[dependabot]

Bumps the python-minor-patch group with 5 updates:

Package	From	To
pydantic	2.14.0	2.14.1
ruff	0.17.0	0.17.1
ty	0.0.86	0.0.89
assertpy2	2.30.0	2.32.0
pyrefly	1.3.2	1.4.0

Updates pydantic from 2.14.0 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

Changelog

Sourced from pydantic's changelog.

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• See full diff in compare view

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates ty from 0.0.86 to 0.0.89

Release notes

Sourced from ty's releases.

0.0.89

Release Notes

Released on 2026-10-16.

Core type checking

• Added support for return type inference for unannotated functions and methods (#29253).

  Return type inference is currently disabled by default. Enable it with the analysis.return-type-inference setting in pyproject.toml:

  [tool.ty.analysis]
  return-type-inference = "always"

  Or in ty.toml:

  [analysis]
  return-type-inference = "always"

  Please share your feedback, especially any problems you encounter, in the return type inference feedback issue.

• Sync vendored typeshed stubs (#29402). Typeshed diff

Bug fixes

• Avoid a panic when negating dynamic type aliases (#29427)
• Widen tuple literal lengths when other collection elements contain nested tuple types (#29147)
• Report invalid Generic and Protocol arguments containing nested variadic type variables (#29146)

Performance

• Speed up generic class-pattern narrowing by skipping impossible intersection comparisons (#29240)

Contributors

• @​carljm
• @​charliermarsh
• @​sharkdp

Install ty 0.0.89

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.89/ty-installer.sh | sh

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.89

Released on 2026-10-16.

Core type checking

• Added support for return type inference for unannotated functions and methods (#29253).

  Return type inference is currently disabled by default. Enable it with the analysis.return-type-inference setting in pyproject.toml:

  [tool.ty.analysis]
  return-type-inference = "always"

  Or in ty.toml:

  [analysis]
  return-type-inference = "always"

  Please share your feedback, especially any problems you encounter, in the return type inference feedback issue.

• Sync vendored typeshed stubs (#29402). Typeshed diff

Bug fixes

• Avoid a panic when negating dynamic type aliases (#29427)
• Widen tuple literal lengths when other collection elements contain nested tuple types (#29147)
• Report invalid Generic and Protocol arguments containing nested variadic type variables (#29146)

Performance

• Speed up generic class-pattern narrowing by skipping impossible intersection comparisons (#29240)

Contributors

• @​carljm
• @​charliermarsh
• @​sharkdp

0.0.88

Released on 2026-10-15.

Bug fixes

• Avoid panics and hangs involving recursive type aliases and intersections (#29057)
• Fix false invalid-mutable-override errors when overriding object attributes (#29373)

... (truncated)

Commits

• 82b0fd4 Bump version to 0.0.89 (#4740)
• 5370198 Update dependency python to 3.14 (#4721)
• 64e7f18 Bump version to 0.0.88 (#4732)
• 88c50d5 Budget the daily fuzz run based on setup time (#4706)
• ec60e71 Document and lint the manually maintained release workflow (#4320)
• dbc632a Update dependency prek to v0.5.3 (#4719)
• 7aa0f34 Update astral-sh/setup-uv action to v10.3.0 (#4720)
• 2eefac0 Update prek dependencies (#4722)
• ea4c3d2 Bump version to 0.0.87 (#4718)
• 1e7a76d Require hashes for build dependencies (#4714)
• Additional commits viewable in compare view

Updates assertpy2 from 2.30.0 to 2.32.0

Release notes

Sourced from assertpy2's releases.

2.32.0

Read Behaviour changes below before upgrading.

TL;DR

New
matches(), does_not_match(), extracting_group(), matches_with_groups() and match.matches_regex()	take a pattern compiled with re.compile(), flags and all (#54)

Passed when it should not have
match.matches_regex(re.compile(""))	passed every string

Crashed or misreported
match.matches_regex(b"x")	built a matcher that raised TypeError on a string and matched nothing else

matches() and its siblings take a compiled pattern

DOTALL = re.compile(r"1st line.2nd line", re.DOTALL)
assert_that("1st line\n2nd line").matches(DOTALL)

Before

TypeError: given pattern arg must be a string, but was <re.compile('1st line.2nd line', re.DOTALL)> (Pattern)

Now

passed

A failure prints the pattern with its flags:

AssertionFailure: Expected <bar> to match pattern <re.compile('F', re.IGNORECASE)>, but did not.

does_not_match(), extracting_group(), matches_with_groups() and match.matches_regex() take one the same way. The type is str | re.Pattern[str], so a pattern of bytes is a type error.

Guide: Strings, Available matchers

match.matches_regex() refuses a pattern that never matches or always does

assert_that("anything").satisfies(match.matches_regex(re.compile("")))  # 1
</tr></table> 

... (truncated)

Commits

• 31d12e2 chore: release 2.32.0
• d7c71ce build: bump ruff to 0.17.1 and ty to 0.0.88
• 26619ba feat: accept a compiled re.Pattern[str] in matches(), its siblings and match....
• 6231866 chore: release 2.31.0
• 5cfb2c3 feat: give each failure a soft block collects its own diff in reports and mes...
• baf668d build: bump ty to 0.0.87
• 9168898 ci: get the mutation run past its baseline and raise its timeout to 300 minutes
• eb32d66 ci(deps): bump the actions-minor-patch group with 2 updates
• 170f715 build: bump locked dependencies and import the jsonpath parser from its defin...
• a64fa90 fix: read and write snapshot files as UTF-8, bump ruff to 0.17.0 and ty to 0....
• Additional commits viewable in compare view

Updates pyrefly from 1.3.2 to 1.4.0

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.4.0

Release date: October 14, 2026

Pyrefly v1.4.0 bundles 1191 commits from 66 contributors.

---

Release Highlights

Language Server

• The VS Code extension now runs the Pyrefly from your environment. By default, the extension launches the Pyrefly installed in your active Python environment (for example, your project's .venv), so your editor and your command line use the same version. If the environment has no Pyrefly, the extension falls back to its bundled binary. Set pyrefly.pyreflyExecutable to bundled to keep the old behavior. See Pyrefly binary selection.

Configuration & CLI

• uv workspace members are now type checked. In a uv workspace, the interpreter puts each member's source directory on sys.path as an editable install. Pyrefly treated those directories as installed packages and skipped them, so errors in workspace members went unreported. Pyrefly now checks editable sources inside your project, while regular site-packages stay excluded.

Type Checking

• Easier migration from BasedPyright. Pyrefly reads basedpyright sections in pyproject.toml and applies the matching type checking mode preset.
• New opt-in checks for untyped code. New error kinds such as unknown-member-type, unknown-return-type, untyped-function-decorator, and uninitialized-instance-variable help you find where Any enters your code.

Tensor Shapes

• JAX shape stubs on PyPI. This is the first stable release that ships JAX shape stubs as the jax-pyrefly-stubs package.

---

⚠️ Behavior Changes

These may change your editor setup or surface new errors in code that checked cleanly under v1.3.0.

• The VS Code extension now uses the Pyrefly in your active environment by default instead of its bundled binary. If your environment pins an older Pyrefly, the editor now runs that version. The Pyrefly language server output channel shows which binary was chosen and why.
• Pyrefly now checks the source of uv workspace members (editable installs inside your project). Errors in those packages that were hidden before can now appear.
• --typeshed-path now replaces the bundled typeshed entirely instead of overlaying it.
• The incompatible-overload-residual error kind is renamed to incompatible-overload-argument. The old name still works as a deprecated alias.
• site-package-path is renamed to site-packages-path. The old name still works.

---

✨ New & Improved

Type Checking

• Pyrefly now recognizes basedpyright configuration sections in pyproject.toml and applies appropriate type checking mode presets, making it easier to migrate from BasedPyright.
• TypedDict handling has been significantly improved: generic extra_items are now instantiated correctly, extra items can supply missing arguments, and definitely_seen calculation in callable checking has been fixed.
• TypeVar restriction checking is now enforced even when the expected type is gradual, preventing silent violations of TypeVar bounds and constraints when Any appears in the expected type.
• Improved handling of overloaded function arguments in generic function calls through a new overload table mechanism, replacing the previous residual-based approach. The incompatible-overload-residual error kind has been renamed to incompatible-overload-argument (the old name remains as a deprecated alias).
• Variance inference has been improved with fixes for nested variance reliability bugs and explicit stored variance evidence.
• Property decorator validation now reports invalid signatures with extra required parameters.

... (truncated)

Commits

• feeee25 cut 1.4.0 (pick onto fbcode/releases/pyrefly/v1.4)
• e6294fc Ignore return-only vars when an overload decides whether it wins (#5241)
• 1c1516f Test an overloaded protocol method whose return var is invariant
• 5327270 Accept bare arrays with symbolic shapes
• 4e9f88b Reject python-version below 3.5 instead of crashing
• d142f67 Document bare shaped array incompatibility
• 96f8820 Extend the test for constructors with several matching overloads
• ea8421d Reject an overload that violates a restriction under a gradual expected type ...
• 03e1ade Cover restriction violations under a gradual expected type in overloaded cons...
• 2adc991 Respect custom new inherited from an intermediate NamedTuple subclass (#5...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codspeed]

Merging this PR will not alter performance

✅ 4 untouched benchmarks

---

_{Comparing dependabot/uv/python-minor-patch-d90672d83e (4862745) with main (d93722c)}