build(deps-dev): bump ty from 0.0.78 to 0.0.84

[dependabot]

Bumps ty from 0.0.78 to 0.0.84.

Release notes

Sourced from ty's releases.

0.0.84

Release Notes

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

• Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

• Complete string keys from dictionary initializers (#28820)
• Support LSP requests against closed documents (#28595)
• Select projects for external files using import search paths (#28594)
• Use workspace editor settings for external files (#28639)

Performance

• Avoid repeated subtyping checks for materialized recursive protocols (#28774)
• Skip reading notebooks when discovering scripts (#28781)

Core type checking

• Avoid incorrect simplification of TypeIs materializations (#28817)
• Fix disjointness of generic class types (#28787)
• Fix staticmethod shadowing through generic receivers and unions (#28766)
• Infer callable signatures from bounded type variables (#28599)
• Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
• Infer through optional generic containers in the legacy solver (#28791)
• Preserve call narrowing during cyclic inference (#28708)
• Preserve intersections of type guard return types (#28796)
• Use subtyping for constraint-set implication (#28657)

Configuration

• Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

• Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

• @​ibraheemdev
• @​zsol
• @​charliermarsh
• @​lerebear
• @​MichaReiser

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.84

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

• Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

• Complete string keys from dictionary initializers (#28820)
• Support LSP requests against closed documents (#28595)
• Select projects for external files using import search paths (#28594)
• Use workspace editor settings for external files (#28639)

Performance

• Avoid repeated subtyping checks for materialized recursive protocols (#28774)
• Skip reading notebooks when discovering scripts (#28781)

Core type checking

• Avoid incorrect simplification of TypeIs materializations (#28817)
• Fix disjointness of generic class types (#28787)
• Fix staticmethod shadowing through generic receivers and unions (#28766)
• Infer callable signatures from bounded type variables (#28599)
• Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
• Infer through optional generic containers in the legacy solver (#28791)
• Preserve call narrowing during cyclic inference (#28708)
• Preserve intersections of type guard return types (#28796)
• Use subtyping for constraint-set implication (#28657)

Configuration

• Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

• Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

• @​ibraheemdev
• @​zsol
• @​charliermarsh
• @​lerebear
• @​MichaReiser
• @​ewdurbin

... (truncated)

Commits

• 8dd9a7f Bump version to 0.0.84 (#4585)
• d4e4bf9 publish to astral-sh/versions via OIDC (#4581)
• 94ce733 use oidc issued token for docs publication (#4579)
• 901eeaa Update prek dependencies (#4576)
• 09bf0b1 Update docker/setup-buildx-action action to v4.3.0 (#4575)
• 89d6ffe Update astral-sh/setup-uv action to v10.2.0 (#4574)
• 9c21479 Bump version to 0.0.83 (#4569)
• 04c6911 Sync the ty security mirror (#4549)
• 3fa57a2 Grant the versions workflow repository read access (#4550)
• a15b353 use scoped token for release workflow (#4506)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)