Chore(deps-dev): Bump ty from 0.0.80 to 0.0.84

[dependabot]

Bumps ty from 0.0.80 to 0.0.84.

Release notes

Sourced from ty's releases.

0.0.84

Release Notes

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

• Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

• Complete string keys from dictionary initializers (#28820)
• Support LSP requests against closed documents (#28595)
• Select projects for external files using import search paths (#28594)
• Use workspace editor settings for external files (#28639)

Performance

• Avoid repeated subtyping checks for materialized recursive protocols (#28774)
• Skip reading notebooks when discovering scripts (#28781)

Core type checking

• Avoid incorrect simplification of TypeIs materializations (#28817)
• Fix disjointness of generic class types (#28787)
• Fix staticmethod shadowing through generic receivers and unions (#28766)
• Infer callable signatures from bounded type variables (#28599)
• Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
• Infer through optional generic containers in the legacy solver (#28791)
• Preserve call narrowing during cyclic inference (#28708)
• Preserve intersections of type guard return types (#28796)
• Use subtyping for constraint-set implication (#28657)

Configuration

• Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

• Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

• @​ibraheemdev
• @​zsol
• @​charliermarsh
• @​lerebear
• @​MichaReiser

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.84

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

• Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

• Complete string keys from dictionary initializers (#28820)
• Support LSP requests against closed documents (#28595)
• Select projects for external files using import search paths (#28594)
• Use workspace editor settings for external files (#28639)

Performance

• Avoid repeated subtyping checks for materialized recursive protocols (#28774)
• Skip reading notebooks when discovering scripts (#28781)

Core type checking

• Avoid incorrect simplification of TypeIs materializations (#28817)
• Fix disjointness of generic class types (#28787)
• Fix staticmethod shadowing through generic receivers and unions (#28766)
• Infer callable signatures from bounded type variables (#28599)
• Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
• Infer through optional generic containers in the legacy solver (#28791)
• Preserve call narrowing during cyclic inference (#28708)
• Preserve intersections of type guard return types (#28796)
• Use subtyping for constraint-set implication (#28657)

Configuration

• Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

• Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

• @​ibraheemdev
• @​zsol
• @​charliermarsh
• @​lerebear
• @​MichaReiser
• @​ewdurbin

... (truncated)

Commits

• 8dd9a7f Bump version to 0.0.84 (#4585)
• d4e4bf9 publish to astral-sh/versions via OIDC (#4581)
• 94ce733 use oidc issued token for docs publication (#4579)
• 901eeaa Update prek dependencies (#4576)
• 09bf0b1 Update docker/setup-buildx-action action to v4.3.0 (#4575)
• 89d6ffe Update astral-sh/setup-uv action to v10.2.0 (#4574)
• 9c21479 Bump version to 0.0.83 (#4569)
• 04c6911 Sync the ty security mirror (#4549)
• 3fa57a2 Grant the versions workflow repository read access (#4550)
• a15b353 use scoped token for release workflow (#4506)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 63485640-9d59-4691-9a09-de9588d5ff11

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (b8c5602) to head (3d73a4f).

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #71   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            5         5           
  Lines          161       161           
=========================================
  Hits           161       161           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.