chore(deps): update python dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mypy (changelog)	1.19.1 → 1.20.0
pytest (changelog)	9.0.2 → 9.0.3
requests (changelog)	2.33.0 → 2.33.1
ruff (source, changelog)	0.15.7 → 0.15.10

---

Release Notes

python/mypy (mypy)

v1.20.0

Compare Source

pytest-dev/pytest (pytest)

v9.0.3

Compare Source

pytest 9.0.3 (2026-04-07)

Bug fixes

• #​12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #​13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #​13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #​14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #​14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #​13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #​13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #​14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #​14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #​12689: The test reports are now published to Codecov from GitHub Actions.
  The test statistics is visible on the web interface.

  -- by aleguy02

psf/requests (requests)

v2.33.1

Compare Source

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
  files in the tmp directory. (#​7305)
• Fixed Content-Type header parsing for malformed values. (#​7309)
• Improved error consistency for malformed header values. (#​7308)

astral-sh/ruff (ruff)

v0.15.10

Compare Source

Released on 2026-04-09.

Preview features

• [flake8-logging] Allow closures in except handlers (LOG004) (#​24464)
• [flake8-self] Make SLF diagnostics robust to non-self-named variables (#​24281)
• [flake8-simplify] Make the fix for collapsible-if safe in preview (SIM102) (#​24371)

Bug fixes

• Avoid emitting multi-line f-string elements before Python 3.12 (#​24377)
• Avoid syntax error from E502 fixes in f-strings and t-strings (#​24410)
• Strip form feeds from indent passed to dedent_to (#​24381)
• [pyupgrade] Fix panic caused by handling of octals (UP012) (#​24390)
• Reject multi-line f-string elements before Python 3.12 (#​24355)

Rule changes

• [ruff] Treat f-string interpolation as potential side effect (RUF019) (#​24426)

Server

• Add support for custom file extensions (#​24463)

Documentation

• Document adding fixes in CONTRIBUTING.md (#​24393)
• Fix JSON typo in settings example (#​24517)

Contributors

• @​charliermarsh
• @​dylwil3
• @​silverstein
• @​anishgirianish
• @​shizukushq
• @​zanieb
• @​AlexWaygood

v0.15.9

Compare Source

Released on 2026-04-02.

Preview features

• [pyflakes] Flag annotated variable redeclarations as F811 in preview mode (#​24244)
• [ruff] Allow dunder-named assignments in non-strict mode for RUF067 (#​24089)

Bug fixes

• [flake8-errmsg] Avoid shadowing existing msg in fix for EM101 (#​24363)
• [flake8-simplify] Ignore pre-initialization references in SIM113 (#​24235)
• [pycodestyle] Fix W391 fixes for consecutive empty notebook cells (#​24236)
• [pyupgrade] Fix UP008 nested class matching (#​24273)
• [pyupgrade] Ignore strings with string-only escapes (UP012) (#​16058)
• [ruff] RUF072: skip formfeeds on dedent (#​24308)
• [ruff] Avoid re-using symbol in RUF024 fix (#​24316)
• [ruff] Parenthesize expression in RUF050 fix (#​24234)
• Disallow starred expressions as values of starred expressions (#​24280)

Rule changes

• [flake8-simplify] Suppress SIM105 for except* before Python 3.12 (#​23869)
• [pyflakes] Extend F507 to flag %-format strings with zero placeholders (#​24215)
• [pyupgrade] UP018 should detect more unnecessarily wrapped literals (UP018) (#​24093)
• [pyupgrade] Fix UP008 callable scope handling to support lambdas (#​24274)
• [ruff] RUF010: Mark fix as unsafe when it deletes a comment (#​24270)

Formatter

• Add nested-string-quote-style formatting option (#​24312)

Documentation

• [flake8-bugbear] Clarify RUF071 fix safety for non-path string comparisons (#​24149)
• [flake8-type-checking] Clarify import cycle wording for TC001/TC002/TC003 (#​24322)

Other changes

• Avoid rendering fix lines with trailing whitespace after | (#​24343)

Contributors

• @​charliermarsh
• @​MichaReiser
• @​tranhoangtu-it
• @​dylwil3
• @​zsol
• @​renovate
• @​bitloi
• @​danparizher
• @​chinar-amrutkar
• @​second-ed
• @​getehen
• @​Redovo1
• @​matthewlloyd
• @​zanieb
• @​InSyncWithFoo
• @​RenzoMXD

v0.15.8

Compare Source

Released on 2026-03-26.

Preview features

• [ruff] New rule unnecessary-if (RUF050) (#​24114)
• [ruff] New rule useless-finally (RUF072) (#​24165)
• [ruff] New rule f-string-percent-format (RUF073): warn when using % operator on an f-string (#​24162)
• [pyflakes] Recognize frozendict as a builtin for Python 3.15+ (#​24100)

Bug fixes

• [flake8-async] Use fully-qualified anyio.lowlevel import in autofix (ASYNC115) (#​24166)
• [flake8-bandit] Check tuple arguments for partial paths in S607 (#​24080)
• [pyflakes] Skip undefined-name (F821) for conditionally deleted variables (#​24088)
• E501/W505/formatter: Exclude nested pragma comments from line width calculation (#​24071)
• Fix %foo? parsing in IPython assignment expressions (#​24152)
• analyze graph: resolve string imports that reference attributes, not just modules (#​24058)

Rule changes

• [eradicate] ignore ty: ignore comments in ERA001 (#​24192)
• [flake8-bandit] Treat sys.executable as trusted input in S603 (#​24106)
• [flake8-self] Recognize Self annotation and self assignment in SLF001 (#​24144)
• [pyflakes] F507: Fix false negative for non-tuple RHS in %-formatting (#​24142)
• [refurb] Parenthesize generator arguments in FURB142 fixer (#​24200)

Performance

• Speed up diagnostic rendering (#​24146)

Server

• Warn when Markdown files are skipped due to preview being disabled (#​24150)

Documentation

• Clarify extend-ignore and extend-select settings documentation (#​24064)
• Mention AI policy in PR template (#​24198)

Other changes

• Use trusted publishing for NPM packages (#​24171)

Contributors

• @​bitloi
• @​Sim-hu
• @​mvanhorn
• @​chinar-amrutkar
• @​markjm
• @​RenzoMXD
• @​vivekkhimani
• @​seroperson
• @​moktamd
• @​charliermarsh
• @​ntBre
• @​zanieb
• @​dylwil3
• @​MichaReiser

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.