Dear Maintainer,

mypyc 2.1.0 generates incorrect reference-counting code for some binary
bytes concatenations. In particular, an owned object used as the left
operand of bytes + bytes is not decref'd after the call to
CPyBytes_Concat.

The issue is caused by the bytes + bytes primitive being declared with:

    steals=[True, False]

However, CPyBytes_Concat does not steal or decref either operand. It
allocates and returns a new bytes object. Consequently, the reference-count
pass omits the decref for an owned left operand.

A minimal reproducer is:

    class A:
        def f(self) -> bytes:
            return (1).to_bytes(4, "big") + (2).to_bytes(4, "big")

When compiled with mypyc 2.1.0, repeated calls to this method cause stable
and reproducible memory growth. Chained concatenations also leak
intermediate concatenation results, which amplifies the problem.

Upstream fixed this in the following commit:

https://github.com/python/mypy/commit/db331b44ac2b4ef35b138cd5ecba7731c656ca4c

Upstream issue:

https://github.com/mypyc/mypyc/issues/1192

The functional change consists only of removing the incorrect
steals=[True, False] annotation. The upstream commit also adds deterministic
IR regression tests verifying that the owned intermediate results are
decref'd.

The change applies cleanly to Debian's 2.1.0 package, does not depend on
other mypy 2.2 changes, and does not alter the runtime ABI or the signature
or implementation of CPyBytes_Concat.

This bug currently blocks the upload of python3-slhdsa, tracked as Debian
bug #1143005, because that package uses mypyc and contains a
high-frequency bytes-concatenation path affected by this leak.

There are also real-world upstream projects that naturally exercise the
same pattern:

LL-mtproto uses mypyc to compile protocol serialization code containing
owned and chained bytes concatenations.
mysql-mimic uses mypyc to compile packet and type helpers containing
owned bytes concatenations.

Neither project currently appears to be packaged in Debian, so I mention
them only as evidence that the affected pattern occurs in real mypyc
workloads, not as affected Debian reverse dependencies.

Although the fix is included in upstream mypy 2.2, I could not find a
publicly visible, ready-to-upload Debian packaging update for 2.2. I
therefore request that commit
db331b44ac2b4ef35b138cd5ecba7731c656ca4c be backported to the current
2.1.0 package rather than leaving the reproducible leak unfixed while
waiting for the next upstream-version upload.

I am happy to provide a Salsa merge request or a debdiff containing the
upstream patch and regression tests.

Regards,
Xu Colin.

Hello,

Bug #1143078 in mypy reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/python-team/packages/mypy/-/commit/9d9fd32b1948a22f400356a7be85d90da86bbf43

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1143078

We believe that the bug you reported is fixed in the latest version of
mypy, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143078@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael R. Crusoe <crusoe@debian.org> (supplier of updated mypy package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 14 Aug 2026 18:25:12 +0300
Source: mypy
Architecture: source
Version: 2.2.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Michael R. Crusoe <crusoe@debian.org>
Closes: 1143078
Changes:
 mypy (2.2.0-1) unstable; urgency=medium
 .
   * New upstream release. Closes: #1143078
   * d/rules: skip some more native-parser specific tests.
   * d/control: Bump minimum librt version to 0.12.
Checksums-Sha1:
 16a2a2d3e379f83f4baf7740e5097fc0ca21438e 2907 mypy_2.2.0-1.dsc
 1d6dbf0e657bea95d5287dde6d08205adffec1ec 3950939 mypy_2.2.0.orig.tar.gz
 0bbfbb3ad7fb65a36f52899894ddb4508987f62d 21460 mypy_2.2.0-1.debian.tar.xz
 ea770453451f9b1a473e71955cb80df78f26b04d 11516 mypy_2.2.0-1_source.buildinfo
Checksums-Sha256:
 0babba3082d6d19ae83c5a0876dae8e4aee0553e01a70a6560d7f892abef85f3 2907 mypy_2.2.0-1.dsc
 2cdd99d48590dce6f6b7f1961eda75386364398fcdaad86923bc0f0231bf9baf 3950939 mypy_2.2.0.orig.tar.gz
 bc71ef25d012b50b7e1a6877c8a43557b2cba8513e7c57b6721666adc56c1fc6 21460 mypy_2.2.0-1.debian.tar.xz
 9db88b750cc437d290406ad8f7e8dec2bcf027da5a83eeb77352ee9431125168 11516 mypy_2.2.0-1_source.buildinfo
Files:
 2d5308188c19da65ed7db284355ae833 2907 utils optional mypy_2.2.0-1.dsc
 eac889c7d8c1248b9eb081885d0848e2 3950939 utils optional mypy_2.2.0.orig.tar.gz
 3171ff75e6dcc5681c3e0ee29349b3d6 21460 utils optional mypy_2.2.0-1.debian.tar.xz
 aeb20c38d8638c9781dc95c4156cf234 11516 utils optional mypy_2.2.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEck1gkzcRPHEFUNdHPCZ2P2xn5uIFAmp//MoACgkQPCZ2P2xn
5uLA0BAAvHPxFwoeX6n5mnGBhJ2fkrdl9ThK5+b/U8J0Ri82yQ9q0tyif9gRYCRR
x6gC2P03XEmoh7ApyhSLDvoEq1oXyzntbFAxt7TXRc3p5h+Rp8nCrLzIjyUWW8r8
7vYk/SU6Z+EFZJMfNp0qoiB5Zstq9rRtJlHIdsdFdvKncJptdREoenhdrlr0ySMH
h0jXv0M0egFu1/za43X1WyBr+84/6LcgZEitCa20SdrnSTJj7ck9F7CNOBOQLA4V
sj5k0EpDuGs5id1W3Gt6/vnldueQt0klAYotAqHSDxFLJ+wI5goKZMC4sm5ZemkS
iaZUUoha18ANB5xouHg0xJCu0fXYioJVZJyNKl7SWPfplT9/usCvEHFdH1i+o3b8
wAAbO5TcEKLlXksAAHhcC8NrzO1b+m8I2d/8jhWPXz8dMP/+Y8QjCU/wv1n2Wf0M
AMUs9gRCKG2qyMtSviaWn9rS6a8ei1QgNx5JApA3kW9zFg8TwtmZST0sIbXIzliJ
Gi1KSzmoJO2U4UqU3gmi6KEmKeaW3pu/CQfh5+5IxuDp3qloUppAZ/Hqj69twUjq
O6z+3p5XyZkY5NFBOnpfVEA6Nue34SbeP8X2GB454suIpTb0lo7VIc1oT+VYDJa6
mOsgCHYtlTkTr7J78hAdlxyMIyZsNz6JnnsbWfNSzifoJLItk8k=
=A9N1
-----END PGP SIGNATURE-----