build(deps): bump pyinstaller from 6.12.0 to 6.13.0

[dependabot]

Bumps pyinstaller from 6.12.0 to 6.13.0.

Release notes

Sourced from pyinstaller's releases.

v6.13.0

Please see the v6.13.0 section of the changelog for a list of the changes since v6.12.0.

Changelog

Sourced from pyinstaller's changelog.

6.13.0 (2025-04-15)

Features

* (macOS) When assembling the executable, PyInstaller now modifies the
  Mach-O image UUID of all architecture slices in the executable, and
  sets them to a value derived from the hash of the embedded PKG archive
  and the original (bootloader's) UUID. This should ensure that different
  application executables have unique identifiers, as per
  `TN3178
  <https://developer.apple.com/documentation/technotes/tn3178-checking-for-and-resolving-build-uuid-problems>`_,
  which might be required by newer macOS features, such as
  `local network privacy
  <https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy#Build-time-considerations>`_.
  (:issue:`9056`)
* Extend analysis code so that when extension module is encountered, it
  checks for the presence of an adjacent ``.py`` or ``.pyi`` file, and
  if present, attempt to perform import analysis on such accompanying
  source/interface file. (:issue:`9084`)
Bugfix

* (Windows) Fix (de)serialization of ``WORD``-typed fields in the
  ``VersionInfo`` structure - it should be using 16-bit unsigned integer
  format (``'H'``) instead of signed one (``'h'``). This, for example,
  fixes the ``struct.error: 'h' format requires -32768 &lt;= number &lt;= 32767``
  error when ``VersionInfo`` contains a ``VarFileInfo`` / ``VarStruct``
  entry with the code page set to 65001. (:issue:`9086`)
* Fix detection of ``setuptools``-vendored modules (i.e., not packages)
  in the ``PyInstaller.utils.hooks.setuptools.SetuptoolsInfo`` hook utility
  class; for example, the ``setuptools/_vendor/typing_extensions.py`` module.
  (:issue:`9102`)
Deprecations

</code></pre>

<ul>

<li>Onefile in combination with macOS's .app bundles will be blocked in v7.0.

Onefile app bundles are not really single file and are heavily penalised by

macOS's security scanning. Please use onedir mode instead. (:issue:<code>9049</code>)</li>

</ul>

<p>Hooks</p>

<pre><code>

Add hook for PyQt6.QtStateMachine that was introduced in PyQt6

&lt;/tr&gt;&lt;/table&gt;

</code></pre>

</blockquote>

<p>... (truncated)</p>

</details>

<details>

<summary>Commits</summary>

<ul>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/306d4d92580fea7be7ff2c89ba112cdc6f73fac1&quot;&gt;&lt;code&gt;306d4d9&lt;/code&gt;&lt;/a> Release v6.13.0. [skip ci]</li>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/c5eb50cfb41eae75c9afc5535cd633e349606c1b&quot;&gt;&lt;code&gt;c5eb50c&lt;/code&gt;&lt;/a> hookutils: setuptools: fix detection of vendored modules</li>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/4c2d04f436e3aa3194938cddf3520033674e0c22&quot;&gt;&lt;code&gt;4c2d04f&lt;/code&gt;&lt;/a> tests: skip incompatible tests when running under Termux</li>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/67eb3f5f3459a4beb63c3982d161d8d948d2ae0a&quot;&gt;&lt;code&gt;67eb3f5&lt;/code&gt;&lt;/a> compat: add is_termux flag</li>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/d403842f4a2ea52bb05771ff5ce8b8136a90f693&quot;&gt;&lt;code&gt;d403842&lt;/code&gt;&lt;/a> ci: add a CI workflow for Termux</li>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/9c8665913e0a5440cab29711fe07612435d34385&quot;&gt;&lt;code&gt;9c86659&lt;/code&gt;&lt;/a> tests: xfail test_reproducible_subsequent_builds for python &lt; 3.11 on linux</li>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/d29458f5468cec40cce3b5bcc4763a1067dfe5f9&quot;&gt;&lt;code&gt;d29458f&lt;/code&gt;&lt;/a> Tests: Requirements: Scheduled weekly dependency update for week 15 (<a href="https://redirect.github.com/pyinstaller/pyinstaller/issues/9097&quot;&gt;#9097&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/97372400c13440c65d061bf4514c9f76fdae8480&quot;&gt;&lt;code&gt;9737240&lt;/code&gt;&lt;/a> bootloader: have onefile parent always pre-load system VC runtime DLLs</li>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/1b94ea1d64d83f4c5faafe2cda793e6834d4e768&quot;&gt;&lt;code&gt;1b94ea1&lt;/code&gt;&lt;/a> bootloader: perform onefile parent/child sync with POSIX semaphore</li>

<li><a href="https://github.com/pyinstaller/pyinstaller/commit/eb236fb4f05d1f0715602a3efdda530233aff8c9&quot;&gt;&lt;code&gt;eb236fb&lt;/code&gt;&lt;/a> Tests: Requirements: Scheduled weekly dependency update for week 14 (<a href="https://redirect.github.com/pyinstaller/pyinstaller/issues/9090&quot;&gt;#9090&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/pyinstaller/pyinstaller/compare/v6.12.0...v6.13.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />



Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options


You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pyinstaller-hooks-contrib@​2025.1 ⏵ 2025.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click for details)
Warn		pypi/[email protected] has a License Policy Violation. License: GPL-2.0 (pyinstaller_hooks_contrib-2025.2/LICENSE) License: GPL-2.0 (pyinstaller_hooks_contrib-2025.2/PKG-INFO) Source: poetry.lock ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		pypi/[email protected] has a License Policy Violation. License: GPL-2.0 (pyinstaller_hooks_contrib-2025.2.dist-info/licenses/LICENSE) License: GPL-2.0 (pyinstaller_hooks_contrib-2025.2.dist-info/METADATA) Source: poetry.lock ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[coveralls-official]

Pull Request Test Coverage Report for Build 14521829124

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 23 unchanged lines in 7 files lost coverage.
• Overall coverage decreased (-0.008%) to 91.274%

---

Files with Coverage Reduction	New Missed Lines	%
chia/plotters/plotters.py	1	90.94%
chia/timelord/timelord_launcher.py	2	90.71%
chia/wallet/wallet_node.py	2	87.83%
chia/wallet/wallet_state_manager.py	3	97.07%
chia/server/node_discovery.py	4	81.18%
chia/server/address_manager.py	5	90.31%
chia/plotters/madmax.py	6	44.58%

Totals
Change from base Build 14521785901:	-0.008%
Covered Lines:	100869
Relevant Lines:	110380

---

💛 - Coveralls