build(deps): bump the python group across 5 directories with 81 updates

[dependabot]

Updates the requirements on annotated-types, anyio, cattrs, certifi, cffi, charset-normalizer, click, cryptography, firebase-admin, google-api-core, google-auth, google-cloud-core, google-cloud-firestore, google-cloud-storage, google-resumable-media, googleapis-common-protos, grpcio, grpcio-status, h2, hpack, idna, importlib-metadata, lsprotocol, maison, msgpack, pathspec, proto-plus, protobuf, pyasn1, pydantic, pydantic-core, pygls, pyjwt, tclint, tomli, typing-extensions, typing-inspection, voluptuous, alabaster, beautifulsoup4, docutils, imagesize, markdown-it-py, mdit-py-plugins, packaging, pydata-sphinx-theme, pygments, snowballstemmer, soupsieve, sphinx-autobuild, sphinx-external-toc, sphinx-llm, sphinx-markdown-builder, sphinxcontrib-mermaid, starlette, uvicorn, websockets, pip, annotated-doc, google-cloud-pubsub, numpy, pandas, platformdirs, pytz, typer, tzdata, setuptools, pyyaml, contourpy, fonttools, kiwisolver, matplotlib, pillow, pyparsing, ray, ax-platform, hyperopt, optuna, bayesian-optimization, tensorboard and sqlalchemy to permit the latest version.
Updates annotated-types from 0.7.0 to 0.8.0

Release notes

Sourced from annotated-types's releases.

v0.8.0

What's Changed

• Rename DocInfo to Doc by @​zen-xu in annotated-types/annotated-types#80
• Add support for Python 3.13 by @​hugovk in annotated-types/annotated-types#83
• Fix docstring of Timezone by @​Viicos in annotated-types/annotated-types#84
• Update license-files to be PEP-639 compliant (#85) by @​shoeffner in annotated-types/annotated-types#86
• fix: typo in README.md by @​camiloaz in annotated-types/annotated-types#87
• add CI for PyPy3.11 and fix test (issue 71) by @​mattip in annotated-types/annotated-types#88
• Fix string predicate names in doc by @​leogermond in annotated-types/annotated-types#90
• Add SPDX license expression by @​wichert in annotated-types/annotated-types#92
• Added Python 3.14 to the test matrix by @​imtoopunkforyou in annotated-types/annotated-types#96
• Add support for Python 3.14 and drop EOL 3.8-3.9 by @​hugovk in annotated-types/annotated-types#97
• Fix typo in Len docstring by @​Dutcho in annotated-types/annotated-types#100
• Prepare for 0.8.0 release by @​adriangb in annotated-types/annotated-types#103

New Contributors

• @​zen-xu made their first contribution in annotated-types/annotated-types#80
• @​hugovk made their first contribution in annotated-types/annotated-types#83
• @​shoeffner made their first contribution in annotated-types/annotated-types#86
• @​camiloaz made their first contribution in annotated-types/annotated-types#87
• @​mattip made their first contribution in annotated-types/annotated-types#88
• @​leogermond made their first contribution in annotated-types/annotated-types#90
• @​wichert made their first contribution in annotated-types/annotated-types#92
• @​imtoopunkforyou made their first contribution in annotated-types/annotated-types#96
• @​Dutcho made their first contribution in annotated-types/annotated-types#100

Full Changelog: annotated-types/annotated-types@v0.7.0...v0.8.0

Commits

• 9eb9668 Prepare for 0.8.0 release (#103)
• 10b7764 Fix typo in Len docstring (#100)
• 955f757 Add support for Python 3.14 and drop EOL 3.8-3.9 (#97)
• bd280fe Added Python 3.14 to the test matrix (#96)
• a471bb7 Add SPDX license expression (#92)
• eab91d9 Fix string predicate names in doc (#90)
• 03ad9c3 add CI for PyPy3.11 and fix test (issue 71) (#88)
• 5ae6043 fix: typo in README.md (#87)
• b60ad7b Update license-files to be PEP-639 compliant (#85) (#86)
• 3fbeb6d Fix docstring of Timezone (#84)
• Additional commits viewable in compare view

Updates anyio from 4.13.0 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

• Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

• Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

  • follow_symlinks on exists() (Python 3.12+)
  • follow_symlinks on is_dir() (Python 3.13+)
  • follow_symlinks on is_file() (Python 3.13+)
  • follow_symlinks on owner() (Python 3.13+)
  • follow_symlinks on group() (Python 3.13+)
  • newline on read_text() (Python 3.13+)

  (#1286, #1293; PR by @​jaideeppyne)

• Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

• Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

• Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

• Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

• Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

• Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

• Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

• Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

• Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

• Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

• Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

• Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

• Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

• Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

• Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

• Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

• Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

• Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits

• ffcd154 Bumped up the version
• 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• Additional commits viewable in compare view

Updates cattrs from 26.1.0 to 26.2.0

Release notes

Sourced from cattrs's releases.

v26.2.0

What's Changed

• Fix the msgpack and cbor2 converters unstructuring naive datetimes as local time, which made the serialized value depend on the timezone of the machine doing the unstructuring; naive datetimes are now assumed to be UTC, matching what the structure hooks already read back. (#774 #775)
• Fix override(rename=...) targets containing a quote (or other characters not safe in a bare string literal) crashing code generation with SyntaxError; the rename key is now embedded with repr. (#771)
• Fix Counter keys not being unstructured with the key type's own hook; the single-type-arg branch passed the whole type-args tuple to the key hook lookup instead of the key type. (#768)
• Fix create_default_dis_func (aka create_uniq_field_dis_func) failing to disambiguate valid unions depending on the order of the member classes; unique fields are now resolved iteratively to a fixpoint. (#230 #765)
• Support more recursive types on 3.14+ with specialized factories for annotationlib.ForwardRef. (#740 #741)
• Converter now uses specialized hook factories to generate hooks for tuples, increasing speed. (#737)
• Fix an AttributeError in cattrs internals that could be triggered by using the include_subclasses strategy in a structure_hook_factory (#721, #722)
• Fix TypedDict codegen when keys contain single quotes. (#769)
• Add CattrsError exception type: all exceptions raised by cattrs inherit from this. Literal and date-time validation raise this directly, instead of Exception. (#728)
• Fix the detailed_validation parameter being passed under the wrong name in namedtuple_dict_structure_factory, causing it to be silently ignored. (#723)
• cattrs is now autoformatted using Ruff. (#732)
• Support running the test suite without cbor2 installed. (#748)
• The union passthrough strategy now supports PEP 695 type aliases as union members. (#753)
• BaseConverter.register_structure_hook_factory and BaseConverter.register_unstructure_hook_factory now properly return the factory when used as decorators. (#724)
• The msgspec preconf converter now properly handles recursive classes on Python 3.14+. (#757)

New Contributors

• @​mm-andritz made their first contribution in python-attrs/cattrs#722
• @​bysiber made their first contribution in python-attrs/cattrs#723
• @​yzhkali made their first contribution in python-attrs/cattrs#753
• @​maxtaran2010 made their first contribution in python-attrs/cattrs#766
• @​vineethsaivs made their first contribution in python-attrs/cattrs#765
• @​uttam12331 made their first contribution in python-attrs/cattrs#768
• @​winklemad made their first contribution in python-attrs/cattrs#771
• @​onk3sh made their first contribution in python-attrs/cattrs#775

Full Changelog: python-attrs/cattrs@v26.1.0...v26.2.0

Changelog

Sourced from cattrs's changelog.

26.2.0 (2026-09-08)

• Fix the msgpack and cbor2 converters unstructuring naive datetimes as local time, which made the serialized value depend on the timezone of the machine doing the unstructuring; naive datetimes are now assumed to be UTC, matching what the structure hooks already read back. (#774 #775)
• Fix override(rename=...) targets containing a quote (or other characters not safe in a bare string literal) crashing code generation with SyntaxError; the rename key is now embedded with repr. (#771)
• Fix Counter keys not being unstructured with the key type's own hook; the single-type-arg branch passed the whole type-args tuple to the key hook lookup instead of the key type. (#768)
• Fix create_default_dis_func <cattrs.disambiguators.create_default_dis_func> (aka create_uniq_field_dis_func) failing to disambiguate valid unions depending on the order of the member classes; unique fields are now resolved iteratively to a fixpoint. (#230 #765)
• Support more recursive types on 3.14+ with specialized factories for annotationlib.ForwardRef. (#740 #741)
• Converter <cattrs.Converter> now uses specialized hook factories to generate hooks for tuples, increasing speed. (#737)
• Fix an AttributeError in cattrs internals that could be triggered by using the include_subclasses strategy in a structure_hook_factory (#721, #722)
• Fix TypedDict codegen when keys contain single quotes. (#769)
• Add CattrsError exception type: all exceptions raised by cattrs inherit from this. Literal and date-time validation raise this directly, instead of Exception. (#728)
• Fix the detailed_validation parameter being passed under the wrong name in {func}namedtuple_dict_structure_factory <cattrs.cols.namedtuple_dict_structure_factory>, causing it to be silently ignored. (#723)
• cattrs is now autoformatted using Ruff. (#732)
• Support running the test suite without cbor2 installed. (#748)
• The union passthrough strategy now supports PEP 695 type aliases as union members. (#753)
• {meth}BaseConverter.register_structure_hook_factory and {meth}BaseConverter.register_unstructure_hook_factory now properly return the factory when used as decorators. (#724)
• The {mod}msgspec <cattrs.preconf.msgspec> preconf converter now properly handles recursive classes on Python 3.14+. (#757)

Commits

• df4e4bb v26.2.0
• f7cd6b1 Assume naive datetimes are UTC in the msgpack and cbor2 converters
• d4ff793 Bump pypa/gh-action-pypi-publish to 1.14.2
• 671f203 Bump hynek/baipp
• 893351d Parametrize the special-characters rename test
• 7a37e00 Add HISTORY entry for the rename-key escaping fix
• 3d57d6b Escape override rename keys when generating structure/unstructure code
• f2e42f3 Improve TypedDict key quoting
• 82b02c0 Add HISTORY entry for Counter key unstructure fix (#768)
• 02c3ead Unpack the single type arg for Counter keys when unstructuring
• Additional commits viewable in compare view

Updates certifi from 2026.5.20 to 2026.7.22

Commits

• f4bc676 2026.07.22 (#428)
• 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
• 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
• eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
• 474e6fc Include tests in the source distribution (#424)
• a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420)
• 98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
• d0ac52f 2026.06.17 (#418)
• d46de62 Bump actions/checkout from 6.0.2 to 6.0.3 (#417)
• 6c183ec fix: update Requests docs link to canonical URL (#415)
• Additional commits viewable in compare view

Updates cffi from 2.0.0 to 2.1.1

Release notes

Sourced from cffi's releases.

v2.1.1

What's Changed

• Minimize internal Python API usage for interpreter and thread state sampling where possible. Avoids breaking ABI change in Python >= 3.15.0b4 (python-cffi/cffi#269).

Full Changelog: python-cffi/cffi@v2.1.0...v2.1.1

v2.1.0

• Added support for Python 3.15 and support for C extensions generated by CFFI to target the new abi3t free-threaded ABI.
• Dropped support for Python 3.9.
• Added cffi-gen-src CLI to generate CFFI C extension source for alternate build backend support.
• Fixed crashes inside __delitem__.
• Fixed "string too big" error under MSVC.
• Fixed mingw builds.
• Added support for arm64 iOS wheels.

Commits

• fd33e77 New release 2.1.1
• 56a7876 Use PyGILState_Ensure to avoid accessing CPython internals (#269) (#270)
• d9f6f70 New release 2.1.0
• 02a7b0e Misc pre-2.1 release/packaging cleanup (#253)
• 1362e5d Move cffi-gen-src release note to 2.1.0 notes
• a797055 Make error message when embedding version test fails more friendly
• f1f40a8 Update changelog
• dc62c93 Delete missed cp39 Windows builds
• a341180 Update version numbers to prepare for v2.1 release
• 9f04d85 Mark test using inet_ntoa as thread-unsafe
• Additional commits viewable in compare view

Updates charset-normalizer from 3.4.7 to 3.5.1

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.1

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

... (truncated)

Changelog

Sourced from charset-normalizer's changelog.

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

3.4.8 (2026-07-06)

Fixed

• Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
• Unnecessary json import at runtime (#753)
• Inverse capitalization not seen by noise detector (#731)

... (truncated)

Commits

• e239bdc Merge pull request #795 from jawah/release-3.5.1
• 648ad77 docs: update faq
• fab2749 docs: write changelog for 3.5.1
• 7d32774 chore: bump version to 3.5.1
• 9a69f60 docs: update data/info
• 5dcc6dd perf: charinfo cache access optimization in cython
• ea3b447 fix: do not validate-decode large payload when md says it's noise
• a05917f chore: allow setuptools 84 builds (#794)
• 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
• 77203b1 chore: reformat noxfile.py
• Additional commits viewable in compare view

Updates click from 8.4.1 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits

• 8b19813 Release version 8.5.0
• 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
• 131c86a Add FAQ entry about UnicodeEncodeError on Windows
• e1fd594 Add support of pathlib.Path to edit (#3781)
• a1d8785 Add support of pathlib.Path to edit
• 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
• a6256bf Forwards all user's parameters set in PAGER
• 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
• 9835b0f Resolve the pager command once, in _pager_contextmanager
• f36d58b Refactor pager stream handling (#3767)
• Additional commits viewable in compare view

Updates cryptography from 48.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:
50.0.0 - 2026-07-31

• SECURITY ISSUE: :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in :rfc:3218. Credit to @​X1AOxiang for reporting the issue. CVE-2026-69247
• Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm.
• Added xof() class methods to :class:~cryptography.hazmat.primitives.hashes.SHAKE128 and :class:~cryptography.hazmat.primitives.hashes.SHAKE256 for constructing algorithm instances configured for use with :class:~cryptography.hazmat.primitives.hashes.XOFHash.
• The :mod:X.509 verification <cryptography.x509.verification> APIs are now considered stable and are subject to our API stability policy.
• Added the :doc:/cobblestone recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification <https://c2sp.org/chunked-encryption>_ for streaming authenticated encryption of large messages.
• Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after ...

  Description has been truncated

[vvbandeira]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T17:35:20.593047Z	83aa361	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 83aa361882

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep Docutils within Sphinx 5's supported range

The lock file still pins sphinx==5.3.0, whose package metadata requires docutils<0.20, so changing this pin to 0.23 makes pip install -r docs/requirements_lock.txt fail dependency resolution before any documentation can be built, including the Read the Docs build configured to consume this file. Keep Docutils below 0.20 or upgrade the constrained Sphinx stack together.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve Python 3.10 compatibility in the common lock

On Ubuntu 22.04, setup.sh reaches _installPipCommon using the system Python 3.10, and this lock file itself says it is generated for Python 3.10; however, pandas 3.x requires Python 3.11 or newer. Consequently, the documented Ubuntu 22.04 setup now fails while installing requirements-common_lock.txt; retain a Python-3.10-compatible pandas release (and regenerate its NumPy dependency) or update the installer runtime first.

Useful? React with 👍 / 👎.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.