Bump aqt from 25.2.5 to 25.9.4

[dependabot]

Bumps aqt from 25.2.5 to 25.9.4.

Release notes

Sourced from aqt's releases.

25.09.4

What's Changed

This is a security release. Please upgrade as soon as possible using Tools > Upgrade/Downgrade.

Importing untrusted decks (.apkg files) had the ability to read local files. This has now been fixed.

Other fixes and new features will follow in the next beta release.

Many thanks to @​Bankde for the excellent report and to @​abdnh, @​dae, and @​fernandolins for the fix! 🙏🏻

Installing

• If you're a new user, please grab the latest launcher from https://apps.ankiweb.net
• If you already have the 25.09 launcher, you can use Tools>Upgrade/Downgrade inside Anki.
• If you have an older launcher/Anki, please grab the latest launcher first, as the older one may or may not work.

25.09.3

What's Changed

This is a security release. Please upgrade as soon as possible using Tools > Upgrade/Downgrade.

Anki's local media server did not sufficiently validate requests, which could allow a malicious website to read local files while Anki was running. This had the potential to affect mostly Firefox and Safari users. Chrome already restricts local network access. Thanks to the great Tavis Ormandy (@​taviso) for the report.

All other fixes and new features since 25.09.2 will follow in a separate beta release.

Installing

• If you're a new user, please grab the latest launcher from https://apps.ankiweb.net
• If you already have the 25.09 launcher, you can use Tools>Upgrade/Downgrade inside Anki.
• If you have an older launcher/Anki, please grab the latest launcher first, as the older one may or may not work.

25.09.2

Installing

• If you're a new user, please grab the latest launcher from https://apps.ankiweb.net
• If you already have the 25.09 launcher, you can use Tools>Upgrade/Downgrade inside Anki.
• If you have an older launcher/Anki, please grab the latest launcher first, as the older one may or may not work.

What's Changed

• Fix custom colors not saving by @​iamllama in ankitects/anki#4326
• Decode images asynchronously during review. Please let us know if images in the review screen load faster or slower for you. By @​abdnh in ankitects/anki#4320
• Prevent clipping for QPushButton:default:hover by @​jcznk in ankitects/anki#4323
• Updated Dockerfile to use Ninja build system by @​e-hamrin in ankitects/anki#4321
• Fix/Add lower review limit to health check. by @​Luc-Mcgrady in ankitects/anki#4334
• Make timebox message translatable with flexible variable order by @​snowtimeglass in ankitects/anki#4338
• (UI polish) Improved margins in Card Browser's "Previewer" by @​jcznk in ankitects/anki#4337

New Contributors

• @​e-hamrin made their first contribution in ankitects/anki#4321

... (truncated)

Commits

• d52ca66 Draft release.
• 18f35ca Add arg attributes.
• 341452e Add workflows for publishing Python packages.
• 03de05a Prepare release 25.09.4
• c887bb3 Update release.just to include version parameter in prepare command
• 3854d22 Regenerate licenses.json.
• 41bb118 just fmt.
• f373daa Pull in changes to minilints.
• 636fbd7 ci: support releases from non-main branches
• 162e2ea Fix false-positive path in CSP smoke test for error events
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.