[dependabot]

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
crosshair-tool	0.0.110	0.0.111
hypothesis	6.168.0	6.170.5
hypothesis-crosshair	0.0.30	0.0.31
pytest	9.0.3	9.1.1
ruff	0.16.4	0.17.1
ty	0.0.74	0.0.89

Updates crosshair-tool from 0.0.110 to 0.0.111

Release notes

Sourced from crosshair-tool's releases.

v0.0.111

See the changelog for details.

Commits

• 14f69eb Bump version to 0.0.111
• 733b258 Fall back to process-wide instruction events beside another instruction tool
• 2a8066a Enable instruction monitoring per code object instead of process-wide
• 3b9c6a2 Add an xfail test for is_integer() on non-finite IEEE-modeled floats
• aa268bb Compute float powers concretely unless the exponent is a small integer
• 0cdf66b Use inline expression instead of helper
• 4c758a2 Compare symbolic strings and bytes to literals with one branch, not one per c...
• 190a73d Merge pull request #527 from KRRT7/regex-lazy-slice
• f510c8e Merge branch 'main' into regex-lazy-slice
• d05c0d0 Merge changelog.rst with the union driver
• Additional commits viewable in compare view

Updates hypothesis from 6.168.0 to 6.170.5

Commits

• 6dda9ec Bump hypothesis version to 6.170.5 and update changelog
• d5af8b4 Merge pull request #4913 from Liam-DeVoe/fix-integer-weights-key
• 3352fe0 Bump hypothesis version to 6.170.4 and update changelog
• ccb592e Merge pull request #4915 from jorenham/typing/_settings/coverage
• 74a7906 Merge remote-tracking branch 'upstream/master' into pr-4915
• 5378001 Bump hypothesis version to 6.170.3 and update changelog
• 93c67c8 Pin max_examples in mixed-alphabet one_of regression test
• 49ba6fc Merge branch 'master' into typing/_settings/coverage
• 6df93f9 oops
• 2e26f0b Merge pull request #4914 from Liam-DeVoe/fix-shrinker-invalid-sort-key
• Additional commits viewable in compare view

Updates hypothesis-crosshair from 0.0.30 to 0.0.31

Commits

• See full diff in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates ruff from 0.16.4 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates ty from 0.0.74 to 0.0.89

Release notes

Sourced from ty's releases.

0.0.89

Release Notes

Released on 2026-10-16.

Core type checking

• Added support for return type inference for unannotated functions and methods (#29253).

  Return type inference is currently disabled by default. Enable it with the analysis.return-type-inference setting in pyproject.toml:

  [tool.ty.analysis]
  return-type-inference = "always"

  Or in ty.toml:

  [analysis]
  return-type-inference = "always"

  Please share your feedback, especially any problems you encounter, in the return type inference feedback issue.

• Sync vendored typeshed stubs (#29402). Typeshed diff

Bug fixes

• Avoid a panic when negating dynamic type aliases (#29427)
• Widen tuple literal lengths when other collection elements contain nested tuple types (#29147)
• Report invalid Generic and Protocol arguments containing nested variadic type variables (#29146)

Performance

• Speed up generic class-pattern narrowing by skipping impossible intersection comparisons (#29240)

Contributors

• @​carljm
• @​charliermarsh
• @​sharkdp

Install ty 0.0.89

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.89/ty-installer.sh | sh

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.89

Released on 2026-10-16.

Core type checking

• Added support for return type inference for unannotated functions and methods (#29253).

  Return type inference is currently disabled by default. Enable it with the analysis.return-type-inference setting in pyproject.toml:

  [tool.ty.analysis]
  return-type-inference = "always"

  Or in ty.toml:

  [analysis]
  return-type-inference = "always"

  Please share your feedback, especially any problems you encounter, in the return type inference feedback issue.

• Sync vendored typeshed stubs (#29402). Typeshed diff

Bug fixes

• Avoid a panic when negating dynamic type aliases (#29427)
• Widen tuple literal lengths when other collection elements contain nested tuple types (#29147)
• Report invalid Generic and Protocol arguments containing nested variadic type variables (#29146)

Performance

• Speed up generic class-pattern narrowing by skipping impossible intersection comparisons (#29240)

Contributors

• @​carljm
• @​charliermarsh
• @​sharkdp

0.0.88

Released on 2026-10-15.

Bug fixes

• Avoid panics and hangs involving recursive type aliases and intersections (#29057)
• Fix false invalid-mutable-override errors when overriding object attributes (#29373)

... (truncated)

Commits

• 82b0fd4 Bump version to 0.0.89 (#4740)
• 5370198 Update dependency python to 3.14 (#4721)
• 64e7f18 Bump version to 0.0.88 (#4732)
• 88c50d5 Budget the daily fuzz run based on setup time (#4706)
• ec60e71 Document and lint the manually maintained release workflow (#4320)
• dbc632a Update dependency prek to v0.5.3 (#4719)
• 7aa0f34 Update astral-sh/setup-uv action to v10.3.0 (#4720)
• 2eefac0 Update prek dependencies (#4722)
• ea4c3d2 Bump version to 0.0.87 (#4718)
• 1e7a76d Require hashes for build dependencies (#4714)
• Additional commits viewable in compare view

[sourcery-ai]

Sorry @dependabot[bot], you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 2 hours and 23 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: fe2c2d5a-aad5-416c-bb3f-53032b7d6a08

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}