Bump the python-dev-dependencies group across 1 directory with 7 updates

[dependabot]

Updates the requirements on coverage, ruff, mypy, pyrefly, tox, tox-uv and uv-build to permit the latest version.
Updates coverage to 7.16.2

Release notes

Sourced from coverage's releases.

7.16.2

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

Changelog

Sourced from coverage's changelog.

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168_.

• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289_.

• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923_.

.. _issue 1923: coveragepy/coveragepy#1923 .. _issue 2168: coveragepy/coveragepy#2168 .. _issue 2289: coveragepy/coveragepy#2289

.. _changes_7-16-1:

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

• Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

• Fix: the Total row in the footer of the HTML report's index page was recomputed in JavaScript with rounding that could disagree with the total the server rendered in the heading, including showing 100% when coverage was not complete. The footer now clamps values the way the rest of the report does, and when nothing is filtered out it is shown exactly as the server rendered it, so the two can't disagree. That also keeps rows the report omits (--skip-covered drops fully covered files) in the total. Fixes issue 2256_.

.. _issue 1563: coveragepy/coveragepy#1563 .. _issue 2256: coveragepy/coveragepy#2256 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Version 7.16.0 — 2026-08-28

... (truncated)

Commits

• 5643ae7 docs: prep for 7.16.2
• a3e969f fix: dynamic_context for @​staticmethod and @​classmethod tests (issue 1923) (#...
• 8ad7236 fix: stop counting the try/else line when a with statement raises (#2301)
• c6dab1f fix(debug): debug output doesn't mis-handle odd line separators #2296
• 08fbc32 style: Protocols should use ... for method bodies
• bc7b0e3 refactor: positional-only args are better than pragmas
• 52afd6b Document parallel tox coverage data files (#2284)
• f653aae fix: loop completion arcs on Python 3.14 (#2281)
• cc1ced4 test: PyPy still compiles comprehensions as functions
• 85a9088 chore: make upgrade
• Additional commits viewable in compare view

Updates ruff to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

0.16.9

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)

... (truncated)

Commits

• 3265ed1 Bump version to 0.16.10 (#29055)
• e786964 Authorize shared PR security-review workflow to publish findings (#29052)
• a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
• b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
• 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
• 317e0a3 [ty] Bound nested callable signature display (#29049)
• 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
• 56180bc [ty] Specialize instance members once (#29043)
• aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
• 2d25346 [ty] Improve unresolved-import documentation (#29039)
• Additional commits viewable in compare view

Updates mypy to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

• You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
• Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
• Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

• 935ba8a Bump version to 2.4.0
• 334a678 Add link for PR 22066 in mypy 2.4 changelog (#22082)
• fe69660 Finalize mypy 2.4 changelog (#22080)
• 541fd87 Various mypy 2.4 changelog updates (#22077)
• b231182 Update native parser docs (#22078)
• 04fe42c Initial Changelog for Mypy 2.4 (#22071)
• 0617494 Quick fix for non UTF-8 encodings with new parser (#22066)
• b2f9b60 Bump librt to 0.16.0 (#22067)
• 9d798dc Sync typeshed (#22054)
• 0861bb6 Reduce max protocol stack size to 20 (#22053)
• Additional commits viewable in compare view

Updates pyrefly to 1.3.2

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.3.2

Release date: September 28, 2026

Pyrefly v1.3.2 is a patch release that fixes regressions in how Pyrefly infers the type of a variable after it is assigned a value of type Any.

---

🐛 Bug fixes

• #4846: Fixed several regressions from v1.3.0 in type inference after a variable is reassigned to Any:
  • Assigning an implicit Any (a value with no known type, such as the result of an unannotated function or an unresolved import) to an annotated variable once again produces Unknown. It no longer turns into an explicit Any.
  • When a variable annotated as Optional[T] or T | None is narrowed to None and then reassigned inside that branch, Pyrefly no longer adds the annotation's None back after the branch. For example, x: Any | None followed by if x is None: x = get_any() now gives Any instead of Any | None.
  • When a variable's annotation is a union that contains Any, assigning Any to it now narrows the variable to Any. For example, x: Any | None followed by x = x or get_any() now gives Any instead of Any | None, so later attribute access no longer reports a false missing-attribute error on None.

Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue here.

---

📦 Upgrade

pip install --upgrade pyrefly==1.3.2

How to safely upgrade your codebase

Upgrading the version of Pyrefly you're using or a third-party library you depend on can reveal new type errors in your code. Fixing them all at once is often unrealistic. We've written scripts to help you temporarily silence them. After upgrading, follow these steps:

1. pyrefly check --suppress-errors
2. Run your code formatter of choice
3. pyrefly check --remove-unused-ignores
4. Repeat until you achieve a clean formatting run and a clean type check.

This will add # pyrefly: ignore comments to your code, enabling you to silence errors and return to fix them later. This can make the process of upgrading a large codebase much more manageable.

Read more about error suppressions in the Pyrefly documentation.

Commits

• e46f4f2 cut 1.3.2
• a1020bf release notes for v1.3.2
• b4d1cd4 Allow assignment to Any when a name is annotated as Any | ...
• 03eff73 Merge AnnotationStyle::ForwardedInitial and Forwarded
• 1a0ac5f Keep a name's annotated type only when it is still active
• fc131f8 Allow an expression to overwrite a name's AnyStyle
• 4b261cd Move tests for assignment to Any to their own file
• 3e3177d cut 1.3.1
• 3445714 release notes for v1.3.1
• c1be891 fix pyrefly instantly dies with with thread panic #4909 (#4925)
• See full diff in compare view

Updates tox to 4.64.7

Release notes

Sourced from tox's releases.

v4.64.7

What's Changed

• fix(man): give each shell a working MANPATH line by @​Rodrigo-Palma in tox-dev/tox#4109

Full Changelog: tox-dev/tox@4.64.6...4.64.7

Changelog

Sourced from tox's changelog.

Bug fixes - 4.64.7

• tox man suggests ~/.profile instead of ~/.zshrc when the shell is not fish, bash, zsh, csh or tcsh, for example sh, ksh or an unset SHELL - by :user:Rodrigo-Palma.

  • tox picks the shell from the executable name, so /home/zshuser/bin/bash gets ~/.bashrc.
  • Outside fish, csh and tcsh, the reload hint reads . <file> instead of source <file>, since dash has no source.
  • The fish line keeps the default man path when MANPATH was unset, instead of hiding every other man page.
  • csh and tcsh get a setenv line for ~/.tcshrc or ~/.cshrc instead of an export line for ~/.profile. (:issue:4109)

---

v4.64.6 (2026-10-01)

---

Bug fixes - 4.64.6

• tox -e and TOXENV accept every interpreter name that picks a base_python for an environment the configuration does not declare - by :user:breken-ai.

  • cpython313, cpython-3.13, graalpy311, jython2.7, rustpython3 and ironpython3 select that interpreter instead of failing with "provided environments not found".
  • The d debug-build suffix works too, for example py313d.
  • cython313 now fails as an unknown environment; it used to run on the Python that tox runs under. (:issue:4106)

• A set_env block pulled in with {[section]set_env} now applies a PEP-508 marker only to the value it came with, as the inline and TOML forms already do - by :user:feiiiiii5. A false marker on an earlier line no longer hides a value that the inheriting environment, a later unconditional line or an environment file supplies. (:issue:4107)

• set_env values resolve when tox reads them, so {env:KEY} sees the keys a block pulls in with {[section]set_env}, and a { replace = "env" } table sees the keys next to it - by :user:gaborbernat, found by :user:breken-ai. Configurations that see a difference:

  • A value pulled in from another section that refers to a key of the same block now gets the block's value instead of the host variable.
  • A pulled-in line that refers to its own key, such as PYTHONHASHSEED = {env:PYTHONHASHSEED:0}, reads the host variable or its default, as the same line written in place does. It used to read the value tox sets.
  • A key written in an INI set_env wins over the same key pulled in from another section, and a later pulled-in section wins over an earlier one, at every nesting level. A nested section could override the section that included it before.
  • tox config shows the keys of every pulled-in section that tox run sets.
  • A section that pulls itself in, a TOML ref to itself, and values that refer to each other fail the environment with the cycle. They used to fail with a traceback or "could not find python interpreter", and values that referred to each other inside a pulled-in section read the host variables without a warning. (:issue:4108)

---

v4.64.5 (2026-09-29)

---

... (truncated)

Commits

• a45f1fa release 4.64.7
• 3e5db9e fix(man): give each shell a working MANPATH line (#4109)
• 03160bc release 4.64.6
• 8cbdb50 fix(config): resolve set_env values when read (#4108)
• b3e69e4 fix(env): accept every documented interpreter name with -e (#4106)
• 66ec58c fix(config): tie spliced set_env markers to their value (#4107)
• 24f433b release 4.64.5
• d254559 fix(config): fail on an invalid platform regex (#4104)
• 1845eed build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
• 2d2ef9f [pre-commit.ci] pre-commit autoupdate (#4101)
• Additional commits viewable in compare view

Updates tox-uv to 1.36.1

Commits

• 0cfb305 build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
• 64ca6b5 [pre-commit.ci] pre-commit autoupdate (#378)
• 8f4da88 build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
• 5f772db 🐛 fix(venv): honor VIRTUALENV_SYSTEM_SITE_PACKAGES for the system_site_packag...
• b1dddaf [pre-commit.ci] pre-commit autoupdate (#375)
• 915d957 [pre-commit.ci] pre-commit autoupdate (#374)
• 7aa6b73 [pre-commit.ci] pre-commit autoupdate (#373)
• 1fcf959 [pre-commit.ci] pre-commit autoupdate (#372)
• 7a9c42e [pre-commit.ci] pre-commit autoupdate (#371)
• b5c62e4 🔧 chore: batch dependency updates weekly on Tuesday (#370)
• Additional commits viewable in compare view

Updates uv-build to 0.12.22

Release notes

Sourced from uv-build's releases.

0.12.22

Release Notes

Released on 2026-10-01.

Python

• Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (#22147)

Enhancements

• Accept uppercase release suffixes in wheel platform tags (#22113)
• Record workspace-member default groups in lockfiles (#22010, #22103)
• Record workspace-member dependency-group Python requirements in lockfiles (#22044, #22103)
• Record default groups for non-project workspace roots in lockfiles (#22104)
• Record dependency-group Python requirements for non-project workspace roots in lockfiles (#22104)
• Format URLs and paths consistently in CLI messages (#21937)
• Hide the unsupported --offline option from uv publish help (#22124)

Preview features

• Honor --no-default-groups in uv audit (#22090)
• Report a clear error when uv audit or uv tool audit runs offline and hide the unsupported option from help (#22114)

Configuration

• Add UV_PYTHON_ARCH to select an interpreter architecture independently of its Python version (#22098)

Performance

• Reduce uv's binary size by compressing embedded Python download metadata (#22126)

Bug fixes

• Verify unchanged requirements against existing lockfile hashes when relocking (#22083)
• Honor dependency-group Python requirements at non-project workspace roots (#22101)
• Use each selected workspace member's recorded default groups during frozen sync (#22015)
• Avoid false entry-point warnings for required workspace members (#22112)

Other changes

• Raise the minimum supported Rust version for building uv to 1.97 and update the toolchain to Rust 1.99 (#22121)

Install uv 0.12.22

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.22/uv-installer.sh | sh

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.12.22

Released on 2026-10-01.

Python

• Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (#22147)

Enhancements

• Accept uppercase release suffixes in wheel platform tags (#22113)
• Record workspace-member default groups in lockfiles (#22010, #22103)
• Record workspace-member dependency-group Python requirements in lockfiles (#22044, #22103)
• Record default groups for non-project workspace roots in lockfiles (#22104)
• Record dependency-group Python requirements for non-project workspace roots in lockfiles (#22104)
• Format URLs and paths consistently in CLI messages (#21937)
• Hide the unsupported --offline option from uv publish help (#22124)

Preview features

• Honor --no-default-groups in uv audit (#22090)
• Report a clear error when uv audit or uv tool audit runs offline and hide the unsupported option from help (#22114)

Configuration

• Add UV_PYTHON_ARCH to select an interpreter architecture independently of its Python version (#22098)

Performance

• Reduce uv's binary size by compressing embedded Python download metadata (#22126)

Bug fixes

• Verify unchanged requirements against existing lockfile hashes when relocking (#22083)
• Honor dependency-group Python requirements at non-project workspace roots (#22101)
• Use each selected workspace member's recorded default groups during frozen sync (#22015)
• Avoid false entry-point warnings for required workspace members (#22112)

Other changes

• Raise the minimum supported Rust version for building uv to 1.97 and update the toolchain to Rust 1.99 (#22121)

0.12.21

Released on 2026-09-29.

Python

• Update CPython to use OpenSSL 3.5.9 (#22076)

... (truncated)

Commits

• 70fe119 Bump version to 0.12.22 (#22148)
• 7e9d252 Sync latest Python releases (#22147)
• d644be2 Compress embedded Python download metadata (#22126)
• 0a41ee3 Benchmark Python download catalog loading (#22125)
• cbf6106 Use Cargo warning policy for Clippy (#22122)
• 6077664 Update Rust to 1.99 and MSRV to 1.97 (#22121)
• 69025fd Hide the --offline flag in uv publish (#22124)
• 3f70ccf Defer cache format changes to 0.13 (#22128)
• e71ab8f Add UV_PYTHON_ARCH for requesting an interpreter architecture (#22098)
• d62a205 Hide the --offline flag for uv audit (#22114)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions