[dependabot]

Bumps the python-packages group with 10 updates:

Package	From	To
sqlmodel	0.0.42	0.0.47
uvicorn	0.52.4	0.54.0
logfire[celery,fastapi,httpx,requests,sqlalchemy,system-metrics]	5.0.0	5.1.1
sentry-sdk	2.68.1	2.70.0
psycopg2-binary	2.9.12	2.9.13
phonenumbers	9.0.38	9.0.40
ruff	0.16.6	0.16.9
ty	0.0.78	0.0.84
coverage	7.16.0	7.16.2
pytest-env	1.7.0	1.7.1

Updates sqlmodel from 0.0.42 to 0.0.47

Release notes

Sourced from sqlmodel's releases.

0.0.47

Features

• ✨ Add direct support for PostgreSQL, MySQL, and MariaDB, include in CI tests. PR #2103 by @​tiangolo.

0.0.46

Fixes

• 🐛 Fix timedelta arithmetic with UTC datetime fields. PR #2101 by @​tiangolo.

0.0.45

Breaking Changes

• ✨ Use UTC datetimes by default. PR #2099 by @​tiangolo.

datetime fields now use UTCDateTime, a custom type based on DateTime(timezone=True). It requires aware datetime parameters, normalizes them to UTC, and returns aware UTC values from database reads, including on SQLite and MySQL/MariaDB. Pydantic's AwareDatetime uses the same type, while NaiveDatetime explicitly selects DateTime(timezone=False). Plain datetime validation still accepts both aware and naive values, but naive database parameters now raise an error.

Existing databases are not changed automatically. To retain naive storage, use NaiveDatetime or an explicit Field(sa_type=DateTime(timezone=False)). Explicit SQLAlchemy types retain their existing behavior. PostgreSQL needs a column migration that explicitly specifies the timezone of existing values. SQLite and MySQL/MariaDB keep their column definitions, but existing non-UTC values need a data migration before adopting the new type. Update datetime producers, query parameters, comparisons, and any database defaults to follow the new UTC convention.

Read Datetimes and Timezones: Upgrade Existing Applications before upgrading.

0.0.44

Refactors

• ♻️ Replace the dataclass_transform shim with typing_extensions. PR #2097 by @​tiangolo.

0.0.43

Fixes

• 🐛 Fix SQLAlchemy type handling in Field. PR #2095 by @​tiangolo.

Internal

• ⬆ Bump sqlalchemy from 2.0.51 to 2.0.52. PR #2086 by @​dependabot[bot].
• ⬆ Bump the python-packages group with 9 updates. PR #2085 by @​dependabot[bot].
• ⬆ Bump the github-actions group with 4 updates. PR #2084 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #2083 by @​pr-submit[bot].

Changelog

Sourced from sqlmodel's changelog.

0.0.47 (2026-09-23)

Features

• ✨ Add direct support for PostgreSQL, MySQL, and MariaDB, include in CI tests. PR #2103 by @​tiangolo.

0.0.46 (2026-09-22)

Fixes

• 🐛 Fix timedelta arithmetic with UTC datetime fields. PR #2101 by @​tiangolo.

0.0.45 (2026-09-21)

Breaking Changes

• ✨ Use UTC datetimes by default. PR #2099 by @​tiangolo.

datetime fields now use UTCDateTime, a custom type based on DateTime(timezone=True). It requires aware datetime parameters, normalizes them to UTC, and returns aware UTC values from database reads, including on SQLite and MySQL/MariaDB. Pydantic's AwareDatetime uses the same type, while NaiveDatetime explicitly selects DateTime(timezone=False). Plain datetime validation still accepts both aware and naive values, but naive database parameters now raise an error.

Existing databases are not changed automatically. To retain naive storage, use NaiveDatetime or an explicit Field(sa_type=DateTime(timezone=False)). Explicit SQLAlchemy types retain their existing behavior. PostgreSQL needs a column migration that explicitly specifies the timezone of existing values. SQLite and MySQL/MariaDB keep their column definitions, but existing non-UTC values need a data migration before adopting the new type. Update datetime producers, query parameters, comparisons, and any database defaults to follow the new UTC convention.

Read Datetimes and Timezones: Upgrade Existing Applications before upgrading.

0.0.44 (2026-09-21)

Refactors

• ♻️ Replace the dataclass_transform shim with typing_extensions. PR #2097 by @​tiangolo.

0.0.43 (2026-09-21)

Fixes

• 🐛 Fix SQLAlchemy type handling in Field. PR #2095 by @​tiangolo.

