Maintain Python LSP integrations and refresh the browser playground

.github/workflows/main.yml

@@ -16,7 +16,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.3.0
         with:
           enable-cache: true
 

.github/workflows/playground.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: 24
           cache: npm

.github/workflows/publish.yml

@@ -28,7 +28,7 @@ jobs:
           fetch-depth: 0  # Full history for proper versioning
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.3.0
         with:
           enable-cache: true
 

.github/workflows/python-tests.yml

@@ -25,15 +25,15 @@ jobs:
     steps:
     - uses: actions/checkout@v7
     - name: Install uv
-      uses: astral-sh/setup-uv@v10.0.1
+      uses: astral-sh/setup-uv@v10.3.0
       with:
         enable-cache: true
     - name: Set up Python ${{ matrix.python-version }}
       run: uv python install ${{ matrix.python-version }}
     - name: Install dependencies
       run: uv sync --all-extras --locked
     - name: Setup Node.js environment
-      uses: actions/setup-node@v7.0.0
+      uses: actions/setup-node@v7.1.0
 
     - name: Install Pyright distribution
       run: npm install -g "$PYRIGHT_PACKAGE"

assets/lsps/pyright.schema.json

@@ -890,6 +890,12 @@
       "title": "Output verbose logging",
       "default": false
     },
+    "maxCodeComplexity": {
+      "type": "integer",
+      "title": "Maximum code complexity for type evaluation",
+      "default": 768,
+      "minimum": 768
+    },
     "executionEnvironments": {
       "type": "array",
       "title": "Analysis settings to use for specified subdirectories of code",

docs/SEMANTIC_TOKENS.md

@@ -102,7 +102,7 @@ The tables below describe each server’s raw LSP indexes. Read
 `session.backend_legend` for the running server’s ordering. These legends apply
 to LSP sessions; browser WASM APIs have their own feature sets.
 
-### basedpyright 1.40.1 (through PyrightBackend)
+### basedpyright (through PyrightBackend)
 
 #### Token Types
 
@@ -140,9 +140,9 @@ to LSP sessions; browser WASM APIs have their own feature sets.
 
 ---
 
-### Pyrefly 1.3.0
+### Pyrefly
 
-Legend source: [semantic_tokens.rs](https://github.com/facebook/pyrefly/blob/1.3.0/pyrefly/lib/state/semantic_tokens.rs)
+Legend source: [semantic_tokens.rs](https://github.com/facebook/pyrefly/blob/1.3.2/pyrefly/lib/state/semantic_tokens.rs)
 
 Pyrefly does not advertise its legend via LSP initialization, but the token mappings are defined in source code.
 
@@ -197,7 +197,7 @@ Pyrefly does not advertise its legend via LSP initialization, but the token mapp
 
 ---
 
-### ty 0.0.80
+### ty
 
 #### Token Types
 
@@ -232,7 +232,7 @@ Pyrefly does not advertise its legend via LSP initialization, but the token mapp
 
 ---
 
-### Zuban 0.9.3
+### Zuban
 
 Zuban advertises its legend via LSP initialization (follows LSP 3.17 standard ordering for the 23 token types it emits).
 

docs/internal/FEATURE_VERIFICATION.md

@@ -21,7 +21,10 @@ npm view basedpyright version
 
 Commit `uv.lock` with the dependency changes. Minimum supported versions in
 `pyproject.toml` are compatibility floors, not the versions verified in this run;
-raise them only if a change requires it. Generate schemas from upstream with:
+raise them only if a change requires it or an upstream security fix excludes
+vulnerable versions. The ty floor is 0.0.84 for
+[GHSA-vxvm-j4xq-q7m4](https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4).
+Generate schemas from upstream with:
 
 ```sh
 make generate-latest-types
@@ -38,13 +41,14 @@ select Black/isort before Ruff formatting.
 that executable, so install them in **separate directories**:
 
 ```sh
-npm install --prefix /tmp/lsp-basedpyright basedpyright@1.40.1
+npm install --prefix /tmp/lsp-basedpyright basedpyright@1.40.2
 npm install --prefix /tmp/lsp-pyright pyright@1.1.414
 PATH=/tmp/lsp-basedpyright/node_modules/.bin:$PATH uv run pytest tests -q
 PYRIGHT_PACKAGE=pyright PATH=/tmp/lsp-pyright/node_modules/.bin:$PATH \
   uv run pytest tests -k Pyright -q
 uvx pyright --pythonpath .venv/bin/python .
 uvx ruff check .
+uvx ruff format --check --exclude '*.md' .
 ```
 
 Update those exact npm versions on the next maintenance run. `PYRIGHT_PACKAGE`
@@ -59,8 +63,8 @@ and send a real request with a control case when validating a claim.
 
 ## Verified Session features
 
-Snapshot **2026-09-11**: Pyright 1.1.414, basedpyright 1.40.1, Pyrefly 1.3.0,
-ty 0.0.80, Zuban 0.9.3. “Yes” means the named integration test passes for its
+Snapshot **2026-10-10**: Pyright 1.1.414, basedpyright 1.40.2, Pyrefly 1.3.2,
+ty 0.0.86, Zuban 0.10.0. “Yes” means the named integration test passes for its
 fixture, not comprehensive conformance for every Python program.
 
 | Feature | Pyright | basedpyright | Pyrefly | ty | Zuban |
@@ -96,11 +100,11 @@ rg -n 'xfail|skip' tests
 ```
 
 Compare legends with [the token reference](../SEMANTIC_TOKENS.md) and tagged source.
-Pyrefly 1.3 still omits its provider from initialization; it needs the fallback
+Pyrefly 1.3.2 still omits its provider from initialization; it needs the fallback
 legend. `tests/test_semantic_tokens.py` checks that its five new string modifiers
 survive normalization, including a live server fixture. Append canonical entries
-so existing editor indices stay stable. ty 0.0.80 appends `operator` and `regexp`
-token types, already covered by the canonical legend.
+so existing editor indices stay stable. The current legends match the previous
+maintenance run; ty's `operator` and `regexp` types remain covered.
 
 Reprobe versioned limitations with positive controls before advancing their dates:
 [Pyrefly](../../lsp_types/pyrefly/KNOWN_LIMITATIONS.md),

docs/internal/MAINTENANCE_2026-10-10.md

@@ -0,0 +1,148 @@
+# Maintenance — October 10, 2026
+
+## Release scope
+
+Monthly maintenance follows [the feature-verification runbook](FEATURE_VERIFICATION.md)
+and [documentation policy](DOCUMENTATION.md). Work used the isolated
+`codex/maintenance-2026-10-10` worktree. The existing publication workflow will
+apply a minor bump to **0.25.0** after merge and CI; publication and deployment
+receipts belong in the close-out below.
+
+## Version and source checks
+
+Live PyPI JSON and npm metadata agreed with tagged upstream releases:
+
+| Backend | Previous lock / npm check | Current stable |
+|---|---|---|
+| Microsoft Pyright | 1.1.414 | 1.1.414 |
+| basedpyright | 1.40.1 | 1.40.2 |
+| Pyrefly | 1.3.0 | 1.3.2 |
+| ty | 0.0.80 | 0.0.86 |
+| Zuban | 0.9.3 | 0.10.0 |
+
+Release sources: [Pyright](https://github.com/microsoft/pyright/releases/tag/1.1.414),
+[basedpyright](https://github.com/DetachHead/basedpyright/releases/tag/v1.40.2),
+[Pyrefly](https://github.com/facebook/pyrefly/releases/tag/1.3.2),
+[ty](https://github.com/astral-sh/ty/releases/tag/0.0.86), and
+[Zuban](https://docs.zubanls.com/en/latest/changelog.html).
+Pyrefly's patch fixes inference after assignments from `Any`; basedpyright fixes
+browser typeshed packaging. Zuban changes forward-reference resolution and
+auto-import handling. ty's intervening releases include LSP and inference fixes,
+Python 3.15 fallback targeting, and
+[GHSA-vxvm-j4xq-q7m4](https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4).
+Raised the ty extra's floor to **0.0.84**, the patched release. Other compatibility
+floors remain unchanged.
+
+`uv sync --all-extras --upgrade` refreshed the lock, including
+datamodel-code-generator **0.79.0 → 0.83.0**, Black **26.5.1 → 26.10.1** and
+Pydantic **2.13.5 → 2.14.0**. Updated setup-uv to **10.3.0** and setup-node to
+**7.1.0** in the existing workflows.
+
+## Schemas and integration boundaries
+
+- Downloaded all three upstream schemas/models and ran the Makefile recipes
+  directly because `make` is unavailable. The protocol model and generated
+  protocol types are unchanged. Pyright's current upstream schema adds optional
+  `maxCodeComplexity` (integer, default/minimum 768); regeneration adds that field
+  to its configuration TypedDict. This is an upstream schema addition, not a
+  claim that the installed stable binaries implement it.
+- Repeated generation and compared SHA-256 digests: all five generated files
+  reproduced byte-for-byte. The formatter-extra deprecation warning persists;
+  Black/isort extras are already declared and generation succeeds.
+- Compared Pyrefly's tagged `base.rs`, `config.rs`, `error_kind.rs` and
+  `semantic_tokens.rs` with 1.3.0: unchanged. ty's release-source option fields,
+  severities and output formats match the hand-written schema; its Python target
+  is inferred from project/environment settings, falling back to 3.15. Zuban's
+  documented modes and configuration remain compatible.
+- Extracted live legends: basedpyright **15 types / 9 modifiers**, ty
+  **17 / 4**, Zuban **23 / 8**. Pyrefly still omits its legend from initialization;
+  its fallback and five string modifiers remain valid. Canonical indices did
+  not change. Public legend headings now identify backends; version inventories
+  stay in this record and the runbook.
+- Completion tests still establish documentation enrichment with both Pyright
+  distributions and Zuban, Pyrefly's echo, and ty's `-32601` error. A separate
+  Pyrefly probe stripped `detail` and `documentation` before resolution and still
+  received an unchanged item.
+- ty initialization probes compared `unresolved-import="ignore"` with the
+  misspelled `unresolved_import`: only the correct spelling suppresses the import
+  error; both retain an independent assignment-error control. Default workspace
+  and file-watching warnings remain. Tagged server routing still lacks a
+  `workspace/didChangeConfiguration` handler; workspace-folder/config-file
+  refresh changes do not remove this integration limit.
+- Zuban still skips a constrained TypeVar function's assignment error and an
+  unused ignore, while detecting the same error in an upper-bounded function
+  and at module scope. With `typeCheckingMode="off"` and
+  `disableLanguageServices=True`, initialization drops diagnostic, hover and
+  completion providers; direct requests still return results. Default settings
+  advertise all three providers and return the same positive controls.
+- Pyrefly's opt-in regex and patch-target checks still diagnose `re.compile("[")`
+  and `patch("math.nonexistent_symbol")`. Disabling both removes those diagnostics
+  while preserving an independent bad-assignment control.
+
+## Browser refresh
+
+Updated Monaco **0.56.0 → 0.57.0**, Vite **8.3.0 → 8.3.4**, JSON-RPC
+**9.0.2 → 9.0.3**, LSP protocol **3.18.3 → 3.18.4**, and DOMPurify
+**3.4.15 → 3.4.16**. TypeScript remains **7.0.2**. The external
+browser-basedpyright worker is pinned to **1.40.2**.
+
+The DOMPurify refresh also fixes the repository's open
+[Dependabot alert #34](https://github.com/Mazyod/lsp-python-types/security/dependabot/34)
+([GHSA-p98j-92pf-mc4p](https://github.com/advisories/GHSA-p98j-92pf-mc4p)).
+Raised the existing override to `^3.4.16` so its floor excludes the affected
+3.4.13–3.4.15 releases; the lock already resolved the patched 3.4.16 artifact.
+
+Pinned WASM: Pyrefly **1.3.2** release archive and ty **0.0.86** source archive,
+with their upstream SHA-256 values verified before extraction/build. ty builds
+in an isolated Node **24.21.0** container with Rust **1.99.0**, a native compiler and
+wasm-pack **0.15.0**. Generated assets remain ignored. Monaco 0.57.0's bundled
+`MonacoLspClient` still exposes only its transport constructor, with no public
+initialization-parameter or disposal API; the existing adapter remains in use.
+
+## Validation
+
+Host: Linux x86_64, Python **3.13.15**, uv **0.12.22**, Node **22.23.3**.
+Both npm LSP distributions were installed in separate temporary prefixes.
+
+```sh
+uv sync --all-extras --upgrade
+PATH=/tmp/lsp-basedpyright-2026-10-10/node_modules/.bin:$PATH uv run pytest tests -q -ra
+PYRIGHT_PACKAGE=pyright PATH=/tmp/lsp-pyright-2026-10-10/node_modules/.bin:$PATH \
+  uv run pytest tests -k Pyright -q -ra
+uvx pyright --pythonpath .venv/bin/python .
+uvx ruff check .
+uvx ruff format --check --exclude '*.md' .
+uv build
+PATH=/tmp/lsp-basedpyright-2026-10-10/node_modules/.bin:$PATH \
+  uv run python examples/extract_semantic_legends.py
+git diff --check
+```
+
+- Full suite: **251 passed, 1 xfailed**. The existing ty recycle-hover assertion
+  expects a variable name; ordinary type-only hover still passes. No Linux skips.
+- Separate Microsoft Pyright suite: **35 passed, 217 deselected**.
+- Pyright: **0 errors, warnings or information**. Ruff lint and Python formatting
+  passed. Ruff **0.17.0** now also formats Markdown code fences; the formatting
+  command excludes Markdown to preserve existing examples and historical records.
+- Wheel and source distribution built successfully; whitespace and local
+  documentation link/anchor checks passed. Read the complete README user-guide
+  path; public guides contain no internal-record links.
+- `npm update`, the Monaco minor update, `npm audit` and `npm outdated` completed:
+  **0 vulnerabilities**, **no outdated entries**.
+- Playwright **1.64.0** / Chromium **156**: `concurrency.test.mjs` passed controlled
+  edit-during-debounce, late-result, switch/detach, diagnostic-version,
+  superseded-request, timeout and disposal checks.
+- `npm run fetch-wasm` verified both archive checksums; a second run reused the
+  matching versions. `npm run test:wasm`: **2 passed**. `npm run build`: **passed**,
+  with both `dist/pyrefly` and `dist/ty` assets present at the configured Pages
+  base path. The existing ineffective-Monaco-dynamic-import warning remains;
+  Vite also reports build plugin timings. Neither prevented the browser checks.
+- `browser.test.mjs` passed production markers, hover and error clearing across
+  basedpyright → Pyrefly → ty → Pyrefly → ty → basedpyright, including repeated
+  WASM initialization and rapid selections preserving the final backend. No
+  console/page errors. Pyrefly's WASM is **13,739,184 bytes**; ty's is
+  **19,481,646 bytes**.
+
+## Release close-out
+
+Publication and deployment results will be recorded after their workflows complete.

lsp_types/pyrefly/config_schema.py

@@ -1,7 +1,7 @@
 # Pyrefly configuration schema
 # Based on official Pyrefly documentation: https://pyrefly.org/en/docs/configuration/
 # CLI reference: https://github.com/facebook/pyrefly
-# Reviewed against Pyrefly 1.3.0 (2026-09-11).
+# Source: https://github.com/facebook/pyrefly/tree/1.3.2/crates/pyrefly_config/src
 #
 # Note: Field names use snake_case (Python convention) but are automatically
 # converted to kebab-case when written to pyrefly.toml (official format).

lsp_types/pyright/config_schema.py

@@ -504,4 +504,5 @@ class Model(TypedDict):
     venvPath: NotRequired[str]
     venv: NotRequired[str]
     verboseOutput: NotRequired[bool]
+    maxCodeComplexity: NotRequired[int]
     executionEnvironments: NotRequired[list[ExecutionEnvironment]]

lsp_types/semantic_tokens.py

@@ -77,7 +77,7 @@
 }
 
 # Pyrefly legend (server doesn't advertise it via LSP)
-# Source: https://github.com/facebook/pyrefly/blob/1.3.0/pyrefly/lib/state/semantic_tokens.rs
+# Source: https://github.com/facebook/pyrefly/blob/1.3.2/pyrefly/lib/state/semantic_tokens.rs
 PYREFLY_LEGEND: types.SemanticTokensLegend = {
     "tokenTypes": [
         "namespace",  # 0

lsp_types/ty/KNOWN_LIMITATIONS.md

@@ -56,4 +56,5 @@ Use the initial completion response.
 ## Virtual documents are supported
 
 Supported ty versions analyze documents opened through LSP without a matching
-Python file on disk. The backend requires ty 0.0.16 or newer.
+Python file on disk. The backend requires ty 0.0.84 or newer, which includes the
+[incremental type-checking security fix](https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4).

lsp_types/ty/config_schema.py

@@ -36,7 +36,7 @@ class EnvironmentConfig(TypedDict, total=False):
     """Target platform for sys.platform checks (e.g., 'linux', 'darwin', 'win32')."""
 
     python_version: NotRequired[str]
-    """Python version to target (e.g., '3.12'). Default: 3.14."""
+    """Target Python version; inferred from the project/environment, falling back to 3.15."""
 
     root: NotRequired[list[str]]
     """Root paths of the project, used for finding first-party modules."""

playground/fetch-wasm.sh

@@ -6,8 +6,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WASM_DIR="${SCRIPT_DIR}/wasm"
-PYREFLY_VERSION="1.3.0"
-TY_VERSION="0.0.80"
+PYREFLY_VERSION="1.3.2"
+TY_VERSION="0.0.86"
 WASM_PACK_VERSION="0.15.0"
 TMP_DIR=$(mktemp -d)
 trap 'rm -rf "$TMP_DIR"' EXIT
@@ -24,7 +24,7 @@ fetch_pyrefly() {
   curl --fail --location --retry 3 \
     "https://github.com/facebook/pyrefly/releases/download/${PYREFLY_VERSION}/pyrefly-wasm.tar.gz" \
     -o "$TMP_DIR/pyrefly-wasm.tar.gz"
-  (cd "$TMP_DIR" && echo "6a70781b5e70ad505f18cade35bf64bfc83cfee14437e07fceafd374cc358fd0  pyrefly-wasm.tar.gz" | shasum -a 256 --check)
+  (cd "$TMP_DIR" && echo "2210236fbee5e4dc0427ae8a966c401babc5ab69235d80e9a1f989323c71c9ea  pyrefly-wasm.tar.gz" | shasum -a 256 --check)
   mkdir -p "$dir"
   tar -xzf "$TMP_DIR/pyrefly-wasm.tar.gz" -C "$dir"
   echo "$PYREFLY_VERSION" > "$dir/.version"
@@ -43,7 +43,7 @@ fetch_ty() {
   curl --fail --location --retry 3 \
     "https://github.com/astral-sh/ty/releases/download/${TY_VERSION}/source.tar.gz" \
     -o "$TMP_DIR/ty-source.tar.gz"
-  (cd "$TMP_DIR" && echo "a039d7e66d362e1707fc494f2c69dfdd2eb5333dc8fa9ad582edc125932fa5fa  ty-source.tar.gz" | shasum -a 256 --check)
+  (cd "$TMP_DIR" && echo "83346e0a713c319f81d9848798be6bf8f02e49c324ea5206d0028a110cbdd455  ty-source.tar.gz" | shasum -a 256 --check)
   tar -xzf "$TMP_DIR/ty-source.tar.gz" -C "$TMP_DIR"
   # The source archive contains the exact Ruff workspace used for this ty release.
   (cd "$TMP_DIR/ruff" && npm exec --yes --package="wasm-pack@${WASM_PACK_VERSION}" -- \