Skip to content

Update dependency ruff to v0.16.1 - #46

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/ruff-0.x-lockfile
Jul 31, 2026
Merged

Update dependency ruff to v0.16.1#46
renovate[bot] merged 1 commit into
mainfrom
renovate/ruff-0.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
ruff (source, changelog) 0.16.00.16.1 age confidence

Release Notes

astral-sh/ruff (ruff)

v0.16.1

Compare Source

Released on 2026-07-30.

Preview features
  • Add an option to opt out of human-readable names (#​27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#​27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#​27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#​26959)
Bug fixes
  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#​27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#​27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#​26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#​25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#​23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#​27192)
Rule changes
  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#​26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#​27200)
Server
  • Fix indexing of excluded nested Ruff workspaces (#​27303)
  • Lint TOML files in the LSP (#​26862)
Documentation
  • Cover pycon Markdown formatting (#​27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#​27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#​27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#​27250)
Other changes
  • Reduce syntax error noise by swallowing dedents like indents (#​27170)
  • Vendor latest annotate-snippets (#​27033)
Contributors

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

Copy link
Copy Markdown

Trivy Security Scan

cnb/lifecycle/launcher

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib v1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39836 ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

@renovate
renovate Bot merged commit f3e6e15 into main Jul 31, 2026
7 checks passed
@renovate
renovate Bot deleted the renovate/ruff-0.x-lockfile branch July 31, 2026 02:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants