Bump mypy from 2.2.0 to 2.3.0

[dependabot]

Bumps mypy from 2.2.0 to 2.3.0.

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

• No longer provide mypyc-accelerated wheels for macOS x86_64 [mypyc-wheels #119](mypyc/mypy_mypyc-wheels#119)

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

• Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
• Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
• Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
• Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
• Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits

• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
• 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
• 24c237d [mypyc] Improve documentation of Final (#21713)
• b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
• cbcb51a Narrow for frozendict membership check (#21709)
• af2bc0f Sync typeshed (#21707)
• Additional commits viewable in compare view

[github-actions]

🤖 Claude Code Review

Code Review: Bump mypy 2.2.0 → 2.3.0

Change summary: Single-line version bump of the mypy lint dependency in pyproject.toml (line 82), part of the repo's routine dependency-bump commits (consistent with recent history: #127, #126, #125).

Code Quality

• ✅ Style conventions — Follows existing TOML formatting; alphabetical ordering in the lint array is preserved.
• ✅ No commented-out code
• ✅ Meaningful names — N/A (no identifiers changed)
• ✅ DRY — N/A
• ✅ Defects — None found. Unlike black, isort, bandit, and pylint in the same block (pyproject.toml:69-81), mypy has no python_version conditional split — this matches the pre-existing pattern (the old mypy==2.2.0 line was also unconditional), so this isn't a regression introduced by this PR.
• ✅ CLAUDE.md consideration — .claude/CLAUDE.md content is generic (project overview, dev commands, style/lint conventions) with no local-machine-specific paths or environment assumptions. No issue.

Testing

• N/A — Dependency version bump only, no functional code change. No new tests required.

Documentation

• ⚠️ CHANGELOG.md was not updated, but this is consistent with prior dependency-bump commits in this repo (e.g. #125, #126, #127 — none touch the changelog), so this appears to be established project convention rather than an omission specific to this PR.
• N/A for README/API docs/inline comments.

Security

• ✅ No hardcoded credentials
• ✅ No input validation concerns (dependency pin only)
• ✅ No error handling changes
• ✅ No sensitive data exposure
• ✅ No .lic files or AQAAAD-prefixed license strings found in this diff. (Note: I found AQAAAD strings elsewhere in the working tree — prompt-header.md, prompt-temp.md, build-resources/... — but these are unrelated untracked scratch files outside this PR's diff and turned out to just be copies of this review-prompt template text, not actual license keys.)

Verdict

✅ Approve — Low-risk, mechanical dependency bump. No issues found.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

PR Code Review

Summary: This PR is a single-line Dependabot-style version bump of the mypy dev/lint dependency from 2.2.0 to 2.3.0 in pyproject.toml:77. No application code, tests, or docs are touched.

Code Quality

• ✅ Style conventions — Change is a simple version pin update, consistent with the existing pyproject.toml formatting and adjacent bump commits (e.g., 6ca3e0b, e68383b, 81235b0).
• ✅ No commented-out code — N/A, none present.
• ✅ Meaningful variable names — N/A, no code changes.
• ✅ DRY principle — N/A.
• ✅ Defects/bugs/security — No functional risk introduced. mypy has no dedicated [tool.mypy] config block in pyproject.toml and no mypy.ini/.mypy.ini file exists in the repo, so a minor version bump is unlikely to change linting behavior meaningfully, but note: mypy minor releases occasionally tighten type-checking defaults or add new checks, which could surface new errors in CI on pylint/mypy runs. Worth confirming CI passed on this PR before merge.
• ✅ CLAUDE.md review — .claude/CLAUDE.md is unchanged by this PR and remains general (project overview, dev commands, code style, supported Python versions). Nothing local-environment-specific.

Testing

• ✅ N/A — dependency version bump only, no new functions/endpoints/logic to test.

Documentation

• ✅ README/API docs — N/A, not applicable to a dev-dependency bump.
• ❌ CHANGELOG.md — Not checked/updated. Given this repo appears to use Dependabot for routine bumps (per commit history pattern), a CHANGELOG entry is likely not expected for this class of change — flagging only for completeness per the checklist.
• ✅ Markdown/CommonMark — N/A, no markdown files changed.

Security

• ✅ No hardcoded credentials — Confirmed, diff contains only a version string.
• ✅ Input validation — N/A.
• ✅ Error handling — N/A.
• ✅ No sensitive data in logs — N/A.
• ✅ No .lic files or AQAAAD-prefixed strings — Confirmed none present in this diff.

Overall

Low-risk, mechanical dependency bump. No blocking issues found. Recommend merging once CI (lint/mypy job) is confirmed green, since mypy point releases can occasionally introduce new type-check failures.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

No .lic files present. This is a minimal, single-line dependency version bump — review below.

Code Review: Bump mypy 2.2.0 → 2.3.0

Code Quality

• ✅ Style/formatting: Single-line version bump in pyproject.toml:77, consistent with surrounding entries.
• ✅ No commented-out code
• ✅ Meaningful names: N/A (dependency pin only)
• ✅ DRY: N/A
• ✅ Defects: No functional code changed. This only affects the lint dependency group (mypy is a dev/lint tool, not a runtime dependency), so no production behavior risk. One thing worth double-checking (not blocking): mypy 2.3.0 may surface new type-checking errors on the existing codebase that 2.2.0 didn't catch — worth confirming CI lint job passes with the new version.
• ✅ CLAUDE.md: Not touched by this diff; existing project CLAUDE.md is already environment-agnostic.

Testing

• ✅ N/A — dependency version bump only, no new functions/endpoints/logic to test.

Documentation

• ✅ README/API docs: N/A, no user-facing change.
• ⚠️ CHANGELOG.md: Not updated. Minor — many repos exclude routine dependency bumps (especially ones likely generated by Dependabot) from the changelog. If this repo's convention is to log all dep bumps, add an entry; otherwise this is fine as-is.
• ✅ Markdown formatting: N/A, no .md files changed.

Security

• ✅ No hardcoded credentials
• ✅ No input validation concerns (dev tooling only)
• ✅ No error handling changes
• ✅ No sensitive data in logs
• ✅ No .lic files found in the repository or diff

Summary

No blocking issues. This is a routine, low-risk dev-dependency bump (mypy 2.2.0 → 2.3.0). Recommend confirming the lint/type-check CI job still passes with the new mypy version before merging, since minor mypy releases occasionally introduce new checks that can surface fresh type errors in unrelated code.

Automated code review analyzing defects and coding standards