Accept positional source and keyword overrides in Box.update - #342

Bug

Box.update() rejects a valid positional source together with keyword overrides:

from box import Box

config = Box(timeout=10)
config.update({"timeout": 20}, timeout=30)
assert config.timeout == 30

The current call raises BoxTypeError: update expected at most 1 argument, got 2 because the arity guard counts the keyword argument set as another positional source. This patch counts only positional sources. The existing update loops already apply source values before keyword values, preserving the expected override order. It also adds regressions, an unreleased changelog entry, and contributor credit.

Validation

• New regression against the base: 4 failed, 3 controls passed in both pure-Python and compiled Cython modes.
• Patched regression: 7 passed in both modes.
• Full suite: 166 passed in both pure-Python and compiled Cython modes (base: 159 passed).
• Black, mypy, and git diff --check: passed.

Validation ran on macOS with Python 3.12.15; the other supported interpreter/platform and wheel matrix remains for CI.

AI assistance was used to prepare the implementation and regression tests.