chore(ci): sync lint.yml pins with dev-tool bump; mypy 3.10 target + py3.9 test leg

Companion to the Dependabot bump (black 26.5.1 / ruff 0.15.21 / mypy 2.3.0):

- lint.yml: sync the pinned installs with pyproject's dev extra
  (TestLintWorkflowPinSync contract - the two surfaces move together).
- pyproject [tool.mypy]: python_version 3.9 -> 3.10. mypy >= 2.2 rejects
  a 3.9 target, so static checking can no longer guard the library floor.
- rust-test.yml: add a single Python 3.9 Linux leg to the gated test
  matrix as the compensating runtime floor guard.
- CHANGELOG: Unreleased entry for the pin bump.

Verified locally with the exact Lint Gate commands: ruff clean, black
clean (229 files unchanged), mypy zero errors under the 3.10 target.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kt38RMkkZkNXKxi4G3QJ83

Author: igerber

.github/workflows/lint.yml

@@ -39,7 +39,7 @@ jobs:
         with:
           python-version: '3.14'
       - name: Install pinned linters (keep in sync with pyproject [dev])
-        run: pip install ruff==0.15.13 black==26.3.1
+        run: pip install ruff==0.15.21 black==26.5.1
       - name: Ruff
         run: ruff check diff_diff tests
       - name: Black
@@ -60,7 +60,7 @@ jobs:
       # The package itself is NOT installed (mypy analyzes source directly;
       # no maturin/Rust build ever enters this workflow).
       - name: Install mypy + runtime deps for their type stubs (pinned)
-        run: pip install mypy==2.1.0 numpy==2.4.5 pandas==3.0.3 scipy==1.17.1
+        run: pip install mypy==2.3.0 numpy==2.4.5 pandas==3.0.3 scipy==1.17.1
       - name: Mypy
         run: mypy diff_diff
 

.github/workflows/rust-test.yml

@@ -124,6 +124,12 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest, ubuntu-24.04-arm]
         python-version: ['3.11', '3.13', '3.14']
+        include:
+          # Python 3.9 floor guard (single Linux leg): mypy >= 2.2 can no
+          # longer type-check with python_version = "3.9", so this runtime
+          # leg is the floor's only continuous CI coverage.
+          - os: ubuntu-latest
+            python-version: '3.9'
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+- **Internal: dev tooling pins bumped** (Dependabot group + manual lint.yml sync):
+  `black==26.5.1`, `ruff==0.15.21`, `mypy==2.3.0` in both the `dev` extra and the
+  Lint CI workflow. mypy >= 2.2 can no longer target Python 3.9, so
+  `[tool.mypy] python_version` moves to `"3.10"` (the library floor stays 3.9);
+  as a compensating floor guard the gated test matrix gains a dedicated
+  Python 3.9 Linux leg.
+
 ## [3.8.0] - 2026-07-18
 
 ### Added

pyproject.toml

@@ -150,7 +150,11 @@ ignore = ["E501"]
 "tests/test_t19_marketing_pulse_drift.py" = ["E741"]
 
 [tool.mypy]
-python_version = "3.9"
+# mypy >= 2.2 cannot target Python 3.9 (python_version must be >= 3.10), so
+# static checking runs against 3.10 even though the library floor stays 3.9.
+# The floor is guarded at runtime instead: the gated test matrix carries a
+# dedicated Python 3.9 leg (.github/workflows/rust-test.yml).
+python_version = "3.10"
 warn_return_any = false
 warn_unused_configs = true
 ignore_missing_imports = true