build(deps): bump pdm from 2.29.0 to 2.29.1

[dependabot]

Bumps pdm from 2.29.0 to 2.29.1.

Release notes

Sourced from pdm's releases.

v2.29.1

Features & Improvements

• Explain missing lockfile groups and provide group-selection recovery guidance when installing, syncing, or updating groups. (#2682)
• Allow package-specific overrides for exclude-newer resolution limits. (#3809)

Bug Fixes

• Keep the separating comma out of the operator and accept a v prefix when converting Poetry version constraints. (#3860)
• Escape glob characters in the virtualenv lookup prefix, so a project whose directory name contains [ or ] can find its own virtualenv. (#3869)
• Write pyproject.toml and lockfiles atomically to prevent interrupted writes from truncating them. (#3870)
• Resolve the workspace root before making member paths relative, so a root given as a relative path or reached through a symlink no longer raises ValueError. (#3874)
• Replace the destination of an atomic write instead of unlinking it first, so an interrupted write can no longer destroy pyproject.toml or the lockfile. (#3878)
• Report the version part that could not be read, instead of blaming a postrelease for every parse failure. (#3880)
• Keep quoted local paths that contain - when parsing requirements files. (#3885)

Documentation

• Clarify dependency command effects on project declarations, lock metadata, and installed packages in the guide and CLI help. (#2681)

Changelog

Sourced from pdm's changelog.

Release v2.29.1 (2026-09-14)

Features & Improvements

• Explain missing lockfile groups and provide group-selection recovery guidance when installing, syncing, or updating groups. (#2682)
• Allow package-specific overrides for exclude-newer resolution limits. (#3809)

Bug Fixes

• Keep the separating comma out of the operator and accept a v prefix when converting Poetry version constraints. (#3860)
• Escape glob characters in the virtualenv lookup prefix, so a project whose directory name contains [ or ] can find its own virtualenv. (#3869)
• Write pyproject.toml and lockfiles atomically to prevent interrupted writes from truncating them. (#3870)
• Resolve the workspace root before making member paths relative, so a root given as a relative path or reached through a symlink no longer raises ValueError. (#3874)
• Replace the destination of an atomic write instead of unlinking it first, so an interrupted write can no longer destroy pyproject.toml or the lockfile. (#3878)
• Report the version part that could not be read, instead of blaming a postrelease for every parse failure. (#3880)
• Keep quoted local paths that contain - when parsing requirements files. (#3885)

Documentation

• Clarify dependency command effects on project declarations, lock metadata, and installed packages in the guide and CLI help. (#2681)

Commits

• 18f84f8 chore: Release 2.29.1
• 924c6d1 feat(cli): explain recovery for groups missing from lockfile (#3886)
• b4666eb fix(formats): keep quoted local paths containing space-dash (#3885)
• f7b622f docs: clarify dependency command state changes (#3882)
• 2ce2127 fix(utils): replace the destination atomically instead of unlinking it (#3878)
• dea18eb fix(versions): name the version part that could not be read (#3881)
• e49caf0 fix(formats): parse multi-constraint and v-prefixed Poetry versions (#3876)
• e9d65f0 fix(workspace): resolve the root before making member paths relative (#3874)
• 63d359a chore(deps): bump astral-sh/setup-uv in the actions group (#3873)
• d1accaa chore(news): add the missing news fragment for #3869 (#3872)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)