Skip to content

Update dependency ruff to v0.16.1 - #36

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ruff-0.x-lockfile
Open

Update dependency ruff to v0.16.1#36
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ruff-0.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
ruff (source, changelog) 0.15.22 → 0.16.1 age confidence

Release Notes

astral-sh/ruff (ruff)

v0.16.1

Compare Source

Released on 2026-07-30.

Preview features
  • Add an option to opt out of human-readable names (#​27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#​27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#​27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#​26959)
Bug fixes
  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#​27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#​27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#​26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#​25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#​23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#​27192)
Rule changes
  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#​26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#​27200)
Server
  • Fix indexing of excluded nested Ruff workspaces (#​27303)
  • Lint TOML files in the LSP (#​26862)
Documentation
  • Cover pycon Markdown formatting (#​27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#​27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#​27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#​27250)
Other changes
  • Reduce syntax error noise by swallowing dedents like indents (#​27170)
  • Vendor latest annotate-snippets (#​27033)
Contributors

v0.16.0

Compare Source

Released on 2026-07-23.

Check out the blog post for a migration
guide and overview of the changes!

Breaking changes

  • Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for
    more details and the new Default Rules page for a
    full listing of the enabled rules.

  • Ruff can now format Python code blocks in Markdown files and will do this by default. See the
    documentation for more details.

  • Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

    import math  # ruff: ignore[F401]

# ruff: ignore[F401]
import os

  • Fixes are now shown in check and format --check output:

    ❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |

1 file would be reformatted

    This example also shows off the Markdown formatting.

  • format --check now supports the same output formats as the linter, including the github and
    gitlab outputs for rendering annotations in CI:

    ❯ ruff format --check --output-format github .
::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

    See the CLI help or documentation for the
    full list of supported formats.

  • The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location
    fields in the JSON output format may now be null rather than defaulting to the empty string and
    row 1, column 1, respectively.

Stabilization

The following rules have been stabilized and are no longer in preview:

The following behaviors have been stabilized:

Preview features
  • [pyupgrade] Fix false positive with TypeVar default before Python 3.13 (UP040) (#​26888)
Bug fixes
  • [ruff] Fix missing check on unrecognized early bound (RUF016) (#​26986)
Rule changes
  • Insert a space after the colon in Ruff suppression comments (#​27123)
Performance
  • [pyupgrade] Speed up unnecessary-future-import (UP010) (#​27047)
Documentation
  • [ruff] Add missing period in "Why is this bad?" section (RUF200) (#​26930)
  • [flake8-simplify] Clarify os.environ behavior on Windows (SIM112) (#​26972)
  • [pydocstyle] Document fix safety (D400) (#​26971)
Contributors

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Trivy Security Scan

cnb/lifecycle/launcher

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib v1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39836 ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

workspace/pushgateway

Severity Package Installed Fixed CVE Title
🟠 HIGH github.com/prometheus/prometheus v0.302.1 0.311.3 CVE-2026-42151 github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
🟠 HIGH github.com/prometheus/prometheus v0.302.1 0.311.3, 0.305.2 CVE-2026-42154 github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint
🟠 HIGH golang.org/x/crypto v0.35.0 0.43.0 CVE-2025-47913 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS
🟠 HIGH golang.org/x/crypto v0.35.0 0.52.0 CVE-2026-39828 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
🟠 HIGH golang.org/x/crypto v0.35.0 0.52.0 CVE-2026-39829 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
🟠 HIGH golang.org/x/crypto v0.35.0 0.52.0 CVE-2026-39830 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
🟠 HIGH golang.org/x/crypto v0.35.0 0.52.0 CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
🟠 HIGH golang.org/x/crypto v0.35.0 0.52.0 CVE-2026-39832 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
🟠 HIGH golang.org/x/crypto v0.35.0 0.52.0 CVE-2026-39835 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
🟠 HIGH golang.org/x/crypto v0.35.0 0.52.0 CVE-2026-42508 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
🟠 HIGH golang.org/x/crypto v0.35.0 0.52.0 CVE-2026-46595 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
🟠 HIGH golang.org/x/crypto v0.35.0 0.52.0 CVE-2026-46597 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
🟠 HIGH golang.org/x/net v0.36.0 0.55.0 CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
🟠 HIGH golang.org/x/net v0.36.0 0.55.0 CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
🟠 HIGH golang.org/x/net v0.36.0 0.53.0 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH golang.org/x/net v0.36.0 0.55.0 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH golang.org/x/oauth2 v0.25.0 0.27.0 CVE-2025-22868 golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
🟠 HIGH golang.org/x/text v0.22.0 0.39.0 CVE-2026-56852 A norm.Iter can enter an infinite loop when handling input containing ...
🔴 CRITICAL stdlib v1.24.1 1.24.13, 1.25.7, 1.26.0-rc.3 CVE-2025-68121 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
🟠 HIGH stdlib v1.24.1 1.24.4 CVE-2025-22874 crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509
🟠 HIGH stdlib v1.24.1 1.24.12, 1.25.6 CVE-2025-61726 golang: net/url: Memory exhaustion in query parameter parsing in net/url
🟠 HIGH stdlib v1.24.1 1.24.11, 1.25.5 CVE-2025-61729 crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate
🟠 HIGH stdlib v1.24.1 1.25.8, 1.26.1 CVE-2026-25679 net/url: Incorrect parsing of IPv6 host literals in net/url
🟠 HIGH stdlib v1.24.1 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib v1.24.1 1.25.9, 1.26.2 CVE-2026-32280 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
🟠 HIGH stdlib v1.24.1 1.25.9, 1.26.2 CVE-2026-32281 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
🟠 HIGH stdlib v1.24.1 1.25.9, 1.26.2 CVE-2026-32283 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
🟠 HIGH stdlib v1.24.1 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib v1.24.1 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib v1.24.1 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib v1.24.1 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib v1.24.1 1.25.10, 1.26.3 CVE-2026-39836 ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH stdlib v1.24.1 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib v1.24.1 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

@renovate
renovate Bot force-pushed the renovate/ruff-0.x-lockfile branch 2 times, most recently from ce71c23 to 5c22e47 Compare July 25, 2026 17:06
@renovate
renovate Bot force-pushed the renovate/ruff-0.x-lockfile branch from 5c22e47 to 5eb0f1a Compare July 30, 2026 20:11
@renovate renovate Bot changed the title Update dependency ruff to v0.16.0 Update dependency ruff to v0.16.1 Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants