Skip to content

chore(deps-dev): bump the python-minor-patch group with 3 updates#687

Merged
igerber merged 2 commits into
mainfrom
dependabot/pip/python-minor-patch-7eae64c20d
Jul 19, 2026
Merged

chore(deps-dev): bump the python-minor-patch group with 3 updates#687
igerber merged 2 commits into
mainfrom
dependabot/pip/python-minor-patch-7eae64c20d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 3 updates: black, ruff and mypy.

Updates black from 26.3.1 to 26.5.1

Release notes

Sourced from black's releases.

26.5.1

Stable style

  • Fix unstable formatting of annotated assignments whose subscript annotation contains an inline comment (e.g. x: list[ # pyright: ignore[...]) (#5130)
  • Preserve inline comments (including # type: ignore) immediately before a # fmt: skip line, avoiding AST equivalence failures (#5139)

Packaging

  • Correct the version in the published executables (#5137)

Documentation

  • Add Neovim integration guide covering conform.nvim, ALE, and simple command approaches (#5124)

26.5.0

Highlights

  • Add support for unpacking in comprehensions (PEP 798) and for lazy imports (PEP 810), both new syntactic features in Python 3.15 (#5048)
  • Python 3.15 is now supported. Compiled wheels are not yet provided for Python 3.15, so performance may be slower than on existing Python versions. Wheels will be provided once Python 3.15 is later in its release cycle. (#5127)

Stable style

  • Fix # fmt: skip being ignored in nested if expressions with parenthesized in clauses (#4903)
  • Add syntactic support for Python 3.15 (#5048)
  • Fix crash when an f-string follows a # fmt: off comment inside brackets (#5097)
  • Preserve multiline compound statement headers when # fmt: skip is placed on the colon line (#5117)

Preview style

  • Improve heuristics around whether blank lines should appear before, within and after groups of same-name decorated functions (such as @overload groups) in .pyi stub files (#5021)
  • Fix blank lines being removed between a function and a decorated class in .pyi stub files (#5092)
  • Prevent string merger from creating unsplittable long lines when a pragma comment (e.g. # type: ignore) follows the closing bracket (#5096)

Packaging

Output

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.5.1

Stable style

  • Fix unstable formatting of annotated assignments whose subscript annotation contains an inline comment (e.g. x: list[ # pyright: ignore[...]) (#5130)
  • Preserve inline comments (including # type: ignore) immediately before a # fmt: skip line, avoiding AST equivalence failures (#5139)

Packaging

  • Correct the version in the published executables (#5137)

Documentation

  • Add Neovim integration guide covering conform.nvim, ALE, and simple command approaches (#5124)

Version 26.5.0

Highlights

  • Add support for unpacking in comprehensions (PEP 798) and for lazy imports (PEP 810), both new syntactic features in Python 3.15 (#5048)
  • Python 3.15 is now supported. Compiled wheels are not yet provided for Python 3.15, so performance may be slower than on existing Python versions. Wheels will be provided once Python 3.15 is later in its release cycle. (#5127)

Stable style

  • Fix # fmt: skip being ignored in nested if expressions with parenthesized in clauses (#4903)
  • Add syntactic support for Python 3.15 (#5048)
  • Fix crash when an f-string follows a # fmt: off comment inside brackets (#5097)
  • Preserve multiline compound statement headers when # fmt: skip is placed on the colon line (#5117)

Preview style

  • Improve heuristics around whether blank lines should appear before, within and after groups of same-name decorated functions (such as @overload groups) in .pyi stub files (#5021)
  • Fix blank lines being removed between a function and a decorated class in .pyi stub files (#5092)
  • Prevent string merger from creating unsplittable long lines when a pragma comment (e.g. # type: ignore) follows the closing bracket (#5096)

Packaging

... (truncated)

Commits

Updates ruff from 0.15.13 to 0.15.21

Release notes

Sourced from ruff's releases.

0.15.21

Release Notes

Released on 2026-07-09.

Preview features

  • Add --add-ignore for adding ruff:ignore comments (#26346)
  • [flake8-comprehensions] Drop C409 tuple comprehension preview behavior (#25707)
  • Avoid whitespace normalization when formatting comments (#26455)
  • [pyupgrade] Lint and fix use of deprecated abc decorators (UP051) (#26417)

Bug fixes

  • Refine non-empty f-string detection (#26526)
  • Detect syntax errors in individual notebook cells (#26419)
  • [flake8-implicit-str-concat] Fix ISC003 autofix incorrectly stripping + from comments (#26554)

Rule changes

  • [flake8-executable] Mark EXE004 fix as unsafe (#26033)
  • [flake8-pyi] Mark PYI061 fixes as unsafe in Python files (#26533)
  • [pydocstyle] Skip overload-with-docstring in stub files (D418) (#26318)

Performance

  • Avoid per-token source index visitor calls (#26506)
  • Cache parenthesized expression boundaries in the formatter (#26344)
  • Improve performance of rendering edits in preview mode (#26565)
  • Inline fits_element in formatter (#26429)
  • Inline formatter printing hot paths (#26504)
  • Lazily create builtin bindings (#26510)
  • Skip empty trivia scans in the source indexer (#26507)
  • Use ICF for macOS release builds (#25780)

Formatter

  • Add --extend-exclude to ruff format (#26372)

Documentation

  • Add "How does Ruff's import sorting compare to isort?" link to README (#26530)
  • Fix Mozilla Firefox repository link in README (#26537)
  • [flake8-bandit] Fix misleading docstring for mako-templates (S702) (#26432)
  • [ruff] Fix non-triggering example for if-key-in-dict-del (RUF051) (#26433)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.21

Released on 2026-07-09.

Preview features

  • Add --add-ignore for adding ruff:ignore comments (#26346)
  • [flake8-comprehensions] Drop C409 tuple comprehension preview behavior (#25707)
  • Avoid whitespace normalization when formatting comments (#26455)
  • [pyupgrade] Lint and fix use of deprecated abc decorators (UP051) (#26417)

Bug fixes

  • Refine non-empty f-string detection (#26526)
  • Detect syntax errors in individual notebook cells (#26419)
  • [flake8-implicit-str-concat] Fix ISC003 autofix incorrectly stripping + from comments (#26554)

Rule changes

  • [flake8-executable] Mark EXE004 fix as unsafe (#26033)
  • [flake8-pyi] Mark PYI061 fixes as unsafe in Python files (#26533)
  • [pydocstyle] Skip overload-with-docstring in stub files (D418) (#26318)

Performance

  • Avoid per-token source index visitor calls (#26506)
  • Cache parenthesized expression boundaries in the formatter (#26344)
  • Improve performance of rendering edits in preview mode (#26565)
  • Inline fits_element in formatter (#26429)
  • Inline formatter printing hot paths (#26504)
  • Lazily create builtin bindings (#26510)
  • Skip empty trivia scans in the source indexer (#26507)
  • Use ICF for macOS release builds (#25780)

Formatter

  • Add --extend-exclude to ruff format (#26372)

Documentation

  • Add "How does Ruff's import sorting compare to isort?" link to README (#26530)
  • Fix Mozilla Firefox repository link in README (#26537)
  • [flake8-bandit] Fix misleading docstring for mako-templates (S702) (#26432)
  • [ruff] Fix non-triggering example for if-key-in-dict-del (RUF051) (#26433)

Contributors

... (truncated)

Commits

Updates mypy from 2.1.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)
  • Make for loop over list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21686)
  • Fix memory safety of list.count on free-threaded builds (Jukka Lehtosalo, PR 21680)
  • Make vec creation from list memory safe on free-threaded builds (Jukka Lehtosalo, PR 21681)

... (truncated)

Commits
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
  • 24c237d [mypyc] Improve documentation of Final (#21713)
  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
  • cbcb51a Narrow for frozendict membership check (#21709)
  • af2bc0f Sync typeshed (#21707)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot @github

dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from igerber as a code owner July 13, 2026 18:45
@igerber
igerber force-pushed the dependabot/pip/python-minor-patch-7eae64c20d branch from 9cc31f1 to 2647ab8 Compare July 18, 2026 19:30
@github-actions

github-actions Bot commented Jul 18, 2026

Copy link
Copy Markdown

🔁 AI review rerun (requested by @igerber)

Head SHA: 2647ab8024031ef11154efb6066568efefd4bad2

PR Review Report

Overall Assessment

✅ Looks good — no unmitigated P0/P1 findings.

Executive Summary

  • This PR only changes dev tooling pins, CI workflow configuration, and changelog text.
  • No estimators, weighting, variance/SE logic, inference fields, or identification assumptions are modified.
  • pyproject.toml and .github/workflows/lint.yml are correctly synchronized for black==26.5.1, ruff==0.15.21, and mypy==2.3.0.
  • The Python 3.9 runtime floor remains declared and now has a dedicated Linux CI leg in rust-test.yml.
  • One minor documentation drift remains in TODO.md, which still references the old mypy pin.

Methodology

No findings.

Severity: P3
Impact: No affected causal inference method. The PR does not touch estimator code, math, weighting, variance/SE, defaults, or assumptions. The Methodology Registry does not require any paper cross-check for these dependency/config-only changes.
Concrete fix: None required.

Code Quality

No findings.

Severity: P3
Impact: The changed configuration is internally consistent. The lint workflow pins match the dev extra at pyproject.toml:L67-L69 and .github/workflows/lint.yml:L42-L63.
Concrete fix: None required.

Performance

No findings.

Severity: P3
Impact: Tooling bumps may affect CI runtime slightly, but no library runtime path or algorithm is changed.
Concrete fix: None required.

Maintainability

No findings.

Severity: P3
Impact: The PR documents the mypy target change in pyproject.toml:L153-L157 and adds a compensating Python 3.9 runtime leg in .github/workflows/rust-test.yml:L124-L132.
Concrete fix: None required.

Tech Debt

No findings.

Severity: P3
Impact: Existing mypy suppression cleanup remains tracked in TODO.md; this PR does not add untracked correctness debt.
Concrete fix: None required.

Security

No findings.

Severity: P3
Impact: No new secret handling, permissions expansion, or PR-head code execution path is introduced.
Concrete fix: None required.

Documentation/Tests

Finding: Stale TODO mypy pin reference.

Severity: P3
Impact: TODO.md:L246-L248 still says lint CI is pinned to mypy==2.1.0, while this PR updates the active pin to mypy==2.3.0 in pyproject.toml:L67-L69 and .github/workflows/lint.yml:L62-L63. This is documentation drift only; it does not affect CI behavior or statistical correctness.
Concrete fix: Update TODO.md:L247 to reference mypy==2.3.0, and optionally mention that [tool.mypy] python_version now targets "3.10" while Python 3.9 is covered by runtime CI.

@igerber
igerber force-pushed the dependabot/pip/python-minor-patch-7eae64c20d branch from 2647ab8 to e0c079c Compare July 18, 2026 19:33
@github-actions

github-actions Bot commented Jul 18, 2026

Copy link
Copy Markdown

🔁 AI review rerun (requested by @igerber)

Head SHA: e0c079ca8c8849f3419cdbdbf1f506b58eef2e29

PR Review Report

Overall Assessment

✅ Looks good — no unmitigated P0/P1 findings.

Executive Summary

  • Re-review confirms the prior stale TODO.md mypy-pin finding is resolved at TODO.md:L246-L250.
  • The PR only changes dev tooling pins, CI workflow coverage, and changelog/TODO documentation.
  • No estimator code, weighting, variance/SE logic, inference defaults, or identification assumptions are changed.
  • pyproject.toml and .github/workflows/lint.yml remain synchronized for black==26.5.1, ruff==0.15.21, and mypy==2.3.0.
  • The Python 3.9 library floor is documented as runtime-guarded and has a dedicated Linux CI leg in .github/workflows/rust-test.yml:L124-L132.

Methodology

No findings.

Severity: P3
Impact: No causal inference method is affected. The changed files do not modify estimators, math, assumptions, weighting, inference, or result-field semantics. The Methodology Registry remains applicable as background only; no paper cross-check is triggered by these dependency/config changes. See docs/methodology/REGISTRY.md:L1-L5.
Concrete fix: None required.

Code Quality

No findings.

Severity: P3
Impact: Tool pins are internally consistent between the dev extra and lint workflow: pyproject.toml:L67-L69 matches .github/workflows/lint.yml:L41-L63.
Concrete fix: None required.

Performance

No findings.

Severity: P3
Impact: The added Python 3.9 Linux runtime leg may increase gated CI time slightly, but no library runtime path or algorithm is changed.
Concrete fix: None required.

Maintainability

No findings.

Severity: P3
Impact: The mypy target-version rationale is documented near the config at pyproject.toml:L152-L157, and the corresponding runtime floor guard is added at .github/workflows/rust-test.yml:L124-L132.
Concrete fix: None required.

Tech Debt

No findings.

Severity: P3
Impact: Existing mypy suppression cleanup remains tracked in TODO.md:L246-L258; this PR does not add untracked correctness debt.
Concrete fix: None required.

Security

No findings.

Severity: P3
Impact: No new secret handling, permission expansion, dependency execution surface in PR-controlled code, or workflow trust boundary change is introduced.
Concrete fix: None required.

Documentation/Tests

No findings.

Severity: P3
Impact: The previous documentation drift is fixed: TODO.md:L246-L250 now references mypy==2.3.0, documents the "3.10" mypy target, and points to the Python 3.9 runtime matrix coverage. CHANGELOG.md:L8-L16 also records the tooling bump and CI floor-guard change.
Concrete fix: None required.

@igerber igerber added ready-for-ci Triggers CI test workflows and removed ready-for-ci Triggers CI test workflows labels Jul 18, 2026
dependabot Bot and others added 2 commits July 19, 2026 05:39
@dependabot @igerber
chore(deps-dev): bump the python-minor-patch group with 3 updates
6a6efc0 
Bumps the python-minor-patch group with 3 updates: [black](https://github.com/psf/black), [ruff](https://github.com/astral-sh/ruff) and [mypy](https://github.com/python/mypy).


Updates `black` from 26.3.1 to 26.5.1
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.3.1...26.5.1)

Updates `ruff` from 0.15.13 to 0.15.21
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.13...0.15.21)

Updates `mypy` from 2.1.0 to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.1.0...v2.3.0)

---
updated-dependencies:
- dependency-name: black
  dependency-version: 26.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.15.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@igerber @claude
chore(ci): sync lint.yml pins with dev-tool bump; mypy 3.10 target + …
06c0437 
…py3.9 test leg

Companion to the Dependabot bump (black 26.5.1 / ruff 0.15.21 / mypy 2.3.0):

- lint.yml: sync the pinned installs with pyproject's dev extra
  (TestLintWorkflowPinSync contract - the two surfaces move together).
- pyproject [tool.mypy]: python_version 3.9 -> 3.10. mypy >= 2.2 rejects
  a 3.9 target, so static checking can no longer guard the library floor.
- rust-test.yml: add a single Python 3.9 Linux leg to the gated test
  matrix as the compensating runtime floor guard.
- CHANGELOG: Unreleased entry for the pin bump.

Verified locally with the exact Lint Gate commands: ruff clean, black
clean (229 files unchanged), mypy zero errors under the 3.10 target.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kt38RMkkZkNXKxi4G3QJ83
@igerber
igerber force-pushed the dependabot/pip/python-minor-patch-7eae64c20d branch from e0c079c to 06c0437 Compare July 19, 2026 09:40
@github-actions

github-actions Bot commented Jul 19, 2026

Copy link
Copy Markdown

🔁 AI review rerun (requested by @igerber)

Head SHA: 06c04379484442745be6a66bb73fb92abcabac18

PR Review Report

Overall Assessment

✅ Looks good — no unmitigated P0/P1 findings.

Executive Summary

  • The prior stale TODO.md mypy-pin finding is resolved.
  • Changes are limited to development tooling, CI, and documentation.
  • No estimator, inference, weighting, variance, or identification logic changes.
  • Tool pins are synchronized, and the Python 3.9 matrix leg runs the full runtime suite.
  • YAML/TOML configuration validation passed.

Methodology

No findings.

  • Severity: P3 — informational
  • Impact: No causal inference method is affected; methodology cross-checking is not triggered.
  • Concrete fix: None required.

Code Quality

No findings.

  • Severity: P3 — informational
  • Impact: Pins match across pyproject.toml:L67-L69 and .github/workflows/lint.yml:L42-L63.
  • Concrete fix: None required.

Performance

No findings.

  • Severity: P3 — informational
  • Impact: The additional Python 3.9 leg increases CI usage slightly but does not affect library runtime performance.
  • Concrete fix: None required.

Maintainability

No findings.

  • Severity: P3 — informational
  • Impact: The mypy target rationale and compensating runtime coverage are clearly documented at pyproject.toml:L152-L157 and .github/workflows/rust-test.yml:L127-L132.
  • Concrete fix: None required.

Tech Debt

No findings.

  • Severity: P3 — informational
  • Impact: Existing mypy suppressions remain tracked in TODO.md; no new untracked debt is introduced.
  • Concrete fix: None required.

Security

No findings.

  • Severity: P3 — informational
  • Impact: No secrets, elevated permissions, mutable action references, or workflow trust-boundary changes were introduced.
  • Concrete fix: None required.

Documentation/Tests

No findings.

  • Severity: P3 — informational
  • Impact: The prior documentation drift is fixed at TODO.md:L245-L250. The new Python 3.9 job builds and installs the wheel and runs the full non-documentation suite at .github/workflows/rust-test.yml:L127-L220.
  • Concrete fix: None required.

@igerber igerber added the ready-for-ci Triggers CI test workflows label Jul 19, 2026
@igerber
igerber merged commit e1ee90b into main Jul 19, 2026
45 of 46 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/python-minor-patch-7eae64c20d branch July 19, 2026 11:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@igerber igerber igerber approved these changes

Assignees

No one assigned

Labels

ready-for-ci Triggers CI test workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@igerber