@@ -48,6 +48,7 @@ repos:
     rev: 451b56af716f9f0d0c2b816503a3fd0cf8b036fa # frozen: v1.29.0
     hooks:
       - id: zizmor
+        args: [--no-progress, --fix]
 
 ci:
   autofix_commit_msg: "[pre-commit.ci] auto fixes from pre-commit.com hooks"
 
@@ -36,7 +36,14 @@
 from packaging.specifiers import Specifier
 from termcolor import colored
 
-from ts_utils.metadata import ObsoleteMetadata, StubMetadata, read_metadata, update_metadata
+from ts_utils.metadata import (
+    ObsoleteMetadata,
+    StubMetadata,
+    StubtestSettings,
+    read_metadata,
+    read_stubtest_settings,
+    update_metadata,
+)
 from ts_utils.paths import PYRIGHT_CONFIG, STUBS_PATH, distribution_path
 from ts_utils.stubs import third_party_stubs
 
@@ -772,36 +779,41 @@ async def update_pull_request_label(*, pr_number: int, session: aiohttp.ClientSe
         response.raise_for_status()
 
 
+def remote_branch_exists(branch: str) -> bool:
+    return (
+        subprocess.run(["git", "show-ref", "--verify", "--quiet", f"refs/remotes/origin/{branch}"], check=False).returncode == 0
+    )
+
+
 def has_non_stubsabot_commits(branch: str) -> bool:
     assert not branch.startswith("origin/")
-    try:
-        # commits on origin/branch that are not on branch or are
-        # patch equivalent to a commit on branch
-        output = subprocess.check_output(
-            ["git", "log", "--right-only", "--pretty=%an", "--cherry-pick", f"{branch}...origin/{branch}"],
-            stderr=subprocess.DEVNULL,
-        )
-        return bool(set(output.splitlines()) - {b"stubsabot"})
-    except subprocess.CalledProcessError:
-        # origin/branch does not exist
+
+    if not remote_branch_exists(branch):
         return False
 
+    # commits on origin/branch that are not on branch or are
+    # patch equivalent to a commit on branch
+    output = subprocess.check_output(
+        ["git", "log", "--right-only", "--pretty=%an", "--cherry-pick", f"{branch}...origin/{branch}"], stderr=subprocess.DEVNULL
+    )
+    return bool(set(output.splitlines()) - {b"stubsabot"})
+
 
 def latest_commit_is_different_to_last_commit_on_origin(branch: str) -> bool:
     assert not branch.startswith("origin/")
-    try:
-        # https://www.git-scm.com/docs/git-range-diff
-        # If the number of lines is >1,
-        # it indicates that something about our commit is different to the last commit
-        # (Could be the commit "content", or the commit message).
-        commit_comparison = subprocess.run(
-            ["git", "range-diff", f"origin/{branch}~1..origin/{branch}", "HEAD~1..HEAD"], check=True, capture_output=True
-        )
-        return len(commit_comparison.stdout.splitlines()) > 1
-    except subprocess.CalledProcessError:
-        # origin/branch does not exist
+
+    if not remote_branch_exists(branch):
         return True
 
+    # https://www.git-scm.com/docs/git-range-diff
+    # If the number of lines is >1,
+    # it indicates that something about our commit is different to the last commit
+    # (Could be the commit "content", or the commit message).
+    commit_comparison = subprocess.run(
+        ["git", "range-diff", f"origin/{branch}~1..origin/{branch}", "HEAD~1..HEAD"], check=True, capture_output=True
+    )
+    return len(commit_comparison.stdout.splitlines()) > 1
+
 
 class RemoteConflictError(Exception):
     pass
@@ -810,7 +822,12 @@ class RemoteConflictError(Exception):
 def somewhat_safe_force_push(branch: str) -> None:
     if has_non_stubsabot_commits(branch):
         raise RemoteConflictError(f"origin/{branch} has non-stubsabot changes that are not on {branch}!")
-    subprocess.check_call(["git", "push", "origin", branch, "--force"])
+    result = subprocess.run(["git", "push", "--quiet", "origin", branch, "--force"], text=True, capture_output=True, check=False)
+    if result.returncode:
+        # Capture both streams to suppress stderr on success without losing it on failure
+        sys.stdout.write(result.stdout)
+        sys.stderr.write(result.stderr)
+        result.check_returncode()
 
 
 def normalize(name: str) -> str:
@@ -824,15 +841,13 @@ def normalize(name: str) -> str:
 BRANCH_PREFIX = "stubsabot"
 
