[dependabot]

Bumps the python-development group with 4 updates in the / directory: mypy, pytest-randomly, ruff and types-cachetools.

Updates mypy from 1.20.2 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• Additional commits viewable in compare view

Updates pytest-randomly from 4.1.0 to 5.0.0

Changelog

Sourced from pytest-randomly's changelog.

5.0.0 (2026-09-01)

• Support Python 3.15.

• Shuffle tests in a wrapper around the pytest_collection_modifyitems hook, guaranteeing that the shuffle runs before all other plugins’ implementations of the hook.

  Previously, pytest-randomly shuffled in a plain tryfirst hook implementation. When another plugin also implemented the hook with tryfirst, as pytest-django does, whichever plugin pytest happened to register later ran first. Registration order comes from package metadata on disk, which can differ between seemingly identical environments — even two containers built from the same Dockerfile, or the same virtual environment after reinstalling a package. As a result, the same seed could yield different test orders in different environments. Worse, in environments where pytest-randomly ended up shuffling last, it silently destroyed the other plugin’s ordering — for pytest-django, the grouping of database tests that mirrors Django’s test runner (non-transactional database tests, then transactional ones, then the rest).

  Now the shuffle always runs first, and plugins that group tests with a stable sort apply their grouping on top of the shuffled order, so the final order is reproducible from the seed alone. In environments that previously hit the reversed hook order, upgrading changes the test order for a given seed — restoring both reproducibility and other plugins’ grouping.

  PR [#746](https://github.com/pytest-dev/pytest-randomly/issues/746) <https://github.com/pytest-dev/pytest-randomly/pull/746>. Thanks to milssky for the report in Issue [#701](https://github.com/pytest-dev/pytest-randomly/issues/701) <https://github.com/pytest-dev/pytest-randomly/issues/701>.

• Require pytest 8+, the first version to require a version of pluggy that supports hook wrappers, as used by the above fix.

  PR [#746](https://github.com/pytest-dev/pytest-randomly/issues/746) <https://github.com/pytest-dev/pytest-randomly/pull/746>__.

• Reset Polyfactory <https://polyfactory.litestar.dev/>__\’s default random state at the start of every test, if it is installed.

  Thanks to Rahul Kumar in PR [#735](https://github.com/pytest-dev/pytest-randomly/issues/735) <https://github.com/pytest-dev/pytest-randomly/issues/735>__.

• Switch package build backend from setuptools to uv_build <https://docs.astral.sh/uv/concepts/build-backend/>__. This makes builds with uv about nine times faster, since uv runs the backend natively, without creating a build environment or spawning a Python process. Additionally, source distributions no longer include test files, which setuptools previously included incompletely, missing the files needed to actually run them.

Commits

• 89ddfb1 Version 5.0.0
• 0d00951 Shuffle before other plugins' collection hooks (#746)
• 817091d Upgrade dependencies (#745)
• 42a2066 Fix podcast link in README (#740)
• c2a001d Reset Polyfactory's default random state on each test (#735)
• cc4762b Upgrade dependencies (#744)
• 94aba4a Upgrade dependencies (#743)
• c9140ef Support Python 3.15 (#741)
• 15f531e Switch build backend to uv_build (#739)
• 79eee6c [pre-commit.ci] pre-commit autoupdate (#738)
• Additional commits viewable in compare view

Updates ruff from 0.14.14 to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#28699)
• Update rules table with category information (#28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#28509)
• [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
• [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

• @​qinpei-dev
• @​sanjayrohith
• @​ntBre
• @​webdevsamran
• @​zaniebot
• @​ewdurbin
• @​MichaReiser
• @​spaceone
• @​IbrahimKhan12
• @​devtechedge
• @​GruffElixir

Install ruff 0.16.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#28699)
• Update rules table with category information (#28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#28509)
• [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
• [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

• @​qinpei-dev
• @​sanjayrohith
• @​ntBre
• @​webdevsamran
• @​zaniebot
• @​ewdurbin
• @​MichaReiser
• @​spaceone
• @​IbrahimKhan12
• @​devtechedge
• @​GruffElixir

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)

... (truncated)

Commits

• 0be08a2 Bump version to 0.16.9 (#28882)
• b4920b7 Rename ruff_cli to ruff_command_line (#28881)
• 47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
• 8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
• 5edf5a1 Use target form in rooster.version_files (#28876)
• 915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
• 4710e1a ci(github): update version number in placeholder of issue template (#28871)
• eedfc62 [ty] Propagate outer type context through cast calls (#28855)
• ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
• dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
• Additional commits viewable in compare view

Updates types-cachetools from 6.2.0.20260408 to 7.0.0.20260713

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud