chore(deps): update dependency pyright to >=1.1.407,<1.1.408

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pyright	>=1.1.406,<1.1.407 -> >=1.1.407,<1.1.408

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

RobertCraigie/pyright-python (pyright)

v1.1.407

Compare Source

---

Configuration

📅 Schedule: Branch creation - "before 2am every weekday" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Claude finished @renovate[bot]'s task —— View job

---

Pyright Dependency Update Review - ⚠️ BLOCKING ISSUES FOUND

Executive Summary

DO NOT MERGE - This PR updates Pyright from 1.1.406 to 1.1.407, which introduces 301 type checking errors due to a known regression in Pyright 1.1.407 (microsoft/pyright#11060).

The comment in pyproject.toml line 160 already warns about this regression, but Renovate updated TO the broken version instead of avoiding it.

---

Critical Findings

🚨 BLOCKING: Type Checking Failures (301 errors)

Location: Multiple GUI files across the SDK
Issue: Pyright 1.1.407 has a regression with dataclass decorators

Reproduction:

uv sync --all-extras
uv run pyright src/aignostics
# Output: 301 errors, 0 warnings, 0 informations

Root Cause:

• The SDK uses NiceGUI's @binding.bindable_dataclass decorator extensively in GUI modules
• This decorator transforms classes into dataclasses with bindable fields
• Pyright 1.1.407 incorrectly flags attribute access as errors (reportAttributeAccessIssue)
• Same regression affects Pydantic dataclasses and similar patterns

Sample Errors:

src/aignostics/application/_gui/_page_application_describe.py:111:16
  Cannot assign to attribute "application_id" for class "DataclassInstance"
  Attribute "application_id" is unknown (reportAttributeAccessIssue)

src/aignostics/dataset/_gui.py:226:39
  Cannot assign to attribute "destination_open_button" for class "DataclassInstance"
  Attribute "destination_open_button" is unknown (reportAttributeAccessIssue)

Affected Files (sample):

• src/aignostics/application/_gui/_page_application_describe.py
• src/aignostics/application/_gui/_page_application_run.py
• src/aignostics/dataset/_gui.py
• src/aignostics/bucket/_gui.py
• All GUI modules using @binding.bindable_dataclass

CI/CD Impact:

• According to CLAUDE.md, dual type checking is enforced (MyPy strict + PyRight basic)
• BOTH type checkers must pass in CI/CD
• make lint includes PyRight check
• This PR will fail the lint stage in CI/CD

---

Upstream Issue Status

Issue: microsoft/pyright#11060

• Type: Regression in 1.1.407
• Status: ✅ Fixed in upstream (PR #11084 merged)
• Fix Available: Will be in Pyright 1.1.408 or later
• Timeline: Fix committed November 2, 2025

---

Recommendations

✅ Recommended Action: Close this PR and wait for 1.1.408

# Keep current constraint until fix is released
"pyright>=1.1.406,<1.1.407", # Regression in 1.1.407, see https://github.com/microsoft/pyright/issues/11060

Alternative: Pin to 1.1.406

# Explicit pin if needed
"pyright==1.1.406",

When Pyright 1.1.408+ is available:

# Update constraint to include fixed version
"pyright>=1.1.408,<1.1.409", # Regression in 1.1.407 fixed in 1.1.408

---

Review Checklist

• ✅ Read changed files (pyproject.toml, uv.lock)
• ✅ Review pyrightconfig.json for compatibility
• ✅ Check CLAUDE.md guidance on type checking (dual checking enforced)
• ⚠️ CI/CD will fail (type checking is blocking)
• ⚠️ Local type checking fails with 301 errors
• ✅ Upstream issue confirmed and fixed

---

Testing Performed

# Environment setup
uv sync --all-extras

# Verify pyright version
uv run pyright --version
# Output: pyright 1.1.407

# Run type checking
uv run pyright src/aignostics
# Result: 301 errors, 0 warnings, 0 informations

# All errors are reportAttributeAccessIssue for bindable_dataclass decorated classes

---

Additional Context

Why the comment exists: The comment in line 160 was added precisely to prevent updating to 1.1.407:

"pyright>=1.1.406,<1.1.407", # Regression in 1.1.407, see https://github.com/microsoft/pyright/issues/11060

Renovate behavior: Renovate updated the version constraint but kept the warning comment, which creates a contradictory state.

Medical Device Impact: This is medical device software (computational pathology SDK). Type checking is critical for safety and compliance. Merging broken type checking would compromise:

• Code quality gates
• Pre-commit hooks
• CI/CD pipeline integrity
• Regulatory compliance workflows

---

Conclusion

❌ REJECT THIS PR

This dependency update introduces a known regression that breaks type checking across all GUI modules. Wait for Pyright 1.1.408 or later which includes the fix for microsoft/pyright#11060.

Next Steps:

1. Close this PR
2. Update Renovate configuration to skip 1.1.407 if not already configured
3. Wait for Renovate to create a new PR for Pyright >=1.1.408
4. The fix is already merged upstream, so 1.1.408 should be available soon

---