Internal

• ⬆ Bump sqlalchemy from 2.0.51 to 2.0.52. PR #2086 by @​dependabot[bot].
• ⬆ Bump the python-packages group with 9 updates. PR #2085 by @​dependabot[bot].
• ⬆ Bump the github-actions group with 4 updates. PR #2084 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #2083 by @​pr-submit[bot].

Commits

• 1c46f0d 🔖 Release version 0.0.47 (#2104)
• 3e745cb 📝 Update release notes
• 8da9235 ✨ Add direct support for PostgreSQL, MySQL, and MariaDB, include in CI tests ...
• 72bca1e 🔖 Release version 0.0.46 (#2102)
• 6e61179 📝 Update release notes
• bc809ca 🐛 Fix timedelta arithmetic with UTC datetime fields (#2101)
• dcaf329 🔖 Release version 0.0.45 (#2100)
• de21fd3 📝 Update release notes
• cc998aa ✨ Use UTC datetimes by default (#2099)
• ff86856 🔖 Release version 0.0.44 (#2098)
• Additional commits viewable in compare view

Updates uvicorn from 0.52.4 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• Additional commits viewable in compare view

Updates logfire[celery,fastapi,httpx,requests,sqlalchemy,system-metrics] from 5.0.0 to 5.1.1

Release notes

Sourced from logfire[celery,fastapi,httpx,requests,sqlalchemy,system-metrics]'s releases.

v5.1.1

Fixes

• Handle project setup for accounts without organizations by @​strawgate in #2470
• Enable TCP keepalive and recycle idle connections in Logfire's HTTP sessions by @​adriangb in #2476

v5.1.0

Integrations

• Add logfire.instrument_litestar() with support for Litestar 2.11 and later by @​dmontagu in #2249
• Recommend Logfire extras when logfire run detects missing instrumentation packages by @​krishna3554 in #2082

Agent setup

• Use canonical URLs between published Logfire skills by @​strawgate in #2373
• Preserve the selected Logfire region or custom base URL throughout setup by @​strawgate in #2377
• Continue project selection and verification after browser authentication by @​strawgate in #2384
• Make eval setup executable for Python and Node.js by @​strawgate in #2400 and #2402
• Correct setup guidance for Python, Node.js, Rust, and Gunicorn by @​adtyavrdhn in #2365

Fixes

• Prevent OpenTelemetry logging from deadlocking during force_flush() by @​L4XB in #2404
• Require directory boundaries when identifying non-user code paths by @​yhz5613813 in #2375

New Contributors

• @​yhz5613813 made their first contribution in #2375
• @​krishna3554 made their first contribution in #2082
• @​L4XB made their first contribution in #2404

Changelog

Sourced from logfire[celery,fastapi,httpx,requests,sqlalchemy,system-metrics]'s changelog.

[v5.1.1] (2026-09-25)

Fixes

• Handle project setup for accounts without organizations by @​strawgate in #2470
• Enable TCP keepalive and recycle idle connections in Logfire's HTTP sessions by @​adriangb in #2476

[v5.1.0] (2026-09-11)

Integrations

• Add logfire.instrument_litestar() with support for Litestar 2.11 and later by @​dmontagu in #2249
• Recommend Logfire extras when logfire run detects missing instrumentation packages by @​krishna3554 in #2082

Agent setup

• Use canonical URLs between published Logfire skills by @​strawgate in #2373
• Preserve the selected Logfire region or custom base URL throughout setup by @​strawgate in #2377
• Continue project selection and verification after browser authentication by @​strawgate in #2384
• Make eval setup executable for Python and Node.js by @​strawgate in #2400 and #2402
• Correct setup guidance for Python, Node.js, Rust, and Gunicorn by @​adtyavrdhn in #2365

Fixes

• Prevent OpenTelemetry logging from deadlocking during force_flush() by @​L4XB in #2404
• Require directory boundaries when identifying non-user code paths by @​yhz5613813 in #2375

New Contributors

• @​yhz5613813 made their first contribution in #2375
• @​krishna3554 made their first contribution in #2082
• @​L4XB made their first contribution in #2404

Commits

• 6b5ac61 Release v5.1.1 (#2483)
• c26516e [v5] Enable TCP keepalive and recycle idle connections in Logfire's HTTP sess...
• a5c9fdb [v5] Handle project setup for accounts without organizations (#2470)
• 17cc059 Release v5.1.0 (#2406)
• acd485f Harden the OpenTelemetry flush regression test (#2405)
• e209cda Fix Logfire setup skill guidance (#2365)
• bb17649 Prevent OpenTelemetry logging from deadlocking during flush (#2404)
• 5905b8e Route eval setup through the Logfire evals skill (#2402)
• 6e08b41 Make the Logfire evals skill executable for Python and Node.js (#2400)
• 67dae06 Document agent framework coverage across Logfire views (#2386)
• Additional commits viewable in compare view

Updates sentry-sdk from 2.68.1 to 2.70.0

Release notes

Sourced from sentry-sdk's releases.

2.70.0

New Features ✨

• New integration: Mistral AI (#4733) by @​alexander-alderman-webb

  Add the Mistral integration to your sentry_sdk.init call:

import sentry_sdk
from sentry_sdk.integrations.mistral import MistralIntegration
sentry_sdk.init(
dsn="...",
traces_sample_rate=1.0,
integrations=[
MistralIntegration(),
]
)

• New option: A fine-grained way to configure what data should be sent from the SDK.

  Offers much more flexibility than send_default_pii, allowing you to specify what data should be collected. If data_collection is defined, it takes precedence over send_default_pii.

  See https://docs.sentry.io/platforms/python/configuration/options/#data_collection for the available configuration options.

import sentry_sdk
sentry_sdk.init(
data_collection={
"user_info": False,
"gen_ai": {"inputs": False, "outputs": False},
"graphql": {"document": False, "variables": False},
"database_query_data": False,
"queues": False,
"http_bodies": [],
"cookies": {
"mode": "denylist",
"terms": ["forwarded", "-ip", "remote-", "via", "-user"],
},
"http_headers": {
"request": {
"mode": "denylist",
"terms": ["forwarded", "-ip", "remote-", "via", "-user"],
},
},
</tr></table>

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.70.0

New Features ✨

• New integration: Mistral AI (#4733) by @​alexander-alderman-webb

  Add the Mistral integration to your sentry_sdk.init call:

import sentry_sdk
from sentry_sdk.integrations.mistral import MistralIntegration
sentry_sdk.init(
dsn="...",
traces_sample_rate=1.0,
integrations=[
MistralIntegration(),
]
)

• New option: A fine-grained way to configure what data should be sent from the SDK.

  Offers much more flexibility than send_default_pii, allowing you to specify what data should be collected. If data_collection is defined, it takes precedence over send_default_pii.

  See https://docs.sentry.io/platforms/python/configuration/options/#data_collection for the available configuration options.

import sentry_sdk
sentry_sdk.init(
data_collection={
"user_info": False,
"gen_ai": {"inputs": False, "outputs": False},
"graphql": {"document": False, "variables": False},
"database_query_data": False,
"queues": False,
"http_bodies": [],
"cookies": {
"mode": "denylist",
"terms": ["forwarded", "-ip", "remote-", "via", "-user"],
},
"http_headers": {
"request": {
"mode": "denylist",
"terms": ["forwarded", "-ip", "remote-", "via", "-user"],
},
</tr></table>

... (truncated)

Commits

• 1eb7df5 Update CHANGELOG.md
• 92fd42b release: 2.70.0
• d99edef ref(data-collection): Promote data_collection from _experiments o top-lev...
• 045d2c1 test: Close client on teardown (#7562)
• b454d7d feat(mistral): Record gen_ai.output.messages (#7549)
• bdfd68c feat(mistral): Record gen_ai.input.messages (#7548)
• ea08f64 feat(mistral): Record gen_ai.system_instructions (#7547)
• dbddd0e feat(mistral): Record request parameters (#7531)
• 9342968 feat(mistral): Record token usage (#7529)
• 988fd0e feat(mistral): Add integration with Chat.complete and Chat.complete_async...
• Additional commits viewable in compare view

Updates psycopg2-binary from 2.9.12 to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
• Fix parsing of malformed bytea input.
• Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
• Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
• Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits

• f650e7a chore: bump to release 2.9.13
• 368c8a1 chore!: drop support for Python 3.9
• 9b39e65 chore: drop scaleway build support
• 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
• 5385c02 Build CPython 3.15 wheels
• 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
• 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
• 8fb80bc fix: fix parsing of malformed int64 input in arrays
• f98014a fix: fix parsing of malformed bytea input
• 822b79c chore: bump dependencies in binary package
• Additional commits viewable in compare view

Updates phonenumbers from 9.0.38 to 9.0.40

Commits

• 68c2f24 Prep for 9.0.40 release
• eed86a1 Generated files for metadata
• e3d0687 Merge metadata changes from upstream 9.0.40
• d4f9931 Configure pytest to collect the existing test wrapper (#327)
• fa1440b Fix generator script paths in developer documentation (#328)
• 56cafda Create SECURITY.md
• b69f05b Prep for 9.0.39 release
• 95ccaa2 Generated files for metadata
• 252b9c5 Merge metadata changes from upstream 9.0.39
• See full diff in compare view

Updates ruff from 0.16.6 to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#28699)
• Update rules table with category information (#28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#28509)
• [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
• [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

• @​qinpei-dev
• @​sanjayrohith
• @​ntBre
• @​webdevsamran
• @​zaniebot
• @​ewdurbin
• @​MichaReiser
• @​spaceone
• @​IbrahimKhan12
• @​devtechedge
• @​GruffElixir

Install ruff 0.16.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#28699)
• Update rules table with category information (#28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#28509)
• [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
• [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

• @​qinpei-dev
• @​sanjayrohith
• @​ntBre
• @​webdevsamran
• @​zaniebot
• @​ewdurbin
• @​MichaReiser
• @​spaceone
• @​IbrahimKhan12
• @​devtechedge
• @​GruffElixir

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)

... (truncated)

Commits

• 0be08a2 Bump version to 0.16.9 (#28882)
• b4920b7 Rename ruff_cli to ruff_command_line (#28881)
• 47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
• 8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
• 5edf5a1 Use target form in rooster.version_files (#28876)
• 915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
• 4710e1a ci(github): update version number in placeholder of issue template (#28871)
• eedfc62 [ty] Propagate outer type context through cast calls (#28855)
• ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
• dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
• Additional commits viewable in compare view

Updates ty from 0.0.78 to 0.0.84

Release notes

Sourced from ty's releases.

0.0.84

Release Notes

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

• Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

• Complete string keys from dictionary initializers (#28820)
• Support LSP requests against closed documents (#28595)
• Select projects for external files using import search paths (#28594)
• Use workspace editor settings for external files (#28639)

Performance

• Avoid repeated subtyping checks for materialized recursive protocols (#28774)
• Skip reading notebooks when discovering scripts (#28781)

Core type checking

• Avoid incorrect simplification of TypeIs materializations (#28817)
• Fix disjointness of generic class types (#28787)
• Fix staticmethod shadowing through generic receivers and unions (#28766)
• Infer callable signatures from bounded type variables (#28599)
• Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
• Infer through optional generic containers in the legacy solver (#28791)
• Preserve call narrowing during cyclic inference (#28708)
• Preserve intersections of type guard return types (#28796)
• Use subtyping for constraint-set implication (#28657)

Configuration

• Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

• Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

• @​ibraheemdev
• @​zsol
• @​charliermarsh
• @​lerebear
• @​MichaReiser

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.84

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

• Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

• Complete string keys from dictionary initializers (#28820)
• Support LSP requests against closed documents (#28595)
• Select projects for external files using import search paths (#28594)
• Use workspace editor settings for external files (#28639)

Performance

• Avoid repeated subtyping checks for materialized recursive protocols (#28774)
• Skip reading notebooks when discovering scripts (#28781)

Core type checking

• Avoid incorrect simplification of TypeIs materializations (#28817)
• Fix disjointness of generic class types (#28787)
• Fix staticmethod shadowing through generic receivers and unions (#28766)
• Infer callable signatures from bounded type variables (#28599)
• Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
• Infer through optional generic containers in the legacy solver (#28791)
• Preserve call narrowing during cyclic inference (#28708)
• Preserve intersections of type guard return types (#28796)
• Use subtyping for constraint-set implication (#28657)

Configuration

• Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

• Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

• @​ibraheemdev
• @​zsol
• @​charliermarsh
• @​lerebear
• @​MichaReiser
• @​ewdurbin

... (truncated)

Commits

• 8dd9a7f Bump version to 0.0.84 (#4585)
• d4e4bf9 publish to astral-sh/versions via OIDC (#4581)
• 94ce733 use oidc issued token for docs publication (#4579)
• 901eeaa Update prek dependencies (#4576)
• 09bf0b1 Update docker/setup-buildx-action action to v4.3.0 (#4575)
• 89d6ffe Update astral-sh/setup-uv action to v10.2.0 (#4574)
• 9c21479 Bump version to 0.0.83 (#4569)
• 04c6911 Sync the ty security mirror (#4549)
• 3fa57a2 Grant the versions workflow repository read access (#4550)
• a15b353 use scoped token for release workflow (#4506)
• Additional commits viewable in compare view

Updates coverage from 7.16.0 to 7.16.2

Release notes

Sourced from coverage's releases.

7.16.2

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

7.16.1

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
• Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed....

  Description has been truncated