Visitar URL original
Update Mend: high confidence minor and patch dependency updates by mend-for-github-com[bot] · Pull Request #189 · snowdensb/domain-manager-api · GitHub
Skip to content

Update Mend: high confidence minor and patch dependency updates - #189

Open
mend-for-github-com[bot] wants to merge 1 commit into
developfrom
whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates
Open

mend-for-github-com[bot] wants to merge 1 commit into
developfrom
whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates

Conversation

@mend-for-github-com

@mend-for-github-com mend-for-github-com Bot commented Dec 19, 2024 •

Copy link
Copy Markdown

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
MarkupSafe (changelog) ==2.0.1 → ==2.1.5 age adoption passing confidence
PyNaCl ==1.4.0 → ==1.6.2 age adoption passing confidence
appnope ==0.1.2 → ==0.1.4 age adoption passing confidence
attrs (changelog) ==21.2.0 → ==21.4.0 age adoption passing confidence
bcrypt ==3.2.0 → ==3.2.2 age adoption passing confidence
beautifulsoup4 (changelog) ==4.9.3 → ==4.15.0 age adoption passing confidence
cffi (changelog) ==1.14.5 → ==1.17.1 age adoption passing confidence
cfgv ==3.3.0 → ==3.5.0 age adoption passing confidence
click (changelog) ==8.0.1 → ==8.5.1 age adoption passing confidence
decorator ==5.0.9 → ==5.3.1 age adoption passing confidence
distlib ==0.3.2 → ==0.4.4 age adoption passing confidence
ecdsa ==0.17.0 → ==0.19.2 age adoption passing confidence
filelock (changelog) ==3.0.12 → ==3.32.7 age adoption passing confidence
identify ==2.2.10 → ==2.6.20 age adoption passing confidence
ipdb ==0.13.9 → ==0.13.13 age adoption passing confidence
itsdangerous (changelog) ==2.0.1 → ==2.2.0 age adoption passing confidence
jedi ==0.18.0 → ==0.20.1 age adoption passing confidence
matplotlib-inline ==0.1.2 → ==0.2.2 age adoption passing confidence
mypy-extensions ==0.4.3 → ==0.4.4 age adoption passing confidence
nodeenv ==1.6.0 → ==1.12.0 age adoption passing confidence
paramiko (changelog) ==2.7.2 → ==2.12.0 age adoption passing confidence
parso ==0.8.2 → ==0.8.7 age adoption passing confidence
pathspec (changelog) ==0.9.0 → ==0.12.1 age adoption passing confidence
pexpect (source, changelog) ==4.8.0 → ==4.9.0 age adoption passing confidence
prompt-toolkit ==3.0.18 → ==3.0.53 age adoption passing confidence
py ==1.10.0 → ==1.11.0 age adoption passing confidence
pycparser ==2.20 → ==2.23 age adoption passing confidence
python-dateutil ==2.8.2 → ==2.9.0.post0 age adoption passing confidence
regex ==2021.4.4 → ==2021.11.10 age adoption passing confidence
rsa ==4.7.2 → ==4.9.1 age adoption passing confidence
six ==1.16.0 → ==1.17.0 age adoption passing confidence
sshtunnel ==0.4.0 → ==0.5.1 age adoption passing confidence
traitlets ==5.0.5 → ==5.16.1 age adoption passing confidence
typed-ast ==1.4.3 → ==1.5.5 age adoption passing confidence
typing-extensions (changelog) ==3.10.0.0 → ==3.10.0.2 age adoption passing confidence
undetected-chromedriver ==3.0.1 → ==3.5.5 age adoption passing confidence
validators (changelog) ==0.18.2 → ==0.36.0 age adoption passing confidence
wcwidth ==0.2.5 → ==0.9.4 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

pallets/markupsafe (MarkupSafe)

v2.1.5

Compare Source

Released 2024-02-02

  • Fix striptags not collapsing spaces. :issue:417

v2.1.4

Compare Source

Released 2024-01-19

  • Don't use regular expressions for striptags, avoiding a performance
    issue. :pr:413

v2.1.3

Compare Source

Released 2023-06-02

  • Implement format_map, casefold, removeprefix, and removesuffix
    methods. :issue:370
  • Fix static typing for basic str methods on Markup. :issue:358
  • Use Self for annotating return types. :pr:379

v2.1.2

Compare Source

Released 2023-01-17

  • Fix striptags not stripping tags containing newlines.
    :issue:310

v2.1.1

Compare Source

Released 2022-03-14

  • Avoid ambiguous regex matches in striptags. :pr:293

v2.1.0

Compare Source

Released 2022-02-17

  • Drop support for Python 3.6. :pr:262
  • Remove soft_unicode, which was previously deprecated. Use
    soft_str instead. :pr:261
  • Raise error on missing single placeholder during string
    interpolation. :issue:225
  • Disable speedups module for GraalPython. :issue:277
pyca/pynacl (PyNaCl)

v1.6.2

Compare Source

  • Updated libsodium to 1.0.20-stable (2025-12-31 build) to resolve
    CVE-2025-69277.

v1.6.1

Compare Source

  • The MAKE environment variable can now be used to specify the make
    binary that should be used in the build process.

v1.6.0

Compare Source

  • BACKWARDS INCOMPATIBLE: Removed support for Python 3.6 and 3.7.
  • Added support for the low level AEAD AES bindings.
  • Added support for crypto_core_ed25519_from_uniform.
  • Update libsodium to 1.0.20-stable (2025-08-27 build).
  • Added support for free-threaded Python 3.14.
  • Added support for Windows on ARM wheels.

v1.5.0

Compare Source

  • BACKWARDS INCOMPATIBLE: Removed support for Python 2.7 and Python 3.5.
  • BACKWARDS INCOMPATIBLE: We no longer distribute manylinux1
    wheels.
  • Added manylinux2014, manylinux_2_24, musllinux, and macOS
    universal2 wheels (the latter supports macOS arm64).
  • Update libsodium to 1.0.18-stable (July 25, 2021 release).
  • Add inline type hints.
minrk/appnope (appnope)

v0.1.4

Compare Source

v0.1.3

Compare Source

python-attrs/attrs (attrs)

v21.4.0

Compare Source

Changes
  • Fixed the test suite on PyPy3.8 where cloudpickle does not work.
    #​892
  • Fixed coverage report for projects that use attrs and don't set a --source.
    #​895,
    #​896

v21.3.0

Compare Source

Backward-incompatible Changes
  • When using @define, converters are now run by default when setting an attribute on an instance -- additionally to validators.
    Meaning: the new default is on_setattr=[attrs.setters.convert, attrs.setters.validate].

    This is unfortunately a breaking change, but it was an oversight, impossible to raise a DeprecationWarning about, and it's better to fix it now while the APIs are very fresh with few users.
    #​835,
    #​886

  • import attrs has finally landed!
    As of this release, you can finally import attrs using its proper name.

    Not all names from the attr namespace have been transferred; most notably attr.s and attr.ib are missing.
    See attrs.define and attrs.field if you haven't seen our next-generation APIs yet.
    A more elaborate explanation can be found On The Core API Names

    This feature is at least for one release provisional.
    We don't plan on changing anything, but such a big change is unlikely to go perfectly on the first strike.

    The API docs have been mostly updated, but it will be an ongoing effort to change everything to the new APIs.
    Please note that we have not moved -- or even removed -- anything from attr!

    Please do report any bugs or documentation inconsistencies!
    #​887

Changes
  • attr.asdict(retain_collection_types=False) (default) dumps collection-esque keys as tuples.
    #​646,
    #​888
  • __match_args__ are now generated to support Python 3.10's
    Structural Pattern Matching.
    This can be controlled by the match_args argument to the class decorators on Python 3.10 and later.
    On older versions, it is never added and the argument is ignored.
    #​815
  • If the class-level on_setattr is set to attrs.setters.validate (default in @define and @mutable) but no field defines a validator, pretend that it's not set.
    #​817
  • The generated __repr__ is significantly faster on Pythons with f-strings.
    #​819
  • Attributes transformed via field_transformer are wrapped with AttrsClass again.
    #​824
  • Generated source code is now cached more efficiently for identical classes.
    #​828
  • Added attrs.converters.to_bool().
    #​830
  • attrs.resolve_types() now resolves types of subclasses after the parents are resolved.
    #​842
    #​843
  • Added new validators: lt(val) (< val), le(va) (≤ val), ge(val) (≥ val), gt(val) (> val), and maxlen(n).
    #​845
  • attrs classes are now fully compatible with cloudpickle (no need to disable repr anymore).
    #​857
  • Added new context manager attrs.validators.disabled() and functions attrs.validators.(set|get)_disabled().
    They deprecate attrs.(set|get)_run_validators().
    All functions are interoperable and modify the same internal state.
    They are not – and never were – thread-safe, though.
    #​859
  • attrs.validators.matches_re() now accepts pre-compiled regular expressions in addition to pattern strings.
    #​877

python-cffi/cffi (cffi)

v1.17.1

Compare Source

  • Fix failing distutils.msvc9compiler imports under Windows (#​118).
  • ffibuilder.emit_python_code() and ffibuiler.emit_c_code() accept file-like objects (#​115).
  • ffiplatform calls are bypassed by ffibuilder.emit_python_code() and ffibuilder.emit_c_code() (#​81).

Full Changelog: python-cffi/cffi@v1.17.0...v1.17.1

v1.17.0

Compare Source

  • Add support for Python 3.13.
    • Free-threaded CPython builds (i.e. python3.13t and the 3.13t ABI) are not currently supported.
  • In API mode, when you get a function from a C library by writing
    fn = lib.myfunc, you get an object of a special type for performance
    reasons, instead of a <cdata 'C-function-type'>. Before version 1.17
    you could only call such objects. You could write
    ffi.addressof(lib, "myfunc") in order to get a real <cdata> object,
    based on the idea that in these cases in C you'd usually write &myfunc
    instead of myfunc. In version 1.17, the special object
    lib.myfunc can now be passed in many places where CFFI expects
    a regular <cdata> object. For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    ffi.cast() or ffi.typeof() on it.

Full Changelog: python-cffi/cffi@v1.16.0...v1.17.0

v1.16.0

Compare Source

  • Add support for Python 3.12. With the removal of distutils from Python 3.12, projects
    using CFFI features that depend on distutils at runtime must add a dependency on
    setuptools to function under Python 3.12+. CFFI does not declare a runtime setuptools
    requirement to avoid an unnecessary dependency for projects that do not require it.
  • Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  • Add support for PEP517 builds; setuptools is now a required build dependency.
  • Declare python_requires metadata for Python 3.8+. This allows unsupported Pythons
    to continue using previously released sdists and wheels.
  • Move project source under src/; a more standard layout that also enables CI to more easily
    catch packaging errors.

v1.15.1

Compare Source

(retroactive GitHub release for current stable version 1.15.1)

  • If you call ffi.embedding_api() but don't write any extern "Python" function there, then the resulting C code would fail an assert. Fixed.
  • Updated Windows/arm64 embedded libffi static lib to v3.4.2, and scripted to ease future updates (thanks Niyas Sait!)

Full Changelog: python-cffi/cffi@v1.15.0...v1.15.1

v1.15.0

Compare Source

v1.14.6

Compare Source

asottile/cfgv (cfgv)

v3.5.0

Compare Source

v3.4.0

Compare Source

v3.3.1

Compare Source

pallets/click (click)

v8.5.1

Compare Source

Released 2026-11-09

  • Fix copy.deepcopy() and pickle on a Parameter, Option or Command. {pr}3805
  • A KeyboardInterrupt arriving while Command.main() reports an abort or an error,
    or while it exits, no longer escapes as an unhandled traceback. The command still
    exits with the intended code; only the message may be lost. {issue}3802
  • Add {meth}Option.get_help_spec, which returns the option's left help
    column even when the option is hidden. {meth}Option.get_help_record still
    returns None for hidden options, so help screens are unchanged. {pr}3821
  • The Positional arguments help section lists every argument of the command,
    not only the documented ones. An argument with no help gets an empty
    description, the same way an option with no help does. {pr}3860
  • {meth}Argument.get_help_record always returns a tuple. It used to return
    None for an argument with no help. {pr}3860
  • Document which types are inferred from default, and what an unrecognized
    type callable does to a command-line value. {issue}3036 {pr}3808
  • path_type narrows the converted value's type for convert and prompt.
    {issue}3822 {pr}3858
  • {class}Parameter accepts a new help argument and {class}Option and {class}Argument
    inherits it. {meth}Parameter.to_info_dict now reports help for every kind of parameter.
    {pr}3861
  • A command's short help no longer stops at an abbreviation such as vs. or e.g.
    inside the first sentence. A period ends the sentence only when it closes the text
    or the next word does not start in lowercase. {pr}3865
  • With show_envvar=True, an option's error message now prints all variables of an
    envvar sequence instead of the repr of the sequence. {pr}3884
  • An empty envvar, such as [] or "", shows the same help and error message as
    no envvar when show_envvar=True. The help screen used to show [env var: ].
    {pr}3884
  • Align command's deprecated help text to options and arguments: do not translate the
    command's own help text, only the (DEPRECATED) label. {pr}3901

v8.5.0

Compare Source

Released 2026-08-24

  • Add built-in shell completion support for PowerShell (Windows PowerShell
    5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish
    completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate
    the completion script. {issue}2672 {pr}3637
  • Supported versions of Windows enable ANSI terminal styles by default.
    Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
  • {class}Argument accepts a help parameter, and help output includes
    a Positional arguments section when argument help is available. {issue}2983 {pr}3473
  • confirm() and prompt() strip ANSI color and style codes from the
    prompt when the output stream does not support them, matching echo().
    This stripping was lost in 8.4.0 when {pr}2969 began writing the
    prompt with input() directly. {issue}3572 {pr}3653
  • Fix test failures when using pytest >= 9.1. {pr}3656
  • {class}Path with allow_dash=True no longer triggers a BytesWarning,
    an error under python -bb, when checking a value against the -
    convention. {issue}2877 {pr}3642
  • Add {func}custom_version_option, a --version option whose output is
    produced by a callback, covering cases {func}version_option intentionally
    does not. The feature set of {func}version_option is now frozen. {pr}3581
  • style() and secho() no longer silently drop the 256-color index 0
    (black) passed as fg or bg, and now validate color arguments. Invalid
    colors raise a ValueError instead of a TypeError. {pr}3677
  • The automatic help option stores its value under the reserved name
    _click_default_help instead of help, so a parameter named help no
    longer breaks parsing. The new name is visible in
    {meth}Command.to_info_dict output. Parameters that overwrite each other's
    value trigger a warning: an argument sharing its name with another
    parameter, or any parameter claiming the reserved name. Options may still
    share a name to compete for the same value (feature switches).
    {issue}2819 {pr}3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full
    CSI escape-sequence grammar. {pr}3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and
    validation steps in Option.__init__ move into focused helpers, and
    flag_value and default keep their unset sentinel at construction
    (resolved lazily on read) so is UNSET reliably tells a user-supplied value
    from an auto-derived one. Runtime behavior is unchanged, but
    {meth}Parameter.to_info_dict now resolves default=True on a feature
    switch to its flag_value, matching what the function receives at call
    time. {pr}3641
  • {func}get_binary_stream and {func}get_text_stream are deprecated and
    will be removed in Click 9.0. {issue}3481 {pr}3695
  • The following click.utils names were never intentionally public and are
    now private (_-prefixed). The old names remain available with a
    DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,
    make_default_short_help, PacifyFlushWrapper, and safecall.
    {issue}3099 {pr}3695
  • Deprecate {meth}CliRunner.isolated_filesystem. It relies on
    {func}os.chdir, which mutates process-global state and is not
    thread-safe. The helper predates Python 3 and modern pytest: use a
    temporary directory ({class}tempfile.TemporaryDirectory or pytest's
    tmp_path fixture) with absolute paths instead. For running tests in
    parallel, use process-based isolation (such as pytest-xdist) rather
    than threads, since {meth}CliRunner.invoke also redirects the
    process-global standard streams. {issue}3501 {issue}3700 {pr}3704
  • prompt() is now generically typed and returns the type produced by
    type, value_proc, or a matching default instead of Any.
    {class}ParamType takes a second optional type parameter describing the
    input value it accepts (ParamType[int, str] for a type converting
    strings to integers), defaulting to Any. {pr}3407
  • {meth}Command.get_help_option_names returns the help option names in the
    order they were declared. {pr}3728
  • {func}get_pager_file yields a text stream on Windows again. The temporary
    file backend opened its file in binary mode, so writing a str to the pager
    raised TypeError: a bytes-like object is required, not 'str', and the
    color argument was ignored on that path. Regression introduced in 8.4.0
    by {pr}1572. {issue}3731 {issue}3732 {issue}3740 {pr}3739
  • {func}progressbar settles on its final position when update_min_steps
    does not divide the total. Steps below that threshold are applied when the
    bar finishes, so show_pos renders 20/20 rather than the last multiple
    it reached. {issue}3571 {pr}3769
  • An error raised while writing to the pager no longer gets replaced by
    PermissionError: [WinError 32] on Windows. The temporary file backend
    unlinked its file without closing it first, and Windows refuses to remove a
    file the process still holds open, so the cleanup failure masked the real
    exception. {issue}3731 {pr}3764
  • The temporary file the pager writes to on Windows is opened with the encoding
    {func}get_pager_file picked for the output stream, and with
    errors="replace" to match the pipe backend. Any text stdout can encode
    reaches the pager.
  • The temporary file pager backend forwards any parameters the user set in
    PAGER to the pager command instead of silently dropping them. On Windows,
    PAGER="less -R" now invokes less -R on the temporary file rather than
    bare less. {pr}3777
  • Improve raw mode detection by parsing the option tokens. {issue}3416
    {pr}3777
  • {func}edit accepts os.PathLike values for filename, in addition to
    strings. {issue}2869 {pr}3781

v8.4.2

Compare Source

Released 2026-06-24

  • Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and
    tabs in option help text are now escaped, keeping the original completion
    format while still supporting multi-line help. {issue}3502
    {issue}3043 {pr}3504 {pr}3508
  • Deprecated commands and options with empty or missing help text no longer
    render a stray leading space before the (DEPRECATED) label. {pr}3509
  • A {class}Group with invoke_without_command=True marks its subcommand as
    optional in the usage help, showing [COMMAND] instead of COMMAND.
    {issue}3059 {pr}3507
  • echo_via_pager flushes after each write, so passing a generator streams
    output to the pager incrementally instead of staying hidden until the pipe
    buffer fills. {issue}3242 {issue}2542 {pr}3534
  • echo_via_pager and get_pager_file no longer close a borrowed stdout
    stream when no external pager runs, completing the partial
    I/O operation on closed file fix from {pr}3482. {issue}3449
    {pr}3533
  • Fix CLI usage symopsis for optional arguments producing double square brackets
    [[a|b|c]]... whose type already brackets their metavar. {pr}3578
  • {func}version_option resolves a package_name that does not match an
    installed distribution as an import (top-level module) name via
    {func}importlib.metadata.packages_distributions. Packages whose
    top-level module name differs from their distribution name (PIL vs
    Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the
    box. {issue}2331 {issue}1884 {issue}3125 {pr}3582

v8.4.1

Compare Source

Released 2026-05-21

  • get_parameter_source() is available during eager callbacks and type
    conversion again. {issue}3458 {pr}3484
  • Zsh completion scripts parse correctly on Windows. {issue}3277 {pr}3466
  • Shell completion of Enum values used as Choice options produces a
    valid completion result. {issue}3015 {pr}3471
  • Fix empty byte-string handling in echo. {issue}3487 {pr}3493
  • Fix closed file error with echo_via_pager. {issue}3449 {pr}3482
  • Fix open_url on Windows when the file path contains spaces.
    {issue}2994 {pr}3478

v8.4.0

Compare Source

Released 2026-05-17

  • {class}ParamType typing improvements. {pr}3371

    • {class}ParamType is now a generic abstract base class,
      parameterized by its converted value type.
    • {meth}~ParamType.convert return types are narrowed on all
      concrete types (str for {class}STRING, int for
      {class}INT, etc.).
    • {meth}~ParamType.to_info_dict returns specific
      {class}~typing.TypedDict subclasses instead of
      dict[str, Any].
    • {class}CompositeParamType and the number-range base are now
      generic with abstract methods.
  • Refactor convert_type to extract type inference into a private
    _guess_type helper, and add {func}typing.overload signatures.
    {pr}3372

  • {class}Parameter typing improvements. {pr}2805

    • {class}Parameter is now an abstract base class, making explicit
      that it cannot be instantiated directly.
    • {attr}Parameter.name is now str instead of str | None.
      When expose_value=False, the name is set to "" instead
      of None.
    • The ctx parameter of {meth}Parameter.get_error_hint is now
      typed as Context | None, matching the runtime behavior.
  • Split string values from default_map for parameters with nargs > 1
    or {class}Tuple type, matching environment variable behavior.
    {issue}2745 {pr}3364

  • Auto-detect type=UNPROCESSED for flag_value of non-basic types
    (not str, int, float, or bool), so programmer-provided
    Python objects like classes and enum members are passed through unchanged
    instead of being stringified. Previously type=click.UNPROCESSED had
    to be set explicitly. {issue}2012 {pr}3363

  • The error hint now uses {meth}Command.get_help_option_names to pick
    non-shadowed help option names, so Try '... -h' no longer points to a
    subcommand option that shadows -h. The longest surviving name is
    shown (--help over -h) for readability. {issue}2790 {pr}3208

  • Fix readline functionality on non-Windows platforms. Prompt text is now
    passed directly to readline instead of being printed separately, allowing
    proper backspace, line editing, and line wrapping behavior. {issue}2968
    {pr}2969

  • Use {func}os.startfile on Windows to open URLs in {func}open_url,
    replacing the start built-in which cannot be invoked without
    shell=True. {issue}2868 {issue}3164 {pr}3186

  • Fix Fish shell completion errors when option help text contains newlines.
    {issue}3043 {pr}3126

  • Add {class}NoSuchCommand exception with suggestions for misspelled
    commands. {issue}3107 {pr}3228

  • Use {class}ValueError message when conversion in {class}FuncParamType would
    fail. {issue}3105 {pr}3211

  • Add click.get_pager_file for file-like access to an output
    pager. {pr}1572 {pr}3405

  • {func}~click.formatting.wrap_text now measures line width in visible
    characters, ignoring ANSI escape sequences. {pr}3420

  • Fix {meth}HelpFormatter.write_usage emitting only a blank line when
    called without args. The usage prefix and program name are now
    written even when no arguments follow, and the trailing separator
    space is stripped so the line ends at the program name.
    {issue}3360 {pr}3434

  • Show custom error messages from types when {func}prompt with
    hide_input=True fails validation, instead of always showing a
    generic message. Built-in type messages mask the input value.
    {issue}2809 {pr}3256

  • Add capture parameter to {class}CliRunner with two modes: sys
    (default) and fd. fd redirects file descriptors 1 and 2
    via {func}os.dup2 so output that bypasses sys.stdout (stale stream
    references, C extensions, subprocesses, faulthandler) is captured
    with proper isolation. {issue}854 {issue}2412 {issue}2468
    {issue}2497 {issue}2761 {issue}2827 {issue}2865 {pr}3391

  • Revert the 8.3.3 change that exposed the original file descriptor
    via fileno() on the redirected CliRunner streams in the default
    capture mode. os.dup2(w, sys.stdout.fileno()) calls inside a CLI no
    longer mutate the host runner's stdout, which broke Pytest's fd-level
    capture teardown. C-level consumers that need a real fd should use
    capture="fd". {issue}3384 {pr}3391

  • Mark additional built-in strings with gettext() to extend translation
    coverage. {pr}2902

  • Fix feature switch groups (several flag_value options sharing one
    parameter name) silently dropping an explicit default when a sibling
    option without an explicit default was declared first. Arbitration is now
    source-aware: a more explicit {class}ParameterSource always wins, and
    within ParameterSource.DEFAULT, an option that received an explicit
    default= keyword wins over a sibling whose default was auto-derived.
    The 8.3.x first-wins fallback for remaining ties was reverted to the
    pre-8.3.x last-wins fallback. {issue}3403 {pr}3404

  • Fix missing space between option help text and the (DEPRECATED)
    label, and localize the option label so it matches the command label.
    The label and the DeprecationWarning reason suffix are now produced
    by shared helpers. {pr}3423

  • Document short option stacking (-abc is parsed as -a -b -c) and
    clarify that multi-character short option names are not supported.
    {issue}2779 {pr}3431

v8.3.3

Compare Source

Released 2026-04-20

  • Use {func}shlex.split to split pager and editor commands into argv
    lists for {class}subprocess.Popen, removing shell=True.
    {issue}1026 {pr}1477 {pr}2775
  • Fix TypeError when rendering help for an option whose default value is
    an object that doesn't support equality comparison with strings, such as
    semver.Version. {issue}3298 {pr}3299
  • Fix pager test pollution under parallel execution by using pytest's
    tmp_path fixture instead of a shared temporary file path. {pr}3238
  • Treat Sentinel.UNSET values in a default_map as absent, so they fall
    through to the next default source instead of being used as the value.
    {issue}3224 {pr}3240
  • Patch pdb.Pdb in CliRunner isolation so pdb.set_trace(),
    breakpoint(), and debuggers subclassing pdb.Pdb (ipdb, pdbpp) can
    interact with the real terminal instead of the captured I/O streams.
    {issue}654 {issue}824 {issue}843 {pr}951 {pr}3235
  • Add optional randomized parallel test execution using pytest-randomly and
    pytest-xdist to detect test pollution and race conditions. {pr}3151
  • Add contributor documentation for running stress tests, randomized
    parallel tests, and Flask smoke tests. {pr}3151 {pr}3177
  • Show custom show_default string in prompts, matching the existing
    help text behavior. {issue}2836 {pr}2837 {pr}3165 {pr}3262 {pr}3280
    {pr}3328
  • Fix default=True with boolean flag_value always returning the
    flag_value instead of True. The default=True to flag_value
    substitution now only applies to non-boolean flags, where True acts as a
    sentinel meaning "activate this flag by default". For boolean flags,
    default=True is returned as a literal value. {issue}3111 {pr}3239
  • Mark make_default_short_help as private API. {issue}3189 {pr}3250
  • CliRunner's redirected streams now expose the original file descriptor
    via fileno(), so that faulthandler, subprocess, and other
    C-level consumers no longer crash with io.UnsupportedOperation.
    {issue}2865
  • Change {class}ParameterSource to an {class}~enum.IntEnum and reorder
    its members from most to least explicit, so values can be compared to
    check whether a parameter was explicitly provided. {issue}2879 {pr}3248

v8.3.2

Compare Source

Released 2026-04-02

  • Fix handling of flag_value when is_flag=False to allow such options to be
    used without an explicit value. {issue}3084 {pr}3152
  • Hide Sentinel.UNSET values as None when using lookup_default().
    {issue}3136 {pr}3199 {pr}3202 {pr}3209 {pr}3212 {pr}3224
  • Prevent _NamedTextIOWrapper from closing streams owned by StreamMixer.
    {issue}824 {issue}2991 {issue}2993 {issue}3110 {pr}3139 {pr}3140
  • Add comprehensive tests for CliRunner stream lifecycle, covering
    logging interaction, multi-threaded safety, and sequential invocation
    isolation. Add high-iteration stress tests behind a stress marker
    with a dedicated CI job. {pr}3139
  • Fix callable flag_value being instantiated when used as a default via
    default=True. {issue}3121 {pr}3201 {pr}3213 {pr}3225

v8.3.1

Compare Source

Released 2025-11-15

  • Don't discard pager arguments by correctly using subprocess.Popen. {issue}3039
    {pr}3055
  • Replace Sentinel.UNSET default values by None as they're passed through
    the Context.invoke() method. {issue}3066 {issue}3065 {pr}3068
  • Fix conversion of Sentinel.UNSET happening too early, which caused incorrect
    behavior for multiple parameters using the same name. {issue}3071 {pr}3079
  • Hide Sentinel.UNSET values as None when looking up for other parameters
    through the context inside parameter callbacks. {issue}3136 {pr}3137
  • Fix rendering when prompt and confirm parameter prompt_suffix is
    empty. {issue}3019 {pr}3021
  • When Sentinel.UNSET is found during parsing, it will skip calls to
    type_cast_value. {issue}3069 {pr}3090

v8.3.0

Compare Source

Released 2025-09-17

  • Improved flag option handling: Reworked the relationship between flag_value
    and default parameters for better consistency:

    • The default parameter value is now preserved as-is and passed directly
      to CLI functions (no more unexpected transformations)
    • Exception: flag options with default=True maintain backward compatibility
      by defaulting to their flag_value
    • The default parameter can now be any type (bool, None, etc.)
    • Fixes inconsistencies reported in: {issue}1992 {issue}2514 {issue}2610
      {issue}3024 {pr}3030
  • Allow default to be set on Argument for nargs = -1. {issue}2164
    {pr}3030

  • Show correct auto complete value for nargs option in combination with flag
    option {issue}2813

  • Fix handling of quoted and escaped parameters in Fish autocompletion. {issue}2995 {pr}3013

  • Lazily import shutil. {pr}3023

  • Properly forward exception information to resources registered with
    click.core.Context.with_resource(). {issue}2447 {pr}3058

  • Fix regression related to EOF handling in CliRunner. {issue}2939 {pr}2940

v8.2.2

Compare Source

Released 2025-07-31

  • Fix reconciliation of default, flag_value and type parameters for
    flag options, as well as parsing and normalization of environment variables.
    {issue}2952 {pr}2956
  • Fix typing issue in BadParameter and MissingParameter exceptions for the
    parameter param_hint that did not allow for a sequence of string where the
    underlying function _join_param_hints allows for it. {issue}2777 {pr}2990
  • Use the value of Enum choices to render their default value in help
    screen. Refs {issue}2911 {pr}3004
  • Fix completion for the Z shell (zsh) for completion items containing
    colons. {issue}2703 {pr}2846
  • Don't include envvar in error hint when not configured. {issue}2971 {pr}2972
  • Fix a rare race in click.testing.StreamMixer's finalization that manifested
    as a ValueError on close in a multi-threaded test session.
    {issue}2993 {pr}2991

v8.2.1

Compare Source

Released 2025-05-20

  • Fix flag value handling for flag options with a provided type. {issue}2894
    {issue}2897 {pr}2930
  • Fix shell completion for nested groups. {issue}2906 {pr}2907
  • Flush sys.stderr at the end of CliRunner.invoke. {issue}2682
  • Fix EOF handling for stdin input in CliRunner. {issue}2787

v8.2.0

[Compare Source](https://redirect.gith

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com Bot added the security fix Security fix generated by WhiteSource label Dec 19, 2024
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from dbfbccd to 75d42a4 Compare December 23, 2024 03:49
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from 75d42a4 to e481b9a Compare January 19, 2025 19:47
@mend-for-github-com mend-for-github-com Bot changed the title chore(deps): update mend: high confidence minor and patch dependency updates fix(deps): update mend: high confidence minor and patch dependency updates Jan 19, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from e481b9a to 9cedfc8 Compare January 25, 2025 03:48
@mend-for-github-com mend-for-github-com Bot changed the title fix(deps): update mend: high confidence minor and patch dependency updates chore(deps): update mend: high confidence minor and patch dependency updates Jan 25, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 2d4d1f1 to d660c62 Compare January 27, 2025 02:35
@mend-for-github-com mend-for-github-com Bot changed the title chore(deps): update mend: high confidence minor and patch dependency updates fix(deps): update mend: high confidence minor and patch dependency updates Jan 27, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 7e2d656 to 78a9f1c Compare January 29, 2025 03:11
@mend-for-github-com mend-for-github-com Bot changed the title fix(deps): update mend: high confidence minor and patch dependency updates chore(deps): update mend: high confidence minor and patch dependency updates Feb 1, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from ba0a6c4 to 0e614ca Compare February 3, 2025 03:59
@mend-for-github-com mend-for-github-com Bot changed the title chore(deps): update mend: high confidence minor and patch dependency updates fix(deps): update mend: high confidence minor and patch dependency updates Feb 3, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 34d47e5 to a096d34 Compare February 6, 2025 03:46
@mend-for-github-com mend-for-github-com Bot changed the title fix(deps): update mend: high confidence minor and patch dependency updates chore(deps): update mend: high confidence minor and patch dependency updates Feb 6, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from a096d34 to aed4b2c Compare February 7, 2025 03:48
@mend-for-github-com mend-for-github-com Bot changed the title chore(deps): update mend: high confidence minor and patch dependency updates fix(deps): update mend: high confidence minor and patch dependency updates Feb 7, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 4b349f3 to cde9d29 Compare February 9, 2025 03:56
@mend-for-github-com mend-for-github-com Bot changed the title fix(deps): update mend: high confidence minor and patch dependency updates chore(deps): update mend: high confidence minor and patch dependency updates Feb 9, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 89f32fc to cb85312 Compare February 12, 2025 03:04
@mend-for-github-com mend-for-github-com Bot changed the title chore(deps): update mend: high confidence minor and patch dependency updates fix(deps): update mend: high confidence minor and patch dependency updates Feb 12, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from aa55636 to 0315b4b Compare February 28, 2025 05:30
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 60a6293 to b690d77 Compare April 5, 2025 04:57
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 06db1cf to e23b265 Compare April 15, 2025 04:15
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from 8341f2d to af2bfb9 Compare April 23, 2025 04:35
@mend-for-github-com mend-for-github-com Bot changed the title fix(deps): update mend: high confidence minor and patch dependency updates chore(deps): update mend: high confidence minor and patch dependency updates Apr 23, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 5 times, most recently from 8370e95 to 21b26b0 Compare April 28, 2025 05:16
@mend-for-github-com mend-for-github-com Bot changed the title chore(deps): update mend: high confidence minor and patch dependency updates fix(deps): update mend: high confidence minor and patch dependency updates Apr 28, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from 21b26b0 to 74f5f1c Compare April 29, 2025 08:24
@mend-for-github-com mend-for-github-com Bot changed the title fix(deps): update mend: high confidence minor and patch dependency updates chore(deps): update mend: high confidence minor and patch dependency updates Apr 29, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from 74f5f1c to 9581c90 Compare April 30, 2025 05:33
@mend-for-github-com mend-for-github-com Bot changed the title chore(deps): update mend: high confidence minor and patch dependency updates fix(deps): update mend: high confidence minor and patch dependency updates Apr 30, 2025
@mend-for-github-com mend-for-github-com Bot changed the title fix(deps): update mend: high confidence minor and patch dependency updates chore(deps): update mend: high confidence minor and patch dependency updates May 1, 2025
@mend-for-github-com mend-for-github-com Bot changed the title chore(deps): update mend: high confidence minor and patch dependency updates fix(deps): update mend: high confidence minor and patch dependency updates May 2, 2025
@mend-for-github-com mend-for-github-com Bot changed the title fix(deps): update mend: high confidence minor and patch dependency updates chore(deps): update mend: high confidence minor and patch dependency updates May 3, 2025
@mend-for-github-com mend-for-github-com Bot changed the title chore(deps): update mend: high confidence minor and patch dependency updates fix(deps): update mend: high confidence minor and patch dependency updates May 4, 2025
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from 9581c90 to f61b946 Compare May 11, 2025 05:12
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 307af96 to bef9de9 Compare May 25, 2025 05:10
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 13ca25f to 4aa06de Compare May 28, 2025 04:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by WhiteSource

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants