Update dependency prompt-toolkit to v3.0.53

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
prompt-toolkit	==3.0.52 → ==3.0.53

---

Release Notes

prompt-toolkit/python-prompt-toolkit (prompt-toolkit)

v3.0.53

Compare Source

Fixes:

• Fix get_word_before_cursor behavior.
• Fix vt100 6x6x6 color cube range and missing grayscale shades (232, 254-255).
• Treat OSError on add_reader as EOFError (macOS kqueue).
• Handle surrogate pairs in FileHistory.store_string.
• Fix FuzzyWordCompleter meta_dict type hint to match WordCompleter.
• Handle ascii decode errors in terminal type decoding of telnet protocol.
• Update return types of dialog shortcuts to include None when cancelled.
• Set missing minimal requirement on wcwidth.

New features:

• Lazy load __version__.
• Allow to specify show_numbers in ChoiceInput.

Added support for Python 3.14, 3.15, and set minimum Python version to 3.10.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:54 AM UTC · Completed 9:04 AM UTC

Commit: f590702 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [stale hashes / hash mismatch] requirements-test.txt:971 — The version pin for prompt-toolkit was bumped from 3.0.52 to 3.0.53, but the two hashes on lines 972–973 (sha256:28cde192... and sha256:9aac639a...) are the old 3.0.52 hashes carried over unchanged from the base branch. A separate duplicate entry prompt_toolkit==3.0.53 (underscore naming, inconsistent with the rest of the file) with the correct new hashes was appended at line 1532. pip normalizes both names identically and unions hashes across duplicate entries, so all four hashes will be accepted — the stale 3.0.52 hashes remain valid for hash verification, which is a supply-chain security concern.
  Remediation: Replace the stale hashes on the prompt-toolkit==3.0.53 entry with the correct 3.0.53 hashes (sha256:01c0891d... and sha256:9ec8a0ad...), and remove the duplicate prompt_toolkit==3.0.53 block at lines 1532–1534. Alternatively, re-run pip-compile to regenerate the file cleanly.

• [stale hashes / hash mismatch] requirements.txt:790 — Same pattern: the version pin was bumped to 3.0.53 but the hashes on lines 791–792 are still the old 3.0.52 hashes. A duplicate prompt_toolkit==3.0.53 entry with correct hashes was appended at line 1299 using inconsistent underscore naming. pip will union all four hashes, leaving the stale 3.0.52 hashes accepted.
  Remediation: Replace the stale hashes and remove the duplicate block at lines 1299–1301, or re-run pip-compile to regenerate the file cleanly.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [logic-error] requirements.txt:790 — Renovate bot bumped the version string from 3.0.52 to 3.0.53 on the existing entry but left the hashes unchanged — they still correspond to version 3.0.52. A duplicate entry prompt_toolkit==3.0.53 (underscore form) was appended at line 1299 with different hashes that are the correct 3.0.53 hashes. This creates stale hashes on the primary entry and a duplicate with inconsistent naming that breaks the single-entry-per-package convention.
  Remediation: Remove the duplicate prompt_toolkit==3.0.53 block at line 1299. Replace the stale hashes on the existing prompt-toolkit==3.0.53 entry (lines 791–792) with the correct 3.0.53 hashes (sha256:01c0891d... and sha256:9ec8a0ad...). Alternatively, re-run pip-compile to regenerate the file cleanly.

• [logic-error] requirements-test.txt:971 — Same Renovate bot error: version string bumped from 3.0.52 to 3.0.53 but hashes not updated. A duplicate prompt_toolkit==3.0.53 entry appended at line 1532 with the correct hashes.
  Remediation: Remove the duplicate prompt_toolkit==3.0.53 block at line 1532. Replace the stale hashes on the existing entry (lines 972–973) with the correct 3.0.53 hashes. Alternatively, re-run pip-compile to regenerate the file cleanly.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [stale hashes / incorrect hash association] requirements.txt:791 — The version of prompt-toolkit was bumped from 3.0.52 to 3.0.53, but the hashes were NOT updated — they are still the 3.0.52 hashes (28cde1..., 9aac63...). The correct 3.0.53 hashes (01c089..., 9ec8a0...) were appended as a separate duplicate entry at EOF under the underscore-normalized name prompt_toolkit==3.0.53. While pip currently installs successfully because it sees both hash sets, the primary entry carries stale hashes that widen the accepted hash set, weakening supply-chain integrity. If the duplicate entry is ever removed, installation will break.
  Remediation: Update the hashes to the correct 3.0.53 values and remove the duplicate prompt_toolkit==3.0.53 entry.

• [stale hashes / incorrect hash association] requirements-test.txt:972 — Same issue: prompt-toolkit was bumped to 3.0.53 but the hashes remain from 3.0.52. The correct hashes exist only in the duplicate prompt_toolkit entry at EOF.
  Remediation: Update the hashes to the correct 3.0.53 values and remove the duplicate entry.

Medium

• [naming-convention] requirements.txt:1299 — Two entries exist for the same package using inconsistent naming: prompt-toolkit (hyphen) and prompt_toolkit (underscore), both at version 3.0.53 with different hash sets. The established convention uses hyphens. The duplicate underscore-named entry is a Renovate artifact.
  Remediation: Remove the appended prompt_toolkit==3.0.53 block and merge any needed hashes into the single canonical entry.

• [naming-convention] requirements-test.txt:1532 — Same duplicate naming inconsistency: prompt-toolkit (hyphen) and prompt_toolkit (underscore) both at 3.0.53.
  Remediation: Remove the appended prompt_toolkit==3.0.53 block and retain only the canonical hyphen-named entry with corrected hashes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

Medium

• [duplicate/conflicting dependency entry] requirements.txt:1299 — The file contains two entries for the same package under different canonical names: prompt-toolkit==3.0.53 (line 790, hyphenated, retaining stale 3.0.52 hashes 28cde192... / 9aac639a...) and prompt_toolkit==3.0.53 (line 1299, underscored, with the correct 3.0.53 hashes 01c0891d... / 9ec8a0ad...). Per PEP 503 normalization these resolve to the same package, and pip unions hashes from both entries, so installation will succeed. However, the stale hashes on the original entry are unnecessary baggage — they widen the accepted hash set to include 3.0.52 distributions that no longer match any downloadable artifact. Consider consolidating into a single entry with only the correct 3.0.53 hashes.

• [duplicate/conflicting dependency entry] requirements-test.txt:1532 — Same issue: prompt-toolkit==3.0.53 (line 971, stale 3.0.52 hashes) coexists with prompt_toolkit==3.0.53 (line 1532, correct 3.0.53 hashes). Consider consolidating into a single entry with the correct hashes.

Previous run (4)

Review

Findings

High

• [hash-mismatch] requirements.txt:790 — The version was bumped from 3.0.52 to 3.0.53 on the prompt-toolkit entry but the hashes were not updated — they still correspond to the 3.0.52 release (28cde1..., 9aac63...). Additionally, a duplicate entry using the underscore variant prompt_toolkit==3.0.53 was appended at the end of the file (line ~1299) with the correct 3.0.53 hashes (01c089..., 9ec8a0...). pip normalizes both names identically (PEP 503), creating two entries for the same package with conflicting hash sets.
  Remediation: Keep a single prompt-toolkit==3.0.53 entry with the correct 3.0.53 hashes (01c0891d... and 9ec8a0ad...) and remove the duplicate prompt_toolkit==3.0.53 block at the end of the file.

• [hash-mismatch] requirements-test.txt:971 — Same issue: the prompt-toolkit==3.0.53 entry retains the old 3.0.52 hashes while a duplicate prompt_toolkit==3.0.53 entry appended at line ~1532 carries the actual 3.0.53 hashes. This creates a duplicate-with-stale-hashes situation.
  Remediation: Keep a single prompt-toolkit==3.0.53 entry with the correct 3.0.53 hashes and remove the duplicate prompt_toolkit==3.0.53 block at the end of the file.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (5)

Review

Findings

Critical

• [hash-mismatch] requirements.txt:790 — The version string for prompt-toolkit was bumped to 3.0.53 but the hashes were NOT updated — they still contain the hashes for 3.0.52 (sha256:28cde192... and sha256:9aac639a...). On the base branch, the entry reads prompt-toolkit==3.0.52 with these exact hashes, confirming they belong to the old version. pip’s hash-checking mode will reject the download at install time because the 3.0.53 artifacts will not match these stale hashes. Additionally, a duplicate entry prompt_toolkit==3.0.53 (underscore-normalized name) was appended at line 1299 with the correct 3.0.53 hashes, creating an invalid requirements file with two entries for the same package.
  Remediation: Remove the duplicate prompt_toolkit==3.0.53 entry at lines 1299–1301. Update the hashes on the existing prompt-toolkit==3.0.53 entry at line 790 to the correct 3.0.53 hashes. Ideally, re-run pip-compile to regenerate the lockfile correctly.

• [hash-mismatch] requirements-test.txt:971 — Same issue: the version string for prompt-toolkit was bumped to 3.0.53 but the hashes remain those of 3.0.52. A duplicate entry prompt_toolkit==3.0.53 with different hashes was appended at line 1532, creating the same invalid-file pattern.
  Remediation: Remove the duplicate prompt_toolkit==3.0.53 entry at lines 1532–1534. Update the hashes on the existing entry at line 971. Re-running pip-compile would produce the correct output.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (6)

Review

Findings

High

• [hash mismatch / duplicate dependency entry] requirements.txt:790 — The PR bumps prompt-toolkit from 3.0.52 to 3.0.53 at line 790 but leaves the old v3.0.52 hashes (28cde192..., 9aac639a...) unchanged on the existing entry (they are context lines in the diff, not modified). A duplicate prompt_toolkit==3.0.53 entry (underscore name variant) is appended at line 1299 with different hashes (01c0891d..., 9ec8a0ad...). pip normalizes both names to the same package, resulting in duplicate entries with conflicting hash sets. Depending on pip version behavior with duplicates, installation may fail with hash verification errors or reject the file as malformed.
  Remediation: Regenerate requirements.txt with pip-compile --generate-hashes to produce a single, correctly-hashed prompt-toolkit==3.0.53 entry. Alternatively, manually remove the duplicate prompt_toolkit entry at line 1299 and replace the stale hashes at lines 791–792 with the correct v3.0.53 hashes.

• [hash mismatch / duplicate dependency entry] requirements-test.txt:971 — Same issue: the version is bumped to 3.0.53 but the old v3.0.52 hashes remain unchanged on the existing entry. A duplicate prompt_toolkit==3.0.53 entry at line 1532 carries the correct v3.0.53 hashes. This creates the same duplicate-entry / conflicting-hash problem.
  Remediation: Regenerate requirements-test.txt with pip-compile --generate-hashes to produce a single, correctly-hashed entry.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (7)

Review

Findings

Critical

• [hash-mismatch] requirements.txt:790 — The version on the hyphenated entry prompt-toolkit is bumped from 3.0.52 to 3.0.53, but the hash values on lines 791–792 are NOT updated — they remain the hashes for 3.0.52 (28cde192... and 9aac639a...). A new underscore-named duplicate entry prompt_toolkit==3.0.53 is appended at line 1299 with the correct 3.0.53 hashes (01c0891d... and 9ec8a0ad...). Under PEP 503 name normalization these are the same package, creating a duplicate entry with conflicting hashes. This will cause pip install --require-hashes to fail.
  Remediation: Re-run pip-compile --generate-hashes to regenerate the requirements file cleanly, producing a single prompt-toolkit==3.0.53 entry with the correct hashes.

• [hash-mismatch] requirements-test.txt:971 — Same issue: the hyphenated entry prompt-toolkit has its version bumped to 3.0.53 but retains the 3.0.52 hashes, while a new duplicate underscore entry prompt_toolkit==3.0.53 is appended at line 1532 with the correct 3.0.53 hashes. This will cause hash verification failures or duplicate-entry errors during pip install --require-hashes.
  Remediation: Re-run pip-compile --allow-unsafe --generate-hashes to regenerate the test requirements file cleanly.

---

Labels: PR is a dependency version bump (prompt-toolkit 3.0.52 to 3.0.53) generated by Renovate bot

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:13 AM UTC · Completed 9:23 AM UTC

Commit: 21a1e26 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:42 AM UTC · Completed 7:56 AM UTC

Commit: fb898a8 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:48 PM UTC · Completed 1:59 PM UTC

Commit: d08fb6a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.16

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:01 PM UTC · Completed 6:13 PM UTC

Commit: 52c9c7a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.39

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:44 AM UTC · Completed 9:58 AM UTC

Commit: cbf6d0e · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.48

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Bot-authored minor dependency bump (prompt-toolkit 3.0.52 to 3.0.53) across two requirement files; composite score of 2 (moderate) is driven by the two-dependency-file signal and zero test coverage in the changeset, partially offset by minimal change size, bot authorship, single recent author, no recent churn, and no reverts.

Previous run

Risk Assessment: low (1/5)

Details

Bot-authored patch bump of prompt-toolkit (3.0.52 to 3.0.53) across two dependency files with no protected paths, no security-sensitive paths, no CI changes, and no recent churn; the elevated dependency-file signal is offset by the renovate-bot authorship, minimal line count, and clean git history, yielding a composite of 1.42.

Previous run (2)

Risk Assessment: low (1/5)

Details

Bot-authored patch-version bump of prompt-toolkit across 2 dependency files with 10 lines changed, no protected paths, no security-sensitive files, and no recent churn — all signals are low except the presence of 2 dependency files, which is expected for this type of routine renovate update.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:16 AM UTC · Completed 11:30 AM UTC

Commit: f54a387 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.24

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:26 AM UTC · Completed 6:39 AM UTC

Commit: 6d9be1d · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.16

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] stale hashes / hash mismatch

The version pin for prompt-toolkit was bumped from 3.0.52 to 3.0.53, but the two hashes on lines 972-973 (sha256:28cde192... and sha256:9aac639a...) are the old 3.0.52 hashes carried over unchanged from the base branch. A separate duplicate entry prompt_toolkit==3.0.53 with the correct new hashes (sha256:01c0891d... and sha256:9ec8a0ad...) was appended at line 1532. pip normalizes both names identically and unions hashes across duplicate entries, so all four hashes (two stale, two correct) will be accepted -- the stale 3.0.52 hashes remain valid for hash verification, which is a supply-chain security concern. Additionally, the duplicate entry uses underscore naming (prompt_toolkit) inconsistent with the rest of the file.

Suggested fix: Replace the stale hashes on the prompt-toolkit==3.0.53 entry (lines 972-973) with the correct 3.0.53 hashes (sha256:01c0891d... and sha256:9ec8a0ad...), and remove the duplicate prompt_toolkit==3.0.53 block appended at lines 1532-1534. Alternatively, re-run pip-compile to regenerate the file cleanly.

[fullsend-ai-review]

[high] stale hashes / hash mismatch

Same pattern as requirements-test.txt: the version pin for prompt-toolkit was bumped to 3.0.53 but the accompanying hashes on lines 791-792 are still the old 3.0.52 hashes (confirmed identical to base branch). A duplicate entry prompt_toolkit==3.0.53 with the correct hashes was appended at line 1299 using underscore naming inconsistent with the rest of the file. pip will union all four hashes, leaving the stale 3.0.52 hashes accepted.

Suggested fix: Replace the stale hashes on the prompt-toolkit==3.0.53 entry (lines 791-792) with the correct 3.0.53 hashes (sha256:01c0891d... and sha256:9ec8a0ad...), and remove the duplicate prompt_toolkit==3.0.53 block at lines 1299-1301. Alternatively, re-run pip-compile to regenerate the file cleanly.