chore(deps-dev): bump the python-packages group with 3 updates

[dependabot]

Updates the requirements on prek, ty and uv-build to permit the latest version.
Updates prek to 0.5.0

Release notes

Sourced from prek's releases.

0.5.0

Release Notes

Released on 2026-08-27.

Highlights

Choose where hook toolchains come from

language_version now accepts a source preference alongside the version request, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use managed (the default) or system to choose which source prek tries first while still allowing fallback and downloads. Use only-managed or only-system to require one source.

For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:

repos:
  - repo: local
    hooks:
      - id: ruff
        name: ruff
        language: python
        entry: ruff check
        additional_dependencies: [ruff]
        language_version:
          request: "3.12"
          preference: only-managed

With only-managed, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from PATH, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.

Existing scalar values such as language_version: "3.12" continue to work. See toolchain management and language_version for the full source-selection behavior. (#2613)

Breaking changes

The breaking changes in this release are mostly small cleanups, and most users should not be affected.

• Group names can no longer start with @. This prefix is now reserved for special group selectors such as the new @ungrouped selector. (#2617)
• PREK_MAX_CONCURRENCY has been removed. Use PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES to control hook and per-hook batch concurrency separately. (#2620)
• The top-level prek init-template-dir command has been removed. Use prek util init-template-dir, or prek init-templatedir for drop-in compatibility with pre-commit. (#2623)
• prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit. (#2619)

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.0

Released on 2026-08-27.

Highlights

Choose where hook toolchains come from

language_version now accepts a source preference alongside the version request, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use managed (the default) or system to choose which source prek tries first while still allowing fallback and downloads. Use only-managed or only-system to require one source.

For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:

repos:
  - repo: local
    hooks:
      - id: ruff
        name: ruff
        language: python
        entry: ruff check
        additional_dependencies: [ruff]
        language_version:
          request: "3.12"
          preference: only-managed

With only-managed, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from PATH, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.

Existing scalar values such as language_version: "3.12" continue to work. See toolchain management and language_version for the full source-selection behavior. (#2613)

Breaking changes

The breaking changes in this release are mostly small cleanups, and most users should not be affected.

• Group names can no longer start with @. This prefix is now reserved for special group selectors such as the new @ungrouped selector. (#2617)
• PREK_MAX_CONCURRENCY has been removed. Use PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES to control hook and per-hook batch concurrency separately. (#2620)
• The top-level prek init-template-dir command has been removed. Use prek util init-template-dir, or prek init-templatedir for drop-in compatibility with pre-commit. (#2623)
• prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit. (#2619)

Enhancements

... (truncated)

Commits

• 67f8535 Bump version to 0.5.0 (#2631)
• 4546bef Remove legacy init-template-dir command (#2623)
• e63bd4b Remove hook marker schema 0 (#2622)
• 8c433ae Remove config-tracking cache bootstrap (#2621)
• 62ca460 Remove PREK_MAX_CONCURRENCY (#2620)
• e2468ea Remove legacy update aliases (#2619)
• 795c3a4 Group run options in CLI help (#2629)
• b27eb6e Document prek run architecture (#2630)
• 7dd9aa9 Avoid persisting docs workflow credentials (#2627)
• 23815bd Remove the @builtin group selector (#2628)
• Additional commits viewable in compare view

Updates ty to 0.0.75

Release notes

Sourced from ty's releases.

0.0.75

Release Notes

Released on 2026-08-26.

Preview features

• Initialize PEP 723 script environments in the CLI (#27544)
• Refresh PEP 723 script environments in watch mode (#27617)
• Run PEP 723 script synchronization on bounded workers (#27615)

Bug fixes

• Specialize Self bounds of inherited methods (#27990)

LSP server

• Add "Go to Definition" support for pytest fixtures (#27444)

Documentation

• Fix documented Python package build command (#4384)
• Link untyped-call tracking issue in migration guide (#4382)

Library support

• Resolve imported pytest fixture exposures (#27539)
• Resolve installed core pytest fixture providers (#27770)
• Resolve pytest fixtures through conftest (#27540)

Diagnostics

• Add more autofixes (#28029)
• Add a dedicated missing-slot diagnostic (#28039)
• Explain missing storage for declared slotted attributes (#27969)
• Improve diagnostic spans for unpacked variable assignments (#28041)

Core type checking

• Account for known subclasses in equality inference (#28005)
• Expand ParamSpec signatures inferred from bound receivers (#28020)
• Fix Self binding in ParamSpec protocols (#28016)
• Fix TypedDict variance inference (#28052)
• Fix unsound narrowing through branch-assigned conditions (#28006)
• Ignore inconsistent binding decorators on overloads (#28036)
• Infer yield from send/return types from the iterator returned by __iter__ (#27987)
• Infer tuple type parameters from union arguments (#28062)
• Infer variance through nonrecursive protocol references (#28065)
• Preserve bounds of non-literal metaclasses (#28046)
• Preserve correlated generic-call inference (#28043)

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.75

Released on 2026-08-26.

Preview features

• Initialize PEP 723 script environments in the CLI (#27544)
• Refresh PEP 723 script environments in watch mode (#27617)
• Run PEP 723 script synchronization on bounded workers (#27615)

Bug fixes

• Specialize Self bounds of inherited methods (#27990)

LSP server

• Add "Go to Definition" support for pytest fixtures (#27444)

Documentation

• Fix documented Python package build command (#4384)
• Link untyped-call tracking issue in migration guide (#4382)

Library support

• Resolve imported pytest fixture exposures (#27539)
• Resolve installed core pytest fixture providers (#27770)
• Resolve pytest fixtures through conftest (#27540)

Diagnostics

• Add more autofixes (#28029)
• Add a dedicated missing-slot diagnostic (#28039)
• Explain missing storage for declared slotted attributes (#27969)
• Improve diagnostic spans for unpacked variable assignments (#28041)

Core type checking

• Account for known subclasses in equality inference (#28005)
• Expand ParamSpec signatures inferred from bound receivers (#28020)
• Fix Self binding in ParamSpec protocols (#28016)
• Fix TypedDict variance inference (#28052)
• Fix unsound narrowing through branch-assigned conditions (#28006)
• Ignore inconsistent binding decorators on overloads (#28036)
• Infer yield from send/return types from the iterator returned by __iter__ (#27987)
• Infer tuple type parameters from union arguments (#28062)
• Infer variance through nonrecursive protocol references (#28065)
• Preserve bounds of non-literal metaclasses (#28046)
• Preserve correlated generic-call inference (#28043)
• Preserve invariant materialization constraints (#28047)

... (truncated)

Commits

• a553dcc Bump version to 0.0.75 (#4396)
• 26b1b50 Update prek dependencies (#4392)
• 73d226e Fix documented Python package build command (#4384)
• 5e264da Link untyped-call tracking issue in migration guide (#4382)
• 00199f0 Bump version to 0.0.74 (#4351)
• 5769062 Update mypy/pyright comparison table (#4165)
• 4fcb060 Remove Zulip from the PGO training (#4336)
• a7a7064 Use the versions bot's ruleset bypass when merging (#4333)
• 01b0fab Update prek dependencies (#4325)
• deef42f Update dependency python to 3.14 (#4326)
• Additional commits viewable in compare view

Updates uv-build to 0.12.7

Release notes

Sourced from uv-build's releases.

0.12.7

Release Notes

Released on 2026-08-27.

Python

• Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

• Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
• Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

• Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

• Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

• remove pyx specific features (#21182, #21183, #21184, #21185, #21186)

Install uv 0.12.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex"

Download uv 0.12.7

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.12.7

Released on 2026-08-27.

Python

• Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

• Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
• Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

• Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

• Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

• remove pyx specific features (#21182, #21183, #21184, #21185, #21186)

0.12.6

Released on 2026-08-25.

Python

• Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295)

Enhancements

• Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#21261)
• Limit warnings about unbounded uv_build requirements to source-distribution builds (#21078)
• Display byte counts below 1 KiB without a fractional part (#21237)

Preview features

• Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#21117)
• Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#21235)
• Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#21227)
• Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#21146)

Performance

• Enable profile-guided optimization for Linux x86-64 release binaries (#21001)
• Enable profile-guided optimization for Windows x86-64 release binaries (#21003)
• Enable profile-guided optimization for macOS ARM64 release binaries (#21002)

... (truncated)

Commits

• 61291a8 Bump version to 0.12.7 (#21328)
• dd217b8 de-pyx-ify malformed bearer token test (#21326)
• 306ee9c remove references to pyx in RFC 9457 handling code (#21187)
• 6186dcb remove pyx authentication (#21186)
• f61b300 remove pyx publication support (#21185)
• ba19067 remove support for pyx-specific .whl.tar.zst format (#21184)
• ad852ce fix PR labeler automation (#21325)
• 156dd51 Replace Python installations during build upgrades (#21323)
• 1a486d1 Add coverage for Python build upgrades (#21320)
• 17b195b Retry private Azure downloads with authentication (#21318)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

🟡 Changes recommended

The undocumented lockfile-only policy would prevent some future dependency upgrades.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates Python development tooling and its lockfile.

Changes:

• Raises prek, ty, and uv-build requirements.
• Resolves prek 0.5.1 and ty 0.0.77.
• Adds a lockfile-only Dependabot policy.

File summaries

File	Description
pyproject.toml	Updates development and build requirements.
uv.lock	Locks updated tool versions and artifacts.
.github/dependabot.yml	Changes future Python update behavior.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.