Bump build from 1.3.0 to 1.4.0

[dependabot]

Bumps build from 1.3.0 to 1.4.0.

Release notes

Sourced from build's releases.

1.4.0

• Add --quiet flag (PR #947)
• Add option to dump PEP 517 metadata with --metadata (PR #940, PR #943)
• Support UV environment variable (PR #971)
• Remove a workaround for 3.14b1 (PR #960)
• In 3.14 final release, color defaults to True already (PR #962)
• Pass sp-repo-review (PR #942)
• In pytest configuration, log_level is better than log_cli_level (PR #950)
• Split up typing and mypy (PR #944)
• Use types-colorama (PR #945)
• In docs, first argument for _has_dependency is a name (PR #970)
• Fix test failure when flit-core is installed (PR #921)

Changelog

Sourced from build's changelog.

1.4.0 (2026-01-08)

• Add --quiet flag (:pr:947)
• Add option to dump PEP 517 metadata with --metadata (:pr:940, :pr:943)
• Support UV environment variable (:pr:971)
• Remove a workaround for 3.14b1 (:pr:960)
• In 3.14 final release, color defaults to True already (:pr:962)
• Pass sp-repo-review (:pr:942)
• In pytest configuration, log_level is better than log_cli_level (:pr:950)
• Split up typing and mypy (:pr:944)
• Use types-colorama (:pr:945)
• In docs, first argument for _has_dependency is a name (PR :pr:970)
• Fix test failure when flit-core is installed (PR :pr:921)

Commits

• 54f238d chore: prepare for 1.4.0 (#972)
• f219276 docs: first argument for _has_dependency is a name (#970)
• 7adb29e fix: support UV environment variable (#971)
• a40623b build(deps): bump actions/attest-build-provenance in the actions group (#968)
• c8fae34 pre-commit: bump repositories (#965)
• ed9c379 build(deps): bump actions/download-artifact in the actions group
• 0e44fd2 Add quiet flag (#947)
• 60e15ed chore: color defaults to True in 3.14 (#962)
• 0486d9d pre-commit: bump repositories (#961)
• 393b775 MNT: remove workaround for 3.14b1 (#960)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

Code Review Analysis

Analyzing the pull request diff against the checklist:

Summary

This PR updates the build package dependency from version 1.3.0 to 1.4.0 in the development dependencies.

---

Code Quality

✅ Code follows style guide

• This is a dependency version update in pyproject.toml - no code style issues apply.

✅ No commented-out code

• No commented-out code present.

✅ Meaningful variable names

• N/A - This is a dependency version update.

✅ DRY principle followed

• N/A - This is a dependency version update.

✅ Identify Defects

• No defects identified. The change is a minor version bump of the build package (1.3.0 → 1.4.0).
• This is in the development dependency group, so it won't affect production code.
• No logic errors, edge cases, or security vulnerabilities introduced.

✅ Project memory configuration

• No .claude/CLAUDE.md file found in the repository, so this criterion is not applicable.

---

Testing

⚠️ Unit tests for new functions

• N/A - No new functions added. This is a dependency update.

⚠️ Integration tests for new endpoints

• N/A - No new endpoints added.

⚠️ Edge cases covered

• N/A - No new functionality to test.

⚠️ Test coverage > 80%

• N/A - No code changes that would affect test coverage. The dependency update itself doesn't require additional test coverage.

---

Documentation

✅ Readme updated if needed

• No README update needed for a development dependency version bump.

✅ API docs updated

• N/A - No API changes.

✅ Inline comments for complex logic

• N/A - No code logic changes.

❌ CHANGELOG.md updated

• pyproject.toml:39 - The CHANGELOG.md should be updated to document this dependency version change.
• Even minor dependency updates in development dependencies should be tracked for transparency and reproducibility.

✅ Markdown formatting

• No markdown files modified in this PR.

---

Security

✅ No hardcoded credentials

• No credentials present.

✅ Input validation implemented

• N/A - No input handling code added.

✅ Proper error handling

• N/A - No error handling code added.

✅ No sensitive data in logs

• N/A - No logging code added.

✅ No license files (.lic) or AQAAAD strings

• No license files or suspicious strings found in the diff.

---

Overall Assessment

Status: ✅ Approved with Minor Recommendation

This is a straightforward dependency update that poses minimal risk. The only recommendation is to update the CHANGELOG.md to document this change for better dependency management tracking.

Recommendation:

• Consider adding an entry to CHANGELOG.md documenting the build package update from 1.3.0 to 1.4.0.

---

Automated code review analyzing defects and coding standards