chore(deps): update python dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ruff (source, changelog)	0.16.3 → 0.16.7
semver (changelog)	3.0.4 → 3.1.0

---

Release Notes

astral-sh/ruff (ruff)

v0.16.7

Compare Source

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#​26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#​28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#​28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#​27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#​26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#​28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#​28444)
• Recognize slice and frozendict generics (#​28477)
• Stop defining __cached__ for Python 3.15 (#​28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#​28475)

Performance

• Reuse parser name lookups when interning (#​28399)
• Speed up inherited configuration resolution (#​28299)

Documentation

• Fix line-length path in --config example (#​28392)
• Remove the "Who’s Using Ruff?" list (#​28455)

Other changes

• Embed archive checksums in the shell installer (#​28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879
• @​jonathandung
• @​jogo-openai

v0.16.6

Compare Source

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#​28219)
• [flake8-pytest-style] Add an autofix for PT020 (#​27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#​28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#​27313)

Bug fixes

• Validate unary expressions when parsing (#​28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#​28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#​27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#​28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#​27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#​27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#​28027)

Documentation

• Add another example and glob reference for lint.per-file-ignores (#​28106)
• Add duplicate work guidance (#​28229)
• [flake8-async] Document thread offloading (ASYNC240) (#​28008)
• [pyupgrade] Clarify default encoding argument handling (UP012) (#​27315)

Other changes

• Allow unary plus in match patterns on Python 3.15 (#​28231)

Contributors

• @​flying-sheep
• @​pikammmmm
• @​fly1d
• @​waterWang
• @​Pierre-Sassoulas
• @​ntBre
• @​jelle-openai
• @​ericbuehl
• @​tjkuson
• @​AbhinavMir
• @​Whning0513
• @​chirizxc

v0.16.5

Compare Source

Released on 2026-08-27.

Preview features

• Allow rules without codes (#​28049)
• Introduce category selectors (#​27666)
• Update preview default rules and categories (#​27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#​28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#​28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#​28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#​27978)

Documentation

• Document rule acceptance guidelines (#​27910)
• Document the new category selectors (#​27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

v0.16.4

Compare Source

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#​26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#​27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#​27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#​27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#​27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#​27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#​27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#​27753)
• [syntax-errors] Detect duplicate keyword arguments (#​17804)
• [syntax-errors] Detect parameters declared nonlocal (#​27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#​27807)
• Support pull diagnostics for notebook cells (#​27779)

Documentation

• Add default indicator to rules table (#​27724)
• Fix broken link to Python docs (#​27757)

Other changes

• Fix s390x stacker assembly in release builds (#​27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#​25464)
• Reduce configuration deserialization code size (#​27924)
• Check packed AST index bounds (#​27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot
• @​ewdurbin
• @​woodruffw
• @​Sacrimento
• @​lakshayxi
• @​WhiteFox0-0
• @​baltasarblanco

python-semver/python-semver (semver)

v3.1.0

Compare Source

=============

:Released: 2026-09-12
:Maintainer: Tom Schraitle

Bug Fixes

• :pr:478: Version.parse() and Version.is_valid() now reject non-ASCII digits and
  trailing newlines, in accordance with the SemVer grammar. Optional minor and
  patch parsing applies the same character restrictions.

• :pr:479: Comparing a :class:~semver.Version with a dict, tuple, or list that cannot construct a valid version (for example, an empty collection, wrong number of parts, non-numeric parts, or unknown keys) no longer raises internal errors from Version.__init__. The comparison operators now return :py:const:NotImplemented for such operands, following the general rule for invalid comparison operand types: equality evaluates to False and ordering raises Python's standard :py:exc:TypeError (for example, '>' not supported between instances of 'Version' and 'dict').

• :pr:480: (:meth:~semver.version.Version.bump_build) will now add .0 to an existing build when the last segment of the current build metadata, split by dots (.), is not numeric. This is to ensure the bumped version contains a raised build instead of silently returning an unchanged version. For example, 1.2.3+alpha is bumped to 1.2.3+alpha.0. This mirrors the corresponding fix for the prerelease part (:gh:460). Related to :gh:466.

• :gh:460: :meth:~semver.version.Version.bump_prerelease will now add .0 to an
  existing prerelease when the last segment of the current prerelease, split by
  dots (.), is not numeric. This is to ensure the new prerelease is considered
  higher than the previous one.

  :meth:~semver.version.Version.bump_prerelease now also support an argument
  bump_when_empty which will bump the patch version if there is no existing
  prerelease, to ensure the resulting version is considered a higher version than
  the previous one.

Features

• :pr:476: Added optional [native] extra to accelerate parsing on CPython via the
  fast-semver-rs-backend package. The pure-Python parser remains the default;
  the native backend is opt-in and only available on CPython.

Internal Changes

: Update GitHub Actions for astral-sh/setup-uv (version 0.10.1), github/codeql-action (version 4)

Trivial Changes

• :gh:463: Remove double code in :meth:Version.bump_build

: Improve test coverage to 100% by ignoring the optional Rust backend fallback.

: Improve test suite for comparisons and fix test coverage.

: Suppress deprecation warnings in test suite.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Unifex]

@G-Rath, This one LGTM, but with your other Ruff related PRs I'll leave this for you to click merge on.

[Unifex]

patch level bump.

LGTM