Update dependency ruff to v0.16.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ruff (source, changelog)	0.16.3 → 0.16.4

---

Release Notes

astral-sh/ruff (ruff)

v0.16.4

Compare Source

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#​26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#​27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#​27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#​27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#​27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#​27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#​27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#​27753)
• [syntax-errors] Detect duplicate keyword arguments (#​17804)
• [syntax-errors] Detect parameters declared nonlocal (#​27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#​27807)
• Support pull diagnostics for notebook cells (#​27779)

Documentation

• Add default indicator to rules table (#​27724)
• Fix broken link to Python docs (#​27757)

Other changes

• Fix s390x stacker assembly in release builds (#​27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#​25464)
• Reduce configuration deserialization code size (#​27924)
• Check packed AST index bounds (#​27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot
• @​ewdurbin
• @​woodruffw
• @​Sacrimento
• @​lakshayxi
• @​WhiteFox0-0
• @​baltasarblanco

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-33818	encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-39821	golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH	stdlib	v1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39836	net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH	stdlib	v1.26.2	1.26.6, 1.27.0-rc.3	CVE-2026-46600	golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56853	net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56858	html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56859	encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56860	net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56862	crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-33818	encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-39821	golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH	stdlib	1.26.2	1.26.6, 1.27.0-rc.3	CVE-2026-46600	golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56853	net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56858	html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56859	encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56860	net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56862	crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-33818	encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-39821	golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH	stdlib	1.26.2	1.26.6, 1.27.0-rc.3	CVE-2026-46600	golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56853	net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56858	html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56859	encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56860	net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56862	crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages