chore(deps)(deps-dev): bump the python-linters group across 1 directory with 3 updates

[dependabot]

Bumps the python-linters group with 3 updates in the / directory: pyproject-fmt, ruff and ty.

Updates pyproject-fmt from 2.25.1 to 2.29.4

Release notes

Sourced from pyproject-fmt's releases.

pyproject-fmt/2.29.4

Fixed

• Keep the classifiers a bound admits. (#463)

pyproject-fmt/2.29.3

Fixed

• The test suite the source distribution ships passes from the unpacked sdist. The backend read the project metadata from beside itself, and the sdist keeps a copy of that file next to the tests, a directory below the pyproject.toml it belongs to, so eight tests ended on the file it could not find. It reads the metadata from either place. (#454, #457)

pyproject-fmt/2.29.2

Fixed

• A build from the source distribution runs on what that distribution carries. 2.29.0 named toml-fmt-common as a dependency and resolved it from PyPI, where the newest release dates from May; 2.29.1 dropped the dependency before the sdist carried the sources, so a build from it failed on the import. This release carries them, and its metadata requires nothing. (#450, #452)

The wheels held their vendored copy throughout, so an install that takes a wheel was never affected.

pyproject-fmt/2.29.1

Fixed

• The source distribution no longer names toml-fmt-common as a dependency. The newest release of that package on PyPI dates from May, months behind this one, so a build from the sdist ran an old settings reader against the current formatter and failed a large part of its own test suite. (#450, #451)

Known issue

• This release's source distribution carries no toml-fmt-common, so a build from it fails on the import. 2.29.2 carries it. The wheels hold their vendored copy and install as before. (#452)

pyproject-fmt/2.29.0

Changed

• A string measures from the start of its key. A long key can be what pushes a value past column_width; measuring the value alone left lines running past the column the setting asks for. (#448)
• Deep input comes back as an error rather than a crash. Reading a value, writing it and dropping it each walk it by calling themselves, so the model caps nesting at 256 levels. A 12,000-deep value used to end the process. (#448)

Fixed

• A requirement written with a space after its operator reads as a requirement. requires-python = ">= 3.12" did not parse as a version bound, so the generated classifiers fell back to the configured floor and ceiling. pypa/build carried a 3.9 classifier it does not support. (#448)
• The classifier window works at patch precision. requires-python = "<3.10.1" lost the whole 3.10 series, and claimed Programming Language :: Python :: 3 :: Only for a bound that admits Python 2. (#448)
• A literal string sorts with the values around it. 'zz' and 'aa' held their order while the same values in double quotes sorted. (#448)
• A comment written before a member's comma stays on that member's line. The comma is what says which member a comment belongs to: one written before it closes that member's line, one written after it leads the next member. Both used to end up on a line of their own, leaving the comma stranded below. (#448)
• classifiers written as a string stays as written. Asking for generated classifiers replaced the string with an array, losing what the file said. (#448)
• Folding sub-tables into their parent no longer depends on the order the file wrote them in. (#448)
• The key order covers pyrefly's documented option names. It spells them with hyphens, the order listed only the underscore forms, and a file using the documented spelling fell through to alphabetical order. (#448)
• A dependency group keeps its include-group entries where the file wrote them. An include-group pulls its group in at the point it sits, so moving it changes what the group resolves to. (#448)
• Free-form license text stays as written. license = "MIT or later" came back rewritten as though it were an SPDX expression; the formatter now rewrites the value only once it parses as one over registered identifiers. (#448)
• The * catch-all in a setuptools data table matches the way the file spells it. * is not a name TOML reads bare, so a file writes it quoted; the catch-all led the table only because a quote happens to sort before a letter. (#448)

Performance

• The quadratic walks the old parse tree forced are gone. 32,000 interleaved root keys under two tables took 618 seconds and now take 4.8; scaling is close to linear. (#448)

... (truncated)

Commits

• 5c2c87c Release pyproject-fmt 2.29.4 [skip ci]
• ed4af96 🐛 fix(pyproject-fmt): keep the classifiers a bound admits (#463)
• 2946fc3 build(deps): bump taiki-e/install-action from 2.86.7 to 2.87.3 in the github-...
• 95529cc [pre-commit.ci] pre-commit autoupdate (#461)
• 7c729de ♻️ refactor(project): apply the house style (#459)
• 77655bb Release tox-toml-fmt 1.10.3 [skip ci]
• e6cbb18 Release pyproject-fmt 2.29.3 [skip ci]
• 32f9e33 build(deps): bump taiki-e/install-action from 2.86.3 to 2.86.7 in the github-...
• 2dfd00e Update Python dependencies (#455)
• f1b5863 🐛 fix(build): read the project metadata from the sdist (#457)
• Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879

... (truncated)

Commits

• b5dba86 Bump version to 0.16.7 (#28496)
• 5992d05 Install rustfmt before linting releases (#28495)
• 1713a1f ensure prepare release changes pass prek (#28488)
• 18cdbb4 use scoped token for release workflow (#28484)
• c3813a5 add a workflow for preparing releases (#28486)
• 00948c0 Remove the "Who’s Using Ruff?" list (#28455)
• 86a2eba [pyupgrade] Stop recommending removed typing.no_type_check_decorator (`UP...
• 609e184 Stop defining __cached__ for Python 3.15 (#28476)
• 859ff2f [ty] Track symlinked directory status in listings (#28482)
• 77f6538 Use paid GitHub-hosted runners for Linux (#28478)
• Additional commits viewable in compare view

Updates ty from 0.0.55 to 0.0.81

Release notes

Sourced from ty's releases.

0.0.81

Release Notes

Released on 2026-09-14.

Bug fixes

• Escape glob characters in anchored directory paths (#28518)
• Ignore divergent markers when detecting descriptors (#28514)

CLI

• Anchor default exclude patterns at the project root (#28463)

Core type checking

• Avoid rebinding extracted method calls (#28469)
• Default-specialize class objects in meta-protocol checks (#28265)
• Fix MRO ordering for generic bases (#28172)
• Fix assignability of bounded typevars to intersection types (#28479)
• Fix variadic partial signature reduction (#28586)
• Handle gradual metaclass ancestry and conflicts (#28474)
• Preserve recursive metadata in union transformations (#28497)
• Preserve runtime comparison semantics when narrowing tagged unions (#28053)
• Preserve wrapped signatures in nominal descriptor checks (#28466)
• Reject reassignment of enum members (#28462)
• Report override conflicts introduced by new bases (#28530)
• Resolve dependencies within correlated inference alternatives (#28252)
• Respect instance dictionary storage for slotted classes (#27749)
• Validate explicitly overridden constructor signatures (#28115)

Performance

• Avoid redundant superclass member inference (#28587)
• Reuse rendered union elements when displaying types (#28494)

Memory usage improvements

• Reduce retained AST memory by shrinking expressions (#28335)
• Share strings in dependency metadata (#28141)

Contributors

• @​sharkdp
• @​ibraheemdev
• @​MichaReiser
• @​zsol
• @​zanieb
• @​charliermarsh
• @​mtshiba

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.81

Released on 2026-09-14.

Bug fixes

• Escape glob characters in anchored directory paths (#28518)
• Ignore divergent markers when detecting descriptors (#28514)

CLI

• Anchor default exclude patterns at the project root (#28463)

Core type checking

• Avoid rebinding extracted method calls (#28469)
• Default-specialize class objects in meta-protocol checks (#28265)
• Fix MRO ordering for generic bases (#28172)
• Fix assignability of bounded typevars to intersection types (#28479)
• Fix variadic partial signature reduction (#28586)
• Handle gradual metaclass ancestry and conflicts (#28474)
• Preserve recursive metadata in union transformations (#28497)
• Preserve runtime comparison semantics when narrowing tagged unions (#28053)
• Preserve wrapped signatures in nominal descriptor checks (#28466)
• Reject reassignment of enum members (#28462)
• Report override conflicts introduced by new bases (#28530)
• Resolve dependencies within correlated inference alternatives (#28252)
• Respect instance dictionary storage for slotted classes (#27749)
• Validate explicitly overridden constructor signatures (#28115)

Performance

• Avoid redundant superclass member inference (#28587)
• Reuse rendered union elements when displaying types (#28494)

Memory usage improvements

• Reduce retained AST memory by shrinking expressions (#28335)
• Share strings in dependency metadata (#28141)

Contributors

• @​sharkdp
• @​ibraheemdev
• @​MichaReiser
• @​zsol
• @​zanieb
• @​charliermarsh
• @​mtshiba
• @​carljm

... (truncated)

Commits

• 4edd772 Bump version to 0.0.81 (#4528)
• 8cfdd79 Use paid GitHub-hosted runners for Linux (#4502)
• 7fd8e15 Bump version to 0.0.80 (#4501)
• c163f21 Update dependency prek to v0.4.12 (#4494)
• 8ce0450 Update prek dependencies (#4495)
• 5d0aa7a Update actions/attest-build-provenance action to v4.2.2 (#4497)
• e22b86b Update Swatinem/rust-cache action to v2.9.2 (#4496)
• 5cde40f Document uv integration and workspace trust settings (#4339)
• b4cd792 Bump version to 0.0.79 (#4484)
• 52f2d5b Add a GitHub repository threat model for ty (#4481)
• Additional commits viewable in compare view

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud