diff --git a/updater/package_backend.py b/updater/package_backend.py
index 2aecb40..cf30e63 100644
--- a/updater/package_backend.py
+++ b/updater/package_backend.py
@@ -187,7 +187,13 @@ def _refresh_dependency_hashes(ref: PackageRef, *, timeout: str | None) -> None:
     ]
 
     for pattern, replacement, fake_pattern, final_template in replacements:
-        text, count = re.subn(pattern, replacement, ref.file_path.read_text(), count=1, flags=re.S)
+        text, count = re.subn(
+            pattern,
+            replacement,
+            ref.file_path.read_text(),
+            count=1,
+            flags=re.DOTALL,
+        )
         if not count:
             continue
         ref.file_path.write_text(text)
@@ -195,12 +201,12 @@ def _refresh_dependency_hashes(ref: PackageRef, *, timeout: str | None) -> None:
         got_hash = _last_got_hash(ref, timeout=timeout)
         updated, count = re.subn(
             fake_pattern,
-            lambda found: final_template.format(
+            lambda found, final_template=final_template, got_hash=got_hash: final_template.format(
                 prefix=found.group(1) if found.groups() else "", hash=got_hash
             ),
             refreshed,
             count=1,
-            flags=re.S,
+            flags=re.DOTALL,
         )
         if count:
             ref.file_path.write_text(updated)
@@ -208,7 +214,11 @@ def _refresh_dependency_hashes(ref: PackageRef, *, timeout: str | None) -> None:
 
 def _last_got_hash(ref: PackageRef, *, timeout: str | None) -> str:
     result = _build_with_fake_hash(ref, timeout=timeout)
-    match = re.search(r"^\s*got:\s*(sha256-[A-Za-z0-9+/=]+)$", result.stderr + result.stdout, re.M)
+    match = re.search(
+        r"^\s*got:\s*(sha256-[A-Za-z0-9+/=]+)$",
+        result.stderr + result.stdout,
+        re.MULTILINE,
+    )
     if not match:
         raise CommandError(["refresh-dependency-hash", ref.attr_path], result)
     return match.group(1)
diff --git a/updater/process.py b/updater/process.py
index 42a2684..b67fd12 100644
--- a/updater/process.py
+++ b/updater/process.py
@@ -34,8 +34,7 @@ def run(
         actual,
         cwd=cwd,
         text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
+        capture_output=True,
         check=False,
     )
     logger.info("command exited %d: %s", result.returncode, " ".join(actual))
diff --git a/updater/transactions.py b/updater/transactions.py
index 1206c2c..80e66f6 100644
--- a/updater/transactions.py
+++ b/updater/transactions.py
@@ -3,6 +3,7 @@ from __future__ import annotations
 import shutil
 import tempfile
 from pathlib import Path
+from typing import Self
 
 from .process import ROOT, run
 
@@ -15,7 +16,7 @@ class FileTransaction:
         self._backups: dict[Path, Path] = {}
         self.before_diff = git_changed_files()
 
-    def __enter__(self) -> FileTransaction:
+    def __enter__(self) -> Self:
         self._tmpdir = Path(tempfile.mkdtemp(prefix="update-package-"))
         for path in self._snapshot_files:
             backup = self._tmpdir / str(path.relative_to(ROOT)).replace("/", "__")