merge upstream astral-sh/ruff (222 commits, jul 9 → jul 22 2026)

merges `upstream/main` at 47d7184 into the fork. 45 conflicts resolved;
typeshed regenerated from scratch; full suite green (10355 tests), ci insta
gate clean, clippy and prek clean.

notable ripples from upstream refactors:

- salsa `Update` derive renamed to `SalsaValue`; tracked functions and
  interned fields now return references unless marked `returns(copy)`
- `Type::to_instance` returns an `InstanceProjection`; fork call sites that
  only need the type use `to_instance_approximation`
- the parser collects into `expr_scratch`/`stmt_scratch` buffers, so the
  fork's subscript and simple-statement hooks push there instead. the
  `context`-parameter validation had to move after the buffers are drained,
  or it inspected empty parameter lists and never fired
- upstream's two-tier expression cache replaces the fork's
  `(expression, tcx) -> Type` map; the fluid fields are threaded through
  `FullExpressionCacheEntry`
- `check_file` became a salsa query; `apply_overrides` became
  `apply_override_options`
- `ProtocolMemberWrite` wraps the write capability, so the reified-member
  lookup goes through `domain()`
- pydantic field metadata moved behind `pydantic::field_metadata`, which
  gains the fork's `frozen` flag

fluid specializations needed a real fix: upstream now specializes a generic
call's parameter type from the arguments themselves, so every generic call
recorded a self-derived "adoption" and locked the specialization. argument
contexts built that way are marked `inferred_from_argument` and no longer
count as external observers.

the typeshed patch pipeline is reproducible from scratch again:
`container_overlapping` moved to the post-conversion pass (it matches the
converted `Element`/`Key` names and collided with `mapping` in pass 1), and
the sync script now runs the patches to a fixed point, since
`private type _X` only becomes visible after `TypeAliasStatements` writes
the `type _X = …` statement.

fork divergences newly exposed by upstream tests are annotated in place:
`isinstance(x, (List,))` through the recursive pep 695 `_ClassInfo` alias,
covariant `Mapping` keys not widening to the declared key type, `in` on a
provably-disjoint container erroring under `Overlapping`, and a `reveal_type`
in the arguments of a fluid-receiver call reporting an intermediate pass.

Author: KotlinIsland

.agents/skills/minimizing-ty-ecosystem-changes/SKILL.md

@@ -25,6 +25,8 @@ scripts/collect_ty_ecosystem_run_metadata.py \
 
 The manifest contains the analyzed Ruff revisions, Actions `EXCLUDE_NEWER`, ecosystem-analyzer and mypy-primer revisions, and each project's CI Python version. Stop if the helper cannot determine a unique value; never substitute a comment timestamp or local default.
 
+The current workflow splits compilation into `Build ty (base)` and `Build ty (pr)`. The helper reads the base job, which records both the merge base and PR merge revision, and still supports historical runs with a single `Build ty` job.
+
 ## Prepare ty
 
 If a primary agent supplied freshly copied base and PR binaries plus the PR ecosystem config, verify the paths exist and reuse them. Do not rebuild, switch Ruff refs, or overwrite the shared artifacts.

.agents/skills/wobbling-ty-constraint-order/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: wobbling-ty-constraint-order
+description: >
+  Use when a user asks to wobble ty constraint ordering, check constraint-set or TDD ordering
+  determinism, test reversed constraint/typevar IDs, or investigate nondeterministic ty inference
+  and mdtest results.
+compatibility: >
+  Requires Cargo, mktemp, and a POSIX-compatible shell; uses cargo-nextest when available and
+  otherwise falls back to cargo test.
+---
+
+# Wobbling ty constraint order
+
+`TY_CONSTRAINT_SET_ORDER` perturbs both the builder-local TDD-variable order and the local typevar order used to orient typevar-to-typevar constraints. The setting is fixed for the lifetime of each test process.
+
+- unset/`0`: normal ordering;
+- `reverse`: reverse both orderings;
+- an integer: XOR each local ID with that mask. Small masks immediately perturb dense arena IDs: `1` swaps adjacent IDs, `3` reverses blocks of four, and powers of two exchange neighboring blocks.
+
+This deliberately changes internal TDD shape. Run **mdtests only**: graph-structure unit snapshots are expected to differ. Never enable snapshot updates for a wobble run, since updating would hide the failures being sought.
+
+## Run
+
+From the Ruff root, first establish the normal baseline, then run the reversed and XOR-masked orders sequentially. Set `TY_CONSTRAINT_ORDER_LOG_DIR` to retain logs in a particular writable directory; otherwise `mktemp` chooses an appropriate temporary directory (respecting the environment's temporary-directory configuration).
+
+```bash
+set -u
+
+if test -n "${TY_CONSTRAINT_ORDER_LOG_DIR:-}"; then
+    log_dir="$TY_CONSTRAINT_ORDER_LOG_DIR"
+    mkdir -p "$log_dir"
+else
+    log_dir="$(mktemp -d -t ty-constraint-order.XXXXXXXX)"
+fi
+printf '%s\n' "logs: $log_dir"
+
+if cargo nextest --version >/dev/null 2>&1; then
+    runner=nextest
+else
+    runner=test
+fi
+printf '%s\n' "runner: cargo $runner"
+
+export CARGO_PROFILE_DEV_OPT_LEVEL=1
+export CARGO_PROFILE_DEV_DEBUG=line-tables-only
+export INSTA_UPDATE=no
+export MDTEST_UPDATE_SNAPSHOTS=0
+unset INSTA_FORCE_PASS || true
+
+for order in normal reverse 1 2 3 4 7 8 15; do
+    if test "$order" = normal; then
+        unset TY_CONSTRAINT_SET_ORDER || true
+    else
+        export TY_CONSTRAINT_SET_ORDER="$order"
+    fi
+
+    log="$log_dir/ty-constraint-order-${order}.log"
+    if test "$runner" = nextest; then
+        cargo nextest run -p ty_python_semantic --test mdtest \
+            --no-fail-fast --status-level fail --failure-output immediate-final \
+            >"$log" 2>&1
+    else
+        cargo test -p ty_python_semantic --test mdtest >"$log" 2>&1
+    fi
+    status=$?
+
+    printf '%-7s exit=%s\n' "$order" "$status"
+    grep -E 'Summary \[|test result:' "$log" | tail -1 || true
+    printf '%s\n' "  log: $log"
+done
+```
+
+Read each failing log and report the mdtest file, section, line, expected result, and actual diagnostic/revealed type. A wobble failure is evidence that inference semantics or displayed solution types still depend on ordering; do not update the mdtest expectations merely to make the wobble run green.
+
+The knob does **not** perturb hashing of Salsa-backed values. The `Solution binding order follows constraint source order` section of `regression/constraint_set_ordering.md` separately varies typevar declaration order to catch binding-order changes caused by draining an `FxHashMap<BoundTypeVarInstance, ...>`.

.github/actionlint.yaml

@@ -8,7 +8,7 @@ self-hosted-runner:
     - depot-ubuntu-latest-8
     - depot-ubuntu-22.04-16
     - depot-ubuntu-22.04-32
-    - depot-macos-15
+    - namespace-profile-macos-15
     - depot-windows-2022-16
     - depot-ubuntu-22.04-arm-4
     - github-windows-2025-x86_64-8

.github/workflows/build-binaries.yml

@@ -66,7 +66,7 @@ jobs:
 
   macos-x86_64:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
-    runs-on: macos-15
+    runs-on: ${{ github.repository == 'astral-sh/ruff' && 'namespace-profile-macos-15' || 'macos-15' }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -96,7 +96,7 @@ jobs:
 
   macos-aarch64:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
-    runs-on: macos-15
+    runs-on: ${{ github.repository == 'astral-sh/ruff' && 'namespace-profile-macos-15' || 'macos-15' }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/build-docker.yml

@@ -52,9 +52,9 @@ jobs:
           submodules: recursive
           persist-credentials: false
 
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         if: ${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}
         with:
           registry: ghcr.io
@@ -78,7 +78,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.RUFF_BASE_IMG }}
           # Defining this makes sure the org.opencontainers.image.version OCI label becomes the actual release version and not the branch name
@@ -94,7 +94,7 @@ jobs:
       # Adapted from https://docs.docker.com/build/ci/github-actions/multi-platform/
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: ${{ matrix.platform }}
@@ -138,19 +138,19 @@ jobs:
           pattern: digests-*
           merge-multiple: true
 
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.RUFF_BASE_IMG }}
           # Order is on purpose such that the label org.opencontainers.image.version has the first pattern with the full version
           tags: |
             type=pep440,pattern={{ version }},value=${{ fromJson(inputs.plan).announcement_tag }}
             type=pep440,pattern={{ major }}.{{ minor }},value=${{ fromJson(inputs.plan).announcement_tag }}
 
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -210,9 +210,9 @@ jobs:
           - debian:trixie-slim,trixie-slim,debian-slim
           - buildpack-deps:trixie,trixie,debian
     steps:
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -262,7 +262,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         # ghcr.io prefers index level annotations
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: index
@@ -275,7 +275,7 @@ jobs:
 
       - name: Build and push
         id: build-and-push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -316,11 +316,11 @@ jobs:
           pattern: digests-*
           merge-multiple: true
 
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: index
         with:
@@ -330,7 +330,7 @@ jobs:
             type=pep440,pattern={{ version }},value=${{ fromJson(inputs.plan).announcement_tag }}
             type=pep440,pattern={{ major }}.{{ minor }},value=${{ fromJson(inputs.plan).announcement_tag }}
 
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}