Update dependency ruff to v0.15.22

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ruff (source, changelog)	0.15.21 → 0.15.22

---

Release Notes

astral-sh/ruff (ruff)

v0.15.22

Compare Source

Released on 2026-07-16.

Preview features

• [pycodestyle] Add an autofix for E402 (#​22212)
• [refurb] Allow subclassing builtins in stub files (FURB189) (#​26812)
• [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#​26423)
• [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#​26682)
• [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#​26772)

Bug fixes

• [flake8-pyi] Fix false positive in __all__ (PYI053) (#​26872)

Rule changes

• [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#​25733)

Performance

• Avoid redundant lexer token bookkeeping (#​26765)
• Avoid redundant pending-indentation writes (#​26774)
• Avoid unnecessary identifier lookahead (#​26525)
• Reuse parser scratch buffers (#​26798)

Documentation

• Document argfile support (#​26803)
• [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#​26658)
• [pycodestyle] Document E731 fix safety (#​26847)
• [ruff] Clarify intentional async contexts for unused-async (RUF029) (#​26641)

Contributors

• @​dwego
• @​MichaReiser
• @​Joosboy
• @​KaufmanDmitriy
• @​PeterJCLaw
• @​ntBre
• @​charliermarsh

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	v1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header