[dependabot]

Bumps the dependencies group with 1 update in the /crates/stdnum-py directory: ty.
Bumps the dependencies group with 1 update in the /scripts/oracle directory: idnumbers.

Updates ty from 0.0.86 to 0.0.89

Release notes

Sourced from ty's releases.

0.0.89

Release Notes

Released on 2026-10-16.

Core type checking

• Added support for return type inference for unannotated functions and methods (#29253).

  Return type inference is currently disabled by default. Enable it with the analysis.return-type-inference setting in pyproject.toml:

  [tool.ty.analysis]
  return-type-inference = "always"

  Or in ty.toml:

  [analysis]
  return-type-inference = "always"

  Please share your feedback, especially any problems you encounter, in the return type inference feedback issue.

• Sync vendored typeshed stubs (#29402). Typeshed diff

Bug fixes

• Avoid a panic when negating dynamic type aliases (#29427)
• Widen tuple literal lengths when other collection elements contain nested tuple types (#29147)
• Report invalid Generic and Protocol arguments containing nested variadic type variables (#29146)

Performance

• Speed up generic class-pattern narrowing by skipping impossible intersection comparisons (#29240)

Contributors

• @​carljm
• @​charliermarsh
• @​sharkdp

Install ty 0.0.89

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.89/ty-installer.sh | sh

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.89

Released on 2026-10-16.

Core type checking

• Added support for return type inference for unannotated functions and methods (#29253).

  Return type inference is currently disabled by default. Enable it with the analysis.return-type-inference setting in pyproject.toml:

  [tool.ty.analysis]
  return-type-inference = "always"

  Or in ty.toml:

  [analysis]
  return-type-inference = "always"

  Please share your feedback, especially any problems you encounter, in the return type inference feedback issue.

• Sync vendored typeshed stubs (#29402). Typeshed diff

Bug fixes

• Avoid a panic when negating dynamic type aliases (#29427)
• Widen tuple literal lengths when other collection elements contain nested tuple types (#29147)
• Report invalid Generic and Protocol arguments containing nested variadic type variables (#29146)

Performance

• Speed up generic class-pattern narrowing by skipping impossible intersection comparisons (#29240)

Contributors

• @​carljm
• @​charliermarsh
• @​sharkdp

0.0.88

Released on 2026-10-15.

Bug fixes

• Avoid panics and hangs involving recursive type aliases and intersections (#29057)
• Fix false invalid-mutable-override errors when overriding object attributes (#29373)

... (truncated)

Commits

• 82b0fd4 Bump version to 0.0.89 (#4740)
• 5370198 Update dependency python to 3.14 (#4721)
• 64e7f18 Bump version to 0.0.88 (#4732)
• 88c50d5 Budget the daily fuzz run based on setup time (#4706)
• ec60e71 Document and lint the manually maintained release workflow (#4320)
• dbc632a Update dependency prek to v0.5.3 (#4719)
• 7aa0f34 Update astral-sh/setup-uv action to v10.3.0 (#4720)
• 2eefac0 Update prek dependencies (#4722)
• ea4c3d2 Bump version to 0.0.87 (#4718)
• 1e7a76d Require hashes for build dependencies (#4714)
• Additional commits viewable in compare view

Updates idnumbers from 1.11.0 to 1.20.0

Release notes

Sourced from idnumbers's releases.

Release 1.20.0

Validity changes

• BRA (#617): RG checksum validation treats X as value 10, rejecting it when the weighted sum has remainder 0 modulo 11 and accepting it when the remainder is 1. Numeric check-digit behavior is unchanged; remainder 0 still accepts 0.
• UKR (#616): taxpayer ID numbers with encoded birth dates after the local current date now return False from validate() and None from parse(). Today's date remains accepted, and checksum computation and parsed fields for past dates are unchanged.

Changed

• Coverage badge (#600): the README shows the line and branch coverage from a shields.io endpoint JSON that CI publishes to the badges branch on pushes to main, using GITHUB_TOKEN with no repository secrets or external service. Pull request CI and the 97% floor are unchanged.
• Coverage badge hardening (#611): CI tests pin the workflow triggers to push and pull_request, the coverage checkout does not persist credentials, and badge publication skips stale main commits after checking the remote head. The endpoint JSON, coverage metric and floor are unchanged.
• Formatting (#599): the Python sources are formatted with ruff format (ruff 0.16.10, 120 columns; Markdown is left alone) and CI checks them with ruff format --check. .git-blame-ignore-revs lists the reformat commit, so git blame skips it. Code and behaviour are unchanged. This also settles the quote style of the README example tests (#561).

Other fixes

• Checksums (#619): every public checksum() returns False or None for non-string input instead of raising or computing a value. HKG and TUR computed checksums now return Optional[str]. All string-input behavior, including malformed strings, is unchanged.
• Formatting (#618): normalize_id() and format_id() uppercase ASCII letters only, leaving non-ASCII letters (including lowercase Greek letters) unchanged instead of folding lookalikes or expanding ligatures into ASCII. Helper outputs change; country validation is unchanged.
• LKA (#615): old NIC suffixes V/v/X/x historically indicated voter/nonvoter status, not citizenship. OldNationalID.parse() keeps the citizenship key but returns None instead of citizen/resident status, with type Optional[Citizenship]. Validation, checksum, conversion and other parsed fields are unchanged.

Documentation

• Contributor checklists (#608): explicitly name both ruff lint and formatting checks. CI contract tests tolerate extra formatter exclusions and reordered jobs while retaining readable failures for missing checks. Clarify checksum-group coverage, line wrapping and the first trusted release wording; CI policy and library behaviour are unchanged.
• Contributor guide (#598): the line-length rule in AGENTS.md now says that every line of a reflowed paragraph counts as changed, and that only URLs are exempt: other long string literals and citations are wrapped. Code and behaviour are unchanged.
• Country template (#595): the checksum group item names the check character(s) and covers a checksum() that returns a derived value (the tax file number's remainder): the group stays over the check character, and the class needs the named exemption in TestComputedChecksumGroups. The BGR 13-digit test comment now names digits 9 to 12. Code and behaviour are unchanged.

... (truncated)

Changelog

Sourced from idnumbers's changelog.

1.20.0 (2026-10-13)

Validity changes

• BRA (#617): RG checksum validation treats X as value 10, rejecting it when the weighted sum has remainder 0 modulo 11 and accepting it when the remainder is 1. Numeric check-digit behavior is unchanged; remainder 0 still accepts 0.
• UKR (#616): taxpayer ID numbers with encoded birth dates after the local current date now return False from validate() and None from parse(). Today's date remains accepted, and checksum computation and parsed fields for past dates are unchanged.

Changed

• Coverage badge (#600): the README shows the line and branch coverage from a shields.io endpoint JSON that CI publishes to the badges branch on pushes to main, using GITHUB_TOKEN with no repository secrets or external service. Pull request CI and the 97% floor are unchanged.
• Coverage badge hardening (#611): CI tests pin the workflow triggers to push and pull_request, the coverage checkout does not persist credentials, and badge publication skips stale main commits after checking the remote head. The endpoint JSON, coverage metric and floor are unchanged.
• Formatting (#599): the Python sources are formatted with ruff format (ruff 0.16.10, 120 columns; Markdown is left alone) and CI checks them with ruff format --check. .git-blame-ignore-revs lists the reformat commit, so git blame skips it. Code and behaviour are unchanged. This also settles the quote style of the README example tests (#561).

Other fixes

• Checksums (#619): every public checksum() returns False or None for non-string input instead of raising or computing a value. HKG and TUR computed checksums now return Optional[str]. All string-input behavior, including malformed strings, is unchanged.
• Formatting (#618): normalize_id() and format_id() uppercase ASCII letters only, leaving non-ASCII letters (including lowercase Greek letters) unchanged instead of folding lookalikes or expanding ligatures into ASCII. Helper outputs change; country validation is unchanged.
• LKA (#615): old NIC suffixes V/v/X/x historically indicated voter/nonvoter status, not citizenship. OldNationalID.parse() keeps the citizenship key but returns None instead of citizen/resident status, with type Optional[Citizenship]. Validation, checksum, conversion and other parsed fields are unchanged.

Documentation

• Contributor checklists (#608): explicitly name both ruff lint and formatting checks. CI contract tests tolerate extra formatter exclusions and reordered jobs while retaining readable failures for missing checks. Clarify checksum-group coverage, line wrapping and the first trusted release wording; CI policy and library behaviour are unchanged.
• Contributor guide (#598): the line-length rule in AGENTS.md now says that every line of a reflowed paragraph counts as changed, and that only URLs are exempt: other long string literals and citations are wrapped. Code and behaviour are unchanged.
• Country template (#595): the checksum group item names the check character(s) and covers a checksum() that returns a derived value (the tax file number's remainder): the group stays over the check character, and the class needs the named exemption in TestComputedChecksumGroups. The BGR

... (truncated)

Commits

• e36d6e4 Bump version to 1.20.0 (#631)
• bbd8eb8 Fix #629 - prepare consolidated v1.20.0 changelog (#630)
• 55473c4 Fix #611 - harden coverage badge publication and CI contracts (#628)
• 28d33f3 Fix #608 - clarify contributor checks and harden workflow tests (#627)
• 3da77e1 Fix #620 - document and test shape-only input masks (#626)
• 9b496c7 Fix #619 - reject non-string inputs in public checksums (#625)
• ea018e1 Fix #618 - preserve non-ASCII letters during normalization (#624)
• 0def0ba Fix #617 - treat the RG check character X as value ten (#623)
• 2550388 Fix #616 - reject future UKR taxpayer ID birth dates (#622)
• 61e3370 Fix #615 - stop deriving old NIC citizenship from the voter suffix (#621)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/ty	0.0.89	Unknown	Unknown
pip/idnumbers	1.20.0	Unknown	Unknown

Scanned Files

• crates/stdnum-py/tests/requirements.txt
• scripts/oracle/requirements.txt