured nowhere else. It also omitted
`py315` from `depends` and hard-coded `--fail-under=100` on the command line,
contradicting the `fail_under` in `pyproject.toml`.

Changes:

- Turn `[testenv:coverage]` into the combining environment via the existing
  `coverage-command` / `coverage-additional` zope.meta options, and drop
  `[testenv:combined-coverage]`. No template changes were needed.
- Add `py315` to `depends`. `depends` orders environments in sequential runs
  too, not just under `tox -p`, so `coverage` runs last regardless of its
  position in the envlist.
- Disable the coverage threshold for the per-version environments: a single
  Python version cannot reach 100%, only the combination can.
- Set `fail_under` to 100 and reach it:
  - add the missing test for an `ast.Expression` body in
    `compile_restricted_function` (`compile.py` lines 179-181),
  - exclude the `typing.overload` stubs in `Limits.py` and the
    `typing.Protocol` stub in `Eval.py`, whose bodies never execute at
    runtime by design.
- Add `relative_files = true` so the data stays portable across machines.

Combined coverage is now 100.00% over py310-py315 plus py311-datetime; a
single version reaches only 99.76%.

CI still measures a single Python version -- moving it to the combined report
needs new zope.meta template support and follows separately.

Based on the analysis in PR #238 by Rudá Porto Filgueiras.
---
 .meta.toml                                | 38 ++++++++++-------------
 CHANGES.rst                               |  6 ++++
 pyproject.toml                            |  3 +-
 src/RestrictedPython/Eval.py              |  2 +-
 src/RestrictedPython/Limits.py            |  6 ++--
 tests/test_compile_restricted_function.py | 35 +++++++++++++++++++++
 tox.ini                                   | 24 +++-----------
 7 files changed, 67 insertions(+), 47 deletions(-)

diff --git a/.meta.toml b/.meta.toml
index 8f865b8c..412e8461 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -17,7 +17,6 @@ with-free-threaded-python = false
 use-flake8 = true
 additional-envlist = [
     "py311-datetime",
-    "combined-coverage",
     ]
 testenv-deps = [
     "datetime: DateTime",
@@ -29,34 +28,29 @@ testenv-setenv = [
     ]
 testenv-commands = [
     "python -V",
-    "pytest --cov=src --cov=tests --cov-report= tests {posargs}",
+    # A single Python version cannot reach the required coverage, only the
+    # combination of all of them can, thus the check is disabled here and
+    # done in the `coverage` environment.
+    "pytest --cov=src --cov=tests --cov-report= --cov-fail-under=0 tests {posargs}",
     ]
-testenv-additional = [
-    "",
-    "[testenv:combined-coverage]",
-    "basepython = python3",
-    "allowlist_externals =",
-    "    mkdir",
-    "deps =",
-    "    coverage",
-    "    -cconstraints.txt",
-    "setenv =",
-    "    COVERAGE_FILE=.coverage",
-    "commands =",
-    "    mkdir -p {toxinidir}/parts/htmlcov",
-    "    coverage erase",
-    "    coverage combine",
-    "    coverage html",
-    "    coverage report -m --fail-under=100",
-    "depends = py310,py311,py311-datetime,py312,py313,py314,coverage",
+coverage-command = [
+    "coverage erase",
+    "coverage combine",
     ]
-coverage-command = "pytest --cov=src --cov=tests --cov-report= tests {posargs}"
 coverage-setenv = [
     "COVERAGE_FILE=.coverage",
     ]
+coverage-additional = [
+    "depends = py310,py311,py311-datetime,py312,py313,py314,py315",
+    ]
 
 [coverage]
-fail-under = 97.1
+fail-under = 100
+
+[coverage-run]
+additional-config = [
+    "relative_files = true",
+    ]
 
 [isort]
 additional-sources = "{toxinidir}/tests"
diff --git a/CHANGES.rst b/CHANGES.rst
index aa7865d6..c05a3bdf 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -4,6 +4,12 @@ Changes
 8.5 (unreleased)
 ----------------
 
+- Fix the combined coverage report: the ``coverage`` tox environment now
+  combines the coverage data of all supported Python versions instead of
+  measuring a single one, and enforces 100 % coverage. The broken
+  ``combined-coverage`` environment has been removed, as it erased the data it
+  was supposed to combine.
+
 
 8.4 (2026-07-10)
 ----------------
diff --git a/pyproject.toml b/pyproject.toml
index 5aa14cbd..1725a195 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -65,9 +65,10 @@ Changelog = "https://github.com/zopefoundation/RestrictedPython/blob/master/CHAN
 [tool.coverage.run]
 branch = true
 source = ["RestrictedPython"]
+relative_files = true
 
 [tool.coverage.report]
-fail_under = 97.1
+fail_under = 100
 precision = 2
 ignore_errors = true
 show_missing = true
diff --git a/src/RestrictedPython/Eval.py b/src/RestrictedPython/Eval.py
index 3eda8067..9bbab258 100644
--- a/src/RestrictedPython/Eval.py
+++ b/src/RestrictedPython/Eval.py
@@ -32,7 +32,7 @@
 
 
 class _GetItem(typing.Protocol[_TK, _TV]):
-    def __getitem__(self, key: _TK) -> _TV: ...
+    def __getitem__(self, key: _TK) -> _TV: ...  # pragma: no cover
 
 
 def default_guarded_getitem(ob: _GetItem[_TK, _TV], index: _TK) -> _TV:
diff --git a/src/RestrictedPython/Limits.py b/src/RestrictedPython/Limits.py
index 4c933ad3..f91ff545 100644
--- a/src/RestrictedPython/Limits.py
+++ b/src/RestrictedPython/Limits.py
@@ -17,16 +17,16 @@
 limited_builtins: dict[str, typing.Any] = {}
 
 
-@typing.overload
+@typing.overload  # pragma: no cover
 def limited_range(iFirst: int) -> collections.abc.Sequence[int]: ...
 
 
-@typing.overload
+@typing.overload  # pragma: no cover
 def limited_range(iStart: int, iEnd: int, /
                   ) -> collections.abc.Sequence[int]: ...
 
 
-@typing.overload
+@typing.overload  # pragma: no cover
 def limited_range(iStart: int, iEnd: int, iStep: int, /
                   ) -> collections.abc.Sequence[int]: ...
 
diff --git a/tests/test_compile_restricted_function.py b/tests/test_compile_restricted_function.py
index b282ad44..6f0c0f05 100644
--- a/tests/test_compile_restricted_function.py
+++ b/tests/test_compile_restricted_function.py
@@ -269,6 +269,41 @@ def test_compile_restricted_function_pre_parse_exec():
     assert hello_world() == 'Hello World!\n'
 
 
+def test_compile_restricted_function_pre_parse_eval():
+    p = ''
+    body = ast.parse('collected.append("Hello World!")', mode="eval")
+    name = "hello_world"
+    global_symbols = []
+
+    result = compile_restricted_function(
+        p,  # parameters
+        body,
+        name,
+        filename='<string>',
+        globalize=global_symbols
+    )
+
+    assert result.code is not None
+    assert result.errors == ()
+
+    collected = []
+    safe_globals = {
+        '__name__': 'script',
+        '_getattr_': getattr,
+        '_print_': PrintCollector,
+        '__builtins__': safe_builtins,
+        'collected': collected,
+    }
+    safe_locals = {}
+    exec(result.code, safe_globals, safe_locals)
+    hello_world = safe_locals['hello_world']
+    assert type(hello_world) is FunctionType
+    # An `ast.Expression` body has no `return` statement, so the function
+    # itself returns `None`, but the expression is evaluated.
+    assert hello_world() is None
+    assert collected == ['Hello World!']
+
+
 def test_compile_restricted_function_pre_parse_single():
     p = ''
     body = ast.parse("""
diff --git a/tox.ini b/tox.ini
index 2cd39fdc..0e557aa9 100644
--- a/tox.ini
+++ b/tox.ini
@@ -14,7 +14,6 @@ envlist =
     docs
     coverage
     py311-datetime
-    combined-coverage
 
 [testenv]
 usedevelop = true
@@ -30,29 +29,12 @@ setenv =
     COVERAGE_FILE=.coverage.{envname}
 commands =
     python -V
-    pytest --cov=src --cov=tests --cov-report= tests {posargs}
+    pytest --cov=src --cov=tests --cov-report= --cov-fail-under=0 tests {posargs}
     sphinx-build -b doctest -d {envdir}/.cache/doctrees docs {envdir}/.cache/doctest
 extras =
     test
     docs
 
