chore(deps): update all non-major dependencies (minor)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
click (changelog)	==8.3.3 → ==8.4.0
requests (changelog)	==2.33.1 → ==2.34.2
uvicorn (changelog)	==0.46.0 → ==0.47.0

---

Release Notes

pallets/click (click)

v8.4.0

Compare Source

Unreleased

• :class:ParamType typing improvements. :pr:3371

  • :class:ParamType is now a generic abstract base class,
    parameterized by its converted value type.
  • :meth:~ParamType.convert return types are narrowed on all
    concrete types (str for :class:STRING, int for
    :class:INT, etc.).
  • :meth:~ParamType.to_info_dict returns specific
    :class:~typing.TypedDict subclasses instead of
    dict[str, Any].
  • :class:CompositeParamType and the number-range base are now
    generic with abstract methods.

• Refactor convert_type to extract type inference into a private
  _guess_type helper, and add :func:typing.overload signatures.
  :pr:3372

• :class:Parameter typing improvements. :pr:2805

  • :class:Parameter is now an abstract base class, making explicit
    that it cannot be instantiated directly.
  • :attr:Parameter.name is now str instead of str | None.
    When expose_value=False, the name is set to "" instead
    of None.
  • The ctx parameter of :meth:Parameter.get_error_hint is now
    typed as Context | None, matching the runtime behavior.

• Split string values from default_map for parameters with nargs > 1
  or :class:Tuple type, matching environment variable behavior.
  :issue:2745 :pr:3364

• Auto-detect type=UNPROCESSED for flag_value of non-basic types
  (not str, int, float, or bool), so programmer-provided
  Python objects like classes and enum members are passed through unchanged
  instead of being stringified. Previously type=click.UNPROCESSED had
  to be set explicitly. :issue:2012 :pr:3363

• The error hint now uses :meth:Command.get_help_option_names to pick
  non-shadowed help option names, so Try '... -h' no longer points to a
  subcommand option that shadows -h. All surviving names are shown
  (-h/--help). :issue:2790 :pr:3208

• Fix readline functionality on non-Windows platforms. Prompt text is now
  passed directly to readline instead of being printed separately, allowing
  proper backspace, line editing, and line wrapping behavior. :issue:2968
  :pr:2969

• Use :func:os.startfile on Windows to open URLs in :func:open_url,
  replacing the start built-in which cannot be invoked without
  shell=True. :issue:3164 :pr:3186

• Fix Fish shell completion errors when option help text contains newlines.
  :issue:3043 :pr:3126

• Add :class:NoSuchCommand exception with suggestions for misspelled
  commands. :issue:3107 :pr:3228

• Use :class:ValueError message when conversion in :class:FuncParamType would
  fail. :issue:3105 :pr:3211

• Add click.get_pager_file for file-like access to an output
  pager. :pr:1572 :pr:3405

• :class:~click.formatting.TextWrapper and
  :func:~click.formatting.wrap_text now measure line width in visible
  characters, ignoring ANSI escape sequences. :pr:3420

• Fix :meth:HelpFormatter.write_usage emitting only a blank line when
  called without args. The usage prefix and program name are now
  written even when no arguments follow, and the trailing separator
  space is stripped so the line ends at the program name.
  :issue:3360 :pr:3434

• Show custom error messages from types when :func:prompt with
  hide_input=True fails validation, instead of always showing a
  generic message. Built-in type messages mask the input value.
  :issue:2809 :pr:3256

• Add capture parameter to :class:CliRunner with two modes: sys
  (default) and fd. fd redirects file descriptors 1 and 2
  via :func:os.dup2 so output that bypasses sys.stdout (stale stream
  references, C extensions, subprocesses, faulthandler) is captured
  with proper isolation. :issue:854 :issue:2412 :issue:2468
  :issue:2497 :issue:2761 :issue:2827 :issue:2865

• Revert the 8.3.3 change that exposed the original file descriptor
  via fileno() on the redirected CliRunner streams in the default
  capture mode. os.dup2(w, sys.stdout.fileno()) calls inside a CLI no
  longer mutate the host runner's stdout, which broke Pytest's fd-level
  capture teardown. C-level consumers that need a real fd should use
  capture="fd". :issue:3384 :pr:3391

• Mark additional built-in strings with gettext() to extend translation
  coverage. :pr:2902

• Fix feature switch groups (several flag_value options sharing one
  parameter name) silently dropping an explicit default when a sibling
  option without an explicit default was declared first. Arbitration is now
  source-aware: a more explicit :class:ParameterSource always wins, and
  within ParameterSource.DEFAULT, an option that received an explicit
  default= keyword wins over a sibling whose default was auto-derived.
  The 8.3.x first-wins fallback for remaining ties was reverted to the
  pre-8.3.x last-wins fallback. :issue:3403 :pr:3404

• Fix missing space between option help text and the (DEPRECATED)
  label, and localize the option label so it matches the command label.
  The label and the DeprecationWarning reason suffix are now produced
  by shared helpers. :pr:3423

• Document short option stacking (-abc is parsed as -a -b -c) and
  clarify that multi-character short option names are not supported.
  :issue:2779 :pr:3431

psf/requests (requests)

v2.34.2

Compare Source

• Moved headers input type back to Mapping to avoid invariance issues
  with MutableMapping and inferred dict types. Users calling
  Request.headers.update() may need to narrow typing in their code. (#​7441)

v2.34.1

Compare Source

Bugfixes

• Widened json input type from dict and list to Mapping
  and Sequence. (#​7436)
• Changed headers input type to MutableMapping and removed None from
  Request.headers typing to improve handling for users. (#​7431)
• Response.reason moved from str | None to str to improve handling
  for users. (#​7437)
• Fixed a bug where some bodies with custom __getattr__ implementations
  weren't being properly detected as Iterables. (#​7433)

v2.34.0

Compare Source

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by
  typeshed. Public API types should be fully compatible with mypy, pyright,
  and ty. We believe types are comprehensive but if you find issues, please
  report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for
  helping review and test the types ahead of the release. (#​7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify
  security considerations. (#​7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects
  should be able to start testing prior to its release in October. (#​7422)
• Requests added support for Python 3.14t. (#​7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing
  accidental looping when traversing the history list. (#​7328)
• Requests no longer performs greedy matching on no_proxy domains. The
  proxy_bypass implementation has been updated with CPython's fix from
  bpo-39057. (#​7427)
• Requests no longer incorrectly strips duplicate leading slashes in
  URI paths. This should address user issues with specific presigned
  URLs. Note the full fix requires urllib3 2.7.0+. (#​7315)

Kludex/uvicorn (uvicorn)

v0.47.0: Version 0.47.0

Compare Source

What's Changed

• Eagerly import the ASGI app in the parent process by @​Kludex in #​2919
• Add ssl_context_factory for custom SSLContext configuration by @​Kludex in #​2920
• Treat fd=0 as a valid file descriptor with reload/workers by @​eltoder in #​2927

Full Changelog: Kludex/uvicorn@0.46.0...0.47.0

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.