chore(deps): bump the python-minor-patch group with 4 updates

[dependabot]

Bumps the python-minor-patch group with 4 updates: ruff, ty, assertpy2 and hypothesis.

Updates ruff from 0.16.3 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot

... (truncated)

Commits

• 11c76bf Bump 0.16.4 (#27937)
• d53c8c5 Isolate playground builds from deployment credentials (#27839)
• cab001e Disable uv preview for releases and pre-commit hooks (#27939)
• f8d575f [ty] Clarify writing guidance for human readers (#27912)
• ca45fae Set --preview and --default-index for the uv-lock hook (#27935)
• 4827bf7 Export UV_DEFAULT_INDEX in release.sh (#27934)
• d1087a4 [ty] Handle assignment expressions in string annotations (#27921)
• 680cce4 [ty] Optimize inherited recursive protocol comparisons (#27922)
• 974d3cb Upgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (#27932)
• b169b40 Install cargo tools locked (#27929)
• Additional commits viewable in compare view

Updates ty from 0.0.72 to 0.0.74

Release notes

Sourced from ty's releases.

0.0.74

Release Notes

Released on 2026-08-22.

Bug fixes

• Avoid duplicate bindings in multi-target assignments (#27938)
• Avoid panic on unpacked kwargs in string annotations (#27963)
• Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
• Handle assignment expressions in string annotations (#27921)
• Handle dynamic classes in string annotations (#27883)
• Preserve string annotation context in lambda defaults and TypedDict types (#27914)
• Skip invalid subscript arguments in string annotations (#27917)
• Skip invalid subscript operands in string annotations (#27882)

LSP server

• Add untrustedWorkspace option to the LSP (#27828)
• Add executable discovery to the server command (#27806)
• Handle file-valued workspace folders from Zed (#27836)
• Skip scripts with an invalid PEP 723 configuration (#27505)
• Support pull diagnostics for notebook cells (#27778)

Documentation

• Update mypy/pyright comparison table (#4165)

Diagnostics

• Add an opt-in unsound-assignment rule for variables (#27874)
• Fix variadic signature display (#27869)
• Highlight declarations in invalid-assignment diagnostics (#27872)
• Improve LiteralString suggestions in string annotations (#27931)
• Use invalid-type-form for non-generic class annotations (#27889)

Core type checking

• Add bounded constraint solution projections (#27949)
• Fix invariant gradual tuple materialization ranges (#27946)
• Guard recursive constructor bindings by receiver (#27958)
• Preserve all alternatives in bounded intersections (#27898)
• Preserve keyword safety for unpacked callables (#27517)
• Preserve source protocol members and classify finite aliases (#27772)
• Preserve type-variable order when reloading constraints (#27904)
• Propagate narrowing through statically known branches (#27752)
• Recognize ABC metaclass methods on protocols (#27897)
• Support __slots__ (#27730)

Performance

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.74

Released on 2026-08-22.

Bug fixes

• Avoid duplicate bindings in multi-target assignments (#27938)
• Avoid panic on unpacked kwargs in string annotations (#27963)
• Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
• Handle assignment expressions in string annotations (#27921)
• Handle dynamic classes in string annotations (#27883)
• Preserve string annotation context in lambda defaults and TypedDict types (#27914)
• Skip invalid subscript arguments in string annotations (#27917)
• Skip invalid subscript operands in string annotations (#27882)

LSP server

• Add untrustedWorkspace option to the LSP (#27828)
• Add executable discovery to the server command (#27806)
• Handle file-valued workspace folders from Zed (#27836)
• Skip scripts with an invalid PEP 723 configuration (#27505)
• Support pull diagnostics for notebook cells (#27778)

Documentation

• Update mypy/pyright comparison table (#4165)

Diagnostics

• Add an opt-in unsound-assignment rule for variables (#27874)
• Fix variadic signature display (#27869)
• Highlight declarations in invalid-assignment diagnostics (#27872)
• Improve LiteralString suggestions in string annotations (#27931)
• Use invalid-type-form for non-generic class annotations (#27889)

Core type checking

• Add bounded constraint solution projections (#27949)
• Fix invariant gradual tuple materialization ranges (#27946)
• Guard recursive constructor bindings by receiver (#27958)
• Preserve all alternatives in bounded intersections (#27898)
• Preserve keyword safety for unpacked callables (#27517)
• Preserve source protocol members and classify finite aliases (#27772)
• Preserve type-variable order when reloading constraints (#27904)
• Propagate narrowing through statically known branches (#27752)
• Recognize ABC metaclass methods on protocols (#27897)
• Support __slots__ (#27730)

Performance

... (truncated)

Commits

• 00199f0 Bump version to 0.0.74 (#4351)
• 5769062 Update mypy/pyright comparison table (#4165)
• 4fcb060 Remove Zulip from the PGO training (#4336)
• a7a7064 Use the versions bot's ruleset bypass when merging (#4333)
• 01b0fab Update prek dependencies (#4325)
• deef42f Update dependency python to 3.14 (#4326)
• 6d35edf Update astral-sh/setup-uv action to v10 (#4327)
• 4bd2833 Bump version to 0.0.73 (#4322)
• 93d0d4f Disable known GitHub cache clients in release workflows (#4317)
• ec4806b Harden release workflow permissions and shell inputs (#4319)
• Additional commits viewable in compare view

Updates assertpy2 from 2.20.1 to 2.23.0

Release notes

Sourced from assertpy2's releases.

2.23.0

Two changes to behaviour and four typing narrowings.
Read Behaviour changes before upgrading.

TL;DR

New
assertpy2_profile = "safe"	the three diagnostics on in one line, instead of three settings a suite has to find
AssertionFailure.has_expected	tells "compared against None" from "named no expectation", which expected is None cannot
Every failure names what it measured against	expected was filled by the comparison assertions and left empty by the rest

Typing
A polling chain is checked	eventually() and eventually_sync() were Any from the first assertion onwards
check() after a pivot has a surface	first().check() landed on an untyped proxy that accepted every name
A predicate is handed the subject's type	a misspelled attribute inside satisfies(lambda item: ...) was accepted by all three checkers
Frames and arrays have their own views	they reached the capability umbrella and kept every assertion name there is
A pivot hands back its element at any depth	the second pivot in a chain landed on the builder whatever the first returned

Fixed
A matcher that changed its mind passed	the verdict was taken once and the reason asked for separately, and the second answer won
KeyboardInterrupt never reached the runner	does_not_raise() swallowed it and raises() reported it as the wrong exception
The duplicate diff printed its header and nothing else	a count against a value reaches neither of the groups the renderer has
Three shapes of dangling assertion went unreported	a chain ending on raises(), on a pivot or on described_as() asserts nothing
An assert in front of a chain hid it from every tool	a builder and a bound method are both truthy, so the line was green on any value
A vacuous pass went unwarned on anything unsized	a spent generator, an empty dataclass and a re-walkable value with no length
not_ and check() accepted operations that assert nothing	check().first() answered passed=True for a call that never asserted
is_subset_of() could pass over an emptied subject	a superset sharing the subject's iterator left nothing to compare

One line turns the diagnostics on

[tool.pytest.ini_options]
assertpy2_profile = "safe"   # dangling on, vacuous on, clusters on (default "compatible": all off)

Naming a setting yourself still wins, so safe plus assertpy2_dangling = "off" turns the other two on.

Guide: Errors and diagnostics

A failure can say whether an expectation was named

assert_that({}).is_equal_to(None)   # names one
assert_that([]).is_not_empty()      # names none

Before

... (truncated)

Commits

• 05e5468 chore: release 2.23.0
• a22f196 docs: stop pinning the surface to a stale count
• 38d9935 fix: report a dangling chain that an assert reads
• 30d30dc docs: say how to compare a collection without its order
• cc6a8e7 docs: correct what the type-safety page promises about chaining
• abbe812 test: check the typed surface against five real http clients
• 22c8cab test: hold the new typed surfaces to what the runtime answers
• b5fcb7a typing: close the places where a chain stopped being checked
• dd2749f feat: say whether a failure named an expected value
• 8d6e6dd fix: warn about a vacuous pass from the walk that passed
• Additional commits viewable in compare view

Updates hypothesis from 6.165.9 to 6.165.10

Commits

• 6384dee Bump hypothesis version to 6.165.10 and update changelog
• c7ca59d Merge pull request #4864 from dgutson/claude-stateful-and-example
• 3fc38f1 claude: teach /hypothesis about stateful tests and @​example
• 16f24b7 Merge pull request #4862 from Zac-HD/claude/upstream-regex-issues-fkke9q
• 3a19d89 fix context flag restoration
• 3f94912 Clarify re.ASCII wording in changelog entry
• 9d0a9a8 Fix from_regex handling of negative classes, re.ASCII, and zero-min repeats
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions