Skip to content

build(deps-dev): bump the python-type-checkers group across 1 directory with 2 updates - #8943

Closed
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/pip/python/python-type-checkers-ca7b8a4036
Closed

build(deps-dev): bump the python-type-checkers group across 1 directory with 2 updates#8943
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/pip/python/python-type-checkers-ca7b8a4036

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-type-checkers group with 2 updates in the /python directory: ty and zuban.

Updates ty from 0.0.81 to 0.0.84

Release notes

Sourced from ty's releases.

0.0.84

Release Notes

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

  • Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

  • Complete string keys from dictionary initializers (#28820)
  • Support LSP requests against closed documents (#28595)
  • Select projects for external files using import search paths (#28594)
  • Use workspace editor settings for external files (#28639)

Performance

  • Avoid repeated subtyping checks for materialized recursive protocols (#28774)
  • Skip reading notebooks when discovering scripts (#28781)

Core type checking

  • Avoid incorrect simplification of TypeIs materializations (#28817)
  • Fix disjointness of generic class types (#28787)
  • Fix staticmethod shadowing through generic receivers and unions (#28766)
  • Infer callable signatures from bounded type variables (#28599)
  • Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
  • Infer through optional generic containers in the legacy solver (#28791)
  • Preserve call narrowing during cyclic inference (#28708)
  • Preserve intersections of type guard return types (#28796)
  • Use subtyping for constraint-set implication (#28657)

Configuration

  • Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

  • Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.84

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

  • Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

  • Complete string keys from dictionary initializers (#28820)
  • Support LSP requests against closed documents (#28595)
  • Select projects for external files using import search paths (#28594)
  • Use workspace editor settings for external files (#28639)

Performance

  • Avoid repeated subtyping checks for materialized recursive protocols (#28774)
  • Skip reading notebooks when discovering scripts (#28781)

Core type checking

  • Avoid incorrect simplification of TypeIs materializations (#28817)
  • Fix disjointness of generic class types (#28787)
  • Fix staticmethod shadowing through generic receivers and unions (#28766)
  • Infer callable signatures from bounded type variables (#28599)
  • Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
  • Infer through optional generic containers in the legacy solver (#28791)
  • Preserve call narrowing during cyclic inference (#28708)
  • Preserve intersections of type guard return types (#28796)
  • Use subtyping for constraint-set implication (#28657)

Configuration

  • Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

  • Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

... (truncated)

Commits

Updates zuban from 0.9.3 to 0.10.0

Release notes

Sourced from zuban's releases.

v0.10.0

Full changelog available here

Commits
  • 7cac037 chore: Release
  • af1f8c9 Fix context for ternary expressions, fixes #558
  • 50743df Fix documentation for narrowed left sides of assignments, fixes #565
  • a0d12b9 Add more debug information
  • deed67b More debug
  • eb1b631 Use Mypy's fallback mechanism for overloads again to infer more specific retu...
  • 91e5259 Improve the issue messages for recursive type definitions
  • 1f0868d Implement the new conformance test name resolution for forward references
  • 9271875 Fix builtins symbols lookups, which is related to the recent conformance test...
  • 656211d Unify annotation names lookups
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Usage: [Issues, PRs], Target: dependencies in the project python Usage: [Issues, PRs], Target: Python labels Oct 1, 2026
Copilot AI balanced review requested due to automatic review settings October 1, 2026 14:43
@dependabot dependabot Bot added the python Usage: [Issues, PRs], Target: Python label Oct 1, 2026
@dependabot dependabot Bot added the dependencies Usage: [Issues, PRs], Target: dependencies in the project label Oct 1, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 1, 2026 14:43 Inactive
@github-actions github-actions Bot changed the title build(deps-dev): bump the python-type-checkers group across 1 directory with 2 updates Python: build(deps-dev): bump the python-type-checkers group across 1 directory with 2 updates Oct 1, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 1, 2026 14:44 Inactive
Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The committed lockfile must be regenerated so frozen installs use the upgraded versions.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)
What changed in this PR

Updates Python development type checkers, including ty’s security fix.

Changes:

  • Bumps ty from 0.0.81 to 0.0.84.
  • Bumps zuban from 0.9.3 to 0.10.0.
File Description
python/​pyproject.toml Updates type-checker dependency pins.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment thread python/pyproject.toml
@moonbox3

Evan Mattson (moonbox3) commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

Copilot fix the PR comment and the failing CI/CD checks. Approve whatever plan you come up with.

@dependabot
dependabot Bot temporarily deployed to github-app-auth October 2, 2026 01:31 Inactive
@dependabot
build(deps-dev): bump the python-type-checkers group across 1 directo…
122a6b7 
…ry with 2 updates

Bumps the python-type-checkers group with 2 updates in the /python directory: [ty](https://github.com/astral-sh/ty) and [zuban](https://github.com/zubanls/zubanls-python).


Updates `ty` from 0.0.81 to 0.0.84
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.81...0.0.84)

Updates `zuban` from 0.9.3 to 0.10.0
- [Release notes](https://github.com/zubanls/zubanls-python/releases)
- [Commits](zubanls/zuban@v0.9.3...v0.10.0)

---
updated-dependencies:
- dependency-name: ty
  dependency-version: 0.0.84
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-type-checkers
- dependency-name: zuban
  dependency-version: 0.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-type-checkers
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 2, 2026 01:33 Inactive
@dependabot dependabot Bot changed the title Python: build(deps-dev): bump the python-type-checkers group across 1 directory with 2 updates build(deps-dev): bump the python-type-checkers group across 1 directory with 2 updates Oct 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/python/python-type-checkers-ca7b8a4036 branch from c327788 to 122a6b7 Compare October 2, 2026 01:33
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 2, 2026 01:33 Inactive
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 2, 2026 01:33 Inactive
@moonbox3
Update Python checker lock and restore typing CI
eaa3bdf 
Co-authored-by: moonbox3 <35585003+moonbox3@users.noreply.github.com>

Copilot AI commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

Copilot fix the PR comment and the failing CI/CD checks. Approve whatever plan you come up with.

Fixed in eaa3bdf: regenerated python/uv.lock for both upgrades and addressed the typing-check failures. Frozen installs, the targeted test, and the full Python typing task pass locally; the new CI run is still in progress.

@moonbox3

Evan Mattson (moonbox3) commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

Copilot address the open PR comment. Approve whatever plan you come up with.

Copilot AI commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

Copilot address the open PR comment. Approve whatever plan you come up with.

The open lockfile review was addressed in eaa3bdf; I replied directly on its thread with the commit and verified both locked versions. The thread remains marked open because the available PR tools cannot resolve review threads. The newer CI workflows show action_required with no jobs, not a failing test.

Copilot AI temporarily deployed to github-app-auth October 7, 2026 13:07 Inactive
@eavanvalkenburg

Eduard van Valkenburg (eavanvalkenburg) commented Oct 7, 2026

Copy link
Copy Markdown
Member

Copilot fix the merge conflicts and update the locks, both in the meta and labs packages

@eavanvalkenburg
Merge remote-tracking branch 'origin/main' into dependabot/pip/python…
6ef81f8 
…/python-type-checkers-ca7b8a4036

# Conflicts:
#	python/packages/core/tests/core/test_harness_tool_approval.py
#	python/pyproject.toml
#	python/uv.lock

Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>

Copilot AI commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Copilot fix the merge conflicts and update the locks, both in the meta and labs packages

Resolved the conflicts by merging current main in 6ef81f84. Both the meta workspace and standalone Lab locks are current and pass uv lock --check (including with the pre-commit uv version); frozen installs, the focused test, and core ty/zuban checks pass. Main already contained the Lab lock refresh, so no additional Lab-only diff was necessary.

Copilot AI temporarily deployed to github-app-auth October 7, 2026 13:36 Inactive
@dependabot @github

dependabot Bot commented on behalf of github Oct 7, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/pip/python/python-type-checkers-ca7b8a4036 branch October 7, 2026 13:37

This branch was previously deployed

1 inactive deployment
github-app-auth — 6ef81f84 Deployed Oct 7, 2026 by Copilot via add_label #24641
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
Copilot code review Copilot Copilot left review comments
@eavanvalkenburg Eduard van Valkenburg (eavanvalkenburg) Awaiting requested review from eavanvalkenburg eavanvalkenburg is a code owner
@SergeyMenshykh SergeyMenshykh Awaiting requested review from SergeyMenshykh SergeyMenshykh is a code owner
@rogerbarreto Roger Barreto (rogerbarreto) Awaiting requested review from rogerbarreto rogerbarreto is a code owner
@westey-m westey (westey-m) Awaiting requested review from westey-m westey-m is a code owner
@moonbox3 Evan Mattson (moonbox3) Awaiting requested review from moonbox3 moonbox3 is a code owner
@jpalvarezl Jose Alvarez (jpalvarezl) Awaiting requested review from jpalvarezl jpalvarezl is a code owner
@sophia-ramsey sophia-ramsey Awaiting requested review from sophia-ramsey sophia-ramsey is a code owner
@TaoChenOSU Tao Chen (TaoChenOSU) Awaiting requested review from TaoChenOSU TaoChenOSU is a code owner
@giles17 Giles Odigwe (giles17) Awaiting requested review from giles17 giles17 is a code owner

Assignees

No one assigned

Labels

dependencies Usage: [Issues, PRs], Target: dependencies in the project python Usage: [Issues, PRs], Target: Python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@moonbox3 @eavanvalkenburg