[dependabot]

Bumps the python group with 13 updates in the / directory:

Package	From	To
litellm	1.101.0	1.105.1
google-auth	2.55.1	2.62.0
boto3	1.43.36	1.43.113
pydantic	2.13.4	2.14.1
pydantic-settings	2.14.2	2.16.0
docker	7.1.0	7.2.0
caido-sdk-client	0.2.0	0.3.2
reportlab	5.0.0	5.0.1
pypdf	6.14.2	6.20.1
mypy	2.1.0	2.4.0
ruff	0.15.20	0.17.0
pyright	1.1.411	1.1.414
pre-commit	4.6.0	4.7.0

Updates litellm from 1.101.0 to 1.105.1

Release notes

Sourced from litellm's releases.

v1.105.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.105.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.105.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.105.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• fix(proxy): backport #44243 and #44508 to stable/1.105.x for v1.105.1 by @​kerry-berri in BerriAI/litellm#46313

Full Changelog: BerriAI/litellm@v1.105.0...v1.105.1

v1.105.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

</tr></table> 

... (truncated)

Commits

• d665dc1 Merge pull request #46313 from BerriAI/litellm_backport_44243_44508_stable_1_...
• 5ad0bf1 bump: version 1.105.1
• 1c183a5 fix(logging): log spend once for large non-streaming requests on the chat to ...
• 8980f37 perf(proxy): batch daily model usage writes instead of upserting per request ...
• 80b9556 Merge pull request #45927 from BerriAI/litellm_ui_bundle_rc_1_105_0
• 919f027 chore: update Next.js build artifacts (2026-10-11 06:00 UTC, node v24.19.0)
• f15af9b feat(ui): backport decision auto-router setup to 1.105 (#45915)
• 2616b1a Merge pull request #45905 from BerriAI/litellm_backport_decisions_rc_1_105_0
• fcbb022 chore(backport): merge rc/1.105.0 and move supported_decisions_providers to l...
• 23fec69 test(unit): flush queued logging tasks after each test so systemone callback ...
• Additional commits viewable in compare view

Updates google-auth from 2.55.1 to 2.62.0

Release notes

Sourced from google-auth's releases.

google-auth: v2.62.0

2.62.0 (2026-10-12)

Features

• auth: enable bound ID tokens by default on Cloud Run (#18635) (8b625c4)

google-auth: v2.61.0

2.61.0 (2026-10-07)

Features

• auth: support bound access and ID tokens for GKE (#18594) (9f5fd7b)

google-auth: v2.60.0

2.60.0 (2026-10-02)

Features

• auth: Support sync credentials in AsyncAuthorizedSession (#18542) (3799568)

Commits

• 5deaacb chore(main): release google-auth 2.62.0 (#18637)
• 8b625c4 feat(auth): enable bound ID tokens by default on Cloud Run (#18635)
• 98fc304 feat(dbapi): wire timeout parameter through Connection to execute_sql (#18484)
• 0cabf7c test(spanner): increase stale database cleanup cutoff to 3 hours (#18633)
• ab56473 perf(spanner): prune lock and begin event allocations on single-use snapshots...
• 78b9da2 fix(google-cloud-spanner): do not replay DDL statements on transaction retry ...
• f18a11e feat(db-dtypes): support pandas 3.1 (#18590)
• 590e43d fix(bigquery): accept empty sourceFormat fields (#18472)
• 05b3775 perf(spanner): optimize single-chunk results and single-row lookups (#18602)
• a7678fd fix(spanner): eliminate duplicate metrics capture and measure full streaming ...
• Additional commits viewable in compare view

Updates boto3 from 1.43.36 to 1.43.113

Commits

• 69ed308 Merge branch 'release-1.43.113'
• 741f8d9 Bumping version to 1.43.113
• ad1c6b5 Add changelog entries from botocore
• 9ca5e36 Merge branch 'release-1.43.112'
• f5581ba Merge branch 'release-1.43.112' into develop
• 6f065c3 Bumping version to 1.43.112
• a980c79 Add changelog entries from botocore
• c14ee96 Merge branch 'release-1.43.111'
• 3557491 Merge branch 'release-1.43.111' into develop
• 2309640 Bumping version to 1.43.111
• Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates pydantic-settings from 2.14.2 to 2.16.0

Release notes

Sourced from pydantic-settings's releases.

v2.16.0

Highlights

Breaking changes and behavior changes

• Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
• python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
• Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
• validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
• CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
• JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
• Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

• Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
• Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
• AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
• env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
• CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

• CliApp.serialize output now round-trips through CliApp.run for enums, tuples, dates and Decimals (#988), explicit None values (#981), empty containers (#1008), CliVariadicArg values (#976) and populated CliUnknownArgs fields, which previously raised IndexError (#992).
• Empty JSON arrays (--items []) now give an empty list instead of [''] (#994).
• Tuples, frozenset, MutableSequence and other collection subtypes are now treated as repeatable/variadic options (#972), and so are named collection type aliases such as TypeAliasType('Addrs', list[IPvAnyAddress]) (#1032).
• cli_exit_on_error=False is now honored in CliSubCommand parsers, which raise SettingsError instead of exiting (#977).
• CliSubCommand aliases keep their case with case_sensitive=False (#989).
• Each CliUnknownArgs field now receives only its own subcommand's leftover args (#1004).
• CliApp.format_help no longer crashes when cli_prefix is set in model_config (#945).

Type aliases and parsing

• Named union type aliases (TypeAliasType('V', list[int] | str)) now decode like their inline equivalents in env and dotenv sources, including under Optional, Annotated and custom validation aliases (#1006, #1030, #1041).
• Resolving a named Annotated type alias no longer mutates shared FieldInfo metadata, which made validators run twice on subclasses or after model_rebuild() (#979).
• A bare single-segment AliasPath('SOME_KEY') no longer tries to JSON-decode plain string values (#980).
• collections.abc.Set/MutableSet/typing.AbstractSet fields now JSON-decode env values (#973).
• A bare typing.Dict field with env_nested_delimiter no longer raises IndexError, which was a regression in 2.13.0 (#1009).
• Case-insensitive matching now works for nested pydantic dataclasses (#1010).

Dotenv, secrets and config files

• With extra='allow', a non-lowercase env_prefix is now stripped from dotenv extras (#959, #968).
• secrets_case_sensitive=True is now honored on Windows (#1001).
• An empty JSON config file is treated as an empty mapping instead of crashing (#947), matching YAML and TOML.
• TOML table headers: ~ paths are now expanded when checking that the file exists (#1034), and an explicit toml_table_header=() now overrides the model config to read the file root (#1027).

Cloud sources

• Azure Key Vault and GCP Secret Manager now honor env_parse_none_str (#1019, #1040).
• Azure Key Vault: dash_to_underscore=True now works for nested model fields (#1025).
• NestedSecretsSettingsSource now validates its specific constructor arguments (#975).

... (truncated)

Commits

• 8c259f4 Prepare release 2.16.0 (#1043)
• 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
• f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
• cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
• 081d39f Fix config file and CLI values being ignored when alias differs from validati...
• c46ebc4 Expand home paths when checking TOML table headers (#1034)
• 6ea85e6 Decode optional Annotated named union aliases (#1041)
• ca9d7c4 Fix JSON decoding for optional named union aliases (#1030)
• b6ddda2 Fix CLI parsing for named collection type aliases (#1032)
• bedb60e Honor explicit empty TOML table header overrides (#1027)
• Additional commits viewable in compare view

Updates docker from 7.1.0 to 7.2.0

Release notes

Sourced from docker's releases.

7.2.0

Upgrade Notes

• docker.from_env() now honors the active Docker CLI context when DOCKER_HOST is not set.
  • This means the client may connect to the daemon selected by DOCKER_CONTEXT or the current context in ~/.docker/config.json, matching Docker CLI behavior more closely.
  • If your application relied on the previous default connection behavior, set DOCKER_HOST explicitly, set DOCKER_CONTEXT=default, or pass use_context=False to DockerClient.from_env().
• Added docker.from_context() / DockerClient.from_context() for explicitly creating a client from a Docker CLI context.

Features

• Added support for Docker contexts when creating the default client
• Added subpath support for volumes

Bugfixes

• Fixed exec_run documentation for the stream parameter
• Fixed image loading to avoid depending on the deprecated JSONMessage.error field
• Preserved the rotated unlock key in swarm integration tests
• Fixed SSL certificate generation in tests
• Fixed IPv6 integration tests by explicitly enabling IPv6 where required

Miscellaneous

• Updated tests for newer Docker Engine behavior
• CI and build updates

What's Changed

• tests/exec: expect 127 exit code for missing executable by @​laurazard in docker/docker-py#3290
• fixing doc for stream param in exec_run by @​yasonk in docker/docker-py#3292
• Bump default API version to 1.45 (Moby 26.0/26.1) by @​thaJeztah in docker/docker-py#3261
• Set a dummy-version if none set, and remove unused APT_MIRROR build-arg by @​thaJeztah in docker/docker-py#3267
• test_service_logs: stop testing experimental versions by @​thaJeztah in docker/docker-py#2442
• Makefile: fix circular reference for integration-dind by @​thaJeztah in docker/docker-py#3297
• image load: don't depend on deprecated JSONMessage.error field by @​thaJeztah in docker/docker-py#3307
• integration: test_create_volume_invalid_driver allow either 400 or 404 by @​thaJeztah in docker/docker-py#3296
• integration: adjust tests for omitted "OnBuild" by @​thaJeztah in docker/docker-py#3336
• Implement Subpath Support for Volumes in Docker-Py (#3243) by @​Khushiyant in docker/docker-py#3270
• tests: fix ssl generation by @​thaJeztah in docker/docker-py#3365
• test/integration: don't check for deprecated Networks field by @​thaJeztah in docker/docker-py#3362
• test: Skip from_env_unix tests if DOCKER_HOST is network socket by @​ricardobranco777 in docker/docker-py#3366
• test_connect_with_ipv6_address: enable IPv6 by @​robmry in docker/docker-py#3372
• test_create_with_ipv6_address: enable IPv6 by @​robmry in docker/docker-py#3373
• tests: Migrate off gpg2 and regenerate key ed25519 by @​vvoland in docker/docker-py#3399
• gha: Pin to digests by @​vvoland in docker/docker-py#3408
• Fix integration tests on non-amd64 hosts and add ARM64 CI by @​vvoland in docker/docker-py#3407
• integration/swarm: Preserve rotated unlock key by @​vvoland in docker/docker-py#3410
• [DKP-2535] Honour context if present for default client, add contexts support by @​ebriney in docker/docker-py#3401
• docs: 7.2.0 changelog by @​vvoland in docker/docker-py#3415

New Contributors

• @​laurazard made their first contribution in docker/docker-py#3290
• @​yasonk made their first contribution in docker/docker-py#3292
• @​ricardobranco777 made their first contribution in docker/docker-py#3366

... (truncated)

Commits

• 5ad5327 Merge pull request #3415 from vvoland/update-changelog
• d242230 docs: 7.2.0 changelog
• ba01cc7 Merge pull request #3401 from ebriney/client-from-context
• ae5dfe9 Merge pull request #3410 from vvoland/fix-flaky
• aa99999 integration/swarm: Preserve rotated unlock key
• 059d371 Merge pull request #3407 from vvoland/fix-arm64
• 9b4b9b8 gha: Add arm64 integration CI
• 9e9f8ff Skip tests incompatible with host architecture
• e0542d9 Merge pull request #3408 from vvoland/gha-pin
• 578a11d gha: Pin to digests
• Additional commits viewable in compare view

Updates caido-sdk-client from 0.2.0 to 0.3.2

Commits

• See full diff in compare view

Updates reportlab from 5.0.0 to 5.0.1

Updates pypdf from 6.14.2 to 6.20.1

Release notes

Sourced from pypdf's releases.

Version 6.20.1, 2026-10-12

What's new

Security (SEC)

• Prevent cyclic tree handling (#4188) by @​stefan6419846

Bug Fixes (BUG)

• Only read the color operator from a text field's default appearance (#4158) by @​yaourtv

Full Changelog

Version 6.20.0, 2026-10-09

What's new

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173) by @​stefan6419846

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168) by @​stefan6419846

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164) by @​marshalltech81
• Parse numbers, indirect references, names and nulls faster (#4148) by @​MartinThoma
• Do not inherit PdfObject from a Protocol (#4149) by @​MartinThoma
• Speed up cloning direct objects (#4152) by @​MartinThoma

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154) by @​pasmud
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151) by @​metsw24-max

Robustness (ROB)

• Multiple changes by @​RavSinghChandan
• Accept an %%EOF marker that is not at the start of a line (#4136) by @​Dmao233
• Font / _cmapy.py: More robust guards around fontTools (#4157) by @​PJBrs
• Flatten the page tree iteratively (#4107) by @​MartinThoma
• Ignore invalid character codes for TrueType and Type1 font widths (#4117) by @​stefan6419846
• Restrict values to allowed range in CCITTFaxDecode (#4115) by @​stefan6419846
• Drop a /Kids entry resolving to null instead of raising a cycle error (#4108) by @​MartinThoma

Developer Experience (DEV)

• Declare official support for Python 3.15 by @​stefan6419846
• Declare protocol data members on PdfReader and PdfWriter (#4106) by @​ihsandeniz

Full Changelog

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

• Limit size of alphabetical page labels (#4096) by @​stefan6419846

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.20.1, 2026-10-12

Security (SEC)

• Prevent cyclic tree handling (#4188)

Bug Fixes (BUG)

• Only read the color operator from a text field's default appearance (#4158)

Full Changelog

Version 6.20.0, 2026-10-09

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173)

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168)

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164)
• Parse numbers, indirect references, names and nulls faster (#4148)
• Do not inherit PdfObject from a Protocol (#4149)
• Speed up cloning direct objects (#4152)

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154)
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151)

Robustness (ROB)

• Accept an %%EOF marker that is not at the start of a line (#4136)
• Font / _cmapy.py: More robust guards around fontTools (#4157)
• Flatten the page tree iteratively (#4107)
• Ignore invalid character codes for TrueType and Type1 font widths (#4117)
• Restrict values to allowed range in CCITTFaxDecode (#4115)
• Drop a /Kids entry resolving to null instead of raising a cycle error (#4108)

Developer Experience (DEV)

• Declare official support for Python 3.15
• Declare protocol data members on PdfReader and PdfWriter (#4106)

Full Changelog

Version 6.19.0, 2026-09-16

Security (SEC)

• Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979)

... (truncated)

Commits

• 628c060 REL: 6.20.1
• c9c35b4 SEC: Prevent cyclic tree handling (#4188)
• b4c6120 MAINT: Correct comments (#4184)
• 8ed783e BUG: Apply the sign of zero-hour XMP timezone offsets (#4182)
• b3f28fa MAINT: Enforce B904 (#4140)
• 146c750 DEV: Switch Python 3.15 from dev to release
• e497241 DEV: Fix for latest mypy
• b5557f0 BUG: Only read the colour operator from a text field's default appearance (#4...
• ece7730 ROB: Extract text with zero width in layout mode (#4174)
• 0309ab7 REL: 6.20.0
• Additional commits viewable in compare view

Updates mypy from 2.1.0 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

• You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
• Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
• Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

• 935ba8a Bump version to 2.4.0
• 334a678 Add link for PR 22066 in mypy 2.4 changelog (#22082)
• fe69660 Finalize mypy 2.4 changelog (#22080)
• 541fd87 Various mypy 2.4 changelog updates (#22077)
• <...

  Description has been truncated

[greptile-apps]

PR author is in the excluded authors list.