build(deps): bump the uv-dependencies group with 5 updates

[dependabot]

Updates the requirements on click, basedpyright, poethepoet, ruff and uv-build to permit the latest version.
Updates click from 8.4.1 to 8.4.2

Release notes

Sourced from click's releases.

8.4.2

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.2/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-2 Milestone: https://github.com/pallets/click/milestone/34

• Fix Fish shell completion broken in 8.4.0 by #3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. #3502 #3043 #3504 #3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. #3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. #3059 #3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. #3242 #2542 #3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from #3482. #3449 #3533
• Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. #3578
• {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. #2331 #1884 #3125 #3582

Changelog

Sourced from click's changelog.

Version 8.4.2

Unreleased

• Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. {issue}3502 {issue}3043 {pr}3504 {pr}3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. {pr}3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. {issue}3059 {pr}3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. {issue}3242 {issue}2542 {pr}3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from {pr}3482. {issue}3449 {pr}3533

Commits

• b2e30a1 Release version 8.4.2
• 7a16b20 Fix package_name resolution when module differs from distribution name (#3582)
• bec5928 Fix package_name resolution when top-level module differs from distribution...
• 916883a Fix tests to not rely on -Wdefault option (#3591)
• 09195f6 Fix double-bracketing of choices in synopsis (#3578)
• 1557e26 Check for warning exception with idiomatic context manager
• d9ff133 Static typing improvements in click.shell_completion (#3460)
• 762c97e Fix double-bracketing of choices in synopsis
• 8929d39 Convert changes to markdown. (#3559)
• 237be50 Move changes headings down a level.
• Additional commits viewable in compare view

Updates basedpyright from 1.39.8 to 1.39.9

Commits

• 2802042 fix pnpm view command and simplify the outcome check
• f6e62d3 fix crash during publish
• 816614e 1.39.9
• c79697f remove more webpack remnants
• 2921109 microsoft/vscode-vsce#421
• 5812074 fix new test from upstream. that representation of a paramspec is wrong, espe...
• eaaaf62 prettier ignore new files from upstream
• 8baf13e switch to pnpm because npm is the worst package manager ever made.
• f228a80 fixes from merge
• 2170274 Merge tag '1.1.411' into merge-1.1.411
• Additional commits viewable in compare view

Updates poethepoet from 0.46.0 to 0.47.0

Release notes

Sourced from poethepoet's releases.

0.47.0

Enhancements

• Add buffer output_mode for parallel tasks by @​nat-n in nat-n/poethepoet#400
• Generate official JSON Schema for poe section in pyproject based on PoeOptions and improve some validation edge cases by @​nat-n in nat-n/poethepoet#392 nat-n/poethepoet#389 nat-n/poethepoet#398
• Support declared args on script tasks targeting modules by @​nat-n in nat-n/poethepoet#396
• Respect the FORCE_COLOR environment variable by @​nat-n in nat-n/poethepoet#403

Fixes

• Executor config validation now rejects unknown keys by @​nat-n in nat-n/poethepoet#391
• Support src-layout python path resolution for script, expr, and include_script by @​nat-n in nat-n/poethepoet#397
• Fully support all three CLI styles for multi-value args by @​nat-n in nat-n/poethepoet#402

AI Agent Skill 🤖

• The poethepoet skill is now documented and ready for use @​nat-n in nat-n/poethepoet#404
• Improve coverage of expr/switch config semantics and edge cases by @​nat-n in nat-n/poethepoet#401

Install the skill via one of the following methods:

1. Via a built in poe task (similar to how shell completions are installed):

poe _install_skill                          # auto-detects .claude/.codex/.pi/.agents and prompts
poe _install_skill ~/.claude/skills         # explicit path (substitute your agent's dir)
poe _install_skill <skills-dir> --upgrade   # non-interactive upgrade (skips if same/newer)

2. From github via npx skills

npx skills add https://github.com/nat-n/poethepoet/tree/v0.46.0/poethepoet/skills/poethepoet

Full Changelog: nat-n/poethepoet@v0.46.0...v0.47.0

Commits

• 9231083 Bump version to 0.47.0
• 994d8ed docs(skill): improve and document SKILL.md based on feedback (#404)
• 0478c10 fix(args): support all three CLI styles for multi-value args (#402)
• 8dc4399 feat: respect the FORCE_COLOR environment variable (#403)
• fe6828b feat: Add buffer output_mode for parallel tasks (#400)
• 548ea9c docs(skill): improve coverage of expr/switch config semantics and edge cases ...
• 5bcd09f refactor: emit strict-mode-compatible forbidden-property encoding (#398)
• 12b850c fix: src-layout python path resolution for script, expr, and include_script (...
• 7f59fd2 feat: support declared args on script tasks targeting modules (#396)
• 0bcda26 feat: Add task to generate JSON Schema based on PoeOptions (#392)
• Additional commits viewable in compare view

Updates ruff from 0.15.18 to 0.15.20

Release notes

Sourced from ruff's releases.

0.15.20

Release Notes

Released on 2026-06-25.

Preview features

• Allow human-readable names in rule selectors (#25887)
• Emit a warning instead of an error for unknown rule selectors (#26113)
• Match noqa shebang handling in ruff:ignore comments (#26286)
• [ruff] Remove pytest-fixture-autouse (RUF076) (#26240, #26371)

Documentation

• Add versioning sections to custom crate READMEs (#26317)
• Update ruff_python_parser README for crates.io (#26315)
• [perflint] Clarify that PERF402 applies to any iterable (#26242)

Contributors

• @​dhruvmanila
• @​MichaReiser
• @​ntBre
• @​trilamsr

Install ruff 0.15.20

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.20/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.15.20/ruff-installer.ps1 | iex"

Download ruff 0.15.20

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.20

Released on 2026-06-25.

Preview features

• Allow human-readable names in rule selectors (#25887)
• Emit a warning instead of an error for unknown rule selectors (#26113)
• Match noqa shebang handling in ruff:ignore comments (#26286)
• [ruff] Remove pytest-fixture-autouse (RUF076) (#26240, #26371)

Documentation

• Add versioning sections to custom crate READMEs (#26317)
• Update ruff_python_parser README for crates.io (#26315)
• [perflint] Clarify that PERF402 applies to any iterable (#26242)

Contributors

• @​dhruvmanila
• @​MichaReiser
• @​ntBre
• @​trilamsr

0.15.19

Released on 2026-06-23.

Preview features

• Support human-readable names when hovering suppression comments and in code actions (#26114)

Bug fixes

• Fall back to default settings when editor-only settings are invalid (#26244)
• Fix panic when inserting text at a notebook cell boundary (#26111)

Rule changes

• [pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801) (#26239)

Performance

• Avoid allocating when parsing single string literals (#26200)
• Avoid reallocating singleton call arguments (#26223)
• Lazily create source files for lint diagnostics (#26226)
• Optimize formatter text width and indentation (#26236)
• Reserve capacity for builtin bindings (#26229)
• Skip repeated-key checks for singleton dictionaries (#26228)
• Use ArrayVec for qualified name segments (#26224)

... (truncated)

Commits

• f82a36b Bump 0.15.20 (#26376)
• af32943 Improve the summarise-ecosystem-results skill (#26378)
• 485ebab Remove RUF076 name from schema (#26371)
• ef81835 [ty] Implement rust-analyzer's "Click for full compiler diagnostic" feature (...
• 572b31e [ruff] Remove pytest-fixture-autouse (RUF076) (#26240)
• f703f21 Allow human-readable names in rule selectors (#25887)
• 0d726b2 [ty] Reuse equality semantics for membership compatibility (#25955)
• dbe6e98 [ty] Infer definite equality comparison results (#26337)
• e700ea3 [ty] Prove TypedDict structural patterns exhaustive (#26285)
• 6a0d2ec [ty] Widen inferred class-valued instance attributes (#26338)
• Additional commits viewable in compare view

Updates uv-build to 0.11.25

Release notes

Sourced from uv-build's releases.

0.11.25

Release Notes

Released on 2026-06-26.

Security

This release updates our tar library, astral-tokio-tar, to v0.6.3, which includes over 20 changes that harden our tar handling against parser differentials. uv may reject source distributions with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Enhancements

• Add a full "lockfile" to tool receipts (#18937)
• Allow scoped overrides to add dependencies (#19974)
• Avoid writing redundant lockfile markers with tool.uv.environments (#19933)
• Factor supported environments out of lockfile markers (#19969)
• Recommend our own build backend in the build frontend (#19994)
• Reject wheels with multiple .dist-info directories (#19986)
• Simplify dependency markers under parent reachability (#19971)
• Support scoped dependency exclusions (#19977)
• Support scoped dependency overrides (#19970)
• Explain why files are skipped in registry index parsing (#19983)

Preview features

• Add uv workspace list --scripts (#20009)
• Support centralised environments in uv venv (#19912)
• Use locked ty versions in uv check (#19884)
• Add centralized storage of project environments (#18214)
• Verify lockfile hashes before reusing a cached ty in uv check (#19995)
• Use locked dependency selection for uv check --script (#19989)

Bug fixes

• Preserve standalone markers in workspace metadata (#20011)
• Reject uv build if the cache dir is enclosed (#19991)

Install uv 0.11.25

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.ps1 | iex"
</tr></table> 

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.11.25

Released on 2026-06-26.

Security

This release updates our tar library, astral-tokio-tar, to v0.6.3, which includes over 20 changes that harden our tar handling against parser differentials. uv may reject source distributions with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Enhancements

• Add a full "lockfile" to tool receipts (#18937)
• Allow scoped overrides to add dependencies (#19974)
• Avoid writing redundant lockfile markers with tool.uv.environments (#19933)
• Factor supported environments out of lockfile markers (#19969)
• Recommend our own build backend in the build frontend (#19994)
• Reject wheels with multiple .dist-info directories (#19986)
• Simplify dependency markers under parent reachability (#19971)
• Support scoped dependency exclusions (#19977)
• Support scoped dependency overrides (#19970)
• Explain why files are skipped in registry index parsing (#19983)

Preview features

• Add uv workspace list --scripts (#20009)
• Support centralised environments in uv venv (#19912)
• Use locked ty versions in uv check (#19884)
• Add centralized storage of project environments (#18214)
• Verify lockfile hashes before reusing a cached ty in uv check (#19995)
• Use locked dependency selection for uv check --script (#19989)

Bug fixes

• Preserve standalone markers in workspace metadata (#20011)
• Reject uv build if the cache dir is enclosed (#19991)

0.11.24

Released on 2026-06-23.

Python

• Add CPython 3.15.0b3 (#19964)

Preview features

• Make project environments relocatable under preview (#19965)

Performance

... (truncated)

Commits

• 1fc7de7 Bump version to 0.11.25 (#20017)
• e0de46e Test tool lock invalidation and upgrades (#20016)
• 7df6bbd Add uv workspace list --scripts (#20009)
• f23ef25 Add a full "lockfile" to tool receipts (#18937)
• 29eb5d2 Preserve standalone markers in workspace metadata (#20011)
• ebf0376 Simplify dependency markers under parent reachability (#19971)
• d8c98e9 Document project environment link return value (#20010)
• cb73f0b Support centralised environments in uv venv (#19912)
• 5fccfe7 Build frontend: simplify is_path_within (#20008)
• 62d8b4e Verify lockfile hashes before reusing a cached ty in uv check (#19995)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions