chore: drop unused dev dependencies, unpin ty, refresh the lockfile

[joshmarkovic]

Development-dependency housekeeping in three atomic commits. [project.dependencies] is untouched, so nothing changes for people installing the adapter.

Commit	What it does
drop four unused development dependencies	pyproject.toml + lock. Removes 7 packages, moves no versions
unpin ty	pyproject.toml + lock + one stale comment. Changes no versions
refresh the lockfile and match the ruff hook to it	lock + the ruff-pre-commit rev. All the version movement

Each commit was checked out and verified on its own: uv lock --check consistent, ruff check and ty check clean, 500 unit tests passing at every one.

1. Drop four unused dev dependencies

Nothing in the repo references any of them:

Dependency	Why it goes
tox	No tox.ini, no setup.cfg, no [tool.tox] section
bumpversion	No config either. CONTRIBUTING documents bumping __version__.py by hand, and release-version.yml verifies it against the tag
pytest-csv	No --csv usage in pytest.ini, the Makefile or CI
pytz	No imports anywhere

pytz stays installed as a transitive dependency of dbt-adapters and dbt-common, so nothing changes at runtime. Removing the direct declaration only drops a claim this repo does not use.

2. Unpin ty

ty==0.0.64 duplicated a version uv.lock already carries, and every caller reaches ty through uv run --frozen, so the lock is what they resolve either way. Two homes for one number, with nothing keeping them in step.

Relocking records the loosened constraint and holds ty at 0.0.64, so this commit moves no versions. It also drops the sentence above the pre-commit hook claiming ty's version comes from pyproject.toml, which the unpin makes untrue; what remains is the part a reader still needs, namely why the hook passes no filenames.

3. Refresh the lockfile, and match the ruff hook to it

uv lock --upgrade. A second run reports no further changes, so everything is at its current ceiling.

ruff moves 0.15.13 to 0.16.5, so the ruff-pre-commit rev moves from v0.15.20 to v0.16.5 in the same commit. Those two numbers are set by different mechanisms and had already drifted; bumping the rev alongside the lock keeps the hooks, make ruff, make format and a direct uv run ruff on one version, and avoids landing a tree that is mismatched again. Verified: pre-commit's isolated environment and uv run ruff both report 0.16.5.

The two upgrades worth a closer look are mssql-python 1.7.1 to 1.14.0, a driver jump the unit tests cannot exercise, and dbt-core 1.12.0 to 1.12.3.

Supersedes

Five open PRs, each landing at or below what is resolved here:

PR	What it does	Covered by
#808	cryptography 48.0.0 to 50.0.0	lock at 50.0.1
#717	msgpack 1.1.2 to 1.2.1	lock at 1.2.2
#713	pyjwt 2.12.1 to 2.13.0	lock at 2.13.0
#812	ty==0.0.64 to ty==0.0.74	lock at 0.0.75, and the pin is gone
#740	ruff-pre-commit rev: v0.15.20 to v0.16.4	rev set to v0.16.5

Not covered, still needs its own merge: #824, the github-actions group (docker/login-action, astral-sh/setup-uv). Not a Python dependency.

Upgraded (52)

Package	Before	After
annotated-types	0.7.0	0.8.0
asttokens	3.0.1	3.0.2
build	1.5.0	1.6.0
certifi	2026.4.22	2026.7.22
cffi	2.0.0	2.1.1
charset-normalizer	3.4.7	3.5.1
click	8.4.0	8.5.0
coverage	7.14.1	7.15.4
cryptography	48.0.0	50.0.1
dbt-common	1.38.0	1.39.0
dbt-core	1.12.0	1.12.3
dbt-core-experimental-parser	2.0.0a5	2.0.0b2
dbt-protos	1.0.541	1.0.565
distlib	0.4.0	0.4.3
docutils	0.22.4	0.23
filelock	3.29.0	3.32.4
idna	3.15	3.19
importlib-metadata	8.9.0	9.0.1
ipython	9.13.0	9.17.0
jaraco-functools	4.5.0	4.6.0
mashumaro	3.14	3.17
metricflow	0.211.0	0.212.0
msal	1.36.0	1.38.0
msgpack	1.1.2	1.2.2
mssql-python	1.7.1	1.14.0
nh3	0.3.5	0.3.7
packaging	26.2	26.3
platformdirs	4.9.6	4.11.5
pre-commit	4.6.0	4.6.2
prompt-toolkit	3.0.52	3.0.53
pyarrow	25.0.0	25.0.1
pydantic	2.13.4	2.13.5
pydantic-core	2.46.4	2.46.5
pygments	2.20.0	2.21.0
pyjwt	2.12.1	2.13.0
pytest	9.0.3	9.1.1
python-discovery	1.3.1	1.5.3
python-dotenv	1.2.2	1.2.3
pytz	2026.2	2026.3.post1
readme-renderer	44.0	46.0
rpds-py	0.30.0	2026.6.3
ruff	0.15.13	0.16.5
sqlglot	30.13.0	30.17.0
sqlparse	0.5.5	0.6.0
traitlets	5.15.0	5.16.1
twine	6.2.0	7.0.0
ty	0.0.64	0.0.75
typing-extensions	4.15.0	4.16.0
typing-inspection	0.4.2	0.4.4
tzdata	2026.2	2026.3
virtualenv	21.3.3	21.7.6
wcwidth	0.7.0	0.8.2

Added (2)

Package	Version	Why
mssql-python-odbc	18.6.2.1	New runtime dependency of mssql-python
opentelemetry-api	1.44.0	Now required by dbt-common and dbt-core

Removed (7)

Package	Was	Why
bump2version	1.0.1	Only reachable via bumpversion
bumpversion	0.6.0	Removed from the dev group (unused)
cachetools	7.1.3	Only reachable via tox
pyproject-api	1.10.0	Only reachable via tox
pytest-csv	3.0.0	Removed from the dev group (unused)
tomli-w	1.2.0	Only reachable via tox
tox	4.54.0	Removed from the dev group (unused)

Testing

Green on the branch tip, and at each individual commit, rebased on current master:

• pre-commit run -a: all hooks pass, with the new v0.16.5 rev resolving and installing cleanly
• ruff check and ruff format --check: clean under 0.16.5, so no reformatting rides along
• ty check: clean on 0.0.75, including with unused-ignore-comment enabled, so none of the existing # ty: ignore suppressions have gone stale
• make ruff, make format, make ty: all resolve their hook ids and pass
• Unit tests: 500 passed
• uv lock --check: lockfile consistent with pyproject.toml

Draft until the integration matrix runs, in particular the mssql-python rows.