Skip to content

build(deps-dev): Bump ruff from 0.15.21 to 0.16.0 in /services/account_unification - #31

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/services/account_unification/ruff-0.16.0
Closed

build(deps-dev): Bump ruff from 0.15.21 to 0.16.0 in /services/account_unification#31
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/services/account_unification/ruff-0.16.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor

Bumps ruff from 0.15.21 to 0.16.0.

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

  • Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

  • Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

  • Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

    import math  # ruff: ignore[F401]
    ruff: ignore[F401]
    import os

  • Fixes are now shown in check and format --check output:

    ruff format --check .
    unformatted: File would be reformatted
     --> try.md:1:1
      |
    1 | ```python
      - import   math
    2 + import math
    3 | ```
      |
    1 file would be reformatted

    This example also shows off the Markdown formatting.

  • format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

    ruff format --check --output-format github .
    ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

    See the CLI help or documentation for the full list of supported formats.

  • The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

  • Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

  • Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

  • Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

    import math  # ruff: ignore[F401]
    ruff: ignore[F401]
    import os

  • Fixes are now shown in check and format --check output:

    ruff format --check .
    unformatted: File would be reformatted
     --> try.md:1:1
      |
    1 | ```python
      - import   math
    2 + import math
    3 | ```
      |
    1 file would be reformatted

    This example also shows off the Markdown formatting.

  • format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits
  • a2635fd Bump 0.16.0 (#27136)
  • 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
  • 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
  • 17ef711 Stabilize --add-ignore (#27125)
  • ef912bb Add newly stabilized rules to defaults (#27055)
  • b30f040 Stabilize new default rules (#27035)
  • bcd70c5 Exclude Markdown files from format-dev runs (#27052)
  • 87e51e2 Fix format --check spans for syntax errors (#27045)
  • afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
  • a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.21 to 0.16.0.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.16.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 29, 2026
@coderabbitai

coderabbitai Bot commented Jul 29, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@dependabot[bot], you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc11fea2-fe0c-4e06-8f59-5decb7d265f3

📥 Commits

Reviewing files that changed from the base of the PR and between 9385306 and e82ccf8.

📒 Files selected for processing (2)
  • services/account_unification/pyproject.toml
  • services/account_unification/requirements-dev.txt

Comment @coderabbitai help to get the list of available commands.

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for e82ccf80ecc4171daec56965caa248d9ec71be73.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
Loading

@opencode-agent

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: e82ccf80ecc4171daec56965caa248d9ec71be73
  • Workflow run: 30464188406
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for e82ccf80ecc4171daec56965caa248d9ec71be73.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
Loading

Copy link
Copy Markdown
Contributor

Superseded by #33, which applies the Ruff upgrade together with an explicit stable lint rule set and a regenerated uv.lock. Closing the duplicate.

@seonghobae seonghobae closed this Aug 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/pip/services/account_unification/ruff-0.16.0 branch August 3, 2026 01:43
seonghobae added a commit that referenced this pull request Aug 3, 2026
* build(deps): consolidate account-unification dependency updates and pin ruff rule set

Dependabot opened five PRs (#27-#31) bumping account_unification dependencies,
but each only edited pyproject.toml (or targeted a transitive package) without
regenerating uv.lock, so every one fails `uv sync --locked` on the
account-unification-tests gate ("The lockfile at uv.lock needs to be updated").

Apply all five bumps in one lock-consistent change:

- fastapi 0.139.0 -> 0.140.13 (pulls starlette 1.3.1)
- uvicorn 0.51.0 -> 0.52.0
- ruff 0.15.21 -> 0.16.0 (dev)
- annotated-doc 0.0.4 -> 0.0.5 (transitive)
- annotated-types 0.7.0 -> 0.8.0 (transitive)

ruff 0.16.0 widened its implicit default rule set (adding flake8-bugbear,
pyupgrade, flake8-pyi, flake8-blind-except, RUF100, isort), which surfaced 21
lints on code that previously passed. Pin the classic default select
(["E4","E7","E9","F"]) so the established lint policy stays explicit and stable
across ruff upgrades instead of silently changing on a version bump.

Verified in services/account_unification: `uv sync --locked --extra dev`,
`ruff check app tests tools` (All checks passed), `interrogate .` (100%),
`pytest -q` (52 passed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT

* fix(security): restrict healthcheck URL scheme and resolve Semgrep urllib finding

The org-central "Semgrep (multi-language SAST)" gate reports a real Medium
(WARNING) finding on every keyverse PR, blocking OpenCode approval:

  python.lang.security.audit.dynamic-urllib-use-detected
  services/account_unification/app/healthcheck.py:18 — dynamic value passed to
  urllib.request.urlopen (urllib honours file://, so a caller-controlled URL
  could read arbitrary files).

Mitigate the actual risk by rejecting any non-http(s) scheme before opening the
URL (closes the file:// vector), then annotate the audited call with a narrow,
documented `# nosemgrep` for that single rule. Add a regression test for the
rejected-scheme path. Fixed at base so all open keyverse PRs inherit a clean
SAST gate.

Verified in services/account_unification: `ruff check app tests tools`,
`interrogate .` (100%), `pytest -q`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT

* chore: drop superseded healthcheck changes from dependency PR

* test: drop superseded healthcheck coverage from dependency PR

* build(deps-dev): bump anyio to 4.14.2

Integrate the validated AnyIO lockfile refresh into the consolidated account-unification dependency branch.

* build(deps-dev): bump certifi to 2026.7.22

Integrate the validated certificate bundle lockfile refresh into the consolidated account-unification dependency branch.

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant