⬆️ Update pyinstaller requirement from ~=6.22.0 to ~=6.22.1

[dependabot]

Updates the requirements on pyinstaller to permit the latest version.

Release notes

Sourced from pyinstaller's releases.

v6.22.1

Please see the v6.22.1 section of the changelog for a list of the changes since v6.22.0.

Changelog

Sourced from pyinstaller's changelog.

6.22.1 (2026-08-15)

Bugfix

* Fix invalid spec file generation when :option:`--hide-console` option is
  given (regression introduced in v6.22.0). (:issue:`9503`)
* (NetBSD) Fix binary dependency analysis. (:issue:`9505`)
* (NetBSD) Fix/improve NetBSD support: add the ``is_netbsd`` platform
  flag, treat NetBSD as a Unix platform, and search ``/usr/local/lib`` for
  shared libraries, as is already done for FreeBSD and OpenBSD. (:issue:`9496`)
* (OpenBSD) Fix binary dependency analysis. (:issue:`9505`)
Incompatible Changes

• (POSIX) Executables built in onedir mode with setuid bit set now validate the owner and permissions on their contents directory (typically the _internal directory); the owner ID must match the effective user ID under which the process is running, and the permissions on the directory need to be 0700. This aims to prevent unprivileged users from modifying contents of an application that runs in privileged mode. (:issue:9492)
• (POSIX) When running as a onefile child process (on POSIX platforms other than OpenBSD and AIX), the bootloader now attempts to verify the parent process executable via procfs lookup. This check is mandatory for onefile executables with setuid bit set; if the relevant procfs entry is inaccessible (for example, due to procfs not being mounted, as is the case on FreeBSD by default, or due to access being blocked by local security policy), the process will exit with security validation error message. For regular onefile executables (without setuid bit set), the parent-process check is enforced when the relevant procfs entry is accessible, and skipped when it happens to be inaccessible. (:issue:9492)
• (POSIX) When running as a onefile child process and the executable has setuid bit set, the bootloader now validates the owner and permissions on the (inherited) temporary directory. The owner ID of the temporary directory must match the effective user ID under which the process is running, and permissions on the temporary directory are need to be 0700. This might (further) break applications that start in privileged mode and then attempt to drop privileges without transferring the ownership of the temporary directory to the unprivileged user; while formerly this would result in the main application process locking itself (as well as any sub-processes spawned by it via sys.executable) from the temporary directory, it will now also cause any subprocess spawned via sys.executable to fail the security validation the bootloader. (:issue:9492)
• (OpenBSD, AIX) Running onefile executables with setuid bit set

... (truncated)

Commits

• 22ea0f2 Release v6.22.1. [skip ci]
• e709c04 bootloader: relax parent-process validation requirements on POSIX platforms
• e0388d3 bootloader: relax parent-process validation requirements on FreeBSD
• 92afdf8 tests: test_application_home_directory_hijack: handle 8.3 short paths
• 4b509a2 tests: improve logging in test_application_home_directory_hijack
• 66b0249 doc: document the new security validation and its implications
• f17fbcd bootloader: update POSIX security codepath
• bb08b9a bootloader: include process ID in the temporary directory name
• ba16568 bootloader: verify the name of ephemeral application's home directory
• 42b60d9 bootloader: additional validation for _PYI_PARENT_PROCESS_LEVEL=-1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1062.