chore(deps): bump scons from 4.11.0 to 4.11.1

[dependabot]

Bumps scons from 4.11.0 to 4.11.1.

Release notes

Sourced from scons's releases.

4.11.1

A new SCons release, 4.11.1, is now available on the SCons download page:

https://scons.org/pages/download.html

Here is a summary of the changes since 4.11.0:

FIXES

• Revert the change to the internal implementation of reading a saved-Variables file. This also undoes the minor API change made when the change was introduced in SCons 4.11.0: in that release is was possible to use a top-relative path in the Variables() call when giving the name of a file (that is, a path that begins with #). This is once again disallowed. The plan is to reintroduce this change in a future release, once the issues are fully resolved.

Thanks to the following contributors listed below for their contributions to this release.

.. code-block:: text

git shortlog --no-merges -ns 4.11.0..HEAD
6  William Deegan
1  Mats Wichmann

Changelog

Sourced from scons's changelog.

             SCons - a software construction tool
                    Change Log

NOTE: The 4.0.0 release of SCons dropped Python 2.7 support. Use 3.1.2 if Python 2.7 support is required (but note old SCons releases are unsupported). NOTE: Since SCons 4.3.0, Python 3.6.0 or above is required. NOTE: Since SCons 4.9.0, Python 3.7.0 or above is required. NOTE: The last release to support Python 3.7 or Python 3.8 is 4.11.1

RELEASE VERSION/DATE TO BE FILLED IN LATER

From Thaddeus Crews: - ty: Initial support setup within pyproject.toml. - Removed Python 3.7 & 3.8 support.

From Mats Wichmann: - Reference manual improvements: * Additional clarification for SideEffect()

RELEASE 4.11.1 - Mon, 26 Aug 2026 21:16:00 -0700

From Mats Wichmann: - Undo, for now, the 4.11.0 change (from PR 4875) to read a saved-Variables file using a File node. There were unanticipated side effects not caught by any existing test. Will be reintroduced when the issues can be resolved cleanly without backwards compatibility concerns.

RELEASE 4.11.0 - Mon, 10 Aug 2026 21:16:00 -0700

From Joseph Brill: - Add possible build failure when targeting 32-bit arm using Visual Studio 2022 with Windows SDK version 10.0.26100.0 or later installed to the known issues in SCons/Tool/MSCommon/README.rst. - MSVC: Added a host/target batch file configuration table for Visual Studio 2026. Visual Studio 2026 removed support for 32-bit arm targets.

From Thaddeus Crews: - Purge vim/emac local variable bloat. - Implement type hints for Node subclasses. - Ruff: Handle F401 exclusions more granularly, remove per-file exclusions. - Simplified and sped up compilation database generation. No longer requires each entry to have a dedicated node that's always built; instead, the database itself is set to always build. - Implement type hints for Environment and environment utilities.

... (truncated)

Commits

• 81e9e1a Release 4.11.1
• b97f32b Regenerated docs for 4.11.1 release.
• 3523a98 skip bin from version string updates
• 2993b26 restore NEXT_RELEASE and PREVIOUS_RELEASE to template/RELEASE.txt
• fa7def6 Merge branch 'master' of github.com:SCons/scons
• 8f9341c [ci skip] add tools for release to replace NEXT_RELEASE and PREVIOUS_RELEASE ...
• c134f8d Merge pull request #4895 from mwichmann/undo-varfile
• efa7ab5 Revert a breaking change to Variables()
• 2e04de0 post release updates
• 9cdefde post release updates
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

LGTM, straightforward dependency version bump.

What was reviewed: the uv.lock diff, confirming it is limited to the scons package entry (version, sdist URL/hash, wheel URL/hash) bumping 4.11.0 to 4.11.1 — no other packages, source files, or configuration were touched. The upstream release is a minor patch reverting a Variables() file-reading change from 4.11.0, with no security implications, and scons is only used optionally via pystatacons for just stata-build/stata-data/stata-analysis.

Extended reasoning...

Overview

The only change in this PR is a version bump of the scons package in uv.lock, from 4.11.0 to 4.11.1, updating the pinned sdist/wheel download URLs and their sha256 hashes. No Python source, Stata scripts, Justfile targets, or CLAUDE.md configuration were modified.

Security risks

None identified. The hashes in the lockfile correctly correspond to the new version's artifacts as published on PyPI (this is a standard dependabot-generated bump), and no code execution paths, credentials, or PII-related logic are touched. Scons itself is only invoked via optional dependency-tracked build commands (just stata-build, etc.) and is not part of the core Stata pipeline.

Level of scrutiny

This warrants minimal scrutiny — it is the textbook case of a safe, automated dependency update: a single-package patch version bump in a lockfile, generated by dependabot, with a scoped and well-documented upstream changelog (a revert of a problematic change from the prior release, reducing risk further).

Other factors

The PR is small, self-contained, mechanical, and matches the repository's stated dependency management workflow (uv.lock regenerated via standard tooling). No CODEOWNERS restriction applies to lockfiles here, and there is no outstanding reviewer feedback to address.