Skip to content

Bump mypy from 2.1.0 to 2.3.0#49

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/mypy-2.3.0
Open

Bump mypy from 2.1.0 to 2.3.0#49
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/mypy-2.3.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 19, 2026

Copy link
Copy Markdown
Contributor

Bumps mypy from 2.1.0 to 2.3.0.

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
  • 24c237d [mypyc] Improve documentation of Final (#21713)
  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
  • cbcb51a Narrow for frozendict membership check (#21709)
  • af2bc0f Sync typeshed (#21707)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [mypy](https://github.com/python/mypy) from 2.1.0 to 2.3.0.
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.1.0...v2.3.0)

---
updated-dependencies:
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates python Pull requests that update python code labels Jul 19, 2026
@coderabbitai

coderabbitai Bot commented Jul 19, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Summary by CodeRabbit

  • Chores
    • Updated the development type-checking tool to version 2.3.0.

Walkthrough

The development dependency pin for mypy is updated from version 2.1.0 to 2.3.0 in requirements-dev.txt.

Changes

Development dependency update

Layer / File(s) Summary
Update mypy development pin
requirements-dev.txt
Updates the pinned mypy version from 2.1.0 to 2.3.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: finallyjay

Poem

A bunny bumps the typing grain,
From two-one to two-three again.
Mypy hops with ears held high,
Fresh checks now sparkle by and by.
“Small pin,” says Bun, “big carrot pie!”

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The PR description does not follow the repo template; it lacks Summary, Changes, Test plan, and Related issues sections. Add the required sections with a brief summary, key change bullets, a verification/test plan, and any linked issues.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately summarizes the dependency bump from mypy 2.1.0 to 2.3.0.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dependabot/pip/mypy-2.3.0

Comment @coderabbitai help to get the list of available commands.

@coderabbitai
coderabbitai Bot requested a review from finallyjay July 19, 2026 05:03

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@requirements-dev.txt`:
- Line 6: Update the mypy revision in the pre-commit configuration to match the
requirements-dev.txt pin at version 2.3.0, ensuring both development dependency
management and pre-commit checks use the same version.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a444f43-fbee-452f-b753-c9da8ff5f5a4

📥 Commits

Reviewing files that changed from the base of the PR and between f0f6a92 and c83eed6.

📒 Files selected for processing (1)
  • requirements-dev.txt

Comment thread requirements-dev.txt
responses==0.26.1
ruff==0.15.20
mypy==2.1.0
mypy==2.3.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== requirements-dev.txt ==\n'
nl -ba requirements-dev.txt | sed -n '1,40p'

printf '\n== .pre-commit-config.yaml ==\n'
nl -ba .pre-commit-config.yaml | sed -n '1,120p'

Repository: finallyjay/packagist-tracker

Length of output: 234


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
for p in [Path('requirements-dev.txt'), Path('.pre-commit-config.yaml')]:
    print(f"\n== {p} exists={p.exists()} ==")
    if p.exists():
        text = p.read_text()
        for needle in ['mypy==', 'mirrors-mypy', 'rev:']:
            if needle in text:
                print(f"contains {needle}")
PY

Repository: finallyjay/packagist-tracker

Length of output: 301


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path

for path in [Path('requirements-dev.txt'), Path('.pre-commit-config.yaml')]:
    print(f"\n== {path} ==")
    if not path.exists():
        print("MISSING")
        continue
    for i, line in enumerate(path.read_text().splitlines(), 1):
        if 'mypy' in line or 'mirrors-mypy' in line or 'rev:' in line:
            print(f"{i}: {line}")
PY

Repository: finallyjay/packagist-tracker

Length of output: 379


Align the pre-commit mypy pin with the dev dependency. requirements-dev.txt is on mypy==2.3.0, but .pre-commit-config.yaml still uses rev: v2.1.0, so local checks can run a different mypy version and produce inconsistent results.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@requirements-dev.txt` at line 6, Update the mypy revision in the pre-commit
configuration to match the requirements-dev.txt pin at version 2.3.0, ensuring
both development dependency management and pre-commit checks use the same
version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants