Skip to content

chore(deps): update all dependencies - #531

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/all
Open

chore(deps): update all dependencies#531
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/all

Conversation

@renovate

@renovate renovate Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
ansible-lint (changelog) 26.6.0 → 26.8.0 age confidence dependency-groups minor
ansible/actions (changelog) a4a333c → 1c11599 action digest
ansible/team-devtools (changelog) 52cd2a0 → 4875845 action digest
astral-sh/setup-uv v8.3.2 → v9.0.0 age confidence action major v10.0.1 (+1)
astral-sh/uv-pre-commit 0.11.32 → 0.12.5 age confidence repository minor
biomejs/pre-commit v2.5.5 → v2.5.8 age confidence repository patch
coverage 7.15.2 → 7.15.4 age confidence dependency-groups patch
github/codeql-action v4.37.1 → v4.37.7 age confidence action patch
j178/prek-action v2.0.6 → v3.0.0 age confidence action major
prek (source, changelog) 0.4.11 → 0.4.13 age confidence dependency-groups patch
pypa/gh-action-pypi-publish v1.14.1 → v1.14.2 age confidence action patch
release-drafter/release-drafter (changelog) eada3c9 → 34d8067 action digest
ruff (source, changelog) 0.16.0 → 0.16.3 age confidence dependency-groups patch
tombi 1.2.4 → 1.4.0 age confidence dependency-groups minor 1.4.1
tombi-toml/tombi-pre-commit v1.2.4 → v1.4.0 age confidence repository minor v1.4.1
twine 6.2.0 → 7.0.0 age confidence dependency-groups major

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

Release Notes

ansible/ansible-lint (ansible-lint)

v26.8.0

Compare Source

What's Changed

New Contributors

Full Changelog: ansible/ansible-lint@v26.6.0...v26.8.0

astral-sh/setup-uv (astral-sh/setup-uv)

v9.0.0

Compare Source

astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)

v0.12.5

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.5

v0.12.4

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.4

v0.12.3

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.3

v0.12.2

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.2

v0.12.1

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.1

v0.12.0

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.12.0

v0.11.33

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.11.33

biomejs/pre-commit (biomejs/pre-commit)

v2.5.8

Compare Source

v2.5.7

Compare Source

v2.5.6

Compare Source

coveragepy/coveragepy (coverage)

v7.15.4

Compare Source

  • Fix: in the HTML report, a source file name containing a double quote (legal
    on POSIX) wasn't escaped where it's dropped into the href of the index
    and prev/next links, so it could close the attribute early and inject markup.
    Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.

  • Fix: the LCOV report wrote file names and other fields into its
    line-oriented records without neutralizing control characters. A measured
    file whose name contained a newline (legal on POSIX) could forge extra
    records, inflating the coverage seen by tools that read the report. Control
    characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.

  • Wheels are now provided for Python 3.15.

.. _pull 2226: #​2226
.. _pull 2227: #​2227

.. _changes_7-15-3:

v7.15.3

Compare Source

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the
    combination would be prevented when read from the coverage.py configuration.
    But using the context API as pytest-cov does, contexts would be silently
    dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>.
    Closes issue 2200    .

  • A performance improvement in the low-level line number bookkeeping when
    combining data files, thanks to Kevin Turcios <pull 2239_>_.

  • Performance improvement in HTML reporting by reducing the number of times
    files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: #​2200
.. _pull 2234: #​2234
.. _pull 2239: #​2239
.. _pull 2240: #​2240

.. _changes_7-15-2:

github/codeql-action (github/codeql-action)

v4.37.7

Compare Source

v4.37.6

Compare Source

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

Compare Source

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #​4061

v4.37.4

Compare Source

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007
j178/prek-action (j178/prek-action)

v3.0.0

Compare Source

prek-action releases are now immutable

Starting with v3, prek-action will no longer publish moving major or minor tags. References such as j178/prek-action@v3 and j178/prek-action@v3.0 will not be available.

Moving tags can be retargeted after users adopt them, creating unnecessary supply-chain risk. Use an exact release tag or, for stronger protection, pin the action to a full commit SHA.

