Skip to content

build(deps): bump the test-and-lint-dependencies group with 2 updates #2876

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 30, 2025
Merged

build(deps): bump the test-and-lint-dependencies group with 2 updates #2876

merged 2 commits into from
Oct 30, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 20, 2025 •
edited
Loading

Bumps the test-and-lint-dependencies group with 2 updates: ruff and zizmor.

Updates ruff from 0.14.0 to 0.14.1

Release notes

Sourced from ruff's releases.

0.14.1

Release Notes

Released on 2025-10-16.

Preview features

  • [formatter] Remove parentheses around multiple exception types on Python 3.14+ (#20768)
  • [flake8-bugbear] Omit annotation in preview fix for B006 (#20877)
  • [flake8-logging-format] Avoid dropping implicitly concatenated pieces in the G004 fix (#20793)
  • [pydoclint] Implement docstring-extraneous-parameter (DOC102) (#20376)
  • [pyupgrade] Extend UP019 to detect typing_extensions.Text (UP019) (#20825)
  • [pyupgrade] Fix false negative for TypeVar with default argument in non-pep695-generic-class (UP046) (#20660)

Bug fixes

  • Fix false negatives in Truthiness::from_expr for lambdas, generators, and f-strings (#20704)
  • Fix syntax error false positives for escapes and quotes in f-strings (#20867)
  • Fix syntax error false positives on parenthesized context managers (#20846)
  • [fastapi] Fix false positives for path parameters that FastAPI doesn't recognize (FAST003) (#20687)
  • [flake8-pyi] Fix operator precedence by adding parentheses when needed (PYI061) (#20508)
  • [ruff] Suppress diagnostic for f-string interpolations with debug text (RUF010) (#20525)

Rule changes

  • [airflow] Add warning to airflow.datasets.DatasetEvent usage (AIR301) (#20551)
  • [flake8-bugbear] Mark B905 and B912 fixes as unsafe (#20695)
  • Use DiagnosticTag for more rules - changes display in editors (#20758,#20734)

Documentation

  • Update Python compatibility from 3.13 to 3.14 in README.md (#20852)
  • Update lint.flake8-type-checking.quoted-annotations docs (#20765)
  • Update setup instructions for Zed 0.208.0+ (#20902)
  • [flake8-datetimez] Clarify docs for several rules (#20778)
  • Fix typo in RUF015 description (#20873)

Other changes

  • Reduce binary size (#20863)
  • Improved error recovery for unclosed strings (including f- and t-strings) (#20848)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.14.1

Released on 2025-10-16.

Preview features

  • [formatter] Remove parentheses around multiple exception types on Python 3.14+ (#20768)
  • [flake8-bugbear] Omit annotation in preview fix for B006 (#20877)
  • [flake8-logging-format] Avoid dropping implicitly concatenated pieces in the G004 fix (#20793)
  • [pydoclint] Implement docstring-extraneous-parameter (DOC102) (#20376)
  • [pyupgrade] Extend UP019 to detect typing_extensions.Text (UP019) (#20825)
  • [pyupgrade] Fix false negative for TypeVar with default argument in non-pep695-generic-class (UP046) (#20660)

Bug fixes

  • Fix false negatives in Truthiness::from_expr for lambdas, generators, and f-strings (#20704)
  • Fix syntax error false positives for escapes and quotes in f-strings (#20867)
  • Fix syntax error false positives on parenthesized context managers (#20846)
  • [fastapi] Fix false positives for path parameters that FastAPI doesn't recognize (FAST003) (#20687)
  • [flake8-pyi] Fix operator precedence by adding parentheses when needed (PYI061) (#20508)
  • [ruff] Suppress diagnostic for f-string interpolations with debug text (RUF010) (#20525)

Rule changes

  • [airflow] Add warning to airflow.datasets.DatasetEvent usage (AIR301) (#20551)
  • [flake8-bugbear] Mark B905 and B912 fixes as unsafe (#20695)
  • Use DiagnosticTag for more rules - changes display in editors (#20758,#20734)

Documentation

  • Update Python compatibility from 3.13 to 3.14 in README.md (#20852)
  • Update lint.flake8-type-checking.quoted-annotations docs (#20765)
  • Update setup instructions for Zed 0.208.0+ (#20902)
  • [flake8-datetimez] Clarify docs for several rules (#20778)
  • Fix typo in RUF015 description (#20873)

Other changes

  • Reduce binary size (#20863)
  • Improved error recovery for unclosed strings (including f- and t-strings) (#20848)

Contributors

... (truncated)

Commits
  • 2bffef5 Bump 0.14.1 (#20925)
  • e64d772 Standardize syntax error construction (#20903)
  • 0369668 [pydoclint] Implement docstring-extraneous-parameter (DOC102) (#20376)
  • 058fc37 [ty] Fix panic 'missing root' when handling completion request (#20917)
  • ec9faa3 [ty] Run file watching tests serial when using nextest (#20918)
  • 7155a62 [ty] Add version hint for failed stdlib attribute accesses (#20909)
  • a67e069 More CI improvements (#20920)
  • 6a1e91c [ty] Check typeshed VERSIONS for parent modules when reporting failed stdlib ...
  • 3db5d59 Don't use codspeed or depot runners in CI jobs on forks (#20894)
  • d23826c [ty] cache Type::is_redundant_with (#20477)
  • Additional commits viewable in compare view

Updates zizmor from 1.14.2 to 1.15.2

Release notes

Sourced from zizmor's releases.

v1.15.2

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would fail to parse some Dependabot configuration files due to missing support for some schedule formats (#1247)

v1.15.1

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would fail to parse Dependabot configuration files due to missing support for some package ecosystems (#1240)

v1.15.0

This release comes with support for auditing Dependabot configuration files! Like with composite action definition auditing (introduced in v1.0.0), Dependabot configuration auditing is enabled by default but can be disabled as part of input collection.

To complement this new functionality, this release comes with two new audits: dependabot-execution and dependabot-cooldown.

New Features 🌈🔗

  • New audit: dependabot-execution detects Dependabot configurations that allow insecure external code execution (#1220)

  • New audit: dependabot-cooldown detects Dependabot configurations that do not include cooldown settings, or that set an insufficient cooldown (#1223)

Performance Improvements 🚄🔗

  • zizmor now uses jemalloc as its default allocator on non-MSVC targets, which should significantly improve performance for Linux and macOS users (#1200)

Enhancements 🌱🔗

  • zizmor now unconditionally emits its version number to stderr on startup (#1199)

  • The ref-version-mismatch audit now supports auto-fixes for many findings (#1205)

    Many thanks to @​mostafa for implementing this improvement!

  • The [impostor-commit] audit now supports auto-fixes for many findings (#1090)

    Many thanks to @​mostafa for implementing this improvement!

  • zizmor is now more resilient to sporadic request failures when performing GitHub API requests (#1219)

  • --collect=dependabot is now supported as a collection option, allowing users to audit only Dependabot configuration files (#1215)

  • The --fix mode (introduced with v1.10.0) is now considered stable and no longer experimental (#1232)

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would fail instead of analyzing single-file inputs that lacked an explicit parent path component, e.g. zizmor foo.yml instead of zizmor ./foo.yml (#1212)

Deprecations ⚠️🔗

  • The workflows-only and actions-only values for --collect are now deprecated. These values have been replaced with workflows and actions, respectively, which have the same behavior but can be composed together with other collection modes. The deprecated modes will be removed in a future release (#1228)

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.15.2

Bug Fixes 🐛

  • Fixed a bug where zizmor would fail to parse some Dependabot configuration files due to missing support for some schedule formats (#1247)

1.15.1

Bug Fixes 🐛

  • Fixed a bug where zizmor would fail to parse Dependabot configuration files due to missing support for some package ecosystems (#1240)

1.15.0

This release comes with support for auditing Dependabot configuration files! Like with composite action definition auditing (introduced in v1.0.0), Dependabot configuration auditing is enabled by default but can be disabled as part of input collection.

To complement this new functionality, this release comes with two new audits: [dependabot-execution] and [dependabot-cooldown].

New Features 🌈

  • New audit: [dependabot-execution] detects Dependabot configurations that allow insecure external code execution (#1220)

  • New audit: [dependabot-cooldown] detects Dependabot configurations that do not include cooldown settings, or that set an insufficient cooldown (#1223)

Performance Improvements 🚄

  • zizmor now uses jemalloc as its default allocator on non-MSVC targets, which should significantly improve performance for Linux and macOS users (#1200)

Enhancements 🌱

  • zizmor now unconditionally emits its version number to stderr on startup (#1199)

  • The [ref-version-mismatch] audit now supports auto-fixes for many findings (#1205)

    Many thanks to @​mostafa for implementing this improvement!

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Oct 20, 2025
@dependabot dependabot bot requested a review from a team as a code owner October 20, 2025 21:01
@dependabot dependabot bot added python Pull requests that update Python code dependencies Pull requests that update a dependency file labels Oct 20, 2025
@lukpueh
Copy link
Member

lukpueh commented Oct 21, 2025

secure-systems-lab/securesystemslib#1036 (comment) seems reasonable. let's apply here too.

@dependabot
build(deps): bump the test-and-lint-dependencies group with 2 updates
be63d5b 
Bumps the test-and-lint-dependencies group with 2 updates: [ruff](https://github.com/astral-sh/ruff) and [zizmor](https://github.com/zizmorcore/zizmor).


Updates `ruff` from 0.14.0 to 0.14.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.14.0...0.14.1)

Updates `zizmor` from 1.14.2 to 1.15.2
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.14.2...v1.15.2)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-and-lint-dependencies
- dependency-name: zizmor
  dependency-version: 1.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-and-lint-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/pip/test-and-lint-dependencies-6445124e3d branch from b2c95f1 to be63d5b Compare October 27, 2025 21:35
@jku
dependabot: Set default cooldown of 7 days
e8eecd6 
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@coveralls
Copy link

Coverage Status

coverage: 97.007% (+0.4%) from 96.603%
when pulling e8eecd6 on dependabot/pip/test-and-lint-dependencies-6445124e3d
into 701dbe2 on develop.

@lukpueh
Copy link
Member

lukpueh commented Oct 30, 2025

Cheers, @jku!

@lukpueh lukpueh merged commit d993961 into develop Oct 30, 2025
18 checks passed
@dependabot dependabot bot deleted the dependabot/pip/test-and-lint-dependencies-6445124e3d branch October 30, 2025 16:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lukpueh lukpueh lukpueh approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@lukpueh @coveralls @jku