chore(deps-dev): Bump strict-kwargs from 2026.6.8.post1 to 2026.7.24

[dependabot]

Bumps strict-kwargs from 2026.6.8.post1 to 2026.7.24.

Release notes

Sourced from strict-kwargs's releases.

Release 2026.7.24

2026.7.24

• Avoid false constructor diagnostics and unsafe fixes when a class call crosses multiple locally modeled runtime boundaries. Calls now remain unchanged when a local __new__ competes with __init__ or a custom metaclass __call__ can impose a different positional-only contract.

• Extend ty hover-answer reuse from self/cls attribute calls to every call on a stable name binding: any parameter, a module-level import/def/class, a single assignment (f = open(...), with open(...) as f), and bare-name calls on such bindings (Decimal(...), check(...)). Deferred calls that share a binding, an attribute, and a call-shape fingerprint now resolve from one hover/definition round trip instead of one per call site, cutting the CPython completeness run's ty request volume by about 17% (138k to 114k requests). Bindings stay grouped only while they are provably stable: any rebinding, del, augmented assignment, global/nonlocal, match subject or capture, narrowing test, or escape into a call poisons the group, a binding that shadows an enclosing name retroactively un-groups call sites recorded before it in the same scope (Python makes the name scope-local throughout), and class-body bindings never shadow names inside methods. The wider reuse also recovers nine CPython diagnostics that per-site queries had been losing to ty's answer instability (LibraryLoader.LoadLibrary, IdleConf.GetOption, ExitStack.enter_context, ...), with no entries lost on either completeness oracle.

  The whole-project pipeline now also streams: files needing the ty fallback are dispatched to the four shard servers in sorted order as soon as the parallel built-in pass finishes each file, so the servers work concurrently with the scan instead of idling until it drains, and a shard that never receives a query no longer starts a server at all. The first-party index build reads and parses candidate files in parallel as well (about 1.1s to 0.5s on a CPython checkout). Each server's request stream is byte-identical to the previous scan-then-shard pipeline's, so diagnostics are unchanged.

• Fix a regression in ty hover-answer reuse that dropped real diagnostics for calls grouped across a platform-specific branch. When a group's earliest call site sits in code ty considers unreachable (for example a sys.platform-guarded branch that is dead on the host platform), ty answers with the bottom type Never instead of the receiver's real signature. That answer was cached and reused for the whole group, suppressing the group's live members, which do resolve. Only a usable callable signature is now treated as the shared group answer, so a Never (or absent) answer at one member no longer hides violations at the others.

• Include Python environment modules and stubs in the persistent diagnostic cache fingerprint. Changes below a project .venv, VIRTUAL_ENV, or an

... (truncated)

Changelog

Sourced from strict-kwargs's changelog.

2026.7.24

• Avoid false constructor diagnostics and unsafe fixes when a class call crosses multiple locally modeled runtime boundaries. Calls now remain unchanged when a local __new__ competes with __init__ or a custom metaclass __call__ can impose a different positional-only contract.

• Extend ty hover-answer reuse from self/cls attribute calls to every call on a stable name binding: any parameter, a module-level import/def/class, a single assignment (f = open(...), with open(...) as f), and bare-name calls on such bindings (Decimal(...), check(...)). Deferred calls that share a binding, an attribute, and a call-shape fingerprint now resolve from one hover/definition round trip instead of one per call site, cutting the CPython completeness run's ty request volume by about 17% (138k to 114k requests). Bindings stay grouped only while they are provably stable: any rebinding, del, augmented assignment, global/nonlocal, match subject or capture, narrowing test, or escape into a call poisons the group, a binding that shadows an enclosing name retroactively un-groups call sites recorded before it in the same scope (Python makes the name scope-local throughout), and class-body bindings never shadow names inside methods. The wider reuse also recovers nine CPython diagnostics that per-site queries had been losing to ty's answer instability (LibraryLoader.LoadLibrary, IdleConf.GetOption, ExitStack.enter_context, ...), with no entries lost on either completeness oracle.

  The whole-project pipeline now also streams: files needing the ty fallback are dispatched to the four shard servers in sorted order as soon as the parallel built-in pass finishes each file, so the servers work concurrently with the scan instead of idling until it drains, and a shard that never receives a query no longer starts a server at all. The first-party index build reads and parses candidate files in parallel as well (about 1.1s to 0.5s on a CPython checkout). Each server's request stream is byte-identical to the previous scan-then-shard pipeline's, so diagnostics are unchanged.

• Fix a regression in ty hover-answer reuse that dropped real diagnostics for calls grouped across a platform-specific branch. When a group's earliest call site sits in code ty considers unreachable (for example a sys.platform-guarded branch that is dead on the host platform), ty answers with the bottom type Never instead of the receiver's real signature. That answer was cached and reused for the whole group, suppressing the group's live members, which do resolve. Only a usable callable signature is now treated as the shared group answer, so a Never (or absent) answer at one member no longer hides violations at the others.

• Include Python environment modules and stubs in the persistent diagnostic cache fingerprint. Changes below a project .venv, VIRTUAL_ENV, or an explicit --python environment now invalidate cached results instead of

... (truncated)

Commits

• d8a6874 Bump CHANGELOG and version for release
• 0e0d138 build: ignore LLVM profile raw files (#309)
• 402d359 Use explicit Python environment for resolution (#304)
• 1e72cc4 Avoid partial multi-file fixes (#305)
• a88ec56 Invalidate function signatures after rebinding (#289)
• 0afdb48 Preserve virtual environment precedence (#301)
• 1823ffd Validate PEP 263 cookie placement (#302)
• b9c9607 Handle broken stdout pipes (#299)
• 748acb1 Follow symlinked Python sources (#300)
• de66f1f Decode ASCII sources with declared codecs (#303)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)