build(deps): bump the python-dependencies group with 9 updates by dependabot[bot] · Pull Request #28 · sbgaia/python-template

dependabot · 2026-08-05T13:13:35Z

Bumps the python-dependencies group with 9 updates:

Package	From	To
hatchling	`1.30.1`	`1.31.0`
lizard	`1.22.1`	`1.23.0`
pre-commit	`4.6.0`	`4.6.1`
pip-audit	`2.10.0`	`2.10.1`
ruff	`0.15.13`	`0.16.1`
tox	`4.54.0`	`4.58.0`
tox-uv	`1.35.2`	`1.36.0`
pytest	`9.0.3`	`9.1.1`
pyrefly	`1.0.0`	`1.2.0`

Updates hatchling from 1.30.1 to 1.31.0

Release notes

Sourced from hatchling's releases.

Hatchling v1.31.0

Fixed

Only rewrite the shebang of a shared script when a Python shebang is present on the first line, preserving binary files and other content verbatim instead of dropping leading bytes.

Commits

4b3fd7d release Hatchling v1.31.0
19ced89 Fix env-dependency extras being dropped when a metadata hook is configured (#...
3b45c75 Prepare hatchling for release 1.31.0 (#2330)
e3d9b95 Addresses bug where blank lines are dropped when there is no shebang (#2328)
9bc573c Prepare for 1.17.1 hatch release (#2329)
bbb12bb Pass --no-header to uv pip compile for deterministic lockfiles (#2327)
8c06373 Fix uv lock check header comparison (#2317)
5cfbb54 fix: skip extend injection if already present in ruff config (#2305)
cf85971 fix: use TemporaryDirectory + pylock*.toml for temp lock files (#2303)
40c471c Docs: Add hatch-calver to version scheme plugins (#1725)
Additional commits viewable in compare view

Updates lizard from 1.22.1 to 1.23.0

Release notes

Sourced from lizard's releases.

1.23.0

New Features

Python — structural pattern matching (match/case, PEP 634, Python 3.10+) is now counted correctly for cyclomatic complexity (including --modified mode)

Bug Fixes

C/C++: stop raw string literals (R"(…)") from swallowing following code in the tokenizer (issue #478, PR #479)

Published to PyPI via GitHub Actions (release.yml).

Changelog

Sourced from lizard's changelog.

1.23.0

New Features

Python — structural pattern matching (match/case, PEP 634, Python 3.10+) is now counted correctly:

Each case arm adds +1 to cyclomatic complexity (like an if/elif branch)

case guards (case x if cond:) count the if as a normal condition

case and match used as plain variable names (assignments, attribute access, function calls, subscripts, tuple unpacking, annotated assignments) are not counted — soft-keyword disambiguation via lookahead in preprocess

--modified: an entire match/case block counts as 1, consistent with switch/case in C-family languages

Bug Fixes

C/C++: stop raw string literals (R"(…)") from swallowing following code in the tokenizer (issue #478, PR #479)

1.22.2

Bug Fixes

TypeScript: handle function stack correctly when starting a new function (avoids incorrect nesting / metrics)

Duplicate finder: avoid double-counting overlapping duplicate code ranges (PR #474)

Security

Demo Flask app (index.py): enable debug only when FLASK_DEBUG is set, not by default (PR #475)

Commits

06284ec Release 1.23.0
414f806 fix(clike): improve handling of C++ raw string literals in tokenizer
6c3ea38 Merge pull request #479 from StressTestor/fix/478-cpp-raw-string-overmatch
bfaa1b1 fix(clike): stop C++ raw string literals from swallowing following code
82c8e7a Merge pull request #477 from ixnes/fix/python_match_case
0d22cc7 added support for python match-case statements for normal and modified cyclom...
bd261a1 Release 1.22.2
147b163 fix: handle function stack correctly when starting a new function in TypeScri...
a1d1cac Merge pull request #475 from tomaioo/fix/security/flask-debug-mode-enabled-in...
142c7c5 fix(security): 2 improvements across 1 files
Additional commits viewable in compare view

Updates pre-commit from 4.6.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Install language: node hooks via git.

Fixes npm 12.x compatibility

#3719 PR by @asottile.

#3517 issue by @ojob.

Set JULIA_DEPOT_PATH for language: julia.

#3711 PR by @damonbayer.

pre-commit-ci/runner-image#335 issue by @damonbayer.

Produce error on mistyped --repo for pre-commit autoupdate.

#3701 PR by @mxr.

#3695 issue by @mxr.

Improve performance of commit existence check in pre-push.

#3726 PR by @asottile.

#3604 issue by @ptarjan.

Avoid duplicating conflicted filenames during pre-commit run --all-files.

#3727 PR by @asottile.

#3706 issue by @RomanValov.

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Install language: node hooks via git.

Fixes npm 12.x compatibility

#3719 PR by @asottile.

#3517 issue by @ojob.

Set JULIA_DEPOT_PATH for language: julia.

#3711 PR by @damonbayer.

pre-commit-ci/runner-image#335 issue by @damonbayer.

Produce error on mistyped --repo for pre-commit autoupdate.

#3701 PR by @mxr.

#3695 issue by @mxr.

Improve performance of commit existence check in pre-push.

#3726 PR by @asottile.

#3604 issue by @ptarjan.

Avoid duplicating conflicted filenames during pre-commit run --all-files.

#3727 PR by @asottile.

#3706 issue by @RomanValov.

Commits

242ce8a v4.6.1
766e550 Merge pull request #3727 from pre-commit/dedupe
1558d06 Merge pull request #3726 from pre-commit/exists-faster
8a1c47a avoid duplicate files in --all-files during conflict
2e01c99 faster check of rev existing locally as a commit
3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
1d811d9 Return an error for invalid --repo
374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
1e7994f set JULIA_DEPOT_PATH
b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
Additional commits viewable in compare view

Updates pip-audit from 2.10.0 to 2.10.1

Release notes

Sourced from pip-audit's releases.

v2.10.1

Fixed

Fixed a KeyError crash when an OSV vulnerability record contains an affected entry that omits the optional ranges field (#1046)

Changelog

Sourced from pip-audit's changelog.

[2.10.1]

Fixed

Fixed a KeyError crash when an OSV vulnerability record contains an affected entry that omits the optional ranges field (#1046)

Commits

8894eb8 Merge pull request #1056 from pypa/copilot/release-2101
1c625b7 Update version in README.md to 2.10.1
fd2094b Prep 2.10.1 release
58d2488 build(deps): bump github/codeql-action from 4.35.2 to 4.36.1 (#1052)
8df9420 build(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (#1044)
3f618d3 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1053)
4849132 Restrict OIDC token to publish job (#1050)
c1eb69a Fix KeyError when OSV affected entry omits optional ranges field (#1046)
68de07f Merge pull request #1054 from pypa/fix/1047
ef31c9e Formatting fixes
Additional commits viewable in compare view

Updates ruff from 0.15.13 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

Add an option to opt out of human-readable names (#27160)

[flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)

[pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)

[ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)

[flake8-bugbear] Mark range as immutable (B008) (#27247)

[flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)

[flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)

[pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)

[refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

[flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)

[refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

Fix indexing of excluded nested Ruff workspaces (#27303)

Lint TOML files in the LSP (#26862)

Documentation

Cover pycon Markdown formatting (#27153)

[flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)

[flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)

[pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

Reduce syntax error noise by swallowing dedents like indents (#27170)

Vendor latest annotate-snippets (#27033)

Contributors

@bxff

@anishgirianish

@Avasam

@epage

@LHMQ878

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

Add an option to opt out of human-readable names (#27160)

[flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)

[pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)

[ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)

[flake8-bugbear] Mark range as immutable (B008) (#27247)

[flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)

[flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)

[pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)

[refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

[flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)

[refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

Fix indexing of excluded nested Ruff workspaces (#27303)

Lint TOML files in the LSP (#26862)

Documentation

Cover pycon Markdown formatting (#27153)

[flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)

[flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)

[pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

Reduce syntax error noise by swallowing dedents like indents (#27170)

Vendor latest annotate-snippets (#27033)

Contributors

@bxff

@anishgirianish

@Avasam

@epage

@LHMQ878

@MichaReiser

... (truncated)

Commits

80790b3 Bump 0.16.1 (#27330)
63830f3 [ty] Borrow from constraint set storage less often (#27328)
f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
0d80497 Lint TOML files in the LSP (#26862)
d91586b Update prek dependencies (#27293)
7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
b20daf7 [ty] refactor: add helper function to send partial results (#27249)
4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
7c3e2db [ty] Fix enum class container assignability (#27318)
d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
Additional commits viewable in compare view

Updates tox from 4.54.0 to 4.58.0

Release notes

Sourced from tox's releases.

v4.58.0

What's Changed

👷 ci: run the test matrix against Python 3.15 by @gaborbernat in tox-dev/tox#4001

Full Changelog: tox-dev/tox@4.57.2...4.58.0

v4.57.2

What's Changed

🐛 fix(session): fix package env failure cascade and state corruption by @gaborbernat in tox-dev/tox#3991

🐛 fix(pkg): repair editable fallback and sdist-wheel root handling by @gaborbernat in tox-dev/tox#3992

🐛 fix(pylock): install exactly what the lock file specifies by @gaborbernat in tox-dev/tox#3994

🐛 fix(cache): self-heal wrong-shape tox-info content by @gaborbernat in tox-dev/tox#3996

🐛 fix(config): rebuild loader chains per config set by @gaborbernat in tox-dev/tox#3993

🐛 fix(pip): stable rendering of set options in install cache by @gaborbernat in tox-dev/tox#3995

🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks by @gaborbernat in tox-dev/tox#3997

🐛 fix(run): honor the fail-fast contract, resilient teardown by @gaborbernat in tox-dev/tox#3999

🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin by @gaborbernat in tox-dev/tox#3998

🐛 fix(ux): four run-edge polish fixes by @gaborbernat in tox-dev/tox#4000

Full Changelog: tox-dev/tox@4.57.1...4.57.2

v4.57.1

What's Changed

Run sequentially for run-parallel -p 0 instead of at CPU count by @chuenchen309 in tox-dev/tox#3989

Do not let a lone quote in a set_env value swallow the marker by @chuenchen309 in tox-dev/tox#3988

Full Changelog: tox-dev/tox@4.57.0...4.57.1

v4.57.0

What's Changed

💰 Surface the org itself in the FUNDING config by @webknjaz in tox-dev/tox#3979

Replace prettier with mdformat and yamlfmt by @gaborbernat in tox-dev/tox#3984

📦 build: use test dependency group in internal envs by @gaborbernat in tox-dev/tox#3985

✨ feat(python): match free-threaded and debug interpreter builds by @chuenchen309 in tox-dev/tox#3986

New Contributors

@chuenchen309 made their first contribution in tox-dev/tox#3986

Full Changelog: tox-dev/tox@4.56.4...4.57.0

... (truncated)

Changelog

Sourced from tox's changelog.

Miscellaneous internal changes - 4.58.0

Test against Python 3.15 (beta) in CI and declare its classifier - by :user:gaborbernat. (:issue:4001)

v4.57.2 (2026-07-21)

Bug fixes - 4.57.2

Fix package environment creation failures being misreported:

discard the partially registered configuration on failure, so the real error surfaces instead of a spurious duplicate configuration definition;

report the first creation failure in definition order, not a hash-random one;

build the PEP 517 frontend lazily, so tox c and tox l work when pyproject.toml cannot be read. (:issue:3987)

Fix state corruption in the environment creation machinery:

a failed run environment build no longer removes shared package environments other run environments still use;

a run environment registers with its package environment once, not twice with triple-counted usage;

circular depends reports the cycle as an error instead of a raw traceback;

Skip raised by a plugin for a package environment marks the run environment package-skipped instead of crashing with UnboundLocalError. (:issue:3991)

Fix two packaging regressions:

package = editable on a build backend without PEP-660 support now falls back to editable-legacy with a warning instead of crashing, also when the project metadata is static;

editable and wheel environments running after an sdist-wheel environment build from the project sources again, instead of a stale temporary copy that made source edits invisible. (:issue:3992)

An environment serving as both a run environment and a package environment now behaves predictably:

one defined through a [testenv:...]-style section and referenced by package_env inherits from pkgenv/env_pkg_base as documented, instead of silently keeping run environment defaults;

one listed in env_list while referenced as a package environment is reported as a configuration conflict up front, instead of failing late with cannot run packaging environment or silently disappearing from tox l. (:issue:3993)

pylock.toml installs now match the lock file:

a package locked once per Python range installs only the version matching the environment's interpreter;

packages locked to a local directory, VCS repository, or archive install from that source instead of resolving the name against the package index;

locked hashes are verified when every entry carries one;

changing a pip environment variable such as PIP_INDEX_URL reinstalls, as it already did for deps.

... (truncated)

Commits

69e1bdc release 4.58.0
ea8734e 👷 ci: run the test matrix against Python 3.15 (#4001)
2d8d5ae release 4.57.2
b74d78b 🐛 fix(ux): four run-edge polish fixes (#4000)
09dad3d 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin (#3...
fa6ec2b 🐛 fix(run): honor the fail-fast contract, resilient teardown (#3999)
b1b0159 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks (#3997)
a111ec6 🐛 fix(pip): stable rendering of set options in install cache (#3995)
e969723 🐛 fix(config): rebuild loader chains per config set (#3993)
6a9b6a5 🐛 fix(cache): self-heal wrong-shape tox-info content (#3996)
Additional commits viewable in compare view

Updates tox-uv from 1.35.2 to 1.36.0

Release notes

Sourced from tox-uv's releases.

1.36.0

What's Changed

Fix flaky na-interpreter test for skip_missing_interpreters default by @gaborbernat in tox-dev/tox-uv#349

Replace prettier with mdformat and yamlfmt by @gaborbernat in tox-dev/tox-uv#356

👷 ci: add Python 3.15 to the test matrix by @gaborbernat in tox-dev/tox-uv#358

Full Changelog: tox-dev/tox-uv@1.35.2...1.36.0

Commits

6268ef9 👷 ci: add Python 3.15 to the test matrix (#358)
12edb70 [pre-commit.ci] pre-commit autoupdate (#357)
a6d24f8 Replace prettier with mdformat and yamlfmt (#356)
8bab275 build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 (#355)
75c7409 build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 (#354)
a4ef4f2 [pre-commit.ci] pre-commit autoupdate (#353)
16203a1 build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 (#352)
af040e7 [pre-commit.ci] pre-commit autoupdate (#351)
1a09434 💰 Surface GitHub Sponsors + thanks.dev
9781bb7 [pre-commit.ci] pre-commit autoupdate (#350)
Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

#14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.

#14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".

#14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.

#14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

#14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

If this is undesirable, move the fixture definition to a conftest.py file if possible.

Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

#10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

See 10819 and 14011.

#12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

See dynamic-fixture-request-during-teardown for details.

#13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

See parametrize-iterators for details and suggestions.

#13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

See config-inicfg for more details.

#14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

cf470ec Prepare release version 9.1.1
e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
501c4bc Merge pull request #14596 from bluetech/doc-classmethod
b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
9a567e0 [automated] Update plugin list (#14617) (#14618)
ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
Additional commits viewable in compare view

Updates pyrefly from 1.0.0 to 1.2.0

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.2.0

Release date: July 31, 2026

Pyrefly v1.2.0 bundles 901 commits from 59 contributors.

✨ New & Improved

Type Checking

Attrs classes are now fully supported with comprehensive field synthesis, validation, and special-method generation. Pyrefly recognizes @attr.s, @define, @frozen, and their variants, handling field specifiers (attr.ib(), field()), converters, validators, defaults, and private-field aliasing. Converters are typed from their real input type rather than Any, including the @<field>.converter decorator, attrs.converters.pipe, attrs.converters.default_if_none, and generic converters like copy.deepcopy. See the new attrs documentation for details.

functools.partial is now type-checked instead of treated as opaque. Bound arguments are validated at construction and Pyrefly synthesizes a precise residual signature for the remaining parameters, so errors surface at both the partial(...) call and the later invocation. Generic functions, overloads, constructors, bound methods, and **Unpack[TypedDict] parameters are supported, and results expose .func, .args, and .keywords. Precise residual callable assignment is enabled by the strict and all presets or explicitly with strict-partial-subtyping.

Functions decorated with functools.singledispatch now type-check calls using the signature of the function you decorated, and registered implementations are checked against that function's first parameter. Generic singledispatch functions infer from call arguments instead of reporting Unknown.

Pyrefly can now warn when a function declared to return a concrete type returns Any, with separate diagnostics for explicit and inferred cases. Off by default, and migrated automatically from mypy's warn_return_any.

Pattern matching is substantially more precise: positional class patterns resolve attribute names from __match_args__ at solve time, sequence element captures read from the narrowed subject so sibling constraints refine them, and isinstance on a facet filters the parent union to matching members. Fully covered class and sequence patterns now subtract their union member from later cases.

Unpacking a variadic tuple with a fixed prefix and suffix no longer smears those elements into the starred capture, so a, *rest, b = t where t: tuple[int, *tuple[bool, ...], str] types rest as list[bool].

TypedDict classes now synthesize __required_keys__ and __optional_keys__, so protocols requiring them (like those in langgraph) satisfy structural checks. .get() and .pop() with literal defaults preserve the field type.

Overload handling improved throughout: constrained TypeVar arguments expand during resolution, rejected overloads no longer leak argument errors into diagnostics, and exact callback-forwarding signatures resolve overloaded callbacks against forwarded arguments for helpers like asyncio.to_thread.

Enum .value on an enum type now infers as the union of member literal values instead of widening to the mixed-in data type.

Lambda parameters are contextually typed more thoroughly. Types are stored directly rather than resolved through inference variables, and *args/**kwargs resolve from callable hints to tuple[...] and dict[str, ...] inside the body while preserving element types in the signature.

All properties are now treated as data descriptors, and reflected binary-operation dunders are tried first for proper subclasses, fixing a class of incorrect attribute and operator results.

Cyclic type aliases reachable from an annotation are now detected instead of hanging, and class finality is taken into account when deciding whether a condition is redundant.

Continued basedpyright parity work: class instance truthiness is recognized, code under if TYPE_CHECKING is handled consistently, typing_extensions.sentinel is supported with relaxed naming restrictions, and super(cls, cls) is accepted.

copy.replace is now type-checked like dataclass replacement, and isinstance(x, type) preserves type arguments when narrowing unions.

Narrowing a receiver typed as Self to a subclass now preserves Self, eliminating false return errors in methods that return the narrowed receiver.

Library Support

Pydantic constructor synthesis now honors populate_by_name and built-in alias_generator functions, ignores Field(init=False) to match runtime, and treats frozen as a readonly field reason.

Django ForeignKey targets now resolve attribute expressions and string references such as "app_label.Model", preserving the generated relation and <field>_id types.

Bare factory-boy factory calls now return the model type via FactoryMetaClass.

PEP 561 partial stub packages are now supported in imports. Pyrefly reads the partial marker from py.typed and merges the stubs with the runtime package, deferring to the runtime package for omitted modules while preserving .pyi-before-.py precedence for provided ones.

A configured typeshed-path now supplies stdlib stubs as well as third-party stubs, enabling complete custom-typeshed testing and overrides.

Language Server

Hover now resolves keyword arguments, renders callable protocols as their __call__ signature, preserves overload docstrings at call sites, shows enum fields, wraps nested callable and Concatenate[...] signatures for readability, and covers and/or operators, augmented assignments, and union methods.

Auto-import completions respect python.analysis.autoImportCompletions, rank deprecated stdlib typing aliases below their modern equivalents, avoid duplicates for already-imported modules, and preserve import aliases correctly.

Rename now works on aliased imports and across files for keyword arguments, and renaming a Protocol class targets the class rather than __init__.

Go-to-definition now navigates directly to symbols in non-Python files such as .thrift, including nested attribute and enum access and intermediate components of multi-dotted imports.

Inlay hints debounce server-side (default 150ms), preventing width jitter while typing. NewType values now use their callable constructor signature instead of producing an invalid type[N] annotation.

Notebook support improved: hover and type lookups work past the first cell, and inlay hints, document symbols, references, and diagnostic grouping work in cells following markdown cells.

Document symbols fall back to flat SymbolInformation for clients such as Helix, semantic tokens cover with ... as and except ... as bindings, and cross-file diagnostics refresh on save in strict-spec clients such as Zed.

#region/#endregion markers create folding regions, and selection ranges now follow AST nesting from expression to statement to scope to document.

Baselined errors now appear as hints instead of errors, making it easier to distinguish new issues from known technical debt. Baselining also now applies correctly to unused-ignore diagnostics.

Match captures receive consistent semantic highlighting and preserve their declaration identity for go-to-definition.

lspArguments defaults to ["lsp"] when empty, preventing startup failures in dev containers and remote environments.

The VSCode extension adds an "Infer Types for Current File" command to the command palette.

... (truncated)

Commits

1933169 cut 1.2.0
df11f5d Enforce call-boundary consumption in production
e67bc8e Transfer quantified handles to call boundaries
6ba516f Move deferred call state into its boundary
8888e70 Scope call contexts to a lexical boundary
f8c9e7c LSP: default lspArguments to ["lsp"] when empty
3f0c228 Remove dead .hgignore
335510d improve Sandbox: link shortening #1063 (#4327)
41094b9 Keep lambda hint decomposition transactional
3193b6a fix behavior of init=False for pydantic.BaseModel (#4352)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase ...

Description has been truncated

Bumps the python-dependencies group with 9 updates: | Package | From | To | | --- | --- | --- | | [hatchling](https://github.com/pypa/hatch) | `1.30.1` | `1.31.0` | | [lizard](https://github.com/terryyin/lizard) | `1.22.1` | `1.23.0` | | [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.1` | | [pip-audit](https://github.com/pypa/pip-audit) | `2.10.0` | `2.10.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.13` | `0.16.1` | | [tox](https://github.com/tox-dev/tox) | `4.54.0` | `4.58.0` | | [tox-uv](https://github.com/tox-dev/tox-uv) | `1.35.2` | `1.36.0` | | [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` | | [pyrefly](https://github.com/facebook/pyrefly) | `1.0.0` | `1.2.0` | Updates `hatchling` from 1.30.1 to 1.31.0 - [Release notes](https://github.com/pypa/hatch/releases) - [Commits](pypa/hatch@hatchling-v1.30.1...hatchling-v1.31.0) Updates `lizard` from 1.22.1 to 1.23.0 - [Release notes](https://github.com/terryyin/lizard/releases) - [Changelog](https://github.com/terryyin/lizard/blob/master/CHANGELOG.md) - [Commits](terryyin/lizard@1.22.1...1.23.0) Updates `pre-commit` from 4.6.0 to 4.6.1 - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1) Updates `pip-audit` from 2.10.0 to 2.10.1 - [Release notes](https://github.com/pypa/pip-audit/releases) - [Changelog](https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md) - [Commits](pypa/pip-audit@v2.10.0...v2.10.1) Updates `ruff` from 0.15.13 to 0.16.1 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.13...0.16.1) Updates `tox` from 4.54.0 to 4.58.0 - [Release notes](https://github.com/tox-dev/tox/releases) - [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst) - [Commits](tox-dev/tox@4.54.0...4.58.0) Updates `tox-uv` from 1.35.2 to 1.36.0 - [Release notes](https://github.com/tox-dev/tox-uv/releases) - [Commits](tox-dev/tox-uv@1.35.2...1.36.0) Updates `pytest` from 9.0.3 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.3...9.1.1) Updates `pyrefly` from 1.0.0 to 1.2.0 - [Release notes](https://github.com/facebook/pyrefly/releases) - [Commits](facebook/pyrefly@1.0.0...1.2.0) --- updated-dependencies: - dependency-name: hatchling dependency-version: 1.31.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: lizard dependency-version: 1.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: pre-commit dependency-version: 4.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: pip-audit dependency-version: 2.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: ruff dependency-version: 0.16.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: tox dependency-version: 4.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: tox-uv dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: pyrefly dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 5, 2026

sbgaia merged commit 360671f into main Aug 6, 2026
15 checks passed

sbgaia deleted the dependabot/uv/python-dependencies-fefa009d0a branch August 6, 2026 09:35

Navigation Menu

build(deps): bump the python-dependencies group with 9 updates - #28

build(deps): bump the python-dependencies group with 9 updates#28
sbgaia merged 1 commit into
mainfrom
dependabot/uv/python-dependencies-fefa009d0a

dependabot Bot commented on behalf of github Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 5, 2026

Hatchling v1.31.0

1.23.0

New Features

Bug Fixes

1.23.0

New Features

Bug Fixes

1.22.2

Bug Fixes

Security

pre-commit v4.6.1

Fixes

4.6.1 - 2026-07-21

Fixes

v2.10.1

Fixed

[2.10.1]

Fixed

0.16.1

Release Notes

Preview features

Bug fixes

Rule changes

Server

Documentation

Other changes

Contributors

0.16.1

Preview features

Bug fixes

Rule changes

Server

Documentation

Other changes

Contributors

v4.58.0

What's Changed

v4.57.2

What's Changed

v4.57.1

What's Changed

v4.57.0

What's Changed

New Contributors

Miscellaneous internal changes - 4.58.0

Bug fixes - 4.57.2

1.36.0

What's Changed

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

Pyrefly v1.2.0

✨ New & Improved

Type Checking

Library Support

Language Server

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant