)]}'
{
  "log": [
    {
      "commit": "93e6868182a8cfdf7dbd06f87575a62c23379a8e",
      "tree": "26be97a0d14bbd6dfbca4630cbd095d17defa11f",
      "parents": [
        "bb486ab68d0fc27a189d94be181b2de5ccde306d"
      ],
      "author": {
        "name": "Asuka Minato",
        "email": "i@asukaminato.eu.org",
        "time": "Wed Oct 28 03:18:03 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Wed Oct 28 03:18:03 2026 -0700"
      },
      "message": "test: document enum semantic-token classification bugs (#5050)\n\nSummary:\nSemantic tokens classify attributes from their inferred value types instead of their definitions. Snapshots capture the current misclassification, with comments identifying the correct enumMember or property token for each affected case.\n\nThese LSP tests use ordinary Rust `#[test]` functions, so explicit `BUG` comments document the incorrect behavior and the correct result. These are passing tests of known bugs, following [the repository test guidance](https://github.com/facebook/pyrefly/blob/main/AGENTS.md#the-bug-marker-in-tests).\n\nThe complete implementation and regression tests remain in [PR https://github.com/facebook/pyrefly/issues/4794](https://github.com/facebook/pyrefly/pull/4794). Related issue: https://github.com/facebook/pyrefly/issues/4751.\n\n## Validation\n\nBased on upstream `main` at `ef6de648bce0dc6dcca0a21a9fbb7490f23ecce8`.\n\n- `cargo test -p pyrefly --lib -- enum_member_definition_test narrowed_enum_instance_attribute_test` — passed.\n- `python3 test.py --no-test --no-tensor-shapes --no-conformance --no-jsonschema --no-extension` — passed.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5050\n\nReviewed By: rchen152\n\nDifferential Revision: D122390462\n\nfbshipit-source-id: 79027859a79c700aca570d74df86de37bf3e66de\n"
    },
    {
      "commit": "bb486ab68d0fc27a189d94be181b2de5ccde306d",
      "tree": "7b154eb93997058a221e0d62f2090dc1ee2a6b90",
      "parents": [
        "ec3400981fc4b307a0bc76b8449101b85d4267dc"
      ],
      "author": {
        "name": "Asuka Minato",
        "email": "i@asukaminato.eu.org",
        "time": "Wed Oct 28 02:21:50 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Wed Oct 28 02:21:50 2026 -0700"
      },
      "message": "test: treat __all__ and __slots__ entries as symbol references (#5052)\n\nSummary:\nIDE operations do not resolve __all__ and __slots__ string entries as symbol references.\n\nThis PR contains only the regression tests extracted from [the complete fix PR https://github.com/facebook/pyrefly/issues/4715](https://github.com/facebook/pyrefly/pull/4715). The original PR retains the implementation and tests.\n\nRelated issue: https://github.com/facebook/pyrefly/issues/4344.\n\nThe tests assert the intended behavior and deliberately fail on current `main` until the fix is applied.\n\n## Validation\n\nBase: `18b758498ff07ee92c3373e88e64b73afc549f54` (upstream `main`).\n\n- Formatting and linting: `python3 test.py --no-test --no-tensor-shapes --no-conformance --no-jsonschema --no-extension`.\n- Regression tests compile successfully.\n- `cargo test -p pyrefly --lib -- dunder_slots_entry_definition_test hover_symbol_literals dunder_all_entries_are_symbol_references dunder_slots_entries_are_attribute_references prepare_rename_symbol_literals` reproduces the failure on the unmodified main implementation.\n\nFailing tests:\n\n- `test::lsp::local_find_refs::dunder_slots_entries_are_attribute_references`\n- `test::lsp::rename::prepare_rename_symbol_literals`\n- `test::lsp::definition::dunder_slots_entry_definition_test`\n- `test::lsp::hover::hover_symbol_literals`\n- `test::lsp::local_find_refs::dunder_all_entries_are_symbol_references`\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5052\n\nReviewed By: rchen152\n\nDifferential Revision: D122390606\n\nfbshipit-source-id: 76ef53aa418f049febba813bc7b2edfe876f61e1\n"
    },
    {
      "commit": "ec3400981fc4b307a0bc76b8449101b85d4267dc",
      "tree": "53abc8d9b7e5b6da64e570b651262b942a1f39ec",
      "parents": [
        "36167922c7ec96169f01f37a19f15a2ba62d0105"
      ],
      "author": {
        "name": "Asuka Minato",
        "email": "i@asukaminato.eu.org",
        "time": "Wed Oct 28 02:19:24 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Wed Oct 28 02:19:24 2026 -0700"
      },
      "message": "test: document container inference bugs with Any bounds (#5046)\n\nSummary:\nAny-bounded type variables erase concrete container element types and over-narrow repeated appends. The tests retain the intended type assertions and explicitly expect the current incorrect diagnostics.\n\nThe `testcase!` regressions use `bug \u003d` markers and comments documenting the correct behavior. These are passing tests of known bugs, following [the repository test guidance](https://github.com/facebook/pyrefly/blob/main/AGENTS.md#the-bug-marker-in-tests).\n\nThe complete implementation and regression tests remain in [PR https://github.com/facebook/pyrefly/issues/4877](https://github.com/facebook/pyrefly/pull/4877). Related issue: https://github.com/facebook/pyrefly/issues/3265.\n\n## Validation\n\nBased on upstream `main` at `ef6de648bce0dc6dcca0a21a9fbb7490f23ecce8`.\n\n- `cargo test -p pyrefly --lib -- test_iter_container_literal test_any_bounded_typevar_container_hints test_any_bounded_typevar_empty_list_repeated_append` — passed.\n- `python3 test.py --no-test --no-tensor-shapes --no-conformance --no-jsonschema --no-extension` — passed.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5046\n\nReviewed By: rchen152\n\nDifferential Revision: D122390321\n\nfbshipit-source-id: 26bf055b1c1dfa37758c316bafffb62bda64f399\n"
    },
    {
      "commit": "36167922c7ec96169f01f37a19f15a2ba62d0105",
      "tree": "9be96ce65857b32f607b6b3f831eea889ec7aef7",
      "parents": [
        "991a67bcc2a0a4c87e85db951ed5588fa25703b0"
      ],
      "author": {
        "name": "Asuka Minato",
        "email": "i@asukaminato.eu.org",
        "time": "Wed Oct 28 00:29:22 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Wed Oct 28 00:29:22 2026 -0700"
      },
      "message": "fix inspect.isclass does not make a TypeForm valid for isinstance #4822 (#4830)\n\nSummary:\nFixes https://github.com/facebook/pyrefly/issues/4822\n\nTypeForm values narrowed by inspect.isclass now work with isinstance.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/4830\n\nTest Plan: add test\n\nReviewed By: rchen152\n\nDifferential Revision: D119017345\n\nfbshipit-source-id: 14bf456438b799c3eadf2cf2cd459c993755c708\n"
    },
    {
      "commit": "991a67bcc2a0a4c87e85db951ed5588fa25703b0",
      "tree": "4219c27455299494cb5eff0bedd6001080534482",
      "parents": [
        "136f4ce438ea311262192d94a6b18f2f62327f6d"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Tue Oct 27 23:47:09 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 23:47:09 2026 -0700"
      },
      "message": "Add a scheduled sweep to fix missing automation_pr_state updates\n\nSummary:\nautomation_pr_state adds waiting-for-* labels to PRs to indicate who needs to act next on each PR. Sadly, the pull_request_review event doesn\u0027t seem to reliably fire (it appears to be skipped for PRs with merge conflicts and PRs by new contributors that haven\u0027t had their workflows approved to run), so label updates can be accidentally skipped. This diff adds a sweep every 30 minutes to fix missed updates.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D128001697\n\nfbshipit-source-id: 44df5bea9b55fdeb3f2de4ba9be451fe0cdc16ae\n"
    },
    {
      "commit": "136f4ce438ea311262192d94a6b18f2f62327f6d",
      "tree": "9f935d0166094b1ddfdb87672d1824e191404a0e",
      "parents": [
        "b6213dac3ff6925c93fa829e15155e13c0a9a751"
      ],
      "author": {
        "name": "Nevsor",
        "email": "Nevsor@users.noreply.github.com",
        "time": "Tue Oct 27 17:12:19 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 17:12:19 2026 -0700"
      },
      "message": "Add stub for np.argmax (#5411)\n\nSummary:\nCurrently pyrefly-numpy-stubs has stubs for `np.argmin`, `np.ndarray.argmin` and `np.ndarray.argmax`, but not for `np.argmax`, which instead reexports the regular NumPy stub.\n\n\u003cimg width\u003d\"1077\" height\u003d\"152\" alt\u003d\"image\" src\u003d\"https://github.com/user-attachments/assets/3cf44da9-9ea4-4a22-b4ab-09ffbb7408c1\" /\u003e\n\nThis PR adds the missing stub for `np.argmax`, by copying and renaming the one for `np.argmin`.\n\n- [x] I am a human, and I fully understand the code I am submitting.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5411\n\nTest Plan:\nWith this change, pyrefly shows the same return type for each of the four functions:\n\n\u003cimg width\u003d\"1151\" height\u003d\"158\" alt\u003d\"image\" src\u003d\"https://github.com/user-attachments/assets/a68ebad0-456b-4d67-8509-ea3d1e443090\" /\u003e\n\nReviewed By: stroxler\n\nDifferential Revision: D127823373\n\nfbshipit-source-id: 3ecd04012249544827e88a60f775f946ff32d3f2\n"
    },
    {
      "commit": "b6213dac3ff6925c93fa829e15155e13c0a9a751",
      "tree": "587602877ed209be88fb2206c1071af64e0f484c",
      "parents": [
        "af3f3eab22f198e83f81256a7ccfeab5920ac6ab"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Tue Oct 27 16:04:03 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 16:04:03 2026 -0700"
      },
      "message": "Widen narrows after a suppressing `with`\n\nSummary:\nIn ordinary flow, a suppressing context manager can resume after a statement in its body raised, before a narrow in the body became true. Pyrefly kept the narrow from the end of the body on that path, so code after the `with` could see a type that was too narrow.\n\nOn the suppression path, this diff joins a name\u0027s body-end narrow with its view at `with` entry, taken after the first manager and its `as` target, through a per-name Phi. A separate suppression-only query on the original `ContextExpr` values decides whether the path exists, so normal completion of the body is unaffected. The result is a join that contains the body-end view, so the change can only widen types relative to before.\n\nBounds:\n- It applies only to unchanged, initialized local `SingleDef` names whose narrow chain is a pure root `Narrow` chain.\n- Names that are roots of attribute or subscript `Store`/`Del` targets in the body are excluded; ordinary loads do not exclude a name. An unknown write root disables the repair for that `with`.\n- Written values, facets, initialization, and resume, may-raise and jump behavior are unchanged.\n- Branch, Phi and loop-carried sources, captures, and writes in the middle of the body remain known limits, documented by `bug \u003d` tests.\n\nThis is an ordinary flow repair, not quantified narrowing.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127863973\n\nfbshipit-source-id: c1ab00dd72d9e8b41485114c81c637752fb185c2\n"
    },
    {
      "commit": "af3f3eab22f198e83f81256a7ccfeab5920ac6ab",
      "tree": "6f18ee92e2dbc2bae25a513f682009663fffaa85",
      "parents": [
        "a0810218daed744182524782c13d61099a03c5b0"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Tue Oct 27 16:04:03 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 16:04:03 2026 -0700"
      },
      "message": "Add tests for ordinary narrowing after a suppressing `with`\n\nSummary:\nIn ordinary flow, a suppressing context manager (such as `contextlib.suppress`) can resume after a statement in its body raises. Pyrefly currently keeps a name narrow from the end of the body after the `with`, even when the guard that established the narrow may have failed first, so code after the `with` sees a type that is too narrow.\n\nThis diff adds passing tests that record the current behavior, with `bug \u003d` markers, before the fix in the next diff. They cover suppressed assertions, early failure, raising branches, resumed returns, combined, nested and async managers, following loops, and attribute or subscript reads of the narrowed name. Control tests record the cases that the fix intentionally leaves alone: attribute and subscript write targets, written values, facets, initialization, Phi, loop and capture sources, and an existing hard-return diagnostic. A scope unit test checks that narrow updates keep the value and the loop prior.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127863969\n\nfbshipit-source-id: 8cf24dcc9fe4e1d336de1402f2a8897d609d8e64\n"
    },
    {
      "commit": "a0810218daed744182524782c13d61099a03c5b0",
      "tree": "7f628d06c0c365fd644d6deb6c79efcf19bc2fb7",
      "parents": [
        "cdfd1f01604c45c7900e85554c3eec1e8b5bbb46"
      ],
      "author": {
        "name": "Conner Nilsen",
        "email": "connernilsen@meta.com",
        "time": "Tue Oct 27 14:48:04 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 14:48:04 2026 -0700"
      },
      "message": "Add interpret-mypy-primer skill for analyzing error differentials\n\nSummary:\nWhen a change alters which errors pyrefly reports, its mypy_primer differential\nneeds interpreting — classifying added/fixed errors as true vs false positives,\nweighing per-preset impact, and discounting corpus churn — and the result recorded\nin the change summary. That was tribal knowledge; this captures it.\n\nAdd an open-source `interpret-mypy-primer` skill covering the whole lifecycle:\ngetting the differential, interpreting it by preset, discounting byte-identical\nchurn, verifying correctness against reference checkers and the CPython runtime, and\nwriting the result into the pull request summary. An \"Inside Meta\" section adds the\ninternal plumbing (the `ci-signals` and `triage-pyrefly-ci` skills, recording in\nthe Phabricator diff Summary).\n\nPoint both AGENTS.md files at the skill, and reference it from the review skills\n(`score-pyrefly-change` I3 and `review-pyrefly-diff`) so scoring and review use the\nsame method.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127003709\n\nfbshipit-source-id: b024c614bd8e1ce2fe9fa8ec6c8e38cbdf5a547f\n"
    },
    {
      "commit": "cdfd1f01604c45c7900e85554c3eec1e8b5bbb46",
      "tree": "f4868f01431bedaeb0e4388764e6732b092e85a8",
      "parents": [
        "720fd6ae802976a81892c813d910c47d95f1a606"
      ],
      "author": {
        "name": "Hamdi Hassan Shahid",
        "email": "shahhamdihassan@meta.com",
        "time": "Tue Oct 27 14:29:36 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 14:29:36 2026 -0700"
      },
      "message": "Add a `hint` severity\n\nSummary:\nThe language server shows unused parameters, variables and imports as greyed-out hints, but pyrefly has no severity for that level, so these hints can\u0027t be error kinds whose default matches what users see today (https://github.com/facebook/pyrefly/issues/5113). `info` is louder: a blue squiggle in the IDE and a \"not shown\" line in every `pyrefly check` summary.\n\nThis adds `hint`, ordered `ignore \u003c hint \u003c info \u003c warn \u003c error`. In the IDE it maps to the LSP Hint level. `pyrefly check` hides it by default like `warn` and `info`, but a hidden hint is not counted in the \"not shown\" summary, since hints are meant for the IDE; `--min-severity hint` prints them and fails the run like any other shown finding. SARIF and Code Climate report it at their lowest level, legacy JSON as `\"hint\"`, and the playground as a Monaco hint.\n\nHints are collected apart from other diagnostics, in their own `hints` list. Only the surfaces that can show them read it: the language server, the playground, and `pyrefly check`, which merges them in before applying `--min-severity`. Everything else that reads diagnostics, such as the query and embedding APIs, the incremental checker and the test harness, sees no hints. The language server\u0027s quick fixes and baseline update on save, and `buck check` / `bazel check` under `--min-severity hint`, read them too. Suppressed errors keep their configured severity, so a suppressed hint is not counted in the `pyrefly check` summary.\n\nNo error kind uses `hint` yet, so default behaviour is unchanged.\n\nProposal: https://docs.google.com/document/d/1tFRwMCeczZNunAlpocNvyWF4r4UHekRefChRnFEwtZM/edit\n\nReviewed By: kinto0\n\nDifferential Revision: D127864895\n\nfbshipit-source-id: b60b055f85ba3ce9138208bcd93c26c6d7a15ca9\n"
    },
    {
      "commit": "720fd6ae802976a81892c813d910c47d95f1a606",
      "tree": "b6bcba87aa80e34946545cb50f416caad805659c",
      "parents": [
        "fd13e513042894b566619b4e8770f966dc69685c"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 14:22:31 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 14:22:31 2026 -0700"
      },
      "message": "Resolve `Self` to the TypeVar when subscripting a class-bounded TypeVar (#5258)\n\nSummary:\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5258\n\nSubscripting a value whose type is a TypeVar bounded by a class (`seq[0:1]` with `S: SupportsSlice`) inferred the bound instead of `S` when `__getitem__` returns `Self`. Calling the method explicitly (`seq.__getitem__(slice(0, 1))`) already inferred `S`.\n\nThe subscript path handled a bounded TypeVar by subscripting its bound, so `__getitem__` was looked up and called with the bound as the receiver, and `Self` resolved to the bound. Binary operators don\u0027t have this problem because they call the dunder on the TypeVar itself.\n\nFor a TypeVar bounded by a class whose subscripts use the plain `__getitem__` call, we now call `__getitem__` on the TypeVar, the same way an explicit method call does. Attribute lookup on a bounded TypeVar binds `Self` to the TypeVar. Bounds with builtin subscript handling (lists, tuples, shaped arrays, `nn.ModuleDict`) still subscript the bound, so their precise indexing is kept.\n\nfixes https://github.com/facebook/pyrefly/issues/5257\n\nReviewed By: rchen152\n\nDifferential Revision: D125829160\n\nfbshipit-source-id: 63c81f74c489a66f4d9ca82ffca62863a9741fe2\n"
    },
    {
      "commit": "fd13e513042894b566619b4e8770f966dc69685c",
      "tree": "38207350f5ba15ecb265919eb2d75188c6d60a75",
      "parents": [
        "756872537c2d4ed4ae333cbdfce435eb3f67c4e4"
      ],
      "author": {
        "name": "Hamdi Hassan Shahid",
        "email": "shahhamdihassan@meta.com",
        "time": "Tue Oct 27 13:49:44 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 13:49:44 2026 -0700"
      },
      "message": "Add a test for configuring `unused-parameter` in `[errors]`\n\nSummary:\nThe language server greys out unused parameters, variables and imports, but these hints are not error kinds, so a project can\u0027t turn them off in `pyrefly.toml` (https://github.com/facebook/pyrefly/issues/5113). Naming one under `[errors]` makes the whole config invalid.\n\n`test_deserializing_unused_parameter_errors` pins that today: `unused-parameter \u003d \"ignore\"` is rejected as an unknown error kind. The stack above makes the three hints error kinds with a new default severity, `hint`, and this test flips to show the setting is accepted.\n\nProposal: https://docs.google.com/document/d/1tFRwMCeczZNunAlpocNvyWF4r4UHekRefChRnFEwtZM/edit\n\nReviewed By: kinto0\n\nDifferential Revision: D127864894\n\nfbshipit-source-id: 9df1c3dc0f821250dba05c2a45e5fa929c119a81\n"
    },
    {
      "commit": "756872537c2d4ed4ae333cbdfce435eb3f67c4e4",
      "tree": "587d572bda291db9a9cb58eb604a598d52cfcd30",
      "parents": [
        "9d5d356aa88b59a59ab985b15c0e19baa7a45d5c"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Upgrade typeshed\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- This diff upgrades the bundled typeshed from `a7bcce8` (2026-07-07) to upstream `main` at `7030b26`, and updates the test expectations that depend on the stubs.\n- The bundled stubs are more than three months old. Upstream has stub fixes that users report as pyrefly bugs, for example the 3.15 `frozendict` fixes. The diffs below this one fix the pyrefly problems that the new stubs expose.\n- The test updates follow from the new stubs: moved line numbers in `builtins.pyi` and `typing.pyi`, the removed `builtins.ellipsis` alias, and the new `_SupportsReversed` protocol. The `unused-coroutine` test for a Protocol `Coroutine` now uses the bundled stubs directly, so it moves from a custom-typeshed test in `test/state.rs` to a `testcase!`.\n\nI ran `crates/pyrefly_bundled/update.py` with docify enabled. The script downloaded the archive URL directly, because the GitHub API rate limit blocks the default `main` lookup through fwdproxy.\n\nReviewed By: stroxler\n\nDifferential Revision: D126992287\n\nfbshipit-source-id: 903c56ea456a8c65682a8eecd3c4de2998bb50d9\n"
    },
    {
      "commit": "9d5d356aa88b59a59ab985b15c0e19baa7a45d5c",
      "tree": "b6a27de0b903137760b5be524a14e5e148c8a272",
      "parents": [
        "e9363560e4e8c94af1ef654446315f6ef8f3f732"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Annotate the pydantic test stub\u0027s `Field` overload with a version-gated `EllipsisType`\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- The typeshed upgrade in D126992287 removes the `builtins.ellipsis` alias, and `test::pydantic::field::test_default_keywords` then fails. The test stub `pydantic/fields.py` annotates the first `Field` overload with `default: ellipsis`. Without the alias, that name does not resolve, so the overload accepts any `default` and returns `Any`. `Field(default\u003d\u0027oops\u0027)` then hides the expected `str` to `int` error.\n- This diff defines `EllipsisType` with a `sys.version_info` gate and annotates the overload with it. On Python 3.10 and later, the stub imports `types.EllipsisType`. On older versions, it uses `type(Ellipsis)`. This is the same pattern that real pydantic uses in `pydantic/_internal/_typing_extra.py`. A new test, `test_default_keywords_3_9`, covers the pre-3.10 branch.\n- The pre-3.10 branch uses `type(Ellipsis)` and not `ellipsis`, because the upgraded typeshed has no `ellipsis` on any Python version. With `EllipsisType \u003d ellipsis`, `test_default_keywords_3_9` fails on D126992287.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127225669\n\nfbshipit-source-id: c36da1ff62c1d62bd06c5f79e8de97ec475ad7b5\n"
    },
    {
      "commit": "e9363560e4e8c94af1ef654446315f6ef8f3f732",
      "tree": "c77b9c0e2ecce3e86a1827350f0215fdc0f0ffdf",
      "parents": [
        "6febd21b280334d6ab95080c78fb1e18f9bef43c"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Recognize `Protocol: type[_Protocol]` as the `Protocol` special form\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Problem: upstream typeshed (D126992287) declares `Protocol: type[_Protocol]` instead of `Protocol: _SpecialForm`. `SpecialForm::new` knows only the `Generic: type[_Generic]` pattern, so with the upgraded typeshed, `Protocol` loses its special-form meaning. Classes that inherit from `Protocol` do not become protocols, and `Protocol[T]` reports \"`type[_Protocol]` is not subscriptable\".\n- Fix: `SpecialForm::new` accepts `type[_\u003cName\u003e]` as a declaration of the special form `\u003cName\u003e`, the same as `\u003cName\u003e: _SpecialForm`. This one rule covers `Generic: type[_Generic]` and `Protocol: type[_Protocol]`. Before, `Generic` with any annotation became the special form, so the `type[_Generic]` check had no effect.\n- The fix works with both the current `Protocol: _SpecialForm` and the upstream `Protocol: type[_Protocol]`.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127256582\n\nfbshipit-source-id: 3514fa314f5156dc4408dfe3c85dffc4a8a4bb8d\n"
    },
    {
      "commit": "6febd21b280334d6ab95080c78fb1e18f9bef43c",
      "tree": "9f4d8cb5ac0a02efb7dcee0e99a5e64b4b8cfcdc",
      "parents": [
        "a06f9dc785bbd215145b16bf300ddaf4c6b23e78"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Resolve declared special forms as special exports\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Problem: a module that declares `Generic` or `Protocol` itself cannot use them as base classes. This occurs when pyrefly checks a copy of `typing.pyi` as a source module, such as `mypy/typeshed/stdlib/typing.pyi` in mypy_primer\u0027s `mypy` project. There, `class G(Generic[T])` reports \"`Generic` is not allowed in this context\" [invalid-annotation] and \"Invalid base class: `Generic`\" [invalid-inheritance]. Master reports 4 such errors on that file.\n- Root cause: two places recognize these names in different ways. `SpecialForm::new` gives a declared name its special-form type in any module. But the binding step classifies class bases with `as_special_export`, which accepts `Generic` and `Protocol` only from `typing` and `typing_extensions` (`SpecialExport::defined_in`). In `mypy.typeshed.stdlib.typing`, the base `Generic[T]` is therefore an ordinary type expression, and the solver rejects the `Generic` special form there.\n- Fix: when `as_special_export` follows a local name to its binding, a declaration that `SpecialForm::new` recognized resolves to the `SpecialExport` of that name. A module that declares a special form now treats it the same way as an import from `typing`.\n- This applies to any module, not only copies of `typing.pyi`. For example, a user module that declares `Literal: _SpecialForm` now also gets the `Literal` special export. This matches the type that `SpecialForm::new` already gives that name. The bundled `typing` module does not change, because `SpecialExport::defined_in` already accepts it.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127229419\n\nfbshipit-source-id: 9a3e808cab6dd34b3acdc227237ac15ba51414f9\n"
    },
    {
      "commit": "a06f9dc785bbd215145b16bf300ddaf4c6b23e78",
      "tree": "1d2f66f92dfb5cee939a163eac30869b055e8e9a",
      "parents": [
        "adbbdf38c2feb10629170c21f79a139fd0744609"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Add tests for `Generic` and `Protocol` declared outside `typing`\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Add two `testcase!` tests that declare `Generic` and `Protocol` in the checked module, as a vendored copy of typeshed\u0027s `typing.pyi` does. One test uses the current `Protocol: _SpecialForm` form. The other uses the upstream `Protocol: type[_Protocol]` form.\n- The tests record today\u0027s wrong behavior with `bug` markers. Classes that inherit from these names get `Invalid base class` and `is not allowed in this context` errors, or do not become protocols. The next diff fixes this.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127229327\n\nfbshipit-source-id: e898f4460721353a0880b468fcb65de231d03bbb\n"
    },
    {
      "commit": "adbbdf38c2feb10629170c21f79a139fd0744609",
      "tree": "4fc71bbdae3ce1e0deb0528ba6a0601e2680754a",
      "parents": [
        "67ef2ee43644a257cb12813cd2631a7fc74d8133"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Test `unused-coroutine` in conditions for classes that extend `Any`\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Extend `test_unused_coroutine_extends_any` to use `make_c()` and `make_d()` as conditions. The test records the current behavior: no `unused-coroutine` error for either.\n- A class with an `Any` base resolves every missing attribute to `Any`, so it matches the `Coroutine` Protocol after the typeshed upgrade in D126992287. Both `unused-coroutine` checks skip such classes with `extends_any`. The statement check already had a test; this covers the condition check in `check_implicit_bool`, so that a later change cannot drop the guard there without a test failure.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127845772\n\nfbshipit-source-id: 76131ca74e35e7a9a7f126e0c6cc0213b1092469\n"
    },
    {
      "commit": "67ef2ee43644a257cb12813cd2631a7fc74d8133",
      "tree": "40fd2f0b47fe0772c9434eec8a0b9cd540a11497",
      "parents": [
        "4a5e8624f433a95d21ba814b4e284794848190f0"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Do not resolve underscore attributes on namedtuples with dynamic fields\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Problem: for a namedtuple whose fields are not known statically, such as `collections.namedtuple(\"Ext\", [*Base._fields, \"extra\"])`, every missing instance attribute resolves to `Any`, including `__await__`. Such a namedtuple then matches `Awaitable` and other dunder-based protocols. After the typeshed upgrade in D126992287, `Coroutine` is a Protocol, so a discarded `e._replace(...)` gets a false `unused-coroutine` error in `test_named_tuple_replace_dynamic_fields`.\n- Fix: use the dynamic-field fallback only for attribute names that do not start with `_`.\n- Why it works: `collections.namedtuple` raises `ValueError` for a field name that starts with `_`, so a dynamic field can never supply `__await__` or any other underscore attribute. The namedtuple methods such as `_replace` and `_fields` are found on the class before the fallback.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127844721\n\nfbshipit-source-id: 8011a63515ee71470d196dec52c93b33ca71836f\n"
    },
    {
      "commit": "4a5e8624f433a95d21ba814b4e284794848190f0",
      "tree": "086732da8d2d9cd1f80747216c58916128e900bd",
      "parents": [
        "116b069620f4d25ec1f553e767fcbd7d1e25a8c4"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Add a test for underscore attributes on namedtuples with dynamic fields\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Add a test that records the current behavior for a namedtuple whose fields are not known statically: every missing attribute resolves to `Any`, including `_private` and `__await__`. So the namedtuple matches a protocol that requires `__await__`.\n- After the typeshed upgrade in D126992287, `Coroutine` is a Protocol, so the same fallback makes such a namedtuple match `Coroutine`, and `test_named_tuple_replace_dynamic_fields` gets a false `unused-coroutine` error. The bundled typeshed still has a nominal `Coroutine`, so this test uses a custom protocol to show the bug. The next diff fixes it.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127844666\n\nfbshipit-source-id: 0431da8cc8739b736fc8c92876cf378c5a79ee25\n"
    },
    {
      "commit": "116b069620f4d25ec1f553e767fcbd7d1e25a8c4",
      "tree": "bd045c306e6d7b53511f5bcfc117eed18f336de0",
      "parents": [
        "1c3eeacb4e0eb6cde55a43ac81609aca4dab40a0"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Do not let `__getattr__` satisfy protocol dunder methods\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Problem: protocol matching lets a `__getattr__` fallback satisfy any missing protocol member, dunder methods included. A class with `__getattr__` and `__setattr__`, such as `argparse.Namespace` or a pandas `DataFrame`, then matches `Awaitable`, `Iterable`, `Sized`, and other protocols. After the typeshed upgrade in D126992287, `Coroutine` is a Protocol, so these classes also match `Coroutine`. A discarded `DataFrame` value then gets a false `unused-coroutine` error, about 2150 times on mypy_primer.\n- Fix: reject a `__getattr__` fallback for a protocol member that is a dunder method, the same way we already reject it for a class object. This intentionally differs from mypy, which accepts the fallback for operator methods.\n- Why it works: Python looks up dunder methods on the type and does not call the instance\u0027s `__getattr__` for them, so `await Namespace()` raises `TypeError`. `Namespace` has no `__await__`, so it no longer matches `Coroutine`. Ordinary members and dunder data attributes such as `__name__` still match through `__getattr__`, because explicit attribute access does fall back to it.\n\nReviewed By: rchen152\n\nDifferential Revision: D127696753\n\nfbshipit-source-id: a05101f0b08378fcd3008e1c4642073c03653ff5\n"
    },
    {
      "commit": "1c3eeacb4e0eb6cde55a43ac81609aca4dab40a0",
      "tree": "e7f31ffbc2bc5ae02819ea82bdb71110e1d29eb0",
      "parents": [
        "99e5aac822f7f985f6194df70207a55a1cf10fda"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Add a test for protocol dunder methods that `__getattr__` satisfies\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Add a test that records the current wrong behavior: a class with `__getattr__` and `__setattr__` satisfies protocol dunder methods such as `Awaitable.__await__`, `Iterable.__iter__`, and `Sized.__len__`.\n- At runtime, Python looks up dunder methods on the type and does not call `__getattr__`, so these classes do not implement the protocols. This bug is also the cause of the false `unused-coroutine` errors after the typeshed upgrade in D126992287, where `Coroutine` becomes a Protocol: `argparse.Namespace` and `DataFrame` match `Coroutine` through `__getattr__`.\n- The test also checks that `__getattr__` still satisfies an ordinary method and a dunder data attribute such as `__name__`, because explicit attribute access does fall back to `__getattr__`.\n\nReviewed By: ndmitchell\n\nDifferential Revision: D127696582\n\nfbshipit-source-id: 0ea19718538ae98818f2116ad8373db2d3bc110f\n"
    },
    {
      "commit": "99e5aac822f7f985f6194df70207a55a1cf10fda",
      "tree": "47e3ffdb64d7c6ba65df3eea99ac60174ca79199",
      "parents": [
        "21a5523700590352ef13b0d7932a2061b2a767e5"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Add a test for `unused-coroutine` on classes that extend `Any`\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Add a test for `unused-coroutine` on a discarded instance of a class that extends `Any`. The test records the current behavior: no error for `class C(Any, Coroutine[...])` or for `class D(Any)`.\n- The next diff replaces the `extends_any` exclusion with a nominal `Coroutine` superclass check. That change makes `C` report `unused-coroutine`, because `C` is a real `Coroutine` subclass, and keeps `D` clean. This test shows that change with the bundled typeshed.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127619610\n\nfbshipit-source-id: 0a1c17e473f4c11bab55b6f5af4773450a40d131\n"
    },
    {
      "commit": "21a5523700590352ef13b0d7932a2061b2a767e5",
      "tree": "3c47e98edfab30fb0ce5b8f2cfef116bccf28624",
      "parents": [
        "413a7eff830ced26e93e68ac1979bb01a66cba8d"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 11:57:42 2026 -0700"
      },
      "message": "Add a test for `unused-coroutine` when `Coroutine` is a Protocol\n\nSummary:\nStack context: Upgrade pyrefly\u0027s bundled typeshed, and fix the pyrefly problems that the upgrade exposes.\n\n- Add a test that checks `unused-coroutine` against a custom typeshed in which `Coroutine` is a `runtime_checkable` Protocol, as in upstream typeshed. The test records the current wrong behavior: a discarded `argparse.Namespace()` gets a false `unused-coroutine` error.\n- The typeshed upgrade in D126992287 makes `Coroutine` a Protocol, and this false positive then shows up about 2150 times on mypy_primer. The bundled typeshed still has a nominal `Coroutine`, so a `testcase!` cannot show the bug. The test patches a copy of the bundled stubs instead, the same way the other custom-typeshed tests in `test/state.rs` do. The next diff fixes the bug and updates the expectation.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127227220\n\nfbshipit-source-id: f6e2966edfc6ee105ae1b4674efd01259a92545f\n"
    },
    {
      "commit": "413a7eff830ced26e93e68ac1979bb01a66cba8d",
      "tree": "a777b3b3763218c7761d7ff1881d8a38c8c2db76",
      "parents": [
        "c7575e29a4e4697472dbead3e444339d8eaf564c"
      ],
      "author": {
        "name": "jorenham",
        "email": "jhammudoglu@gmail.com",
        "time": "Tue Oct 27 08:23:10 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 08:23:10 2026 -0700"
      },
      "message": "Count `_ \u003d set[int]()` as typed in `pyrefly coverage` (#5383)\n\nSummary:\nBefore, `x \u003d set[int]()` would be treated as untyped, because `x` had no annotations. This is a bit silly though, since `set[int]` is already explicitly provided by the user, albeit on the RHS. This makes it so that `pyrefly coverage {report,coverage}` will consider `x`  to be typed.\n\nIn case of unknown rhs, e.g. `from schrodinger import cat; cats \u003d cat[None]()`, `cats` will still be considered untyped. Because `cat` could be a generic type, but it could also be `dict[None, () -\u003e SomethingElse]` -- there\u0027s no way to tell :shrug:.\n\nI ran into this in the wild in [Hypothesis](https://github.com/HypothesisWorks/hypothesis/) recently:\n\n-  [`default_variable \u003d DynamicVariable[Optional[\"settings\"]](None)`](https://github.com/HypothesisWorks/hypothesis/blob/a2406edcd532e02400c8e20e6a131b791d3c11b6/hypothesis/src/hypothesis/_settings.py#L416)\n- [`reporter \u003d DynamicVariable[ReporterT](default)`](https://github.com/HypothesisWorks/hypothesis/blob/a2406edcd532e02400c8e20e6a131b791d3c11b6/hypothesis/src/hypothesis/reporting.py#L28)\n\n- [x] I am a human \u003csub\u003e(no way to know for sure, but I certainly hope so!)\u003c/sub\u003e, and I fully understand the code I am submitting.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5383\n\nTest Plan: Tests added\n\nReviewed By: stroxler\n\nDifferential Revision: D127555133\n\nfbshipit-source-id: ff4ae96effd52aa2e24205800c569c63a9bba584\n"
    },
    {
      "commit": "c7575e29a4e4697472dbead3e444339d8eaf564c",
      "tree": "3028f1b5af4c735a61f016f255a881aa290e0b9f",
      "parents": [
        "5ecfddfa521bf865b17b6a1d831f51fe9a8deafe"
      ],
      "author": {
        "name": "Thomas Polasek",
        "email": "thomaspolasek@meta.com",
        "time": "Tue Oct 27 08:17:51 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 08:17:51 2026 -0700"
      },
      "message": "Return typed errors from qualified-name resolution\n\nSummary: Return typed diagnostics for invalid names and unavailable query state instead of panicking. Preserve successful responses and distinguish HTTP 400 input errors from HTTP 500 internal faults.\n\nReviewed By: kinto0\n\nDifferential Revision: D127666571\n\nfbshipit-source-id: a8bdc981b84da22781660153d5ba2a416aefc2bf\n"
    },
    {
      "commit": "5ecfddfa521bf865b17b6a1d831f51fe9a8deafe",
      "tree": "da635689e6a530a7a5d04b13d88072e2f0e3ea7b",
      "parents": [
        "683813828335a76144e9377a80b284ab40f36e57"
      ],
      "author": {
        "name": "Mangesh Raut",
        "email": "mbr63drexel@gmail.com",
        "time": "Tue Oct 27 08:04:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 08:04:41 2026 -0700"
      },
      "message": "fix(stubs): allow array inputs to NumPy scalar constructors (#5370)\n\nSummary:\nCloses https://github.com/facebook/pyrefly/issues/5357.\n\n# Issue 5357 result\n\nAdded scalar and ndarray-returning overloads for NumPy integer, floating,\ncomplex, and boolean scalar constructors. List literals keep their inferred\nshape and constructor dtype; ndarray inputs keep their shape and receive the\nconstructor dtype. Added coverage for array and scalar results.\n\n## Files\n\n- `tensor-shapes/pyrefly-numpy-stubs/numpy-stubs/__init__.pyi`\n- `tensor-shapes/pyrefly-numpy-stubs/test/test_dtype_properties.py`\n\n## Commit\n\n`499aeb1405e35d5e2d6ea93eebc96ff2d5c726c7` — `fix(stubs): allow array inputs to NumPy scalar constructors`\n\n## Checks\n\n- PASS: Stub-file static check and all 15 NumPy suites (tests and examples).\n- PASS: NumPy runtime suite, all 15 suites and 213 tests.\n- PASS: Ruff format and import checks on the modified Python test.\n- PASS: `git diff --check`.\n- The repository handoff command could not finish because Cargo is unavailable; it stopped at `cargo fmt`. Ruff and the NumPy static/runtime suites passed.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5370\n\nReviewed By: stroxler\n\nDifferential Revision: D127483828\n\nfbshipit-source-id: ada9520ddec498c28935aa2be054879f17b0479b\n"
    },
    {
      "commit": "683813828335a76144e9377a80b284ab40f36e57",
      "tree": "30cbd7a42d0eb64c49be4800cbdfc891c4784493",
      "parents": [
        "c016775606b02eba73363b187ecac746cac3ade8"
      ],
      "author": {
        "name": "Mangesh Raut",
        "email": "mbr63drexel@gmail.com",
        "time": "Tue Oct 27 08:01:07 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 08:01:07 2026 -0700"
      },
      "message": "fix(stubs): type NumPy sqrt for array-like inputs (#5368)\n\nSummary:\nFixes https://github.com/facebook/pyrefly/issues/5351: `numpy.sqrt` was effectively untyped (generic ufunc `Any` call) under tensor-shapes stubs.\n\nAdd proper typing for `numpy.sqrt` on array-like inputs consistent with sibling unary ufuncs, plus focused coverage.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5368\n\nTest Plan:\n- [x] Focused stub/type tests for sqrt\n- [ ] CI on this PR\n\nCloses https://github.com/facebook/pyrefly/issues/5351\n\nReviewed By: stroxler\n\nDifferential Revision: D127482820\n\nfbshipit-source-id: 8e7467a8656806404713b99aa3fea6f72995730d\n"
    },
    {
      "commit": "c016775606b02eba73363b187ecac746cac3ade8",
      "tree": "184a2755016f80b2f8ab461e0dcd8087670fd869",
      "parents": [
        "948a553fbfb9391db5821640bd91df7a2d07d30a"
      ],
      "author": {
        "name": "Mangesh Raut",
        "email": "mbr63drexel@gmail.com",
        "time": "Tue Oct 27 08:00:21 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 08:00:21 2026 -0700"
      },
      "message": "fix(stubs): accept tensor weights in torch.lerp (#5371)\n\nSummary:\nCloses https://github.com/facebook/pyrefly/issues/5360.\n\n`torch.lerp` and `Tensor.lerp` only accepted a scalar `weight` in the shape stubs, so passing a tensor weight was an error. This adds tensor-weight overloads for both that broadcast across `input`, `end`, and `weight`. The existing scalar-weight signatures are unchanged.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5371\n\nTest Plan:\n`test_pointwise_arithmetic.py` now checks that a `(3, 1)` weight with two length-2 inputs gives `Tensor[[3, 2]]` through both `torch.lerp(start, end, weight)` and `start.lerp(end, weight)`. The runtime suite passes (11 tests, 58 shape assertions), and ruff format and import checks are clean.\n\nHappy to change the approach if you had something else in mind.\n\nReviewed By: stroxler\n\nDifferential Revision: D127483846\n\nfbshipit-source-id: 19c98e507cda94d4d11759295f1efabc9706d9fb\n"
    },
    {
      "commit": "948a553fbfb9391db5821640bd91df7a2d07d30a",
      "tree": "f1246a50f6534be05368491bf210e07825881a2e",
      "parents": [
        "82b28db654fac060039c1f46a9ee2457ecfb31e7"
      ],
      "author": {
        "name": "Catherine Gasnier",
        "email": "catg@meta.com",
        "time": "Tue Oct 27 04:18:28 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 04:18:28 2026 -0700"
      },
      "message": "Record Glean declarations before emitting references, and declare comprehension variables\n\nSummary:\n## Background\n\nThe Glean converter (`report/glean/convert.rs`) turns each Python file into Glean facts. There are two kinds of facts:\n\n- Declaration facts, e.g. \"class `m.Outer.Inner` is declared at this span\".\n- Cross-references (xrefs), e.g. \"the `method` at this span refers to `m.Outer.Inner.method`\".\n\nTo name the target of an xref, the converter looks the use up in tables that are filled while declarations are emitted. `locations_fqnames` maps the position of a definition to its fully qualified name, `names` holds the names recorded so far, and `import_names` maps the names that imports bind to what they resolve to.\n\n## The problem\n\nUntil now, the converter walked each file once. It emitted the declarations and xrefs of each statement in the same step. So when a use was processed before its declaration, the lookup found nothing. Two examples:\n\n1. A function that uses a class defined later in the file:\n   ```\n   def build() -\u003e str:\n       return Outer.Inner().method()\n\n   class Outer:\n       class Inner:\n           def method(self) -\u003e str: ...\n   ```\n   When `build` is processed, `Outer.Inner` is not recorded yet.\n\n2. A variable assigned in both branches of an `if` and used afterwards (`return result`).\n\nTwo patches worked around this:\n\n- Statements were processed depth-first in source order. This fixed example 2, because the branches are processed before the `return`.\n- `get_definition_location` had a fallback for an unrecorded class of the same module. It built the name from the module, the class\u0027s short name and the member. This is wrong for nested classes: example 1 got `m.Inner.method` instead of `m.Outer.Inner.method`.\n\n## The fix: two passes\n\n`generate_facts` now walks each file in two passes:\n\n1. The first pass (`declare_statements`, `declare_statement`) records the fully qualified name of every declaration in the lookup tables. This covers classes, functions, parameters, variables (including walrus, `for`, `with` and `except` targets), imports and comprehension variables. It emits no facts and no xrefs.\n2. The second pass (`process_statement`) emits declaration facts and xrefs as before. The tables are now complete, so every lookup finds its declaration, wherever it is in the file. The second pass reads declared names from the tables (`declared_name`) instead of computing them again, so the naming logic exists only once.\n\nThis matches Python\u0027s static scoping. Python decides which binding a name refers to from the whole scope, not from the order of the statements. A function body can use a class defined later in the module, because the body only runs after the module has been executed. Recording all bindings first gives the second pass the same view.\n\nThe first pass also returns the list of statements with their contexts, in source order, so the second pass is a flat loop and does not walk the tree again. Imports are resolved by shared helpers (`import_bindings`, `import_from_binding`): the first pass records the bindings, and the second pass emits facts and xrefs from them.\n\nThe fallback in `get_definition_location` is removed. With complete tables, a same-module class is always found through its definition position, and the nested class of example 1 now gets `m.Outer.Inner.method`.\n\nThis is a clean split rather than running the whole emitter twice. Apart from resolving imports, the first pass does no reference lookups, which are the expensive part of the conversion.\n\n## Comprehension variables\n\nThe target variables of list, set and dict comprehensions and of generator expressions had no declaration. Their uses were named at module level, e.g. `m.path`, which collides with any real module-level `path`.\n\nEach comprehension target, in every `for` clause and including tuple targets, is now declared as a variable in a `\u003ccomprehension\u003e` scope inside the enclosing scope. This is the naming of the Pyre-based Glean database. For example:\n\n```\nclass Runner:\n    classmethod\n    def by_path(cls, configs: dict[str, str]) -\u003e dict[str, str]:\n        return {path: cls.helper(value) for path, value in configs.items()}\n\ntotals \u003d [n * 2 for n in range(3)]\n```\n\n- `path` and `value` are `m.Runner.by_path.\u003clocals\u003e.\u003ccomprehension\u003e.path` and `.value`.\n- `n` is `m.\u003ccomprehension\u003e.n`.\n\nAll comprehensions of a scope, nested ones included, share the same `\u003ccomprehension\u003e` segment. This keeps the names simple. It doesn\u0027t break resolution, because uses resolve through the definition position, which is distinct for each comprehension. Two comprehensions with the same variable name in the same scope share one declaration name. A walrus target inside a comprehension binds the enclosing scope (PEP 572), so its name is unchanged.\n\n## Suggested review order\n\n1. `convert.rs`: `generate_facts`, `declare_statements`, `declare_statement`, `declare_targets` and `child_context` (the first pass).\n2. `convert.rs`: `process_statement` and `variable_facts` (the second pass, which now reads names with `declared_name`).\n3. `convert.rs`: `ExprBindings`, `expr_bindings` and `bound_names` (finding walrus targets, comprehension targets and assignment targets).\n4. `convert.rs`: the import helpers (`ImportBinding`, `import_bindings`, `import_from_binding`, `record_import`, `import_fact`).\n5. `convert.rs`: the removed fallback in `get_definition_location`.\n6. `glean.rs` and the snapshots.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127577128\n\nfbshipit-source-id: 6aaf6e1d744c007ed068805f9005464c71348bea\n"
    },
    {
      "commit": "82b28db654fac060039c1f46a9ee2457ecfb31e7",
      "tree": "b571db544f225d3a6b3d320cb154bf980155fa38",
      "parents": [
        "60a486662788a4abdf77e93602f43db94feff1b0"
      ],
      "author": {
        "name": "Catherine Gasnier",
        "email": "catg@meta.com",
        "time": "Tue Oct 27 03:54:03 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 03:54:03 2026 -0700"
      },
      "message": "Use the solver\u0027s member lookup to find the defining class in the Glean report\n\nSummary:\nPyrefly\u0027s Glean report names an inherited member after the class that defines it, e.g. `child.greet()` targets `m.Base.greet` instead of `m.Child.greet` (D127187873, D127572082). It found that class by walking the receiver\u0027s method resolution order (MRO) itself, checking each class\u0027s fields for the attribute.\n\nThat duplicates what the solver already does: `get_class_member_with_defining_class` performs the same member lookup the type checker uses, and returns the class where the member was found. This diff calls it instead.\n\nWhy:\n- One source of truth: the Glean names follow the type checker\u0027s member lookup, including any rules it applies, instead of a parallel reimplementation.\n- No second walk of the MRO per attribute access in the converter.\n- Less code.\n\nThe defining class is passed on as `Type::ClassDef`, because `get_definition_location` only reads the type\u0027s qualified name.\n\nReview the `defining_type` closure in `find_definition_for_typed_attribute` (`convert.rs`).\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127575179\n\nfbshipit-source-id: 2110eb1959ce7a6afd8ac3d5813b2969b1161332\n"
    },
    {
      "commit": "60a486662788a4abdf77e93602f43db94feff1b0",
      "tree": "cb8dbf6f8fa03a5eb255b2c41aee0337c4d60901",
      "parents": [
        "eaba8f05efbd97ee6e79f1a452d875e67ff75aa4"
      ],
      "author": {
        "name": "Catherine Gasnier",
        "email": "catg@meta.com",
        "time": "Tue Oct 27 03:54:03 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 03:54:03 2026 -0700"
      },
      "message": "Resolve `self` members, CPython stdlib layouts and later classes in the Glean report\n\nSummary:\nA full test run of the previous Glean-report fixes (T291925475) measured which cross-references Glass still can\u0027t navigate, on a sample of 300 fbcode files. It found three follow-up problems in Pyrefly\u0027s Glean converter (`report/glean/convert.rs`).\n\n**1. Members inherited through `self`.** D127187873 names an inherited member after the class that declares it, e.g. `child.greet()` targets `m.Base.greet` instead of `m.Child.greet`. It only handled receivers whose type is an ordinary instance (`Type::ClassType`). Inside a method, `self` has type `Type::SelfType`, so `self.assertEqual(...)` in a `unittest.TestCase` subclass `MyTest` still targeted `unittest.case.MyTest.assertEqual`, which nothing declares. This was about 2,600 spans in the sample, mostly `self.assertX` in tests. Fix: treat `Type::SelfType` like `Type::ClassType` when looking for the declaring class.\n\n**2. Typeshed vs CPython file layout.** D127187874 maps a bundled typeshed stub to the stdlib source it describes, e.g. `logging/__init__.pyi` to `third-party/python/3.12/Lib/logging/__init__.py`. But typeshed and CPython sometimes lay a module out differently: typeshed has `os/__init__.pyi` for CPython\u0027s `os.py`, and `re.pyi` for CPython\u0027s `re/__init__.py`. References to `os`, `os.path`, `pathlib` and `re` then recorded a file that doesn\u0027t exist, so Glass couldn\u0027t match them. This was about 800 spans. Fix: `stdlib_source_file` tries both layouts, the stub\u0027s own first, and uses the one that exists.\n\n**3. Classes defined later in the same file.** D127187872 made the converter process statements in source order. A method call on a class defined further down, e.g. `Later().name()` inside a function above `class Later`, then found no recorded declaration for the method and emitted no cross-reference. Fix: in that case, build the name from the receiver\u0027s class, as is already done for classes of other modules.\n\nReview order: `defining_type` and the fallback in `get_definition_location`, then `stdlib_source_file` (all in `convert.rs`), then the tests. In the `classes` snapshot, `self.name` in a subclass of `Animal` now targets `classes.Animal.name`, where the attribute is declared, instead of `classes.Dog.name`.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127572082\n\nfbshipit-source-id: 4508fbd16f43723634fda8102ebfe2b9b453daf7\n"
    },
    {
      "commit": "eaba8f05efbd97ee6e79f1a452d875e67ff75aa4",
      "tree": "bce52504feacf04a58d3168e9a20be0c1c601a78",
      "parents": [
        "ab877dfecccc9434689030590cbcee89cc8bec79"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Tue Oct 27 02:14:20 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 02:14:20 2026 -0700"
      },
      "message": "Replace hand-rolled closure with existing narrowing helper\n\nSummary:\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127771170\n\nfbshipit-source-id: 20480568a196e0ffaf9e2faab06922c3de0501e3\n"
    },
    {
      "commit": "ab877dfecccc9434689030590cbcee89cc8bec79",
      "tree": "9c282008641a8089267085e45a56f6eb45ff086b",
      "parents": [
        "615a3d1d71a3e1576174b44a5ec93b5db61bcf27"
      ],
      "author": {
        "name": "Asuka Minato",
        "email": "i@asukaminato.eu.org",
        "time": "Tue Oct 27 01:52:32 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 01:52:32 2026 -0700"
      },
      "message": "fix assert with date value does not narrow #5178 (#5179)\n\nSummary:\nFixes https://github.com/facebook/pyrefly/issues/5178\n\nDate equality assertions now narrow `date | None` to `date`.\n\n- [x] I am a human, and I fully understand the code I am submitting.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5179\n\nTest Plan: add test\n\nReviewed By: rchen152\n\nDifferential Revision: D124383505\n\nfbshipit-source-id: ae75752631c222d061c9d8428a3eaa499195d36f\n"
    },
    {
      "commit": "615a3d1d71a3e1576174b44a5ec93b5db61bcf27",
      "tree": "2173d4ee845d413a5482f9544d40541eef2ef118",
      "parents": [
        "326d199c6124fc697df25e854444833f3210ad35"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Tue Oct 27 00:56:11 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 00:56:11 2026 -0700"
      },
      "message": "Give PR turn tracking workflow permission to update labels\n\nSummary:\n\"issues: write\" does not give permission to update labels on PRs: https://github.com/facebook/pyrefly/actions/runs/40467283944/job/122065693163. \"pull-requests: write\" hopefully will.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127764853\n\nfbshipit-source-id: 20f96c6d1e37a0d5d825dc6392566915b5dce70e\n"
    },
    {
      "commit": "326d199c6124fc697df25e854444833f3210ad35",
      "tree": "7b46e352da4ad321f8a68b21dfdb9b4a298b47a4",
      "parents": [
        "2e3a17b8929c0ca8f52a508d391080eadfb5dc1a"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Tue Oct 27 00:20:29 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Tue Oct 27 00:20:29 2026 -0700"
      },
      "message": "Detect incorrect inputs to automation_pr_state workflow_dispatch\n\nSummary:\nErrors on an unrecognized scenario or a PR number being provided for backfill.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127756273\n\nfbshipit-source-id: befd7cf95110555d738bc31eec2c5269e959459d\n"
    },
    {
      "commit": "2e3a17b8929c0ca8f52a508d391080eadfb5dc1a",
      "tree": "7998f22727f7ca51a13e820925161d81611e6f38",
      "parents": [
        "85ed882c741958607d6fcfc99f6c6dba2d95cbc5"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Mon Oct 26 23:55:48 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 23:55:48 2026 -0700"
      },
      "message": "Shorten descriptions of automation_pr_state workflow_dispatch options\n\nSummary:\nToo wordy\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127756209\n\nfbshipit-source-id: 5e83cd5e551c4c9e9370ea045c495ea7a23c3b16\n"
    },
    {
      "commit": "85ed882c741958607d6fcfc99f6c6dba2d95cbc5",
      "tree": "41494f887e954db937a8012a801ae35461da7db3",
      "parents": [
        "f90f3bcf8f122fa9c02b194540fa5f9172a1b8b8"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Mon Oct 26 23:55:48 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 23:55:48 2026 -0700"
      },
      "message": "Add manual PR selection for automation_pr_state\n\nSummary:\nAdds a way to manually update the label on a single PR, including dry run capability.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127753793\n\nfbshipit-source-id: c2e071f99a30578ad7e3f95f196270472595b522\n"
    },
    {
      "commit": "f90f3bcf8f122fa9c02b194540fa5f9172a1b8b8",
      "tree": "a05b4a4d86b08b6bd17fd0957f450345e4459a01",
      "parents": [
        "4d9f02eb9b2303c39ed2f9fee97a0b66b3373c77"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Mon Oct 26 23:55:48 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 23:55:48 2026 -0700"
      },
      "message": "Fix PR selection in automation_pr_state\n\nSummary:\nThe \"head repo\" is always facebook/pyrefly, so the workflow was unable to find PRs opened from forks.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127752333\n\nfbshipit-source-id: 1c4bd1d3945b61ded85a5bdd59836ccd14a2e563\n"
    },
    {
      "commit": "4d9f02eb9b2303c39ed2f9fee97a0b66b3373c77",
      "tree": "6243f337e5b50334f9a41117b61c8f7cb374abf2",
      "parents": [
        "47fe61a176ba385d8b52baec1591f8639d01f2c3"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 22:17:47 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 22:17:47 2026 -0700"
      },
      "message": "Bump codspeed-criterion-compat 5.0.2 -\u003e 5.0.3\n\nSummary:\nAutomated semver-compatible version bump.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127734997\n\nfbshipit-source-id: 9a4837d17939a7a3f143ca273d9811e66c4524c8\n"
    },
    {
      "commit": "47fe61a176ba385d8b52baec1591f8639d01f2c3",
      "tree": "719e9bd1b6e8c6207ec46ba06dafda5db4705b8f",
      "parents": [
        "1928c804791c88f8d83799a3f169d381535e937d"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 22:17:47 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 22:17:47 2026 -0700"
      },
      "message": "Bump toml_edit 0.25.15+spec-1.1.0 -\u003e 0.25.17+spec-1.1.0\n\nSummary:\nAutomated semver-compatible version bump.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127734995\n\nfbshipit-source-id: 6389a6e6f50cffe1a7d6b2b29e1e26552f5bea70\n"
    },
    {
      "commit": "1928c804791c88f8d83799a3f169d381535e937d",
      "tree": "c8b41ed7e6c33779e450a0a934994617e7ea4d9e",
      "parents": [
        "07402a243ec099c24f8085cef800c8f47a22845d"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 22:17:47 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 22:17:47 2026 -0700"
      },
      "message": "Bump toml 1.1.6+spec-1.1.0 -\u003e 1.1.8+spec-1.1.0\n\nSummary:\nAutomated semver-compatible version bump.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127734994\n\nfbshipit-source-id: 76bf39d090e0c5c7d88d1372f085f8202e55f562\n"
    },
    {
      "commit": "07402a243ec099c24f8085cef800c8f47a22845d",
      "tree": "460976f4057edc60951e7cccf8e8f01f859d947a",
      "parents": [
        "2422b63235aeb419eca49cb6e4d4349c9fc93099"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 22:17:47 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 22:17:47 2026 -0700"
      },
      "message": "Bump append-only-vec 0.1.8 -\u003e 0.1.10\n\nSummary:\nAutomated semver-compatible version bump.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127734983\n\nfbshipit-source-id: 52e3a9e9873e30e8a3f6cfb569e663587d5fd0e5\n"
    },
    {
      "commit": "2422b63235aeb419eca49cb6e4d4349c9fc93099",
      "tree": "584330c3574b61b9303e8566429b0e9f65e5f8c3",
      "parents": [
        "6f459278d5df091b5f87cf9b6ee7f6040d156726"
      ],
      "author": {
        "name": "Mohammed Sufiyan Ahmed",
        "email": "mohammed.sufiyan.msa@gmail.com",
