chore(python): update `click` dependency versions
What the developer wrote
Authored by Roman Zeyde
chore(python): update `click` dependency versions
[no changelog]
What changed, and why it matters
This commit simply widens the allowed version range for the Python 'click' command-line library used in Trezor's Python tools. It does not change any device firmware, wallet logic, or security-sensitive code. There is no indication this is a security fix or that it addresses any vulnerability.
No security action required. Treat as a normal dependency maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change updates the dependency specifier for the ‘click’ package from ‘>=8,<8.3’ to ‘>=8,<9’ in python/pyproject.toml and the generated uv.lock file. This is a routine dependency range bump with no code changes, no patch logic, and no disclosed security relevance.
Changed components
python/pyproject.tomluv.lockInspect captured patch +2 / −2
diff --git a/python/pyproject.toml b/python/pyproject.toml
index 10558802..6933ff9a 100644
--- a/python/pyproject.toml
+++ b/python/pyproject.toml
@@ -24,7 +24,7 @@ dependencies = [
"shamir-mnemonic>=0.3.0",
"slip10>=1.0.1",
"requests>=2.4.0",
- "click>=8,<8.3",
+ "click>=8,<9",
"libusb1>=1.6.4",
"construct>=2.9,!=2.10.55",
"typing_extensions>=4.7.1",
diff --git a/uv.lock b/uv.lock
index 99332997..81ded210 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2231,7 +2231,7 @@ dependencies = [
requires-dist = [
{ name = "bleak", marker = "extra == 'ble'", specifier = ">=1.1.0" },
{ name = "bleak", marker = "extra == 'full'", specifier = ">=1.1.0" },
- { name = "click", specifier = ">=8,<8.3" },
+ { name = "click", specifier = ">=8,<9" },
{ name = "construct", specifier = ">=2.9,!=2.10.55" },
{ name = "construct-classes", specifier = ">=0.1.2" },
{ name = "cryptography", specifier = ">=41" },
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.