[dependabot]

Bumps pyinstaller from 6.20.0 to 6.22.3.

Release notes

Sourced from pyinstaller's releases.

v6.22.3

Please see the v6.22.3 section of the changelog for a list of the changes since v6.22.2.

v6.22.2

Please see the v6.22.2 section of the changelog for a list of the changes since v6.22.1.

v6.22.1

Please see the v6.22.1 section of the changelog for a list of the changes since v6.22.0.

v6.22.0

Please see the v6.22.0 section of the changelog for a list of the changes since v6.21.0.

v6.21.0

Please see the v6.21.0 section of the changelog for a list of the changes since v6.20.0.

Changelog

Sourced from pyinstaller's changelog.

6.22.3 (2026-09-12)

Bugfix

* (Windows) Revise earlier fix for :issue:`9508` to avoid breaking
  executables located on ImDisk RAMDISK volumes. (:issue:`9510`)
* Compare the icon file suffix case-insensitively, so an icon named with an
  upper-case suffix such as ``MyApp.ICO`` is recognised as already being in the
  right format instead of being rejected or silently re-encoded.
  (:issue:`9521`)
* Fix ``onefile`` parent-process validation to allow intermixed nested
  sub-processes. (:issue:`9513`)
Bootloader

• (POSIX) Enable onefile parent-process validation for POSIX executables that have setgid bit set, and for Linux executables that have file capabilities set (i.e., have a security.capability extended file attribute). (:issue:9524)
• (POSIX) Revise the validation of owner and permissions of onedir application's contents directory when the executable has either setuid or setgid bit set. If setuid bit is set, the owner ID of the application's contents directory must match the owner ID of the executable itself, and only owner is allowed to have write permissions on the directory. If setgid bit is set, the group ID of the application's contents directory must match the group ID of the executable itself, and only owner and the group are allowed to have write permissions on the directory. (:issue:9524)
• Limit onefile parent-process validation only to executables that are running with elevated privileges while inheriting environment variables set by unprivileged user. On POSIX systems, this corresponds to executables with setuid bit set, while on Windows, it corresponds to UAC-elevated processes (running with TokenElevationTypeFull token). (:issue:9520)

6.22.2 (2026-08-17)

Bugfix

* (Windows) Fix spurious security validation error when a ``onefile``
  executable is launched from a symlinked directory or a junction.
  (:issue:`9508`)
</tr></table>

... (truncated)

Commits

• ecd7993 Release v6.22.3. [skip ci]
• 8807296 doc: update documentation section on onefile/onedir security verification
• bda6110 bootloader: security: improve owner/permissions check in onedir mode
• e3fc240 bootloader: security: add detection of file capabilities on linux
• 3d73d32 bootloader: security: enable security checks for setgid executables
• 10c62c5 bootloader: security: make early-error message a bit more generic
• 1919af1 Tests: Requirements: Scheduled weekly dependency update for week 36 (#9522)
• 77907b5 doc: update documentation section on onefile security verification
• a36324b ci: freebsd: mount /proc
• 012e150 tests: security: adjust for platforms without parent-process verification
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

🎉 Build Assets are ready!

Type	File	Checksum
Wheel	treefort-0.5.0b2-py3-none-any.whl	76f67d2d10c1bf4c6388046ed37c1520abacdfb7c2a045051194ec45c18f9b9d
PEX	treefort.pex	648adc282f70cff6a490f12798e0ce51027b3c5a1e3a26a71d64c96ba1cd7aad
Binary (amd64)	treefort-linux-amd64	b578277bf3f74bed846e5346dc24e1ea704864921a557fc0277c565d2e509c96
Binary (arm64)	treefort-linux-arm64	af03db7494e4adb3aecf0a07c125e115f18119c35efb881392082e767986fdd9

[bjester]

@dependabot rebase