Update dependency ruff to v0.15.21

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ruff (source, changelog)	0.15.20 → 0.15.21

---

Release Notes

astral-sh/ruff (ruff)

v0.15.21

Compare Source

Released on 2026-07-09.

Preview features

• Add --add-ignore for adding ruff:ignore comments (#​26346)
• [flake8-comprehensions] Drop C409 tuple comprehension preview behavior (#​25707)
• Avoid whitespace normalization when formatting comments (#​26455)
• [pyupgrade] Lint and fix use of deprecated abc decorators (UP051) (#​26417)

Bug fixes

• Refine non-empty f-string detection (#​26526)
• Detect syntax errors in individual notebook cells (#​26419)
• [flake8-implicit-str-concat] Fix ISC003 autofix incorrectly stripping + from comments (#​26554)

Rule changes

• [flake8-executable] Mark EXE004 fix as unsafe (#​26033)
• [flake8-pyi] Mark PYI061 fixes as unsafe in Python files (#​26533)
• [pydocstyle] Skip overload-with-docstring in stub files (D418) (#​26318)

Performance

• Avoid per-token source index visitor calls (#​26506)
• Cache parenthesized expression boundaries in the formatter (#​26344)
• Improve performance of rendering edits in preview mode (#​26565)
• Inline fits_element in formatter (#​26429)
• Inline formatter printing hot paths (#​26504)
• Lazily create builtin bindings (#​26510)
• Skip empty trivia scans in the source indexer (#​26507)
• Use ICF for macOS release builds (#​25780)

Formatter

• Add --extend-exclude to ruff format (#​26372)

Documentation

• Add "How does Ruff's import sorting compare to isort?" link to README (#​26530)
• Fix Mozilla Firefox repository link in README (#​26537)
• [flake8-bandit] Fix misleading docstring for mako-templates (S702) (#​26432)
• [ruff] Fix non-triggering example for if-key-in-dict-del (RUF051) (#​26433)

Contributors

• @​EkriirkE
• @​tingerrr
• @​s-rigaud
• @​nikolauspschuetz
• @​Avasam
• @​ntBre
• @​omar-y-abdi
• @​AlexWaygood
• @​sylvestre
• @​shaanmajid
• @​lerebear
• @​baltasarblanco
• @​Sanjays2402
• @​ZedThree
• @​servusdei2018
• @​charliermarsh
• @​jesco-absolute
• @​velikodniy
• @​zaniebot
• @​epage

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header