Bump the python group with 2 updates

[dependabot]

Updates the requirements on click and uv-build to permit the latest version.
Updates click to 8.4.2

Release notes

Sourced from click's releases.

8.4.2

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.2/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-2 Milestone: https://github.com/pallets/click/milestone/34

• Fix Fish shell completion broken in 8.4.0 by #3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. #3502 #3043 #3504 #3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. #3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. #3059 #3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. #3242 #2542 #3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from #3482. #3449 #3533
• Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. #3578
• {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. #2331 #1884 #3125 #3582

Changelog

Sourced from click's changelog.

Version 8.4.2

Unreleased

• Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. {issue}3502 {issue}3043 {pr}3504 {pr}3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. {pr}3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. {issue}3059 {pr}3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. {issue}3242 {issue}2542 {pr}3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from {pr}3482. {issue}3449 {pr}3533

Version 8.4.1

Released 2026-05-21

• get_parameter_source() is available during eager callbacks and type conversion again. {issue}3458 {pr}3484
• Zsh completion scripts parse correctly on Windows. {issue}3277 {pr}3466
• Shell completion of Enum values used as Choice options produces a valid completion result. {issue}3015 {pr}3471
• Fix empty byte-string handling in echo. {issue}3487 {pr}3493
• Fix closed file error with echo_via_pager. {issue}3449 {pr}3482
• Fix open_url on Windows when the file path contains spaces. {issue}2994 {pr}3478

Version 8.4.0

Released 2026-05-17

• {class}ParamType typing improvements. {pr}3371

  • {class}ParamType is now a generic abstract base class, parameterized by its converted value type.
  • {meth}~ParamType.convert return types are narrowed on all concrete types (str for {class}STRING, int for {class}INT, etc.).
  • {meth}~ParamType.to_info_dict returns specific {class}~typing.TypedDict subclasses instead of dict[str, Any].
  • {class}CompositeParamType and the number-range base are now

... (truncated)

Commits

• b2e30a1 Release version 8.4.2
• 7a16b20 Fix package_name resolution when module differs from distribution name (#3582)
• bec5928 Fix package_name resolution when top-level module differs from distribution...
• 916883a Fix tests to not rely on -Wdefault option (#3591)
• 09195f6 Fix double-bracketing of choices in synopsis (#3578)
• 1557e26 Check for warning exception with idiomatic context manager
• d9ff133 Static typing improvements in click.shell_completion (#3460)
• 762c97e Fix double-bracketing of choices in synopsis
• 8929d39 Convert changes to markdown. (#3559)
• 237be50 Move changes headings down a level.
• Additional commits viewable in compare view

Updates uv-build to 0.11.25

Release notes

Sourced from uv-build's releases.

0.11.25

Release Notes

Released on 2026-06-26.

Security

This release updates our tar library, astral-tokio-tar, to v0.6.3, which includes over 20 changes that harden our tar handling against parser differentials. uv may reject source distributions with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Enhancements

• Add a full "lockfile" to tool receipts (#18937)
• Allow scoped overrides to add dependencies (#19974)
• Avoid writing redundant lockfile markers with tool.uv.environments (#19933)
• Factor supported environments out of lockfile markers (#19969)
• Recommend our own build backend in the build frontend (#19994)
• Reject wheels with multiple .dist-info directories (#19986)
• Simplify dependency markers under parent reachability (#19971)
• Support scoped dependency exclusions (#19977)
• Support scoped dependency overrides (#19970)
• Explain why files are skipped in registry index parsing (#19983)

Preview features

• Add uv workspace list --scripts (#20009)
• Support centralised environments in uv venv (#19912)
• Use locked ty versions in uv check (#19884)
• Add centralized storage of project environments (#18214)
• Verify lockfile hashes before reusing a cached ty in uv check (#19995)
• Use locked dependency selection for uv check --script (#19989)

Bug fixes

• Preserve standalone markers in workspace metadata (#20011)
• Reject uv build if the cache dir is enclosed (#19991)

Install uv 0.11.25

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.ps1 | iex"
</tr></table> 

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.11.25

Released on 2026-06-26.

Security

This release updates our tar library, astral-tokio-tar, to v0.6.3, which includes over 20 changes that harden our tar handling against parser differentials. uv may reject source distributions with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Enhancements

• Add a full "lockfile" to tool receipts (#18937)
• Allow scoped overrides to add dependencies (#19974)
• Avoid writing redundant lockfile markers with tool.uv.environments (#19933)
• Factor supported environments out of lockfile markers (#19969)
• Recommend our own build backend in the build frontend (#19994)
• Reject wheels with multiple .dist-info directories (#19986)
• Simplify dependency markers under parent reachability (#19971)
• Support scoped dependency exclusions (#19977)
• Support scoped dependency overrides (#19970)
• Explain why files are skipped in registry index parsing (#19983)

Preview features

• Add uv workspace list --scripts (#20009)
• Support centralised environments in uv venv (#19912)
• Use locked ty versions in uv check (#19884)
• Add centralized storage of project environments (#18214)
• Verify lockfile hashes before reusing a cached ty in uv check (#19995)
• Use locked dependency selection for uv check --script (#19989)

Bug fixes

• Preserve standalone markers in workspace metadata (#20011)
• Reject uv build if the cache dir is enclosed (#19991)

0.11.24

Released on 2026-06-23.

Python

• Add CPython 3.15.0b3 (#19964)

Preview features

• Make project environments relocatable under preview (#19965)

Performance

... (truncated)

Commits

• 1fc7de7 Bump version to 0.11.25 (#20017)
• e0de46e Test tool lock invalidation and upgrades (#20016)
• 7df6bbd Add uv workspace list --scripts (#20009)
• f23ef25 Add a full "lockfile" to tool receipts (#18937)
• 29eb5d2 Preserve standalone markers in workspace metadata (#20011)
• ebf0376 Simplify dependency markers under parent reachability (#19971)
• d8c98e9 Document project environment link return value (#20010)
• cb73f0b Support centralised environments in uv venv (#19912)
• 5fccfe7 Build frontend: simplify is_path_within (#20008)
• 62d8b4e Verify lockfile hashes before reusing a cached ty in uv check (#19995)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions