Update version of dependency-groups to v1.3.1

[sirosen]

This is a bugfix release of dependency-groups which resolves #13372

---

I assume no further changes are needed, and that the upstream testing for the bug surfaced in #13372 is sufficient.
Please let me know if the news entry isn't quite right -- I wasn't sure if I should include a bugfix entry as well.

[notatallshaw]

Typically the vendor news entry just includes the vendorong version information.

You can add an extra bug fix news entry to call out the specific bug fix.

[sirosen]

I updated the vendor entry to match what I see in NEWS.rst. For the bugfix, I described it in terms of what a user of pip will see, to the best of my ability.

[pfmoore]

I assume no further changes are needed, and that the upstream testing for the bug surfaced in #13372 is sufficient.

Do we have any evidence that this fixes #13372? I don't see anything in that issue suggesting that the user has tested with an updated copy of pip, and this PR doesn't include any tests in the dependency-groups package.

The fix looks simple enough, so I'm not against taking it on trust, but if we can demonstrate that it fixes the reported issue that would be great. (To be clear, though, there's not much time if we want to get 25.1.1 into Python 3.14b1).

[sirosen]

this PR doesn't include any tests in the dependency-groups package.

I wasn't sure if I should add tests in pip? I added this test in dependency-groups as part of developing the fix itself.

I tested manually against the case in #13372, with a slight modification (because the empty requirements list made it hard to verify):

$ cat /tmp/pyproject.toml 
[dependency-groups]
foo_bar = ['vendoring']
eggs = [{ include-group = 'foo_bar' }]

$ pip install --group /tmp/pyproject.toml:eggs   
Collecting vendoring
  Using cached vendoring-1.2.0-py2.py3-none-any.whl.metadata (2.5 kB)
... # snipped lots of output
Successfully installed vendoring-1.2.0

I'm happy to add a test case to the pip testsuite, but I think the upstream test should be sufficient.

[pfmoore]

Thanks. That looks fine to me. No, this doesn't need tests in pip itself. Sorry, I was being dense - I was looking at the vendored copy, not the project source (which is where the upstream tests would be).