Bump click from 8.3.3 to 8.4.1

[dependabot]

Bumps click from 8.3.3 to 8.4.1.

Release notes

Sourced from click's releases.

8.4.1

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-1 Milestone: https://github.com/pallets/click/milestone/32?closed=1

• get_parameter_source() is available during eager callbacks and type conversion again. #3458 #3484
• Zsh completion scripts parse correctly on Windows. #3277 # 3466
• Shell completion of Choice Enum values produces a valid completion result. #3015
• Fix empty byte-string handling in echo. #3487
• Fix closed file error with echo_via_pager. #3449

8.4.0

This is the Click 8.4.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.4.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-0 Milestone https://github.com/pallets/click/milestone/30

• ParamType typing improvements. #3371

  • :class:ParamType is now a generic abstract base class, parameterized by its converted value type.
  • :meth:~ParamType.convert return types are narrowed on all concrete types (str for :class:STRING, int for :class:INT, etc.).
  • :meth:~ParamType.to_info_dict returns specific :class:~typing.TypedDict subclasses instead of dict[str, Any].
  • :class:CompositeParamType and the number-range base are now generic with abstract methods.

• Refactor convert_type to extract type inference into a private _guess_type helper, and add :func:typing.overload signatures. #3372

• Parameter typing improvements. #2805

  • :class:Parameter is now an abstract base class, making explicit that it cannot be instantiated directly.
  • :attr:Parameter.name is now str instead of str | None. When expose_value=False, the name is set to "" instead of None.
  • The ctx parameter of :meth:Parameter.get_error_hint is now typed as Context | None, matching the runtime behavior.

• Split string values from default_map for parameters with nargs > 1 or :class:Tuple type, matching environment variable behavior.

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.4.1

Released 2026-05-21

• get_parameter_source() is available during eager callbacks and type conversion again. :issue:3458 :issue:3484
• Zsh completion scripts parse correctly on Windows. :issue:3277 :pr:3466
• Shell completion of Choice Enum values produces a valid completion result. :issue:3015
• Fix empty byte-string handling in echo. :issue:3487
• Fix closed file error with echo_via_pager. :issue:3449

Version 8.4.0

Released 2026-05-17

• :class:ParamType typing improvements. :pr:3371

  • :class:ParamType is now a generic abstract base class, parameterized by its converted value type.
  • :meth:~ParamType.convert return types are narrowed on all concrete types (str for :class:STRING, int for :class:INT, etc.).
  • :meth:~ParamType.to_info_dict returns specific :class:~typing.TypedDict subclasses instead of dict[str, Any].
  • :class:CompositeParamType and the number-range base are now generic with abstract methods.

• Refactor convert_type to extract type inference into a private _guess_type helper, and add :func:typing.overload signatures. :pr:3372

• :class:Parameter typing improvements. :pr:2805

  • :class:Parameter is now an abstract base class, making explicit that it cannot be instantiated directly.
  • :attr:Parameter.name is now str instead of str | None. When expose_value=False, the name is set to "" instead of None.
  • The ctx parameter of :meth:Parameter.get_error_hint is now typed as Context | None, matching the runtime behavior.

• Split string values from default_map for parameters with nargs > 1 or :class:Tuple type, matching environment variable behavior. :issue:2745 :pr:3364

• Auto-detect type=UNPROCESSED for flag_value of non-basic types (not str, int, float, or bool), so programmer-provided Python objects like classes and enum members are passed through unchanged instead of being stringified. Previously type=click.UNPROCESSED had to be set explicitly. :issue:2012 :pr:3363

... (truncated)

Commits

• 6eeb50e release version 8.4.1
• 67921d5 change log and doc fixes (#3495)
• 9c41f46 Fix changelog and version admonitions
• 6cb3477 fix skip condition
• 5ee8e31 fix I/O operation on closed file error with CliRunner and echo_via_pager (#3482)
• becbde5 pager doesn't close std streams
• a5f5aa6 Handle empty bytes in echo (#3493)
• 4d3db84 handle empty bytes in echo
• d42f15b Fix get_parameter_source() during type conversion and eager callbacks (#3484)
• 0baa8db Document ctx.params bypass with test and doc
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, pip, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
progressbar	Ready	Preview, Comment	May 25, 2026 5:43pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	click@​8.3.3 ⏵ 8.4.1	+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Embedded URLs or IPs: pypi click URLs: https://github.com/pallets/click/issues/%s, https://github.com/pallets/click/pull/%s, https://docs.python.org/3/, https://palletsprojects.com/donate, https://pypi.org/project/click/, https://github.com/pallets/click/, https://github.com/pallets/click/issues/, https://discord.gg/pallets, https://docs.python.org/3/library/textwrap.html#textwrap.TextWrapper, https://github.com/python/cpython/blob/main/Lib/textwrap.py, https://peps.python.org/pep-0661/, https://click.palletsprojects.com/en/stable/advanced/#callback-evaluation-order, https://docs.python.org/3/library/os.html#os.environ, https://en.wikipedia.org/wiki/ANSI_color, https://gist.github.com/XVilka/8346728, https://click.palletsprojects.com/, https://github.com/pallets/click/issues/3024#issuecomment-3146199461, https://github.com/pallets/click/pull/2811, https://github.com/pallets/click/issues/3136, https://github.com/pallets/click/issues/3145, https://github.com/pallets/click/issues/3458, https://github.com/pallets/click/pr/3199, https://github.com/pallets/click/issues/3121, https://github.com/pallets/click/issues/2745, https://github.com/pallets/click/pull/3224#issuecomment-3968643305, https://github.com/pallets/click/issues/2790, https://github.com/pallets/click/issues/3298, https://github.com/pallets/click/pull/3030#discussion_r2271571819, https://github.com/pallets/click/pull/3030#pullrequestreview-3106604795, https://github.com/pallets/click/pull/3030#pullrequestreview-3108471552, https://github.com/pallets/click/issues/3024#issuecomment-3146511356, https://github.com/pallets/click/issues/3024#issuecomment-3146480714, https://github.com/pallets/click/issues/2012#issuecomment-892437060, https://github.com/pallets/click/issues/3024#issuecomment-3146508536, https://github.com/pallets/click/issues/2012#issue-946471049, https://github.com/pallets/click/issues/2012, https://github.com/pallets/click/issues/2610, https://github.com/pallets/click/issues/3403, https://github.com/pallets/click/issues/3084, https://github.com/pallets/click/issues/1992, https://github.com/pallets/click/issues/2809, https://github.com/pallets/click/issues/2968, https://github.com/pallets/click/pull/2969, https://click.palletsprojects.com/en/stable/advanced/#command-aliases, https://click.palletsprojects.com/en/stable/options/#yes-parameters, https://click.palletsprojects.com/en/stable/quickstart/#adding-parameters, https://github.com/pallets/click#a-simple-example, https://click.palletsprojects.com/en/stable/options/#callbacks-and-eager-options Location: Package overview From: requirements.txt → pypi/click@8.4.1 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/click@8.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: pypi click URLs: https://docs.python.org/3/library/textwrap.html#textwrap.TextWrapper, https://github.com/python/cpython/blob/main/Lib/textwrap.py, https://peps.python.org/pep-0661/, https://click.palletsprojects.com/en/stable/advanced/#callback-evaluation-order, https://docs.python.org/3/library/os.html#os.environ, https://en.wikipedia.org/wiki/ANSI_color, https://gist.github.com/XVilka/8346728, https://click.palletsprojects.com/ Location: Package overview From: requirements.txt → pypi/click@8.4.1 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/click@8.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[guibranco]

Automatically approved by gstraccini[bot]

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-actions]

Infisical secrets check: ✅ No secrets leaked!

💻 Scan logs

2026-05-25T17:43:52Z INF scanning for exposed secrets...
5:43PM INF 142 commits scanned.
2026-05-25T17:43:52Z INF scan completed in 25.6ms
2026-05-25T17:43:52Z INF no leaks found