Skip to content

chore(deps): bump the ci-requirements group in /requirements with 2 updates - #108

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/requirements/ci-requirements-5eee14478f
Open

chore(deps): bump the ci-requirements group in /requirements with 2 updates#108
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/requirements/ci-requirements-5eee14478f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the ci-requirements group in /requirements with 2 updates: ruff and build.

Updates ruff from 0.16.4 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Commits

Updates build from 1.5.0 to 1.6.0

Release notes

Sourced from build's releases.

1.6.0

What's Changed

New Contributors

Full Changelog: pypa/build@1.5.1...1.6.0

1.5.1

What's Changed

... (truncated)

Changelog

Sourced from build's changelog.

#################### 1.6.0 (2026-08-27) ####################

Features

  • Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
  • The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
  • The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
  • Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
  • Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
    • by :user:gaborbernat (:issue:655)
  • Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
  • On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

Bugfixes

  • Drain verbose subprocess output inline instead of using a ThreadPoolExecutor, which silently swallowed logging errors - by :user:henryiii (:issue:1098)
  • Reject a file passed as --env-dir with a clear error instead of a raw FileExistsError - by :user:henryiii (:issue:1100)
  • Emit CLI warnings to stderr instead of stdout, so they no longer corrupt --metadata JSON output on stdout - by :user:ymyzk (:issue:1111)
  • Fix the Windows symlink support probe always returning False due to a stale object interpolated into the destination path - by :user:henryiii (:issue:1118)
  • Fix metadata_path's build-backend fallback returning a nonexistent dist-info path for wheels with a build tag - by :user:henryiii (:issue:1119)
  • Write pip/uv requirements and constraints files with \n instead of os.linesep, avoiding doubled \r\r\n line endings on Windows - by :user:henryiii (:issue:1120)
  • Batch of small robustness fixes: correct macOS release parsing for the minimum pip version, avoid sharing the mutable default build-system table between builders, keep the original error when isolated-environment setup fails early, and raise BuildException for an invalid wheel - by :user:henryiii (:issue:1121)
  • Decide color support independently for stdout and stderr instead of only checking stdout.isatty(), so redirecting one stream no longer disables or leaks ANSI colors on the other - by :user:henryiii (:issue:1123)
  • Pass --dependency-constraints-txt files through to the installer unmodified instead of re-parsing them into a deduplicated set of lines, fixing a case where a hashed requirement (e.g. from pip-compile --generate-hashes) could have its --hash continuation line separated from its requirement line and silently dropped, depending on the interpreter's hash seed - by :user:manfred-kaiser (:issue:1140)

... (truncated)

Commits
  • 7ac9efe chore: prepare for 1.6.0
  • e57e2bf 👷 ci: use app token for releases (#1169)
  • 66438ab pre-commit: bump repositories (#1167)
  • 4ed9658 build(deps): bump the github-actions group with 3 updates (#1166)
  • c76707f 🔧 chore: batch dependency updates weekly on Tuesday (#1165)
  • b317437 Drop a few PyPy-specific test skips (#1164)
  • 561f331 pre-commit: bump repositories (#1163)
  • 9456281 refactor: drop redundant exc_info parameter from backend exception wrapper ...
  • 3e7a445 Use stdlib importlib.metadata for typing (#1162)
  • 9a2e1e9 tests: download integration sources once per run (#1157)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the ci-requirements group
cf3200b 
Bumps the ci-requirements group in /requirements with 2 updates: [ruff](https://github.com/astral-sh/ruff) and [build](https://github.com/pypa/build).


Updates `ruff` from 0.16.4 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.16.5)

Updates `build` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.5.0...1.6.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-requirements
- dependency-name: build
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-requirements
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 31, 2026
@cohenrobinson cohenrobinson mentioned this pull request Aug 31, 2026
Open
@cohenrobinson

cohenrobinson commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

pr-sweep triage — bot PR (dependabot), reviewed read-only. No commits pushed to the dependabot branch, no approving review, not merged.

Version jumps (ci-requirements group):

  • build 1.5.0 → 1.6.0; constraint build>=1.0 → build>=1.6.0 in requirements/build.in and requirements/dev.in
  • ruff 0.16.4 → 0.16.5; constraint ruff>=0.16.4 → ruff>=0.16.5 in requirements/dev.in and requirements/lint.in

Risk: low.

  • No major-version boundary crossed. build 1.5→1.6 is a minor within 1.x; ruff 0.16.4→0.16.5 is a patch. The ruff job is green, so the new linter release surfaces no new diagnostics on this codebase.
  • Both are dev/CI-only dependencies, not runtime. This repo publishes an sdist + wheel, so a runtime bump would be a shipped change — this is not one. build/twine are the packaging toolchain, ruff is the linter; the published artifact contents are unaffected. build sdist + wheel passing confirms the new build produces artifacts fine.

.in → .txt consistency check (this PR touches both): consistent. Each raised floor is reflected in the pinned compiled output with a fresh hash set — build.in build>=1.6.0 → build.txt build==1.6.0; dev.in ruff>=0.16.5 / build>=1.6.0 → dev.txt ruff==0.16.5 / build==1.6.0; lint.in ruff>=0.16.5 → lint.txt ruff==0.16.5. No other pin in the compiled files moved, and no transitive dependency was added or dropped, which is what you'd expect from a floor-only bump. One cosmetic wrinkle: the regenerated # via provenance comments read -r build.in / -r lint.in while the header command line still says requirements/build.in — a uv invocation-cwd artifact in a comment, no functional effect.

All checks green (tests on ubuntu/macos/windows, ruff, mypy --strict, pip-audit + bandit, CodeQL, build sdist + wheel).

Merge this one first. #109 makes the same two version jumps but only in the compiled .txt files, leaving the .in floors stale — this PR is the superset. The two also edit the same # via comment lines in build.txt, dev.txt and lint.txt in conflicting directions, so whichever lands second will conflict; merging #108 first means #109 becomes redundant and dependabot should close or recreate it.

Held for you: ready for human approval and merge. pr-sweep does not auto-advance a green dependency bump — CI passing is not a substitute for a human approval on a bot PR. Labelled pr-sweep/held.

@cohenrobinson cohenrobinson added the pr-sweep/held Held by pr-sweep for human approval label Aug 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file pr-sweep/held Held by pr-sweep for human approval python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cohenrobinson