Update Python dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
granian	==2.7.6 → ==2.7.7
poethepoet (changelog)	==0.46.0 → ==0.47.0
ruff (source, changelog)	==0.15.18 → ==0.15.20
tombi	==1.1.4 → ==1.1.6
ty (changelog)	==0.0.51 → ==0.0.55

---

Release Notes

emmett-framework/granian (granian)

v2.7.7: Granian 2.7.7

Compare Source

Patch release

Changes since 2.7.6:

• Fix a bug in ASGI protocol websockets teardown leading to Python's event-loop blocking
• Fix a memory leak in async applications calls

nat-n/poethepoet (poethepoet)

v0.47.0: 0.47.0

Compare Source

Enhancements

• Add buffer output_mode for parallel tasks by @​nat-n in #​400
• Generate official JSON Schema for poe section in pyproject based on PoeOptions and improve some validation edge cases by @​nat-n in #​392 #​389 #​398
• Support declared args on script tasks targeting modules by @​nat-n in #​396
• Respect the FORCE_COLOR environment variable by @​nat-n in #​403

Fixes

• Executor config validation now rejects unknown keys by @​nat-n in #​391
• Support src-layout python path resolution for script, expr, and include_script by @​nat-n in #​397
• Fully support all three CLI styles for multi-value args by @​nat-n in #​402

AI Agent Skill 🤖

• The poethepoet skill is now documented and ready for use @​nat-n in #​404
• Improve coverage of expr/switch config semantics and edge cases by @​nat-n in #​401

Install the skill via one of the following methods:

1. Via a built in poe task (similar to how shell completions are installed):

poe _install_skill                          # auto-detects .claude/.codex/.pi/.agents and prompts
poe _install_skill ~/.claude/skills         # explicit path (substitute your agent's dir)
poe _install_skill <skills-dir> --upgrade   # non-interactive upgrade (skips if same/newer)

2. From github via npx skills

npx skills add https://github.com/nat-n/poethepoet/tree/v0.46.0/poethepoet/skills/poethepoet

Full Changelog: nat-n/poethepoet@v0.46.0...v0.47.0

astral-sh/ruff (ruff)

v0.15.20

Compare Source

Released on 2026-06-25.

Preview features

• Allow human-readable names in rule selectors (#​25887)
• Emit a warning instead of an error for unknown rule selectors (#​26113)
• Match noqa shebang handling in ruff:ignore comments (#​26286)
• [ruff] Remove pytest-fixture-autouse (RUF076) (#​26240, #​26371)

Documentation

• Add versioning sections to custom crate READMEs (#​26317)
• Update ruff_python_parser README for crates.io (#​26315)
• [perflint] Clarify that PERF402 applies to any iterable (#​26242)

Contributors

• @​dhruvmanila
• @​MichaReiser
• @​ntBre
• @​trilamsr

v0.15.19

Compare Source

Released on 2026-06-23.

Preview features

• Support human-readable names when hovering suppression comments and in code actions (#​26114)

Bug fixes

• Fall back to default settings when editor-only settings are invalid (#​26244)
• Fix panic when inserting text at a notebook cell boundary (#​26111)

Rule changes

• [pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801) (#​26239)

Performance

• Avoid allocating when parsing single string literals (#​26200)
• Avoid reallocating singleton call arguments (#​26223)
• Lazily create source files for lint diagnostics (#​26226)
• Optimize formatter text width and indentation (#​26236)
• Reserve capacity for builtin bindings (#​26229)
• Skip repeated-key checks for singleton dictionaries (#​26228)
• Use ArrayVec for qualified name segments (#​26224)

Documentation

• [flake8-pyi] Note that PYI051 is an opinionated stylistic rule (#​26179)
• [pyupgrade] Clarify UP029 as a Python 2 compatibility rule (#​26243)

Other changes

• Publish Ruff crates to crates.io (#​26271)

Contributors

• @​MakenRosa
• @​MichaReiser
• @​trilamsr
• @​ntBre
• @​sanjibani
• @​charliermarsh

tombi-toml/tombi (tombi)

v1.1.6

Compare Source

What's Changed

🚀 New Features

• feat: include target in CLI version output by @​ya7010 in #​1974

🐛 Bug Fixes

• fix: remove npm install script from tombi package by @​ya7010 in #​1969

🛠️ Other Changes

• Fix Windows release CRT linkage by @​ya7010 in #​1961
• ci: use shared release environment by @​ya7010 in #​1962
• Deprecate legacy document-link feature toggles by @​ya7010 in #​1965
• docs: add v2 release todo by @​ya7010 in #​1966
• chore: bump biome $schema to match pinned CLI 2.3.8 by @​EduardF1 in #​1967
• Align release build settings by @​ya7010 in #​1972
• fix: update vulnerable npm dependencies by @​ya7010 in #​1973

New Contributors

• @​EduardF1 made their first contribution in #​1967

Full Changelog: tombi-toml/tombi@v1.1.5...v1.1.6

v1.1.5

Compare Source

What's Changed

🐛 Bug Fixes

• fix(lsp): merge allOf table key completions by @​ya7010 in #​1959
• fix(vscode): color TOML dates as constants by @​ya7010 in #​1960

🛠️ Other Changes

• fix(lsp): complete literal keys in tables by @​ya7010 in #​1958

Full Changelog: tombi-toml/tombi@v1.1.4...v1.1.5

astral-sh/ty (ty)

v0.0.55

Compare Source

Released on 2026-06-26.

LSP server

• Render full diagnostics in color (#​26384)

Documentation

• Document colored diagnostic output (#​3858)

Performance

• Improve vendored filesystem concurrency (#​26408)
• Optimize enum comparisons in equality evaluation (#​26340)
• Remove redundant semantic index shrinks (#​26392)
• Use never-change durability for one-shot checks (#​26359)

Core type checking

• Correct enum alias detection and scalar constructors (#​26345)
• Fix structural pattern binding inference (#​26411)
• Improve variable-length tuple slicing (#​26151)
• Infer class and mapping pattern bindings (#​25941)
• Infer empty collection constructors from later uses (#​26389)
• Skip shadowed submodule bindings during import analysis (#​26385)
• Sync vendored typeshed stubs (#​26406). Typeshed diff
• Track literal iterable emptiness for reachability (#​25222)
• Validate positional class patterns against __match_args__ (#​26195)

Contributors

• @​charliermarsh
• @​carljm
• @​AlexWaygood
• @​MichaReiser
• @​mtshiba
• @​felixscherz

v0.0.54

Compare Source

Released on 2026-06-25.

Bug fixes

• Avoid duplicate configuration error output (#​26375)
• Avoid stack overflows in reachability analysis (#​26272)
• Fix divergent recursive tuple cycle handling in ty (#​26316)
• Fix panic from relation queries during cycle recovery (#​26335)
• Fix panics by reverting recursive TypeOf cycle recovery (#​26339)
• Support basic usages of __class__ closure cells in methods (#​26329)

LSP server

• Fix typealias token classification inconsistency (#​26255)
• Implement rust-analyzer's "Click for full compiler diagnostic" feature (#​26269)

Performance

• Co-locate retained definition usage state (#​26019)
• Use never-change durability for immutable file inputs (#​26353)

Diagnostics

• Reject undeclared protocol instance attributes (#​26336)

Core type checking

• Allow replacing ordinary methods with compatible functions (#​26158)
• Distinguish typing.TypedDict from typing_extensions.TypedDict (#​25843)
• Don't treat non-empty ranges as single-valued (#​26351)
• Handle TypeVar bounds over type[...] in attribute lookup (#​26146)
• Infer definite equality comparison results (#​26337)
• Infer mismatched literal comparisons (#​26313)
• match statements: make class-pattern fallthrough member-aware (#​26283)
• match statements: prove TypedDict structural patterns exhaustive (#​26285)
• match statements: resolve positional class-pattern exhaustiveness (#​26284)
• Model non-exhaustive enum member sets (enum.Flags) (#​26277)
• Reduce retained definition map storage (#​26348)
• Reuse equality semantics for membership compatibility (#​25955)
• Sync vendored typeshed stubs to support builtins.sentinel (#​26341)
• Treat non-empty range calls as non-empty for reachability (#​25220)
• Use assignability for divergent constraints (#​26334)
• Widen inferred class-valued instance attributes (#​26338)

Contributors

• @​carljm
• @​sqqueak
• @​AlexWaygood
• @​mtshiba
• @​charliermarsh
• @​MichaReiser

v0.0.53

Compare Source

Released on 2026-06-23.

Bug fixes

• Avoid bypassing lazy constraints for Divergent (#​26288)
• Avoid recursion when projecting narrowing constraints (#​26276)
• Fix ParamSpec callable signature extraction for callable instances (#​26279)
• Make multi-arm TypeOf cycle recovery monotonic (#​26275)

LSP server

• Document all special forms in ty_extensions (#​26263)

Performance

• Avoid cloning fallback condition flow snapshots (#​26203)
• Avoid constructing discarded speculative diagnostics (#​26251)
• Avoid path lookups when sorting same-file diagnostics (#​26257)
• Cache is_never_satisfied results (#​26261)
• Defer applying type context to simple standalone expressions (#​26252)

Core type checking

• Infer types for names bound in match patterns (#​25940)
• Preserve regular kind for callable instances (#​26253)
• Simplify intersections of invariant generic types with Any specializations (#​26127)

Contributors

• @​charliermarsh
• @​MichaReiser
• @​AlexWaygood
• @​sharkdp
• @​ibraheemdev
• @​carljm

v0.0.52

Compare Source

Released on 2026-06-22.

Bug fixes

• Avoid shadowing hints for attribute assignments (#​26164)
• Fix dict.pop overloads to accept arbitrary keys with defaults (#​26241)
• Normalize recursive TypeOf across multiple union arms (#​26230)
• Normalize recursive TypeOf growth during cycle recovery (#​26163)
• Normalize recursive protocol growth during cycle recovery (#​26246)
• Preserve generic alias identity during cycle recovery (#​26166)
• Recover from dynamic class code generator cycles (#​26167)

LSP server

• Add a go-to destination for Divergent (#​26162)
• Publish diagnostics for all open files after a single file is saved (#​25929)
• Render Markdown for reStructuredText fields in docstrings on hover (#​25903)

CLI

• Make error-on-warning the default (#​26157)

Diagnostics

• Make rendering of fix diffs more concise (#​26161)

Performance

• Avoid allocating disabled error context trees (#​26191)
• Avoid lookup maps for small place tables (#​26177)
• Avoid moving boxed use-def map builders (#​26211)
• Avoid transient AST ID merge map (#​26185)
• Batch signature typevar freshness scans (#​26196)
• Box large semantic index builders (#​26186)
• Build frozen definition maps directly (#​26188)
• Compact use-def binding interner keys (#​26193)
• Consume condition flow snapshots (#​26189)
• Lazily allocate reachability caches (#​26194)
• Remove redundant use-def state shrinking (#​26206)
• Reuse the first union bindings buffer (#​26225)
• Short-circuit terminal narrowing constraints (#​26215)
• Solve simple constraint conjunctions directly (#​25879)
• Store cycle-detector cache entries inline (#​26183)
• Stream indexed AST construction (#​26184)
• Suppress discarded TypedDict diagnostics (#​26250)
• Use SmallVec for CycleDetector::seen (#​26181)
• Use a SmallVec for seen type aliases (#​26187)

Core type checking

• Raise limit for number of non-recursive union literals (#​25212)
• Preserve gradual behavior for explicit Any subclasses (#​26034)
• Preserve metaclasses when inheriting from intersection-typed bases (#​26145)
• Recognize exhaustive matches over finite tuples (#​26132)

Contributors

• @​JamBalaya56562
• @​AlexWaygood
• @​carljm
• @​Minibrams
• @​lerebear
• @​MichaReiser
• @​charliermarsh

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.