What Needs Maintaining
- Target:
ruff and ty dev toolchain
- Current version: ruff 0.15.5, ty 0.0.20
- Target version: ruff 0.16.3, ty 0.0.71
Why Now
Both were deliberately held back during the August 2026 dependency sweep (#425). Neither carries a security advisory, so pinning them cost nothing on that front — but bundling their fallout into a security sweep would have buried a 1400-line lockfile diff under hundreds of mechanical style changes. They are now the only two dependencies knowingly behind.
Expected Fallout
Measured on 2026-08-13 by upgrading both and running the gates:
| Gate |
Result |
ruff check . |
139 errors, 28 auto-fixable with --fix, 89 further hidden fixes behind --unsafe-fixes |
ruff format --check . |
50 files would be reformatted (of 833) |
ty check |
54 diagnostics |
Representative samples:
RUF059 — unpacked variables never used, e.g. findings, stats, errors = _run_checks(...) in tests/unit/test_mcp.py. New rule behavior, mostly in tests.- ty
invalid-assignment — "Property require_raises defined in EnrichmentConfig is read-only" in tests/unit/test_config.py, on lines that already carry # type: ignore[misc]. ty 0.0.71 appears to no longer honor those suppressions, so the fix is likely a different suppression form rather than a code change.
- ty
not-subscriptable — "Cannot subscript object of type object" on a line already carrying # type: ignore[index].
Note the ruff formatter also wants to reformat the suppression-comment fixtures (# docvet:ignore[missing-raises] → # docvet: ignore[missing-raises]). Those spacing variants are deliberate test inputs for AC5 of story 32.4 — they must not be normalized. Check whether they need a # fmt: off guard or relocation out of formatter scope.
Verification
Suggested order: bump ruff first and land its fixes, then ty separately — the two failure sets are unrelated and mixing them makes review harder.
Deferred from #425.
What Needs Maintaining
ruffandtydev toolchainWhy Now
Both were deliberately held back during the August 2026 dependency sweep (#425). Neither carries a security advisory, so pinning them cost nothing on that front — but bundling their fallout into a security sweep would have buried a 1400-line lockfile diff under hundreds of mechanical style changes. They are now the only two dependencies knowingly behind.
Expected Fallout
Measured on 2026-08-13 by upgrading both and running the gates:
ruff check .--fix, 89 further hidden fixes behind--unsafe-fixesruff format --check .ty checkRepresentative samples:
RUF059— unpacked variables never used, e.g.findings, stats, errors = _run_checks(...)intests/unit/test_mcp.py. New rule behavior, mostly in tests.invalid-assignment— "Propertyrequire_raisesdefined inEnrichmentConfigis read-only" intests/unit/test_config.py, on lines that already carry# type: ignore[misc]. ty 0.0.71 appears to no longer honor those suppressions, so the fix is likely a different suppression form rather than a code change.not-subscriptable— "Cannot subscript object of typeobject" on a line already carrying# type: ignore[index].Note the ruff formatter also wants to reformat the suppression-comment fixtures (
# docvet:ignore[missing-raises]→# docvet: ignore[missing-raises]). Those spacing variants are deliberate test inputs for AC5 of story 32.4 — they must not be normalized. Check whether they need a# fmt: offguard or relocation out of formatter scope.Verification
uv run pytestuv run ruff check ./uv run ruff format --check .uv run ty checkuv audituv run docvet check --allSuggested order: bump ruff first and land its fixes, then ty separately — the two failure sets are unrelated and mixing them makes review harder.
Deferred from #425.