build(deps-dev): bump the linters group with 2 updates

[dependabot]

Bumps the linters group with 2 updates: ty and zizmor.

Updates ty from 0.0.53 to 0.0.63

Release notes

Sourced from ty's releases.

0.0.63

Release Notes

Released on 2026-07-23.

Core type checking

• Handle generic stringified PEP 613 (typing.TypeAlias) type aliases (#27092)
• Allow equality narrowing across non-final classes (#27031)
• Allow interpolated string literals to be promoted to str (#27104)
• Fix double specialization of generic type aliases (#27058)
• Fix intersections of type and TypeForm (#27099)
• When narrowing from a match statement leads a variable x to be inferred as A & B, infer the type of x.attr as <type of A.attr> & <type of B.attr> (#27103)

Library support

• Pydantic: Stricter validation of sub-model fields in lax mode (#27091)
• Pydantic: Support special underscore parameters in BaseSettings models (#27098)

Performance

• Avoid exponential narrowing of optional dynamic match subjects (#27100)
• Avoid normalizing cached absolute file paths (#26998)

Contributors

• @​sharkdp
• @​charliermarsh
• @​ibraheemdev
• @​carljm

Install ty 0.0.63

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.63/ty-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ty/releases/download/0.0.63/ty-installer.ps1 | iex"

Download ty 0.0.63

File	Platform	Checksum
ty-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.63

Released on 2026-07-23.

Core type checking

• Handle generic stringified PEP 613 (typing.TypeAlias) type aliases (#27092)
• Allow equality narrowing across non-final classes (#27031)
• Allow interpolated string literals to be promoted to str (#27104)
• Fix double specialization of generic type aliases (#27058)
• Fix intersections of type and TypeForm (#27099)
• When narrowing from a match statement leads a variable x to be inferred as A & B, infer the type of x.attr as <type of A.attr> & <type of B.attr> (#27103)

Library support

• Pydantic: Stricter validation of sub-model fields in lax mode (#27091)
• Pydantic: Support special underscore parameters in BaseSettings models (#27098)

Performance

• Avoid exponential narrowing of optional dynamic match subjects (#27100)
• Avoid normalizing cached absolute file paths (#26998)

Contributors

• @​sharkdp
• @​charliermarsh
• @​ibraheemdev
• @​carljm

0.0.62

Released on 2026-07-21.

Bug fixes

• Guard recursive Protocol and TypedDict relations (#26990)
• Prevent stack overflows in recursive type relation checks (#26503)
• Recover from cancelled file indexing (#26876)

Diagnostics

• Avoid editing ignore comments with trailing reasons (#26939)
• Prefer innermost inline suppressions (#26940)
• Remove unused own-line ignore comments (#27013)
• Reuse applicable own-line suppressions in --add-ignore (#26925)

Configuration

• Respect rules and analysis in PEP 723 script metadata configurations (#26671)

... (truncated)

Commits

• 46f4915 Bump version to 0.0.63 (#4071)
• df75992 Bump version to 0.0.62 (#4057)
• 48dd1fd Update prek dependencies (#4059)
• f53a95e Update astral-sh/setup-uv action to v9 (#4060)
• 17d1791 Update dependency prek to v0.4.9 (#4058)
• eb7e7ba Update documentation on mypy/pyright --strict parity, and achieving maximum...
• 56b2c24 Update changelog for 0.0.61 (#4028)
• 4c865c8 Bump version to 0.0.61 (#4027)
• ae554ec Bump version to 0.0.60 (#4008)
• 4f78ec5 Update astral-sh/setup-uv action to v8.3.2 (#3997)
• Additional commits viewable in compare view

Updates zizmor from 1.26.1 to 1.28.0

Release notes

Sourced from zizmor's releases.

v1.28.0

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

v1.27.0

New Features 🌈🔗

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153) Enhancements 🌱🔗

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛🔗

• Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#2157)

• Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#2177)

• Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#2185)

Changelog

Sourced from zizmor's changelog.

1.28.0

Security 🔒

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh] for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

• The [dependabot-cooldown] audit is now aware of GitHub's new three-day default cooldown (#2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛

• Fixed a bug where the [template-injection] audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

• Fixed a bug where the [github-env] audit would incorrectly flag some printf calls as exploitable (#2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

1.27.0

New Features 🌈

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153)

Enhancements 🌱

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛

• Fixed a bug where the [secrets-outside-env] audit would not honor

... (truncated)

Commits

• 4381cc6 Prep zizmor 1.28.0 (#2214)
• 724d0e8 Remove a redundant debug log (#2213)
• 5a01aad [BOT] update JSON schemas from SchemaStore (#2208)
• 6138a6d Add sbt to known Dependabot ecosystems (#2211)
• 23878aa chore(deps): bump the cargo group with 4 updates (#2206)
• 5e839db chore(deps): bump the github-actions group with 3 updates (#2207)
• 297975a dependabot-cooldown: honor GitHub's new default (#2193)
• b648e57 Improve error message on remote ambiguous input refs (#2205)
• d06c823 Dedupe a function in the GitHub APIs (#2204)
• 82f5bf6 github-env: don't flag all-literal printf arguments (#2201)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.84%. Comparing base (0a72761) to head (826ab9d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #260   +/-   ##
=======================================
  Coverage   93.84%   93.84%           
=======================================
  Files          14       14           
  Lines         585      585           
  Branches       51       51           
=======================================
  Hits          549      549           
  Misses         31       31           
  Partials        5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.