Update Python dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
buf-bin (changelog)	==1.71.0 → ==1.72.0
ruff	==0.15.21 → ==0.16.0
tombi	==1.2.0 → ==1.2.4
ty (changelog)	==0.0.59 → ==0.0.63

---

Release Notes

bufbuild/buf (buf-bin)

v1.72.0

Compare Source

• Fix buf beta registry webhook create and buf beta registry webhook list to emit proto JSON output.
• Fix HTTPS Basic authentication for remote inputs to use BUF_INPUT_HTTPS_USERNAME for the username.
• Fix IMPORT_USED lint rule silently reporting no unused imports when
  google/protobuf/descriptor.proto is in the transitive dependency graph.

tombi-toml/tombi (tombi)

v1.2.4

Compare Source

What's Changed

🛠️ Other Changes

• fix(date-time): accept leap second 60 in date-time values by @​LordAizen1 in #​2024

New Contributors

• @​LordAizen1 made their first contribution in #​2024

Full Changelog: tombi-toml/tombi@v1.2.3...v1.2.4

v1.2.3

Compare Source

What's Changed

🦅 New Features

• Allow comment directives to suppress schema resolution warnings by @​ya7010 in #​2023

🛠️ Other Changes

• ci: finalize illumos install checks by @​ya7010 in #​2021
• fix(ci): preserve winget release metadata by @​ya7010 in #​2022

Full Changelog: tombi-toml/tombi@v1.2.2...v1.2.3

v1.2.2

Compare Source

What's Changed

🐝 Bug Fixes

• ci: submit winget manifest leaf directory by @​ya7010 in #​2018

📦 Dependencies

• chore: update package lock files for SunOS package by @​ya7010 in #​2020

🛠️ Other Changes

• feat(dist): add x86_64-unknown-illumos binary distribution by @​sunshowers in #​2014
• refactor(dist): infer CLI-only illumos builds by @​ya7010 in #​2019

New Contributors

• @​sunshowers made their first contribution in #​2014

Full Changelog: tombi-toml/tombi@v1.2.1...v1.2.2

v1.2.1

Compare Source

What's Changed

In this release, we have updated the linter to issue a warning if it is unable to resolve elements such as $ref within a JSON Schema.

🐝 Bug Fixes

• Stabilize diagnostic collection names by @​ya7010 in #​2000
• fix(lint): avoid false unused deprecated directive by @​ya7010 in #​2001
• fix(vscode): make executable settings machine-scoped by @​ya7010 in #​2002
• fix(validator): report schema resolution errors by @​ya7010 in #​2010
• fix(glob): remove unused profile import by @​ya7010 in #​2011

📦 Dependencies

• chore: resolve OSV code scanning alerts by @​ya7010 in #​2004

🛠️ Other Changes

• docs: document deprecationMessage as non-standard support by @​ya7010 in #​2003
• ci: pin OSV scanner workflow to existing action ref by @​ya7010 in #​2005
• fix(validator): report not schema resolution errors by @​risu729 in #​2007
• feat(diagnostic): integrate tombi-diagnostic for error reporting in validator by @​ya7010 in #​2015
• Update error handling by @​ya7010 in #​2016
• chore: change schemastore diagnostics level by @​ya7010 in #​2017

New Contributors

• @​risu729 made their first contribution in #​2007

Full Changelog: tombi-toml/tombi@v1.2.0...v1.2.1

astral-sh/ty (ty)

v0.0.63

Compare Source

Released on 2026-07-23.

Core type checking

• Handle generic stringified PEP 613 (typing.TypeAlias) type aliases (#​27092)
• Allow equality narrowing across non-final classes (#​27031)
• Allow interpolated string literals to be promoted to str (#​27104)
• Fix double specialization of generic type aliases (#​27058)
• Fix intersections of type and TypeForm (#​27099)
• When narrowing from a match statement leads a variable x to be inferred as A & B, infer the type of x.attr as <type of A.attr> & <type of B.attr> (#​27103)

Library support

• Pydantic: Stricter validation of sub-model fields in lax mode (#​27091)
• Pydantic: Support special underscore parameters in BaseSettings models (#​27098)

Performance

• Avoid exponential narrowing of optional dynamic match subjects (#​27100)
• Avoid normalizing cached absolute file paths (#​26998)

Contributors

• @​sharkdp
• @​charliermarsh
• @​ibraheemdev
• @​carljm

v0.0.62

Compare Source

Released on 2026-07-21.

Bug fixes

• Guard recursive Protocol and TypedDict relations (#​26990)
• Prevent stack overflows in recursive type relation checks (#​26503)
• Recover from cancelled file indexing (#​26876)

Diagnostics

• Avoid editing ignore comments with trailing reasons (#​26939)
• Prefer innermost inline suppressions (#​26940)
• Remove unused own-line ignore comments (#​27013)
• Reuse applicable own-line suppressions in --add-ignore (#​26925)

Configuration

• Respect rules and analysis in PEP 723 script metadata configurations (#​26671)

Core type checking

• Accept gradual constrained TypeVar solutions (#​26965)
• Avoid recursive TypeVarTuple alias expansion (#​27032)
• Check inherited method conflicts via the MRO (#​27019)
• Contextually infer custom __setattr__ assignments (#​27015)
• Fix Callable isinstance reachability (#​26970)
• Fix Just[float] protocol matching (#​27053)
• Fix Self binding for classmethod __new__ constructors (#​27030)
• Fix nested short-circuit flow snapshots (#​26956)
• Gate TypedDict PEP 728 parameters by Python version (#​26968)
• Improve match reachability inference around value-pattern branches (#​26979)
• Make membership and equality narrowing consistent (#​26982)
• Preserve constrained TypeVar equality narrowing (#​26988)
• Preserve constrained TypeVar inequality narrowing (#​26995)
• Preserve unsatisfiable generic call constraints (#​26964)
• Respect bounded typevars in union inference (#​27023)
• Respect metaclass __setattr__ for class attributes (#​27000)

Performance

• Cache non-terminal-call reachability prefixes (#​26810)
• Cache protocol Self binding (#​26997)
• Cache sparse reachability checkpoints (#​26811)
• Defer statement-call narrowing gates (#​26793)

Contributors

• @​charliermarsh
• @​MichaReiser
• @​carljm
• @​AlexWaygood
• @​mtshiba

v0.0.61

Compare Source

Released on 2026-07-17.

Bug fixes

• Avoid recursive protocol structural comparisons (#​26721)

LSP server

• Render Google docstrings as structured Markdown (#​26599)

Library support

• Pydantic: Collect field metadata through subscripted generic Annotated aliases (#​26885)

Diagnostics

• Avoid extending own-line suppressions in --add-ignore (#​26808)

Core type checking

• Derive descriptor setter domains for protocols (#​26683)
• Enforce declared receiver TypeVar domains (#​26863)
• Infer isinstance results for aliases and type variables (#​26961)
• Infer isinstance results for fixed class tuples (#​26935)
• Narrow inline list and set membership checks (#​26955)
• Narrow tagged unions by tag truthiness (#​26887)
• Narrow walrus expression values (#​26949)
• Project intersections in to_instance (#​26892)
• Remove inferable TypeVar artifacts recursively (#​26787)
• Respect mixin receiver domains in method overrides (#​26941)
• Support TypeVarTuple and Unpack (#​25240)

Performance

• Deduplicate completion labels (#​26890)
• Only collect expected types for files open in the editor (#​25546)
• Parallelize subtype hierarchy search (#​26875)
• Share heap-backed parser names with CharStr (#​26594)
• Use the new incremental checker from the ignore crate (#​26933)

Contributors

• @​MichaReiser
• @​denyszhak
• @​lerebear
• @​dhruvmanila
• @​charliermarsh
• @​BurntSushi
• @​Aethryl
• @​carljm
• @​ibraheemdev

v0.0.60

Compare Source

Released on 2026-07-15.

Bug fixes

• Expand transparent callable workaround with overloads and Awaitable[T] (#​26761)
• Separate type-mapping caches by transformation mode (#​26857)
• Avoid recursive protocol union redundancy checks (#​26689)
• Handle recursive protocols in redundant-cast checks (#​26708)

LSP server

• Prevent type that is written with a code span from being incorrectly re-wrapped during docstring Markdown rendering (#​26723)

Library support

• Pydantic: Support populate_by_name and custom initializers (#​26764)
• Pydantic: Warn about immediately discarded extra arguments (#​26762)

Diagnostics

• Narrow TypeGuard keyword arguments and remove invalid-type-guard-call (#​26809)
• Support own-line suppression comments (#​26785)

Core type checking

• Derive descriptor setter domains for protocols (#​26683)
• Handle cycles in derived constraint relations (#​26814)
• Implement unified generic call inference (#​26141)
• Preserve constraints from bound receivers (#​26776)
• Project exact-length narrowing through TypeVars (#​26852)
• Resolve PEP 695 aliases in type[...] annotations (#​26842)
• Retain sequence pattern narrowing in successful match cases (#​26807)
• Support class and static protocol methods (#​26574)
• Support class objects satisfying instance-method protocols (#​26789)
• Support type[Protocol] (#​26649)
• Sync vendored typeshed stubs (#​26840). Typeshed diff
• Treat transparent callable decorators consistently in class assignments (#​26720)

Performance

• Compare overloaded protocol method returns pairwise (#​26684)
• Extend PathBounds fast-path to support both upper and lower bounds (#​26782)
• Skip Self type scans for non-generic instances (#​26703)

Contributors

• @​sharkdp
• @​mtshiba
• @​dhruvmanila
• @​lerebear
• @​carljm
• @​charliermarsh
• @​ibraheemdev
• @​RasmusNygren

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.