fix(deps): update minor and patch updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
click (changelog)	==8.4.2 → ==8.5.0			project.dependencies	minor
jdx/mise-action	v4.2.5 → v4.3.0			action	minor
ruff (source, changelog)	==0.16.4 → ==0.16.5			dependency-groups	patch	0.16.7 (+1)
uv	0.12.5 → 0.12.7			tools	patch	0.12.13 (+5)

---

Release Notes

pallets/click (click)

v8.5.0

Compare Source

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell
  5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish
  completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate
  the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default.
  Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes
  a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the
  prompt when the output stream does not support them, matching echo().
  This stripping was lost in 8.4.0 when {pr}2969 began writing the
  prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning,
  an error under python -bb, when checking a value against the -
  convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is
  produced by a callback, covering cases {func}version_option intentionally
  does not. The feature set of {func}version_option is now frozen; see
  discussion #​3527. {pr}3581
• style() and secho() no longer silently drop the 256-color index 0
  (black) passed as fg or bg, and now validate color arguments. Invalid
  colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name
  _click_default_help instead of help, so a parameter named help no
  longer breaks parsing. The new name is visible in
  {meth}Command.to_info_dict output. Parameters that overwrite each other's
  value trigger a warning: an argument sharing its name with another
  parameter, or any parameter claiming the reserved name. Options may still
  share a name to compete for the same value (feature switches).
  {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full
  CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and
  validation steps in Option.__init__ move into focused helpers, and
  flag_value and default keep their unset sentinel at construction
  (resolved lazily on read) so is UNSET reliably tells a user-supplied value
  from an auto-derived one. Runtime behavior is unchanged, but
  {meth}Parameter.to_info_dict now resolves default=True on a feature
  switch to its flag_value, matching what the function receives at call
  time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and
  will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are
  now private (_-prefixed). The old names remain available with a
  DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,
  make_default_short_help, PacifyFlushWrapper, and safecall.
  {issue}3099 {pr}3695
• Deprecate {meth}CliRunner.isolated_filesystem. It relies on
  {func}os.chdir, which mutates process-global state and is not
  thread-safe. The helper predates Python 3 and modern pytest: use a
  temporary directory ({class}tempfile.TemporaryDirectory or pytest's
  tmp_path fixture) with absolute paths instead. For running tests in
  parallel, use process-based isolation (such as pytest-xdist) rather
  than threads, since {meth}CliRunner.invoke also redirects the
  process-global standard streams. {issue}3501 {issue}3700 {pr}3704
• prompt() is now generically typed and returns the type produced by
  type, value_proc, or a matching default instead of Any.
  {class}ParamType takes a second optional type parameter describing the
  input value it accepts (ParamType[int, str] for a type converting
  strings to integers), defaulting to Any. {pr}3407
• {meth}Command.get_help_option_names returns the help option names in the
  order they were declared. {pr}3728
• {func}get_pager_file yields a text stream on Windows again. The temporary
  file backend opened its file in binary mode, so writing a str to the pager
  raised TypeError: a bytes-like object is required, not 'str', and the
  color argument was ignored on that path. Regression introduced in 8.4.0
  by {pr}1572. {issue}3731 {issue}3732 {issue}3740 {pr}3739
• {func}progressbar settles on its final position when update_min_steps
  does not divide the total. Steps below that threshold are applied when the
  bar finishes, so show_pos renders 20/20 rather than the last multiple
  it reached. {issue}3571 {pr}3769
• An error raised while writing to the pager no longer gets replaced by
  PermissionError: [WinError 32] on Windows. The temporary file backend
  unlinked its file without closing it first, and Windows refuses to remove a
  file the process still holds open, so the cleanup failure masked the real
  exception. {issue}3731 {pr}3764
• The temporary file the pager writes to on Windows is opened with the encoding
  {func}get_pager_file picked for the output stream, and with
  errors="replace" to match the pipe backend. Any text stdout can encode
  reaches the pager.
• The temporary file pager backend forwards any parameters the user set in
  PAGER to the pager command instead of silently dropping them. On Windows,
  PAGER="less -R" now invokes less -R on the temporary file rather than
  bare less. {pr}3777
• Improve raw mode detection by parsing the option tokens. {issue}3416
  {pr}3777
• {func}edit accepts os.PathLike values for filename, in addition to
  strings. {issue}2869 {pr}3781

jdx/mise-action (jdx/mise-action)

v4.3.0: : Install age-filtered mise releases

Compare Source

A small release that adds an opt-in way to hold back from installing brand-new mise releases.

