chore(deps): update xa11y requirement from <0.9,>=0.8.2 to >=0.9.0,<0.10

[dependabot]

Warning

Dependabot will stop supporting python v3.9!

Please upgrade to one of the following versions: v3.9, v3.10, v3.11, v3.12, v3.13, or v3.14.

Updates the requirements on xa11y to permit the latest version.

Release notes

Sourced from xa11y's releases.

xa11y v0.9.0

What's Changed in v0.9.0

Breaking Changes

• The default timeout behavior has changed; users should now set a global timeout using set_default_timeout or the XA11Y_DEFAULT_TIMEOUT environment variable to override the previous hardcoded 5 seconds. (#262)

Deprecations

• The previous method of manually polling with App.list() is now discouraged in favor of the new App.find method. (#264)

Features

• The App.find method is now available in the Python API, allowing users to discover applications more easily without needing to manually poll with App.list(). (#264)
• A global default timeout can now be set using set_default_timeout or the XA11Y_DEFAULT_TIMEOUT environment variable, allowing users to adjust the timeout for all calls in one place instead of specifying it for each call. (#262)
• New design tenets have been implemented to ensure blocking calls release the host runtime's lock, improving performance and responsiveness in Python bindings. (#263)
• The App.by_pid(pid, timeout) method has been introduced as a robust way to attach to applications, enhancing the reliability of app discovery. (#258)
• Introduced App::find_with and App::try_find_with methods for predicate-based discovery in the core library, now available in Python and JavaScript bindings as App.find, enhancing element search capabilities. (#236)

Bug Fixes

• The library now retries the EVENT_E_ALL_SUBSCRIBERS_FAILED error on the UIA query path, improving stability during application discovery. (#260)
• The subscribe method now correctly fails with Error::Platform if any AX notification fails to register, ensuring better error handling on macOS. (#256)

Full Changelog: xa11y/xa11y@v0.8.2...v0.9.0

Commits

• 314f980 chore: Release
• 8c079be Surface App.find: stub parity tests, multi-app discovery docs, Qt quirks (#264)
• 3a190ca Add global default-timeout override (set_default_timeout / XA11Y_DEFAULT_TIME...
• 16f0a8b Add tenets 5 & 6: GIL-free waits and self-diagnosing errors (#263)
• bbe5f5b Robust app attach: PID-direct by_pid, attach diagnostics, macOS subscribe ret...
• 4b39f05 Retry EVENT_E_ALL_SUBSCRIBERS_FAILED (0x80040201) on the UIA query path (#260)
• bec1e1d Fix codebase-review findings: macOS event subscribe, CLI errors, test coverag...
• f7ed40b docs: fix GFM tables not rendering and add rendered-table linter check (#248)
• 1f01c79 Reword tagline: Playwright-style API -> library (#246)
• 8b89131 build(deps-dev): Bump @​types/node from 25.9.1 to 25.9.2 in /xa11y-js (#243)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)