Skip to content

MAINT: Adopt ty 0.0.73 - #2434

Open
Roman Lutz (romanlutz) wants to merge 10 commits into
microsoft:mainfrom
romanlutz:romanlutz-adopt-current-ty
Open

MAINT: Adopt ty 0.0.73#2434
Roman Lutz (romanlutz) wants to merge 10 commits into
microsoft:mainfrom
romanlutz:romanlutz-adopt-current-ty

Conversation

@romanlutz

Copy link
Copy Markdown
Contributor

Why

PR #2424 temporarily capped ty below 0.0.70 because newer releases enable unsound-return-statement under PyRIT's strict all = "error" configuration. Now that #2424 is merged, this follow-up removes that cap and adopts the current ty release without weakening type-checking rules.

What changed

  • Resolve ty 0.0.73 while preserving the ty>=0.0.32 lower bound.
  • Fix newly enforced return-type diagnostics across production code using typed intermediates and explicit boundary validation rather than ignores or broad casts.
  • Keep valid runtime paths unchanged while making malformed dynamic values fail at their documented boundaries.
  • Update scenario test doubles to satisfy the existing PromptTarget contract.

Validation

  • uv run --extra all --link-mode=copy ty check pyrit
  • uv run pre-commit run --all-files
  • Focused regression suites: 484 tests passed
  • Additional component suites: memory 624 passed, GCG 205 passed, targets 386 passed, miscellaneous 649 passed

dependabot Bot and others added 7 commits August 19, 2026 12:59
Bumps the minor-and-patch group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [azure-keyvault-secrets](https://github.com/Azure/azure-sdk-for-python) | `4.11.0` | `4.11.1` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.15.0` | `6.16.1` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.51` | `2.0.52` |
| [transformers](https://github.com/huggingface/transformers) | `5.14.1` | `5.15.0` |
| [pyarrow](https://github.com/apache/arrow) | `25.0.0` | `25.0.1` |
| [litellm](https://github.com/BerriAI/litellm) | `1.91.5` | `1.97.0` |
| [ty](https://github.com/astral-sh/ty) | `0.0.69` | `0.0.72` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.1` | `4.6.2` |
| [pytest-rerunfailures](https://github.com/pytest-dev/pytest-rerunfailures) | `16.4` | `16.5` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.2` | `0.16.3` |


Updates `azure-keyvault-secrets` from 4.11.0 to 4.11.1
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-keyvault-secrets_4.11.0...azure-keyvault-secrets_4.11.1)

Updates `pypdf` from 6.15.0 to 6.16.1
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.15.0...6.16.1)

Updates `sqlalchemy` from 2.0.51 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `transformers` from 5.14.1 to 5.15.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.14.1...v5.15.0)

Updates `pyarrow` from 25.0.0 to 25.0.1
- [Release notes](https://github.com/apache/arrow/releases)
- [Commits](apache/arrow@apache-arrow-25.0.0...apache-arrow-25.0.1)

Updates `litellm` from 1.91.5 to 1.97.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.91.5...v1.97.0)

Updates `ty` from 0.0.69 to 0.0.72
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.69...0.0.72)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `pytest-rerunfailures` from 16.4 to 16.5
- [Changelog](https://github.com/pytest-dev/pytest-rerunfailures/blob/master/CHANGES.rst)
- [Commits](pytest-dev/pytest-rerunfailures@16.4...16.5)

Updates `ruff` from 0.16.2 to 0.16.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.2...0.16.3)

---
updated-dependencies:
- dependency-name: azure-keyvault-secrets
  dependency-version: 4.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pypdf
  dependency-version: 6.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sqlalchemy
  dependency-version: 2.0.52
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: transformers
  dependency-version: 5.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pyarrow
  dependency-version: 25.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: litellm
  dependency-version: 1.97.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ty
  dependency-version: 0.0.72
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pytest-rerunfailures
  dependency-version: '16.5'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Preserve the universal wheel required by the supported platforms while retaining the other dependency updates.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Avoid enabling the new unsound-return-statement rule until the existing typing findings can be addressed separately.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove the temporary ty upper bound and make dynamically typed return boundaries sound under ty's strict configuration.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Keep the ty 0.0.73 manifest and lock changes after integrating the merged dependency PR.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
raise TypeError("Conversation scorer identifier must be a ComponentIdentifier")
return identifier

conversation_scorer = DynamicConversationScorer()

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Diff coverage looks like it's landing short - the new isinstance/raise guards are the uncovered lines. For the ones that can't fire, would assert isinstance(...) work?

@varunj-msft varunj-msft self-assigned this Aug 20, 2026
Copilot AI added 3 commits August 20, 2026 07:38
Adds unit tests exercising the new isinstance/type-narrowing guard
clauses introduced for ty 0.0.73 compatibility, which the diff-cover
CI check flagged as uncovered branches:

- pyrit_scan.py: TypeError guards for non-string server URLs
- openai_error_handling.py: non-dict JSON body fallback branch
- tree_of_attacks.py: TAPAttackScoringConfig.threshold re-validation
- atomic_attack.py: non-AttackResult item from executor raises ValueError
- attack_technique_factory.py: typing.Union/Optional unwrap branch and
  non-AttackScoringConfig-subclass narrowing branch
- scenario.py: TypeError guards for non-PromptTarget default/resolved
  objective_target values, plus the valid-default happy path
- conversation_scorer.py: wrapped-scorer and identifier re-validation
  guards on the dynamically created DynamicConversationScorer

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Merging origin/main brought in pyrit_scan.py's subcommand-based CLI
rework, which introduces two return statements ty 0.0.73 now flags as
unsound:

- _discover_verbs(): the empty-set fallback `frozenset()` is inferred
  as `frozenset[Unknown]`, not a subtype of the declared
  `frozenset[str]` return type. Parameterize the empty literal
  explicitly as `frozenset[str]()`.
- _dispatch_with_client_async(): the handler table is typed
  `dict[str, Callable[..., Any]]`, so the dispatched handler's return
  value is `Any` and isn't a sound `int`. Add an isinstance guard
  (matching this PR's existing pattern for narrowing dynamically-typed
  values) before returning.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants