chore(deps-dev): bump the dev group with 5 updates

[dependabot]

Updates the requirements on ruff, ty, pyrefly, types-requests and zizmor to permit the latest version.
Updates ruff to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879

... (truncated)

Commits

• b5dba86 Bump version to 0.16.7 (#28496)
• 5992d05 Install rustfmt before linting releases (#28495)
• 1713a1f ensure prepare release changes pass prek (#28488)
• 18cdbb4 use scoped token for release workflow (#28484)
• c3813a5 add a workflow for preparing releases (#28486)
• 00948c0 Remove the "Who’s Using Ruff?" list (#28455)
• 86a2eba [pyupgrade] Stop recommending removed typing.no_type_check_decorator (`UP...
• 609e184 Stop defining __cached__ for Python 3.15 (#28476)
• 859ff2f [ty] Track symlinked directory status in listings (#28482)
• 77f6538 Use paid GitHub-hosted runners for Linux (#28478)
• Additional commits viewable in compare view

Updates ty to 0.0.80

Release notes

Sourced from ty's releases.

0.0.80

Release Notes

Released on 2026-09-09.

Bug fixes

• Fix --force-exclude for directories with an excluded ancestor (#28451)
• Preserve metaclass candidates after conflicts (#28461)

LSP server

• Give existing autofixes descriptive titles (#28456)
• Prevent LSP hangs during inlay hint bursts (#28390)

Diagnostic improvements

• Preserve redundant-condition diagnostics with unreachable operands (#28374)

Core type checking

• Check captured receivers when calling wrapped classmethods (#28467)
• Fix cached classmethods on generic classes (#28207)
• Fix disjointness of type guards and boolean literals (#28363)
• Infer tuple variance from the full tuple spec (#28446)
• Infer tuple variance more precisely (#28426)
• Preserve callable identity across specialized types (#28409)
• Preserve callback type context through ParamSpec forwarding (#28439)
• Preserve wrapped functions in precise functools.partial relations (#28460)
• Respect descriptor protocol for __set__ itself (#28408)
• Respect type-variable bounds in argument context (#28448)
• Unwrap union alternatives in overload implementations (#28468)

Performance

• Distribute len inference over unions (#28470)
• Fast-path concrete literal intersections (#28348)

Memory usage improvements

• Avoid excess capacity in multi-binding tables (#28412)
• Share equivalent place tables within a file (#28319)
• Share names in synthesized constructor parameters (#28398)

Contributors

• @​sharkdp
• @​charliermarsh
• @​ibraheemdev
• @​AlexWaygood

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.80

Released on 2026-09-09.

Bug fixes

• Fix --force-exclude for directories with an excluded ancestor (#28451)
• Preserve metaclass candidates after conflicts (#28461)

LSP server

• Give existing autofixes descriptive titles (#28456)
• Prevent LSP hangs during inlay hint bursts (#28390)

Diagnostic improvements

• Preserve redundant-condition diagnostics with unreachable operands (#28374)

Core type checking

• Check captured receivers when calling wrapped classmethods (#28467)
• Fix cached classmethods on generic classes (#28207)
• Fix disjointness of type guards and boolean literals (#28363)
• Infer tuple variance from the full tuple spec (#28446)
• Infer tuple variance more precisely (#28426)
• Preserve callable identity across specialized types (#28409)
• Preserve callback type context through ParamSpec forwarding (#28439)
• Preserve wrapped functions in precise functools.partial relations (#28460)
• Respect descriptor protocol for __set__ itself (#28408)
• Respect type-variable bounds in argument context (#28448)
• Unwrap union alternatives in overload implementations (#28468)

Performance

• Distribute len inference over unions (#28470)
• Fast-path concrete literal intersections (#28348)

Memory usage improvements

• Avoid excess capacity in multi-binding tables (#28412)
• Share equivalent place tables within a file (#28319)
• Share names in synthesized constructor parameters (#28398)

Contributors

• @​sharkdp
• @​charliermarsh
• @​ibraheemdev
• @​AlexWaygood
• @​MichaReiser

... (truncated)

Commits

• 7fd8e15 Bump version to 0.0.80 (#4501)
• c163f21 Update dependency prek to v0.4.12 (#4494)
• 8ce0450 Update prek dependencies (#4495)
• 5d0aa7a Update actions/attest-build-provenance action to v4.2.2 (#4497)
• e22b86b Update Swatinem/rust-cache action to v2.9.2 (#4496)
• 5cde40f Document uv integration and workspace trust settings (#4339)
• b4cd792 Bump version to 0.0.79 (#4484)
• 52f2d5b Add a GitHub repository threat model for ty (#4481)
• fd0d789 Declare support for Python 3.15 (#4476)
• 7e7a87d Improve rooster-generated changelog sections (#4473)
• Additional commits viewable in compare view

Updates pyrefly to 1.3.0

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.3.0

Release date: September 10, 2026

Pyrefly v1.3.0 bundles 934 commits from 71 contributors.

---

🔍Release Highlights

Type Checking

• New diagnostics and more accurate type inference. Pyrefly now catches invalid literal regular expressions, invalid mock.patch targets, unsupported dataclass_transform arguments, incompatible Protocol.__call__ overrides, and unimplemented abstract methods. Pattern-match exhaustiveness, overload resolution, narrowing, and generic inference are also more accurate.
• Better support for major Python frameworks. Pyrefly understands same-file Django reverse relationships, checks SQLAlchemy updates against model fields, and recognizes attributes registered on PyTorch modules.

Language Server

• Search the whole workspace for methods and nested definitions. Workspace symbol search now covers methods, nested classes and functions, and class attributes even in unopened files.
• New editor refactorings and quick fixes. Change Signature updates a function and its call sites together, while new quick fixes remove unused imports and insert assert x is not None. Inlay hints can also insert required imports and link to definitions.

Configuration & CLI

• Target individual Pyrefly errors with standard suppression comments. # type: ignore[pyrefly:<code>] suppresses a specific Pyrefly diagnostic without hiding unrelated errors on the same line.
• Choose how Pyrefly handles untyped dependencies. The new --replace-untyped-imports-with-any option replaces selected third-party packages that lack stubs or a py.typed marker with Any, and pyrefly init translates mypy's follow_untyped_imports setting automatically.
• Baseline files are easier to maintain and review. Baselines can match by concise description instead of source position, use a compact format, show existing errors at reduced severity, remove stale entries with --prune-baseline, and reject them in CI with --error-stale-baseline.

Experimental Extensions

• Much broader shape-aware JAX and NumPy support. New JAX stubs cover array creation, manipulation, and linear algebra, while the new pyrefly-numpy-stubs package brings shape checking to NumPy. These stubs use a new type-level shape DSL, which replaces the old @shaped_array API.
• Expanded Polars and pandas DataFrame schema support. Pyrefly tracks Polars schemas through common DataFrame transformations, with support for typed Series and schema annotations. pandas columns= projections now preserve the requested schema as well.

---

✨ New & Improved

Type Checking

• Pattern matching gained stronger exhaustiveness checking, including tuple subjects and open types such as unions. Open-type exhaustiveness now has its own configurable non-exhaustive-match-open-type error kind.
• Overload selection now follows the latest typing specification more closely, producing a safe common return type for gradual arguments and reducing false positives in complex overloads.
• Type inference and narrowing are more precise for membership tests, equality checks, hasattr, wide Literal unions, callable values, reverse tuple slices, and values assigned from Any.
• Dataclass fields backed by descriptors are now checked for incompatible read and write types under the new bad-dataclass-descriptor error kind.
• String targets passed to unittest.mock.patch are validated, with nonexistent attributes reported as missing-attribute-patch-target warnings.
• Literal regular expressions are checked for invalid patterns and capturing groups under the new regex error kind.
• Django support now understands reverse ForeignKey, OneToOneField, and ManyToManyField relationships in the same file, while Django REST Framework serializers avoid false override errors for common Meta and field patterns.
• SQLAlchemy update().values() checks values against mapped model fields.
• PyTorch modules recognize attributes registered through register_buffer and register_parameter.

Language Server

• Workspace symbol search now includes methods, nested classes, nested functions, and class attributes.
• Cross-file call hierarchy, type hierarchy, and find-references now work without first opening every relevant file.

... (truncated)

Commits

• 624bdc4 cut 1.3.0
• ad6958c feat: support Pyrefly-specific type ignore codes
• f1d8f62 Bump fast-uri from 3.1.5 to 3.1.7 in /website (#4789)
• cb178b9 add type stubs for remaining jax.lax APIs (#4875)
• 8ee41ca Model polars join(..., coalesce=...) (#4833) (#4859)
• 5d00010 Find methods and other nested definitions in workspace symbols
• 5b392ca Cache flat symbols for first-party modules
• eaa1fd2 Trim the add_var_bound doc comment to its invariant
• df4cfe0 Add build system integration tests (#3628)
• aec8224 Deduplicate and stably rank workspace symbol results
• Additional commits viewable in compare view

Updates types-requests to 2.33.0.20260906

Commits

• See full diff in compare view

Updates zizmor to 1.30.1

Release notes

Sourced from zizmor's releases.

v1.30.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

• Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

Changelog

Sourced from zizmor's changelog.

1.30.1

Bug Fixes 🐛

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

• Fixed a bug where [self-repository] auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

1.30.0

New Features 🌈

• New audit: [self-repository] detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)

Enhancements 🌱

• The [impostor-commit] audit now supports pre-commit config inputs (#2256)

• The [forbidden-uses] audit now supports pre-commit config inputs (#2263)

• The [adhoc-packages] audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The [archived-uses] audit now supports pre-commit config inputs (#2272)

• The [ref-confusion] audit now supports pre-commit config inputs (#2274)

• The [cache-poisoning] audit now produces more detailed and more precise diagnostics (#2330)

• The [cache-poisoning] audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes @​sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The [unpinned-tools] audit now produces more detailed and more precise diagnostics (#2339)

• The [unpinned-tools] audit now detects usages of @​extractions/setup-just (#2339)

• The [unpinned-tools] audit now detects usages of @​extractions/setup-crate (#2340)

• The [archived-uses] audit now detects several more archived repositories (#2340)

• The [ref-version-mismatch] audit now supports #!yaml uses: that reference

... (truncated)

Commits

• 99a054e zizmor 1.30.1 (#2375)
• f8be5a2 docs: bump GHA pins (#2374)
• efdff0a Mark self-repository fixes as unsafe (#2373)
• 4cdfcca chore(deps): bump the cargo group with 3 updates (#2355)
• df617de Handle .git URLs correctly (#2363)
• 0500d71 chore(deps): bump the github-actions group with 3 updates (#2356)
• aebd747 chore(deps-dev): bump zensical from 0.0.53 to 0.0.57 in the uv group (#2357)
• f6d7aa6 docs: Add instructions for Sublime Text (#2354)
• 5526208 Fix typo spelling error in audits docs (#2360)
• 8d529fe docs: bump version (#2352)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions