build(deps-dev): bump the uv-dependencies group with 2 updates

[dependabot]

Bumps the uv-dependencies group with 2 updates: pyinstaller and ruff.

Updates pyinstaller from 6.22.0 to 6.22.2

Release notes

Sourced from pyinstaller's releases.

v6.22.2

Please see the v6.22.2 section of the changelog for a list of the changes since v6.22.1.

v6.22.1

Please see the v6.22.1 section of the changelog for a list of the changes since v6.22.0.

Changelog

Sourced from pyinstaller's changelog.

6.22.2 (2026-08-17)

Bugfix

* (Windows) Fix spurious security validation error when a ``onefile``
  executable is launched from a symlinked directory or a junction.
  (:issue:`9508`)
6.22.1 (2026-08-15)
Bugfix

• Fix invalid spec file generation when :option:--hide-console option is given (regression introduced in v6.22.0). (:issue:9503)
• (NetBSD) Fix binary dependency analysis. (:issue:9505)
• (NetBSD) Fix/improve NetBSD support: add the is_netbsd platform flag, treat NetBSD as a Unix platform, and search /usr/local/lib for shared libraries, as is already done for FreeBSD and OpenBSD. (:issue:9496)
• (OpenBSD) Fix binary dependency analysis. (:issue:9505)

Incompatible Changes

* (POSIX) Executables built in ``onedir`` mode with ``setuid`` bit set
  now validate the owner and permissions on their contents directory
  (typically the ``_internal`` directory); the owner ID must match the
  effective user ID under which the process is running, and the
  permissions on the directory need to be `0700`. This aims to prevent
  unprivileged users from modifying contents of an application that
  runs in privileged mode. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process (on POSIX platforms
  other than OpenBSD and AIX), the bootloader now attempts to verify
  the parent process executable via ``procfs`` lookup. This check is
  mandatory for ``onefile`` executables with ``setuid`` bit set; if the
  relevant ``procfs`` entry is inaccessible (for example, due to ``procfs``
  not being mounted, as is the case on FreeBSD by default, or due to access
  being blocked by local security policy), the process will exit with
  security validation error message. For regular ``onefile`` executables
  (without ``setuid`` bit set), the parent-process check is enforced when the
  relevant ``procfs`` entry is accessible, and skipped when it happens to be
  inaccessible. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process and the executable
  has ``setuid`` bit set, the bootloader now validates the owner and
  permissions on the (inherited) temporary directory. The owner ID of the
</tr></table> 

... (truncated)

Commits

• 19f42e7 Release v6.22.2. [skip ci]
• 72bbdb4 bootloader: Windows: use QueryFullProcessImageNameW for executable resolution
• 0d6941c tests: add test to ensure security validation works with symlinked executables
• 6e00368 Tests: Requirements: Scheduled weekly dependency update for week 33 (#9506)
• 22ea0f2 Release v6.22.1. [skip ci]
• e709c04 bootloader: relax parent-process validation requirements on POSIX platforms
• e0388d3 bootloader: relax parent-process validation requirements on FreeBSD
• 92afdf8 tests: test_application_home_directory_hijack: handle 8.3 short paths
• 4b509a2 tests: improve logging in test_application_home_directory_hijack
• 66b0249 doc: document the new security validation and its implications
• Additional commits viewable in compare view

Updates ruff from 0.16.3 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot

... (truncated)

Commits

• 11c76bf Bump 0.16.4 (#27937)
• d53c8c5 Isolate playground builds from deployment credentials (#27839)
• cab001e Disable uv preview for releases and pre-commit hooks (#27939)
• f8d575f [ty] Clarify writing guidance for human readers (#27912)
• ca45fae Set --preview and --default-index for the uv-lock hook (#27935)
• 4827bf7 Export UV_DEFAULT_INDEX in release.sh (#27934)
• d1087a4 [ty] Handle assignment expressions in string annotations (#27921)
• 680cce4 [ty] Optimize inherited recursive protocol comparisons (#27922)
• 974d3cb Upgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (#27932)
• b169b40 Install cargo tools locked (#27929)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions