[dependabot]

Bumps the uv-development group with 7 updates in the / directory:

Package	From	To
aws-durable-execution-sdk-python-testing	1.2.1	1.3.0
pyrefly	1.3.2	1.4.0
basedpyright	1.40.1	1.40.2
hypothesis	6.168.3	6.170.8
poethepoet	0.48.0	0.49.0
coverage	7.16.2	7.17.0
tox	4.64.7	4.67.1

Updates aws-durable-execution-sdk-python-testing from 1.2.1 to 1.3.0

Commits

• See full diff in compare view

Updates pyrefly from 1.3.2 to 1.4.0

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.4.0

Release date: October 14, 2026

Pyrefly v1.4.0 bundles 1191 commits from 66 contributors.

---

Release Highlights

Language Server

• The VS Code extension now runs the Pyrefly from your environment. By default, the extension launches the Pyrefly installed in your active Python environment (for example, your project's .venv), so your editor and your command line use the same version. If the environment has no Pyrefly, the extension falls back to its bundled binary. Set pyrefly.pyreflyExecutable to bundled to keep the old behavior. See Pyrefly binary selection.

Configuration & CLI

• uv workspace members are now type checked. In a uv workspace, the interpreter puts each member's source directory on sys.path as an editable install. Pyrefly treated those directories as installed packages and skipped them, so errors in workspace members went unreported. Pyrefly now checks editable sources inside your project, while regular site-packages stay excluded.

Type Checking

• Easier migration from BasedPyright. Pyrefly reads basedpyright sections in pyproject.toml and applies the matching type checking mode preset.
• New opt-in checks for untyped code. New error kinds such as unknown-member-type, unknown-return-type, untyped-function-decorator, and uninitialized-instance-variable help you find where Any enters your code.

Tensor Shapes

• JAX shape stubs on PyPI. This is the first stable release that ships JAX shape stubs as the jax-pyrefly-stubs package.

---

⚠️ Behavior Changes

These may change your editor setup or surface new errors in code that checked cleanly under v1.3.0.

• The VS Code extension now uses the Pyrefly in your active environment by default instead of its bundled binary. If your environment pins an older Pyrefly, the editor now runs that version. The Pyrefly language server output channel shows which binary was chosen and why.
• Pyrefly now checks the source of uv workspace members (editable installs inside your project). Errors in those packages that were hidden before can now appear.
• --typeshed-path now replaces the bundled typeshed entirely instead of overlaying it.
• The incompatible-overload-residual error kind is renamed to incompatible-overload-argument. The old name still works as a deprecated alias.
• site-package-path is renamed to site-packages-path. The old name still works.

---

✨ New & Improved

Type Checking

• Pyrefly now recognizes basedpyright configuration sections in pyproject.toml and applies appropriate type checking mode presets, making it easier to migrate from BasedPyright.
• TypedDict handling has been significantly improved: generic extra_items are now instantiated correctly, extra items can supply missing arguments, and definitely_seen calculation in callable checking has been fixed.
• TypeVar restriction checking is now enforced even when the expected type is gradual, preventing silent violations of TypeVar bounds and constraints when Any appears in the expected type.
• Improved handling of overloaded function arguments in generic function calls through a new overload table mechanism, replacing the previous residual-based approach. The incompatible-overload-residual error kind has been renamed to incompatible-overload-argument (the old name remains as a deprecated alias).
• Variance inference has been improved with fixes for nested variance reliability bugs and explicit stored variance evidence.
• Property decorator validation now reports invalid signatures with extra required parameters.

... (truncated)

Commits

• feeee25 cut 1.4.0 (pick onto fbcode/releases/pyrefly/v1.4)
• e6294fc Ignore return-only vars when an overload decides whether it wins (#5241)
• 1c1516f Test an overloaded protocol method whose return var is invariant
• 5327270 Accept bare arrays with symbolic shapes
• 4e9f88b Reject python-version below 3.5 instead of crashing
• d142f67 Document bare shaped array incompatibility
• 96f8820 Extend the test for constructors with several matching overloads
• ea8421d Reject an overload that violates a restriction under a gradual expected type ...
• 03e1ade Cover restriction violations under a gradual expected type in overloaded cons...
• 2adc991 Respect custom new inherited from an intermediate NamedTuple subclass (#5...
• Additional commits viewable in compare view

Updates basedpyright from 1.40.1 to 1.40.2

Release notes

Sourced from basedpyright's releases.

v1.40.2 (pyright 1.1.414)

What's Changed

• Fix typeshed packaging for the browser-basedpyright npm package by @​BertalanD in DetachHead/basedpyright#1890
• generate builtin docstrings for python 3.15 by @​DetachHead in DetachHead/basedpyright#1895

Full Changelog: DetachHead/basedpyright@v1.40.1...v1.40.2

Commits

• 3447596 asdf
• 9c403f1 retry vscode publish because vs marketplace was down
• fa4b52d 1.40.2
• 3ca944f pin python version to 3.15
• 1f4822c add python 3.15 builtin docstrings
• 77cfb2d bump python dependencies & pnpm (#1877)
• a8a92cd formatting
• d55e86a Fix typeshed packaging for browser-basedpyright
• c63390c delete dependabot config. too much of a pain in the ass to configure it to no...
• 278e99c delete weekly typechecker benchmark workflow
• Additional commits viewable in compare view

Updates hypothesis from 6.168.3 to 6.170.8

Commits

• f0764a4 Bump hypothesis version to 6.170.8 and update changelog
• c134e15 Merge pull request #4936 from Zac-HD/claude/affectionate-pascal-e8sqgn
• a2406ed Bump hypothesis version to 6.170.7 and update changelog
• ecbcafa Don't enumerate collection "continue" draws in simplest probes
• 416fd28 Merge pull request #4916 from jorenham/typing/stateful/coverage
• d6dc78d Bump hypothesis version to 6.170.6 and update changelog
• d01ccc3 Merge pull request #4935 from Zac-HD/claude/gallant-meitner-6blj9q
• a511216 Skip zizmor in Claude Code remote environments
• 2e8c012 Ignore dateutil.zoneinfo deprecation warning in tests
• 1485498 Merge pull request #4907 from MarcoGorelli/pyrefly-cleanups
• Additional commits viewable in compare view

Updates poethepoet from 0.48.0 to 0.49.0

Release notes

Sourced from poethepoet's releases.

0.49.0

Enhancements

• Add true_string and false_string options to customize the string values that boolean args are exposed as by @​nat-n in nat-n/poethepoet#419
• Support the .yml file extension for poe_tasks.yml and included config files by @​Ab2nour in nat-n/poethepoet#426
• Remove the pastel dependency, leaving pyyaml (and tomli on older pythons) as the only runtime dependencies by @​nat-n in nat-n/poethepoet#411

Fixes

• Resolve glob patterns in cmd tasks after parameter expansion, so expansions and quotes inside square bracket patterns are respected and unmatched globs are passed on unescaped by @​nat-n in nat-n/poethepoet#425
• Handle absolute glob patterns (e.g. /etc/host*) and ** within a path component in cmd tasks instead of crashing by @​nat-n in nat-n/poethepoet#431
• Propagate errors and exit codes from failed subtasks: errors in a switch case or a ref'd task are no longer swallowed, and poe now exits with the exit code of the first failed subtask instead of 1 by @​nat-n in nat-n/poethepoet#430
• Resolve subtask arg defaults against the env inherited from the parent task by @​nat-n in nat-n/poethepoet#421
• Detect and report cyclic deps/uses instead of silently running nothing or crashing by @​nat-n in nat-n/poethepoet#421
• Report malformed, empty, and non-table config files with clear errors instead of tracebacks by @​nat-n in nat-n/poethepoet#428
• Fix boolean flags forwarded to python tasks being inverted when their default is templated by @​nat-n in nat-n/poethepoet#420

Breaking changes

These changes may affect a small number of existing configurations:

• Consistent sys.argv for Python tasks with declared args. Script tasks that call a function, and expr tasks, now get the same sys.argv as script tasks that run a module: declared args as parsed (with defaults applied), followed by any args given after --. Templates like ${VAR} in args given on the command line are also no longer expanded for these tasks, matching other task types. See the migration guide for an example. (nat-n/poethepoet#420)

• Square bracket glob patterns in cmd tasks are parsed like in bash. Whitespace, backslashes, quotes, and parameter expansions inside [...] are no longer taken literally, so e.g. [ -f foo ] is now four words rather than one pattern. To match a space or backslash, escape or quote it, e.g. [a\ b]. See the migration guide for details. (nat-n/poethepoet#425)

AI Agent Skill 🤖

• Teach the task graph (deps, uses, uses_env) and steer agents towards declarative poe features rather than bash logic by @​nat-n in nat-n/poethepoet#429

Upgrade an installed skill with:

poe _install_skill --upgrade

New Contributors

• @​Ab2nour made their first contribution in nat-n/poethepoet#426

Full Changelog: nat-n/poethepoet@v0.48.0...v0.49.0

Commits

• b8e96a9 Bump version to 0.49.0
• 98da6fe fix(cmd): handle absolute glob patterns and misplaced ** without crashing (...
• 5e67f11 fix: propagate errors and exit codes from failed subtasks (#430)
• 65f2390 fix!: resolve glob patterns in cmd tasks after parameter expansion (#425)
• 0f56a81 docs(skill): teach the task graph and steer bash logic to poe features (#429)
• eec9c33 fix!: consistent sys.argv for Python tasks with declared args (#420)
• ac60c37 fix(config): report malformed and non-table config files cleanly (#428)
• af160fe feat: support both .yaml and .yml file extensions (#426)
• 31b931e fix: resolve subtask arg defaults against the inherited env, and detect cycli...
• ee5b9bc feat: customize boolean argument string values (#419)
• Additional commits viewable in compare view

Updates coverage from 7.16.2 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.
• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
• Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.
• Fixes for obscure but legal file names:
  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.
  • A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.
• Fixes in the implementation of the C tracer:
  • If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.
  • The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.
  • The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.
  • An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.
• Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.
• Performance: HTML reports should be about 5% faster to produce.
• Kept the political banner in the README. Closes issue 2344.

➡️  PyPI page: coverage 7.17.0. :arrow_right:  To install: python3 -m pip install coverage==7.17.0

Changelog

Sourced from coverage's changelog.

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.

• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987_.

• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314_.

• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.

• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.

• Fix: The "Can't combine statement coverage data with branch data" error now names the two data files it couldn't combine. The :ref:error description <error_cant_combine> in the docs now lists common causes and how to find the process that wrote the file.

• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293_ and issue 2294_.

• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338_.

• Fixes for obscure but legal file names:

  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and ``coverage debug

... (truncated)

Commits

• 393ac71 docs: prep for 7.17.0
• 14257d3 test: check that 100% files haven't lost coverage
• db056ac docs: keep the ukraine banner #2344
• 6033660 fix: update the data file hash when a parallel data file is saved again (#2339)
• 99024b5 fix: clamp rate in XML report to prevent false 1.0/0.0 rounding and scientifi...
• ff62a02 refactor: remove unused caching branches
• 24d0b67 fix: KeyError for a with statement at the end of a finally clause (#2336)
• 934f5b8 chore: upgrade pip==26.2.2 certifi==2026.10.19
• f95c980 fix: triply nested with statements don't cause false branch misses #1987
• 6aaa858 docs: more changelog gardening
• Additional commits viewable in compare view

Updates tox from 4.64.7 to 4.67.1

Release notes

Sourced from tox's releases.

v4.67.1

Bug fixes

• Preserve ignore (-) and invert (!) exit code prefixes on commands when referenced via TOML { replace = "ref", ... }. (#4169)
• Installing from a pylock.toml with no dependency_groups selected now uses the lock file's default-groups, as PEP 751 specifies. Previously packages marked 'default' in dependency_groups (as written by pdm export -f pylock) were skipped by @​pcbeingused333. (#4173)
• A positional {factor:N} label in an env_base now resolves against that table's own factors, so with several env_base tables or an env_list product it no longer expands to an empty string. (#4174)

New Contributors

• @​saifmodan2006 made their first contribution in #4172
• @​pcbeingused333 made their first contribution in #4173
• @​spicysharkco made their first contribution in #4174

🐍 PyPI release

📜 Full Changelog

v4.67.0

Features

• Allow opting in to tox substitutions within TOML positional arguments with substitute = true. (#4165)

Bug fixes

• Keep capturing the output of the packaging backend with --no-capture, so tox --no-capture no longer hangs at started backend while waiting for the backend's reply. (#4163)
• A leading UTF-8 byte order mark in tox.ini, setup.cfg, tox.toml or a TOML pyproject.toml no longer stops the configuration from loading - editors on Windows may add one. (#4166)
• tox --no-provision <command> no longer treats the command as the JSON output path: a global option placed before a subcommand now keeps it, so tox --no-provision list lists the environments instead of writing a file named list. (#4168)

Documentation

• Link overridden argparse methods and logging.Handler.name in the plugin API reference. (#4170)

New Contributors

• @​syahra712 made their first contribution in #4164
• @​abdull-ah-med made their first contribution in #4167
• @​XXXXXQ-0206 made their first contribution in #4168

🐍 PyPI release

📜 Full Changelog

... (truncated)

Changelog

Sourced from tox's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-67-2:

---

4.67.2 (2026-10-27)

---

.. _release-4-67-2-packaging:

Packaging

• Releases now run on the shared tox-dev/github-workflows pipeline, with a locked release toolchain and generated GitHub Release notes (:pr:4202) by :user:gaborbernat.

.. _release-4-67-1:

---

4.67.1 (2026-10-18)

---

.. _release-4-67-1-fixed:

Fixed

• Preserve ignore (-) and invert (!) exit code prefixes on commands when referenced via TOML { replace = "ref", ... }. (:issue:4169)
• Installing from a pylock.toml with no :ref:dependency_groups selected now uses the lock file's default-groups, as :PEP:751 specifies. Previously packages marked 'default' in dependency_groups (as written by pdm export -f pylock) were skipped - by :user:pcbeingused333. (:issue:4173)
• A positional {factor:N} label in an env_base now resolves against that table's own factors, so with several env_base tables or an env_list product it no longer expands to an empty string. (:issue:4174)

.. _release-4-67-0:

---

4.67.0 (2026-10-17)

---

.. _release-4-67-0-added:

Added

... (truncated)

Commits

• 129a377 release 4.67.1
• 21d01be fix(config): resolve factor labels per env_base (#4174)
• 7a77f76 🐛 fix(pylock): use default-groups when no dependency group is selected (#4173)
• 59d3c99 fix(config): keep exit-code prefixes on TOML command references (#4172)
• 1de497f release 4.67.0
• 375a807 fix(config): read a UTF-8 BOM in the ini and TOML config sources (#4166)
• ba393c1 Allow opt-in substitution of TOML positional arguments (#4167)
• fa16bde fix(cli): --no-provision swallows the subcommand that follows it (#4168)
• e352fbe ♻️ refactor(docs): use public Sphinx hooks (#4171)
• 1d054ab 📝 docs(api): link overridden stdlib members (#4170)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

AI review: 1 P0-P2 finding(s)

Reviewed 99b94d0. Run log

Dependabot's grouped dev-dependency update bumps pyrefly, basedpyright (including the tox package-types pin), hypothesis, poethepoet, coverage, tox and aws-durable-execution-sdk-python-testing, and refreshes uv.lock to match. The bumps are low-risk, but the basedpyright pin change isn't mirrored in the quality-policy lock, so poe policy, and with it every CI poe checks job, will fail.

🟠 P1

• pyproject.toml:340 basedpyright tox pin bumped without updating the quality-policy lock and its digest, so poe policy fails

Not checked: The AI review read the diff, the code, and the PR's text; it ran no tests or builds and read nothing outside this repository.

• Whether uv 0.12.17, which CI pins, accepts the regenerated uv.lock header revision = 5 (previously 3) under uv sync --locked and uv run --locked.
• Whether pyrefly 1.4.0, which now reads [tool.basedpyright] and applies a matching preset, reports new errors in the mutmut type_check_command run over src/volcano_sdk.
• Whether the durable authoring tests still pass against aws-durable-execution-sdk-python 2.1.0 and its testing package 1.3.0, which the lock now resolves.
• Verify the upgraded dependency set passes quality and mutation checks across supported Python versions after synchronizing the policy snapshot.

Push a fix, or have a collaborator with write access (including the PR author) add the ai-review-override label to accept 99b94d0 as is. An override also needs a human review.

Human review: not needed

[github-actions]

🟠 P1: basedpyright tox pin bumped without updating the quality-policy lock and its digest, so poe policy fails

scripts/check_quality_policy.py (check_config) requires everything under [tool] in pyproject.toml to exactly match native_tool_config in maintainers/quality-policy.lock.json. This PR changes [tool.tox.env.package-types] deps to basedpyright==1.40.2, but the lock still records "basedpyright==1.40.1" at maintainers/quality-policy.lock.json:324. As a result, poe policy reports tool.tox.env.package-types.deps and exits 1. policy is the first step of poe checks, which CI runs on all four Python versions (.github/workflows/ci.yml:53), so every test job and the Quality Gate will fail. maintainers/releasing.md:42-46 documents this step for grouped updates that bump basedpyright.

Fix: change the lock entry to basedpyright==1.40.2, then recompute LOCK_SHA256 in scripts/check_quality_policy.py:21 from the new lock bytes. Without the digest update, check_lock_bytes also fails.

_{Found by claude-opus-5-5}

[github-actions]

🟠 P1: Update the policy snapshot and digest alongside the basedpyright pin

maintainers/quality-policy.lock.json still records basedpyright==1.40.1 for this environment. check_config in scripts/check_quality_policy.py compares the entire tool configuration against that snapshot and returns an error for tool.tox.env.package-types.deps. Since .github/workflows/ci.yml runs poe checks with policy first, every Python matrix job fails before the remaining checks run. Update the snapshot to 1.40.2 and its LOCK_SHA256 digest in the policy checker.

_{Found by gpt-6.1-sol}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.