Added

minimum_release_age input (#​604 by @​jdx)

When version is omitted, you can now set minimum_release_age to install the newest stable, non-draft mise release that is older than a given cutoff — a simple way to avoid picking up a mise release the moment it ships (closes #​603).

- uses: jdx/mise-action@v4
  with:
    minimum_release_age: 7d

It accepts relative durations (24h, 7d, 6mo, 1y) as well as absolute ISO dates and timestamps. Age-filtered versions are resolved from the GitHub Releases API (the CDN only serves the latest binary) and downloaded by their exact version. If mise is already present on disk, an age-filtered run updates it to the resolved version rather than keeping the existing binary. An explicit version always takes precedence over minimum_release_age, and invalid dates fail fast.

Full Changelog: jdx/mise-action@v4.2.5...v4.3.0

astral-sh/ruff (ruff)

v0.16.5

Compare Source

Released on 2026-08-27.

Preview features

• Allow rules without codes (#​28049)
• Introduce category selectors (#​27666)
• Update preview default rules and categories (#​27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#​28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#​28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#​28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#​27978)

Documentation

• Document rule acceptance guidelines (#​27910)
• Document the new category selectors (#​27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

astral-sh/uv (uv)

v0.12.7

Compare Source

Released on 2026-08-27.

Python

• Replace managed Python installations when upgrading to a newer build of the same version (#​21323)

Enhancements

• Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#​21313)
• Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#​21318)

Preview features

• Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#​19693)

Bug fixes

• Reject source archives with hash mismatches before persisting their extracted contents to the cache (#​21248)

Other changes

• remove pyx specific features (#​21182, #​21183, #​21184, #​21185, #​21186)

v0.12.6

Compare Source

Released on 2026-08-25.

Python

• Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #​21295)

Enhancements

• Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#​21261)
• Limit warnings about unbounded uv_build requirements to source-distribution builds (#​21078)
• Display byte counts below 1 KiB without a fractional part (#​21237)

Preview features

• Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#​21117)
• Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#​21235)
• Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#​21227)
• Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#​21146)

Performance

• Enable profile-guided optimization for Linux x86-64 release binaries (#​21001)
• Enable profile-guided optimization for Windows x86-64 release binaries (#​21003)
• Enable profile-guided optimization for macOS ARM64 release binaries (#​21002)
• Enable profile-guided optimization for Linux ARM64 release binaries (#​21004)
• Speed up syncing projects with many activated conflict items by reusing their encoded representation (#​21148)

Bug fixes

• Allow explicit uv build and non-editable first-party workspace packages when no-build is enabled (#​21294)
• Reuse configured index credentials during uv tool upgrade when the tool receipt references the same index (#​21275)
• Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch (#​21224)
• Prevent TLS segfaults in riscv64 musl release binaries (#​21158)
• Preserve dependencies selected by recursive extras when markers mix production and extra conditions (#​21181)
• Preserve version constraints from transitively referenced recursive extras (#​21209)
• Resolve repository-relative Git archive dependencies inside the checkout during the initial uv sync (#​21264)
• Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header (#​21282)
• Do not misclassify package URLs ending in .py as local script paths (#​21144)
• Use directory creation times consistently across libc implementations for directory cache-keys entries (#​21137)
• Promote human-readable sizes to the next unit at rounding boundaries (#​21136)

Other changes

• Add Python 3.15 release-candidate Docker images (#​21293)
• Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 (#​21258)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9pm on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.