Skip to content

Update dependency ruff to v0.16.4 - #40

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ruff-0.x-lockfile
Open

Update dependency ruff to v0.16.4#40
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ruff-0.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
ruff (source, changelog) 0.15.22 → 0.16.4 age confidence

Release Notes

astral-sh/ruff (ruff)

v0.16.4

Compare Source

Released on 2026-08-20.

Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#​26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#​27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#​27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#​27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#​27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#​27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#​27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#​27753)
  • [syntax-errors] Detect duplicate keyword arguments (#​17804)
  • [syntax-errors] Detect parameters declared nonlocal (#​27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#​27807)
  • Support pull diagnostics for notebook cells (#​27779)
Documentation
  • Add default indicator to rules table (#​27724)
  • Fix broken link to Python docs (#​27757)
Other changes
  • Fix s390x stacker assembly in release builds (#​27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#​25464)
  • Reduce configuration deserialization code size (#​27924)
  • Check packed AST index bounds (#​27849)
Contributors

v0.16.3

Compare Source

Released on 2026-08-13.

Preview features
  • [pylint] Fix false negatives on negative numbers (PLR6104) (#​27251)
  • [pyupgrade] Add rule to replace while 1 with while True (UP048) (#​27190)
Bug fixes
  • [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#​27687)
  • [pylint] Allow continue in finally on Python 3.8 (#​27626)
  • [pylint] Fix PLE1307 false positive with bools (#​27651)
  • [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#​27560)
  • [pylint] Improve handling of concatenated strings (PLE1300) (#​27659)
Rule changes
  • [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#​27527)
Performance
  • Enable PGO for Linux x86-64 Ruff releases (#​27570)
  • Enable PGO for Linux ARM64 Ruff releases (#​27574)
  • Enable PGO for Windows x86-64 Ruff releases (#​27573)
  • Enable PGO for macOS ARM64 Ruff releases (#​27572)
  • Reduce Expr size to 64 bytes (#​27591)
CLI
  • Hyperlink rule codes in ruff check --statistics output (#​27646)
Documentation
  • [ruff] Also suggest asyncio.TaskGroup (RUF006) (#​27461)
Other changes
Contributors

v0.16.2

Compare Source

Released on 2026-08-06.

Bug fixes
  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#​27335)
Server
  • Register formatting capabilities dynamically to exclude TOML files (#​27332)
Contributors

v0.16.1

Compare Source

Released on 2026-07-30.

Preview features
  • Add an option to opt out of human-readable names (#​27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#​27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#​27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#​26959)
Bug fixes
  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#​27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#​27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#​26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#​25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#​23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#​27192)
Rule changes
  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#​26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#​27200)
Server
  • Fix indexing of excluded nested Ruff workspaces (#​27303)
  • Lint TOML files in the LSP (#​26862)
Documentation
  • Cover pycon Markdown formatting (#​27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#​27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#​27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#​27250)
Other changes
  • Reduce syntax error noise by swallowing dedents like indents (#​27170)
  • Vendor latest annotate-snippets (#​27033)
Contributors

v0.16.0

Compare Source

Released on 2026-07-23.

Check out the blog post for a migration
guide and overview of the changes!

Breaking changes

  • Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for
    more details and the new Default Rules page for a
    full listing of the enabled rules.

  • Ruff can now format Python code blocks in Markdown files and will do this by default. See the
    documentation for more details.

  • Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

    import math  # ruff: ignore[F401]

# ruff: ignore[F401]
import os

  • Fixes are now shown in check and format --check output:

    ❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |

1 file would be reformatted

    This example also shows off the Markdown formatting.

  • format --check now supports the same output formats as the linter, including the github and
    gitlab outputs for rendering annotations in CI:

    ❯ ruff format --check --output-format github .
::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

    See the CLI help or documentation for the
    full list of supported formats.

  • The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location
    fields in the JSON output format may now be null rather than defaulting to the empty string and
    row 1, column 1, respectively.

Stabilization

The following rules have been stabilized and are no longer in preview:

The following behaviors have been stabilized:

Preview features
  • [pyupgrade] Fix false positive with TypeVar default before Python 3.13 (UP040) (#​26888)
Bug fixes
  • [ruff] Fix missing check on unrecognized early bound (RUF016) (#​26986)
Rule changes
  • Insert a space after the colon in Ruff suppression comments (#​27123)
Performance
  • [pyupgrade] Speed up unnecessary-future-import (UP010) (#​27047)
Documentation
  • [ruff] Add missing period in "Why is this bad?" section (RUF200) (#​26930)
  • [flake8-simplify] Clarify os.environ behavior on Windows (SIM112) (#​26972)
  • [pydocstyle] Document fix safety (D400) (#​26971)
Contributors

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Trivy Security Scan

Python

Severity Package Installed Fixed CVE Title
🟠 HIGH cryptography 48.0.1 50.0.0 CVE-2026-69247 cryptography is a package designed to expose cryptographic primitives ...
🟠 HIGH cryptography 48.0.1 49.0.0 CVE-2026-69249 python-cryptography is a package designed to expose cryptographic prim ...
🟠 HIGH msgpack 1.1.2 1.2.1 GHSA-6v7p-g79w-8964 MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

cnb/lifecycle/launcher

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib v1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib v1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

@renovate
renovate Bot force-pushed the renovate/ruff-0.x-lockfile branch from 52fd450 to 4d4d320 Compare July 30, 2026 21:33
@renovate renovate Bot changed the title Update dependency ruff to v0.16.0 Update dependency ruff to v0.16.1 Jul 30, 2026
@renovate
renovate Bot force-pushed the renovate/ruff-0.x-lockfile branch from 4d4d320 to 475fc97 Compare August 7, 2026 14:37
@renovate renovate Bot changed the title Update dependency ruff to v0.16.1 Update dependency ruff to v0.16.2 Aug 7, 2026
@renovate
renovate Bot force-pushed the renovate/ruff-0.x-lockfile branch 3 times, most recently from 4d4bd14 to 2d5ed20 Compare August 13, 2026 17:58
@renovate renovate Bot changed the title Update dependency ruff to v0.16.2 Update dependency ruff to v0.16.3 Aug 13, 2026
@renovate
renovate Bot force-pushed the renovate/ruff-0.x-lockfile branch from 2d5ed20 to 19e816d Compare August 14, 2026 09:09
@renovate
renovate Bot force-pushed the renovate/ruff-0.x-lockfile branch from 19e816d to 20bbe89 Compare August 20, 2026 20:00
@renovate renovate Bot changed the title Update dependency ruff to v0.16.3 Update dependency ruff to v0.16.4 Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants