⬆️ deps: bump Python dev dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ruff (source, changelog)	>=0.16.8 → >=0.16.9
ty (changelog)	>=0.0.82 → >=0.0.84

---

Release Notes

astral-sh/ruff (ruff)

v0.16.9

Compare Source

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#​28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#​28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#​28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#​28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#​28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#​28699)
• Update rules table with category information (#​28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#​28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#​28509)
• [flake8-comprehensions] Document map/generator exception behavior (C417) (#​27794)
• [ruff] Mention related isort settings (RUF022) (#​28719)

Contributors

• @​qinpei-dev
• @​sanjayrohith
• @​ntBre
• @​webdevsamran
• @​zaniebot
• @​ewdurbin
• @​MichaReiser
• @​spaceone
• @​IbrahimKhan12
• @​devtechedge
• @​GruffElixir

astral-sh/ty (ty)

v0.0.84

Compare Source

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

• Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#​28759)

LSP server

• Complete string keys from dictionary initializers (#​28820)
• Support LSP requests against closed documents (#​28595)
• Select projects for external files using import search paths (#​28594)
• Use workspace editor settings for external files (#​28639)

Performance

• Avoid repeated subtyping checks for materialized recursive protocols (#​28774)
• Skip reading notebooks when discovering scripts (#​28781)

Core type checking

• Avoid incorrect simplification of TypeIs materializations (#​28817)
• Fix disjointness of generic class types (#​28787)
• Fix staticmethod shadowing through generic receivers and unions (#​28766)
• Infer callable signatures from bounded type variables (#​28599)
• Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#​28676)
• Infer through optional generic containers in the legacy solver (#​28791)
• Preserve call narrowing during cyclic inference (#​28708)
• Preserve intersections of type guard return types (#​28796)
• Use subtyping for constraint-set implication (#​28657)

Configuration

• Disable invalid-legacy-positional-parameter by default (#​28834)

Other changes

• Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#​28788)

Contributors

• @​ibraheemdev
• @​zsol
• @​charliermarsh
• @​lerebear
• @​MichaReiser
• @​ewdurbin
• @​carljm
• @​sharkdp

v0.0.83

Compare Source

Released on 2026-09-21.

Bug fixes

• Fix hangs from repeated partial application (#​28754)
• Preserve PEP 695 bindings across nested classes (#​28723)

LSP server

• Include required imports in every inlay hint (#​28724)
• Preserve fast name filtering for normalized Unicode source (#​28701)
• Refresh diagnostics after workspace configuration changes (#​28755)

Diagnostic improvements

• Expand unreachable-code annotations for redundant conditions (#​28674)
• Improve diagnostics for async generator stubs (#​28692)
• Improve primary diagnostic annotations for redundant-condition(-strict) diagnostics (#​28666)
• Point misplaced tuple ellipsis diagnostics at each ellipsis (#​28709)

Other changes

• Add rules that detect suspicious uses of Callable, Iterable, Iterator or Generator types in a boolean context (#​28554)
• Allow slots to override abstract properties (#​28698)
• Avoid leaking Unknown from unconstrained collection use-sites (#​28659)
• Diagnose unguarded cycles in implicit and PEP 613 aliases (#​28704)
• Eagerly bind unused Self receivers (#​28662)
• Generalize receiver binding for wrapped callables (#​28725)
• More faithful representation of bound methods (#​28410)
• Only classify evidence bounds for constrained type variables (#​28700)
• Preserve inferred bindings during annotation cycles (#​28717)
• Preserve quoted aliases during cycle recovery (#​28710)
• Reject class-scoped type variables in init receivers (#​28706)
• Reject unsafe TypedDict updates from hidden fields (#​28711)
• Respect fixed caller type variables when selecting constraints (#​28652)
• Reuse cached type alias inference for diagnostics (#​28696)
• Simplify unions of disjoint exclusions (#​28684)
• Update typing conformance suite (#​28718)

Contributors

• @​charliermarsh
• @​AlexWaygood
• @​sharkdp
• @​carljm
• @​ibraheemdev
• @​zaniebot
• @​MichaReiser

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.