chore(deps)(deps-dev): bump the python-linters group across 1 directory with 3 updates

[dependabot]

Bumps the python-linters group with 3 updates in the / directory: pyproject-fmt, ruff and ty.

Updates pyproject-fmt from 2.25.1 to 2.29.3

Release notes

Sourced from pyproject-fmt's releases.

pyproject-fmt/2.29.3

Fixed

• The test suite the source distribution ships passes from the unpacked sdist. The backend read the project metadata from beside itself, and the sdist keeps a copy of that file next to the tests, a directory below the pyproject.toml it belongs to, so eight tests ended on the file it could not find. It reads the metadata from either place. (#454, #457)

pyproject-fmt/2.29.2

Fixed

• A build from the source distribution runs on what that distribution carries. 2.29.0 named toml-fmt-common as a dependency and resolved it from PyPI, where the newest release dates from May; 2.29.1 dropped the dependency before the sdist carried the sources, so a build from it failed on the import. This release carries them, and its metadata requires nothing. (#450, #452)

The wheels held their vendored copy throughout, so an install that takes a wheel was never affected.

pyproject-fmt/2.29.1

Fixed

• The source distribution no longer names toml-fmt-common as a dependency. The newest release of that package on PyPI dates from May, months behind this one, so a build from the sdist ran an old settings reader against the current formatter and failed a large part of its own test suite. (#450, #451)

Known issue

• This release's source distribution carries no toml-fmt-common, so a build from it fails on the import. 2.29.2 carries it. The wheels hold their vendored copy and install as before. (#452)

pyproject-fmt/2.29.0

Changed

• A string measures from the start of its key. A long key can be what pushes a value past column_width; measuring the value alone left lines running past the column the setting asks for. (#448)
• Deep input comes back as an error rather than a crash. Reading a value, writing it and dropping it each walk it by calling themselves, so the model caps nesting at 256 levels. A 12,000-deep value used to end the process. (#448)

Fixed

• A requirement written with a space after its operator reads as a requirement. requires-python = ">= 3.12" did not parse as a version bound, so the generated classifiers fell back to the configured floor and ceiling. pypa/build carried a 3.9 classifier it does not support. (#448)
• The classifier window works at patch precision. requires-python = "<3.10.1" lost the whole 3.10 series, and claimed Programming Language :: Python :: 3 :: Only for a bound that admits Python 2. (#448)
• A literal string sorts with the values around it. 'zz' and 'aa' held their order while the same values in double quotes sorted. (#448)
• A comment written before a member's comma stays on that member's line. The comma is what says which member a comment belongs to: one written before it closes that member's line, one written after it leads the next member. Both used to end up on a line of their own, leaving the comma stranded below. (#448)
• classifiers written as a string stays as written. Asking for generated classifiers replaced the string with an array, losing what the file said. (#448)
• Folding sub-tables into their parent no longer depends on the order the file wrote them in. (#448)
• The key order covers pyrefly's documented option names. It spells them with hyphens, the order listed only the underscore forms, and a file using the documented spelling fell through to alphabetical order. (#448)
• A dependency group keeps its include-group entries where the file wrote them. An include-group pulls its group in at the point it sits, so moving it changes what the group resolves to. (#448)
• Free-form license text stays as written. license = "MIT or later" came back rewritten as though it were an SPDX expression; the formatter now rewrites the value only once it parses as one over registered identifiers. (#448)
• The * catch-all in a setuptools data table matches the way the file spells it. * is not a name TOML reads bare, so a file writes it quoted; the catch-all led the table only because a quote happens to sort before a letter. (#448)

Performance

• The quadratic walks the old parse tree forced are gone. 32,000 interleaved root keys under two tables took 618 seconds and now take 4.8; scaling is close to linear. (#448)

Known issue

• This release's source distribution names a dependency on toml-fmt-common without carrying it, and the newest release of that package on PyPI dates from May. A build from the sdist therefore runs an older settings reader against this formatter. 2.29.2 carries the sources. The wheels hold their vendored copy and install as before. (#450)

... (truncated)

Commits

• e6cbb18 Release pyproject-fmt 2.29.3 [skip ci]
• 32f9e33 build(deps): bump taiki-e/install-action from 2.86.3 to 2.86.7 in the github-...
• 2dfd00e Update Python dependencies (#455)
• f1b5863 🐛 fix(build): read the project metadata from the sdist (#457)
• ea71976 Update Rust dependencies (#456)
• 362f57c Release tox-toml-fmt 1.10.2 [skip ci]
• 7bd21dc 🔧 chore(ci): build the sdist through PEP 517 (#453)
• 8b40ebe Release pyproject-fmt 2.29.2 [skip ci]
• a407ce4 🐛 fix(build): vendor into the sdist a release builds (#452)
• 8cfd7d3 Release tox-toml-fmt 1.10.1 [skip ci]
• Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#28219)
• [flake8-pytest-style] Add an autofix for PT020 (#27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

• Validate unary expressions when parsing (#28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

• Add another example and glob reference for lint.per-file-ignores (#28106)
• Add duplicate work guidance (#28229)
• [flake8-async] Document thread offloading (ASYNC240) (#28008)
• [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

• Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

• @​flying-sheep
• @​pikammmmm
• @​fly1d
• @​waterWang
• @​Pierre-Sassoulas
• @​ntBre
• @​jelle-openai
• @​ericbuehl
• @​tjkuson
• @​AbhinavMir
• @​Whning0513
• @​chirizxc

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#28219)
• [flake8-pytest-style] Add an autofix for PT020 (#27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

• Validate unary expressions when parsing (#28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

• Add another example and glob reference for lint.per-file-ignores (#28106)
• Add duplicate work guidance (#28229)
• [flake8-async] Document thread offloading (ASYNC240) (#28008)
• [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

• Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

• @​flying-sheep
• @​pikammmmm
• @​fly1d
• @​waterWang
• @​Pierre-Sassoulas
• @​ntBre
• @​jelle-openai
• @​ericbuehl
• @​tjkuson
• @​AbhinavMir
• @​Whning0513
• @​chirizxc

... (truncated)

Commits

• 22f65a2 Bump 0.16.6 (#28280)
• 7cc9f1e [ty] Document CallableTypeKind variants (#28277)
• 056ce07 Add UV_LOCKED to all workflows (#28261)
• 6d6e35d [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• 80b4891 [ty] Temporarily disable tuple types in property tests (#28275)
• 3f7a54d [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• 35656cf [ty] Preserve deprecations on decorated callables (#28256)
• d2626c8 [ty] Reject missing attributes on type[] aliases (#28267)
• ee6a6d1 [ty] Support ParamSpecs in ConstraintSet (#28028)
• 7f6a170 [ty] Move bound APIs to constraint owners (#28094)
• Additional commits viewable in compare view

Updates ty from 0.0.55 to 0.0.79

Release notes

Sourced from ty's releases.

0.0.79

Release Notes

Released on 2026-09-07.

Bug fixes

• Avoid dict keyword-call panics when typing is shadowed (#28292)
• Discover configs in models derived from legacy generic classes (#28397)
• Normalize recursive collection-use constraints (#28332)
• Recover cycles when constructing known class instances (#28289)

CLI

• Embed archive checksums in the shell installer (#4458)

Diagnostic improvements

• Add Literal fixes for diagnostics flagging invalid type annotations (#28185)
• Add await fixes for redundant conditions (#28169)
• Add assert_never fixes for redundant final elif branches (#28178)
• Add defensive assertion fallback for redundant elif fixes (#28179)
• Add rules to detect always-truthy and always-falsy conditions (#28034)
• Preserve deprecations on decorated callables (#28256)
• Require a direct dependency for reveal_type backport fixes (#28177)
• Suggest variable-length tuple annotations for redundant conditions (#28168)

Core type checking

• Align TypeIs and isinstance narrowing (#28193)
• Avoid falling back to Unknown when collecting type context constraints (#28297)
• Ensure f is identity(f) evaluates to Literal[True] (#28360)
• Fix callable specialization with union-valued ParamSpec (#28085)
• Infer variance through recursive protocols (#28077)
• Narrow types with ordered length comparisons (#28264)
• Preserve gradual type context during generic call inference (#28091)
• Preserve nominal subtyping for top-materialized protocols (#28271)
• Preserve outer type variables during ParamSpec inference (#28306)
• Preserve protocol intersections when narrowing gradual types (#28391)
• Promote literals in nested (non-covariant) positions (#28389)
• Reject missing attributes on type[] aliases (#28267)
• Solve formal unions using constraint-sets (#28312)
• Sync vendored typeshed stubs (#28331). Typeshed diff

Performance

• Avoid unnecessary work when building specializations (#28369)
• Bypass materialization queries for simple types (#28367)
• Cache exception suppression for context managers (#28376)
• Intern statement call predicates (#28373)

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.79

Released on 2026-09-07.

Bug fixes

• Avoid dict keyword-call panics when typing is shadowed (#28292)
• Discover configs in models derived from legacy generic classes (#28397)
• Normalize recursive collection-use constraints (#28332)
• Recover cycles when constructing known class instances (#28289)

CLI

• Embed archive checksums in the shell installer (#4458)

Diagnostic improvements

• Add Literal fixes for diagnostics flagging invalid type annotations (#28185)
• Add await fixes for redundant conditions (#28169)
• Add assert_never fixes for redundant final elif branches (#28178)
• Add defensive assertion fallback for redundant elif fixes (#28179)
• Add rules to detect always-truthy and always-falsy conditions (#28034)
• Preserve deprecations on decorated callables (#28256)
• Require a direct dependency for reveal_type backport fixes (#28177)
• Suggest variable-length tuple annotations for redundant conditions (#28168)

Core type checking

• Align TypeIs and isinstance narrowing (#28193)
• Avoid falling back to Unknown when collecting type context constraints (#28297)
• Ensure f is identity(f) evaluates to Literal[True] (#28360)
• Fix callable specialization with union-valued ParamSpec (#28085)
• Infer variance through recursive protocols (#28077)
• Narrow types with ordered length comparisons (#28264)
• Preserve gradual type context during generic call inference (#28091)
• Preserve nominal subtyping for top-materialized protocols (#28271)
• Preserve outer type variables during ParamSpec inference (#28306)
• Preserve protocol intersections when narrowing gradual types (#28391)
• Promote literals in nested (non-covariant) positions (#28389)
• Reject missing attributes on type[] aliases (#28267)
• Solve formal unions using constraint-sets (#28312)
• Sync vendored typeshed stubs (#28331). Typeshed diff

Performance

• Avoid unnecessary work when building specializations (#28369)
• Bypass materialization queries for simple types (#28367)
• Cache exception suppression for context managers (#28376)
• Intern statement call predicates (#28373)
• Lazily compute argument-context specializations (#28378)

... (truncated)

Commits

• b4cd792 Bump version to 0.0.79 (#4484)
• 52f2d5b Add a GitHub repository threat model for ty (#4481)
• fd0d789 Declare support for Python 3.15 (#4476)
• 7e7a87d Improve rooster-generated changelog sections (#4473)
• f862d1f Document mappings for new ty rules (#4475)
• 23fced1 Allow Ruff to format our docs examples (#4457)
• 3c907bc [ty] Embed archive checksums in the shell installer (#4458)
• 873885e [ty] Use the shared release smoke-test action (#4461)
• dca9f98 Bump version to 0.0.78 (#4452)
• 2bd3de2 Update strict-literal-narrowing to strict-equality-semantics (#4438)
• Additional commits viewable in compare view

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud