Skip to content

build(deps): bump the test-and-lint-dependencies group across 1 directory with 3 updates - #2987

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/test-and-lint-dependencies-20a4e62989
Open

build(deps): bump the test-and-lint-dependencies group across 1 directory with 3 updates#2987
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/test-and-lint-dependencies-20a4e62989

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the test-and-lint-dependencies group with 3 updates in the / directory: ruff, zizmor and coverage.

Updates ruff from 0.15.22 to 0.16.2

Release notes

Sourced from ruff's releases.

0.16.2

Release Notes

Released on 2026-08-06.

Bug fixes

  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

  • Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

Install ruff 0.16.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.ps1 | iex"

Download ruff 0.16.2

File Platform Checksum
ruff-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
ruff-x86_64-apple-darwin.tar.gz Intel macOS checksum
ruff-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
ruff-i686-pc-windows-msvc.zip x86 Windows checksum
ruff-x86_64-pc-windows-msvc.zip x64 Windows checksum
ruff-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
ruff-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz PPC64 Linux checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
ruff-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.2

Released on 2026-08-06.

Bug fixes

  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

  • Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

0.16.1

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

... (truncated)

Commits
  • 5b48a04 Bump 0.16.2 (#27555)
  • 1b9e5fc Update Swatinem/rust-cache action to v2.9.2 (#27568)
  • c4e86fc [ty] Add helper extension methods for half-range and equality constraints (#2...
  • 17a00de [ty] Reuse primer commands in memory reports (#27553)
  • 6ea296b [ty] Normalize type labels in structured docstrings (#26923)
  • 2fc445f [ty] Diagnose invalid getattr calls (#27502)
  • 22c7823 [ty] Enable (but downrank) auto-import completion suggestions from stub-only ...
  • 05160d5 [ty] Diagnose invalid descriptor __get__ calls (#27400)
  • baea3d0 [ty] Expose strict analysis options in the playground (#27543)
  • c88946e [ty] Bump ecosystem-analyzer for strict project settings (#27542)
  • Additional commits viewable in compare view

Updates zizmor from 1.26.1 to 1.29.0

Release notes

Sourced from zizmor's releases.

v1.29.0

New Features 🌈🔗

  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)

Changes ⚠️🔗

Removals 🌅🔗

  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)

  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)

  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

v1.28.0

Security 🔒🔗

  • v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

    Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

  • The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

  • The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)

  • sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗

  • Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

  • Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)

  • Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

v1.27.0

New Features 🌈🔗

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.29.0

New Features 🌈

  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and #!yaml uses: ./foo/bar (#2248)

Changes ⚠️

  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly: [unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses, whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅

  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛

  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)

  • Fixed a bug where the [github-app] audit would incorrectly flag some usages as needing a #!yaml repositories: key, despite requesting organization-level-only permissions (#2227)

  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

1.28.0

Security 🔒

  • v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh] for full information.

    Many thanks to @​shaanmajid for finding and reporting this vulnerability.

... (truncated)

Commits

Updates coverage from 7.15.2 to 7.15.4

Release notes

Sourced from coverage's releases.

7.15.4

Version 7.15.4 — 2026-08-06

  • Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
  • Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
  • Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
  • A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
  • Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

Changelog

Sourced from coverage's changelog.

Version 7.15.4 — 2026-08-06

  • Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn't escaped where it's dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.

  • Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.

  • Wheels are now provided for Python 3.15.

.. _pull 2226: coveragepy/coveragepy#2226 .. _pull 2227: coveragepy/coveragepy#2227

.. _changes_7-15-3:

Version 7.15.3 — 2026-08-02

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>. Closes issue 2200.

  • A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios <pull 2239_>_.

  • Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: coveragepy/coveragepy#2200 .. _pull 2234: coveragepy/coveragepy#2234 .. _pull 2239: coveragepy/coveragepy#2239 .. _pull 2240: coveragepy/coveragepy#2240

.. _changes_7-15-2:

Commits
  • 4c0e7ff docs: sample HTML for 7.15.4
  • db4cc32 docs: prep for 7.15.4
  • c33085c style: start gradual move to ruff 0.16
  • 53a0fd5 fix: neutralize control characters in lcov report fields (#2226)
  • b64d53d build: make 3.15 wheels
  • 53792ab build: show the python version for kits
  • f6b03c7 chore: make upgrade_one package=cibuildwheel
  • d9b660a chore: make upgrade
  • b128a31 docs: oops, move this entry to the correct place
  • a7a2c15 fix: escape filename urls in html report href attributes (#2227)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 10, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 10, 2026 21:43
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 10, 2026
@jku

jku commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

new ruff enables a a lot of new rules. Failures are:

CPY001 Missing copyright notice at top of file

Some of these are a bit silly but I guess the easiest fix is to add the notices.

Error: examples/manual_repo/basic_repo.py:1:1: CPY001 Missing copyright notice at top of file
Error: examples/manual_repo/hashed_bin_delegation.py:1:1: CPY001 Missing copyright notice at top of file
Error: examples/manual_repo/succinct_hash_bin_delegations.py:1:1: CPY001 Missing copyright notice at top of file
Error: tests/__init__.py:1:1: CPY001 Missing copyright notice at top of file
Error: tests/generated_data/__init__.py:1:1: CPY001 Missing copyright notice at top of file
Error: tests/generated_data/generate_md.py:1:1: CPY001 Missing copyright notice at top of file
Error: tests/test_metadata_eq_.py:1:1: CPY001 Missing copyright notice at top of file
Error: tests/test_metadata_generation.py:1:1: CPY001 Missing copyright notice at top of file
Error: tests/test_metadata_serialization.py:1:1: CPY001 Missing copyright notice at top of file
Error: tests/test_trusted_metadata_set.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/__init__.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/api/__init__.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/api/_payload.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/api/dsse.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/api/exceptions.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/api/metadata.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/api/serialization/__init__.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/api/serialization/json.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/ngclient/__init__.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/ngclient/_internal/__init__.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/ngclient/_internal/proxy.py:1:1: CPY001 Missing copyright notice at top of file
Error: tuf/ngclient/_internal/trusted_metadata_set.py:1:1: CPY001 Missing copyright notice at top of file

Too many positional arguments

Probably want to add "noqa" comments to these, I don't think we want to refactor for this even if I generally agree with the rule.

Error: tuf/api/_payload.py:533:9: PLR0917 Too many positional arguments (7 > 5)
Error: tuf/api/_payload.py:1092:9: PLR0917 Too many positional arguments (7 > 5)
Error: tuf/api/_payload.py:1713:9: PLR0917 Too many positional arguments (6 > 5)
Error: tuf/ngclient/updater.py:106:9: PLR0917 Too many positional arguments (6 > 5)

@dependabot
build(deps): bump the test-and-lint-dependencies group across 1 direc…
2a5f670 
…tory with 3 updates

Bumps the test-and-lint-dependencies group with 3 updates in the / directory: [ruff](https://github.com/astral-sh/ruff), [zizmor](https://github.com/zizmorcore/zizmor) and [coverage](https://github.com/coveragepy/coveragepy).


Updates `ruff` from 0.15.22 to 0.16.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.22...0.16.2)

Updates `zizmor` from 1.26.1 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.26.1...v1.29.0)

Updates `coverage` from 7.15.2 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.2...7.15.4)

---
updated-dependencies:
- dependency-name: coverage
  dependency-version: 7.15.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-and-lint-dependencies
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-and-lint-dependencies
- dependency-name: zizmor
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-and-lint-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/test-and-lint-dependencies-20a4e62989 branch from 0acb8eb to 2a5f670 Compare August 17, 2026 21:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jku