build(deps-dev): bump the python group in /python with 4 updates

[dependabot]

Updates the requirements on hypothesis, ruff, ty and uv-build to permit the latest version.
Updates hypothesis from 6.168.5 to 6.170.0

Commits

• 7572cd0 Bump hypothesis version to 6.170.0 and update changelog
• 1ad039f Merge pull request #4871 from Zac-HD/claude/hypothesis-conformance-tests-c6877l
• a03eb1b Merge pull request #4895 from TaiSakuma/add-hypothesis-awkward
• 7219a20 Strengthen provider conformance tests and fix BytestringProvider
• e7c0eb9 Bump hypothesis version to 6.169.4 and update changelog
• c3705d2 Merge pull request #4898 from Arjun-Aravind/fix/unresolved-lazy-annotations
• 6ec54d5 Bump hypothesis version to 6.169.3 and update changelog
• 37c6420 Merge pull request #4903 from MarcoGorelli/random-seed-signature
• 18ad441 Bump hypothesis version to 6.169.2 and update changelog
• 29a1dc0 Merge pull request #4883 from deepak7lal/fix/ghostwriter-no-arguments
• Additional commits viewable in compare view

Updates ruff from 0.16.10 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates ty from 0.0.85 to 0.0.88

Release notes

Sourced from ty's releases.

0.0.88

Release Notes

Released on 2026-10-15.

Bug fixes

• Avoid panics and hangs involving recursive type aliases and intersections (#29057)
• Fix false invalid-mutable-override errors when overriding object attributes (#29373)
• Fix attribute assignment and deletion checks through bounded or constrained type variables (#29345)
• Detect instance layout conflicts hidden by additional base classes (#29372)
• Fix false missing-argument errors when Pydantic models override inherited attributes with ClassVar (#29367)
• Preserve known module owners when uv reports owners outside the resolution (#29296)

Diagnostic improvements

• Report assignments to individually frozen Pydantic fields (#29305)

Core type checking

• Improve type inference for intersection arguments to generic functions (#28677)
• Preserve inherited annotations for unannotated subclass attributes when a base has type Any or Unknown (#28973)
• Preserve common return-type structure when gradual arguments match multiple overloads (#29342)
• Check upper bounds when inferring type variables from caller type variables (#29014)

Contributors

• @​zaniebot
• @​charliermarsh
• @​zhouzaida
• @​seunghyun-24
• @​zsol
• @​RasmusNygren
• @​carljm

Install ty 0.0.88

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.88/ty-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ty/releases/download/0.0.88/ty-installer.ps1 | iex"

Download ty 0.0.88

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.88

Released on 2026-10-15.

Bug fixes

• Avoid panics and hangs involving recursive type aliases and intersections (#29057)
• Fix false invalid-mutable-override errors when overriding object attributes (#29373)
• Fix attribute assignment and deletion checks through bounded or constrained type variables (#29345)
• Detect instance layout conflicts hidden by additional base classes (#29372)
• Fix false missing-argument errors when Pydantic models override inherited attributes with ClassVar (#29367)
• Preserve known module owners when uv reports owners outside the resolution (#29296)

Diagnostic improvements

• Report assignments to individually frozen Pydantic fields (#29305)

Core type checking

• Improve type inference for intersection arguments to generic functions (#28677)
• Preserve inherited annotations for unannotated subclass attributes when a base has type Any or Unknown (#28973)
• Preserve common return-type structure when gradual arguments match multiple overloads (#29342)
• Check upper bounds when inferring type variables from caller type variables (#29014)

Contributors

• @​zaniebot
• @​charliermarsh
• @​zhouzaida
• @​seunghyun-24
• @​zsol
• @​RasmusNygren
• @​carljm

0.0.87

Released on 2026-10-13.

LSP server

• Clamp notebook cell positions to the end of the cell (#29307)
• Fix deadlock when requests arrive before workspace configuration (#29303)
• Fix notebook cell lookups after cells with cell magics (#29308)
• Fix panic on completions past the end of a notebook's last cell (#29306)

Diagnostic improvements

• Add opt-in mismatched-sentinel-name rule (#27206)
• Deduplicate identical argument type diagnostics (#29337)
• Enable invalid-mutable-override by default (#29335)

... (truncated)

Commits

• 64e7f18 Bump version to 0.0.88 (#4732)
• 88c50d5 Budget the daily fuzz run based on setup time (#4706)
• ec60e71 Document and lint the manually maintained release workflow (#4320)
• dbc632a Update dependency prek to v0.5.3 (#4719)
• 7aa0f34 Update astral-sh/setup-uv action to v10.3.0 (#4720)
• 2eefac0 Update prek dependencies (#4722)
• ea4c3d2 Bump version to 0.0.87 (#4718)
• 1e7a76d Require hashes for build dependencies (#4714)
• 1179aeb Use thin LTO for PGO training (#4704)
• d5da069 Authenticate Docker Hub pulls (#4702)
• Additional commits viewable in compare view

Updates uv-build to 0.13.1

Release notes

Sourced from uv-build's releases.

0.13.1

Release Notes

Released on 2026-10-14.

Enhancements

• Ignore Requires-Python upper bounds in uv pip check and uv pip install --strict, consistent with resolution (#22500)
• Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable (#22463)
• Report missing trusted hashes in resolution errors (#22241)

Python

• Add CPython 3.16.0a1 (#22527)

Preview features

• Allow uv tool upgrade to upgrade installed tools when tool-install-locks is enabled (#22498)
• Add preliminary support for parsing PEP 825 variant labels in wheel filenames with wheel-variants (#22039)

Performance

• Reduce uv's binary size (#22429, #22430, #22432)
• Speed up Simple API parsing (#22429)
• Reduce package metadata parsing overhead (#22239)

Bug fixes

• Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories (#22495)
• Restore support for source distributions containing hard links or full-length tar user or group names (#22516, #22522)
• Preserve device files and FIFOs used as uv pip compile or uv export output destinations (#22496)
• Fix sys._base_executable detection for environments created from symlinked interpreters (#22520)
• Prevent concurrent readers from observing partially written lockfiles, Python version files, or managed Python sysconfig files (#22399, #22402, #22403)
• Serialize concurrent project commands that reach the same environment through real and symlinked paths (#22390)
• Prevent installs, syncs, and environment creation from failing when they race with uv cache clean (#22387)
• Prevent concurrent tool installations from corrupting an environment when the last tool is uninstalled (#22391)
• Persist changed upgrade settings even when uv tool upgrade leaves the tool version unchanged (#22499)
• Reuse environments with installed Git dependencies pinned to full commit hashes without resolving again (#22464)

Documentation

• Explain how to select an emulated Python interpreter on Windows ARM64 when native wheels are unavailable (#22424)
• Fix the .netrc format documentation link (#22514)

Other changes

• Publish Python 3.15-based uv Docker images under stable tags (#22503)

Install uv 0.13.1

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.13.1

Released on 2026-10-14.

Enhancements

• Ignore Requires-Python upper bounds in uv pip check and uv pip install --strict, consistent with resolution (#22500)
• Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable (#22463)
• Report missing trusted hashes in resolution errors (#22241)

Python

• Add CPython 3.16.0a1 (#22527)

Preview features

• Allow uv tool upgrade to upgrade installed tools when tool-install-locks is enabled (#22498)
• Add preliminary support for parsing PEP 825 variant labels in wheel filenames with wheel-variants (#22039)

Performance

• Reduce uv's binary size (#22429, #22430, #22432)
• Speed up Simple API parsing (#22429)
• Reduce package metadata parsing overhead (#22239)

Bug fixes

• Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories (#22495)
• Restore support for source distributions containing hard links or full-length tar user or group names (#22516, #22522)
• Preserve device files and FIFOs used as uv pip compile or uv export output destinations (#22496)
• Fix sys._base_executable detection for environments created from symlinked interpreters (#22520)
• Prevent concurrent readers from observing partially written lockfiles, Python version files, or managed Python sysconfig files (#22399, #22402, #22403)
• Serialize concurrent project commands that reach the same environment through real and symlinked paths (#22390)
• Prevent installs, syncs, and environment creation from failing when they race with uv cache clean (#22387)
• Prevent concurrent tool installations from corrupting an environment when the last tool is uninstalled (#22391)
• Persist changed upgrade settings even when uv tool upgrade leaves the tool version unchanged (#22499)
• Reuse environments with installed Git dependencies pinned to full commit hashes without resolving again (#22464)

Documentation

• Explain how to select an emulated Python interpreter on Windows ARM64 when native wheels are unavailable (#22424)
• Fix the .netrc format documentation link (#22514)

Other changes

• Publish Python 3.15-based uv Docker images under stable tags (#22503)

0.13.0

Released on 2026-10-09.

... (truncated)

Commits

• 62faed3 Bump version to 0.13.1 (#22525)
• 01bfd22 Sync latest Python releases (#22527)
• 07ab80e Avoid linking the Zstandard ZIP encoder (#22432)
• 66cea0c Keep large Debug formatters out of line (#22430)
• d7eb7ab Deserialize dependency overrides and Simple API fields directly (#22429)
• b757f15 Revert interpreter cache warming (#22520)
• c977e8e Support bot:automerge for promoted pull requests (#22523)
• 4f14d44 Require hashes for uv's build dependencies (#22517)
• 06bf2e8 Bump tar-codec to 0.0.15 (#22522)
• 6609cfd Use async I/O and atomic pkgconfig writes for managed Python setup (#22521)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

The group that created this PR has been removed from your configuration.