Remove mypy strictness exceptions

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7

.github/workflows/publish.yml

@@ -12,19 +12,19 @@ jobs:
     name: Build distribution
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: "3.14"
     - name: Install pypa/build
       run: python3 -m pip install build --user
     - name: Build a binary wheel and a source tarball
       run: python3 -m build
     - name: Store the distribution packages
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: python-package-distributions
         path: dist/
@@ -41,9 +41,9 @@ jobs:
       id-token: write
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution to PyPI
-      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # 1.14.0
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.github/workflows/test.yml

@@ -28,11 +28,11 @@ jobs:
           toxenv: extra
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
@@ -43,10 +43,10 @@ jobs:
       run: |
         tox -e ${{ matrix.toxenv || 'py' }}
     - name: Upload coverage report
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
     - name: Upload test results
       if: ${{ !cancelled() }}
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
       with:
         report_type: test_results
   check:
@@ -57,11 +57,11 @@ jobs:
         python-version: ["3.14"]
         tox-job: ["pre-commit", "mypy", "docs", "doctest", "twinecheck"]
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.15.17
+  rev: v0.16.9
   hooks:
     - id: ruff-check
       args: [ --fix ]
@@ -10,7 +10,7 @@ repos:
   hooks:
   - id: blacken-docs
     additional_dependencies:
-    - black==26.3.1
+    - black==26.5.1
 - repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v6.0.0
   hooks:
@@ -24,3 +24,8 @@ repos:
   rev: v1.7.12
   hooks:
     - id: actionlint
+- repo: https://github.com/zizmorcore/zizmor-pre-commit
+  rev: v1.30.1
+  hooks:
+    - id: zizmor
+      args: [--no-progress, --fix]

docs/requirements.txt

@@ -1,2 +1,2 @@
-Sphinx==8.2.3
-sphinx-rtd-theme==3.0.2
+Sphinx==9.1.0
+sphinx-rtd-theme==3.1.0

form2request/_base.py

@@ -31,17 +31,17 @@ class FileField:
 
 
 def _parsel_to_lxml(
-    element: HtmlElement | Selector | SelectorList,
+    element: HtmlElement | Selector | SelectorList[Selector],
 ) -> HtmlElement:
     if isinstance(element, SelectorList):
-        return element[0].root
+        return cast("HtmlElement", element[0].root)
     if isinstance(element, Selector):
-        return element.root
+        return cast("HtmlElement", element.root)
     return element
 
 
 def _enctype(
-    form: FormElement, click_element: HtmlElement | None, enctype: None | str
+    form: FormElement, click_element: HtmlElement | None, enctype: str | None
 ) -> str:
     if enctype:
         enctype = enctype.lower()
@@ -77,7 +77,7 @@ def _url(form: FormElement, click_element: HtmlElement | None) -> str:
 
 
 def _method(
-    form: FormElement, click_element: HtmlElement | None, method: None | str
+    form: FormElement, click_element: HtmlElement | None, method: str | None
 ) -> str:
     if method:
         method_src = USER
@@ -106,12 +106,13 @@ def _method(
 
 
 def _click_element(
-    form: FormElement, click: bool | HtmlElement | Selector | SelectorList | None
+    form: FormElement,
+    click: bool | HtmlElement | Selector | SelectorList[Selector] | None,
 ) -> HtmlElement | None:
     if click is False:
         return None
     if click is None or click is True:
-        clickables = list(
+        clickables: list[HtmlElement] = list(
             form.xpath(
                 'descendant::input[re:test(@type, "^(submit|image)$", "i")]'
                 '|descendant::button[not(@type) or re:test(@type, "^submit$", "i")]',
@@ -240,7 +241,7 @@ def to_requests(self, **kwargs: Any) -> requests.PreparedRequest:
         )
         return request.prepare()
 
-    def to_scrapy(self, callback: Callable, **kwargs: Any) -> scrapy.Request:
+    def to_scrapy(self, callback: Callable[..., Any], **kwargs: Any) -> scrapy.Request:
         """Convert the request to :class:`scrapy.Request`.
 
         All *kwargs* are passed to :class:`scrapy.Request` as is.
@@ -258,12 +259,12 @@ def to_scrapy(self, callback: Callable, **kwargs: Any) -> scrapy.Request:
 
 
 def form2request(
-    form: FormElement | Selector | SelectorList,
+    form: FormElement | Selector | SelectorList[Selector],
     data: FormdataType = None,
     *,
-    click: bool | HtmlElement | Selector | SelectorList | None = None,
-    method: None | str = None,
-    enctype: None | str = None,
+    click: bool | HtmlElement | Selector | SelectorList[Selector] | None = None,
+    method: str | None = None,
+    enctype: str | None = None,
 ) -> Request:
     """Return request data for an HTML form submission.
 

pyproject.toml

@@ -67,15 +67,6 @@ exclude_also = [
 
 [tool.mypy]
 strict = true
-allow_any_generics = true
-warn_return_any = false
-
-[[tool.mypy.overrides]]
-module = [
-    "tests.*",
-]
-allow_untyped_defs = true
-check_untyped_defs = true
 
 [tool.ruff.lint]
 extend-select = [

tests/test_conversion.py

@@ -1,3 +1,5 @@
+from typing import Any
+
 import pytest
 
 from form2request import Request
@@ -7,7 +9,7 @@
 requests = pytest.importorskip("requests")
 
 
-def fake_scrapy_callback(self, response):
+def fake_scrapy_callback(self: Any, response: Any) -> None:
     pass
 
 
@@ -138,7 +140,9 @@ def fake_scrapy_callback(self, response):
         ),
     ],
 )
-def test_conversion(request_data, method, kwargs, expected):
+def test_conversion(
+    request_data: Request, method: str, kwargs: dict[str, Any], expected: Any
+) -> None:
     actual = getattr(request_data, f"to_{method}")(**kwargs)
     if method == "poet":
         for field in ("method", "headers", "body"):

tests/test_main.py

@@ -775,7 +775,12 @@ def _parse_multipart(request: Request) -> list[dict[str, Any]]:
         ),
     ],
 )
-def test_form2request(base_url, html, kwargs, expected):
+def test_form2request(
+    base_url: str,
+    html: bytes,
+    kwargs: dict[str, Any],
+    expected: Request | type[Exception],
+) -> None:
     root = fromstring(html, base_url=base_url)
     form = root.xpath("//form")[0]
     click = kwargs.pop("click", None)
@@ -789,15 +794,15 @@ def test_form2request(base_url, html, kwargs, expected):
             form2request(form, click=click, **kwargs)
 
 
-def test_form2request_no_base_url():
+def test_form2request_no_base_url() -> None:
     html = "<form></form>"
     root = fromstring(html)
     form = root.xpath("//form")[0]
     with pytest.raises(ValueError, match="has no base_url set"):
         form2request(form)
 
 
-def test_form2request_parsel():
+def test_form2request_parsel() -> None:
     html = b"""<form><input type="submit" name="foo" value="bar" />
     <input type="submit" name="foo" value="baz" /></form>"""
     selector = Selector(body=html, base_url="https://example.com")
@@ -825,7 +830,7 @@ def _multipart_request(html: bytes, **kwargs: Any) -> Request:
     return form2request(form, **kwargs)
 
 
-def test_multipart_empty_form():
+def test_multipart_empty_form() -> None:
     request = _multipart_request(
         b'<form enctype="multipart/form-data" method="post"></form>'
     )
@@ -836,7 +841,7 @@ def test_multipart_empty_form():
     assert _parse_multipart(request) == []
 
 
-def test_multipart_text_fields():
+def test_multipart_text_fields() -> None:
     request = _multipart_request(
         b"""<form enctype="multipart/form-data" method="post">
         <input name="a" value="hello" />
@@ -860,7 +865,7 @@ def test_multipart_text_fields():
     ]
 
 
-def test_multipart_file_field():
+def test_multipart_file_field() -> None:
     request = _multipart_request(
         b"""<form enctype="multipart/form-data" method="post">
         <input type="file" name="upload" />
@@ -879,7 +884,7 @@ def test_multipart_file_field():
     assert parts[0]["content"] == b"file content"
 
 
-def test_multipart_file_field_default_content_type():
+def test_multipart_file_field_default_content_type() -> None:
     request = _multipart_request(
         b'<form enctype="multipart/form-data" method="post"></form>',
         data={"f": FileField(content=b"\x00\x01\x02", filename="data.bin")},
@@ -889,7 +894,7 @@ def test_multipart_file_field_default_content_type():
     assert parts[0]["content"] == b"\x00\x01\x02"
 
 
-def test_multipart_mixed_fields():
+def test_multipart_mixed_fields() -> None:
     request = _multipart_request(
         b"""<form enctype="multipart/form-data" method="post">
         <input name="note" value="hi" />
@@ -902,7 +907,7 @@ def test_multipart_mixed_fields():
     assert names == {"note", "attachment"}
 
 
-def test_multipart_formenctype_button():
+def test_multipart_formenctype_button() -> None:
     # formenctype="multipart/form-data" on the submit button triggers multipart.
     request = _multipart_request(
         b"""<form enctype="application/x-www-form-urlencoded" method="post">
@@ -917,7 +922,7 @@ def test_multipart_formenctype_button():
     assert parts[0]["content"] == b"y"
 
 
-def test_multipart_formenctype_case_insensitive():
+def test_multipart_formenctype_case_insensitive() -> None:
     request = _multipart_request(
         b"""<form enctype="application/x-www-form-urlencoded" method="post">
         <input type="submit" formenctype="MuLtIpArT/fOrM-dAtA" />
@@ -927,7 +932,7 @@ def test_multipart_formenctype_case_insensitive():
     assert ct.startswith("multipart/form-data; boundary=")
 
 
-def test_multipart_enctype_override():
+def test_multipart_enctype_override() -> None:
     # enctype parameter override to multipart/form-data.
     request = _multipart_request(
         b'<form method="post"><input name="k" value="v" /></form>',

tox.ini

@@ -51,11 +51,11 @@ commands = pre-commit run --all-files --show-diff-on-failure
 
 [testenv:mypy]
 deps =
-    mypy==2.1.0
-    pytest==9.0.3
-    scrapy==2.16.0
+    mypy==2.3.1
+    pytest==9.1.1
+    scrapy==2.19.0
     types-lxml==2026.2.16
-    types-requests==2.33.0.20260518
+    types-requests==2.33.0.20260906
     web-poet==0.24.1
 
 commands = mypy form2request tests
@@ -82,8 +82,8 @@ commands =
 [testenv:twinecheck]
 basepython = python3
 deps =
-    twine==6.2.0
-    build==1.5.0
+    twine==7.0.0
+    build==1.6.1
 commands =
     python -m build --sdist
     twine check dist/*