Bump click from 8.4.2 to 8.5.0

[dependabot]

Bumps click from 8.4.2 to 8.5.0.

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits

• 8b19813 Release version 8.5.0
• 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
• 131c86a Add FAQ entry about UnicodeEncodeError on Windows
• e1fd594 Add support of pathlib.Path to edit (#3781)
• a1d8785 Add support of pathlib.Path to edit
• 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
• a6256bf Forwards all user's parameters set in PAGER
• 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
• 9835b0f Resolve the pager command once, in _pager_contextmanager
• f36d58b Refactor pager stream handling (#3767)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, pip, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
progressbar	Ready	Preview	Aug 31, 2026 11:54am

[guibranco]

Automatically approved by gstraccini[bot]

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	click@​8.4.2 ⏵ 8.5.0	+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Embedded URLs or IPs: pypi click URLs: https://github.com/pallets/click/issues/%s, https://github.com/pallets/click/pull/%s, https://docs.python.org/3/, https://palletsprojects.com/donate, https://pypi.org/project/click/, https://github.com/pallets/click/, https://github.com/pallets/click/issues/, https://discord.gg/pallets, https://docs.python.org/3/library/subprocess.html#popen-constructor, https://docs.python.org/3/library/textwrap.html#textwrap.TextWrapper, https://github.com/python/cpython/blob/main/Lib/textwrap.py, https://peps.python.org/pep-0661/, https://click.palletsprojects.com/en/stable/advanced/#callback-evaluation-order, https://docs.python.org/3/library/os.html#os.environ, https://github.com/pallets/click/issues/3084, https://github.com/pallets/click/discussions/3527, https://en.wikipedia.org/wiki/ANSI_color, https://gist.github.com/XVilka/8346728, https://click.palletsprojects.com/, https://github.com/pallets/click/issues/2819, https://github.com/pallets/click/issues/3024#issuecomment-3146199461, https://github.com/pallets/click/pull/3728, https://github.com/pallets/click/pull/2811, https://github.com/pallets/click/issues/3136, https://github.com/pallets/click/issues/3145, https://github.com/pallets/click/issues/3458, https://github.com/pallets/click/pr/3199, https://github.com/pallets/click/issues/3121, https://github.com/pallets/click/issues/2745, https://github.com/pallets/click/pull/3224#issuecomment-3968643305, https://github.com/pallets/click/issues/2790, https://github.com/pallets/click/issues/3298, https://github.com/pallets/click/pull/3030#discussion_r2271571819, https://github.com/pallets/click/pull/3030#pullrequestreview-3106604795, https://github.com/pallets/click/pull/3030#pullrequestreview-3108471552, https://github.com/pallets/click/issues/3024#issuecomment-3146511356, https://github.com/pallets/click/issues/3024#issuecomment-3146480714, https://github.com/pallets/click/issues/2012#issuecomment-892437060, https://github.com/pallets/click/issues/3024#issuecomment-3146508536, https://github.com/pallets/click/issues/2012#issue-946471049, https://github.com/pallets/click/issues/2012, https://github.com/pallets/click/issues/2610, https://github.com/pallets/click/issues/3403, https://github.com/pallets/click/issues/1992, https://github.com/pallets/click/issues/2809, https://github.com/pallets/click/issues/2634, https://github.com/pallets/click/issues/2968, https://github.com/pallets/click/pull/2969, https://click.palletsprojects.com/en/stable/advanced/#command-aliases, https://click.palletsprojects.com/en/stable/options/#yes-parameters, https://click.palletsprojects.com/en/stable/quickstart/#adding-parameters, https://github.com/pallets/click#a-simple-example, https://click.palletsprojects.com/en/stable/options/#callbacks-and-eager-options Location: Package overview From: requirements.txt → pypi/click@8.5.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/click@8.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: pypi click URLs: https://docs.python.org/3/library/subprocess.html#popen-constructor, https://docs.python.org/3/library/textwrap.html#textwrap.TextWrapper, https://github.com/python/cpython/blob/main/Lib/textwrap.py, https://peps.python.org/pep-0661/, https://click.palletsprojects.com/en/stable/advanced/#callback-evaluation-order, https://docs.python.org/3/library/os.html#os.environ, https://github.com/pallets/click/issues/3084, https://github.com/pallets/click/discussions/3527, https://en.wikipedia.org/wiki/ANSI_color, https://gist.github.com/XVilka/8346728, https://click.palletsprojects.com/ Location: Package overview From: requirements.txt → pypi/click@8.5.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/click@8.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

Infisical secrets check: ✅ No secrets leaked!

💻 Scan logs

2026-08-31T11:54:50Z INF scanning for exposed secrets...
11:54AM INF 158 commits scanned.
2026-08-31T11:54:50Z INF scan completed in 24.6ms
2026-08-31T11:54:50Z INF no leaks found

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}