Running uv audit on my project which uses fixit as a direct dependency gives the following warning for click as a transative dependency:
Vulnerabilities:
click 8.1.8 has 1 known vulnerability:
- PYSEC-2026-2132: No summary provided
Fixed in: 8.3.3
Advisory information: https://access.redhat.com/errata/RHSA-2026:24761
In Fixit's pyproject.toml, click has a dependency marker of click>=8.0,<8.2. Is there any reason why this cannot be upgraded to click>=8.3.3?
Running
uv auditon my project which usesfixitas a direct dependency gives the following warning forclickas a transative dependency:In Fixit's
pyproject.toml,clickhas a dependency marker ofclick>=8.0,<8.2. Is there any reason why this cannot be upgraded toclick>=8.3.3?