chore(deps): bump the python-minor-patch group with 4 updates

[dependabot]

Bumps the python-minor-patch group with 4 updates: flet, ruff, ty and hypothesis.

Updates flet from 0.86.2 to 0.86.5

Release notes

Sourced from flet's releases.

v0.86.5

Bug fixes

• Fix every flet_ads control (BannerAd, InterstitialAd, NativeAd, ConsentManager) crashing on construction with RuntimeError: <Ad>(N) Control must be added to the page first, which made the package unusable since 0.85. The mobile-only platform guard read self.page from init(), which runs at construction — before the control is attached to the page — so the parent-chain lookup raised. The guard is back in before_update(), a post-mount hook where self.page resolves, so ads construct freely and only reject web/desktop at mount time (#6726, #6735) by @​ndonkoHenri.

Improvements

• An Android permission set to false is now actively removed from the merged manifest instead of merely being left out of the generated one. Gradle's manifest merger folds in the manifest of every Flutter plugin and can also synthesize permissions on its own, and false previously had no effect on either — the template only skipped emitting the entry, so a plugin-contributed permission passed straight through with no way to stop it. Concretely: flet-camera pulls in camera_android_camerax, which declares WRITE_EXTERNAL_STORAGE bounded to maxSdkVersion="28", and the merger implies an unbounded READ_EXTERNAL_STORAGE from it (legacy behaviour — write once implied read). Both then appear in the Play Console despite being absent from pyproject.toml, and the unbounded read is exactly the shape Google Play's storage policy objects to. Permissions set to false now render as <uses-permission android:name="…" tools:node="remove" /> (the template's <manifest> gained the tools namespace), which strips them during the merge; removing a permission nothing declares is a harmless no-op. Verified on Flet Studio: 11 permissions down to 9, both storage entries gone from the built APK by @​FeodorFitsner.

• Bumped serious_python to 4.5.1 and re-pinned the bundled python-build snapshot to 20260730 (dart_bridge 1.7.1). serious_python 4.5.1 tracks the same python-build release, keeping PYTHON_BUILD_RELEASE_DATE in sync with its pythonReleaseDate as the pin requires by @​FeodorFitsner.

• Android ProGuard/R8 rules can now be extended from pyproject.toml via [tool.flet.android].proguard_rules. The generated project's android/app/proguard-rules.pro was a fixed template file, so an app that needed an extra keep rule had no way to add one short of downloading the published build template, patching the file and passing --template. This matters for Pyjnius: autoclass() resolves Java classes by name at runtime, and R8 renames anything in the APK that isn't kept — so autoclass() on a class bundled by a Flutter plugin or by your own Java/Kotlin fails in release builds. It fails hard: JNI FindClass returns null and the process aborts with JNI DETECTED ERROR IN APPLICATION: obj == null / SIGABRT rather than raising a catchable Python exception, and because R8 only runs in release builds it never reproduces in debug. Android framework classes (android.os.Build and friends) live outside the APK and never needed a rule. Rules are appended to the defaults, since R8 has no directive that undoes a keep; to remove the defaults instead — in particular -keepnames class * { *; }, which keeps every class and member name in the app and costs 2.5 MB of classes.dex on Flet Studio (5.9 MB → 3.4 MB, -43%) — set [tool.flet.android].proguard_default_rules = false. Dropping the defaults is safe for Pyjnius's PythonActivity access, because serious_python_android 4.1.0+ ships that keep rule in its own consumer-rules.pro. Defaults are unchanged, so existing builds render exactly the same file by @​FeodorFitsner.

• Android Gradle properties can now be configured from pyproject.toml via [tool.flet.android.gradle_properties]. The generated project's android/gradle.properties was previously fixed, so its memory settings — org.gradle.jvmargs=-Xmx8G plus a 4 GB metaspace — could not be changed. That is larger than the total RAM of a standard GitHub-hosted runner (measured: 7.8 GB with 3 GB of swap), so release builds, which additionally run Dart AOT once per ABI and R8, could exhaust memory and stall with no error; the only workaround was to download the published build template, patch the file and pass --template. Entries in the table override the defaults or add new properties, e.g. "org.gradle.jvmargs" = "-Xmx3G -XX:MaxMetaspaceSize=1G" and "org.gradle.workers.max" = 2. Defaults are unchanged, so existing builds render exactly the same file by @​FeodorFitsner.

Full Changelog: v0.86.4...v0.86.5

v0.86.4

Bug fixes

• Fix services registered after an embedded FletApp is opened never becoming usable on the host page — calling one failed with Timeout waiting for invoke method listener for <Service>(id).<method>. ServiceRegistry subclasses Service, so it registered itself on construction; when an embedded app's page built its own registry while the host page was still the current context, the embedded registry was registered as a service inside the host's registry. The client has no binding for a control of type ServiceRegistry, so building it threw Unknown service inside the host's service loop and aborted it, leaving every service positioned after that entry unbound — permanently, since the entry stays in the list. A registry is the container for services, not a service, so it no longer self-registers; the client-side loop also isolates per-service failures now, so a single unbuildable entry can't stop the rest from binding. Reproduced with a host app embedding a FletApp and registering a Clipboard afterwards by @​FeodorFitsner.

Full Changelog: v0.86.3...v0.86.4

v0.86.3

Improvements

• An embedded FletApp can now run over the in-process dart_bridge transport instead of a socket. Set url="dartbridge://" and the client allocates a native channel, delivers its port through the new FletApp.on_connect event, and the host serves that port with a FletDartBridgeServer — so a Flet program hosted inside another Flet app (a gallery, a preview) exchanges messages at memcpy speed with no socket file, no TCP port, and no AF_UNIX path-length limit (which broke embedded apps on the iOS simulator, where the container path overflows sun_path). High-throughput DataChannels used by embedded apps (RawImage, MatplotlibChart) get their own dedicated bridge too. The transport is opt-in and falls back to the existing URL-scheme channels: on web and desktop dev builds, where dart_bridge is unavailable, hosts keep using a socket URL by @​FeodorFitsner.

• flet run can now pass custom arguments to your app script: everything after a -- separator is forwarded to the script instead of being parsed by Flet, and arrives there as sys.argv[1:] - e.g. flet run --web main.py -- --dataset big.csv --verbose. Previously there was no way to do this: the app was always launched as python -u <script> with no extra arguments, so a flag meant for the app was consumed by the CLI's own parser and rejected with flet: error: unrecognized arguments: --verbose. The arguments are re-applied on every hot reload and work in all run modes (desktop, --web, --ios, --android, and -m module invocations). Arguments that don't look like options can be passed without the separator (flet run main.py big.csv), and mistyped Flet options are still reported as errors - now with a hint to use -- when they were meant for the app. See Passing arguments to your app by @​FeodorFitsner.

Bug fixes

• Fix iOS apps built with flet build ipa crashing at startup with Failed to lookup symbol 'serious_python_run': dlsym(RTLD_DEFAULT, serious_python_run): symbol not found. serious_python shipped dart_bridge — which provides the in-process Dart↔Python transport — as a static library linked into the app executable. An iOS executable exports nothing to the dynamic symbol table by default and the release build strips local symbols, so the dlsym lookups that Dart (DynamicLibrary.process()) and Python (import dart_bridge) perform at runtime could not resolve. Only release/archive (device) builds under the Swift Package Manager path were affected — debug and simulator builds don't dead-strip, so the failure did not reproduce there, and Android was never affected (its dart_bridge is a dynamic .so, which exports its symbols). Bumps serious_python to 4.4.0, which ships dart_bridge as a dynamic framework — embedded and signed into the app like Python.xcframework, with its symbols exported — and re-pins the bundled python-build snapshot to 20260726 (dart_bridge 1.5.1 → 1.6.1, Pyodide 3.14 314.0.2 → 314.0.3); the bundled Python versions (3.12.13 / 3.13.14 / 3.14.6) are unchanged by @​FeodorFitsner.

• Fix MatplotlibChart freezing permanently when its platform view is disposed with a frame in flight — the common trigger is switching to another tab inside the app, which races the frame stream: DataChannel.send on a disposed channel silently drops, so the frame's [0xFF] frame-applied ack never arrives and _send_and_wait's unbounded await parks MatplotlibChart._receive_loop — the sole consumer of the frame queue — for the rest of the session, with no exception raised; remounting opens a fresh channel but the stale ack futures were never resolved, so the chart stayed frozen. _capture_channel now resolves all pending ack futures when a new channel is captured (a fresh channel means every pending ack belongs to the disposed one), unparking the producer instantly on remount, and the ack await is bounded by FRAME_ACK_TIMEOUT (5s; a healthy ack lands in milliseconds) — on expiry the frame is dropped and its future removed from the ack FIFO so subsequent acks keep resolving the right entries (#6709, #6710) by @​ForsakenDurian.

• Fix a system/edge-swipe back gesture exiting the whole host app instead of navigating back when it lands on an embedded FletApp (an app rendered inside another Flet app — e.g. a gallery host running example apps in-process). The embedded app's WidgetsApp (MaterialApp/CupertinoApp) ran the default NavigationNotification handler, which reported SystemNavigator.setFrameworkHandlesBack(false) for a nested app that couldn't pop (typically a single-view example) and swallowed the notification, so the OS finished the whole activity on back and the host never got to report that it could pop. An embedded page now lets that notification bubble to the host (which re-reports canHandlePop) and chains a ChildBackButtonDispatcher to the host Router, so a system back propagates to the host and pops the view that embeds it by @​FeodorFitsner.

• Fix page.window.maximized = True intermittently reverting to unmaximized right after startup on macOS, when set in the same patch as page.title (e.g. page.title = "My App"; page.window.maximized = True in main()) by @​davidlawson.

• Fix flet build picking a non-decodable icon/splash image when several files share a base name, producing a machine-dependent NoDecoderForImageFormatException from flutter_launcher_icons. When an app's assets held, say, both icon.png and icon.svg, find_platform_image selected the first match from glob.glob(...) — whose order is filesystem-dependent — so the same app could pick icon.png on one machine and icon.svg on another (SVG is vector and can't be decoded by the raster icon/splash generators), turning a working build into a crash purely based on directory listing order. Candidates are now filtered to formats the generators can actually decode (.svg is dropped everywhere; .icns stays macOS-only and .ico Windows-only) and ranked so a raster image (.png first) always wins, making the choice deterministic across machines. When the only supplied image is an SVG (no raster sibling), it's skipped with a build-log warning and the default Flet icon is used instead of crashing by @​FeodorFitsner.

• Fix modal controls (AlertDialog, CupertinoAlertDialog, BottomSheet, CupertinoBottomSheet) crashing to a black screen with "setState()/markNeedsBuild() called during build" when they close in the same frame that another route or overlay opens — e.g. dismissing a bottom sheet and showing a SnackBar from one handler. The close path popped the route synchronously during build, so the exit animation notified a listener that was mid-build. Each modal now tracks its own ModalRoute and closes it in a post-frame callback, popping that route (never the topmost one); View's confirm-pop pops its own route too, so a modal dismissed in the same tick as a view pop can no longer dismiss the wrong one by @​FeodorFitsner.

Full Changelog: v0.86.2...v0.86.3

Changelog

Sourced from flet's changelog.

0.86.5

Bug fixes

• Fix every flet_ads control (BannerAd, InterstitialAd, NativeAd, ConsentManager) crashing on construction with RuntimeError: <Ad>(N) Control must be added to the page first, which made the package unusable since 0.85. The mobile-only platform guard read self.page from init(), which runs at construction — before the control is attached to the page — so the parent-chain lookup raised. The guard is back in before_update(), a post-mount hook where self.page resolves, so ads construct freely and only reject web/desktop at mount time (#6726, #6735) by @​ndonkoHenri.

Improvements

• An Android permission set to false is now actively removed from the merged manifest instead of merely being left out of the generated one. Gradle's manifest merger folds in the manifest of every Flutter plugin and can also synthesize permissions on its own, and false previously had no effect on either — the template only skipped emitting the entry, so a plugin-contributed permission passed straight through with no way to stop it. Concretely: flet-camera pulls in camera_android_camerax, which declares WRITE_EXTERNAL_STORAGE bounded to maxSdkVersion="28", and the merger implies an unbounded READ_EXTERNAL_STORAGE from it (legacy behaviour — write once implied read). Both then appear in the Play Console despite being absent from pyproject.toml, and the unbounded read is exactly the shape Google Play's storage policy objects to. Permissions set to false now render as <uses-permission android:name="…" tools:node="remove" /> (the template's <manifest> gained the tools namespace), which strips them during the merge; removing a permission nothing declares is a harmless no-op. Verified on Flet Studio: 11 permissions down to 9, both storage entries gone from the built APK by @​FeodorFitsner.

• Bumped serious_python to 4.5.1 and re-pinned the bundled python-build snapshot to 20260730 (dart_bridge 1.7.1). serious_python 4.5.1 tracks the same python-build release, keeping PYTHON_BUILD_RELEASE_DATE in sync with its pythonReleaseDate as the pin requires by @​FeodorFitsner.

• Android ProGuard/R8 rules can now be extended from pyproject.toml via [tool.flet.android].proguard_rules. The generated project's android/app/proguard-rules.pro was a fixed template file, so an app that needed an extra keep rule had no way to add one short of downloading the published build template, patching the file and passing --template. This matters for Pyjnius: autoclass() resolves Java classes by name at runtime, and R8 renames anything in the APK that isn't kept — so autoclass() on a class bundled by a Flutter plugin or by your own Java/Kotlin fails in release builds. It fails hard: JNI FindClass returns null and the process aborts with JNI DETECTED ERROR IN APPLICATION: obj == null / SIGABRT rather than raising a catchable Python exception, and because R8 only runs in release builds it never reproduces in debug. Android framework classes (android.os.Build and friends) live outside the APK and never needed a rule. Rules are appended to the defaults, since R8 has no directive that undoes a keep; to remove the defaults instead — in particular -keepnames class * { *; }, which keeps every class and member name in the app and costs 2.5 MB of classes.dex on Flet Studio (5.9 MB → 3.4 MB, -43%) — set [tool.flet.android].proguard_default_rules = false. Dropping the defaults is safe for Pyjnius's PythonActivity access, because serious_python_android 4.1.0+ ships that keep rule in its own consumer-rules.pro. Defaults are unchanged, so existing builds render exactly the same file by @​FeodorFitsner.

• Android Gradle properties can now be configured from pyproject.toml via [tool.flet.android.gradle_properties]. The generated project's android/gradle.properties was previously fixed, so its memory settings — org.gradle.jvmargs=-Xmx8G plus a 4 GB metaspace — could not be changed. That is larger than the total RAM of a standard GitHub-hosted runner (measured: 7.8 GB with 3 GB of swap), so release builds, which additionally run Dart AOT once per ABI and R8, could exhaust memory and stall with no error; the only workaround was to download the published build template, patch the file and pass --template. Entries in the table override the defaults or add new properties, e.g. "org.gradle.jvmargs" = "-Xmx3G -XX:MaxMetaspaceSize=1G" and "org.gradle.workers.max" = 2. Defaults are unchanged, so existing builds render exactly the same file by @​FeodorFitsner.

0.86.4

Bug fixes

• Fix services registered after an embedded FletApp is opened never becoming usable on the host page — calling one failed with Timeout waiting for invoke method listener for <Service>(id).<method>. ServiceRegistry subclasses Service, so it registered itself on construction; when an embedded app's page built its own registry while the host page was still the current context, the embedded registry was registered as a service inside the host's registry. The client has no binding for a control of type ServiceRegistry, so building it threw Unknown service inside the host's service loop and aborted it, leaving every service positioned after that entry unbound — permanently, since the entry stays in the list. A registry is the container for services, not a service, so it no longer self-registers; the client-side loop also isolates per-service failures now, so a single unbuildable entry can't stop the rest from binding. Reproduced with a host app embedding a FletApp and registering a Clipboard afterwards by @​FeodorFitsner.

0.86.3

Improvements

• An embedded FletApp can now run over the in-process dart_bridge transport instead of a socket. Set url="dartbridge://" and the client allocates a native channel, delivers its port through the new FletApp.on_connect event, and the host serves that port with a FletDartBridgeServer — so a Flet program hosted inside another Flet app (a gallery, a preview) exchanges messages at memcpy speed with no socket file, no TCP port, and no AF_UNIX path-length limit (which broke embedded apps on the iOS simulator, where the container path overflows sun_path). High-throughput DataChannels used by embedded apps (RawImage, MatplotlibChart) get their own dedicated bridge too. The transport is opt-in and falls back to the existing URL-scheme channels: on web and desktop dev builds, where dart_bridge is unavailable, hosts keep using a socket URL by @​FeodorFitsner.

• flet run can now pass custom arguments to your app script: everything after a -- separator is forwarded to the script instead of being parsed by Flet, and arrives there as sys.argv[1:] - e.g. flet run --web main.py -- --dataset big.csv --verbose. Previously there was no way to do this: the app was always launched as python -u <script> with no extra arguments, so a flag meant for the app was consumed by the CLI's own parser and rejected with flet: error: unrecognized arguments: --verbose. The arguments are re-applied on every hot reload and work in all run modes (desktop, --web, --ios, --android, and -m module invocations). Arguments that don't look like options can be passed without the separator (flet run main.py big.csv), and mistyped Flet options are still reported as errors - now with a hint to use -- when they were meant for the app. See Passing arguments to your app by @​FeodorFitsner.

Bug fixes

• Fix iOS apps built with flet build ipa crashing at startup with Failed to lookup symbol 'serious_python_run': dlsym(RTLD_DEFAULT, serious_python_run): symbol not found. serious_python shipped dart_bridge — which provides the in-process Dart↔Python transport — as a static library linked into the app executable. An iOS executable exports nothing to the dynamic symbol table by default and the release build strips local symbols, so the dlsym lookups that Dart (DynamicLibrary.process()) and Python (import dart_bridge) perform at runtime could not resolve. Only release/archive (device) builds under the Swift Package Manager path were affected — debug and simulator builds don't dead-strip, so the failure did not reproduce there, and Android was never affected (its dart_bridge is a dynamic .so, which exports its symbols). Bumps serious_python to 4.4.0, which ships dart_bridge as a dynamic framework — embedded and signed into the app like Python.xcframework, with its symbols exported — and re-pins the bundled python-build snapshot to 20260727 (dart_bridge 1.5.1 → 1.6.1, Pyodide 3.14 314.0.2 → 314.0.3); the bundled Python versions (3.12.13 / 3.13.14 / 3.14.6) are unchanged by @​FeodorFitsner.

• Fix MatplotlibChart freezing permanently when its platform view is disposed with a frame in flight — the common trigger is switching to another tab inside the app, which races the frame stream: DataChannel.send on a disposed channel silently drops, so the frame's [0xFF] frame-applied ack never arrives and _send_and_wait's unbounded await parks MatplotlibChart._receive_loop — the sole consumer of the frame queue — for the rest of the session, with no exception raised; remounting opens a fresh channel but the stale ack futures were never resolved, so the chart stayed frozen. _capture_channel now resolves all pending ack futures when a new channel is captured (a fresh channel means every pending ack belongs to the disposed one), unparking the producer instantly on remount, and the ack await is bounded by FRAME_ACK_TIMEOUT (5s; a healthy ack lands in milliseconds) — on expiry the frame is dropped and its future removed from the ack FIFO so subsequent acks keep resolving the right entries (#6709, #6710) by @​ForsakenDurian.

• Fix a system/edge-swipe back gesture exiting the whole host app instead of navigating back when it lands on an embedded FletApp (an app rendered inside another Flet app — e.g. a gallery host running example apps in-process). The embedded app's WidgetsApp (MaterialApp/CupertinoApp) ran the default NavigationNotification handler, which reported SystemNavigator.setFrameworkHandlesBack(false) for a nested app that couldn't pop (typically a single-view example) and swallowed the notification, so the OS finished the whole activity on back and the host never got to report that it could pop. An embedded page now lets that notification bubble to the host (which re-reports canHandlePop) and chains a ChildBackButtonDispatcher to the host Router, so a system back propagates to the host and pops the view that embeds it by @​FeodorFitsner.

• Fix page.window.maximized = True intermittently reverting to unmaximized right after startup on macOS, when set in the same patch as page.title (e.g. page.title = "My App"; page.window.maximized = True in main()) by @​davidlawson.

• Fix flet build picking a non-decodable icon/splash image when several files share a base name, producing a machine-dependent NoDecoderForImageFormatException from flutter_launcher_icons. When an app's assets held, say, both icon.png and icon.svg, find_platform_image selected the first match from glob.glob(...) — whose order is filesystem-dependent — so the same app could pick icon.png on one machine and icon.svg on another (SVG is vector and can't be decoded by the raster icon/splash generators), turning a working build into a crash purely based on directory listing order. Candidates are now filtered to formats the generators can actually decode (.svg is dropped everywhere; .icns stays macOS-only and .ico Windows-only) and ranked so a raster image (.png first) always wins, making the choice deterministic across machines. When the only supplied image is an SVG (no raster sibling), it's skipped with a build-log warning and the default Flet icon is used instead of crashing by @​FeodorFitsner.

• Fix modal controls (AlertDialog, CupertinoAlertDialog, BottomSheet, CupertinoBottomSheet) crashing to a black screen with "setState()/markNeedsBuild() called during build" when they close in the same frame that another route or overlay opens — e.g. dismissing a bottom sheet and showing a SnackBar from one handler. The close path popped the route synchronously during build, so the exit animation notified a listener that was mid-build. Each modal now tracks its own ModalRoute and closes it in a post-frame callback, popping that route (never the topmost one); View's confirm-pop pops its own route too, so a modal dismissed in the same tick as a view pop can no longer dismiss the wrong one by @​FeodorFitsner.

Commits

• a15ab62 Remove Android permissions that plugins inject; bump serious_python to 4.5.1 ...
• c35347a Make Android ProGuard/R8 rules configurable from pyproject.toml (#6741)
• 01bf7d5 Stop requesting broad Android media/storage permissions (#6740)
• ff3a09f fix(flet-ads): make ad controls constructable — move platform guard to `bef...
• a3f47d0 Make Android gradle.properties configurable from pyproject.toml (#6733)
• 06b395c Fix services registered after an embedded FletApp never binding (0.86.4) (#6728)
• fa2ed21 Pass the app's bundle id to serious_python's darwin packaging (#6731)
• 4d3b6bf Bump flet package version to 0.86.3 (#6727)
• a5f12d8 Run embedded FletApps over the in-process dart_bridge transport (#6723)
• b9d3844 fix(flet-charts): drop stray tests/init.py that broke test collection (#6...
• Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878
• @​MichaReiser

... (truncated)

Commits

• 80790b3 Bump 0.16.1 (#27330)
• 63830f3 [ty] Borrow from constraint set storage less often (#27328)
• f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
• 0d80497 Lint TOML files in the LSP (#26862)
• d91586b Update prek dependencies (#27293)
• 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
• b20daf7 [ty] refactor: add helper function to send partial results (#27249)
• 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
• 7c3e2db [ty] Fix enum class container assignability (#27318)
• d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
• Additional commits viewable in compare view

Updates ty from 0.0.63 to 0.0.65

Release notes

Sourced from ty's releases.

0.0.65

Release Notes

Released on 2026-07-29.

LSP server

• Support comprehension walruses in IDE features (#26476)

Library support

• Pydantic: Allow mutation of private attributes on frozen models (#27257)
• Pydantic: Synthesize __replace__ for models (#27220)

Diagnostics

• Correct ParamSpec forwarded-argument diagnostic locations (#27263)
• Recover forwarded callable object and constructor sources (#27264)
• Recover forwarded functools.partial diagnostic sources (#27265)

Core type checking

• Fix gradual class assignability with generic receivers (#27223)
• Lazily materialize protocol attributes (#27267)
• Narrow tagged unions through all type kinds (#27226)
• Prefer static constrained TypeVar solutions (#27057)
• Preserve frozen-dataclass setter delegation (#27217)
• Preserve inference when filtering constructor overloads (#27254)
• Reject frozen-dataclass field deletion through subclasses (#27001)
• Stabilize recursive type-constraint ordering (#27176)
• Support materialized class type expressions (#27258)

Performance

• Avoid quadratic inference for large literal unions (#27178)
• Cache protocol receiver binding (#27301)

Contributors

• @​thejchap
• @​benedikt-bartscher
• @​carljm
• @​charliermarsh

Install ty 0.0.65

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.65/ty-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.65

Released on 2026-07-29.

LSP server

• Support comprehension walruses in IDE features (#26476)

Library support

• Pydantic: Allow mutation of private attributes on frozen models (#27257)
• Pydantic: Synthesize __replace__ for models (#27220)

Diagnostics

• Correct ParamSpec forwarded-argument diagnostic locations (#27263)
• Recover forwarded callable object and constructor sources (#27264)
• Recover forwarded functools.partial diagnostic sources (#27265)

Core type checking

• Fix gradual class assignability with generic receivers (#27223)
• Lazily materialize protocol attributes (#27267)
• Narrow tagged unions through all type kinds (#27226)
• Prefer static constrained TypeVar solutions (#27057)
• Preserve frozen-dataclass setter delegation (#27217)
• Preserve inference when filtering constructor overloads (#27254)
• Reject frozen-dataclass field deletion through subclasses (#27001)
• Stabilize recursive type-constraint ordering (#27176)
• Support materialized class type expressions (#27258)

Performance

• Avoid quadratic inference for large literal unions (#27178)
• Cache protocol receiver binding (#27301)

Contributors

• @​thejchap
• @​benedikt-bartscher
• @​carljm
• @​charliermarsh

0.0.64

Released on 2026-07-27.

Bug fixes

• Fix identity narrowing for NewTypes (#26439)

... (truncated)

Commits

• 87de836 Bump version to 0.0.65 (#4113)
• d784bad README: Add link to Stable milestone (#4112)
• b4c1978 Update actions/setup-python action to v7 (#4110)
• 8d216a3 Update actions/checkout action to v7.0.1 (#4107)
• 06f44e9 Update dependency prek to v0.4.10 (#4108)
• b3665fd Update prek dependencies (#4109)
• 5e64a13 Bump version to 0.0.64 (#4097)
• See full diff in compare view

Updates hypothesis from 6.161.5 to 6.164.0

Commits

• 4b8467b Bump hypothesis version to 6.164.0 and update changelog
• 47bb9d1 Merge pull request #4833 from Zac-HD/claude/hypothesis-issue-4149-16nmgw
• b2b77ec Bump hypothesis version to 6.163.1 and update changelog
• bc2af6c Merge pull request #4832 from Zac-HD/claude/hypothesis-nocover-cleanup-1yu7ao
• cef8c21 ignore mock xp namespace warning
• 65022c4 fix parents
• 0c45285 clean up tests, simplify configs, parse complex constants
• 13ccc11 be explicit in allowed types
• f3b6dfe Exclude test code from the combined coverage report
• 71b7bc0 Recognize zipimported stdlib when filtering explanations
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions