Merge branch 'master' into fix-crash

.github/workflows/build_wheels.yml

@@ -6,14 +6,16 @@ on:
     tags: ['*']
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build-wheels:
     if: github.repository == 'python/mypy'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'

.github/workflows/docs.yml

@@ -35,6 +35,8 @@ jobs:
       VERIFY_MYPY_ERROR_CODES: 1
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'

.github/workflows/mypy_primer.yml

@@ -26,8 +26,6 @@ jobs:
   mypy_primer:
     name: Run mypy_primer
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     strategy:
       matrix:
         shard-index: [0, 1, 2, 3, 4]
@@ -38,9 +36,10 @@ jobs:
         with:
           path: mypy_to_test
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
       - name: Install dependencies
         run: |
           python -m pip install -U pip
@@ -74,9 +73,9 @@ jobs:
         name: Save PR number
         run: |
           echo ${{ github.event.pull_request.number }} | tee pr_number.txt
-      - if: ${{ matrix.shard-index == 0 }}
-        name: Upload mypy_primer diff + PR number
+      - name: Upload mypy_primer diff + PR number
         uses: actions/upload-artifact@v4
+        if: ${{ matrix.shard-index == 0 }}
         with:
           name: mypy_primer_diffs-${{ matrix.shard-index }}
           path: |
@@ -93,8 +92,6 @@ jobs:
     name: Join artifacts
     runs-on: ubuntu-latest
     needs: [mypy_primer]
-    permissions:
-      contents: read
     steps:
       - name: Merge artifacts
         uses: actions/upload-artifact/merge@v4

.github/workflows/mypy_primer_comment.yml

@@ -1,20 +1,21 @@
 name: Comment with mypy_primer diff
 
-on:
+on:  # zizmor: ignore[dangerous-triggers]
   workflow_run:
     workflows:
       - Run mypy_primer
     types:
       - completed
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   comment:
     name: Comment PR from mypy_primer
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Download diffs
@@ -48,7 +49,7 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
-            const MAX_CHARACTERS = 30000
+            const MAX_CHARACTERS = 50000
             const MAX_CHARACTERS_PER_PROJECT = MAX_CHARACTERS / 3
 
             const fs = require('fs')

.github/workflows/sync_typeshed.yml

@@ -5,20 +5,22 @@ on:
   schedule:
     - cron: "0 0 1,15 * *"
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   sync_typeshed:
     name: Sync typeshed
     if: github.repository == 'python/mypy'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: true  # needed to `git push` the PR branch
         # TODO: use whatever solution ends up working for
         # https://github.com/python/typeshed/issues/8434
       - uses: actions/setup-python@v5

.github/workflows/test.yml

@@ -33,57 +33,49 @@ jobs:
         # the oldest and newest supported Python versions
         - name: Test suite with py39-ubuntu, mypyc-compiled
           python: '3.9'
-          arch: x64
-          os: ubuntu-latest
+          os: ubuntu-24.04-arm
           toxenv: py
           tox_extra_args: "-n 4"
           test_mypyc: true
         - name: Test suite with py39-windows-64
           python: '3.9'
-          arch: x64
           os: windows-latest
           toxenv: py39
           tox_extra_args: "-n 4"
         - name: Test suite with py310-ubuntu
           python: '3.10'
-          arch: x64
-          os: ubuntu-latest
+          os: ubuntu-24.04-arm
           toxenv: py
           tox_extra_args: "-n 4"
         - name: Test suite with py311-ubuntu, mypyc-compiled
           python: '3.11'
-          arch: x64
-          os: ubuntu-latest
+          os: ubuntu-24.04-arm
           toxenv: py
           tox_extra_args: "-n 4"
           test_mypyc: true
         - name: Test suite with py312-ubuntu, mypyc-compiled
           python: '3.12'
-          arch: x64
-          os: ubuntu-latest
+          os: ubuntu-24.04-arm
           toxenv: py
           tox_extra_args: "-n 4"
           test_mypyc: true
         - name: Test suite with py313-ubuntu, mypyc-compiled
           python: '3.13'
-          arch: x64
-          os: ubuntu-latest
+          os: ubuntu-24.04-arm
           toxenv: py
           tox_extra_args: "-n 4"
           test_mypyc: true
 
         # - name: Test suite with py314-dev-ubuntu
         #   python: '3.14-dev'
-        #   arch: x64
-        #   os: ubuntu-latest
+        #   os: ubuntu-24.04-arm
         #   toxenv: py
         #   tox_extra_args: "-n 4"
         #   allow_failure: true
         #   test_mypyc: true
 
         - name: mypyc runtime tests with py39-macos
           python: '3.9.21'
-          arch: x64
           # TODO: macos-13 is the last one to support Python 3.9, change it to macos-latest when updating the Python version
           os: macos-13
           toxenv: py
@@ -93,20 +85,17 @@ jobs:
         # - https://github.com/python/mypy/pull/17822
         # - name: mypyc runtime tests with py38-debug-build-ubuntu
         #   python: '3.9.21'
-        #   arch: x64
         #   os: ubuntu-latest
         #   toxenv: py
         #   tox_extra_args: "-n 4 mypyc/test/test_run.py mypyc/test/test_external.py"
         #   debug_build: true
 
         - name: Type check our own code (py39-ubuntu)
           python: '3.9'
-          arch: x64
           os: ubuntu-latest
           toxenv: type
         - name: Type check our own code (py39-windows-64)
           python: '3.9'
-          arch: x64
           os: windows-latest
           toxenv: type
 
@@ -115,7 +104,6 @@ jobs:
           # to ensure the tox env works as expected
         - name: Formatting and code style with Black + ruff
           python: '3.10'
-          arch: x64
           os: ubuntu-latest
           toxenv: lint
 
@@ -136,6 +124,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Debug build
       if: ${{ matrix.debug_build }}
@@ -167,7 +157,6 @@ jobs:
       if: ${{ !(matrix.debug_build || endsWith(matrix.python, '-dev')) }}
       with:
         python-version: ${{ matrix.python }}
-        architecture: ${{ matrix.arch }}
 
     - name: Install tox
       run: |
@@ -217,6 +206,8 @@ jobs:
       CC: i686-linux-gnu-gcc
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install 32-bit build dependencies
         run: |
           sudo dpkg --add-architecture i386 && \

.github/workflows/test_stubgenc.yml

@@ -29,6 +29,8 @@ jobs:
     steps:
 
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Setup 🐍 3.9
       uses: actions/setup-python@v5

.gitignore

@@ -17,6 +17,7 @@ venv/
 test-data/packages/.pip_lock
 dmypy.json
 .dmypy.json
+/.mypyc_test_output
 
 # Packages
 *.egg

.pre-commit-config.yaml

@@ -6,28 +6,44 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 24.10.0
+    rev: 25.1.0
     hooks:
       - id: black
         exclude: '^(test-data/)'
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.4
+    rev: v0.8.6
     hooks:
       - id: ruff
         args: [--exit-non-zero-on-fix]
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.30.0
+    rev: 0.31.0
     hooks:
-      - id: check-dependabot
       - id: check-github-workflows
+      - id: check-github-actions
+      - id: check-readthedocs
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.4
+    rev: v1.7.7
     hooks:
       - id: actionlint
         args: [
           -ignore=property "debug_build" is not defined,
           -ignore=property "allow_failure" is not defined,
           -ignore=SC2(046|086),
         ]
+        additional_dependencies:
+          # actionlint has a shellcheck integration which extracts shell scripts in `run:` steps from GitHub Actions
+          # and checks these with shellcheck. This is arguably its most useful feature,
+          # but the integration only works if shellcheck is installed
+          - "github.com/wasilibs/go-shellcheck/cmd/[email protected]"
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.0.1
+    hooks:
+      - id: zizmor
+  # Should be the last one:
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
+
 ci:
   autoupdate_schedule: quarterly

CHANGELOG.md

@@ -2,7 +2,71 @@
 
 ## Next release
 
-...
+### Performance improvements
+
+Mypy may be 5-30% faster. This improvement comes largely from tuning the performance of the
+garbage collector.
+
+Contributed by Jukka Lehtosalo (PR [18306](https://github.com/python/mypy/pull/18306)).
+
+### Mypyc accelerated mypy wheels for aarch64
+
+Mypy can compile itself to C extension modules using mypyc. This makes mypy 3-5x faster
+than if mypy is interpreted with pure Python. We now build and upload mypyc accelerated
+mypy wheels for `manylinux_aarch64` to PyPI, making it easy for users on such platforms
+to realise this speedup.
+
+Contributed by Christian Bundy and Marc Mueller
+(PR [mypy_mypyc-wheels#76](https://github.com/mypyc/mypy_mypyc-wheels/pull/76),
+PR [mypy_mypyc-wheels#89](https://github.com/mypyc/mypy_mypyc-wheels/pull/89)).
+
+### `--strict-bytes`
+
+By default, mypy treats an annotation of ``bytes`` as permitting ``bytearray`` and ``memoryview``.
+[PEP 688](https://peps.python.org/pep-0688) specified the removal of this special case.
+Use this flag to disable this behavior. `--strict-bytes` will be enabled by default in **mypy 2.0**.
+
+Contributed by Ali Hamdan (PR [18137](https://github.com/python/mypy/pull/18263/)) and
+Shantanu Jain (PR [13952](https://github.com/python/mypy/pull/13952)).
+
+### Improvements to reachability analysis and partial type handling in loops
+
+This change results in mypy better modelling control flow within loops and hence detecting several
+issues it previously did not detect. In some cases, this change may require use of an additional
+explicit annotation of a variable.
+
+Contributed by Christoph Tyralla (PR [18180](https://github.com/python/mypy/pull/18180),
+[PR](https://github.com/python/mypy/pull/18433)).
+
+(Speaking of partial types, another reminder that mypy plans on enabling `--local-partial-types`
+by default in **mypy 2.0**).
+
+### Better discovery of configuration files
+
+Mypy will now walk up the filesystem (up until a repository or file system root) to discover
+configuration files. See the
+[mypy configuration file documentation](https://mypy.readthedocs.io/en/stable/config_file.html)
+for more details.
+
+Contributed by Mikhail Shiryaev and Shantanu Jain
+(PR [16965](https://github.com/python/mypy/pull/16965), PR [18482](https://github.com/python/mypy/pull/18482)
+
+### Better line numbers for decorators and slice expressions
+
+Mypy now uses more correct line numbers for decorators and slice expressions. In some cases, this
+may necessitate changing the location of a `# type: ignore` comment.
+
+Contributed by Shantanu Jain (PR [18392](https://github.com/python/mypy/pull/18392),
+PR [18397](https://github.com/python/mypy/pull/18397)).
+
+### Drop Support for Python 3.8
+
+Mypy no longer supports running with Python 3.8, which has reached end-of-life.
+When running mypy with Python 3.9+, it is still possible to type check code
+that needs to support Python 3.8 with the `--python-version 3.8` argument.
+Support for this will be dropped in the first half of 2025!
+
+Contributed by Marc Mueller (PR [17492](https://github.com/python/mypy/pull/17492)).
 
 ## Mypy 1.14