-[testenv:combined-coverage]
-basepython = python3
-allowlist_externals =
-    mkdir
-deps =
-    coverage
-    -cconstraints.txt
-setenv =
-    COVERAGE_FILE=.coverage
-commands =
-    mkdir -p {toxinidir}/parts/htmlcov
-    coverage erase
-    coverage combine
-    coverage html
-    coverage report -m --fail-under=100
-depends = py310,py311,py311-datetime,py312,py313,py314,coverage
-
 [testenv:setuptools-latest]
 basepython = python3
 deps =
@@ -111,7 +93,9 @@ setenv =
     COVERAGE_FILE=.coverage
 commands =
     mkdir -p {toxinidir}/parts/htmlcov
-    pytest --cov=src --cov=tests --cov-report= tests {posargs}
+    coverage erase
+    coverage combine
     coverage run -a -m sphinx -b doctest -d {envdir}/.cache/doctrees docs {envdir}/.cache/doctest
     coverage html
     coverage report
+depends = py310,py311,py311-datetime,py312,py313,py314,py315

From 1a9a3c4aabf0a7a21987d4871059477fcd7a03e8 Mon Sep 17 00:00:00 2001
From: Michael Howitz <icemac@gmx.net>
Date: Tue, 11 Aug 2026 09:16:50 +0200
Subject: [PATCH 5/7] Run the test environments in the CI coverage job

The `coverage` environment runs no tests itself, it only combines the
coverage data written by the `py3*` environments. In CI each matrix entry
is its own runner, so the `coverage` job found no `.coverage.py3*` files
and `coverage combine` failed with "No data to combine".

Its job now runs the whole `envlist` minus the environments that
contribute no coverage data (`lint`, `docs`, `release-check`), via the
`test-commands` option of the zope.meta template. Spelling it as a
blocklist keeps the list of Python versions out of the workflow.

Contrary to what #238 states, no zope.meta template change was needed.
---
 .github/workflows/tests.yml |  3 ++-
 .meta.toml                  | 10 ++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 6bfe7130..5e27f6bd 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -57,7 +57,8 @@ jobs:
         python-version: ${{ matrix.config[0] }}
         github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Test
-      run: uvx --with tox-uv tox -e ${{ matrix.config[1] }}
+      run: |
+        uvx --with tox-uv tox ${{ matrix.config[1] == 'coverage' && '--skip-env "(lint|docs|release-check)"' || format('-e {0}', matrix.config[1]) }}
     - name: Coverage
       if: matrix.config[1] == 'coverage'
       run: |
diff --git a/.meta.toml b/.meta.toml
index 412e8461..5d235fb1 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -83,6 +83,16 @@ additional-ignores = [
 additional-config = [
     "- [\"3.11\", \"py311-datetime\"]",
     ]
+# The `coverage` environment runs no tests itself, it only combines the
+# coverage data written by the `py3*` environments. In CI each of those runs
+# on its own machine, so the `coverage` job finds nothing to combine and
+# fails. It therefore has to run the whole `envlist` minus the environments
+# that contribute no coverage data. Spelling it that way round avoids
+# repeating the list of Python versions here: `envlist` and the `depends` of
+# the `coverage` environment stay its only source.
+test-commands = [
+    "uvx --with tox-uv tox ${{ matrix.config[1] == 'coverage' && '--skip-env \"(lint|docs|release-check)\"' || format('-e {0}', matrix.config[1]) }}",
+    ]
 
 [pypi]
 trusted-publishing = true

From cbb49a9362c0c4a3da12815c6f19518b907d743d Mon Sep 17 00:00:00 2001
From: Michael Howitz <icemac@gmx.net>
Date: Wed, 12 Aug 2026 09:12:04 +0200
Subject: [PATCH 6/7] Configuring for pure-python

---
 .github/workflows/pre-commit.yml |  2 +-
 .github/workflows/tests.yml      |  9 ++++++---
 .meta.toml                       | 31 ++-----------------------------
 .pre-commit-config.yaml          |  5 -----
 pyproject.toml                   |  3 +++
 tox.ini                          |  2 +-
 6 files changed, 13 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index e5fe2f27..961588e2 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
-    - uses: actions/setup-python@v6
+    - uses: actions/setup-python@v7
       with:
         python-version: '3.13'
     - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  #v3.0.1
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 5e27f6bd..f39024bf 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -47,8 +47,8 @@ jobs:
       with:
         persist-credentials: false
     - name: Install uv + caching
-      # astral/setup-uv@8.2.0
-      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+      # astral/setup-uv@9.0.0
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9
       with:
         enable-cache: true
         cache-dependency-glob: |
@@ -57,8 +57,11 @@ jobs:
         python-version: ${{ matrix.config[0] }}
         github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Test
+      # The `coverage` environment combines the data written by the test
+      # environments, so it has to run them: each job gets its own machine
+      # and there would be nothing to combine otherwise.
       run: |
-        uvx --with tox-uv tox ${{ matrix.config[1] == 'coverage' && '--skip-env "(lint|docs|release-check)"' || format('-e {0}', matrix.config[1]) }}
+        uvx --with tox-uv tox ${{ matrix.config[1] == 'coverage' && '--skip-env "(docs|lint|release-check)"' || format('-e {0}', matrix.config[1]) }}
     - name: Coverage
       if: matrix.config[1] == 'coverage'
       run: |
diff --git a/.meta.toml b/.meta.toml
index 5d235fb1..d65d95fd 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -2,7 +2,7 @@
 # https://github.com/zopefoundation/meta/tree/master/src/zope/meta/pure-python
 [meta]
 template = "pure-python"
-commit-id = "6603f967"
+commit-id = "abd316d0"
 
 [python]
 with-pypy = false
@@ -23,9 +23,6 @@ testenv-deps = [
     "-cconstraints.txt",
     "pytest-cov",
     ]
-testenv-setenv = [
-    "COVERAGE_FILE=.coverage.{envname}",
-    ]
 testenv-commands = [
     "python -V",
     # A single Python version cannot reach the required coverage, only the
@@ -33,24 +30,10 @@ testenv-commands = [
     # done in the `coverage` environment.
     "pytest --cov=src --cov=tests --cov-report= --cov-fail-under=0 tests {posargs}",
     ]
-coverage-command = [
-    "coverage erase",
-    "coverage combine",
-    ]
-coverage-setenv = [
-    "COVERAGE_FILE=.coverage",
-    ]
-coverage-additional = [
-    "depends = py310,py311,py311-datetime,py312,py313,py314,py315",
-    ]
 
 [coverage]
 fail-under = 100
-
-[coverage-run]
-additional-config = [
-    "relative_files = true",
-    ]
+combine = true
 
 [isort]
 additional-sources = "{toxinidir}/tests"
@@ -83,16 +66,6 @@ additional-ignores = [
 additional-config = [
     "- [\"3.11\", \"py311-datetime\"]",
     ]
-# The `coverage` environment runs no tests itself, it only combines the
-# coverage data written by the `py3*` environments. In CI each of those runs
-# on its own machine, so the `coverage` job finds nothing to combine and
-# fails. It therefore has to run the whole `envlist` minus the environments
-# that contribute no coverage data. Spelling it that way round avoids
-# repeating the list of Python versions here: `envlist` and the `depends` of
-# the `coverage` environment stay its only source.
-test-commands = [
-    "uvx --with tox-uv tox ${{ matrix.config[1] == 'coverage' && '--skip-env \"(lint|docs|release-check)\"' || format('-e {0}', matrix.config[1]) }}",
-    ]
 
 [pypi]
 trusted-publishing = true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ec5b0d50..d2d50290 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -27,8 +27,3 @@ repos:
     - id: flake8
       additional_dependencies:
         - flake8-debugger == 4.1.2
-  - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v2.1.0
-    hooks:
-      - id: mypy
-        pass_filenames: false
diff --git a/pyproject.toml b/pyproject.toml
index 1725a195..a37a3522 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -90,6 +90,7 @@ directory = "parts/htmlcov"
 readme = {file = ["README.rst", "CHANGES.rst"]}
 
 
+
 [tool.mypy]
 mypy_path = "src"
 packages = ["RestrictedPython"]
@@ -112,6 +113,8 @@ module = ["RestrictedPython.transformer"]
 warn_no_return = false
 
 
+
 [tool.zest-releaser]
 create-wheel = false
+extra-message = ""
 upload-pypi = false
diff --git a/tox.ini b/tox.ini
index 0e557aa9..1a427325 100644
--- a/tox.ini
+++ b/tox.ini
@@ -98,4 +98,4 @@ commands =
     coverage run -a -m sphinx -b doctest -d {envdir}/.cache/doctrees docs {envdir}/.cache/doctest
     coverage html
     coverage report
-depends = py310,py311,py311-datetime,py312,py313,py314,py315
+depends = py310,py311,py312,py313,py314,py315,py311-datetime

From e06c3f07d713ed8fffd48a8c973947eb45aa781e Mon Sep 17 00:00:00 2001
From: Michael Howitz <icemac@gmx.net>
Date: Thu, 13 Aug 2026 08:32:28 +0200
Subject: [PATCH 7/7] Undo mypy delete.

---
 .pre-commit-config.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d2d50290..ec5b0d50 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -27,3 +27,8 @@ repos:
     - id: flake8
       additional_dependencies:
         - flake8-debugger == 4.1.2
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: v2.1.0
+    hooks:
+      - id: mypy
+        pass_filenames: false