chore(deps-dev): bump the dependencies group with 3 updates

[dependabot]

Bumps the dependencies group with 3 updates: ruff, semgrep and ty.

Updates ruff from 0.15.21 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

• [pycodestyle] Add an autofix for E402 (#22212)
• [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
• [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
• [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
• [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

• [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

• [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

• Avoid redundant lexer token bookkeeping (#26765)
• Avoid redundant pending-indentation writes (#26774)
• Avoid unnecessary identifier lookahead (#26525)
• Reuse parser scratch buffers (#26798)

Documentation

• Document argfile support (#26803)
• [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
• [pycodestyle] Document E731 fix safety (#26847)
• [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

• @​dwego
• @​MichaReiser
• @​Joosboy
• @​KaufmanDmitriy
• @​PeterJCLaw
• @​ntBre
• @​charliermarsh

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

• [pycodestyle] Add an autofix for E402 (#22212)
• [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
• [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
• [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
• [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

• [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

• [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

• Avoid redundant lexer token bookkeeping (#26765)
• Avoid redundant pending-indentation writes (#26774)
• Avoid unnecessary identifier lookahead (#26525)
• Reuse parser scratch buffers (#26798)

Documentation

• Document argfile support (#26803)
• [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
• [pycodestyle] Document E731 fix safety (#26847)
• [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

• @​dwego
• @​MichaReiser
• @​Joosboy
• @​KaufmanDmitriy
• @​PeterJCLaw
• @​ntBre
• @​charliermarsh

Commits

• 0177a7e Bump 0.15.22 (#26884)
• fe8ba85 [pycodestyle] Document E731 fix safety (#26847)
• f3cf7c8 [ruff] Add rule-codes-in-selectors (RUF201) (#26772)
• d244fd7 Document argfile support (#26803)
• f239758 [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)
• 54acbcd [ty] Support TypeVarTuple and Unpack (#25240)
• 87fc38c [ty] Parallelize subtype hierarchy search (#26875)
• e454f91 [ty] Share interned query keys across Salsa queries (#26794)
• 6f361a7 [ty] only collect expected types for files open in the editor (#25546)
• 6d6b2b3 [ty] Avoid allocations during Salsa interned lookups (#26877)
• Additional commits viewable in compare view

Updates semgrep from 1.169.0 to 1.170.0

Release notes

Sourced from semgrep's releases.

Release v1.170.0

1.170.0 - 2026-07-15

### Added

• Pro C/C++ scans now skip code inside statically-dead preprocessor branches (for example, #if 0 ... #else ... #endif). Patterns that would otherwise match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)
• Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)
• semgrep install-semgrep-pro now sends usage metrics so that installation errors can be tracked. Metrics can be disabled with --metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also now include the method used to install the Semgrep CLI (pip, homebrew, docker, or unknown), detected heuristically. See metrics.md for more details of what exactly is sent. (engine-2858)

### Changed

• Increased the timeout for dynamic dependency resolution subprocesses from 600 to 900 seconds, giving large projects more time to resolve dependencies before timing out. (SC-3699)
• Pro C/C++ #if 0 filtering now also handles cases where the directive splits a syntactic unit. For example, a function signature toggle like #if 0 void foo(int i) { #else void foo(uint32_t i) { #endif. (engine-994)

### Fixed

• Fixed a crash at startup (Fatal error: Failed to allocate signal stack for domain 0) when running Semgrep on systems with musl 1.2.6 (e.g. Alpine 3.24) on recent Intel CPUs whose kernel-reported minimum signal-stack size exceeds musl's build-time SIGSTKSZ (notably AMX-capable Xeons). (ENGINE-2863)

• Dockerfile: Fixed parse errors on RUN instructions that use heredoc syntax (<<EOF, <<-EOF, quoted delimiters). (LANG-263)

• metavariable-type now supports fully qualified type names in languages where a qualified name in type position parses as an expression (e.g. Python's types: [a.b.C]) when the metavariable's type is determined by type inference, such as Pro engine cross-file type resolution. (LANG-583)

• Updated the ocaml-tree-sitter-core dependency to the latest main.

  • Fails loudly on a parser/runtime ABI mismatch
  • Stamps every generated parser.c with the tree-sitter version that produced it.
  • Changed paths where tree-sitter versions are installed (lang-591)

Changelog

Sourced from semgrep's changelog.

1.170.0 - 2026-07-15

### Added

• Pro C/C++ scans now skip code inside statically-dead preprocessor branches (for example, #if 0 ... #else ... #endif). Patterns that would otherwise match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)
• Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)
• semgrep install-semgrep-pro now sends usage metrics so that installation errors can be tracked. Metrics can be disabled with --metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also now include the method used to install the Semgrep CLI (pip, homebrew, docker, or unknown), detected heuristically. See metrics.md for more details of what exactly is sent. (engine-2858)

### Changed

• Increased the timeout for dynamic dependency resolution subprocesses from 600 to 900 seconds, giving large projects more time to resolve dependencies before timing out. (SC-3699)
• Pro C/C++ #if 0 filtering now also handles cases where the directive splits a syntactic unit. For example, a function signature toggle like #if 0 void foo(int i) { #else void foo(uint32_t i) { #endif. (engine-994)

### Fixed

• Fixed a crash at startup (Fatal error: Failed to allocate signal stack for domain 0) when running Semgrep on systems with musl 1.2.6 (e.g. Alpine 3.24) on recent Intel CPUs whose kernel-reported minimum signal-stack size exceeds musl's build-time SIGSTKSZ (notably AMX-capable Xeons). (ENGINE-2863)

• Dockerfile: Fixed parse errors on RUN instructions that use heredoc syntax (<<EOF, <<-EOF, quoted delimiters). (LANG-263)

• metavariable-type now supports fully qualified type names in languages where a qualified name in type position parses as an expression (e.g. Python's types: [a.b.C]) when the metavariable's type is determined by type inference, such as Pro engine cross-file type resolution. (LANG-583)

• Updated the ocaml-tree-sitter-core dependency to the latest main.

  • Fails loudly on a parser/runtime ABI mismatch
  • Stamps every generated parser.c with the tree-sitter version that produced it.
  • Changed paths where tree-sitter versions are installed (lang-591)

Commits

• bd614ac chore: release 1.170.0
• f3e8812semgrep/semgrep-proprietary#6571
• 2615498 fix(cpp, pro): handle #if 0 splits across syntactic units (semgrep/semgrep-...
• 490e1dc fix: bump OCaml compiler fork for musl signal-stack sizing (ENGINE-2863) (sem...
• 90d5913 fix: add Gc.compact after an ExceededMemoryLimit exception in Memory_limit to...
• aa977b9 feat(cpp, pro): prune statically-dead preprocessor #if branches (semgrep/se...
• c83f9bcsemgrep/semgrep-proprietary#6694
• 75b3783semgrep/semgrep-proprietary#6702
• 74b9404 fix: parse Dockerfile RUN instructions with heredoc syntax (semgrep/semgrep-p...
• 7cbfd85semgrep/semgrep-proprietary#6712
• Additional commits viewable in compare view

Updates ty from 0.0.58 to 0.0.61

Release notes

Sourced from ty's releases.

0.0.61

Release Notes

Released on 2026-07-17.

Bug fixes

• Avoid recursive protocol structural comparisons (#26721)

LSP server

• Render Google docstrings as structured Markdown (#26599)

Library support

• Pydantic: Collect field metadata through subscripted generic Annotated aliases (#26885)

Diagnostics

• Avoid extending own-line suppressions in --add-ignore (#26808)

Core type checking

• Derive descriptor setter domains for protocols (#26683)
• Enforce declared receiver TypeVar domains (#26863)
• Infer isinstance results for aliases and type variables (#26961)
• Infer isinstance results for fixed class tuples (#26935)
• Narrow inline list and set membership checks (#26955)
• Narrow tagged unions by tag truthiness (#26887)
• Narrow walrus expression values (#26949)
• Project intersections in to_instance (#26892)
• Remove inferable TypeVar artifacts recursively (#26787)
• Respect mixin receiver domains in method overrides (#26941)
• Support TypeVarTuple and Unpack (#25240)

Performance

• Deduplicate completion labels (#26890)
• Only collect expected types for files open in the editor (#25546)
• Parallelize subtype hierarchy search (#26875)
• Share heap-backed parser names with CharStr (#26594)
• Use the new incremental checker from the ignore crate (#26933)

Contributors

• @​MichaReiser
• @​denyszhak
• @​lerebear
• @​dhruvmanila
• @​charliermarsh

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.61

Released on 2026-07-17.

Bug fixes

• Avoid recursive protocol structural comparisons (#26721)

LSP server

• Render Google docstrings as structured Markdown (#26599)

Library support

• Pydantic: Collect field metadata through subscripted generic Annotated aliases (#26885)

Diagnostics

• Avoid extending own-line suppressions in --add-ignore (#26808)

Core type checking

• Derive descriptor setter domains for protocols (#26683)
• Enforce declared receiver TypeVar domains (#26863)
• Infer isinstance results for aliases and type variables (#26961)
• Infer isinstance results for fixed class tuples (#26935)
• Narrow inline list and set membership checks (#26955)
• Narrow tagged unions by tag truthiness (#26887)
• Narrow walrus expression values (#26949)
• Project intersections in to_instance (#26892)
• Remove inferable TypeVar artifacts recursively (#26787)
• Respect mixin receiver domains in method overrides (#26941)
• Support TypeVarTuple and Unpack (#25240)

Performance

• Deduplicate completion labels (#26890)
• Only collect expected types for files open in the editor (#25546)
• Parallelize subtype hierarchy search (#26875)
• Share heap-backed parser names with CharStr (#26594)
• Use the new incremental checker from the ignore crate (#26933)

Contributors

• @​MichaReiser
• @​denyszhak
• @​lerebear
• @​dhruvmanila
• @​charliermarsh
• @​BurntSushi

... (truncated)

Commits

• 56b2c24 Update changelog for 0.0.61 (#4028)
• 4c865c8 Bump version to 0.0.61 (#4027)
• ae554ec Bump version to 0.0.60 (#4008)
• 4f78ec5 Update astral-sh/setup-uv action to v8.3.2 (#3997)
• 0f9b587 Update prek dependencies (#3999)
• 9afd373 Update dependency prek to v0.4.8 (#3998)
• 391f499 Update docker/build-push-action action to v7.3.0 (#4000)
• 990dfce Update docker/login-action action to v4.4.0 (#4001)
• 1b1e873 Update docker/metadata-action action to v6.2.0 (#4002)
• aece09f Update docker/setup-buildx-action action to v4.2.0 (#4003)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.