chore(deps): bump the python-minor-patch group with 5 updates

[dependabot]

Bumps the python-minor-patch group with 5 updates:

Package	From	To
hypothesis	6.156.6	6.161.2
ruff	0.15.22	0.16.0
ty	0.0.60	0.0.63
assertpy2	2.15.0	2.18.0
mkdocs-material	9.7.6	9.7.7

Updates hypothesis from 6.156.6 to 6.161.2

Commits

• 5ec7af5 Bump hypothesis version to 6.161.2 and update changelog
• dc2cb63 Merge pull request #4816 from Liam-DeVoe/riscv64-wheels
• d95c1f7 publish riscv64 glibc and musl wheels
• f6a6b7b Bump hypothesis version to 6.161.1 and update changelog
• 4a1706e Merge pull request #4814 from Jayashanker-Padishala/fix-lark-escaped-string
• 9c6561d Use a typed filter predicate for terminal strategies
• d18e36d Only generate lark terminals the lexer would match entirely
• f58678b Bump hypothesis version to 6.161.0 and update changelog
• f7e5f86 Merge pull request #4810 from Zac-HD/claude/note-observability-output-33hcvo
• 2aada67 Fix test failures under the crosshair backend
• Additional commits viewable in compare view

Updates ruff from 0.15.22 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Updates ty from 0.0.60 to 0.0.63

Release notes

Sourced from ty's releases.

0.0.63

Release Notes

Released on 2026-07-23.

Core type checking

• Handle generic stringified PEP 613 (typing.TypeAlias) type aliases (#27092)
• Allow equality narrowing across non-final classes (#27031)
• Allow interpolated string literals to be promoted to str (#27104)
• Fix double specialization of generic type aliases (#27058)
• Fix intersections of type and TypeForm (#27099)
• When narrowing from a match statement leads a variable x to be inferred as A & B, infer the type of x.attr as <type of A.attr> & <type of B.attr> (#27103)

Library support

• Pydantic: Stricter validation of sub-model fields in lax mode (#27091)
• Pydantic: Support special underscore parameters in BaseSettings models (#27098)

Performance

• Avoid exponential narrowing of optional dynamic match subjects (#27100)
• Avoid normalizing cached absolute file paths (#26998)

Contributors

• @​sharkdp
• @​charliermarsh
• @​ibraheemdev
• @​carljm

Install ty 0.0.63

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.63/ty-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ty/releases/download/0.0.63/ty-installer.ps1 | iex"

Download ty 0.0.63

File	Platform	Checksum
ty-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.63

Released on 2026-07-23.

Core type checking

• Handle generic stringified PEP 613 (typing.TypeAlias) type aliases (#27092)
• Allow equality narrowing across non-final classes (#27031)
• Allow interpolated string literals to be promoted to str (#27104)
• Fix double specialization of generic type aliases (#27058)
• Fix intersections of type and TypeForm (#27099)
• When narrowing from a match statement leads a variable x to be inferred as A & B, infer the type of x.attr as <type of A.attr> & <type of B.attr> (#27103)

Library support

• Pydantic: Stricter validation of sub-model fields in lax mode (#27091)
• Pydantic: Support special underscore parameters in BaseSettings models (#27098)

Performance

• Avoid exponential narrowing of optional dynamic match subjects (#27100)
• Avoid normalizing cached absolute file paths (#26998)

Contributors

• @​sharkdp
• @​charliermarsh
• @​ibraheemdev
• @​carljm

0.0.62

Released on 2026-07-21.

Bug fixes

• Guard recursive Protocol and TypedDict relations (#26990)
• Prevent stack overflows in recursive type relation checks (#26503)
• Recover from cancelled file indexing (#26876)

Diagnostics

• Avoid editing ignore comments with trailing reasons (#26939)
• Prefer innermost inline suppressions (#26940)
• Remove unused own-line ignore comments (#27013)
• Reuse applicable own-line suppressions in --add-ignore (#26925)

Configuration

• Respect rules and analysis in PEP 723 script metadata configurations (#26671)

... (truncated)

Commits

• 46f4915 Bump version to 0.0.63 (#4071)
• df75992 Bump version to 0.0.62 (#4057)
• 48dd1fd Update prek dependencies (#4059)
• f53a95e Update astral-sh/setup-uv action to v9 (#4060)
• 17d1791 Update dependency prek to v0.4.9 (#4058)
• eb7e7ba Update documentation on mypy/pyright --strict parity, and achieving maximum...
• 56b2c24 Update changelog for 0.0.61 (#4028)
• 4c865c8 Bump version to 0.0.61 (#4027)
• See full diff in compare view

Updates assertpy2 from 2.15.0 to 2.18.0

Release notes

Sourced from assertpy2's releases.

2.18.0

TL;DR

Change	What it gives you
Vacuity guard	an opt-in warning when a universal assertion passes over an empty value
Naive and aware datetimes	fix: the ignoring-precision assertions refuse the mixed pair instead of passing
extracting(sort=...)	fix: an invalid sort arg is rejected rather than silently ignored
is_subset_of()	fix: dicts and lists as items work, the way the containment family already allowed
Matcher combinators	fix: & and | reject a non-matcher where the combinator is written
Circular references	fix: the snapshot and shape walkers report the cycle instead of a RecursionError
Near-timeout polls	a run-end report naming the polls that converged against their deadline, with a bar you can move
Snapshot mismatches	the failure names the snapshot file and the flag that accepts the new value
Inline snapshots	a mismatch says how to rewrite the literal in place
assert_conforms()	pydantic validation errors become structured diff rows, one per field
Soft and warn failures	the diff reaches soft_assertions() and assert_warn(), not only hard failures
Pipeline provenance	an empty-value failure says which step emptied it
Ordering and duplicates	the longest run that matched, and which values were repeated
any_satisfy()	the items that were examined, instead of only "none did"

Assertions that checked nothing

A universal assertion over an empty collection is true by definition. all_satisfy() on an empty list passes without calling the predicate once, and so does every sibling that quantifies over items.

That is correct logic and a common way for a test to stop testing anything. The fixture stops producing rows, the filter stops matching, and the assertion keeps passing.

The guard is opt-in, because an empty subject is legitimate as often as it is a bug. Turn it on with --assertpy2-vacuous or ASSERTPY2_VACUOUS=1, and silence individual call sites with allow_empty=True.

def test_archived_orders_are_settled():
    archived_orders = []
    assert_that(archived_orders).all_satisfy(lambda order: order.total > 0)

Before

1 passed in 0.11s

Now, with the flag:

1 passed, 1 warning in 0.10s
VacuousAssertionWarning: all_satisfy() passed over an empty value, so nothing was

checked. Pass allow_empty=True if that is intended.

... (truncated)

Commits

• 0df7a8b chore: release 2.18.0
• 1458172 build: bump ty to 0.0.63
• cf0a64e build: bump ty to 0.0.62
• 618f31e feat: let the near-timeout poll report be tuned or turned off
• fc56fc2 perf: read the vacuity environment switch once instead of per assertion
• 892990d docs: cover the new guards and reports, and clear the prose walls
• 5f0d274 feat: show the examined items when any_satisfy finds no match
• f533e60 feat: name what broke in ordering and duplicate containment failures
• abfe6e7 fix: reject a non-matcher operand where the combinator is written
• c16a478 fix: detect circular references in the shape and snapshot walkers
• Additional commits viewable in compare view

Updates mkdocs-material from 9.7.6 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

• Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

• Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

• Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

• Limited version range of mkdocs to <2
• Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

• Hardened social cards plugin by switching to sandboxed environment
• Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

• Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

• Opened up version ranges of optional dependencies for forward-compatibility
• Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

• Updated requests to 2.30+ to mitigate CVE in urllib
• Fixed privacy plugin not picking up protocol-relative URLs
• Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

• b3e6dd8 Prepare 9.7.7 release
• 52fb6be Merge commit from fork
• 901e633 Added SECURITY.md with EOL notice
• 5b36f2a Bump js-yaml from 4.1.1 to 4.2.0 (#8598)
• 2d11e7b Bump form-data from 3.0.4 to 3.0.5 (#8597)
• ae05a53 Bump esbuild from 0.27.2 to 0.28.1 (#8596)
• 434af93 Bump shell-quote from 1.7.3 to 1.8.4 (#8593)
• 4447cda Documentation (#8590)
• 8f8d551 Updated copyright year (#8588)
• 08d8514 Bump fast-uri from 3.0.3 to 3.1.2 (#8587)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codspeed-hq]

Merging this PR will not alter performance

✅ 4 untouched benchmarks

---

_{Comparing dependabot/uv/python-minor-patch-60045d7570 (a780ab4) with main (c002ad4)}