Bump wcwidth from 0.8.4 to 0.9.1

[dependabot]

Bumps wcwidth from 0.8.4 to 0.9.1.

Release notes

Sourced from wcwidth's releases.

0.9.1

What's Changed

• bugfix width() value for very long CSI sequences (0.9.0 regression!) by @​jquast in jquast/wcwidth#272
• Improve performance by kwarg parsing by @​jquast in jquast/wcwidth#273

Full Changelog: jquast/wcwidth@0.9.0...0.9.1

0.9.0: Python build extension

What's Changed

• Use Python extension with libwcwidth by @​jquast in jquast/wcwidth#248

Full Changelog: jquast/wcwidth@0.8.5...0.9.0

0.8.5

What's Changed

• Measure hyphen break positions by display width by @​jakezwang in jquast/wcwidth#262

Full Changelog: jquast/wcwidth@0.8.4...0.8.5

Changelog

Sourced from wcwidth's changelog.

0.9.1 2026-09-23

• Bugfix width()_ in Python and libwcwidth mis-measured CSI sequences over 64 bytes, a 0.9.0 release regression! PR [#271](https://github.com/jquast/wcwidth/issues/271)_.
• Performance improvement of ~15% for many Python API functions when using default arguments like ambiguous_width and term_program. PR [#273](https://github.com/jquast/wcwidth/issues/273)_

0.9.0 2026-09-23

• New Optional CPython extension using libwcwidth_, improving performance 10-58x PR [#248](https://github.com/jquast/wcwidth/issues/248)_.
• Drop Support for Python 3.8, PR [#248](https://github.com/jquast/wcwidth/issues/248)_.

0.8.5 2026-09-23

• Bugfix CJK hyphen break positions for wrap(), PR [#262](https://github.com/jquast/wcwidth/issues/262).

Commits

• 074bc28 do not commit api_c.rst (generated) (#274)
• 6fef337 Add many-argcall style tests
• 8c22e24 Improve performance by kwarg parsing (#273)
• 8cda5e6 bugfix width() value for very-long CSI sequences (#272)
• b3fb5f2 Improve C11 coverage (#270)
• 9b9cfd8 Update history.rst (#271)
• 06ac438 bugfix check-release.py about free-threaded filenames (#269)
• 990c204 add --no-cov for cibuildwheel (#268)
• bb0e7fe setuptools conditionally skipped in test_setup.py (#267)
• f05b2ef pin cibuildwheel@v3.4.1 (#266)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	wcwidth@​0.8.4 ⏵ 0.9.1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		System shell access: pypi wcwidth Location: Package overview From: requirements.txt → pypi/wcwidth@0.9.1 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/wcwidth@0.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Native binaries present: pypi wcwidth Location: Package overview From: requirements.txt → pypi/wcwidth@0.9.1 ℹ Read more on: This package | This alert | Why is native code a concern? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/wcwidth@0.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report