        "time": "Mon Oct 26 20:56:29 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 20:56:29 2026 -0700"
      },
      "message": "Fix TypedDict inference for unpacked dict literals under union hints (#5185)\n\nSummary:\nFixes https://github.com/facebook/pyrefly/issues/5184\n\nA dict literal that unpacks an open TypedDict (e.g. `{**a, \"token\": None}`) was inferred as `dict[str, ...]` instead of the expected TypedDict whenever the hint was a union, such as a union of `(status, body)` tuples or `B | None`. A single hint worked.\n\nUnpacking an open TypedDict always produces an `open-unpacking` error, which is off by default. `dict_infer` only used a TypedDict member of a multi-member hint if checking against it produced no errors at all, so this hidden error made it reject the TypedDict. A single hint was unaffected because it is used regardless of errors.\n\n`dict_infer` now also uses a named TypedDict member when all of its check errors are soft (`ErrorKind::is_soft`). This matches how soft errors are treated elsewhere, e.g. `infer_with_decomposed_hint` and overload selection. The soft errors are still forwarded to the hint\u0027s error collector, so `open-unpacking` is reported as before when enabled. Anonymous TypedDict hints and hard errors behave as before.\n\nNote: `is_subset_partial_typed_dict` returns the open-unpacking error before checking the remaining fields, so it can hide a real field mismatch. That already affects single hints and is a separate fix I can follow up on.\n\n- [x] I am a human, and I fully understand the code I am submitting.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5185\n\nTest Plan:\n- Added `test_unpack_inherited_typeddict_with_union_hint` (the issue\u0027s repro plus a `B | None` return) and a union-hint case (`t5`) to `test_open_unpacking`. Both fail before the fix and pass after.\n- `cargo test -p pyrefly --lib`: 9052 passed, 0 failed.\n- `python3 test.py --no-test --no-tensor-shapes --no-conformance --no-jsonschema --no-extension`: clean.\n- Conformance results are unchanged.\n\nReviewed By: rchen152\n\nDifferential Revision: D127702779\n\nfbshipit-source-id: 15bb7dc1f759c1037bc6e7f13b9e2adc83f3a7d3\n"
    },
    {
      "commit": "6f459278d5df091b5f87cf9b6ee7f6040d156726",
      "tree": "2e991da3a8df7fc816ebd854f74dac1a1fff23f1",
      "parents": [
        "590337fef2c47658f7dfdbbf33cf42a83ab2e65a"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Mon Oct 26 20:24:07 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 20:24:07 2026 -0700"
      },
      "message": "Label PRs with who needs to act next (#5406)\n\nSummary:\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5406\n\nAdds automated turn tracking for PRs via \"waiting-for-*\" labels, currently limited to PRs that have already had a label manually added. I plan to label a small number of PRs and check if the turn tracking is working correctly, before rolling it out to all PRs.\n\nThe way the labels work:\n* No label: draft PRs, closed PRs, exported PRs, and PRs authored by bots and members of owners.json.\n* \"waiting-for-merge\": PRs with an approval and no active \"changes requested\" reviews.\n* \"waiting-for-author\": PRs without a signed CLA, PRs with unaddressed review feedback.\n* \"waiting-for-reviewer\": PRs with a signed CLA that have not yet been reviewed, or which have been sent back to a reviewer via the \"re-request review\" button or a comment tagging the reviewer.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127710246\n\nfbshipit-source-id: 5bb21193ea9c1f0b24a71aebdde4f849828af702\n"
    },
    {
      "commit": "590337fef2c47658f7dfdbbf33cf42a83ab2e65a",
      "tree": "d0e4553811806a46f6e80db54d7d4ae08b5fb0fd",
      "parents": [
        "271c0071bd3a0f68636b3b09881d3fb5abf7aa39"
      ],
      "author": {
        "name": "Mangesh Raut",
        "email": "mbr63@drexel.edu",
        "time": "Mon Oct 26 19:35:46 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 19:35:46 2026 -0700"
      },
      "message": "fix(match): narrow after star-only sequence patterns (#5384)\n\nSummary:\n## Why\n\nA star-only sequence pattern on a fixed tuple subject is exhaustive, but `MatchStar` was not recognized as an irrefutable sequence subpattern. Its fallback narrowing retained a placeholder, so later cases could not narrow to `Never`.\n\n## What changed\n\nTreat star subpatterns as irrefutable within sequence patterns. For fixed tuple subjects, use the number of non-star patterns to recognize compatible star sequences as catch-alls, while preserving refutable cases such as `[1, *_]`.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5384\n\nTest Plan:\n- `cargo test -p pyrefly --lib pattern_match -- --nocapture`\n- `cargo test -p pyrefly --lib flow_branching -- --nocapture`\n- `cargo test -p pyrefly_python`\n- `python3 test.py --no-test --no-tensor-shapes --no-conformance --no-jsonschema --no-extension`\n- Debug CLI smoke under default and strict presets; confirmed `[1, *_]` remains non-exhaustive.\n\nFixes https://github.com/facebook/pyrefly/issues/5336\n\nReviewed By: stroxler\n\nDifferential Revision: D127563545\n\nfbshipit-source-id: 5a295530e7a0cc0ae5ba55b3fd76fe113f95a045\n"
    },
    {
      "commit": "271c0071bd3a0f68636b3b09881d3fb5abf7aa39",
      "tree": "c0abd0c5927aee480d471f8b1913dcf3eb9ee41b",
      "parents": [
        "0159ac46b570f87352bed2177a51fe44e534efdc"
      ],
      "author": {
        "name": "Mangesh Raut",
        "email": "mbr63@drexel.edu",
        "time": "Mon Oct 26 19:14:51 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 19:14:51 2026 -0700"
      },
      "message": "fix(callable): reject leftover star args on zero-arity overloads (#5382)\n\nSummary:\n## Why\n\n`dict(\"a\")` correctly reports `no-matching-overload`, but `dict(*{\"a\": 2})` and `dict(*xs)` with `xs: list[str]` were silent. Unpacking a mapping or `list[str]` yields `str` elements, so those calls are the same shape as `dict(\"a\")` and should fail.\n\nThe zero-argument `dict()` overload was matching because an unknown-length `*` leftover was ignored once positional parameters ran out.\n\nFixes https://github.com/facebook/pyrefly/issues/5381.\n\n## What changed\n\nIn call matching, a leftover non-gradual unknown-length star argument is now treated as an extra positional argument when no parameter remains to absorb it. That stops zero-arity overloads from accepting bad splats.\n\nGradual `Any` splats stay permissive so `*args: Any` forwarding still works.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5382\n\nTest Plan:\n- [x] `dict(*{\"a\": 2})` and `dict(*xs: list[str])` error\n- [x] `dict()`, `dict(a\u003d1)`, `dict({\"a\": 1})`, `dict(**{\"a\": 1})` still OK\n- [x] `f(*())` on a zero-arg function still OK; `f(*xs)` on a zero-arg function errors\n- [x] Focused `test_splat*` / `test_unpack*` / overload suite green\n- [x] CLI smoke check shows the three intended errors only\n\nReviewed By: stroxler\n\nDifferential Revision: D127554098\n\nfbshipit-source-id: 006ea39ac020c7260fd9fd64b33c3f0912ca5fdc\n"
    },
    {
      "commit": "0159ac46b570f87352bed2177a51fe44e534efdc",
      "tree": "1d77fbb9ff097e6a35b201e447d755b816dc7ba4",
      "parents": [
        "37a2b2be27238e25d30c7b8dbd3d541056ab767b"
      ],
      "author": {
        "name": "William Bruns",
        "email": "adde.animulis@gmail.com",
        "time": "Mon Oct 26 19:03:36 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 19:03:36 2026 -0700"
      },
      "message": "Fix some user-facing typos on https://pyrefly.org/en/docs (\"misatch\" -\u003e \"mismatch\", \"tedius\" -\u003e \"tedious\", \"resultion\" -\u003e \"resolution\", \"editiable\" -\u003e \"editable\") (no AI or LLM used) (#5399)\n\nSummary:\nHello Pyrefly team!\n\nThanks for a great tool and excellent resources. To give back, I am sending this simple PR to fix typos on https://pyrefly.org/en/docs (no code changes). No AI or LLMs were used to assist with finding the typos or preparing this change.\n\nOn https://pyrefly.org/en/docs/ (archived as is at https://web.archive.org/web/20261026194931/https://pyrefly.org/en/docs/ )\n- In the code comment\n  \u003e \\# Pyrefly catches this error before runtime due to a type misatch between 42 and \"str\"\n\n  \"misatch\" should be \"mismatch\"\n\nOn https://pyrefly.org/en/docs/autotype/ (archived as is at https://web.archive.org/web/20261026194208/https://pyrefly.org/en/docs/autotype/ )\n- In the sentence\n  \u003e Manually adding type annotations to your code can be tedius and time-consuming.\n\n  \"tedius\" should be \"tedious\"\n\nOn https://pyrefly.org/en/docs/configuration/ (archived as is at https://web.archive.org/web/20261026194229/https://pyrefly.org/en/docs/configuration/ )\n- In the sentence\n  \u003e For more information on import resultion in general see the import resolution docs.\n\n  \"resultion\" should be \"resolution\".\n\n- In the sentence\n  \u003e If you\u0027re running into problems with editiable installations in your project, please read up on editable installs with static analysis tools.\n\n \"editiable\" should be \"editable\".\n\n- [x] I am a human, and I fully understand the code I am submitting.\n\n- [x] I have completed the Facebook CLA (Contributor License Agreement)\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5399\n\nTest Plan: N/A, as these are just typos in the documentation, there are no code changes or even formatting changes to the website.\n\nReviewed By: rchen152\n\nDifferential Revision: D127648442\n\nfbshipit-source-id: 7929fb0484945deadb919257d7827a153cc2622f\n"
    },
    {
      "commit": "37a2b2be27238e25d30c7b8dbd3d541056ab767b",
      "tree": "1fc4631763ad963c0631b4f963206947d7ffbb72",
      "parents": [
        "5fd2b58e0f815314ac5e0e96589c3d153ee1fcc3"
      ],
      "author": {
        "name": "Chaimaa Abi",
        "email": "118536453+Cha-Imaa@users.noreply.github.com",
        "time": "Mon Oct 26 19:02:55 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 19:02:55 2026 -0700"
      },
      "message": "Accept requires_grad in torch.empty (#5380)\n\nSummary:\n`torch.empty((2, 3), requires_grad\u003dTrue)` and `torch.empty(2, 3, requires_grad\u003dTrue)` were rejected with `no-matching-overload`, because neither `empty` overload in the torch stubs declared `requires_grad`. Real `torch.empty` accepts it.\n\nThis adds `requires_grad` to both overloads, matching `zeros` and `ones`. It also makes `dtype`, `device` and `requires_grad` keyword-only in the tuple overload, as they are in PyTorch, so `torch.empty((2, 3), torch.float32)` is now reported as an error instead of being silently accepted. No existing caller in the stubs\u0027 tests or examples passes these arguments positionally.\n\nThe `Sequence[int]` fallback overload that `zeros` and `ones` have, and `requires_grad` on other factories such as `empty_like`, are left for follow-ups.\n\nFixes https://github.com/facebook/pyrefly/issues/5359\n\n- [x] I am a human, and I fully understand the code I am submitting.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5380\n\nTest Plan:\nAdded `test_empty_accepts_requires_grad` to `test_creation.py`, covering the tuple form, separate sizes and an empty shape, plus a negative case for a positional `dtype`. The new test failed before the stub change and passes after it. The test runs both statically and against real PyTorch, which also confirms that `requires_grad` reaches the tensor.\n\n- `python tensor-shapes/pyrefly-torch-stubs/run_pyrefly.py`: all 110 suites pass.\n- `python tensor-shapes/run_tests.py --runtime-only`: all torch runtime suites pass.\n- The issue\u0027s example no longer reports errors, and both calls infer `Tensor[[2, 3]]`.\n- The formatting and lint step of `test.py` is clean for this change.\n\nReviewed By: stroxler\n\nDifferential Revision: D127533231\n\nfbshipit-source-id: 0b4be2bf89a6fc7b79d2025a5a304c4dc0eebea9\n"
    },
    {
      "commit": "5fd2b58e0f815314ac5e0e96589c3d153ee1fcc3",
      "tree": "4013a976224f3a8930eb05b569fe46e41263f5b3",
      "parents": [
        "025d901ebba095891103f40b589efc577229b9f8"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 18:38:53 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 18:38:53 2026 -0700"
      },
      "message": "Bump undici from 6.29.0 to 6.29.1 in /lsp (#5379)\n\nSummary:\nBumps [undici](https://github.com/nodejs/undici) from 6.29.0 to 6.29.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/nodejs/undici/releases\"\u003eundici\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.29.1\u003c/h2\u003e\n\u003ch2\u003eSecurity fixes\u003c/h2\u003e\n\u003ch3\u003eHigh severity\u003c/h3\u003e\n\u003ch4\u003eDenial of service via TLS 1.2 certificate-changing renegotiation\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-87018 · \u003ca href\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm\"\u003eGHSA-qrxm-fqhp-jwvm\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici\u0027s HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.\u003c/p\u003e\n\u003ch4\u003eTLS certificate validation bypass through dropped \u003ccode\u003eAgent\u003c/code\u003e options\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-109383 · \u003ca href\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx\"\u003eGHSA-2m5v-pch6-74hx\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAgent\u003c/code\u003e used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as \u003ccode\u003echeckServerIdentity\u003c/code\u003e. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.\u003c/p\u003e\n\u003ch4\u003eDenial of service through excessive \u003ccode\u003eContent-Encoding\u003c/code\u003e values\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-109869 · \u003ca href\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c\"\u003eGHSA-xjj6-f33q-929c\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although \u003ccode\u003efetch()\u003c/code\u003e rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.\u003c/p\u003e\n\u003ch3\u003eMedium severity\u003c/h3\u003e\n\u003ch4\u003eDenial of service through unbounded EventSource parser state\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-109924 · \u003ca href\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685\"\u003eGHSA-4qv8-2p9j-2685\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny \u003ccode\u003edata:\u003c/code\u003e fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.\u003c/p\u003e\n\u003ch4\u003eDenial of service through unbounded automatic WebSocket PONG buffering\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-109932 · \u003ca href\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6\"\u003eGHSA-9fm3-97px-rjf6\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[v6.x] fix(fetch): fix aborting Streams (\u003ca href\u003d\"https://redirect.github.com/nodejs/undici/issues/3754\"\u003ehttps://github.com/facebook/pyrefly/issues/3754\u003c/a\u003e) by \u003ca href\u003d\"https://github.com/mrityunjay-pandey\"\u003e\u003ccode\u003e@​mrityunjay-pandey\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/nodejs/undici/pull/6000\"\u003enodejs/undici#6000\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/nodejs/undici/compare/v6.29.0...v6.29.1\"\u003ehttps://github.com/nodejs/undici/compare/v6.29.0...v6.29.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/nodejs/undici/commit/8c57f6c68c95465338ae97bfc991cb1513d2f76e\"\u003e\u003ccode\u003e8c57f6c\u003c/code\u003e\u003c/a\u003e [Release] v6.29.1 (\u003ca href\u003d\"https://redirect.github.com/nodejs/undici/issues/6023\"\u003e#6023\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/nodejs/undici/commit/39f93e142df03e559fe7c3d1fc7fba9beee2c185\"\u003e\u003ccode\u003e39f93e1\u003c/code\u003e\u003c/a\u003e fix(websocket): bound automatic PONG writes under backpressure\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e\"\u003e\u003ccode\u003ec43b23f\u003c/code\u003e\u003c/a\u003e fix(eventsource): bound retained SSE parser state\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436\"\u003e\u003ccode\u003e1325a87\u003c/code\u003e\u003c/a\u003e fix(fetch): abort excessive content encoding responses\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f\"\u003e\u003ccode\u003e8c59f6b\u003c/code\u003e\u003c/a\u003e fix: preserve Agent connection options\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28\"\u003e\u003ccode\u003eb40fbfc\u003c/code\u003e\u003c/a\u003e fix: handle post-connect TLS certificate errors\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/nodejs/undici/commit/407630ac0a2f3bc65c596ed078dcffbeec0285c4\"\u003e\u003ccode\u003e407630a\u003c/code\u003e\u003c/a\u003e [v6.x] fix(fetch): fix aborting Streams (\u003ca href\u003d\"https://redirect.github.com/nodejs/undici/issues/3754\"\u003ehttps://github.com/facebook/pyrefly/issues/3754\u003c/a\u003e) (\u003ca href\u003d\"https://redirect.github.com/nodejs/undici/issues/6000\"\u003e#6000\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/nodejs/undici/compare/v6.29.0...v6.29.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dundici\u0026package-manager\u003dnpm_and_yarn\u0026previous-version\u003d6.29.0\u0026new-version\u003d6.29.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n ---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/pyrefly/network/alerts).\n\n\u003c/details\u003e\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5379\n\nReviewed By: stroxler\n\nDifferential Revision: D127511292\n\nfbshipit-source-id: 5e4a4db6b4384236240428b79b7fbcedafca4ba7\n"
    },
    {
      "commit": "025d901ebba095891103f40b589efc577229b9f8",
      "tree": "c33b6e6324b59513459714fadbb5f1ed1d87078c",
      "parents": [
        "4aacd09b1fb5584b11f9e48de51f4aa4658a9d09"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 18:38:21 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 18:38:21 2026 -0700"
      },
      "message": "Bump postcss-selector-parser from 6.1.2 to 6.1.5 in /website (#5394)\n\nSummary:\nBumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) from 6.1.2 to 6.1.5.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/releases\"\u003epostcss-selector-parser\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e6.1.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (\u003ca href\u003d\"https://github.com/advisories/GHSA-rj75-hqrm-r3gf\"\u003eCVE-2026-104844\u003c/a\u003e / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (\u003ca href\u003d\"https://redirect.github.com/postcss/postcss-selector-parser/pull/346\"\u003ehttps://github.com/facebook/pyrefly/issues/346\u003c/a\u003e by \u003ca href\u003d\"https://github.com/bradyshutt\"\u003e\u003ccode\u003e@​bradyshutt\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eThe 6.x line is now in security-only maintenance\u003c/h3\u003e\n\u003cp\u003eThis release exists because the advisory above covers every published 6.x\nversion, and until now the only remediation on offer was an upgrade to 7.x.\n\u003cstrong\u003e6.1.5 is the patched version for the 6.x line.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe line is kept alive for the installed base that cannot move to 7 yet, Tailwind\nCSS 3 in particular, which depends on \u003ccode\u003e^6.1.2\u003c/code\u003e. From here on it receives security\nfixes only: no features, no other bug fixes, no type changes. Everything else\ngoes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer\ndepends on this package at all, so this line is expected to retire on its own.\u003c/p\u003e\n\u003cp\u003e6.1.5 is published under the \u003ccode\u003elegacy-v6\u003c/code\u003e npm dist-tag, so\n\u003ccode\u003enpm install postcss-selector-parser\u003c/code\u003e keeps resolving to 7.x. Existing \u003ccode\u003e^6\u003c/code\u003e\nranges pick up 6.1.5 as usual.\u003c/p\u003e\n\u003ch2\u003e6.1.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: tolerate non-node children when serializing selectors\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e6.1.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ca href\u003d\"https://github.com/advisories/GHSA-w9m9-85wc-3x92\"\u003eCVE-2026-9358\u003c/a\u003e (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of (\u003ca href\u003d\"https://redirect.github.com/postcss/postcss-selector-parser/pull/316\"\u003ehttps://github.com/facebook/pyrefly/issues/316\u003c/a\u003e by \u003ca href\u003d\"https://github.com/MoOx\"\u003e\u003ccode\u003e@​MoOx\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/blob/6.1.5/CHANGELOG.md\"\u003epostcss-selector-parser\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.5 - 2026-10-19\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003efix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (\u003ca href\u003d\"https://github.com/advisories/GHSA-rj75-hqrm-r3gf\"\u003eCVE-2026-104844\u003c/a\u003e / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (\u003ca href\u003d\"https://redirect.github.com/postcss/postcss-selector-parser/pull/346\"\u003ehttps://github.com/facebook/pyrefly/issues/346\u003c/a\u003e by \u003ca href\u003d\"https://github.com/bradyshutt\"\u003e\u003ccode\u003e@​bradyshutt\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eThe 6.x line is now in security-only maintenance\u003c/h3\u003e\n\u003cp\u003eThis release exists because the advisory above covers every published 6.x\nversion, and until now the only remediation on offer was an upgrade to 7.x.\n\u003cstrong\u003e6.1.5 is the patched version for the 6.x line.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe line is kept alive for the installed base that cannot move to 7 yet, Tailwind\nCSS 3 in particular, which depends on \u003ccode\u003e^6.1.2\u003c/code\u003e. From here on it receives security\nfixes only: no features, no other bug fixes, no type changes. Everything else\ngoes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer\ndepends on this package at all, so this line is expected to retire on its own.\u003c/p\u003e\n\u003cp\u003e6.1.5 is published under the \u003ccode\u003elegacy-v6\u003c/code\u003e npm dist-tag, so\n\u003ccode\u003enpm install postcss-selector-parser\u003c/code\u003e keeps resolving to 7.x. Existing \u003ccode\u003e^6\u003c/code\u003e\nranges pick up 6.1.5 as usual.\u003c/p\u003e\n\u003ch1\u003e6.1.4 - 2026-06-11\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003efix: tolerate non-node children when serializing selectors\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.1.3 - 2026-06-11\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ca href\u003d\"https://github.com/advisories/GHSA-w9m9-85wc-3x92\"\u003eCVE-2026-9358\u003c/a\u003e (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of (\u003ca href\u003d\"https://redirect.github.com/postcss/postcss-selector-parser/pull/316\"\u003ehttps://github.com/facebook/pyrefly/issues/316\u003c/a\u003e by \u003ca href\u003d\"https://github.com/MoOx\"\u003e\u003ccode\u003e@​MoOx\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/commit/d90b6e38a0c79d07b02bf0d602bc242fe94be6b9\"\u003e\u003ccode\u003ed90b6e3\u003c/code\u003e\u003c/a\u003e 6.1.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/commit/70b0779c843462197380d25daa02d1528bf7eae5\"\u003e\u003ccode\u003e70b0779\u003c/code\u003e\u003c/a\u003e fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerabil...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/commit/fb22e1247963c272d45dc7bb0f4f9eff089dc379\"\u003e\u003ccode\u003efb22e12\u003c/code\u003e\u003c/a\u003e 6.1.4\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/commit/99d929975c44a781c52f56a0ac21a98c3a1ef8b6\"\u003e\u003ccode\u003e99d9299\u003c/code\u003e\u003c/a\u003e fix: tolerate non-node children when serializing selectors\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/commit/08ac3e56f53ea0a49e2c6868166144152af72018\"\u003e\u003ccode\u003e08ac3e5\u003c/code\u003e\u003c/a\u003e 6.1.3\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/commit/bd927e26b4e14795aff4901291b5165de356e502\"\u003e\u003ccode\u003ebd927e2\u003c/code\u003e\u003c/a\u003e npm audit fix + update CI\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/commit/b6330e58a33622e337bf3592b704079e1475045c\"\u003e\u003ccode\u003eb6330e5\u003c/code\u003e\u003c/a\u003e Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clo...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/commit/053e949b250500daf16e05b585a793ddddd2a6de\"\u003e\u003ccode\u003e053e949\u003c/code\u003e\u003c/a\u003e Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (\u003ca href\u003d\"https://redirect.github.com/postcss/postcss-selector-parser/issues/316\"\u003ehttps://github.com/facebook/pyrefly/issues/316\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/postcss/postcss-selector-parser/compare/v6.1.2...6.1.5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eMaintainer changes\u003c/summary\u003e\n\u003cp\u003eThis version was pushed to npm by \u003ca href\u003d\"https://www.npmjs.com/~moox\"\u003emoox\u003c/a\u003e, a new releaser for postcss-selector-parser since your current version.\u003c/p\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dpostcss-selector-parser\u0026package-manager\u003dnpm_and_yarn\u0026previous-version\u003d6.1.2\u0026new-version\u003d6.1.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n ---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/pyrefly/network/alerts).\n\n\u003c/details\u003e\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5394\n\nReviewed By: stroxler\n\nDifferential Revision: D127600892\n\nfbshipit-source-id: 0da1dd4ac18925f3a2a1dca0d3a3c3d6957bc4c0\n"
    },
    {
      "commit": "4aacd09b1fb5584b11f9e48de51f4aa4658a9d09",
      "tree": "d9bd8c3bddfaeabcee887a01657bb23e79f01e13",
      "parents": [
        "7d87ead6c07204aa70f5793296df0a0de559aa6e"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Mon Oct 26 17:29:16 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 17:29:16 2026 -0700"
      },
      "message": "Fix lint warnings in tarjan.rs\n\nSummary:\nFixes three occurrences of this warning:\n```\n  warning: use of deprecated associated function core::num::\u003cimpl u32\u003e::max_value: replaced by the MAX associated constant on this type\n     --\u003e fbcode/pyrefly/crates/pyrefly_util/src/tarjan.rs:183:1\n      |\n  183 | / define_index_type! {\n  184 | |     struct NodeIdx \u003d u32;\n  185 | | }\n      | |_^\n      |\n      \u003d note: #[warn(deprecated)] on by default\n      \u003d note: this warning originates in the macro define_index_type (in Nightly builds, run with -Z macro-backtrace for more info)\n```\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127696740\n\nfbshipit-source-id: 6215e7d9654165127cbad5e7ff4f320d3719eed0\n"
    },
    {
      "commit": "7d87ead6c07204aa70f5793296df0a0de559aa6e",
      "tree": "bac5952457db6327ca94768a860aaed3f01fd64d",
      "parents": [
        "61dde90989053c7238f0f3d219720bf2b37352f6"
      ],
      "author": {
        "name": "Rebecca Chen",
        "email": "rechen@meta.com",
        "time": "Mon Oct 26 17:20:39 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 17:20:39 2026 -0700"
      },
      "message": "Report soft open unpacking errors only if all hard checks succeed\n\nSummary:\nFixes https://github.com/facebook/pyrefly/issues/5401.\n\nCurrently, open unpacking errors (off by default) can hide other TypedDict errors, such as incompatible item types. WIth this change, we check for all TypedDict-related errors, so these other errors are caught and reported, and report open unpacking only if there are no other errors.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127689766\n\nfbshipit-source-id: cd3f6d695719699768bc109a50faae30a1bc7953\n"
    },
    {
      "commit": "61dde90989053c7238f0f3d219720bf2b37352f6",
      "tree": "a0787ebca77fac0ef5fbd5a4161e020cc49a96a6",
      "parents": [
        "b4ad832b00b47c7d0581ef782aad890a31f5ad78"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 16:37:10 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:37:10 2026 -0700"
      },
      "message": "Bump zstd 0.14.0 -\u003e 0.14.3\n\nSummary:\nAutomated semver-compatible version bump.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127663000\n\nfbshipit-source-id: 3747fbf680fae977f407f34bc5283bc448381599\n"
    },
    {
      "commit": "b4ad832b00b47c7d0581ef782aad890a31f5ad78",
      "tree": "0995634e6dcdc6b795520f756963452839a4f2be",
      "parents": [
        "a91a29ce19cecd3f0450bcc160a3af95a97f66ee"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 16:37:10 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:37:10 2026 -0700"
      },
      "message": "Bump zstd-sys 2.1.0+zstd.1.5.7 -\u003e 2.1.2+zstd.1.5.7\n\nSummary:\nAutomated semver-compatible version bump.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127662999\n\nfbshipit-source-id: 61b601df8957348afefbd41856204e3d4f5ec03e\n"
    },
    {
      "commit": "a91a29ce19cecd3f0450bcc160a3af95a97f66ee",
      "tree": "d6a8b52f6ade8c2fcf825849963d94dd3be1b590",
      "parents": [
        "5890695877c4bbfc3d7404b73ca731ec1a0f95e6"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 16:37:10 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:37:10 2026 -0700"
      },
      "message": "Bump either 1.18.0 -\u003e 1.19.0\n\nSummary:\nAutomated semver-compatible version bump.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127662995\n\nfbshipit-source-id: b2df6cd4d477afe1acf6c882dbffa362e1c9f9d7\n"
    },
    {
      "commit": "5890695877c4bbfc3d7404b73ca731ec1a0f95e6",
      "tree": "591fd7c195b40c576815394a90582958df08dbc0",
      "parents": [
        "e3d6ce839fa62afda1d96efc76a259267313bfd3"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Use bracket selectors in the numerical shape-comment corpus\n\nSummary:\nSpell written type-argument selectors with Python-style brackets in the NumPy and SciPy demos. Keep whole-type replacement, ordinary list payloads, visible annotations, and shape contracts unchanged.\n\nUpdate the notation notes and preserve the SciPy placement of declaration comments below `overload`.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127653939\n\nfbshipit-source-id: e8623bbc4130d54e9d90ef872fb8633ba3cdfbb1\n"
    },
    {
      "commit": "e3d6ce839fa62afda1d96efc76a259267313bfd3",
      "tree": "975f37a4ccca1b1066a6d49e6ec580084fa4e099",
      "parents": [
        "bfcb94fd6dcad017a9c7acc641921178337449b4"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Add Python-style bracket selectors to shape comments\n\nSummary:\nUse bracket paths such as `[0] \u003d payload` and `[0][1] \u003d payload` to replace written type arguments in shape comments. Keep earlier dot selectors as aliases and make the bracket form canonical.\n\nRecognize bracket paths only when followed by a single `\u003d`. This preserves ordinary list-shaped and indexed payload expressions, including `[M, N]` and `[0]`, while keeping the existing source ranges and type-argument interpretation.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127653891\n\nfbshipit-source-id: 00edc4ab72c1b23a1d9c941a4ed121a79d22c1ed\n"
    },
    {
      "commit": "bfcb94fd6dcad017a9c7acc641921178337449b4",
      "tree": "0c486f51bfb7f5e0d6b50e96d170788c135a3b52",
      "parents": [
        "c439658d42dfad6e26d47f2c8a4c3788adf74695"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Keep SciPy shape-comment overloads compact (#5400)\n\nSummary:\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5400\n\nPut SciPy overload shape declarations between `overload` and `def` so Ruff preserves adjacent overloads, matching scipy-stubs formatting conventions.\n\nLeave NumPy examples, shape contracts, and the comment parser unchanged. Document the chosen placement in the SciPy demo.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127646905\n\nfbshipit-source-id: 4446d9a12ab5579d69e6c17963d1e9748898d9bf\n"
    },
    {
      "commit": "c439658d42dfad6e26d47f2c8a4c3788adf74695",
      "tree": "688351eb35c9e56010da6b8a120c576ae9631453",
      "parents": [
        "9d949f917ef9a26db6d935776ea1e045162ce227"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Use compact shape comments throughout the numerical corpus\n\nSummary:\nReplace the long `type \u003d` and `.args[N]` spellings in the NumPy and SciPy demos with `\u003d payload` and `.N \u003d payload`. Keep all visible type annotations and shape contracts unchanged while making array carriers and selectors easier to read.\n\nUpdate the corpus\u0027s notation notes and retain the earlier spellings as supported parser aliases.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127615303\n\nfbshipit-source-id: 413df6ea616b41fd0728d0ccb2f3bbb67b96aceb\n"
    },
    {
      "commit": "9d949f917ef9a26db6d935776ea1e045162ce227",
      "tree": "fcbbda18cd42700b6aa4c58c9cb1fccad7882538",
      "parents": [
        "d5b5a6cbb9a2ea612083ca41d0bf8ce25edc305c"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Add compact shape-comment replacement and selectors\n\nSummary:\nAllow shape-comment replacements to start with `\u003d` and use `.N` paths for written type arguments. This makes NumPy carrier annotations compact without changing their attachment, binding, or shape interpretation.\n\nRetain `type \u003d` and `.args[N]` as aliases while making the shorter forms canonical. Parse selectors independently of payload expressions so chained decimal indices do not become Python floats and `\u003d` inside a DSL call does not become a replacement marker.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127615239\n\nfbshipit-source-id: 837b338a57e84457d5a4c52c214e94c48668fbfa\n"
    },
    {
      "commit": "d5b5a6cbb9a2ea612083ca41d0bf8ce25edc305c",
      "tree": "e51d16e6301afaeaa8954b88554ffd929c521a7e",
      "parents": [
        "ce7dd4a2234dfa86a4a4e369793bcb2fba6365f2"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Add three NumPy modules to the shape-comment corpus\n\nSummary:\nExtend the independent comment-only annotation corpus with NumPy numeric operations, two-dimensional helpers, and shape manipulation. The examples cover dimension relationships across arguments, dtype-preserving generics, rank-changing overloads, batched shapes, repetition tuples, optional output buffers, and an existing DSL-backed return transformation.\n\nKeep the excerpts deliberately narrow and self-contained, with pinned NumPy provenance and explicit supported-case notes. Project discovery automatically includes the new NumPy directory; the existing SciPy demos and type-checker implementation are unchanged.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127490314\n\nfbshipit-source-id: 01be7ba6f8aceb5ebc00cea5638dc117060627c2\n"
    },
    {
      "commit": "ce7dd4a2234dfa86a4a4e369793bcb2fba6365f2",
      "tree": "317606d3610e1ddb92de9fd82c424ec0bbddb5bb",
      "parents": [
        "b42af7bfa743b5450a5b6da1fac684be000d1315"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Use per-component shape comments in SciPy demos\n\nSummary:\nRewrite the Cholesky and distance examples to demonstrate multiline type-component annotations. Shape comments now sit beside the array\u0027s tuple carrier, leaving optional `None` branches separate and refining both elements of `cho_factor` without a verbose whole-tuple replacement.\n\nKeep the existing shape contracts and call-site expectations unchanged. Update syntax observations to describe the new readable form and the remaining NDArray-alias replacement limitation.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127471246\n\nfbshipit-source-id: 17dcc2d295a567baea570de119f2b6c4cd1e301f\n"
    },
    {
      "commit": "b42af7bfa743b5450a5b6da1fac684be000d1315",
      "tree": "6b617d20f05d0b94cd17aa3f7f539aef75f100b3",
      "parents": [
        "9b2f541c46a6dd88631000d5ad42dd78a0406583"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Attach shape comments to multiline type components\n\nSummary:\nAllow trailing shape comments on complete components within multiline annotations. This lets shared stubs refine tuple carriers and union branches locally, without repeating the whole type or writing long selectors from its root.\n\nRecord component paths in the original AST and resolve them after forward-reference parsing. Multiple comments in one annotation must select disjoint final targets. Preserve whole-annotation comments, shape-variable scoping, legacy type-variable binding, and compatibility-mode payload semantics. Scalar type-argument comments use the dimension parser; unsupported starred or metadata targets diagnose rather than silently disappear.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127471227\n\nfbshipit-source-id: 01d80cb66dab9db904d6f9b544445e1300a45db9\n"
    },
    {
      "commit": "9b2f541c46a6dd88631000d5ad42dd78a0406583",
      "tree": "9fc519d66494a7d72fd1fb68d813e8fd36f9e2eb",
      "parents": [
        "155e668a1f0c3009a2e8e1bede0a3bdc56101833"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Start a comment-only shape annotation corpus with SciPy demos\n\nSummary:\nProvide small, independent API slices for evaluating the shape-comment syntax on real library interfaces. The first examples cover FFT helpers, Cholesky routines, and spatial distances using only NumPy annotations, with pinned provenance and supported-case notes.\n\nKeep each project in its own directory and discover documented demos automatically. Check the module slices before their callers, integrate them into static tensor-shape CI, and retain expected shape rejections. These are syntax experiments, not a replacement scipy-stubs distribution or runtime tests.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127467146\n\nfbshipit-source-id: c985e4206b1a6f582c8b4e341d67454d9643d5c1\n"
    },
    {
      "commit": "155e668a1f0c3009a2e8e1bede0a3bdc56101833",
      "tree": "9287da4ca9d4776819a6c7866448b93f762b8fd7",
      "parents": [
        "cddf24dab742eb776e18e87880092910157c68d1"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Preserve qualifiers and validate shape-comment annotations\n\nSummary:\nKeep annotation qualifiers outside the type supplied by a shape comment, including nested `Annotated`, `Final`, and TypedDict qualifiers. Reject comments on bare qualifiers and existing shape wrappers rather than silently ignoring them.\n\nAdd regression coverage for declaration scopes, overloads, annotated assignments, invalid targets and placement, and suppressed diagnostics. Document the opt-in syntax and initial supported positions.\n\nThe shared `Shaped` refactor and core comment application now live in the two preceding diffs. This split preserves the combined source and restacks the later corpus and multiline enhancements without behavior changes.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127441649\n\nfbshipit-source-id: 40d55fa487374d152fba88209571aae17b059590\n"
    },
    {
      "commit": "cddf24dab742eb776e18e87880092910157c68d1",
      "tree": "6b2f5b8141c913557d679dbd1cfe55cb5b4f30a4",
      "parents": [
        "4b9dbe52fc699dc53853f25dba43837dd73a2737"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Apply shape comments to ordinary type annotations\n\nSummary:\nBind trailing `# shaped:` payloads in the enclosing annotation scope and apply them through a side table, leaving the source AST unchanged. Reuse compatibility-mode interpretation for scalar dimensions, class arguments, tuple carriers, and DSL calls.\n\nSupport concise comments, explicit whole-type replacement, and selectors into written type arguments. Preserve genuine diagnostics on replaced annotations and collect legacy type variables appearing only in payloads.\n\nQualifier preservation and additional edge-case validation follow in the next diff.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127488673\n\nfbshipit-source-id: 7fdedeff814d1b332f37f7787938e9b2cb3e26df\n"
    },
    {
      "commit": "4b9dbe52fc699dc53853f25dba43837dd73a2737",
      "tree": "53531b201b02edc24ce2bb3497be4a6fbac7eef7",
      "parents": [
        "c9029c95641120cbc37f048c3e7031de1dd9a793"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Separate Shaped type interpretation from base inference\n\nSummary:\nMake the compatibility transformation accept an already-interpreted base type and its deferred diagnostics. Comment annotations can then reuse the transformation without reinferring their own root and recursively applying themselves.\n\nKeep the existing native `Shaped` behavior, including tuple-carrier checks, and normalize registered array bases through their class arguments.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127488651\n\nfbshipit-source-id: 46aecb80fdcfc663ad22ddf677ca5ffd5302e06d\n"
    },
    {
      "commit": "c9029c95641120cbc37f048c3e7031de1dd9a793",
      "tree": "7f9404649982cb5607001e5e6a5d80ff5c67fc23",
      "parents": [
        "20b437e2fcdd857fff30ed8c8e40d311c257d80d"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Bind shape-variable declarations from comments\n\nSummary:\nAllow shared stubs to declare shape variables with `# shapes: M, N, *Batch` instead of a visible decorator. Reuse `shape_vars` parsing and quantification so scalar and variadic variables, class defaults, and declaration scopes remain consistent across both spellings.\n\nThis diff activates declaration comments; annotation transformations follow in the next diff.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127441629\n\nfbshipit-source-id: ed73a4d9a8bc33a33d6543df35b4df601d631cd7\n"
    },
    {
      "commit": "20b437e2fcdd857fff30ed8c8e40d311c257d80d",
      "tree": "a786b4b266015f79a344066308d4576cbbaeb46a",
      "parents": [
        "b2b380fec5adfbec6e2e862920241cbc20a958aa"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:12:41 2026 -0700"
      },
      "message": "Parse and attach opt-in shape comments\n\nSummary:\nProvide a source-preserving frontend for comment-only shape annotations in shared stubs. An explicit module header enables `# shapes:` declarations and trailing `# shaped:` payloads with optional type-argument selectors.\n\nAttach directives using the original syntax and canonical comment ranges, including definitions in unreachable branches. Reuse the expression depth limit before passing separately parsed payloads to later phases.\n\nThis diff supplies parsing and attachment; later diffs connect declarations and annotation semantics.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127441552\n\nfbshipit-source-id: e2781ba4f1bff1a3642bacddd4b303846af3f6bb\n"
    },
    {
      "commit": "b2b380fec5adfbec6e2e862920241cbc20a958aa",
      "tree": "893fe4c560e5978036c4589daef71c91f1251a7a",
      "parents": [
        "4b5d1e4b9ad46f681c44f033dc959e39433e0baa"
      ],
      "author": {
        "name": "Mangesh Raut",
        "email": "mbr63@drexel.edu",
        "time": "Mon Oct 26 16:02:01 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:02:01 2026 -0700"
      },
      "message": "fix(test): make coverage pipe-close checks portable on macOS (#5390)\n\nSummary:\n## Why\n\nThe coverage pipe-close scrut cases use `head -n 0` to close the reader end of the pipe immediately. That works with GNU head on Linux, but BSD head on macOS rejects a zero line count (`head: illegal line count -- 0`), so `test (macOS-latest)` fails on an otherwise unrelated change.\n\n## What changed\n\nReplace `| head -n 0` with `| dd bs\u003d1 count\u003d0 2\u003e/dev/null` in both pipe-close cases in `test/coverage.md`. `dd` exits 0 after reading nothing on both GNU and BSD, which keeps the same early-close behavior the tests are checking.\n\n## Scope\n\nTest harness only. No type-checker behavior change.\n\n## Verification\n\n- Confirmed `head -n 0` fails on macOS with exit 1.\n- Confirmed `dd bs\u003d1 count\u003d0 2\u003e/dev/null` exits 0 on macOS.\n- Expect `test (macOS-latest)` to pass these two cases after this lands.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5390\n\nReviewed By: stroxler\n\nDifferential Revision: D127576874\n\nfbshipit-source-id: d9ee8ab29b6d9d9661522c7c49b7e56e19e5c0f6\n"
    },
    {
      "commit": "4b5d1e4b9ad46f681c44f033dc959e39433e0baa",
      "tree": "99834d01087e10b7d86eee241353456cf0efab57",
      "parents": [
        "2657fbb407767907ec9680c64b1fabd210ea4aad"
      ],
      "author": {
        "name": "Divyansh",
        "email": "2023csb1119@iitrpr.ac.in",
        "time": "Mon Oct 26 16:00:20 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 16:00:20 2026 -0700"
      },
      "message": "Don\u0027t narrow unions to Never on isinstance with a TypeVar classinfo (#5261)\n\nSummary:\nFixes https://github.com/facebook/pyrefly/issues/5147\n\n`isinstance` with a `type[T]` classinfo narrowed a union-typed value to `Never`:\n\n```python\ndef fn[T](value: int | str, cls: type[T]):\n    if isinstance(value, cls):\n        reveal_type(value)  # before: Never, after: (int \u0026 T) | (str \u0026 T)\n```\n\nNarrowing to `Never` makes the rest of the branch look unreachable, so errors inside it are silently suppressed.\n\n**Root cause.** When the narrowed value is a union, `narrow_isinstance_from_definite` intersects each member with the target using `IntersectFallback::Never`. That is intentional for concrete targets, so `isinstance(x, Iterable)` on `int | list[int]` narrows to just `list[int]`. A type variable target, however, is neither a subtype nor a supertype of any concrete member, so every member hit the fallback and the whole union became `Never`. (The non-union case already used the `Right` fallback and produced `int \u0026 T`.)\n\n**Fix.** Use the regular `Right` fallback when the target is a type variable. Each member then intersects with `T`, producing `(int \u0026 T) | (str \u0026 T)`. This is consistent with how we already narrow `x: T` against concrete classes (e.g. `(float \u0026 T) | (int \u0026 T)` in `test_typevar_isinstance_narrow_else`) and with what ty reports. Members that cannot overlap with the TypeVar\u0027s bound are still removed, since `intersect_impl` compares `disjoint_base`s and `disjoint_base` uses the bound: with `T: int`, `int | str` narrows to `T`.\n\nThe `Never` fallback for concrete targets is unchanged.\n\n- [ ] I am a human, and I fully understand the code I am submitting.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5261\n\nTest Plan:\nAdded `test_isinstance_union_with_typevar_classinfo` to `pyrefly/lib/test/narrow.rs`, covering:\n- the issue\u0027s example: `int | str` narrowed by `type[T]` → `(int \u0026 T) | (str \u0026 T)`; the negative branch stays `int | str`\n- a bounded TypeVar (`T: int`): `int | str` → `T` (the `str` member is dropped via the bound)\n- the non-union case: `int` → `int \u0026 T` (unchanged)\n- returning the narrowed value from a `-\u003e T` function type-checks\n\nBefore the fix:\n\n```text\n$ cargo test -p pyrefly --lib test_isinstance_union_with_typevar_classinfo\n INFO revealed type: Never [reveal-type]\n4724 |         reveal_type(value)  # E: revealed type: (int \u0026 T) | (str \u0026 T)\ntest test::narrow::test_isinstance_union_with_typevar_classinfo ... FAILED\n```\n\nAfter:\n\n```text\n$ cargo test -p pyrefly --lib test_isinstance_union_with_typevar_classinfo\ntest test::narrow::test_isinstance_union_with_typevar_classinfo ... ok\n\n$ cargo test -p pyrefly --lib -- test::narrow:: test::pattern_match:: test::generic_restrictions:: test::type_guard test::typeis test::generic_basic:: test::simple:: test::type_var\ntest result: ok. 850 passed; 0 failed\n\n$ cargo test -p pyrefly --lib -- --skip commands::coverage --skip lsp_interaction\ntest result: ok. 8762 passed; 0 failed\n\n$ python3 test.py --no-test --no-tensor-shapes --no-conformance --no-jsonschema\nRunning formatting... Running linting... Running extension tests... OK\n```\n\nReviewed By: rchen152\n\nDifferential Revision: D125878285\n\nfbshipit-source-id: ac81a534b667ed789416b203935df8d5c29bee49\n"
    },
    {
      "commit": "2657fbb407767907ec9680c64b1fabd210ea4aad",
      "tree": "954dc86c7b03ebfa8b0967e0199828ac3b5dacd4",
      "parents": [
        "0346fe6f8cf97c8da43b58c735db8faf3e21a59b"
      ],
      "author": {
        "name": "tonyyuyiding",
        "email": "tonyyuyiding@gmail.com",
        "time": "Mon Oct 26 15:51:32 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 15:51:32 2026 -0700"
      },
      "message": "Fix false bad argument when casting with str in augassign to subscript (#5337)\n\nSummary:\nFixes https://github.com/facebook/pyrefly/issues/5220\n\n- [x] I am a human, and I fully understand the code I am submitting.\n\nThe problem:\n\n```python\nfrom typing import cast\nlst \u003d [1]\nlst[cast(\"int\", 0)] +\u003d 1 # [bad-argument-type] First argument to `typing.cast` must be a type\n```\n\nThe reason is casting with string is handled by `ensure_expr` in `bind_attr_assign_impl`, but the caller passes a cloned subscript, which means the changes to the subscript is not reflected in `Binding::AugAssign`.\n\nThe solution is to require the updated subscript in `make_assign_value` callback, so that the updated subscript is used. The same applies to attributes.\n\nOne thing to mention is that `bind_subscript_assign_impl` is also used in some other callers. I think they don\u0027t need the updated subscript because those callers do not build a binding that contains the subscript, so the new parameter is not used in those spots. I think the smell is kind of strange though, and I would be happy to hear any suggestion (thanks!)\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5337\n\nTest Plan: Subscript and attribute have similar problems, so I check both in the new test.\n\nReviewed By: rchen152\n\nDifferential Revision: D127079712\n\nfbshipit-source-id: f2f2842b178146078213a4de04606aacb30f96a9\n"
    },
    {
      "commit": "0346fe6f8cf97c8da43b58c735db8faf3e21a59b",
      "tree": "be28a41cc42a17f0c5566b43e95d4de7b05619c0",
      "parents": [
        "13e264bba92f0a67dba1c6f94253de539af6f082"
      ],
      "author": {
        "name": "Divyansh",
        "email": "2023csb1119@iitrpr.ac.in",
        "time": "Mon Oct 26 15:46:38 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 15:46:38 2026 -0700"
      },
      "message": "Allow subclass receivers on overloaded constructors (#4722)\n\nSummary:\nOverloads of `__init__` and `__new__` may annotate the receiver with a subclass of the defining class, so that constructing via that subclass selects a more specific overload:\n\n```python\nclass Path:\n    overload\n    def __new__(cls: type[AbsPath], path: str) -\u003e AbsPath: ...\n    overload\n    def __new__(cls: type[RelPath], path: str) -\u003e RelPath: ...\n    overload\n    def __new__(cls: type[Path], path: str) -\u003e AbsPath | RelPath: ...\n    def __new__(cls: type[Path], path: str) -\u003e Path: ...\n\nclass AbsPath(Path): ...\nclass RelPath(Path): ...\n```\n\nPyrefly rejected these receivers as \"not a superclass\" of the defining class.\n\nThis change keeps constructor receiver validation in place and only widens the accepted set: on **overload variants** of `__init__`/`__new__`, a receiver whose class is a subclass of the defining class is also accepted. Everything else is unchanged:\n\n- non-overloaded constructors and the overload implementation are validated as before;\n- receivers of unrelated classes are still rejected on overloads (`test_init_bad_receiver_annotation`, `test_new_bad_receiver_annotation` unchanged);\n- the `__init__` class-scoped type parameter check still runs on overloads (`test_constructor_overload_with_hint`, `test_constructor_typevar_scope_overload` pass).\n\nFixes https://github.com/facebook/pyrefly/issues/4701\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/4722\n\nTest Plan:\nNew tests in `pyrefly/lib/test/constructors.rs`:\n- `test_new_overload_subclass_receiver`: the `Path` example above, with `assert_type` on each constructor call.\n- `test_init_overload_subclass_receiver`: same pattern for `__init__`.\n- `test_constructor_subclass_receiver_requires_overload`: a subclass receiver on a non-overloaded `__new__`/`__init__` is still an error.\n\n```text\n$ cargo test -p pyrefly --lib -- receiver constructor_overload_with_hint typevar_scope\ntest test::constructors::test_new_overload_subclass_receiver ... ok\ntest test::constructors::test_init_overload_subclass_receiver ... ok\ntest test::constructors::test_constructor_subclass_receiver_requires_overload ... ok\ntest test::constructors::test_init_bad_receiver_annotation ... ok\ntest test::constructors::test_new_bad_receiver_annotation ... ok\ntest test::overload::test_constructor_overload_with_hint ... ok\ntest test::type_variable_scope::test_constructor_typevar_scope_overload ... ok\n...\ntest result: ok. 46 passed; 0 failed\n\n$ cargo test -p pyrefly --lib\nall tests in test::constructors, test::overload, test::typing_self and\n:type_variable_scope pass (220)\n```\n\nReviewed By: rchen152\n\nDifferential Revision: D125874447\n\nfbshipit-source-id: 1badc0c326c19f73f80f549da882cc2d50697279\n"
    },
    {
      "commit": "13e264bba92f0a67dba1c6f94253de539af6f082",
      "tree": "045e8b5c9b73bda9c1afd230f9721f66daf7ada9",
      "parents": [
        "307bc4cd3476850dc397fc8018693e0039643eeb"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Mon Oct 26 14:17:53 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 14:17:53 2026 -0700"
      },
      "message": "Add test for subscripting a TypeVar bounded by a class whose `__getitem__` returns `Self`\n\nSummary:\nSubscripting a value whose type is a TypeVar bounded by a class (`seq[0:1]` with `S: SupportsSlice`) infers the bound instead of `S` when `__getitem__` returns `Self`. Calling `seq.__getitem__(slice(0, 1))` directly infers `S` as expected. This adds a test, marked `bug`, that records the current behavior. The next diff fixes it.\n\nreproduces https://github.com/facebook/pyrefly/issues/5257\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D125829599\n\nfbshipit-source-id: ded3301eae28237bbbae32c4fc9d20bb25c594a7\n"
    },
    {
      "commit": "307bc4cd3476850dc397fc8018693e0039643eeb",
      "tree": "36283578493cf5ad69cd1a3e3a9272d9af36c3d2",
      "parents": [
        "495669d1c0418f30b6a6eb1c99b9b5935fadbd21"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 13:14:15 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 13:14:15 2026 -0700"
      },
      "message": "Simplify inline GroupBy completion recovery\n\nSummary:\nRecover the schema for inline `group_by().agg()` completion through the existing DataFrame receiver-type flow. This removes a syntax-only `.lazy()` fallback that is unnecessary with real Polars types and makes argument eligibility explicit for `agg`.\n\nExpand the completion test stubs to model eager and lazy GroupBy types, then cover positional, keyword, unpacked, lazy, and schema-preserving chained receivers.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127065560\n\nfbshipit-source-id: 1f3a998081063850fd894128225c7adda54b7898\n"
    },
    {
      "commit": "495669d1c0418f30b6a6eb1c99b9b5935fadbd21",
      "tree": "1967a85a8208ffaea5ea17f01b01182ceb6ed641",
      "parents": [
        "faee194d743c2ab3df22bc600b1edde615550f83"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "message": "Bump miniz_oxide 0.8.8 -\u003e 0.8.9\n\nSummary:\nAutomated semver-compatible transitive version bump via temporary synthetic dependency.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127623325\n\nfbshipit-source-id: c4c236999a4d4faefb17762ecbf48754c831f9fa\n"
    },
    {
      "commit": "faee194d743c2ab3df22bc600b1edde615550f83",
      "tree": "e907d534a8591ada27beb5b62b6321664d59a52b",
      "parents": [
        "c77aa35a417e2a3d57692113a54e4b06c3673446"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "message": "Bump get-size2 0.11.0 -\u003e 0.11.1\n\nSummary:\nAutomated semver-compatible transitive version bump via temporary synthetic dependency.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127623324\n\nfbshipit-source-id: 2eee2f55e80ee4a6b6283e35f3bf461881c6c941\n"
    },
    {
      "commit": "c77aa35a417e2a3d57692113a54e4b06c3673446",
      "tree": "cb9cf9ab934540cf99bd43855e2df8e984579754",
      "parents": [
        "c485250ea207ccd3852a82ee2027fc82845414ec"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "message": "Bump get-size-derive2 0.11.0 -\u003e 0.11.1\n\nSummary:\nAutomated semver-compatible transitive version bump via temporary synthetic dependency.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127623323\n\nfbshipit-source-id: 1887f8493d65257e8064094b1f4351aabb3b5b9a\n"
    },
    {
      "commit": "c485250ea207ccd3852a82ee2027fc82845414ec",
      "tree": "37aec721972d43d6abe7e3219f28486c442cccea",
      "parents": [
        "69a5beff3d62850441c38a436e4ff03c41926f73"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "message": "Bump toml_parser 1.1.3+spec-1.1.0 -\u003e 1.1.5+spec-1.1.0\n\nSummary:\nAutomated semver-compatible version bump.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127623318\n\nfbshipit-source-id: 59612efc7c7014a8b7d8b01909fd011afe18c241\n"
    },
    {
      "commit": "69a5beff3d62850441c38a436e4ff03c41926f73",
      "tree": "c44a3a830a3097e9bdd85b784b7ed85a26378110",
      "parents": [
        "76e467bca729e7df25873f0bbe106830cfa105c5"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 13:10:49 2026 -0700"
      },
      "message": "Bump find-msvc-tools 0.1.14 -\u003e 0.1.15\n\nSummary:\nAutomated semver-compatible transitive version bump via temporary synthetic dependency.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127623303\n\nfbshipit-source-id: db31a51fc6e1b4bf34b893b2642dab97093c8b6d\n"
    },
    {
      "commit": "76e467bca729e7df25873f0bbe106830cfa105c5",
      "tree": "dd901f22f8f2d3180bd0123796eedce57dd632f3",
      "parents": [
        "53903b5690f9456ed5057f3f97020fddc364f110"
      ],
      "author": {
        "name": "Aayush Yash",
        "email": "aayushyaash@gmail.com",
        "time": "Mon Oct 26 12:32:41 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 12:32:41 2026 -0700"
      },
      "message": "fix: skip missing-super-call checks in TYPE_CHECKING blocks (#5180)\n\nSummary:\nMethods defined inside `if TYPE_CHECKING:` blocks are type-checking declarations rather than runtime implementations. Requiring an explicit `super()` call in these methods can result in false-positive `missing-super-call` errors.\n\nPreviously, `check_missing_super_call_for_field()` skipped this check for `.pyi` interface stub files but did not account for methods inside `TYPE_CHECKING` blocks.\n\nThis PR updates the check to skip methods whose `toplevel_func_metadata()` has `flags.is_in_type_checking_block` set.\n\nFixes https://github.com/facebook/pyrefly/issues/5136\n\n- [x] I am a human, and I fully understand the code I am submitting.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5180\n\nTest Plan:\nAdded a regression test in `pyrefly/lib/test/class_overrides.rs` for a method inside a `TYPE_CHECKING` block that should not report a `missing-super-call` error.\n\n## Validation:\n\n```bash\ncargo test -p pyrefly --lib test_missing_super_call\ncargo test -p pyrefly --lib test::class_overrides::\npython3 test.py --no-test --no-tensor-shapes --no-conformance --no-jsonschema --no-extension\n```\n\nReviewed By: samwgoldman\n\nDifferential Revision: D124393475\n\nfbshipit-source-id: c612cab766619f92bab76ed6340315eaf28fbd88\n"
    },
    {
      "commit": "53903b5690f9456ed5057f3f97020fddc364f110",
      "tree": "4bcad309e45f6ded94a2e9c23838cf6e42bbac02",
      "parents": [
        "3672a064fdfd7cfa69c0eb9fdc063caaabcbdd10"
      ],
      "author": {
        "name": "Asuka Minato",
        "email": "i@asukaminato.eu.org",
        "time": "Mon Oct 26 12:28:19 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 12:28:19 2026 -0700"
      },
      "message": "fix Incorrect union narrowing with is EnumMember #3820 (#3915)\n\nSummary:\nFixes https://github.com/facebook/pyrefly/issues/3820\n\npositive `is` narrowing preserves a single surviving enum literal instead of letting union simplification widen it back to the enum class.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/3915\n\nTest Plan: add test\n\nReviewed By: samwgoldman\n\nDifferential Revision: D116390684\n\nfbshipit-source-id: eff8be57d4e2d40ce8eb2c2be999680ddb65c44f\n"
    },
    {
      "commit": "3672a064fdfd7cfa69c0eb9fdc063caaabcbdd10",
      "tree": "46c36e87d5cb1bfa6dc70785119e09c173f82259",
      "parents": [
        "6b96cf346f10d01cbace388a1b6c6f3062b318bf"
      ],
      "author": {
        "name": "Hamdi Hassan Shahid",
        "email": "shahhamdihassan@meta.com",
        "time": "Mon Oct 26 12:06:29 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 12:06:29 2026 -0700"
      },
      "message": "Unpack a tuple subclass with an unbounded part like a plain tuple\n\nSummary:\nUnpacking a `tuple` subclass whose tuple has an unbounded part, such as SQLAlchemy\u0027s `Row`, gave every target the union of all the element types. `iterate` only treated a subclass as a tuple when its tuple was fixed-length. Any other subclass fell through to the iterable protocol, which knows only the element type of `__iter__`, so `a, b, c \u003d t` with `t: Variadic[str, int | None, *tuple[Any, ...]]` made `a` and `b` `int | str | Any | None`.\n\nNow a subclass whose tuple has fixed elements before or after the unbounded part is iterated as that plain tuple, which already keeps each fixed position\u0027s type. So `a` is `str`, `b` is `int | None`, `c` is `Any`, and a starred `*rest` is `list[Any]`, matching how a plain tuple with the same types unpacks.\n\nFixed-length subclasses keep their existing path. Subclasses whose tuple has no fixed elements also keep the iterable protocol: routing them through the plain-tuple path added a false `bad-unpacking` error on a subclass of a generic tuple subclass (`class Nested[*Ts](Variadic[*Ts])`), which unpacks fine at runtime. That case still loses position types and is a separate gap.\n\nFixes https://github.com/facebook/pyrefly/issues/5286\n\nReviewed By: samwgoldman\n\nDifferential Revision: D127237256\n\nfbshipit-source-id: 9faba386fe7a15ebe324261ef3af37132db3d060\n"
    },
    {
      "commit": "6b96cf346f10d01cbace388a1b6c6f3062b318bf",
      "tree": "e70ac1e7bffd20c5f1aa918535f6e8a5f1920d04",
      "parents": [
        "453f2b76d6bc172452aff4faf388cc42f93414da"
      ],
      "author": {
        "name": "Hamdi Hassan Shahid",
        "email": "shahhamdihassan@meta.com",
        "time": "Mon Oct 26 12:06:29 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 12:06:29 2026 -0700"
      },
      "message": "Add a test for unpacking a tuple subclass with an unbounded part\n\nSummary:\nUnpacking a `tuple` subclass whose tuple has an unbounded part, such as SQLAlchemy\u0027s `Row`, gives every target the union of all the element types. With `t: Variadic[str, int | None, *tuple[Any, ...]]`, `a, b, c \u003d t` makes `a` and `b` `int | str | Any | None` instead of `str` and `int | None`. A plain tuple with the same element types already unpacks correctly.\n\nThis adds a test that records today\u0027s behaviour under a `bug` marker, using the reporter\u0027s example plus a starred target and the plain-tuple version for contrast. A second test pins unpacking a non-generic fixed-length subclass, which is already correct and should stay that way. The next diff fixes the bug and updates the expectations.\n\nReviewed By: samwgoldman\n\nDifferential Revision: D127237255\n\nfbshipit-source-id: f573ea1382f5c8ca69bae048b9893dea1a7d5587\n"
    },
    {
      "commit": "453f2b76d6bc172452aff4faf388cc42f93414da",
      "tree": "57a40b329a4794e1b9f16eae640d45cc062f0039",
      "parents": [
        "b12f9d89fc30aa13566629bb5e61aa3646b631e7"
      ],
      "author": {
        "name": "Hamdi Hassan Shahid",
        "email": "shahhamdihassan@meta.com",
        "time": "Mon Oct 26 11:58:32 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 11:58:32 2026 -0700"
      },
      "message": "Skip the `__slots__` check for attributes written only through `cls`\n\nSummary:\n`__slots__` only limits the attributes an instance can have. pyrefly checks every attribute assigned in a method against `__slots__`, including ones assigned only through `cls` in a classmethod, `__init_subclass__` or `__new__`. Those writes go to the class object and work at runtime, so pyrefly reported a false positive.\n\nThe binder now records, for each attribute assigned in methods, whether any of those assignments goes through `self`. The `__slots__` check runs only when one does.\n\nThe flag is set while the binder merges assignments from different methods, before it decides which method\u0027s values to keep. So an attribute written through both `cls` and `self` still reports, even when the merge keeps only the `cls` assignment\u0027s values. That case really does fail at runtime, and `test_slots_attribute_written_through_cls_and_self` pins it. The flag fits in existing padding, so `BindingClassField` keeps its size and its `assert_words!` check still passes.\n\nFixes https://github.com/facebook/pyrefly/issues/5300\n\nReviewed By: stroxler\n\nDifferential Revision: D127203878\n\nfbshipit-source-id: acb210abd023c77642eddc6fc961b73831ebce3f\n"
    },
    {
      "commit": "b12f9d89fc30aa13566629bb5e61aa3646b631e7",
      "tree": "faaf2e46805339e3814eeaadae3fff9af097c38c",
      "parents": [
        "53a21310e01d799ad255981c9412b740aa7b5590"
      ],
      "author": {
        "name": "Hamdi Hassan Shahid",
        "email": "shahhamdihassan@meta.com",
        "time": "Mon Oct 26 11:58:32 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 11:58:32 2026 -0700"
      },
      "message": "Add a test for the `__slots__` check on writes through `cls`\n\nSummary:\n`__slots__` only limits the attributes an instance can have. Writing an attribute onto the class object itself, such as `cls.tag \u003d \"x\"` in `__init_subclass__` or a classmethod, works at runtime, but pyrefly reports it as \"not declared in `__slots__`\" (https://github.com/facebook/pyrefly/issues/5300).\n\nThis adds a test that records today\u0027s behaviour with a `bug` marker, using the example from the issue. It also pins a case that must keep reporting: a slotted class that writes the same attribute through both `cls` and `self`, where the instance write really does fail at runtime.\n\nThe next diff fixes the bug and updates the test.\n\nReviewed By: stroxler\n\nDifferential Revision: D127203877\n\nfbshipit-source-id: f0883c8942ec48ddf1687a639ee5f97331599488\n"
    },
    {
      "commit": "53a21310e01d799ad255981c9412b740aa7b5590",
      "tree": "35704595671966a070755945cefdf6bd3cc17e85",
      "parents": [
        "cf6232bb6ddd9549d0b73a9849c42b4ea5a43ec8"
      ],
      "author": {
        "name": "Asuka Minato",
        "email": "i@asukaminato.eu.org",
        "time": "Mon Oct 26 11:52:28 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 11:52:28 2026 -0700"
      },
      "message": "fix unused-coroutine could catch a common bug #5151 (#5154)\n\nSummary:\nFixes https://github.com/facebook/pyrefly/issues/5151\n\nCoroutine conditions now report `unused-coroutine`, even when `implicit-bool` is disabled.\n\n- [x] I am a human, and I fully understand the code I am submitting.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5154\n\nTest Plan: add test\n\nReviewed By: samwgoldman\n\nDifferential Revision: D124137968\n\nfbshipit-source-id: 542061537e52a40c379cc4a8b704418db8c30225\n"
    },
    {
      "commit": "cf6232bb6ddd9549d0b73a9849c42b4ea5a43ec8",
      "tree": "aaf1f8ca3610ca9526ae5db8ad53d1c823e033c1",
      "parents": [
        "da3eb167e2555e7ded7be0ac59fb9947842d0aa1"
      ],
      "author": {
        "name": "Kyle Into",
        "email": "kylei@meta.com",
        "time": "Mon Oct 26 10:40:46 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 10:40:46 2026 -0700"
      },
      "message": "Rename directory-relative-import to fallback-search-path-relative-import\n\nSummary:\nStack context: GitHub PR #4905 adds a diagnostic for imports that resolve only through the fallback search path.\n\n- What: Rename the `directory-relative-import` error kind to `fallback-search-path-relative-import` (`FallbackSearchPathRelativeImport`). Shorten the hint text, and link the error-kind docs to the fallback search path docs. Remove the error kind from the `basic` preset.\n- Why: Review feedback on D119718772. `directory-relative-import` sounds like Pyrefly rejects relative imports, which is not the case. The new name says that the import resolves only through Pyrefly\u0027s fallback search path heuristic, so it may fail at runtime. The `basic` preset holds only high-confidence errors, and this warning comes from a heuristic, so it does not belong there.\n\nReviewed By: connernilsen\n\nDifferential Revision: D127286777\n\nfbshipit-source-id: 2aac8776e69a51e947e35fa1d45566adfdbd237d\n"
    },
    {
      "commit": "da3eb167e2555e7ded7be0ac59fb9947842d0aa1",
      "tree": "4d8d3747fe092d41ccb057d43d160683bb5a6cb2",
      "parents": [
        "013195247ff26f6d13cad42fb47fc52782a2d25d"
      ],
      "author": {
        "name": "Ching-Wei Kang",
        "email": "ckang53@wisc.edu",
        "time": "Mon Oct 26 10:40:46 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 10:40:46 2026 -0700"
      },
      "message": "Diagnose directory-relative imports (#4905)\n\nSummary:\nAdd a dedicated `directory-relative-import` diagnostic when an unqualified import resolves only through `FallbackSearchPath::DirectoryRelative`.\n\nThe diagnostic is a non-fatal warning by default, so the module continues to resolve while users get guidance that first emphasizes missing or misconfigured search paths and site package paths, then explicit relative or fully qualified imports. BasedPyright `reportImplicitRelativeImport` migration keeps the existing `missing-import` mapping and additionally configures the dedicated error kind.\n\nThe branch is merged with current upstream `main`, uses the current `FindImportOptions` API, and covers directory-relative fallback, explicit fallback, configured search-path precedence, end-to-end diagnostic reporting, configuration migration, generated presets, and documentation.\n\nFixes https://github.com/facebook/pyrefly/issues/4174\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/4905\n\nTest Plan:\n- `cargo fmt --all -- --check`\n- `cargo test -p pyrefly_config test_implicit_relative_import_maps_to_import_error_kinds`\n- `cargo test -p pyrefly_config test_doc_headers`\n- `cargo test -p pyrefly_config test_doc_severities`\n- `cargo test -p pyrefly_config test_error_presets_json`\n- `cargo test -p pyrefly test_directory_relative_import_emits_dedicated_diagnostic`\n- `cargo test -p pyrefly test_directory_relative_fallback_reports_directory_relative_import`\n- `cargo test -p pyrefly test_explicit_fallback_does_not_report_directory_relative_import`\n- `cargo test -p pyrefly test_absolute_search_path_precedes_directory_relative_fallback`\n- `python3 test.py --no-test --no-tensor-shapes --no-conformance --no-jsonschema`\n\nReviewed By: connernilsen\n\nDifferential Revision: D119718772\n\nPulled By: kinto0\n\nfbshipit-source-id: c205dc89274682937dcacbcc3e41aff57591a6cb\n"
    },
    {
      "commit": "013195247ff26f6d13cad42fb47fc52782a2d25d",
      "tree": "a17a983e8978d661fcffa109f9c5ce5dd525c52f",
      "parents": [
        "b17cc3830f5ee271f0d823aef0edb674a67fb8e5"
      ],
      "author": {
        "name": "generatedunixname2066905484085733",
        "email": "noreply+2066905484085733@fb.com",
        "time": "Mon Oct 26 10:35:30 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 10:35:30 2026 -0700"
      },
      "message": "Bump arc-swap 1.9.2 -\u003e 1.9.3\n\nSummary:\nAutomated semver-compatible version bump.\nbypass-github-export-checks\n\nReviewed By: dtolnay\n\nDifferential Revision: D127468552\n\nfbshipit-source-id: a9f1a889136725fbee06b685c82ea8e4b5080550\n"
    },
    {
      "commit": "b17cc3830f5ee271f0d823aef0edb674a67fb8e5",
      "tree": "c89d94052f1a11b6c5c1deb6d9ac0f7ecde4d26f",
      "parents": [
        "6f05f5aa770a51d0c4db047049abb91b00e12485"
      ],
      "author": {
        "name": "generatedunixname2382037498884706",
        "email": "noreply+2382037498884706@fb.com",
        "time": "Mon Oct 26 10:12:38 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 10:12:38 2026 -0700"
      },
      "message": "Fix clippy::needless_borrows_for_generic_args issues in fbcode/pyrefly/pyrefly/lib/alt/class\n\nReviewed By: dtolnay, diliop\n\nDifferential Revision: D127517945\n\nfbshipit-source-id: 9372243e719cd5e815371301fd49fc62be286960\n"
    },
    {
      "commit": "6f05f5aa770a51d0c4db047049abb91b00e12485",
      "tree": "fb23414407528cc1e48bca9380aaa2a219d14dd5",
      "parents": [
        "53ed9ff270a6bc2702e1045e83532fbc12eeb0ee"
      ],
      "author": {
        "name": "Neil Mitchell",
        "email": "ndmitchell@meta.com",
        "time": "Mon Oct 26 10:09:59 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 10:09:59 2026 -0700"
      },
      "message": "Match excludes against discovered files\n\nSummary:\nAn exclude can match an include pattern\u0027s source text without matching the\nfiles selected by that include, causing file discovery to drop a valid walk\nroot. Keep include roots active and apply excludes to concrete files instead,\nwhile preserving explicit-file filtering and useful no-match diagnostics.\n\nReviewed By: samwgoldman\n\nDifferential Revision: D124780526\n\nfbshipit-source-id: a5c18ac227f52257703072882201c8d78376368a\n"
    },
    {
      "commit": "53ed9ff270a6bc2702e1045e83532fbc12eeb0ee",
      "tree": "b30daf79d03f87a74d11ee45fa4091f138276620",
      "parents": [
        "e023070a049d1a699a271038a5ed2f0b2fbdb67b"
      ],
      "author": {
        "name": "Neil Mitchell",
        "email": "ndmitchell@meta.com",
        "time": "Mon Oct 26 10:09:59 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 10:09:59 2026 -0700"
      },
      "message": "Clamp LSP positions before line terminators\n\nSummary:\nLSP positions cannot address line terminators, but out-of-range character\npositions in CRLF files could clamp between CR and LF, while bare CR could\nclamp onto the next line. Use Ruff\u0027s line-boundary primitive so all supported\nline endings share the same content-end semantics.\n\nReviewed By: samwgoldman\n\nDifferential Revision: D124780525\n\nfbshipit-source-id: b805d4bcaa67f3df3bb3fdc1b5ceb3e32e6385e1\n"
    },
    {
      "commit": "e023070a049d1a699a271038a5ed2f0b2fbdb67b",
      "tree": "9b014fceaa3d40ba18a75c4d06d22bdd11957b33",
      "parents": [
        "f819cf23ddfa1963c2408a2475d03748b3d777e2"
      ],
      "author": {
        "name": "Neil Mitchell",
        "email": "ndmitchell@meta.com",
        "time": "Mon Oct 26 10:09:59 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 10:09:59 2026 -0700"
      },
      "message": "Preserve inline edits across semicolon statements\n\nSummary:\nLean modeling exposed that removing an inlined assignment could consume the\npreceding newline while leaving a semicolon behind, producing invalid Python.\nChoose the adjacent separator that preserves the remaining statements, or\nremove the whole line when the assignment is alone.\n\n## Review follow-up: physical line boundaries\n\nA real applied-action replay confirmed the orphan-semicolon case on bare-CR files:\n\n```python\n# Input; each displayed line is separated by a bare CR byte.\ndef compute():\n    value \u003d 2;# keep\n    return value + 1\n\n# Before the fix, applying the returned inline edits produced invalid Python:\ndef compute():\n    ;# keep\n    return 2 + 1\n\n# After the fix:\ndef compute():\n    return 2 + 1\n```\n\nThe helper now finds the preceding CR or LF, matching the line endings already recognised\nwhen finding the end of the line. This does not change LF or CRLF behaviour. The new\nregression exercises the returned edits and a clean Pyrefly recheck for both `;# keep`\nand a bare trailing `;`.\n\nFailing-before replay: https://www.internalfb.com/intern/testinfra/testrun/10133099373344553\nPassing-after inline suite: https://www.internalfb.com/intern/testinfra/testrun/19140298476755611\nThe passing-after suite ran 15 inline-variable tests with zero failures.\n\nThe other reported separator case is a tested non-bug: `prefix \u003d 1; value \u003d 2; # keep`\nbecomes `prefix \u003d 1# keep` while uses become `prefix + 2`. The final semicolon is optional\nbefore a comment; the preceding statement and comment survive. The existing permanent\nregression rechecks the returned/applied edits, and the independent CPython replay computes 3.\nA new control exercises the line-start `value \u003d 2;# keep` case; a one-line class assignment\nis rejected by the current inline-action eligibility rules.\n\nIndependent source-first review confirmed the minimal CR/LF fix and both comment/EOL\nregressions. Form-feed indentation and arbitrary malformed parser ranges remain outside this\nfix; the form-feed issue is pre-existing and is not claimed fixed here.\n\n## Accessible evidence\n\nThe full original Lean model, audit output and real-code replay follow inline, so no private\npaste permission is needed. These are the original bounded results; they are not a proof of\nall Python syntax or of general semantic preservation. The separate physical-line model\nbelow adds the supported-terminator refinement and an LF-only mutation check.\n\n## Original bounded model and replay (historical)\n\n# Pyrefly inline-variable Lean check evidence\n\n## Verdict\n\nFOUND: inlining the first of two semicolon-separated statements removed the preceding newline and indentation but left the semicolon, producing invalid Python. The fix consumes the separator on the side of the removed statement that preserves the remaining statements.\n\n## Lean model\n\n```lean\nimport Mathlib\n\nnamespace PyreflyInlineRemoval\n\ninductive Before\n  | startsLine\n  | precededStmt\nderiving DecidableEq, Repr\n\ninductive Following\n  | newline\n  | eof\n  | followingStmt\n  | trailingSeparator\n  | comment\nderiving DecidableEq, Repr\n\nstructure Range where\n  start : ℕ\n  end_ : ℕ\nderiving DecidableEq, Repr\n\nstructure RemovalCase where\n  before : Before\n  following : Following\nderiving DecidableEq, Repr\n\ndef statementStart (c : RemovalCase) : ℕ :\u003d if c.before \u003d\u003d .startsLine then 4 else 12\ndef statementEnd (c : RemovalCase) : ℕ :\u003d statementStart c + 1\n\ndef oldRange (c : RemovalCase) : Range :\u003d\n  let start :\u003d if c.before \u003d\u003d .startsLine then 0 else statementStart c\n  let end_ :\u003d if c.following \u003d\u003d .newline then statementEnd c + 1 else statementEnd c\n  { start, end_ }\n\ndef fixedRange (c : RemovalCase) : Range :\u003d\n  if c.following \u003d\u003d .followingStmt then\n    { start :\u003d statementStart c, end_ :\u003d statementEnd c + 2 }\n  else if c.before \u003d\u003d .precededStmt then\n    { start :\u003d statementStart c - 2,\n      end_ :\u003d if c.following \u003d\u003d .trailingSeparator then statementEnd c + 1 else statementEnd c }\n  else\n    { start :\u003d 0,\n      end_ :\u003d if c.following \u003d\u003d .newline then statementEnd c + 1 else statementEnd c }\n\ndef specRange (c : RemovalCase) : Range :\u003d\n  match c.before, c.following with\n  | _, .followingStmt \u003d\u003e { start :\u003d statementStart c, end_ :\u003d statementEnd c + 2 }\n  | .precededStmt, .trailingSeparator \u003d\u003e\n      { start :\u003d statementStart c - 2, end_ :\u003d statementEnd c + 1 }\n  | .precededStmt, _ \u003d\u003e { start :\u003d statementStart c - 2, end_ :\u003d statementEnd c }\n  | .startsLine, .newline \u003d\u003e { start :\u003d 0, end_ :\u003d statementEnd c + 1 }\n  | .startsLine, _ \u003d\u003e { start :\u003d 0, end_ :\u003d statementEnd c }\n\ndef allBefore : List Before :\u003d [.startsLine, .precededStmt]\ndef allFollowing : List Following :\u003d\n  [.newline, .eof, .followingStmt, .trailingSeparator, .comment]\n\ndef caseGrid : List RemovalCase :\u003d do\n  let before ← allBefore\n  let following ← allFollowing\n  pure { before, following }\n\ntheorem caseGrid_complete (before : Before) (following : Following) :\n    RemovalCase.mk before following ∈ caseGrid :\u003d by\n  cases before \u003c;\u003e cases following \u003c;\u003e decide\n\ntheorem first_semicolon_statement_corrupts_the_line :\n    oldRange ⟨.startsLine, .followingStmt⟩ \u003d ⟨0, 5⟩ ∧\n    specRange ⟨.startsLine, .followingStmt⟩ \u003d ⟨4, 7⟩ :\u003d by\n  decide\n\ntheorem later_statement_consumes_the_next_newline :\n    oldRange ⟨.precededStmt, .newline⟩ \u003d ⟨12, 14⟩ ∧\n    specRange ⟨.precededStmt, .newline⟩ \u003d ⟨10, 13⟩ :\u003d by\n  decide\n\ntheorem fixed_matches_spec_on_complete_grid :\n    ∀ c ∈ caseGrid, fixedRange c \u003d specRange c :\u003d by\n  decide\n\nend PyreflyInlineRemoval\n```\n\n## Lean audit\n\nCommand:\n\n```bash\nbash fbcode/claude-templates/components/plugins/lean-check/skills/lean-check/scripts/lean_audit.sh \\\n  /tmp/lean-check/pyrefly-inline-removal/Model.lean \\\n  caseGrid_complete first_semicolon_statement_corrupts_the_line \\\n  later_statement_consumes_the_next_newline fixed_matches_spec_on_complete_grid\n```\n\nOutput:\n\n```text\nCHECKED PyreflyInlineRemoval.caseGrid_complete\nCHECKED PyreflyInlineRemoval.fixed_matches_spec_on_complete_grid\nCHECKED PyreflyInlineRemoval.later_statement_consumes_the_next_newline\nCHECKED PyreflyInlineRemoval.first_semicolon_statement_corrupts_the_line\n4 declared theorems checked (plus 25 lemmas Lean generated)\nAUDIT OK\n```\n\n## Real-code replay before the fix\n\nCommand:\n\n```bash\nbuck2 test fbcode//pyrefly/pyrefly:pyrefly_library-unittest -- \\\n  --regex \u0027test_removed_export_from_old_answers_invalidates_consumer|inline_variable_preserves_following_statement_on_same_line\u0027\n```\n\nOutput:\n\n```text\nFail: test::lsp::code_actions::inline_variable_preserves_following_statement_on_same_line\nassertion failed: `(left \u003d\u003d right)`\n\nDiff \u003c left / right:\n\u003cdef compute():\n\u003c    result \u003d 1 + 1\n\u003edef compute():; result \u003d 1 + 1\n #                       ^\n     return result\n\nTests finished: Pass 2. Fail 1.\n```\n\nThe unrelated export-invalidation hypothesis in that exploratory run passed and was removed from the source change.\n\n## Real-code replay after the fix\n\nCommand:\n\n```bash\nbuck2 test fbcode//pyrefly/pyrefly:pyrefly_library-unittest -- --regex \u0027inline_variable\u0027\n```\n\nOutput:\n\n```text\nTests finished: Pass 11. Fail 0. Timeout 0. Fatal 0. Skip 0. Omit 0. Infra Failure 0. Build failure 0\n```\n\n## Independent review\n\n- A fresh Pyrefly-owner critic confirmed the original Ruff-range replay and found the additional later-statement and trailing-semicolon boundaries now covered by tests.\n- A cross-family reviewer independently exercised 216 byte-range cases across indentation, separator whitespace, LF/CRLF, first/middle statements, and Unicode prefixes; all patched cases matched the expected text and parsed.\n\n## Not covered\n\n1. Arbitrary malformed parser ranges.\n2. Full semantic preservation for side-effecting inline expressions.\n3. All possible comments and unusual whitespace characters beyond spaces, tabs, LF, and CRLF.\n4. General edit ordering outside this quick fix.\n\n## Bare-CR line-start refinement\n\n```lean\nimport Mathlib\n\n/-!\nFinite refinement for inline-variable physical-line detection.\nThree supported terminators (LF, CRLF, CR) and three indentation suffixes (none, space, tab),\na fixed two-byte preceding statement beforeBytes, and no malformed offsets.\nThis proves line-start detection, not expression semantics or arbitrary edit sequences.\n-/\nnamespace InlineLineStart\n\ninductive Ending | lf | crlf | cr deriving DecidableEq, Repr\ninductive Indent | none | space | tab deriving DecidableEq, Repr\n\ndef endingBytes : Ending → List Nat\n  | .lf \u003d\u003e [10]\n  | .crlf \u003d\u003e [13, 10]\n  | .cr \u003d\u003e [13]\n\ndef indentBytes : Indent → List Nat\n  | .none \u003d\u003e []\n  | .space \u003d\u003e [32]\n  | .tab \u003d\u003e [9]\n\n/-- Byte equivalent of rfind followed by idx + 1; zero when no separator exists. -/\ndef lineStart (recogniseCr : Bool) : List Nat → Nat\n  | [] \u003d\u003e 0\n  | b :: rest \u003d\u003e\n    let later :\u003d lineStart recogniseCr rest\n    if later \u003e 0 then later + 1\n    else if b \u003d 10 ∨ (recogniseCr \u003d true ∧ b \u003d 13) then 1\n    else 0\n\ndef beforeBytes (ending : Ending) (indent : Indent) : List Nat :\u003d\n  [100, 58] ++ endingBytes ending ++ indentBytes indent\n\ndef specStart (ending : Ending) : Nat :\u003d 2 + (endingBytes ending).length\n\ntheorem old_cr_uses_previous_line :\n    lineStart false (beforeBytes .cr .space) \u003d 0 ∧ specStart .cr \u003d 3 :\u003d by\n  decide\n\ntheorem fixed_detects_supported_terminators (ending : Ending) (indent : Indent) :\n    lineStart true (beforeBytes ending indent) \u003d specStart ending :\u003d by\n  cases ending \u003c;\u003e cases indent \u003c;\u003e decide\n\ntheorem lf_only_mutant_fails :\n    lineStart false (beforeBytes .cr .space) ≠ specStart .cr :\u003d by\n  decide\n\nend InlineLineStart\n\n#print axioms InlineLineStart.old_cr_uses_previous_line\n#print axioms InlineLineStart.fixed_detects_supported_terminators\n#print axioms InlineLineStart.lf_only_mutant_fails\n\n```\n\nAudit (`lean-mathlib LineStart.lean`):\n\n```text\n\u0027InlineLineStart.old_cr_uses_previous_line\u0027 does not depend on any axioms\n\u0027InlineLineStart.fixed_detects_supported_terminators\u0027 does not depend on any axioms\n\u0027InlineLineStart.lf_only_mutant_fails\u0027 does not depend on any axioms\n```\n\nReviewed By: samwgoldman\n\nDifferential Revision: D124767758\n\nfbshipit-source-id: 6a4f42a07310f76e99ed97817d033dcfc7f8cf88\n"
    },
    {
      "commit": "f819cf23ddfa1963c2408a2475d03748b3d777e2",
      "tree": "dfd26189e96991dce93f925376fe7888d5e33e5e",
      "parents": [
        "46f185456e011d40d8f21b0ba7ebddd2e036ad73"
      ],
      "author": {
        "name": "Mangesh Raut",
        "email": "95149253+mangeshraut712@users.noreply.github.com",
        "time": "Mon Oct 26 09:53:38 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 09:53:38 2026 -0700"
      },
      "message": "fix(stubgen): preserve from __future__ import annotations (#5369)\n\nSummary:\nCloses https://github.com/facebook/pyrefly/issues/5321.\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5369\n\nReviewed By: stroxler\n\nDifferential Revision: D127483012\n\nfbshipit-source-id: 50c228933a6a753d53ef8024b9fc6b8b42f4b7cc\n"
    },
    {
      "commit": "46f185456e011d40d8f21b0ba7ebddd2e036ad73",
      "tree": "0bcb315684fe3e87fed23306a0366d689bf8569f",
      "parents": [
        "afe65f2272be705530df792160febdbcb16ab9cd"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 09:18:17 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 09:18:17 2026 -0700"
      },
      "message": "Bump serialize-javascript from 7.0.5 to 7.1.3 in /lsp (#5378)\n\nSummary:\nBumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) from 7.0.5 to 7.1.3.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/releases\"\u003eserialize-javascript\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.1.3\u003c/h2\u003e\n\u003cp\u003eSee: \u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v\"\u003ehttps://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: escape \u003ccode\u003e\u0026lt;/script\u003c/code\u003e at the end of a serialized function body by \u003ca href\u003d\"https://github.com/redonkulus\"\u003e\u003ccode\u003e@​redonkulus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/235\"\u003eyahoo/serialize-javascript#235\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix serialization of Dates with expanded ISO years by \u003ca href\u003d\"https://github.com/Shubham-Padkonde\"\u003e\u003ccode\u003e@​Shubham-Padkonde\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/232\"\u003eyahoo/serialize-javascript#232\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: ignore functions without mutating input objects by \u003ca href\u003d\"https://github.com/Shubham-Padkonde\"\u003e\u003ccode\u003e@​Shubham-Padkonde\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/233\"\u003eyahoo/serialize-javascript#233\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease: v7.1.3 by \u003ca href\u003d\"https://github.com/redonkulus\"\u003e\u003ccode\u003e@​redonkulus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/236\"\u003eyahoo/serialize-javascript#236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNote on \u003ccode\u003eignoreFunction\u003c/code\u003e\u003c/h3\u003e\n\u003cp\u003eWith \u003ccode\u003eignoreFunction: true\u003c/code\u003e, function values are now omitted the same way \u003ccode\u003eJSON.stringify\u003c/code\u003e omits them, without deleting them from the input object. Functions inside arrays are emitted as \u003ccode\u003enull\u003c/code\u003e (previously this produced \u003ccode\u003eArray.prototype.slice.call(...)\u003c/code\u003e output).\u003c/p\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Shubham-Padkonde\"\u003e\u003ccode\u003e@​Shubham-Padkonde\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/232\"\u003eyahoo/serialize-javascript#232\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/compare/v7.1.2...v7.1.3\"\u003ehttps://github.com/yahoo/serialize-javascript/compare/v7.1.2...v7.1.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.1.2\u003c/h2\u003e\n\u003cp\u003eSee: \u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-gfhx-hw2g-v5hg\"\u003ehttps://github.com/yahoo/serialize-javascript/security/advisories/GHSA-gfhx-hw2g-v5hg\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.1.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: fix XSS bypass via split \u003ccode\u003e\u0026lt;/script\u003c/code\u003e payload across function bodies by \u003ca href\u003d\"https://github.com/okuryu\"\u003e\u003ccode\u003e@​okuryu\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/226\"\u003eyahoo/serialize-javascript#226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease: v7.1.1 by \u003ca href\u003d\"https://github.com/okuryu\"\u003e\u003ccode\u003e@​okuryu\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/227\"\u003eyahoo/serialize-javascript#227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/compare/v7.1.0...v7.1.1\"\u003ehttps://github.com/yahoo/serialize-javascript/compare/v7.1.0...v7.1.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: add Node.js 26 to test matrix by \u003ca href\u003d\"https://github.com/okuryu\"\u003e\u003ccode\u003e@​okuryu\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/224\"\u003eyahoo/serialize-javascript#224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease: v7.1.0 by \u003ca href\u003d\"https://github.com/okuryu\"\u003e\u003ccode\u003e@​okuryu\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/225\"\u003eyahoo/serialize-javascript#225\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/compare/v7.0.7...v7.1.0\"\u003ehttps://github.com/yahoo/serialize-javascript/compare/v7.0.7...v7.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: reject spoofed RegExp objects with non-string source property by \u003ca href\u003d\"https://github.com/redonkulus\"\u003e\u003ccode\u003e@​redonkulus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/222\"\u003eyahoo/serialize-javascript#222\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease: v7.0.7 by \u003ca href\u003d\"https://github.com/okuryu\"\u003e\u003ccode\u003e@​okuryu\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/223\"\u003eyahoo/serialize-javascript#223\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/compare/v7.0.6...v7.0.7\"\u003ehttps://github.com/yahoo/serialize-javascript/compare/v7.0.6...v7.0.7\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.6\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps-dev): bump lodash from 4.17.23 to 4.18.1 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/215\"\u003eyahoo/serialize-javascript#215\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: reject spoofed URL objects with non-string toString() result by \u003ca href\u003d\"https://github.com/redonkulus\"\u003e\u003ccode\u003e@​redonkulus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/217\"\u003eyahoo/serialize-javascript#217\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease: v7.0.6 by \u003ca href\u003d\"https://github.com/okuryu\"\u003e\u003ccode\u003e@​okuryu\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/pull/221\"\u003eyahoo/serialize-javascript#221\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/4d36b828f7c1c6a1f0de9ef932fefadcca0edace\"\u003e\u003ccode\u003e4d36b82\u003c/code\u003e\u003c/a\u003e release: v7.1.3 (\u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/issues/236\"\u003ehttps://github.com/facebook/pyrefly/issues/236\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/45e539775bc15e2f30d338dfc7b543dd174dbcc0\"\u003e\u003ccode\u003e45e5397\u003c/code\u003e\u003c/a\u003e fix: ignore functions without mutating input objects (\u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/issues/233\"\u003ehttps://github.com/facebook/pyrefly/issues/233\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/e978a1bc163610cec4915677e1587924ab4a8cef\"\u003e\u003ccode\u003ee978a1b\u003c/code\u003e\u003c/a\u003e fix: serialize Dates with expanded ISO years (\u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/issues/232\"\u003ehttps://github.com/facebook/pyrefly/issues/232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61\"\u003e\u003ccode\u003e2864b3c\u003c/code\u003e\u003c/a\u003e fix: escape \u003ccode\u003e\u0026lt;/script\u003c/code\u003e at the end of a serialized function body (\u003ca href\u003d\"https://redirect.github.com/yahoo/serialize-javascript/issues/235\"\u003ehttps://github.com/facebook/pyrefly/issues/235\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/6a73fa1ddcbe4bbee8bfb12fc1ad8c086cb1334b\"\u003e\u003ccode\u003e6a73fa1\u003c/code\u003e\u003c/a\u003e release: v7.1.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/2bdbaaff9cb8a4639135eb24cfcd383d3fefb534\"\u003e\u003ccode\u003e2bdbaaf\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/8c8caa7066a52106fa719c6abb5dc69858c9f799\"\u003e\u003ccode\u003e8c8caa7\u003c/code\u003e\u003c/a\u003e release: v7.1.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/ffda9f11d946f2d161471340f92ac0b7a7208449\"\u003e\u003ccode\u003effda9f1\u003c/code\u003e\u003c/a\u003e fix: fix XSS bypass via split \u003ccode\u003e\u0026lt;/script\u003c/code\u003e payload across function bodies\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/739145a671afd4b81a416e15888f8f5e637d08d6\"\u003e\u003ccode\u003e739145a\u003c/code\u003e\u003c/a\u003e release: v7.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/commit/57865edc0f3ae4fcc3c649bbb135122303519c11\"\u003e\u003ccode\u003e57865ed\u003c/code\u003e\u003c/a\u003e feat: add Node.js 26 to test matrix\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/yahoo/serialize-javascript/compare/v7.0.5...v7.1.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dserialize-javascript\u0026package-manager\u003dnpm_and_yarn\u0026previous-version\u003d7.0.5\u0026new-version\u003d7.1.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n ---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/pyrefly/network/alerts).\n\n\u003c/details\u003e\n\nPull Request resolved: https://github.com/facebook/pyrefly/pull/5378\n\nReviewed By: stroxler\n\nDifferential Revision: D127511255\n\nfbshipit-source-id: e99c0302ba68dafb0cadb87ffe25de3d66db59d7\n"
    },
    {
      "commit": "afe65f2272be705530df792160febdbcb16ab9cd",
      "tree": "3cb15835f64f220db3eb11049e127454cb2854e8",
      "parents": [
        "b92f0a235d06814b444c1fb521ad545c85bb8e70"
      ],
      "author": {
        "name": "Steven Troxler",
        "email": "stroxler@meta.com",
        "time": "Mon Oct 26 07:39:08 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 07:39:08 2026 -0700"
      },
      "message": "Consider non-Linux platforms in authoring and review\n\nSummary:\nPyrefly supports Linux, macOS, and Windows, so Linux-only reasoning can miss correctness bugs in report output and LSP fixtures. Add concise project-wide guidance to consider platform-specific path and text behavior when authoring and reviewing code, and treat concrete portability failures as blocking review issues.\n\nReference the shared guidance from the existing review skill instead of maintaining a separate Windows-only checklist. Missing platform validation should be stated, not mistaken for a successful cross-platform run; the guidance does not require a full CI matrix for every change.\n\n___\n\nlanded-with-radar-review\n\nDifferential Revision: D127501342\n\nfbshipit-source-id: afe0e1bf60118315aaca8e6a9c786bb392ffd719\n"
    },
    {
      "commit": "b92f0a235d06814b444c1fb521ad545c85bb8e70",
      "tree": "f69cbcbbac1ea442ed1bd8fa77df7c68a86065a1",
      "parents": [
        "149d3749901e770aeb7daf3c042bfd5813986ca2"
      ],
      "author": {
        "name": "Hamdi Hassan Shahid",
        "email": "shahhamdihassan@meta.com",
        "time": "Mon Oct 26 07:17:03 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 07:17:03 2026 -0700"
      },
      "message": "Count fields `__new__` sets on the new instance in uninitialized-instance-variable\n\nSummary:\nThe opt-in `uninitialized-instance-variable` check reports an annotated field as never initialized unless it is assigned in the class body or in a recognized method such as `__init__` or `__new__`. The binder only records writes through a method\u0027s first parameter, which in `__new__` is `cls`, so a field that `__new__` sets on the instance it creates (`result \u003d super().__new__(cls); result.flag \u003d flag`) is reported even though it is always set at runtime.\n\nInside a method named `__new__`, the binder now remembers locals bound to the result of a `__new__` call, the same way it remembers `self`, and records the attributes assigned on them on the enclosing class. Those names reach the class field as a separate `initialized_on_new_instance` flag on `DeclaredByAnnotation`, which only the `uninitialized-instance-variable` condition reads.\n\nThe writes are deliberately kept out of the ordinary instance attributes. Counting them there would also satisfy the `Final` check, which the typing spec limits to `__init__`, and would start inferring attribute types from `__new__`, which changes enum `_value_` inference. A field `__new__` never sets, or sets on some other object, is still reported. Like the existing `__init__` handling this is flow-insensitive, so a write on one branch counts.\n\nFixes https://github.com/facebook/pyrefly/issues/5280\n\nReviewed By: stroxler\n\nDifferential Revision: D127195534\n\nfbshipit-source-id: 3788ae8a55a7ff5bc2f2d67adf87fc1926110492\n"
    },
    {
      "commit": "149d3749901e770aeb7daf3c042bfd5813986ca2",
      "tree": "732f13e723897d7675425fe39d5a21818367f64c",
      "parents": [
        "6a3ed57864764bb00fe87537665cec20db182966"
      ],
      "author": {
        "name": "Hamdi Hassan Shahid",
        "email": "shahhamdihassan@meta.com",
        "time": "Mon Oct 26 07:17:03 2026 -0700"
      },
      "committer": {
        "name": "meta-codesync[bot]",
        "email": "215208954+meta-codesync[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 07:17:03 2026 -0700"
      },
      "message": "Add tests for uninitialized-instance-variable with fields set in `__new__`\n\nSummary:\nThe opt-in `uninitialized-instance-variable` check reports an annotated field as never initialized when `__new__` sets it on the instance it creates, for example `result \u003d super().__new__(cls); result.flag \u003d flag; return result`. The check counts writes in recognized methods such as `__init__` and `__new__`, but only writes through the method\u0027s first parameter, which in `__new__` is `cls` rather than the new instance.\n\nThis adds tests that pin today\u0027s behaviour before the fix. `test_uninitialized_instance_variable_set_in_new` uses the issue\u0027s example and records the false positive under a `bug` marker; it also has a class whose `__new__` sets `x` but not `y`, so the fix has to keep reporting `y`. `test_uninitialized_instance_variable_not_set_in_new` covers fields that must keep reporting: one `__new__` never sets, and one set on an unrelated object inside `__new__`.\n\nReviewed By: stroxler, ndmitchell\n\nDifferential Revision: D127195533\n\nfbshipit-source-id: 800fd665cee5fc10f6fe6c016bd4cab02aa610c3\n"
    }
  ],
  "next": "6a3ed57864764bb00fe87537665cec20db182966"
}