build(deps): bump the minor-and-patch group in /scripts with 4 updates

[dependabot]

Bumps the minor-and-patch group in /scripts with 4 updates: click, feedparser, packaging and platformdirs.

Updates click from 8.4.1 to 8.4.2

Release notes

Sourced from click's releases.

8.4.2

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.2/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-2 Milestone: https://github.com/pallets/click/milestone/34

• Fix Fish shell completion broken in 8.4.0 by #3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. #3502 #3043 #3504 #3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. #3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. #3059 #3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. #3242 #2542 #3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from #3482. #3449 #3533
• Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. #3578
• {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. #2331 #1884 #3125 #3582

Changelog

Sourced from click's changelog.

Version 8.4.2

Released 2026-06-24

• Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. {issue}3502 {issue}3043 {pr}3504 {pr}3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. {pr}3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. {issue}3059 {pr}3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. {issue}3242 {issue}2542 {pr}3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from {pr}3482. {issue}3449 {pr}3533
• Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. {pr}3578
• {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. {issue}2331 {issue}1884 {issue}3125 {pr}3582

Commits

• b2e30a1 Release version 8.4.2
• 7a16b20 Fix package_name resolution when module differs from distribution name (#3582)
• bec5928 Fix package_name resolution when top-level module differs from distribution...
• 916883a Fix tests to not rely on -Wdefault option (#3591)
• 09195f6 Fix double-bracketing of choices in synopsis (#3578)
• 1557e26 Check for warning exception with idiomatic context manager
• d9ff133 Static typing improvements in click.shell_completion (#3460)
• 762c97e Fix double-bracketing of choices in synopsis
• 8929d39 Convert changes to markdown. (#3559)
• 237be50 Move changes headings down a level.
• Additional commits viewable in compare view

Updates feedparser from 6.0.12 to 6.0.14

Release notes

Sourced from feedparser's releases.

v6.0.14

Changed

• Upgrade to feedparser-sgmllib 2.0.0. (#585)

v6.0.13

Python support

• Drop support for Python 3.9 and lower.

Changed

• Migrate from sgmllib3k to feedparser-sgmllib.

Fixed

• Resolve package build warnings.

Changelog

Sourced from feedparser's changelog.

6.0.14 - 2026-07-30

• Upgrade to feedparser-sgmllib 2.0.0. (#585)

6.0.13 - 2026-07-28

Python support

• Drop support for Python 3.9 and lower.

Changed

• Migrate from sgmllib3k to feedparser-sgmllib.

Fixed

• Resolve package build warnings.

Commits

• 14425f6 Hotfix v6.0.14 (#586)
• 64757d0 Update project metadata
• 67ad0ed Upgrade to feedparser-sgmllib 2.x
• c1c7d72 Hotfix 6.0.13 (#582)
• 587b7d6 Update project metadata
• 5eb46d2 Migrate from sgmllib3k to feedparser-sgmllib
• See full diff in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates platformdirs from 4.9.6 to 4.11.0

Release notes

Sourced from platformdirs's releases.

4.11.0

What's Changed

• 👷 ci: run the test suite against Python 3.15 by @​gaborbernat in tox-dev/platformdirs#512

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

4.10.1

What's Changed

• 🐛 fix(windows): stop leaking memory on repeated folder lookups by @​gaborbernat in tox-dev/platformdirs#507
• 🚀 ci(release): towncrier changelog + publish on tag push by @​gaborbernat in tox-dev/platformdirs#509
• 📝 docs(changelog): rebuild against release history by @​gaborbernat in tox-dev/platformdirs#510

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

4.10.0

What's Changed

• chore: improve platformdirs maintenance path by @​lphuc2250gma in tox-dev/platformdirs#488
• ✨ feat: add user_projects_dir for $XDG_PROJECTS_DIR by @​gaborbernat in tox-dev/platformdirs#490
• ✨ feat: add user_publicshare_dir, user_templates_dir, user_fonts_dir, user_preference_dir by @​gaborbernat in tox-dev/platformdirs#491

New Contributors

• @​lphuc2250gma made their first contribution in tox-dev/platformdirs#488

Full Changelog: tox-dev/platformdirs@4.9.6...4.10.0

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.1 (2026-08-07)

---

• Fix :func:~platformdirs.user_desktop_dir on Windows builds without ctypes. CSIDL_DESKTOPDIRECTORY appeared only in the ctypes lookup table, so the registry and environment variable resolvers raised ValueError for it. :pr:519

---

4.11.0 (2026-07-21)

---

• Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

---

4.10.1 (2026-07-18)

---

• Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

---

4.10.0 (2026-05-28)

---

• Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
• Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
• Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

---

4.9.6 (2026-04-09)

---

• Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen
• Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

---

4.9.4 (2026-03-05)

... (truncated)

Commits

• 2140495 Release 4.11.0
• a562df9 👷 ci: run the test suite against Python 3.15 (#512)
• 7c764c4 [pre-commit.ci] pre-commit autoupdate (#511)
• 2e74013 Release 4.10.1
• 3076722 📝 docs(changelog): rebuild against release history (#510)
• 42751ce 🚀 ci(release): towncrier changelog + publish on tag push (#509)
• d2e5756 fix(windows): stop leaking ctypes pointer types on repeated calls (#507)
• 4f52c4f build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 in the all group (#506)
• f68e56f build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 in the all group (#504)
• 806560b build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the all group (#502)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/click	8.4.2	Unknown	Unknown
pip/feedparser	6.0.14	🟢 5.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 18 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 1 Found 2/14 approved changesets -- score normalized to 1 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Pinned-Dependencies 🟢 10 all dependencies are pinned Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/packaging	26.3	Unknown	Unknown
pip/platformdirs	4.11.0	Unknown	Unknown

Scanned Files

• scripts/requirements.txt