Skip to content

chore(deps): bump typer from 0.26.7 to 0.27.0 - #70

Merged
lab700xdev merged 1 commit into
mainfrom
dependabot/pip/typer-0.27.0
Jul 26, 2026
Merged

chore(deps): bump typer from 0.26.7 to 0.27.0#70
lab700xdev merged 1 commit into
mainfrom
dependabot/pip/typer-0.27.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2026

Copy link
Copy Markdown
Contributor

Bumps typer from 0.26.7 to 0.27.0.

Release notes

Sourced from typer's releases.

0.27.0

Breaking Changes

Internal

0.26.8

Fixes

  • 🐛 Make second column of Rich help output reflect the type consistently, even when using metavar. PR #1410 by @​svlandeg.
  • 🐛 Fix formatting in NoSuchOption.format_message(). PR #1843 by @​foomunleong.

Docs

  • 📝 Update docs badges: remove Publish badge, it doesn't give extra information. PR #1850 by @​tiangolo.
  • 📝 Fix formatting for help link to support GitHub-specific overview edge-case. PR #1826 by @​phalberg.

Internal

Changelog

Sourced from typer's changelog.

0.27.0 (2026-07-15)

Breaking Changes

Internal

0.26.8 (2026-06-25)

Fixes

  • 🐛 Make second column of Rich help output reflect the type consistently, even when using metavar. PR #1410 by @​svlandeg.
  • 🐛 Fix formatting in NoSuchOption.format_message(). PR #1843 by @​foomunleong.

Docs

  • 📝 Update docs badges: remove Publish badge, it doesn't give extra information. PR #1850 by @​tiangolo.
  • 📝 Fix formatting for help link to support GitHub-specific overview edge-case. PR #1826 by @​phalberg.

Internal

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump typer from 0.26.7 to 0.27.0
e3a1735 
Bumps [typer](https://github.com/fastapi/typer) from 0.26.7 to 0.27.0.
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.26.7...0.27.0)

---
updated-dependencies:
- dependency-name: typer
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: deps, poetry. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@lab700xdev

lab700xdev commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Verified locally on top of current main (so with #74's setuptools 83.0.0 and #71's click 8.4.2 also applied — this branch predates both).

Scanner behaviour is unchanged, but help screens are not. typer 0.27.0 carries one documented breaking change (fastapi/typer#1863, "how metavar is printed"), and it is visible on every --help screen:

0.26.7 0.27.0
scan usage [OPTIONS] [TARGET] [OPTIONS] [target]
diff usage [OPTIONS] OLD_FILE NEW_FILE [OPTIONS] {old_file} {new_file}
string option --output TEXT --output <str>
enum option --format [json|markdown|spdx] --format <json|markdown|spdx>

The unknown-flag error also drops a stray tuple repr — No such option: --nope ('(Possible options: --no-share)',) becomes No such option: --nope (Possible options: --no-share), which is a small improvement.

This is cosmetic and carries no downstream doc drift: nothing in this repo's README, docs, tests, or the ten CI smoke tests asserts on metavar formatting, and the aisbom.io site does not embed CLI help output. Flagging it explicitly because it is user-facing on a public CLI.

Everything else is byte-identical

  • Full suite green: 253 passed, coverage 88.64% (gate 85%).
  • Scan output diffed against a pre-bump baseline — terminal, markdown, JSON (CycloneDX 1.6) and SPDX renderings, plus --strict, --lint, --no-fail-on-risk, diff, info, --version, and the missing-target path: byte-identical, exit codes unchanged (2 on CRITICAL, 0 clean).
  • typer is a runtime dependency, so the frozen binary was rebuilt via scripts/build_binaries.sh and re-tested: mock_malware.pt still flags CRITICAL (RCE posix.system) and exits 2; diff still reports no regression.
  • --show-completion prints Shell not supported. under a non-interactive subprocess, but it does so identically on 0.26.7 — shellingham cannot detect a parent shell there. Pre-existing, not caused by this bump.

The pyproject.toml constraint widening to <0.28.0 is required for the lock to resolve and keeps the upper bound one minor ahead, matching the previous pattern.

@lab700xdev
lab700xdev merged commit 802a8e6 into main Jul 26, 2026
2 checks passed
@lab700xdev
lab700xdev deleted the dependabot/pip/typer-0.27.0 branch July 26, 2026 02:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lab700xdev