build(deps): bump the uv-version-updates group across 1 directory with 6 updates

[dependabot]

Bumps the uv-version-updates group with 6 updates in the / directory:

Package	From	To
click	8.4.2	8.5.0
tqdm	4.70.0	4.70.1
pyinstaller	6.22.2	6.22.3
ruff	0.16.4	0.16.7
anyio	4.14.2	4.15.1
wcwidth	0.8.2	0.8.3

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits

• 8b19813 Release version 8.5.0
• 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
• 131c86a Add FAQ entry about UnicodeEncodeError on Windows
• e1fd594 Add support of pathlib.Path to edit (#3781)
• a1d8785 Add support of pathlib.Path to edit
• 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
• a6256bf Forwards all user's parameters set in PAGER
• 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
• 9835b0f Resolve the pager command once, in _pager_contextmanager
• f36d58b Refactor pager stream handling (#3767)
• Additional commits viewable in compare view

Updates tqdm from 4.70.0 to 4.70.1

Release notes

Sourced from tqdm's releases.

tqdm v4.70.1 stable

• contrib.concurrent: fix no-len iterables (#1830 <- #1828)
• tests: major overhaul (#1819)
• update AI policy in PR template
• misc lint & tidy
• CI: bump workflow actions & pre-commit hooks

Commits

• 9cf5a12 Merge pull request #1830 from eaubin/master
• 24b9e1e misc tidy
• 2a9e4e8 contrib.concurrent: fix no-len iterables
• 8d6ff8d Merge pull request #1819 from tqdm/devel
• bed3796 tests: major overhaul
• 4d3d319 AI policy
• 5dcb022 minor syntax update
• 309effe tests: pre-commit coverage
• 604193a tests: slight tidy
• 17f1cac CI: bump workflow actions
• See full diff in compare view

Updates pyinstaller from 6.22.2 to 6.22.3

Release notes

Sourced from pyinstaller's releases.

v6.22.3

Please see the v6.22.3 section of the changelog for a list of the changes since v6.22.2.

Changelog

Sourced from pyinstaller's changelog.

6.22.3 (2026-09-12)

Bugfix

* (Windows) Revise earlier fix for :issue:`9508` to avoid breaking
  executables located on ImDisk RAMDISK volumes. (:issue:`9510`)
* Compare the icon file suffix case-insensitively, so an icon named with an
  upper-case suffix such as ``MyApp.ICO`` is recognised as already being in the
  right format instead of being rejected or silently re-encoded.
  (:issue:`9521`)
* Fix ``onefile`` parent-process validation to allow intermixed nested
  sub-processes. (:issue:`9513`)
Bootloader

• (POSIX) Enable onefile parent-process validation for POSIX executables that have setgid bit set, and for Linux executables that have file capabilities set (i.e., have a security.capability extended file attribute). (:issue:9524)
• (POSIX) Revise the validation of owner and permissions of onedir application's contents directory when the executable has either setuid or setgid bit set. If setuid bit is set, the owner ID of the application's contents directory must match the owner ID of the executable itself, and only owner is allowed to have write permissions on the directory. If setgid bit is set, the group ID of the application's contents directory must match the group ID of the executable itself, and only owner and the group are allowed to have write permissions on the directory. (:issue:9524)
• Limit onefile parent-process validation only to executables that are running with elevated privileges while inheriting environment variables set by unprivileged user. On POSIX systems, this corresponds to executables with setuid bit set, while on Windows, it corresponds to UAC-elevated processes (running with TokenElevationTypeFull token). (:issue:9520)

Commits

• ecd7993 Release v6.22.3. [skip ci]
• 8807296 doc: update documentation section on onefile/onedir security verification
• bda6110 bootloader: security: improve owner/permissions check in onedir mode
• e3fc240 bootloader: security: add detection of file capabilities on linux
• 3d73d32 bootloader: security: enable security checks for setgid executables
• 10c62c5 bootloader: security: make early-error message a bit more generic
• 1919af1 Tests: Requirements: Scheduled weekly dependency update for week 36 (#9522)
• 77907b5 doc: update documentation section on onefile security verification
• a36324b ci: freebsd: mount /proc
• 012e150 tests: security: adjust for platforms without parent-process verification
• Additional commits viewable in compare view

Updates ruff from 0.16.4 to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879

... (truncated)

Commits

• b5dba86 Bump version to 0.16.7 (#28496)
• 5992d05 Install rustfmt before linting releases (#28495)
• 1713a1f ensure prepare release changes pass prek (#28488)
• 18cdbb4 use scoped token for release workflow (#28484)
• c3813a5 add a workflow for preparing releases (#28486)
• 00948c0 Remove the "Who’s Using Ruff?" list (#28455)
• 86a2eba [pyupgrade] Stop recommending removed typing.no_type_check_decorator (`UP...
• 609e184 Stop defining __cached__ for Python 3.15 (#28476)
• 859ff2f [ty] Track symlinked directory status in listings (#28482)
• 77f6538 Use paid GitHub-hosted runners for Linux (#28478)
• Additional commits viewable in compare view

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

• Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

• Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

  • follow_symlinks on exists() (Python 3.12+)
  • follow_symlinks on is_dir() (Python 3.13+)
  • follow_symlinks on is_file() (Python 3.13+)
  • follow_symlinks on owner() (Python 3.13+)
  • follow_symlinks on group() (Python 3.13+)
  • newline on read_text() (Python 3.13+)

  (#1286, #1293; PR by @​jaideeppyne)

• Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

• Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

• Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

• Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

• Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

• Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

• Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

• Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

• Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

• Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

• Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

• Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

• Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

• Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

• Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

• Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

• Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

• Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits

• ffcd154 Bumped up the version
• 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• Additional commits viewable in compare view

Updates wcwidth from 0.8.2 to 0.8.3

Release notes

Sourced from wcwidth's releases.

0.8.3

What's Changed

• Fix hang wrapping OSC-8 hyperlinks with wide graphemes by @​jquast in jquast/wcwidth#232
• bugfix: clip() should behave like propagate_sgr() by @​jquast in jquast/wcwidth#235
• add twine_check to "tox -e lint" and CI by @​jquast in jquast/wcwidth#236

Full Changelog: jquast/wcwidth@0.8.2...0.8.3

Changelog

Sourced from wcwidth's changelog.

0.8.3 2026-08-28

• Bugfix Do not hang on wrap()_ calls of width 1 with text containing OSC8 hyperlinks and wide characters, PR [#231](https://github.com/jquast/wcwidth/issues/231)_.
• Bugfix clip()_ with propagate_sgr=True, should match behavior of propagate_sgr(), PR [#235](https://github.com/jquast/wcwidth/issues/235).

Commits

• 17986f5 add twine_check to "tox -e lint" and CI (#236)
• cf17c98 Do not suggest the bin/ tools
• 8364c23 bugfix: clip() should behave like propagate_sgr() (#235)
• 551710e remove errant date, not yet released
• 79287df Fix hang wrapping OSC-8 hyperlinks with wide graphemes (#232)
• 614156b Note about VS15 in the specification is contested
• 5a71d7d nit punct
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions