[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ruff (source, changelog)	>=0.17.1 → >=0.17.3
ty (changelog)	>=0.0.89 → >=0.0.92

---

Release Notes

astral-sh/ruff (ruff)

v0.17.3

Compare Source

Released on 2026-10-26.

Preview features

• [suspicious] Add shared-clock-mock (#​29074)

Bug fixes

• [pyupgrade] Avoid incorrect conversions to f-strings (UP032) (#​25485)

Performance

• Buffer stdout in ruff format (#​29631)
• Specialize ASCII identifier lexing (#​29503)
• Speed up identifier and keyword lexing (#​29463)

Documentation

• [flake8-bandit] Describe what the rule actually checks for httpx (S113) (#​27936)

Contributors

• @​itsvedantkumar
• @​charliermarsh
• @​anishgirianish

v0.17.2

Compare Source

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#​25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#​28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#​29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#​29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#​29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#​29413)

Performance

• Avoid intermediate names in lint name resolution (#​29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#​29561)
• Share postfix parsing and reduce expression copies (#​29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#​18961)

Documentation

• Clarify documentation and correct stale guidance (#​29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#​29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

astral-sh/ty (ty)

v0.0.92

Compare Source

Released on 2026-10-26.

Core type checking

• Infer the types of Django model primary keys (pk and the automatic id) with django-types (#​29642)
• Infer Django foreign key <field>_id types from the referenced field (#​29664)
• Recognize get_<field>_display() on Django model fields with choices (#​29651)
• Recognize get_next_by_<field>() and get_previous_by_<field>() on non-nullable Django date and datetime fields (#​29653)

Bug fixes

• Preserve generic callback parameters when forwarding overloaded functions through a ParamSpec (#​29649)
• Check implicit and PEP 613 type aliases as type expressions at their definitions (#​29200)

CLI

• Emit SARIF reports with ty check --output-format sarif (#​29635)

LSP server

• Skip scanning for scripts at startup and reload when uv script environments are disabled (#​29697)

Diagnostic improvements

• Abbreviate large nested tuple types in diagnostics and inlay hints (#​29691)
• Point to the expression that makes a type alias invalid, even when the alias is imported (#​29654)

Performance

• Avoid redundant work when checking inherited attributes (#​29699)
• Check for instance storage without inferring method assignments (#​29709)
• Collect receiver annotations once per class (#​29703)
• Check non-recursive protocol members before recursive ones (#​29542)
• Reuse class member lookups when checking overrides (#​29716)
• Reuse each generic context's inferable type variables (#​29700)
• Short-circuit comparisons involving top and bottom callable signatures (#​29537)
• Skip inferred writes when a declaration determines an instance member (#​29702)
• Skip method signature inference for concrete decorator results (#​29708)

Contributors

• @​charliermarsh
• @​ntBre
• @​carljm
• @​dcreager
• @​sharkdp

v0.0.91

Compare Source

Released on 2026-10-22.

Bug fixes

• Improve generics solving when an intersection is passed into a generic call to prefer solving the call to a more precise type when it is safe to do so (#​29578)
• Fix recursive type materialization (#​29532)
• Infer return intersections from correlated call specializations (#​28303)
• Preserve Self when checking universal protocols (#​29207)
• Fix stack overflows involving recursive descriptor setter types (#​29148)
• Preserve the namespace-package fallback in module discovery when the namespace-package fallback is obscured by a partial stub package (#​29559)
• Report all missing @override decorators together (#​29557)
• Fix false-positive invalid-argument-type diagnostics when inferring constrained type variables from callbacks that return an invariant generic with a gradual type argument (#​29577)

Performance improvements

• Compare protocol receiver restrictions before binding (#​29443)

LSP server

• Avoid cancelling requests for unrelated file changes (#​29604)

Core type checking

• Generics solving: check for unsatisfiable bodies before existentially quantifying (#​29504)
• Liskov diagnostics: Check inherited attribute conflicts (#​28559)
• Return type inference: eneralize nested types in inferred return types (#​29488)

Contributors

• @​charliermarsh
• @​sharkdp
• @​dhruvmanila
• @​carljm
• @​MichaReiser
• @​dcreager

v0.0.90

Compare Source

Released on 2026-10-20.

Bug fixes

• Allow subclasses to restore hashability (#​29471)
• Avoid crashes when negating recursive aliases (#​29429)
• Avoid stack overflow for recursive descriptor setter checks (#​29467)
• Defer constructor type variable defaults (#​29469)
• Preserve bound receivers for strict signature checks (#​29396)
• Preserve read types for dynamic attributes (#​29461)
• Reject runtime_checkable on non-protocol classes (#​29460)
• Validate TypeAliasType keyword arguments (#​29466)

LSP server

• Add return-type inlay hints (#​29437)

Other changes

• Adopt stable macOS signing identifiers (#​4743)
• Avoid inserting inlay hints containing stub-only types (#​29477)
• Filter incompatible union members during union inference (#​29344)
• Infer ParamSpecs from call-wide constraints (#​28828)
• Mitigate pauses from clearing cached ASTs in more language server operations (#​29232)
• Report read-only keys when deleting, popping, or defaulting TypedDict items (#​29441)
• Support uv's nested module ownership metadata (#​29436)

Contributors

• @​carljm
• @​zsol
• @​zanieb
• @​ibraheemdev
• @​hsusul
• @​charliermarsh
• @​sharkdp
• @​dhruvmanila
• @​lerebear

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pyproject.toml

Artifact update for ty resolved to version 0.0.93, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 0.0.92
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/