Relax ladybug-core Click pin to support Click 8.3.3+

ladybug-core==0.44.56 currently requires click==8.1.7.

Click 8.1.7 is affected by PYSEC-2026-2132; the audited fixed version is Click 8.3.3.

We tested this minimal change against a downstream project:

-click==8.1.7;python_version>='3.8'
+click>=8.3.3,<9;python_version>='3.8'

Results:

pip check: Passed

Click version tested: 8.3.3

Ladybug version: 0.44.56+kelvara.click833

Full integration suite: 339 passed

Python: 3.11 on Windows

Please release an updated ladybug-core version with a compatible Click constraint so downstream projects can remove temporary patched wheels.

fix(deps): Bump click for security patches

@leonie-kelvara

Thanks for letting us know, @leonie-kelvara.

The click version specified in ladybug core gets used by almost everything throughout the LBT Dependency tree. So we need to test more than just this package. But I looked at the change log between click 8.1.7 and 8.3.3 and it doesn't look like any of the changes would break the parts of click that we use.

I am updating it here:
#662

Assuming that all of the other tests that run in our CI after this release pass, I won't post back on this issue and you'll now that Ladybug Tools now uses click==8.3.3.

Otherwise, I'll post back here letting you know what the blocker is and how long it might take us to address it.

fix(deps): Bump click for security patches

Navigation Menu

Repository navigation

Relax ladybug-core Click pin to support Click 8.3.3+ #661

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Relax ladybug-core Click pin to support Click 8.3.3+ #661

Description

Activity

chriswmackey commented on Aug 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions