diff --git a/pyproject.toml b/pyproject.toml
index 8134f73f1..577f64bfb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -33,7 +33,7 @@ classifiers = [
 repository = "https://github.com/tableau/server-client-python"
 
 [project.optional-dependencies]
-test = ["black==26.3.1", "build", "mypy==1.4", "pytest>=7.0", "pytest-cov", "pytest-subtests",
+test = ["black==26.3.1", "build", "mypy==2.3.0", "pytest>=7.0", "pytest-cov", "pytest-subtests",
     "pytest-xdist", "requests-mock>=1.0,<2.0", "types-requests>=2.32.4.20250913"]
 
 [tool.setuptools.package-data]
diff --git a/tableauserverclient/helpers/strings.py b/tableauserverclient/helpers/strings.py
index 7a0eaddc7..a095d606e 100644
--- a/tableauserverclient/helpers/strings.py
+++ b/tableauserverclient/helpers/strings.py
@@ -1,6 +1,6 @@
 from defusedxml.ElementTree import fromstring, tostring
 from functools import singledispatch
-from typing import TypeVar, overload
+from typing import TypeVar, cast, overload
 
 # the redact method can handle either strings or bytes, but it can't mix them.
 # Generic type so we can write the actual logic once, then use singledispatch to
@@ -17,8 +17,9 @@ def _redact_any_type(xml: T, sensitive_word: T, replacement: T, encoding=None) -
         matches = root.findall(".//password")
         for item in matches:
             item.text = "********"
-        # tostring returns bytes unless an encoding value is passed
-        return tostring(root, encoding=encoding)
+        # tostring returns bytes unless an encoding value is passed; cast since
+        # the callers pass encoding="unicode" for str and None for bytes
+        return cast(T, tostring(root, encoding=encoding))
     except Exception:
         # something about the xml handling failed. Just cut off the text at the first occurrence of "password"
         location = xml.find(sensitive_word)
@@ -39,7 +40,7 @@ def _(xml: str) -> str:
 
 @redact_xml.register  # type: ignore[no-redef]
 def _(xml: bytes) -> bytes:
-    return _redact_any_type(bytearray(xml), b"password", b"..[redacted]")
+    return cast(bytes, _redact_any_type(xml, b"password", b"..[redacted]"))
 
 
 @overload
diff --git a/test/test_datasource.py b/test/test_datasource.py
index c4bca0a7b..95332c6db 100644
--- a/test/test_datasource.py
+++ b/test/test_datasource.py
@@ -3,6 +3,7 @@
 from pathlib import Path
 import tempfile
 import unittest
+import unittest.mock
 from zipfile import ZipFile
 
 from defusedxml.ElementTree import fromstring