Exempt the Astral-maintained uv package from the seven-day dependency
cooldown, replacing the temporary uv cutoff added in #29551. This allows
lockfile updates to select new uv releases without waiting seven days.
Codex prepared this update.
The [eMudhra incident](https://emudhra.we-have-a-problem.com/)
compromised intermediate CA keys that could be used to impersonate HTTPS
sites. uv 0.13.4 removes the emSign root that anchors the affected
intermediates from its bundled trust store.
Update the uv versions used in CI and by the uv-lock hook, and the
locked uv dependency. A uv-specific cutoff allows the updated release
through the seven-day dependency waiting period.
Codex prepared this update.
Enable `require-build-hashes` for the Python projects and inline scripts
so isolated builds require declared hashes for their build dependencies.
Pin the build backends and their dependencies with hashes.
---------
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
Black 26.10.0’s preview style adds missing blank lines after stub
functions whose bodies contain only a docstring, without inserting blank
lines within overload groups. Previously, this formatting behavior
required installing Black from Git. Switch typeshed formatting to the
released wheel so that Black no longer needs an exception to `no-build`,
and remove its unused build constraints.
Follow-up to #29151: upgrade the benchmark dependency from hyperfine
2.0.0-alpha.2 to 2.0.0.
Use `--env RAYON_NUM_THREADS=1` instead of an `env` command prefix for
the single-threaded formatter benchmarks. This avoids measuring the
overhead of `env` itself (~5 ms).
## Summary
Upgrade hyperfine to 2.0.0-alpha.2, which now includes support for
memory measurements (see output below).
Tested:
<details>
<summary>Formatter benchmark output</summary>
```text
Benchmark 1: ./target/release/ruff format ./fixture (2 runs)
mean ± σ min … max
Wall Time 12.8 ms ± 0.2 ms 12.7 ms … 12.9 ms
Memory 16.6 MiB ± 0.1 MiB 16.5 MiB … 16.6 MiB
Benchmark 2: black --no-cache ./fixture --safe (2 runs)
mean ± σ min … max
Wall Time 207.1 ms ± 4.8 ms 203.7 ms … 210.5 ms +1517.9% (16.2x slower)
Memory 37.3 MiB ± 0.1 MiB 37.2 MiB … 37.4 MiB +125.2% (2.3x more)
Benchmark 3: black --no-cache ./fixture --fast (2 runs)
mean ± σ min … max
Wall Time 226.6 ms ± 7.4 ms 221.4 ms … 231.9 ms +1670.7% (17.7x slower)
Memory 37.4 MiB ± 0.1 MiB 37.3 MiB … 37.5 MiB +126.2% (2.3x more)
Benchmark 4: black --no-cache ./fixture --safe --preview (2 runs)
mean ± σ min … max
Wall Time 250.1 ms ± 41.8 ms 220.6 ms … 279.6 ms +1854.3% (19.5x slower)
Memory 37.4 MiB ± 0.3 MiB 37.2 MiB … 37.6 MiB +126.0% (2.3x more)
Benchmark 5: black --no-cache ./fixture --fast --preview (2 runs)
mean ± σ min … max
Wall Time 186.2 ms ± 2.5 ms 184.5 ms … 188.0 ms +1355.1% (14.6x slower)
Memory 37.3 MiB ± 0.0 MiB 37.3 MiB … 37.3 MiB +125.2% (2.3x more)
Benchmark 6: autopep8 ./fixture --recursive --in-place (2 runs)
mean ± σ min … max
Wall Time 41.6 ms ± 0.7 ms 41.1 ms … 42.1 ms +225.2% (3.3x slower)
Memory 26.3 MiB ± 0.0 MiB 26.3 MiB … 26.3 MiB +58.8% (1.6x more)
Benchmark 7: yapf ./fixture --parallel --recursive --in-place (2 runs)
mean ± σ min … max
Wall Time 142.1 ms ± 4.8 ms 138.7 ms … 145.5 ms +1010.6% (11.1x slower)
Memory 29.1 MiB ± 0.3 MiB 28.9 MiB … 29.4 MiB +76.0% (1.8x more)
Benchmark 1: env RAYON_NUM_THREADS=1 ./target/release/ruff format ./fixture (2 runs)
mean ± σ min … max
Wall Time 12.7 ms ± 2.5 ms 10.9 ms … 14.4 ms
Memory 14.6 MiB ± 0.1 MiB 14.6 MiB … 14.7 MiB
Benchmark 2: black --no-cache ./fixture --workers=1 --safe (2 runs)
mean ± σ min … max
Wall Time 95.2 ms ± 3.2 ms 92.9 ms … 97.4 ms +650.6% (7.5x slower)
Memory 38.4 MiB ± 0.0 MiB 38.4 MiB … 38.4 MiB +162.6% (2.6x more)
Benchmark 3: black --no-cache ./fixture --workers=1 --fast (2 runs)
mean ± σ min … max
Wall Time 89.6 ms ± 2.8 ms 87.6 ms … 91.6 ms +606.5% (7.1x slower)
Memory 38.4 MiB ± 0.0 MiB 38.4 MiB … 38.4 MiB +162.7% (2.6x more)
Benchmark 4: black --no-cache ./fixture --workers=1 --safe --preview (2 runs)
mean ± σ min … max
Wall Time 94.7 ms ± 0.6 ms 94.3 ms … 95.2 ms +646.9% (7.5x slower)
Memory 38.5 MiB ± 0.1 MiB 38.5 MiB … 38.6 MiB +163.5% (2.6x more)
Benchmark 5: black --no-cache ./fixture --workers=1 --fast --preview (2 runs)
mean ± σ min … max
Wall Time 92.7 ms ± 0.6 ms 92.3 ms … 93.2 ms +631.4% (7.3x slower)
Memory 38.4 MiB ± 0.1 MiB 38.3 MiB … 38.4 MiB +162.5% (2.6x more)
Benchmark 6: autopep8 ./fixture --in-place --recursive --jobs=1 (2 runs)
mean ± σ min … max
Wall Time 43.5 ms ± 3.7 ms 40.9 ms … 46.1 ms +242.7% (3.4x slower)
Memory 26.5 MiB ± 0.1 MiB 26.4 MiB … 26.6 MiB +81.2% (1.8x more)
Benchmark 7: yapf ./fixture --recursive --in-place (2 runs)
mean ± σ min … max
Wall Time 56.8 ms ± 1.2 ms 55.9 ms … 57.6 ms +347.8% (4.5x slower)
Memory 27.3 MiB ± 0.1 MiB 27.2 MiB … 27.4 MiB +86.5% (1.9x more)
Benchmark 1: ./target/release/ruff format ./fixture --check (2 runs)
mean ± σ min … max
Wall Time 10.2 ms ± 0.3 ms 9.9 ms … 10.4 ms
Memory 16.9 MiB ± 0.1 MiB 16.8 MiB … 17.0 MiB
Benchmark 2: black --no-cache ./fixture --check --safe (2 runs)
mean ± σ min … max
Wall Time 193.8 ms ± 6.2 ms 189.5 ms … 198.2 ms +1806.9% (19.1x slower)
Memory 37.3 MiB ± 0.1 MiB 37.2 MiB … 37.4 MiB +120.8% (2.2x more)
Benchmark 3: black --no-cache ./fixture --check --fast (2 runs)
mean ± σ min … max
Wall Time 188.2 ms ± 1.9 ms 186.8 ms … 189.6 ms +1751.4% (18.5x slower)
Memory 37.3 MiB ± 0.1 MiB 37.3 MiB … 37.4 MiB +121.1% (2.2x more)
Benchmark 4: black --no-cache ./fixture --check --safe --preview (2 runs)
mean ± σ min … max
Wall Time 202.1 ms ± 6.3 ms 197.7 ms … 206.6 ms +1888.5% (19.9x slower)
Memory 37.2 MiB ± 0.0 MiB 37.2 MiB … 37.2 MiB +120.5% (2.2x more)
Benchmark 5: black --no-cache ./fixture --check --fast --preview (2 runs)
mean ± σ min … max
Wall Time 197.0 ms ± 20.1 ms 182.8 ms … 211.2 ms +1837.8% (19.4x slower)
Memory 37.2 MiB ± 0.0 MiB 37.2 MiB … 37.2 MiB +120.5% (2.2x more)
Benchmark 6: autopep8 ./fixture --recursive --diff (2 runs)
mean ± σ min … max
Wall Time 38.5 ms ± 0.1 ms 38.4 ms … 38.6 ms +278.4% (3.8x slower)
Memory 26.3 MiB ± 0.0 MiB 26.3 MiB … 26.4 MiB +56.0% (1.6x more)
Benchmark 7: yapf ./fixture --parallel --recursive --quiet (2 runs)
mean ± σ min … max
Wall Time 144.8 ms ± 7.4 ms 139.6 ms … 150.1 ms +1324.8% (14.2x slower)
Memory 29.0 MiB ± 0.2 MiB 28.9 MiB … 29.1 MiB +71.6% (1.7x more)
```
</details>
<details>
<summary>ty_benchmark (multi-threaded, then single-threaded)</summary>
```text
jinja
-----
Benchmark 1: ty (2 runs)
mean ± σ min … max
Wall Time 73.0 ms ± 5.6 ms 69.0 ms … 76.9 ms
Memory 100.1 MiB ± 0.1 MiB 100.0 MiB … 100.2 MiB
Warning: Ignoring non-zero exit code.
Benchmark 2: Pyrefly (2 runs)
mean ± σ min … max
Wall Time 118.3 ms ± 6.0 ms 114.0 ms … 122.5 ms +62.1% (1.6x slower)
Memory 130.9 MiB ± 0.2 MiB 130.8 MiB … 131.1 MiB +30.8% (1.3x more)
Warning: Ignoring non-zero exit code.
Benchmark 3: mypy (2 runs)
mean ± σ min … max
Wall Time 802.9 ms ± 8.0 ms 797.2 ms … 808.6 ms +1000.2% (11.0x slower)
Memory 143.4 MiB ± 0.1 MiB 143.3 MiB … 143.5 MiB +43.2% (1.4x more)
Warning: Ignoring non-zero exit code.
Benchmark 4: mypy (warm) (2 runs)
mean ± σ min … max
Wall Time 208.8 ms ± 5.6 ms 204.9 ms … 212.7 ms +186.1% (2.9x slower)
Memory 51.9 MiB ± 0.2 MiB 51.8 MiB … 52.0 MiB -48.2% (1.9x less)
Warning: Ignoring non-zero exit code.
Benchmark 5: Pyright (2 runs)
mean ± σ min … max
Wall Time 1198.8 ms ± 12.0 ms 1190.3 ms … 1207.3 ms +1542.8% (16.4x slower)
Memory 251.6 MiB ± 1.3 MiB 250.7 MiB … 252.5 MiB +151.3% (2.5x more)
Warning: Ignoring non-zero exit code.
jinja
-----
Benchmark 1: ty (2 runs)
mean ± σ min … max
Wall Time 226.1 ms ± 14.0 ms 216.2 ms … 236.0 ms
Memory 84.9 MiB ± 0.2 MiB 84.8 MiB … 85.0 MiB
Warning: Ignoring non-zero exit code.
Benchmark 2: Pyrefly (2 runs)
mean ± σ min … max
Wall Time 210.4 ms ± 6.9 ms 205.5 ms … 215.3 ms -7.0%
Memory 92.3 MiB ± 0.1 MiB 92.2 MiB … 92.4 MiB +8.8%
Warning: Ignoring non-zero exit code.
Benchmark 3: mypy (2 runs)
mean ± σ min … max
Wall Time 896.4 ms ± 88.8 ms 833.7 ms … 959.2 ms +296.4% (4.0x slower)
Memory 144.3 MiB ± 0.6 MiB 143.9 MiB … 144.7 MiB +70.0% (1.7x more)
Warning: Ignoring non-zero exit code.
Benchmark 4: mypy (warm) (2 runs)
mean ± σ min … max
Wall Time 213.0 ms ± 3.7 ms 210.4 ms … 215.6 ms -5.8%
Memory 51.7 MiB ± 0.1 MiB 51.6 MiB … 51.8 MiB -39.1% (1.6x less)
Warning: Ignoring non-zero exit code.
Benchmark 5: Pyright (2 runs)
mean ± σ min … max
Wall Time 981.9 ms ± 13.0 ms 972.6 ms … 991.1 ms +334.2% (4.3x slower)
Memory 315.4 MiB ± 5.9 MiB 311.2 MiB … 319.5 MiB +271.6% (3.7x more)
Warning: Ignoring non-zero exit code.
```
</details>
I also tested most of the other hyperfine invocations mentioned
somewhere in this repo.
## Summary
Continues #28197 by lifting `cargo-fuzz` into the dev toolchain.
<!-- What's the purpose of the change? What does it do, and why? -->
## Test Plan
NFC, internal only. I confirmed that `./init-fuzzer.sh` still runs as
expected. I'm less positive about the CI changes.
<!-- How was it tested? -->
---------
Signed-off-by: William Woodruff <william@yossarian.net>
Co-authored-by: Alex Waygood <Alex.Waygood@Gmail.com>
Python tooling can currently build third-party source distributions. Set
`no-build` in the maintained Python projects and PEP 723 scripts,
retaining named exceptions for Git-pinned tooling and the local
ecosystem runner. Pin the isolated build dependencies for those
exceptions, including their transitive requirements.
Follows merged astral-sh/ruff#27856, which gives the legacy `ruff-lsp`
suite a dedicated, locked Python 3.12 test environment.
Follow-up to astral-sh/ruff#27843. Replaces astral-sh/ruff#27840, which
closed when the merged docs branch was deleted.
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
The legacy `ruff-lsp` compatibility job installs the archived project's
entire development environment, including `mypy` and `typed-ast`, even
though it only runs pytest. Those frozen development dependencies
require source builds on Python 3.12.
Add a locked `ruff-lsp-test` dependency group containing the runtime and
test dependencies. Keep the suite on Python 3.12, the newest version
covered by the archived project's CI, and leave the published `ruff`
package out of the environment so the tests exercise the binary built
from this checkout.
This is the base for astral-sh/ruff#27861, which requires wheels for
Python tooling dependencies.
---------
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
<!--
Thank you for contributing to Ruff/ty! To help us out with reviewing,
please consider the following:
- Does this pull request include a summary of the change? (See below.)
- Does this pull request include a descriptive title? (Please prefix
with `[ty]` for ty pull
requests.)
- Does this pull request include references to any relevant issues?
- Does this PR follow our AI policy
(https://github.com/astral-sh/.github/blob/main/AI_POLICY.md)?
-->
## Summary
Adds explicit 7d cooldowns to all of our PEP 723 scripts, as well as
similar cooldowns via `.npmrc`.
<!-- What's the purpose of the change? What does it do, and why? -->
## Test Plan
NFC.
<!-- How was it tested? -->
---
<sub>Stack created with <a
href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a
href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub>
