build(deps-dev): bump the linters group with 2 updates

[dependabot]

Bumps the linters group with 2 updates: ty and zizmor.

Updates ty from 0.0.42 to 0.0.53

Release notes

Sourced from ty's releases.

0.0.53

Release Notes

Released on 2026-06-23.

Bug fixes

• Avoid bypassing lazy constraints for Divergent (#26288)
• Avoid recursion when projecting narrowing constraints (#26276)
• Fix ParamSpec callable signature extraction for callable instances (#26279)
• Make multi-arm TypeOf cycle recovery monotonic (#26275)

LSP server

• Document all special forms in ty_extensions (#26263)

Performance

• Avoid cloning fallback condition flow snapshots (#26203)
• Avoid constructing discarded speculative diagnostics (#26251)
• Avoid path lookups when sorting same-file diagnostics (#26257)
• Cache is_never_satisfied results (#26261)
• Defer applying type context to simple standalone expressions (#26252)

Core type checking

• Infer types for names bound in match patterns (#25940)
• Preserve regular kind for callable instances (#26253)
• Simplify intersections of invariant generic types with Any specializations (#26127)

Contributors

• @​charliermarsh
• @​MichaReiser
• @​AlexWaygood
• @​sharkdp
• @​ibraheemdev
• @​carljm

Install ty 0.0.53

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.53/ty-installer.sh | sh

Install prebuilt binaries via powershell script

</tr></table> 

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.53

Released on 2026-06-23.

Bug fixes

• Avoid bypassing lazy constraints for Divergent (#26288)
• Avoid recursion when projecting narrowing constraints (#26276)
• Fix ParamSpec callable signature extraction for callable instances (#26279)
• Make multi-arm TypeOf cycle recovery monotonic (#26275)

LSP server

• Document all special forms in ty_extensions (#26263)

Performance

• Avoid cloning fallback condition flow snapshots (#26203)
• Avoid constructing discarded speculative diagnostics (#26251)
• Avoid path lookups when sorting same-file diagnostics (#26257)
• Cache is_never_satisfied results (#26261)
• Defer applying type context to simple standalone expressions (#26252)

Core type checking

• Infer types for names bound in match patterns (#25940)
• Preserve regular kind for callable instances (#26253)
• Simplify intersections of invariant generic types with Any specializations (#26127)

Contributors

• @​charliermarsh
• @​MichaReiser
• @​AlexWaygood
• @​sharkdp
• @​ibraheemdev
• @​carljm

0.0.52

Released on 2026-06-22.

Bug fixes

• Avoid shadowing hints for attribute assignments (#26164)
• Fix dict.pop overloads to accept arbitrary keys with defaults (#26241)
• Normalize recursive TypeOf across multiple union arms (#26230)
• Normalize recursive TypeOf growth during cycle recovery (#26163)
• Normalize recursive protocol growth during cycle recovery (#26246)
• Preserve generic alias identity during cycle recovery (#26166)

... (truncated)

Commits

• 23f26f9 Bump version to 0.0.53 (#3841)
• 13f91b0 Bump version to 0.0.52 (#3828)
• bfc2b24 Document recent changes to how exit codes are determined (#3824)
• caf5e06 Move Python support guidance to FAQ (#3823)
• 03ec364 Document Python version support (#3821)
• 592a4bb Adjust mypy/pyright migration guide now that PYI033 checks .py files in p...
• d299a29 Document ty's Divergent type in the typing FAQ (#3809)
• b5ef61c Bump version to 0.0.51 (#3811)
• 0749dee Remove broken gradual guarantee link (#3806)
• 556d22c fix typo (#3805)
• Additional commits viewable in compare view

Updates zizmor from 1.25.2 to 1.26.1

Release notes

Sourced from zizmor's releases.

v1.26.1

This is a small corrective release for 1.26.0.

v1.26.0

New Features 🌈🔗

• New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#1985)

  Many thanks to @​andrew for proposing and implementing this improvement!

• New audit: unsound-ternary detects pseudo-ternary expressions that don't evaluate as expected (#2085)

  Many thanks to @​terror for proposing and implementing this improvement!

• New audit: adhoc-packages detects run: steps that install packages in an ad-hoc manner (#2061)

  Many thanks to @​connorshea for proposing and implementing this improvement!

Enhancements 🌱🔗

• The cache-poisoning audit now detects additional cache disablement heuristics (#2053)

• The known-vulnerable-actions audit is now configurable. See the configuration documentation for details (#2084)

• The excessive-permissions audit is now aware of the code-quality permission (#2088)

• The unpinned-uses audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @​v6) (#2127)

Performance Improvements 🚄🔗

• Most online audits are significantly faster, thanks to more precise retry handling (#2036) Bug Fixes 🐛🔗

• Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#2026)

  Many thanks to @​fionn for implementing this fix!

• Fixed a bug where ref-version-mismatch would fail to fully match some version comments (#2040)

• Fixed a bug where dependabot-cooldown would fail to honor the user's configured days when performing autofixes (#2055)

• Steps and jobs gated by statically-false if: conditions (e.g. if: false, if: ${{ false }}) are now skipped during auditing, since they cannot execute (#2059, #2069)

• Fixed a bug where ref-version-mismatch would fail to identify some valid version comments (#2073)

• Fixed a bug where unpinned-images would incorrectly flag empty matrix expansions as unpinned container image references (#2102)

• Fixed a bug where unpinned-images would incorrectly flag some matrix expansions as unpinned (#2098)

• The SARIF (--format=sarif) and GitHub Annotations (--format=github) output formats now provide more correct/useful paths, particularly when the user provides a relative path as input to zizmor rather than zizmor . (#1748, #2095)

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.26.1

This is a small corrective release for 1.26.0.

1.26.0

New Features 🌈

• New audit: [typosquat-uses] detects #!yaml uses: clauses that reference likely typoed actions (#1985)

  Many thanks to @​andrew for proposing and implementing this improvement!

• New audit: [unsound-ternary] detects pseudo-ternary expressions that don't evaluate as expected (#2085)

  Many thanks to @​terror for proposing and implementing this improvement!

• New audit: [adhoc-packages] detects #!yaml run: steps that install packages in an ad-hoc manner (#2061)

  Many thanks to @​connorshea for proposing and implementing this improvement!

Enhancements 🌱

• The [cache-poisoning] audit now detects additional cache disablement heuristics (#2053)

• The [known-vulnerable-actions] audit is now configurable. See the configuration documentation for details (#2084)

• The [excessive-permissions] audit is now aware of the code-quality permission (#2088)

• The [unpinned-uses] audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @v6) (#2127)

Performance Improvements 🚄

• Most online audits are significantly faster, thanks to more precise retry handling (#2036)

Bug Fixes 🐛

• Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#2026)

  Many thanks to @​fionn for implementing this fix!

• Fixed a bug where [ref-version-mismatch] would fail to fully match some version comments (#2040)

... (truncated)

Commits

• 597db4d zizmor 1.26.1 (#2137)
• 97037cd zizmor 1.26.0 (#2136)
• 3fecda6 Bump trophies (#2135)
• cdaf536 Add InputGroup::root (#2095)
• d7672f9 docs: fix release note references (#2132)
• 5420162 docs: pin manual uvx zizmor examples (#2131)
• e9d4a44 feat(unpinned-uses): pin to full version when fixing a major ref (#2127)
• e638658 [BOT] update JSON schemas from SchemaStore (#2126)
• 2c47399 chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group (#2125)
• cd68f65 chore(deps): bump the github-actions group across 1 directory with 3 updates ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.84%. Comparing base (2ef80b9) to head (4d66c69).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #257   +/-   ##
=======================================
  Coverage   93.84%   93.84%           
=======================================
  Files          14       14           
  Lines         585      585           
  Branches       51       51           
=======================================
  Hits          549      549           
  Misses         31       31           
  Partials        5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.