 
-def get_update_pr_body(update: Update, metadata: Mapping[str, Any]) -> str:
+def get_update_pr_body(update: Update, settings: StubtestSettings) -> str:
     body = "\n".join(f"{k}: {v}" for k, v in update.links.items())
 
     if update.diff_analysis is not None:
         body += f"\n\n{update.diff_analysis}"
 
-    stubtest_settings: dict[str, Any] = metadata.get("tool", {}).get("stubtest", {})
-    stubtest_will_run = not stubtest_settings.get("skip", False)
-    if stubtest_will_run:
+    if not settings.skip:
         body += textwrap.dedent("""
 
             If stubtest fails for this PR:
@@ -866,66 +881,55 @@ def remove_stubs(distribution: str) -> None:
         f.writelines(lines)
 
 
-async def suggest_typeshed_update(update: Update, session: aiohttp.ClientSession, action_level: ActionLevel) -> None:
+def get_commit_message(action: Update | Obsolete | Remove) -> tuple[str, str]:
+    """Return git commit message title and body."""
+    match action:
+        case Update():
+            stubtest_settings = read_stubtest_settings(action.distribution)
+            return (
+                f"[stubsabot] Bump {action.distribution} to {action.new_version}",
+                get_update_pr_body(action, stubtest_settings),
+            )
+        case Obsolete():
+            return (
+                f"[stubsabot] Mark {action.distribution} as obsolete since {action.obsolete_since_version}",
+                "\n".join(f"{k}: {v}" for k, v in action.links.items()),
+            )
+        case Remove():
+            return (
+                f"[stubsabot] Remove {action.distribution} as {action.reason}",
+                "\n".join(f"{k}: {v}" for k, v in action.links.items()),
+            )
+
+
+def run_action(action: Update | Obsolete | Remove) -> None:
+    match action:
+        case Update():
+            update_metadata(action.distribution, version=action.new_version)
+        case Obsolete():
+            obsolete_t = cast(dict[str, object], tomlkit.inline_table())
+            obsolete_t.update({"version": action.obsolete_since_version, "date": action.obsolete_since_date.date().isoformat()})
+            update_metadata(action.distribution, obsolete_since=obsolete_t)
+        case Remove():
+            remove_stubs(action.distribution)
+
+
+async def process_typeshed_change(
+    action: Update | Obsolete | Remove, session: aiohttp.ClientSession, action_level: ActionLevel
+) -> None:
     if action_level <= ActionLevel.nothing:
         return
-    title = f"[stubsabot] Bump {update.distribution} to {update.new_version}"
-    async with _repo_lock:
-        branch_name = f"{BRANCH_PREFIX}/{normalize(update.distribution)}"
-        subprocess.check_call(["git", "checkout", "-B", branch_name, "origin/main"])
-        meta = update_metadata(update.distribution, version=update.new_version)
-        body = get_update_pr_body(update, meta)
-        subprocess.check_call(["git", "commit", "--all", "-m", f"{title}\n\n{body}"])
-        if action_level <= ActionLevel.local:
-            return
-        if not latest_commit_is_different_to_last_commit_on_origin(branch_name):
-            print(f"No pushing to origin required: origin/{branch_name} exists and requires no changes!")
-            return
-        somewhat_safe_force_push(branch_name)
-        if action_level <= ActionLevel.fork:
-            return
 
-    await create_or_update_pull_request(title=title, body=body, branch_name=branch_name, session=session)
-
-
-async def suggest_typeshed_obsolete(obsolete: Obsolete, session: aiohttp.ClientSession, action_level: ActionLevel) -> None:
-    if action_level <= ActionLevel.nothing:
-        return
-    title = f"[stubsabot] Mark {obsolete.distribution} as obsolete since {obsolete.obsolete_since_version}"
-    async with _repo_lock:
-        branch_name = f"{BRANCH_PREFIX}/{normalize(obsolete.distribution)}"
-        subprocess.check_call(["git", "checkout", "-B", branch_name, "origin/main"])
-        obsolete_t = cast(dict[str, object], tomlkit.inline_table())
-        obsolete_t.update({"version": obsolete.obsolete_since_version, "date": obsolete.obsolete_since_date.date().isoformat()})
-        update_metadata(obsolete.distribution, obsolete_since=obsolete_t)
-        body = "\n".join(f"{k}: {v}" for k, v in obsolete.links.items())
-        subprocess.check_call(["git", "commit", "--all", "-m", f"{title}\n\n{body}"])
-        if action_level <= ActionLevel.local:
-            return
-        if not latest_commit_is_different_to_last_commit_on_origin(branch_name):
-            print(f"No PR required: origin/{branch_name} exists and requires no changes!")
-            return
-        somewhat_safe_force_push(branch_name)
-        if action_level <= ActionLevel.fork:
-            return
-
-    await create_or_update_pull_request(title=title, body=body, branch_name=branch_name, session=session)
-
-
-async def suggest_typeshed_remove(remove: Remove, session: aiohttp.ClientSession, action_level: ActionLevel) -> None:
-    if action_level <= ActionLevel.nothing:
-        return
-    title = f"[stubsabot] Remove {remove.distribution} as {remove.reason}"
     async with _repo_lock:
-        branch_name = f"{BRANCH_PREFIX}/{normalize(remove.distribution)}"
-        subprocess.check_call(["git", "checkout", "-B", branch_name, "origin/main"])
-        remove_stubs(remove.distribution)
-        body = "\n".join(f"{k}: {v}" for k, v in remove.links.items())
-        subprocess.check_call(["git", "commit", "--all", "-m", f"{title}\n\n{body}"])
+        branch_name = f"{BRANCH_PREFIX}/{normalize(action.distribution)}"
+        subprocess.check_call(["git", "checkout", "--quiet", "-B", branch_name, "origin/main"])
+        run_action(action)
+        title, body = get_commit_message(action)
+        subprocess.check_call(["git", "commit", "--quiet", "--all", "-m", f"{title}\n\n{body}"])
         if action_level <= ActionLevel.local:
             return
         if not latest_commit_is_different_to_last_commit_on_origin(branch_name):
-            print(f"No pushing to origin required: origin/{branch_name} exists and requires no changes!")
+            print(f"No pushing to origin required: 'origin/{branch_name}' exists and requires no changes!")
             return
         somewhat_safe_force_push(branch_name)
         if action_level <= ActionLevel.fork:
@@ -995,13 +999,13 @@ async def main() -> int:
 
             action_count = 0
             for task in asyncio.as_completed(tasks):
-                update = await task
-                print(f"{update.distribution}... ", end="")
-                print(update)
+                action = await task
+                print(f"{action.distribution}... ", end="")
+                print(action)
 
-                if isinstance(update, NoUpdate):
+                if isinstance(action, NoUpdate):
                     continue
-                if isinstance(update, Error):
+                if isinstance(action, Error):
                     error = True
                     continue
 
@@ -1011,16 +1015,8 @@ async def main() -> int:
                 action_count += 1
 
                 try:
-                    if isinstance(update, Update):
-                        await suggest_typeshed_update(update, session, action_level=args.action_level)
-                        continue
-                    if isinstance(update, Obsolete):
-                        await suggest_typeshed_obsolete(update, session, action_level=args.action_level)
-                        continue
-                    # Redundant, but keeping for extra runtime validation
-                    if isinstance(update, Remove):  # pyright: ignore[reportUnnecessaryIsInstance]
-                        await suggest_typeshed_remove(update, session, action_level=args.action_level)
-                        continue
+                    await process_typeshed_change(action, session, action_level=args.action_level)
+                    continue
                 except RemoteConflictError as e:
                     print(colored(f"... but ran into {type(e).__qualname__}: {e}", "red"))
                     continue
@@ -1029,7 +1025,7 @@ async def main() -> int:
         # if you need to cleanup, try:
         # git branch -D $(git branch --list 'stubsabot/*')
         if args.action_level >= ActionLevel.local and original_branch:
-            subprocess.check_call(["git", "checkout", original_branch])
+            subprocess.check_call(["git", "checkout", "--quiet", original_branch])
 
     return 1 if error else 0
 
 
@@ -3,12 +3,9 @@
 # ============================================
 
 _frozen_importlib_external.PathFinder.discover
-_frozen_importlib_external.SourceFileLoader.source_to_code
-_frozen_importlib_external.SourceLoader.source_to_code
 dataclasses.MISSING
 dataclasses._MISSING_TYPE
 dataclasses.field
-mailbox._ProxyFile.__class_getitem__
 
 # =============================================================
 # Allowlist entries that cannot or should not be fixed; >= 3.15
 
@@ -101,9 +101,24 @@ class SourceLoader(_LoaderBasics):
     def set_data(self, path: str, data: bytes) -> None: ...
     def get_source(self, fullname: str) -> str | None: ...
     def path_stats(self, path: str) -> Mapping[str, Any]: ...
-    def source_to_code(
-        self, data: ReadableBuffer | str | _ast.Module | _ast.Expression | _ast.Interactive, path: bytes | StrPath
-    ) -> types.CodeType: ...
+    if sys.version_info >= (3, 15):
+        def source_to_code(
+            self,
+            data: ReadableBuffer | str | _ast.Module | _ast.Expression | _ast.Interactive,
+            path: bytes | StrPath,
+            fullname: str | None = None,
+            *,
+            _optimize: int = -1,
+        ) -> types.CodeType: ...
+    else:
+        def source_to_code(
+            self,
+            data: ReadableBuffer | str | _ast.Module | _ast.Expression | _ast.Interactive,
+            path: bytes | StrPath,
+            *,
+            _optimize: int = -1,
+        ) -> types.CodeType: ...
+
     def get_code(self, fullname: str) -> types.CodeType | None: ...
 
 class FileLoader:
@@ -120,13 +135,6 @@ class FileLoader:
 class SourceFileLoader(importlib.abc.FileLoader, FileLoader, importlib.abc.SourceLoader, SourceLoader):  # type: ignore[misc]  # incompatible method arguments in base classes
     def set_data(self, path: str, data: ReadableBuffer, *, _mode: int = 0o666) -> None: ...
     def path_stats(self, path: str) -> Mapping[str, Any]: ...
-    def source_to_code(  # type: ignore[override]  # incompatible with InspectLoader.source_to_code
-        self,
-        data: ReadableBuffer | str | _ast.Module | _ast.Expression | _ast.Interactive,
-        path: bytes | StrPath,
-        *,
-        _optimize: int = -1,
-    ) -> types.CodeType: ...
 
 class SourcelessFileLoader(importlib.abc.FileLoader, FileLoader, _LoaderBasics):
     def get_code(self, fullname: str) -> types.CodeType | None: ...
 
@@ -223,7 +223,7 @@ class ArgumentParser(_AttributeHolder, _ActionsContainer):
         title: str = "subcommands",
         description: str | None = None,
         prog: str | None = None,
-        action: type[Action] = ...,
+        action: str | type[Action] = ...,
         option_string: str = ...,
         dest: str | None = None,
         required: bool = False,
@@ -238,7 +238,7 @@ class ArgumentParser(_AttributeHolder, _ActionsContainer):
         description: str | None = None,
         prog: str | None = None,
         parser_class: type[_ArgumentParserT],
-        action: type[Action] = ...,
+        action: str | type[Action] = ...,
         option_string: str = ...,
         dest: str | None = None,
         required: bool = False,
 
@@ -334,6 +334,7 @@ class RawConfigParser(_Parser):
     def items(self, section: _SectionName, raw: bool = False, vars: _Section | None = None) -> list[tuple[str, str]]: ...
 
     def values(self) -> ValuesView[SectionProxy]: ...
+    def popitem(self) -> tuple[str, SectionProxy]: ...
     def set(self, section: _SectionName, option: str, value: str | None = None) -> None: ...
     def write(self, fp: SupportsWrite[str], space_around_delimiters: bool = True) -> None: ...
     def remove_option(self, section: _SectionName, option: str) -> bool: ...
 
@@ -294,7 +294,8 @@ class _ProxyFile:
     def flush(self) -> None: ...
     @property
     def closed(self) -> bool: ...
-    def __class_getitem__(cls, item: Any, /) -> GenericAlias: ...
+    if sys.version_info < (3, 15):
+        def __class_getitem__(cls, item: Any, /) -> GenericAlias: ...
 
 class _PartialFile(_ProxyFile):
     def __init__(self, f: _GetFileReturn, start: int | None = None, stop: int | None = None) -> None: ...
 
@@ -49,6 +49,5 @@ authlib.integrations.flask_client.*
 authlib.integrations.flask_oauth1.*
 authlib.integrations.flask_oauth2.*
 authlib.integrations.httpx_client.*
-authlib.integrations.requests_client.*
 authlib.integrations.sqla_oauth2.*
 authlib.integrations.starlette_client.*
@@ -1,3 +1,4 @@
 version = "1.7.2"
 upstream-repository = "https://github.com/authlib/authlib"
 dependencies = ["cryptography"]
+optional-dependencies = ["requests"]
@@ -1,6 +1,7 @@
 # test code does not need type hints
 jwcrypto.tests
 jwcrypto.tests-cookbook
+jwcrypto.tests_mldsa
 
 # even if the deprecated decorator is applied, the attribute is not present
 jwcrypto.jwt.JWTMissingKeyID.__deprecated__