Bump the python group across 1 directory with 3 updates

[dependabot]

Bumps the python group with 3 updates in the / directory: ruff, ty and openapi-python-client.

Updates ruff from 0.16.5 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits

• 62914c4 Bump version to 0.16.8 (#28648)
• c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
• ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
• 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
• 50020fb [ty] Avoid storing constraint nodes twice (#28375)
• 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
• 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
• d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
• fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
• 31131db [ty] Support type[A & B] (#27124)
• Additional commits viewable in compare view

Updates ty from 0.0.75 to 0.0.82

Release notes

Sourced from ty's releases.

0.0.82

Release Notes

Released on 2026-09-17.

Preview features

• Ignore Python version from uv metadata (#28646)
• Watch script dependencies in CLI watch mode (#28125)

CLI

• Only skip uv workspace metadata for a single script (#28581)
• Support dependency lints with --config-file (#28573)

LSP server

• Filter string literal completions by typed text (#28612)
• Find member references across files (#28669)
• Find parameter references across files (#28670)
• Preserve valid LSP settings when configuration resolution fails (#28653)
• Reuse identifier matcher in LSP operations (#28663)
• Watch script dependencies in the language server (#28522)

Diagnostic improvements

• Add an autofix for unused awaitables (#28668)
• Add annotations for unreachable code caused by boolean operands (#28521)
• Add subdiagnostics to redundant-condition rules warning about reachability implications (#28263)
• Clarify diagnostics for unimplemented abstract members (#28538)
• Extend unreachable-code annotations to while, assert, and match statements (#28290)

Core type checking

• Allow experimental intersection syntax in PEP 695 aliases (#28513)
• Bound aliased intersection expansion during inference (#28546)
• Check declared variance against final method bindings (#28155)
• Fix recursive protocol checks for decorated methods (#28293)
• Freshen constructor-owned Self with class type variables (#28592)
• Improve disjointness of functools.partial types (#28660)
• Include constraint-set assignability in more checks (#28642)
• Infer conditional literals from peers in unspecialized contexts (#28633)
• Infer generic elements from gradual tuples (#28637)
• Introduce Recursive types and fully support recursive implicit type aliases (#28425)
• Narrow type context during tuple inference (#28658)
• Preserve field metadata after overload resolution (#28635)
• Preserve gradual class assignability in constraint-set checks (#28638)
• Preserve gradual tuple lengths during callable inference (#28588)
• Preserve tuple shapes during concatenation (#28617)
• Reject abstract class instantiation (#28167)

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.82

Released on 2026-09-17.

Preview features

• Ignore Python version from uv metadata (#28646)
• Watch script dependencies in CLI watch mode (#28125)

CLI

• Only skip uv workspace metadata for a single script (#28581)
• Support dependency lints with --config-file (#28573)

LSP server

• Filter string literal completions by typed text (#28612)
• Find member references across files (#28669)
• Find parameter references across files (#28670)
• Preserve valid LSP settings when configuration resolution fails (#28653)
• Reuse identifier matcher in LSP operations (#28663)
• Watch script dependencies in the language server (#28522)

Diagnostic improvements

• Add an autofix for unused awaitables (#28668)
• Add annotations for unreachable code caused by boolean operands (#28521)
• Add subdiagnostics to redundant-condition rules warning about reachability implications (#28263)
• Clarify diagnostics for unimplemented abstract members (#28538)
• Extend unreachable-code annotations to while, assert, and match statements (#28290)

Core type checking

• Allow experimental intersection syntax in PEP 695 aliases (#28513)
• Bound aliased intersection expansion during inference (#28546)
• Check declared variance against final method bindings (#28155)
• Fix recursive protocol checks for decorated methods (#28293)
• Freshen constructor-owned Self with class type variables (#28592)
• Improve disjointness of functools.partial types (#28660)
• Include constraint-set assignability in more checks (#28642)
• Infer conditional literals from peers in unspecialized contexts (#28633)
• Infer generic elements from gradual tuples (#28637)
• Introduce Recursive types and fully support recursive implicit type aliases (#28425)
• Narrow type context during tuple inference (#28658)
• Preserve field metadata after overload resolution (#28635)
• Preserve gradual class assignability in constraint-set checks (#28638)
• Preserve gradual tuple lengths during callable inference (#28588)
• Preserve tuple shapes during concatenation (#28617)
• Reject abstract class instantiation (#28167)
• Respect frozen=False overrides on Pydantic subclasses (#28515)

... (truncated)

Commits

• 6999edb Bump version to 0.0.82 (#4547)
• 69ee79c Update prek dependencies (#4534)
• 9bbaccc Remove accidental uv version constraint (#4537)
• edb7fab Update astral-sh/setup-uv action to v10.1.0 (#4535)
• bc531b1 Update dependency prek to v0.4.14 (#4533)
• 66d7e3f renovate: track uv versions/checksums with setup-uv (#4532)
• 4edd772 Bump version to 0.0.81 (#4528)
• 8cfdd79 Use paid GitHub-hosted runners for Linux (#4502)
• 7fd8e15 Bump version to 0.0.80 (#4501)
• c163f21 Update dependency prek to v0.4.12 (#4494)
• Additional commits viewable in compare view

Updates openapi-python-client from 0.29.0 to 0.29.1

Release notes

Sourced from openapi-python-client's releases.

0.29.1 (2026-08-30)

🚨Security

Arbitrary code generation vulnerability

Prior to this release, malicious OpenAPI documents could cause openapi-python-client to generate arbitrary code, which would then be executed by consumers of the generated client.

If you generate code from OpenAPI documents you don't control, you should upgrade to this release as soon as possible and validate any previously-generated code.

See the GitHub advisory for more details.

🚀 Features

• Update uv_build to 0.12 when using --meta=uv (#1473)

🐛 Fixes

• Apply PEP 639 for improved license metadata (#1459)
• update generated code to use StrEnum and -> Self (#1474)
• Remove trailing spaces in README example code (#1475)
• Stopped generating empty docstrings for models with no description

Fixed invalid Python identifiers when resolving naming conflicts

When two property or parameter names conflicted after conversion to snake_case (e.g. foo-bar and fooBar), the conflict-resolution path preserved delimiters like -, ., and spaces in the generated Python identifiers, producing invalid code which failed generation. Conflicting names now keep their original casing but have any characters which are invalid in Python identifiers stripped (e.g. foobar and fooBar).

Improve readability of error messages

Errors and warnings which include a snippet of your OpenAPI document now render that snippet as JSON, making them much easier to read.

📝Notes

Breaking changes for all custom templates

ALL custom templates are expected to break with this version as a result of the security fix.

1. The utils global has been renamed to strings
2. Most string values can no longer be rendered directly into templates, you must describe how the value is being used so it can be properly escaped using either a Python function or Jinja filter:
   1. strings.snake_case() / | snakecase (existing)
   2. strings.kebab_case() / | kebabcase (existing)
   3. strings.pascal_case() / | pascalcase (existing)
   4. python_identifier() (existing)
   5. class_name() (existing)
   6. strings.safe_for_docstring() / | safe_for_docstring for values which get injected into a """ docstring
   7. strings.in_f_string_literal() / | in_f_string_literal for values that go into f"" f-strings
   8. strings.in_double_quote_literal() / | in_double_quote_literal for values that go into non-f-string "" literals
   9. .as_unembedded_code() / | as_unembedded_code ONLY for PythonCode values—those that are intended to be Python code which is not embedded into any string/docstring. Examples include usages of .python_code, .get_type_string(), .get_instance_type_string(), .get_type_strings_in_union(). You should not assume these values are safe to put in docstrings, string literals, or f-string literals. Use the dedicated helpers for those.

... (truncated)

Changelog

Sourced from openapi-python-client's changelog.

0.29.1 (2026-08-30)

🚨Security

Arbitrary code generation vulnerability

Prior to this release, malicious OpenAPI documents could cause openapi-python-client to generate arbitrary code, which would then be executed by consumers of the generated client.

If you generate code from OpenAPI documents you don't control, you should upgrade to this release as soon as possible and validate any previously-generated code.

See the GitHub advisory for more details.

🚀 Features

• Update uv_build to 0.12 when using --meta=uv (#1473)

🐛 Fixes

• Apply PEP 639 for improved license metadata (#1459)
• update generated code to use StrEnum and -> Self (#1474)
• Remove trailing spaces in README example code (#1475)
• Stopped generating empty docstrings for models with no description

Fixed invalid Python identifiers when resolving naming conflicts

When two property or parameter names conflicted after conversion to snake_case (e.g. foo-bar and fooBar), the conflict-resolution path preserved delimiters like -, ., and spaces in the generated Python identifiers, producing invalid code which failed generation. Conflicting names now keep their original casing but have any characters which are invalid in Python identifiers stripped (e.g. foobar and fooBar).

Improve readability of error messages

Errors and warnings which include a snippet of your OpenAPI document now render that snippet as JSON, making them much easier to read.

📝Notes

Breaking changes for all custom templates

ALL custom templates are expected to break with this version as a result of the security fix.

1. The utils global has been renamed to strings
2. Most string values can no longer be rendered directly into templates, you must describe how the value is being used so it can be properly escaped using either a Python function or Jinja filter:
   1. strings.snake_case() / | snakecase (existing)
   2. strings.kebab_case() / | kebabcase (existing)
   3. strings.pascal_case() / | pascalcase (existing)
   4. python_identifier() (existing)
   5. class_name() (existing)
   6. strings.safe_for_docstring() / | safe_for_docstring for values which get injected into a """ docstring
   7. strings.in_f_string_literal() / | in_f_string_literal for values that go into f"" f-strings
   8. strings.in_double_quote_literal() / | in_double_quote_literal for values that go into non-f-string "" literals

... (truncated)

Commits

• 4a2f3db Release 0.29.1 (#1460)
• 1c99af4 Comprehensive string handling rewrite (#1483)
• ee9a8c4 chore(deps): update pypa/gh-action-pypi-publish action to v1.14.2 (#1476)
• edaae66 fix: Remove trailing spaces in README example code (#1475)
• 2216c15 feat: Update uv_build to 0.12 when using --meta=uv (#1473)
• 2aae596 fix: update generated code to use StrEnum and -> Self (#1474)
• 468cfda chore(deps): update actions/checkout action to v7.0.1 (#1470)
• 852116c chore(deps): pin dependencies (#1467)
• d5c5367 chore(deps): update actions/cache action to v6.1.0 (#1468)
• 0414726 Update Renovate configuration
• Additional commits viewable in compare view