chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/checkout	action	patch	v6.0.2 → v6.0.3
click (changelog)		minor	==8.3.1 → ==8.4.2
cosl		minor	==1.6.1 → ==1.9.2
fabric (source, changelog)		patch	==3.2.2 → ==3.2.3
hashicorp/setup-terraform	action	patch	v4.0.0 → v4.0.1
openstacksdk		minor	==4.10.0 → ==4.17.0
ops (changelog)		minor	==3.7.0 → ==3.8.0
pydantic (changelog)		minor	==2.12.5 → ==2.13.4
terraform-linters/setup-tflint	action	minor	v6.2.2 → v6.3.0
typing_extensions (changelog)		minor	==4.15.0 → ==4.16.0

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

pallets/click (click)

v8.4.2

Compare Source

Released 2026-06-24

• Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and
  tabs in option help text are now escaped, keeping the original completion
  format while still supporting multi-line help. {issue}3502
  {issue}3043 {pr}3504 {pr}3508
• Deprecated commands and options with empty or missing help text no longer
  render a stray leading space before the (DEPRECATED) label. {pr}3509
• A {class}Group with invoke_without_command=True marks its subcommand as
  optional in the usage help, showing [COMMAND] instead of COMMAND.
  {issue}3059 {pr}3507
• echo_via_pager flushes after each write, so passing a generator streams
  output to the pager incrementally instead of staying hidden until the pipe
  buffer fills. {issue}3242 {issue}2542 {pr}3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout
  stream when no external pager runs, completing the partial
  I/O operation on closed file fix from {pr}3482. {issue}3449
  {pr}3533
• Fix CLI usage symopsis for optional arguments producing double square brackets
  [[a|b|c]]... whose type already brackets their metavar. {pr}3578
• {func}version_option resolves a package_name that does not match an
  installed distribution as an import (top-level module) name via
  {func}importlib.metadata.packages_distributions. Packages whose
  top-level module name differs from their distribution name (PIL vs
  Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the
  box. {issue}2331 {issue}1884 {issue}3125 {pr}3582

v8.4.1

Compare Source

Released 2026-05-21

• get_parameter_source() is available during eager callbacks and type
  conversion again. :issue:3458 :issue:3484
• Zsh completion scripts parse correctly on Windows. :issue:3277 :pr:3466
• Shell completion of Choice Enum values produces a valid completion
  result. :issue:3015
• Fix empty byte-string handling in echo. :issue:3487
• Fix closed file error with echo_via_pager. :issue:3449

v8.4.0

Compare Source

Released 2026-05-17

• :class:ParamType typing improvements. :pr:3371

  • :class:ParamType is now a generic abstract base class,
    parameterized by its converted value type.
  • :meth:~ParamType.convert return types are narrowed on all
    concrete types (str for :class:STRING, int for
    :class:INT, etc.).
  • :meth:~ParamType.to_info_dict returns specific
    :class:~typing.TypedDict subclasses instead of
    dict[str, Any].
  • :class:CompositeParamType and the number-range base are now
    generic with abstract methods.

• Refactor convert_type to extract type inference into a private
  _guess_type helper, and add :func:typing.overload signatures.
  :pr:3372

• :class:Parameter typing improvements. :pr:2805

  • :class:Parameter is now an abstract base class, making explicit
    that it cannot be instantiated directly.
  • :attr:Parameter.name is now str instead of str | None.
    When expose_value=False, the name is set to "" instead
    of None.
  • The ctx parameter of :meth:Parameter.get_error_hint is now
    typed as Context | None, matching the runtime behavior.

• Split string values from default_map for parameters with nargs > 1
  or :class:Tuple type, matching environment variable behavior.
  :issue:2745 :pr:3364

• Auto-detect type=UNPROCESSED for flag_value of non-basic types
  (not str, int, float, or bool), so programmer-provided
  Python objects like classes and enum members are passed through unchanged
  instead of being stringified. Previously type=click.UNPROCESSED had
  to be set explicitly. :issue:2012 :pr:3363

• The error hint now uses :meth:Command.get_help_option_names to pick
  non-shadowed help option names, so Try '... -h' no longer points to a
  subcommand option that shadows -h. The longest surviving name is
  shown (--help over -h) for readability. :issue:2790 :pr:3208

• Fix readline functionality on non-Windows platforms. Prompt text is now
  passed directly to readline instead of being printed separately, allowing
  proper backspace, line editing, and line wrapping behavior. :issue:2968
  :pr:2969

• Use :func:os.startfile on Windows to open URLs in :func:open_url,
  replacing the start built-in which cannot be invoked without
  shell=True. :issue:3164 :pr:3186

• Fix Fish shell completion errors when option help text contains newlines.
  :issue:3043 :pr:3126

• Add :class:NoSuchCommand exception with suggestions for misspelled
  commands. :issue:3107 :pr:3228

• Use :class:ValueError message when conversion in :class:FuncParamType would
  fail. :issue:3105 :pr:3211

• Add click.get_pager_file for file-like access to an output
  pager. :pr:1572 :pr:3405

• :func:~click.formatting.wrap_text now measures line width in visible
  characters, ignoring ANSI escape sequences. :pr:3420

• Fix :meth:HelpFormatter.write_usage emitting only a blank line when
  called without args. The usage prefix and program name are now
  written even when no arguments follow, and the trailing separator
  space is stripped so the line ends at the program name.
  :issue:3360 :pr:3434

• Show custom error messages from types when :func:prompt with
  hide_input=True fails validation, instead of always showing a
  generic message. Built-in type messages mask the input value.
  :issue:2809 :pr:3256

• Add capture parameter to :class:CliRunner with two modes: sys
  (default) and fd. fd redirects file descriptors 1 and 2
  via :func:os.dup2 so output that bypasses sys.stdout (stale stream
  references, C extensions, subprocesses, faulthandler) is captured
  with proper isolation. :issue:854 :issue:2412 :issue:2468
  :issue:2497 :issue:2761 :issue:2827 :issue:2865 :pr:3391

• Revert the 8.3.3 change that exposed the original file descriptor
  via fileno() on the redirected CliRunner streams in the default
  capture mode. os.dup2(w, sys.stdout.fileno()) calls inside a CLI no
  longer mutate the host runner's stdout, which broke Pytest's fd-level
  capture teardown. C-level consumers that need a real fd should use
  capture="fd". :issue:3384 :pr:3391

• Mark additional built-in strings with gettext() to extend translation
  coverage. :pr:2902

• Fix feature switch groups (several flag_value options sharing one
  parameter name) silently dropping an explicit default when a sibling
  option without an explicit default was declared first. Arbitration is now
  source-aware: a more explicit :class:ParameterSource always wins, and
  within ParameterSource.DEFAULT, an option that received an explicit
  default= keyword wins over a sibling whose default was auto-derived.
  The 8.3.x first-wins fallback for remaining ties was reverted to the
  pre-8.3.x last-wins fallback. :issue:3403 :pr:3404

• Fix missing space between option help text and the (DEPRECATED)
  label, and localize the option label so it matches the command label.
  The label and the DeprecationWarning reason suffix are now produced
  by shared helpers. :pr:3423

• Document short option stacking (-abc is parsed as -a -b -c) and
  clarify that multi-character short option names are not supported.
  :issue:2779 :pr:3431

v8.3.3

Compare Source

v8.3.2

Compare Source

Released 2026-04-02

• Fix handling of flag_value when is_flag=False to allow such options to be
  used without an explicit value. :issue:3084 :pr:3152
• Hide Sentinel.UNSET values as None when using lookup_default().
  :issue:3136 :pr:3199 :pr:3202 :pr:3209 :pr:3212 :pr:3224
• Prevent _NamedTextIOWrapper from closing streams owned by StreamMixer.
  :issue:824 :issue:2991 :issue:2993 :issue:3110 :pr:3139 :pr:3140
• Add comprehensive tests for CliRunner stream lifecycle, covering
  logging interaction, multi-threaded safety, and sequential invocation
  isolation. Add high-iteration stress tests behind a stress marker
  with a dedicated CI job. :pr:3139
• Fix callable flag_value being instantiated when used as a default via
  default=True. :issue:3121 :pr:3201 :pr:3213 :pr:3225

canonical/cos-lib (cosl)

v1.9.2

Compare Source

What's Changed

• chore(ci): bump reusable workflows to v2 by @​lucabello in #​194
• feat: log files ignored due to unrecognized suffix by @​lucabello in #​198

Full Changelog: canonical/cos-lib@1.9.1...1.9.2

v1.9.1

Compare Source

What's Changed

• feat: add JujuTopology.to_baggage() for telemetry labelling by @​Copilot in #​186

New Contributors

• @​Copilot made their first contribution in #​186

Full Changelog: canonical/cos-lib@1.9.0...1.9.1

v1.9.0

Compare Source

What's Changed

• refactor: InjectResult and SingleRuleFormat types by @​MichaelThamm in #​190

Full Changelog: canonical/cos-lib@1.8.0...1.9.0

v1.8.0

Compare Source

What's Changed

• refactor: Improved typing in the rules and cos_tool modules by @​MichaelThamm in #​189

Full Changelog: canonical/cos-lib@1.7.0...1.8.0

v1.7.0

Compare Source

What's Changed

• feat: Type-agnostic Rules instance by @​MichaelThamm in #​187

Full Changelog: canonical/cos-lib@1.6.1...1.7.0

fabric/fabric (fabric)

v3.2.3

Compare Source

hashicorp/setup-terraform (hashicorp/setup-terraform)

v4.0.1

Compare Source

BUG FIXES:

• Fix Node 24 DEP0169 url.parse() deprecation warning by updating @​hashicorp/js-releases to v1.7.7 (#​549)

canonical/operator (ops)

v3.8.0

Compare Source

Features

• Note the socket path in Pebble tracing spans (#​2555)

Fixes

• Treat remote unit zero as explicit (#​2454)
• Ensure resources are cleaned up in testing.Context (#​2506)
• Close SQLite storage in Harness.cleanup() (#​2507)
• Restore sys.breakpointhook on _Manager teardown (#​2542)
• Avoid errors in finalisation due to already-closed websocket (#​2548)
• Use the correct value for JUJU_HOOK_NAME when objects contain dashes (#​2552)
• Avoid double-closing the framework in testing teardown (#​2561)
• Don't leak exec I/O threads when waiting on the change fails (#​2558)
• Take Pebble defaults into consideration when consistency checking Checks (#​2567)
• Tear down Runtime.exec() when the charm raises (#​2581)

Documentation

• Fix small issues in K8s tutorial (#​2540)
• Document user-secret observer lifecycle and secret-changed semantics (#​2522)
• Replace CoC with link to Ubuntu Code of Conduct (#​2564)
• Add a small note about -W error in the unit test how-to (#​2560)
• Add doc about subordinate charms (#​2455)
• Add 26.04 to the versions page and mark 2.23 as LTS (#​2517)
• Clarify storage-detaching applies to both machine and K8s charms (#​2554)
• Add guidance about names of workload-less charms (#​2496)
• Fix first unit tests command in machine charm tutorial (#​2574)
• Extend security explanation page to cover SEC0030 V1.3 gaps (#​2571)
• Move docs to canonical.com/juju/docs/ops (#​2545)
• Fix docstring of _Event._is_action_event (#​2580)

Tests

• Treat warnings as errors when running unit tests (#​2541)
• Fix mock_temp_dir fixture's open() patch (#​2553)
• Add integration tests for ops.hookcmds (#​2520, #​2562)
• Fix integration test flakes on Juju 3 k8s and Juju 4 secrets (#​2584)

Refactoring

• Avoid yaml.load() to silence security scanner false positives (#​2523)
• Replace jsonpatch with an inline dict-diff (#​2578)
• Move the otlp-json package to be a regular ops-tracing module (#​2585)
• Distinguish between init and attribute types in testing state classes (#​2331)

CI

• Remove obsolete containerd workaround from integration workflow (#​2519)
• Use the sys.monitoring coverage core (#​2518)

v3.7.1

Compare Source

Fixes

• Pass the endpoint name through to relation-get (#​2499)

Documentation

• Add a how-to guide focused on debugging charms (#​2386)
• Add metadata descriptions to the debug and public listing how-to guides (#​2415)
• Update tutorials and how-tos to use pytest-jubilant (#​2406)
• Add how-to guide about CI (#​2405)
• Test COS Lite integration with the k8s-5-observe charm (#​2411)
• Update tutorials and example charms to match Charmcraft 4.2 (#​2407)
• Update api_demo_server version to support non-amd64 architectures (#​2448)
• Pin to 24.04 when launching VMs (#​2457)
• Explain how to remove errored apps in k8s tutorial (#​2445)
• Align example charms with pre-release Charmcraft (#​2444)
• Add how-to guide for naming and initialising a charm (#​2449)
• Add a how-to guide about publishing a charm (#​2420)
• In the tutorials, recommend initing from GitHub (#​2459)
• Fix integration tests of K8s tutorial charms (#​2471)
• Replace the PGP key with the upstream page in SECURITY.md (#​2474)
• Bump api_demo_server to 1.0.4 in docs and example charms (#​2473)
• Refresh the machine workloads how-to (#​2443)
• Add COS Lite integration tests to K8s tutorial (#​2478)
• Add git workflow guidance for contributors (#​2453)
• Update profile guidance in HACKING.md (#​2486)
• Explain how to add an icon to a charm (#​2451)
• Adopt latest Charmcraft profiles, incl juju_setup marker on integration tests (#​2497)
• Improve support for agents, with Sphinx Stack upgrade (#​2495)
• Improve how-to about managing files in containers (#​2470)
• Improve Container.pull docs to avoid leaky files (#​2508)
• Clarify Secret manage-permission error in testing.State (#​2510)

Tests

• Extend the type checking of the ops-scenario tests (#​2234, #​2235)
• Wait on ExecProcess after expected TypeError (#​2509)

CI

• Drop external action for checking PR title format (#​2388)
• Add a dependabot cooldown (#​2413)
• Sort the directory entries when updating the best practices list (#​2422)
• Configure dependabot for the example charms (#​2426)
• Pin zizmor and TIOBE tool versions in pyproject.toml rather than the workflow (#​2437)
• Add 26.04 to smoke tests and remove outdated metadata.yaml (#​2450)
• Use charmcraft test for example charm (#​2440)
• Add workflow_dispatch trigger to workflows where it is useful (#​2468)
• Ensure the correct job is selected in updating charm pins (#​2500)

pydantic/pydantic (pydantic)

v2.13.4: 2026-05-06

Compare Source

v2.13.4 (2026-05-06)

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #​13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #​13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #​13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

v2.13.3

Compare Source

GitHub release

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #​13096

v2.13.2

Compare Source

v2.13.1: 2026-04-15

Compare Source

v2.13.1 (2026-04-15)

What's Changed

Fixes

• Fix ValidationInfo.data missing with model_validate_json() by @​davidhewitt in #​13079

Full Changelog: pydantic/pydantic@v2.13.0...v2.13.1

v2.13.0

Compare Source

GitHub release

The highlights of the v2.13 release are available in the blog post.
Several minor changes (considered non-breaking changes according to our versioning policy)
are also included in this release. Make sure to look into them before upgrading.

This release contains the updated pydantic.v1 namespace, matching version 1.10.26 which includes support for Python 3.14.

What's Changed

See the beta releases for all changes sinces 2.12.

New Features

• Allow default factories of private attributes to take validated model data by @​Viicos in #​13013

Changes

• Warn when serializing fixed length tuples with too few items by @​arvindsaripalli in #​13016

Fixes

• Change type of Any when synthesizing _build_sources for BaseSettings.__init__() signature in the mypy plugin by @​Viicos in #​13049
• Fix model equality when using runtime extra configuration by @​Viicos in #​13062

Packaging

• Add zizmor for GitHub Actions workflow linting by @​Viicos in #​13039
• Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by @​Viicos in #​13064

New Contributors

• @​arvindsaripalli made their first contribution in #​13016

terraform-linters/setup-tflint (terraform-linters/setup-tflint)

v6.3.0

Compare Source

What's Changed

Features

• Add tflint_version_file input to read the TFLint version from a file by @​somaz94 in #​448

Dependencies

• build(deps-dev): Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​415
• build(deps): Bump fast-xml-parser from 5.5.5 to 5.5.7 by @​dependabot[bot] in #​416
• build(deps): Bump picomatch by @​dependabot[bot] in #​417
• build(deps-dev): Bump @​eslint/compat from 2.0.0 to 2.0.3 by @​dependabot[bot] in #​419
• build(deps-dev): Bump eslint-plugin-security from 3.0.1 to 4.0.0 by @​dependabot[bot] in #​421
• build(deps): Bump actions/cache from 5.0.3 to 5.0.4 by @​dependabot[bot] in #​423
• build(deps): Bump brace-expansion by @​dependabot[bot] in #​424
• build(deps-dev): Bump the eslint group across 1 directory with 3 updates by @​dependabot[bot] in #​430
• build(deps-dev): Bump eslint-plugin-jsdoc from 62.8.0 to 62.8.1 in the eslint group by @​dependabot[bot] in #​431
• build(deps-dev): Bump the eslint group with 3 updates by @​dependabot[bot] in #​435
• build(deps-dev): Bump globals from 17.4.0 to 17.5.0 by @​dependabot[bot] in #​436
• build(deps-dev): Bump prettier from 3.8.1 to 3.8.3 by @​dependabot[bot] in #​437
• build(deps): Bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in #​438
• build(deps): Bump actions/setup-node from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​439
• build(deps-dev): Bump the eslint group with 2 updates by @​dependabot[bot] in #​442
• build(deps-dev): Bump jest from 30.3.0 to 30.4.2 by @​dependabot[bot] in #​443
• build(deps): Bump the actions group across 1 directory with 3 updates by @​dependabot[bot] in #​441
• build(deps): Bump fast-xml-builder from 1.1.4 to 1.2.0 by @​dependabot[bot] in #​440
• build(deps): Bump fast-xml-parser from 5.5.7 to 5.7.1 by @​dependabot[bot] in #​433
• dependabot: Set cooldown period by @​wata727 in #​418
• Remove @​babel/eslint-parser by @​bendrucker in #​425
• dependabot: Group eslint packages by @​bendrucker in #​426
• Replace eslint-plugin-import with eslint-plugin-import-x by @​bendrucker in #​428
• Remove eslint-plugin-promise by @​bendrucker in #​429

Chores

• ci: exclude dist from CodeQL analysis by @​bendrucker in #​412
• Extract release-target and installer modules with tests by @​bendrucker in #​444
• Consolidate plugin cache into a single module by @​bendrucker in #​445
• Name the wrapper hand-off protocol in a shared module by @​bendrucker in #​446

New Contributors

• @​somaz94 made their first contribution in #​448

Full Changelog: terraform-linters/setup-tflint@v6...v6.3.0

v6.3

Compare Source

python/typing_extensions (typing_extensions)

v4.16.0

Compare Source

No user-facing changes since 4.16.0rc2.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.