chore(deps): update python packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
click (changelog)	8.3.1 → 8.4.0
markdown (changelog)	3.10.1 → 3.10.2
mypy (changelog)	1.19.1 → 1.20.2
ni-python-styleguide (changelog)	0.4.8 → 0.5.0
pyright	1.1.408 → 1.1.409
requests (changelog)	2.33.1 → 2.34.2
tomli (changelog)	2.4.0 → 2.4.1

---

Release Notes

pallets/click (click)

v8.4.0

Compare Source

Released 2026-05-17

• :class:ParamType typing improvements. :pr:3371

  • :class:ParamType is now a generic abstract base class,
    parameterized by its converted value type.
  • :meth:~ParamType.convert return types are narrowed on all
    concrete types (str for :class:STRING, int for
    :class:INT, etc.).
  • :meth:~ParamType.to_info_dict returns specific
    :class:~typing.TypedDict subclasses instead of
    dict[str, Any].
  • :class:CompositeParamType and the number-range base are now
    generic with abstract methods.

• Refactor convert_type to extract type inference into a private
  _guess_type helper, and add :func:typing.overload signatures.
  :pr:3372

• :class:Parameter typing improvements. :pr:2805

  • :class:Parameter is now an abstract base class, making explicit
    that it cannot be instantiated directly.
  • :attr:Parameter.name is now str instead of str | None.
    When expose_value=False, the name is set to "" instead
    of None.
  • The ctx parameter of :meth:Parameter.get_error_hint is now
    typed as Context | None, matching the runtime behavior.

• Split string values from default_map for parameters with nargs > 1
  or :class:Tuple type, matching environment variable behavior.
  :issue:2745 :pr:3364

• Auto-detect type=UNPROCESSED for flag_value of non-basic types
  (not str, int, float, or bool), so programmer-provided
  Python objects like classes and enum members are passed through unchanged
  instead of being stringified. Previously type=click.UNPROCESSED had
  to be set explicitly. :issue:2012 :pr:3363

• The error hint now uses :meth:Command.get_help_option_names to pick
  non-shadowed help option names, so Try '... -h' no longer points to a
  subcommand option that shadows -h. The longest surviving name is
  shown (--help over -h) for readability. :issue:2790 :pr:3208

• Fix readline functionality on non-Windows platforms. Prompt text is now
  passed directly to readline instead of being printed separately, allowing
  proper backspace, line editing, and line wrapping behavior. :issue:2968
  :pr:2969

• Use :func:os.startfile on Windows to open URLs in :func:open_url,
  replacing the start built-in which cannot be invoked without
  shell=True. :issue:3164 :pr:3186

• Fix Fish shell completion errors when option help text contains newlines.
  :issue:3043 :pr:3126

• Add :class:NoSuchCommand exception with suggestions for misspelled
  commands. :issue:3107 :pr:3228

• Use :class:ValueError message when conversion in :class:FuncParamType would
  fail. :issue:3105 :pr:3211

• Add click.get_pager_file for file-like access to an output
  pager. :pr:1572 :pr:3405

• :func:~click.formatting.wrap_text now measures line width in visible
  characters, ignoring ANSI escape sequences. :pr:3420

• Fix :meth:HelpFormatter.write_usage emitting only a blank line when
  called without args. The usage prefix and program name are now
  written even when no arguments follow, and the trailing separator
  space is stripped so the line ends at the program name.
  :issue:3360 :pr:3434

• Show custom error messages from types when :func:prompt with
  hide_input=True fails validation, instead of always showing a
  generic message. Built-in type messages mask the input value.
  :issue:2809 :pr:3256

• Add capture parameter to :class:CliRunner with two modes: sys
  (default) and fd. fd redirects file descriptors 1 and 2
  via :func:os.dup2 so output that bypasses sys.stdout (stale stream
  references, C extensions, subprocesses, faulthandler) is captured
  with proper isolation. :issue:854 :issue:2412 :issue:2468
  :issue:2497 :issue:2761 :issue:2827 :issue:2865 :pr:3391

• Revert the 8.3.3 change that exposed the original file descriptor
  via fileno() on the redirected CliRunner streams in the default
  capture mode. os.dup2(w, sys.stdout.fileno()) calls inside a CLI no
  longer mutate the host runner's stdout, which broke Pytest's fd-level
  capture teardown. C-level consumers that need a real fd should use
  capture="fd". :issue:3384 :pr:3391

• Mark additional built-in strings with gettext() to extend translation
  coverage. :pr:2902

• Fix feature switch groups (several flag_value options sharing one
  parameter name) silently dropping an explicit default when a sibling
  option without an explicit default was declared first. Arbitration is now
  source-aware: a more explicit :class:ParameterSource always wins, and
  within ParameterSource.DEFAULT, an option that received an explicit
  default= keyword wins over a sibling whose default was auto-derived.
  The 8.3.x first-wins fallback for remaining ties was reverted to the
  pre-8.3.x last-wins fallback. :issue:3403 :pr:3404

• Fix missing space between option help text and the (DEPRECATED)
  label, and localize the option label so it matches the command label.
  The label and the DeprecationWarning reason suffix are now produced
  by shared helpers. :pr:3423

• Document short option stacking (-abc is parsed as -a -b -c) and
  clarify that multi-character short option names are not supported.
  :issue:2779 :pr:3431

v8.3.3

Compare Source

v8.3.2

Compare Source

Released 2026-04-02

• Fix handling of flag_value when is_flag=False to allow such options to be
  used without an explicit value. :issue:3084 :pr:3152
• Hide Sentinel.UNSET values as None when using lookup_default().
  :issue:3136 :pr:3199 :pr:3202 :pr:3209 :pr:3212 :pr:3224
• Prevent _NamedTextIOWrapper from closing streams owned by StreamMixer.
  :issue:824 :issue:2991 :issue:2993 :issue:3110 :pr:3139 :pr:3140
• Add comprehensive tests for CliRunner stream lifecycle, covering
  logging interaction, multi-threaded safety, and sequential invocation
  isolation. Add high-iteration stress tests behind a stress marker
  with a dedicated CI job. :pr:3139
• Fix callable flag_value being instantiated when used as a default via
  default=True. :issue:3121 :pr:3201 :pr:3213 :pr:3225

Python-Markdown/markdown (markdown)

v3.10.2

Compare Source

Fixed

• Fix a regression related to comment handling (#​1590).
• More reliable fix for </ (#​1593).

python/mypy (mypy)

v1.20.2

Compare Source

v1.20.1

Compare Source

• Always disable sync in SQLite cache (Ivan Levkivskyi, PR 21184)
• Temporarily skip few base64 tests (Ivan Levkivskyi, PR 21193)
• Revert dict.__or__ typeshed change (Ivan Levkivskyi, PR 21186)
• Fix narrowing for match case with variadic tuples (Shantanu, PR 21192)
• Avoid narrowing type[T] in type calls (Shantanu, PR 21174)
• Fix regression for catching empty tuple in except (Shantanu, PR 21153)
• Fix reachability for frozenset and dict view narrowing (Shantanu, PR 21151)
• Fix narrowing with chained comparison (Shantanu, PR 21150)
• Avoid narrowing to unreachable at module level (Shantanu, PR 21144)
• Allow dangerous identity comparisons to Any typed variables (Shantanu, PR 21142)
• --warn-unused-config should not be a strict flag (Ivan Levkivskyi, PR 21139)

v1.20.0

Compare Source

ni/python-styleguide (ni-python-styleguide)

v0.5.0: - Adopt flake8-tidy-imports

Compare Source

Added

• Add vim/neovim integration instructions to README (#​205)
• Add VSCode integration instructions to README (#​222)
• Adopt flake8-tidy-imports to enforce O.1.5 (#​223)
• Add fallbacks to _get_application_import_names (#​234)
• Make format command (#​221)

Changed

• Drop Python 3.7 support (#​218)
• Drop Python 3.8 support (#​235)

Fixed

• Fix formatting files with unicode (#​242)
• Fix acknowledge when run on multiple files (#​244)

Details

What's Changed

• README: Add vim/neovim integration instructions by @​mbr0wn in #​205
• poetry-lock-update - skip PR if no changes by @​mshafer-NI in #​213
• Update poetry lock file and poetry and python versions in pipelines by @​mshafer-NI in #​216
• Drop Python 3.7 support by @​mshafer-NI in #​218
• make format command by @​mshafer-NI in #​221
• Dev/update_readme by @​mshafer-NI in #​222
• adopt flake8-tidy-imports to enforce O.1.5 by @​mshafer-NI in #​223
• pin to 0.18 because 0.19 is broken by @​mshafer-NI in #​225
• update publishing flow to use ni/python-actions by @​mshafer-NI in #​227
• Update _get_application_import_names to have fall-backs by @​mjohanse-emr in #​234
• github: Upgrade from ubuntu-20.04 to ubuntu-latest by @​bkeryan in #​238
• Configure Renovate by @​renovate[bot] in #​239
• Add self to code owners by @​mshafer-NI in #​243
• Fix formatting files with unicode by @​mshafer-NI in #​242
• Fix acknowledge when run on multiple files by @​mshafer-NI in #​244
• adopt ni/python-actions for PR builds by @​mshafer-NI in #​235
• pyproject.toml: Update dev-dependency syntax and build system by @​bkeryan in #​249
• add a pip install and lint to the PR build to validate install time deps without the lock by @​mshafer-NI in #​182
• add bkeryan as another alt by @​mshafer-NI in #​261
• disable upgrading flake8-import-order by @​mshafer-NI in #​260
• mark flake8-spellcheck as a rejected plugin by @​mshafer-NI in #​272
• fix: Work around "No module named 'pkg_resources'" by pinning setuptools to <82 by @​bkeryan in #​275
• Delete .github/workflows/Update-Poetry-Lock.yml by @​mshafer-NI in #​278
• Add changelog by @​mshafer-NI in #​287
• Also prevent setuptools from getting upgraded by @​mshafer-NI in #​289
• github: Fix outdated aspects of Comment-on-PR.yml and Notify-Convention-Change.yml by @​bkeryan in #​291
• Update CHANGELOG to reflect that support for Python 3.8 is also removed in the upcoming release by @​mshafer-NI in #​294
• Bring black pin forward from 0.4.x by @​mshafer-NI in #​295

New Contributors

• @​mjohanse-emr made their first contribution in #​234
• @​renovate[bot] made their first contribution in #​239

Full Changelog: ni/python-styleguide@v0.4.9...v0.5.0

v0.4.9

Compare Source

Fixed

• Work around "No module named 'pkg_resources'" by pinning setuptools to <82 (#​275)

RobertCraigie/pyright-python (pyright)

v1.1.409

Compare Source

psf/requests (requests)

v2.34.2

Compare Source

• Moved headers input type back to Mapping to avoid invariance issues
  with MutableMapping and inferred dict types. Users calling
  Request.headers.update() may need to narrow typing in their code. (#​7441)

v2.34.1

Compare Source

Bugfixes

• Widened json input type from dict and list to Mapping
  and Sequence. (#​7436)
• Changed headers input type to MutableMapping and removed None from
  Request.headers typing to improve handling for users. (#​7431)
• Response.reason moved from str | None to str to improve handling
  for users. (#​7437)
• Fixed a bug where some bodies with custom __getattr__ implementations
  weren't being properly detected as Iterables. (#​7433)

v2.34.0

Compare Source

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by
  typeshed. Public API types should be fully compatible with mypy, pyright,
  and ty. We believe types are comprehensive but if you find issues, please
  report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for
  helping review and test the types ahead of the release. (#​7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify
  security considerations. (#​7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects
  should be able to start testing prior to its release in October. (#​7422)
• Requests added support for Python 3.14t. (#​7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing
  accidental looping when traversing the history list. (#​7328)
• Requests no longer performs greedy matching on no_proxy domains. The
  proxy_bypass implementation has been updated with CPython's fix from
  bpo-39057. (#​7427)
• Requests no longer incorrectly strips duplicate leading slashes in
  URI paths. This should address user issues with specific presigned
  URLs. Note the full fix requires urllib3 2.7.0+. (#​7315)

hukkin/tomli (tomli)

v2.4.1

Compare Source

• Fixed
  • Limit number of parts of a TOML key to address quadratic time complexity

---

Configuration

📅 Schedule: (in timezone US/Central)

• Branch creation
  • Only on Sunday (* * * * 0)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bkeryan]

FYI @mshafer-NI It says the renovate/stability-days check passed, but the updated lock files include mypy 2.1.0, which was released on 5/11/2026. I wonder if Renovate failed to add an "artifact error" because mypy 2.1.0 is in the "major" bucket, which would normally get a separate PR.