[dependabot]

Bumps the python group with 39 updates in the / directory:

Package	From	To
duckdb	1.5.5	1.5.6
geopandas	1.1.4	1.2.0
torch	2.14.0	2.14.1
marimo	0.24.2	0.25.1
ruff	0.16.8	0.16.10
anyio	4.14.2	4.15.1
charset-normalizer	3.4.9	3.5.2
click	8.4.2	8.5.0
contourpy	1.3.3	1.4.0
coverage	7.15.3	7.16.2
fonttools	4.63.0	4.66.1
idna	3.18	3.20
jedi	0.19.2	0.20.0
joblib	1.5.3	1.6.0
kiwisolver	1.5.0	1.5.1
loro	1.13.2	1.16.2
markdown	3.10.3	3.11
markupsafe	3.0.3	3.0.4
msgspec	0.21.1	0.22.0
narwhals	2.24.0	2.26.0
networkx	3.6.1	3.7
numpy	2.5.1	2.5.3
orjson	3.11.9	3.12.0
overturemaps	1.0.1	1.0.2
packaging	26.2	26.3
platformdirs	4.11.0	4.12.2
pygments	2.20.0	2.21.0
pymdown-extensions	11.0.1	12.1
pyparsing	3.3.2	3.3.3
pyproj	3.7.2	3.8.0
pyzmq	27.1.0	27.2.0
soupsieve	2.9.1	2.10
starlette	1.3.1	1.7.0
threadpoolctl	3.6.0	3.7.0
tqdm	4.70.0	4.70.1
tzdata	2026.3	2026.5
urllib3	2.7.0	2.8.0
uvicorn	0.52.1	0.54.0
websockets	17.0.1	17.2

Updates duckdb from 1.5.5 to 1.5.6

Release notes

Sourced from duckdb's releases.

v1.5.6 Bugfix Release

See DuckDB's changelog for all changes in DuckDB.

Commits

• 802a345 set submodule pin to v1.5.6 release hash
• f4f4ad2 [duckdb-labs bot] Bump DuckDB submodule (#631)
• 3d35637 Bump submodule
• 2929d48 [duckdb-labs bot] Bump DuckDB submodule (#625)
• e1b6247 Bump submodule
• f487d2d [duckdb-labs bot] Bump DuckDB submodule (#624)
• ede665a Bump submodule
• f0829a7 [duckdb-labs bot] Bump DuckDB submodule (#623)
• 7e1aaa2 Bump submodule
• b385dbf [duckdb-labs bot] Bump DuckDB submodule (#621)
• Additional commits viewable in compare view

Updates geopandas from 1.1.4 to 1.2.0

Release notes

Sourced from geopandas's releases.

v1.2.0

What's Changed

New features and improvements:

• Static plotting in GeoPandas has been re-implemented. The new tooling shall be mostly backwards compatible while bringing a set of enhancements:

  • Categorical plotting now allows dict-based mapping of categories to colors and other styles.
  • Legends now reflect the geometry type and complete set of styles, not just a color.
  • Plotting of continuous variables with a classification scheme can now produce a colorbar instead of a categorical legend when using colorbar=True within legend_kwds.
  • vmin and vmax keywords are supported when scheme is defined, not ignored.
  • When using categorical colormap with categorical plots, colors are now assigned in order to optimize the contrast of the resulting map.
  • Colorbar size is automatically adjusted to be approximately the size of the plot.
  • Colorbar now indicates extensions if the vmin and/or vmax clip the values.
  • Legends are created automatically by matplotlib. This also means that you can create a single legend from a layered map by calling ax.legend() directly.
  • GeoPandas now labels axes using the information on units from CRS. This can be controlled via the add_labels keyword.
  • Static plots can include a basemap defined by the tiles keyword, exposing contextily.add_basemap from within the plot method. Requires contextily package to be installed.
  • scheme keyword can take a value "greedy" resulting in a greedy (topological) coloring where no two adjacent polygons share a color. Requires mapclassify and libpysal packages.

  The related refactoring of the plotting infrastructure has changed the internal representation of the figure generated by GeoPandas. This can be considered a breaking change if you rely the composition of collections, as that has changed. A number of plotting-related bugs has been fixed along as a side effect. All changes are reflected in an updated user guide. (#3708, #3728, #3748, #3752, #3753, #3763, #3767, #3689).

• GeoParquet improvements:

  • The upcoming GeoParquet 2.0 specification is now supported for both writing and reading (#3632).
  • read_parquet now support direct reading from HTTP/HTTPS protocols (#3699).
  • GeoDataFrame.to_parquet and read_parquet will now write and read attrs respectively (#3597).

• Added geopandas.make_grid and GeoSeries.make_grid to generate a square or hexagonal grids covering the input geometry (#2062).

• Added geopandas.read_file_info to expose information about file layers, including layer metadata (this is an alias for pyogrio.read_info) (#3759).

• Add grid_size parameter to union, difference, symmetric_difference and intersection (#3593).

• Document how to access the feature ID (fid) as the index when reading files

... (truncated)

Changelog

Sourced from geopandas's changelog.

Version 1.2.0 (September 28, 2026)

New features and improvements:

• Static plotting in GeoPandas has been re-implemented. The new tooling shall be mostly backwards compatible while bringing a set of enhancements:

  • Categorical plotting now allows dict-based mapping of categories to colors and other styles.
  • Legends now reflect the geometry type and complete set of styles, not just a color.
  • Plotting of continuous variables with a classification scheme can now produce a colorbar instead of a categorical legend when using colorbar=True within legend_kwds.
  • vmin and vmax keywords are supported when scheme is defined, not ignored.
  • When using categorical colormap with categorical plots, colors are now assigned in order to optimize the contrast of the resulting map.
  • Colorbar size is automatically adjusted to be approximately the size of the plot.
  • Colorbar now indicates extensions if the vmin and/or vmax clip the values.
  • Legends are created automatically by matplotlib. This also means that you can create a single legend from a layered map by calling ax.legend() directly.
  • GeoPandas now labels axes using the information on units from CRS. This can be controlled via the add_labels keyword.
  • Static plots can include a basemap defined by the tiles keyword, exposing contextily.add_basemap from within the plot method. Requires contextily package to be installed.
  • scheme keyword can take a value "greedy" resulting in a greedy (topological) coloring where no two adjacent polygons share a color. Requires mapclassify and libpysal packages.

  The related refactoring of the plotting infrastructure has changed the internal representation of the figure generated by GeoPandas. This can be considered a breaking change if you rely the composition of collections, as that has changed. A number of plotting-related bugs has been fixed along as a side effect. All changes are reflected in an updated user guide. (#3708, #3728, #3748, #3752, #3753, #3763, #3767, #3689).

• GeoParquet improvements:

  • The upcoming GeoParquet 2.0 specification is now supported for both writing and reading (#3632).
  • read_parquet now support direct reading from HTTP/HTTPS protocols (#3699).
  • GeoDataFrame.to_parquet and read_parquet will now write and read attrs respectively (#3597).

• Added geopandas.make_grid and GeoSeries.make_grid to generate a square or hexagonal grids covering the input geometry (#2062).

• Added geopandas.read_file_info to expose information about file layers, including layer metadata (this is an alias for pyogrio.read_info) (#3759).

• Add grid_size parameter to union, difference, symmetric_difference and intersection (#3593).

• Document how to access the feature ID (fid) as the index when reading files with read_file and the pyogrio engine, using fid_as_index=True (#3829).

... (truncated)

Commits

• 199fc53 RLS: v1.2.0
• 0429cd1 DOC/RLS: update changelog for 1.2 release (#3864)
• 3e07c90 BUG: always use int64 for the explode parts index level (#3871)
• 85f3654 TST: use fixed byte-order in to_wkb tests (for big endian machine) (#3874)
• 6d49816 CI: use nightly wheels for shapely in the dev build (#3872)
• 69fb61f ENH: expose read_file_info as toplevel function (#3759)
• cc8e4e8 TST: filterwarning cleanup (#3867)
• 6302753 ENH: support reading GeoParquet 2.0 files with bbox filter (#3847)
• c0e3867 ENH: add new make_grid() function (equivalent of st_make_grid) (#2197)
• 9e58ea1 DOC: consolidate contributing guides (#3859)
• Additional commits viewable in compare view

Updates torch from 2.14.0 to 2.14.1

Release notes

Sourced from torch's releases.

PyTorch 2.14.1 Release

This release is meant to fix the following regressions and silent correctness issues:

Silent correctness fixes

• Fix incorrect torch.linalg.lstsq solutions on MPS for complex batched underdetermined systems (#196113), fixed by #196128
• Fix non-orthogonal U and inaccurate small singular values from torch.linalg.svd on MPS for rank-deficient and ill-conditioned inputs (#196112), fixed by #196139 and #199063
• Update the CUDA 13.2 Linux binaries to CUDA 13.2.2 (#196351). This NVIDIA update resolves two critical issues that could produce incorrect results (CUDA 13.2.2 release notes):
  • cuBLAS: cublasLtMatmul() could ignore tensor-wide scaling for NVFP4 matrix multiplications (introduced in CUDA 13.2 Update 1)
  • Compiler: failed thread reconvergence could leave stale or corrupted register values in kernels with nested thread divergence (present since CUDA 12.8)

Regression fixes

• Fix torch.linalg.svd, torch.linalg.svdvals and torch.linalg.lstsq failing on MPS with a Metal pipeline-state error for inputs above 8192 elements (#195937), fixed by #195949 and #195950
• Fix internal assert in torch.svd(out=) on MPS for complex inputs (#195822), fixed by #195872

Commits

• 5c48869 [MPS] Fix Jacobi SVD convergence for small columns (#199086)
• 35223a2 [release/2.14] Run the release runner-group reconcile in pytorch/pytorch (#19...
• 41ffbc4 [release-only] Update version to 2.14.1 (#198661)
• e8f0c01 [release/2.14] [CD] Update to CUDA 13.2.2 for Linux binaries (#198644)
• 911665d [MPS] Cherry-pick native SVD fixes into release/2.14 (#198394)
• See full diff in compare view

Updates marimo from 0.24.2 to 0.25.1

Release notes

Sourced from marimo's releases.

0.25.1

✨ Enhancements

• Make local agent pairing easier to discover (#10946)
• Update LLM model catalog (#11002)
• Add expand_outputs as an argument to ctx.edit_cell and ctx.create_cell (#10974)
• Record cache entries in a per-notebook manifest (#10838)
• Marimo cache size (#10837)
• Marimo cache dir (#10836)

🐛 Bug fixes

• Keep getpass responses out of saved console output (#11043)
• Reject invalid code mode cell names (#11032)
• Align and unshrink mo.ui.radio button when option label wraps (#11031)
• Harden sandbox environment selection (#11026)
• Send origin referrer on cross-origin requests from notebook pages (#11015)
• Keep sandbox package managers fixed in install alerts (#10983)
• Render dotted chart columns when data falls back to CSV (#10856)
• Fix plotly hover text rendering issue (#10988)
• Avoid repeated Docker prompt for sandboxed URL edits (#10984)
• Make the kernel SIGINT handler reentrancy-safe (#10975)
• Secure language server websocket listeners (#10979)
• Change tokenization to allow trailing comments (#10981)
• UI fix for SFTP (and a fsspec plugin for ssh) (#10977)
• Ensure partial cell config update preserves existing values (#10971)

📚 Documentation

• Add huggingface/drive to remote storage (#10959)
• Normalize styles from katex bump (#10995)
• Add Whisper sandbox example (#10994)
• Fix quickstart anchors in Spanish and Chinese READMEs (#10989)
• Security clarification on pyproject.toml (#10986)
• Add ffmpeg pixi example for blog post (#10993)

📝 Other changes

• Fix suboptimal assignment in cell-matching Hungarian algorithm (#10654) (f15c5ff)

Contributors

Thanks to all our community and contributors who made this release possible: @​dmadisetti, @​kirangadhave, @​koaning, @​Light2Dark, @​manzt, @​marthacryan, @​mscolnick, @​peter-gy, @​sadov, @​ZainnQureshii

Full Changelog: marimo-team/marimo@0.25.0...0.25.1

0.25.0

This release reworks sandboxing to improve correctness, recovery, and consistency, and adds Pixi as a new sandbox backend.

We expect most users to be able to upgrade without making changes. Existing sandbox commands continue to work, but the underlying environment lifecycle has changed substantially and could affect some workflows.

This release also adds portable WebAssembly exports, persistent expanded outputs, and many fixes across the editor and runtime.

⭐️ Highlights

... (truncated)

Commits

• 92fbbbe release: 0.25.1 (#11056)
• e43977e fix(deps): exclude broken SQLAlchemy 2.1.0 release (#11059)
• 062caf9 fix(test): drop leaked DuckDB schemas in SQL cleanup test (#11057)
• 9f34a51 fix: point pair agents at marimo edit when no session exists (#11055)
• 7d7529a fix(test): prevent DuckDB state leaks and directory watcher races (#11054)
• bfa9639 feat: add shared table export dialog (#11029)
• 719f967 fix: preserve null handling in generated filters (#11036)
• c1220e6 fix(sql): honor DuckDB discovery settings (#11007)
• 6d3d22e fix: give Markdown list markers more room (#11042)
• ce0e849 feat(frontend): publish HTML to web through molab (#10763)
• Additional commits viewable in compare view

Updates ruff from 0.16.8 to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

0.16.9

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)

... (truncated)

Commits

• 3265ed1 Bump version to 0.16.10 (#29055)
• e786964 Authorize shared PR security-review workflow to publish findings (#29052)
• a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
• b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
• 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
• 317e0a3 [ty] Bound nested callable signature display (#29049)
• 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
• 56180bc [ty] Specialize instance members once (#29043)
• aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
• 2d25346 [ty] Improve unresolved-import documentation (#29039)
• Additional commits viewable in compare view

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

• Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

• Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

  • follow_symlinks on exists() (Python 3.12+)
  • follow_symlinks on is_dir() (Python 3.13+)
  • follow_symlinks on is_file() (Python 3.13+)
  • follow_symlinks on owner() (Python 3.13+)
  • follow_symlinks on group() (Python 3.13+)
  • newline on read_text() (Python 3.13+)

  (#1286, #1293; PR by @​jaideeppyne)

• Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

• Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

• Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

• Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

• Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

• Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

• Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

• Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

• Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

• Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

• Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

• Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

• Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

• Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

• Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

• Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

• Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

• Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits

• ffcd154 Bumped up the version
• 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• Additional commits viewable in compare view

Updates charset-normalizer from 3.4.9 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Version 3.5.1

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

... (truncated)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• e239bdc Merge pull request #795 from jawah/release-3.5.1
• 648ad77 docs: update faq
• Additional commits viewable in compare view

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](https://github.com/pallets/click/discussions/3527). #3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](https://github.com/pallets/click/discussions/3527). {pr}3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and ...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.