[!TIP]
Use an exact release tag:

- uses: j178/prek-action@v3.0.0

Or, even better, pin the full commit SHA:

- uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0

What's Changed

Full Changelog: j178/prek-action@v2...v3.0.0

j178/prek (prek)

v0.4.13

Compare Source

Released on 2026-08-10.

Highlights
Manage hook tools with mise

The new language: mise support lets hooks install tools using
mise in an isolated environment:

repos:
  - repo: local
    hooks:
      - id: golangci-lint
        name: golangci-lint
        language: mise
        additional_dependencies: ["aqua:golangci/golangci-lint@2"]
        entry: golangci-lint run --fast-only ./...
        pass_filenames: false
Run commands in hook environments

The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:

$ prek exec golangci-lint -- golangci-lint --version
Enhancements
  • Add mise language support (#​2540)
  • Add deny-filename-pattern and require-filename-pattern hooks (#​2488)
  • Add prek exec for running commands in a hook environment (#​2478)
  • Add yaml-language-server: comment to YAML sample config (#​2486)
  • Make prek cache size output terminal-aware (#​2508)
  • Match file regexes against path bytes (#​2541)
  • Show hook aliases in run output (#​2497)
  • Show hook descriptions in run output (#​2490)
Performance
  • Avoid env cache scans for skipped hooks (#​2502)
  • Cache Node version queries (#​2500)
Bug fixes
  • Fix Node hook installation with npm 11 (#​2487)
  • Isolate dependency installs from inherited Git repository state (#​2506)
Documentation
  • Document combined group filtering (#​2495)
  • Explain what prek does in README (#​2507)
  • Refresh "Why prek" highlights (#​2474)
Contributors

v0.4.12

Compare Source

Released on 2026-08-03.

Enhancements
  • Add --require-group for hook group intersections (#​2472)
  • Align fast-path and builtin pre-commit hooks (#​2433)
  • Do not shuffle file list for verbose output (#​2431)
  • Improve top-level command descriptions (#​2429)
  • Install uv from Astral CDN and drop source racing (#​2455)
  • Make prek install --force bypass external hooks paths (#​2437)
  • Show builtin hook flags in verbose list output (#​2427)
  • Verify uv release archive checksums (#​2456)
Performance
  • Precompute file tags in parallel (#​2440)
  • Skip diffs after known hook modifications (#​2447)
  • Skip worktree diffs for read-only languages (#​2432)
  • Track builtin hook file changes directly (#​2404)
Bug fixes
  • Use full object IDs in diff snapshots (#​2448)
Documentation
  • Add a multi-repository configuration example (#​2434)
  • Rewrite benchmark documentation (#​2469)
Contributors
pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)

v1.14.2

Compare Source

This one probably won't touch you visibly so just bookmark @​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube or encourage him to come back with more to share next year!

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip]
So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#​416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

The rest of the updates bump things related to pypi-attestations and sigstore, which has the most interesting backstory here. @​facutuesca💰 sent a patch in #​417 but a bunch more helped out.

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23.
On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

Edge Cake XKCD feels just like this release

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #​415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

astral-sh/ruff (ruff)

v0.16.3

Compare Source

Released on 2026-08-13.

Preview features
  • [pylint] Fix false negatives on negative numbers (PLR6104) (#​27251)
  • [pyupgrade] Add rule to replace while 1 with while True (UP048) (#​27190)
Bug fixes
  • [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#​27687)
  • [pylint] Allow continue in finally on Python 3.8 (#​27626)
  • [pylint] Fix PLE1307 false positive with bools (#​27651)
  • [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#​27560)
  • [pylint] Improve handling of concatenated strings (PLE1300) (#​27659)
Rule changes
  • [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#​27527)
Performance
  • Enable PGO for Linux x86-64 Ruff releases (#​27570)
  • Enable PGO for Linux ARM64 Ruff releases (#​27574)
  • Enable PGO for Windows x86-64 Ruff releases (#​27573)
  • Enable PGO for macOS ARM64 Ruff releases (#​27572)
  • Reduce Expr size to 64 bytes (#​27591)
CLI
  • Hyperlink rule codes in ruff check --statistics output (#​27646)
Documentation
  • [ruff] Also suggest asyncio.TaskGroup (RUF006) (#​27461)
Other changes
Contributors

v0.16.2

Compare Source

Released on 2026-08-06.

Bug fixes
  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#​27335)
Server
  • Register formatting capabilities dynamically to exclude TOML files (#​27332)
Contributors

v0.16.1

Compare Source

Released on 2026-07-30.

Preview features
  • Add an option to opt out of human-readable names (#​27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#​27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#​27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#​26959)
Bug fixes
  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#​27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#​27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#​26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#​25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#​23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#​27192)
Rule changes
  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#​26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#​27200)
Server
  • Fix indexing of excluded nested Ruff workspaces (#​27303)
  • Lint TOML files in the LSP (#​26862)
Documentation
  • Cover pycon Markdown formatting (#​27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#​27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#​27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#​27250)
Other changes
  • Reduce syntax error noise by swallowing dedents like indents (#​27170)
  • Vendor latest annotate-snippets (#​27033)
Contributors
tombi-toml/tombi (tombi)

v1.4.0

Compare Source

What's Changed

Starting from this version, we are introducing the WebAssembly npm package.

Please refer to the documentation for details.

https://tombi-toml.github.io/tombi/docs/wasm

🐝 Bug Fixes
🛠️ Other Changes

Full Changelog: tombi-toml/tombi@v1.3.5...v1.4.0

v1.3.5

Compare Source

What's Changed

🐝 Bug Fixes

Full Changelog: tombi-toml/tombi@v1.3.4...v1.3.5

v1.3.4

Compare Source

What's Changed

🚨 Breaking Changes
🐝 Bug Fixes
🛠️ Other Changes

Full Changelog: tombi-toml/tombi@v1.3.3...v1.3.4

v1.3.3

Compare Source

What's Changed

🚨 Breaking Changes
🦅 New Features

Full Changelog: tombi-toml/tombi@v1.3.2...v1.3.3

v1.3.2

Compare Source

What's Changed

Unless line-width is specified, there is no wrap limit.
This is because allowing multi-line inline tables in TOML v1.1.0 has unnecessarily led to the creation of numerous issues.

🚨 Breaking Changes
🦅 New Features
🛠️ Other Changes

Full Changelog: tombi-toml/tombi@v1.3.1...v1.3.2

v1.3.1

Compare Source

v1.3.0

Compare Source

v1.2.10

Compare Source

What's Changed

📦 Dependencies

Full Changelog: tombi-toml/tombi@v1.2.9...v1.2.10

v1.2.9

Compare Source

What's Changed

🦅 New Features
🐝 Bug Fixes
🛠️ Other Changes

Full Changelog: tombi-toml/tombi@v1.2.8...v1.2.9

v1.2.8

Compare Source

What's Changed

🐝 Bug Fixes
📦 Dependencies
🛠️ Other Changes

Full Changelog: tombi-toml/tombi@v1.2.7...v1.2.8

v1.2.7

Compare Source

What's Changed

🦅 New Features
🛠️ Other Changes

Full Changelog: tombi-toml/tombi@v1.2.6...v1.2.7

v1.2.6

Compare Source

What's Changed

🦅 New Features
🐝 Bug Fixes
🛠️ Other Changes

Full Changelog: tombi-toml/tombi@v1.2.5...v1.2.6

v1.2.5

Compare Source

What's Changed

🦅 New Features
🐝 Bug Fixes
🛠️ Other Changes

Full Changelog: tombi-toml/tombi@v1.2.4...v1.2.5

tombi-toml/tombi-pre-commit (tombi-toml/tombi-pre-commit)

v1.4.0

Compare Source

See: https://github.com/tombi-toml/tombi/releases/tag/v1.4.0

v1.3.5

Compare Source

See: https://github.com/tombi-toml/tombi/releases/tag/v1.3.5

v1.3.4

Compare Source

See: https://github.com/tombi-toml/tombi/releases/tag/v1.3.4

v1.3.3

Compare Source

See: https://github.com/tombi-toml/tombi/releases/tag/v1.3.3

[

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "before 4am on monday"
  • Automerge
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner August 17, 2026 02:10
@renovate
renovate Bot enabled auto-merge (squash) August 17, 2026 02:10
@renovate

renovate Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pyproject.toml
Artifact update for tombi resolved to version 1.4.1, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 1.4.0
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

@renovate

renovate Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

chore dependencies

Projects

🧰 devtools project board
Status: No status

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ansibuddy