Update Python dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
maturin (changelog)	==1.14.1 → ==1.15.0
pydantic (changelog)	==2.13.4 → ==2.13.5
ruff (source, changelog)	==0.16.4 → ==0.16.5
tombi	==1.4.1 → ==1.5.0
ty (changelog)	==0.0.74 → ==0.0.75

---

Release Notes

pyo3/maturin (maturin)

v1.15.0

Compare Source

• Set UV_PYTHON when running maturin develop with uv (#​3236)
• Set UID and GID headers in pax (#​3241)
• Replace unguarded panics with explicit errors on fallible input (#​3242)
• Harden PEP 517 build-wheel and fix unreachable OIDC 404 fallback (#​3244)
• Fix abi3t PyModExport entrypoint check (#​3246)
• Fix maturin build --pgo -i <version> with uv install (#​3237)
• Refactor: apply some mechanical cleanups (#​3250)
• Refactor: BuildOrchestrator pipeline deduplication (#​3251)
• Refactor: improve context and environment hygiene (#​3252)
• Fix(ci): honor ~= and ==X.* in requires-python for generate-ci (#​3249)
• Refactor: type cleanup for options, tags, and wheel metadata (#​3253)
• Refactor: InstallDest, single BridgeModel, and ui output facade (#​3254)
• Don’t specify generate-import-lib for PyO3 0.29 (#​3258)
• Refactor build so that pgo is part of normal pathway (#​3257)
• Fix: verify bindings detection with cargo tree in workspaces (#​3264)
• Fix: harden cargo tree verification of bindings detection (#​3266)
• Feat: support --pgo for maturin develop (#​3270)
• Feat: support MATURIN_PGO env var to activate --pgo (#​3271)
• Docs: correct crate feature documentation; remove stale clippy allow
• Fix: deduplicate SBOM includes across full merged list, preserving first-seen order
• Feat: type the bindings input with a single-source-of-truth enum (#​3273)
• Don't force export of the PyInit_{module_name} in UniFfi mode (#​3275)
• Switch musllinux images to musllinux_1_2 as musllinux_1_1 is EOL (#​3280)
• Fix(generate-stubs): write stubs into the module's package directory (#​3282)
• Fix group not cwd (#​3284)
• Docs: document missing [tool.maturin] config fields (#​3287)
• Update cargo-zigbuild & cargo-xwin to 0.23.1

pydantic/pydantic (pydantic)

v2.13.5

Compare Source

astral-sh/ruff (ruff)

v0.16.5

Compare Source

Released on 2026-08-27.

Preview features

• Allow rules without codes (#​28049)
• Introduce category selectors (#​27666)
• Update preview default rules and categories (#​27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#​28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#​28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#​28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#​27978)

Documentation

• Document rule acceptance guidelines (#​27910)
• Document the new category selectors (#​27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

tombi-toml/tombi (tombi)

v1.5.0

Compare Source

What's Changed

Tombi v1.5.0 is a major performance and architecture release.

We redesigned the parser and AST around a compact, source-backed syntax tape, replacing the previous red-green syntax tree.
The new architecture is optimized for Tombi’s lossless, long-lived editor and LSP workloads: it improves memory locality and reduces allocation and pointer-chasing overhead while preserving comments, punctuation, incomplete syntax, and diagnostics.
The AST and document-tree interfaces are now also separated from their syntax-backed implementations.

We also optimized hot paths throughout the parser, JSON Schema processing, linter, formatter, and stdin-based CLI workflows.
In our Apple M2 Max benchmarks, long ASCII comment lexing was approximately 2.3× faster, selected JSON parsing workloads improved by up to 84%, and repository-wide lint time decreased from approximately 355 ms to 81 ms.

🚨 Breaking Changes

• perf(parser): replace syntax tree with compact tape by @​ya7010 in #​2140

🐝 Bug Fixes

• fix(lsp): preserve composite schema metadata by @​ya7010 in #​2139

🛠️ Other Changes

• Improve minimal-change guidance for agents by @​ya7010 in #​2137
• perf(parser): accelerate long comment scanning by @​ya7010 in #​2141
• perf: speed up lint and format by @​ya7010 in #​2142
• perf: reduce stdin runtime overhead by @​ya7010 in #​2143
• perf(json): accelerate long string parsing by @​ya7010 in #​2145
• perf(json): optimize lexer and parser hot paths by @​ya7010 in #​2146

Full Changelog: tombi-toml/tombi@v1.4.1...v1.5.0

astral-sh/ty (ty)

v0.0.75

Compare Source

Released on 2026-08-26.

Preview features

• Initialize PEP 723 script environments in the CLI (#​27544)
• Refresh PEP 723 script environments in watch mode (#​27617)
• Run PEP 723 script synchronization on bounded workers (#​27615)

Bug fixes

• Specialize Self bounds of inherited methods (#​27990)

LSP server

• Add "Go to Definition" support for pytest fixtures (#​27444)

Documentation

• Fix documented Python package build command (#​4384)
• Link untyped-call tracking issue in migration guide (#​4382)

Library support

• Resolve imported pytest fixture exposures (#​27539)
• Resolve installed core pytest fixture providers (#​27770)
• Resolve pytest fixtures through conftest (#​27540)

Diagnostics

• Add more autofixes (#​28029)
• Add a dedicated missing-slot diagnostic (#​28039)
• Explain missing storage for declared slotted attributes (#​27969)
• Improve diagnostic spans for unpacked variable assignments (#​28041)

Core type checking

• Account for known subclasses in equality inference (#​28005)
• Expand ParamSpec signatures inferred from bound receivers (#​28020)
• Fix Self binding in ParamSpec protocols (#​28016)
• Fix TypedDict variance inference (#​28052)
• Fix unsound narrowing through branch-assigned conditions (#​28006)
• Ignore inconsistent binding decorators on overloads (#​28036)
• Infer yield from send/return types from the iterator returned by __iter__ (#​27987)
• Infer tuple type parameters from union arguments (#​28062)
• Infer variance through nonrecursive protocol references (#​28065)
• Preserve bounds of non-literal metaclasses (#​28046)
• Preserve correlated generic-call inference (#​28043)
• Preserve invariant materialization constraints (#​28047)
• Recover bare TypeVarTuples in tuple annotations (#​27950)
• Reject fixed tuples for non-inferable TypeVarTuples (#​27943)
• Reject incompatible constructor context for variadic packs (#​27966)
• Support mixed gradual tuple assignability with TypeVarTuple (#​27957)
• Support tagged union with multiple tags per type (#​27984)
• Sync vendored typeshed stubs (#​28035). Typeshed diff
• Treat typing.Union as a class on Python 3.14+ (#​28003)
• Validate generic protocol variance (#​27531)
• collections.abc.Callable is an instance of type (#​27991)

Contributors

• @​sharkdp
• @​jelle-openai
• @​marcelo-souzaf
• @​AlexWaygood
• @​krzkaczor
• @​carljm
• @​charliermarsh
• @​lerebear
• @​MichaReiser

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.