deps: bump ruff from 0.15.22 to 0.16.0

[dependabot]

Bumps ruff from 0.15.22 to 0.16.0.

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: deps. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[helebest]

Code Review — ruff 0.15.22 → 0.16.0

Consistency: PR description accurately reflects the diff — pyproject.toml and uv.lock bump the ruff dev dependency floor from >=0.15.22 to >=0.16.0, and the lock's resolved ruff entry moves accordingly. No other files touched.

Correctness: ruff is a dev-only lint/format tool, not a runtime dependency of any published package.

Security: No CVEs called out in this release.

Breaking-change assessment: The headline breaking change in 0.16.0 is that Ruff's default lint rule set expands from 59 to 413 rules. That would normally be a real risk for a CI gate built on ruff check .. However, this repo pins an explicit rule selection in pyproject.toml:

[tool.ruff.lint]
select = ["E", "F", "W", "I", "UP", "B", "SIM", "C4", "RUF"]

Since select overrides Ruff's default rule set entirely, the expanded defaults have no effect here — confirmed empirically below.

Effectiveness: Achieves the stated purpose with no net-new lint findings.

Test coverage: Tooling version bump — no new test cases needed.

Regression verification

Ran the full local check suite (mirroring CI) against this branch:

• uv lock --locked — lockfile in sync ✅
• uv sync --all-packages --all-extras — resolves cleanly ✅
• uv run ruff check . (ruff 0.16.0) — all checks passed, same as before the bump ✅
• uv run mypy packages/*/src — no issues in 14 source files ✅
• uv run pytest -v --ignore=tests/packaging — 107 passed ✅
• uv run pytest tests/packaging -v — 27 passed ✅
• uv build --all-packages — all three packages built successfully ✅

Note: uv run ruff format --check . does flag drift under 0.16.0, but I confirmed the same files are already unformatted under 0.15.22 on main (19/27 files) — this is pre-existing drift, not a regression from this bump, and ruff format --check is not part of the CI gate (only ruff check . runs in ci.yml). No action needed for this PR.

No regressions found. Proceeding to monitor CI, then squash-merge if green.

---

Generated by Claude Code

[helebest]

Automated review: ruff 0.15.22 → 0.16.0

Consistency: PR description matches the diff — a single dev-dependency bump in pyproject.toml (ruff>=0.15.22 → ruff>=0.16.0) with the corresponding uv.lock update. No other files touched.

Correctness: ruff is a dev-only lint/format tool; no plugin/runtime code depends on it.

Security / breaking changes: Reviewed the 0.16.0 release notes. The headline breaking change is that Ruff now enables ~413 default lint rules (up from 59), with 18 opinionated pycodestyle/pyflakes rules dropped from the default set. This repo is not affected by that expansion: pyproject.toml's [tool.ruff.lint] uses an explicit select = ["E", "F", "W", "I", "UP", "B", "SIM", "C4", "RUF"], which overrides Ruff's default rule set entirely — the new defaults never come into play. Ruff also now formats Python code blocks in Markdown by default; this only affects ruff format, which is not run in CI (.github/workflows/ci.yml only runs ruff check .). No CVEs in this release.

Effectiveness: Achieves the stated purpose — ruff pinned at a current version.

Test coverage: No functional code changed; nothing new to cover.

Verification performed

• uv sync --all-packages --all-extras — resolves cleanly, ruff==0.16.0 installed.
• uv run ruff check . — All checks passed (no new violations from the version bump, confirming the explicit select list insulates us from the expanded default rule set).
• uv run pytest (full suite) — 134 passed.
• uv run mypy packages/*/src — no issues found.
• Noted for information only (not a CI gate): ruff format --check . now flags 21 files vs. 19 pre-existing on 0.15.22 — this repo was already not 100% ruff format-clean before this bump, and format-checking isn't part of the CI pipeline, so this doesn't block the bump. Worth a follow-up if the team wants ruff format --check added to CI.
• CI (test (3.12), test (3.13), CodeQL analyze) — all green.

Decision

All gates pass. Proceeding to squash merge.

---

Generated by Claude Code

[helebest]

Update: Dependabot auto-rebase + re-verification

After #33 (twine bump) merged to main, this PR briefly conflicted (mergeable_state: dirty). Dependabot auto-rebased onto the new main (new head 239a5bb). Re-ran the full local check suite against the rebased commit to be safe:

• uv lock --locked ✅
• uv sync --all-packages --all-extras ✅
• uv run ruff check . (ruff 0.16.0) — all checks passed ✅
• uv run mypy packages/*/src — no issues ✅
• uv run pytest -q --ignore=tests/packaging — 107 passed ✅
• uv run pytest tests/packaging -q — 27 passed ✅
• uv build --all-packages — all three packages built ✅

CI Status

All required checks are green on 239a5bb:

• test (3.12) ✅
• test (3.13) ✅
• CodeQL analyze ✅
• CodeQL ✅

Decision

Review, regression verification, and CI are all clean on the rebased commit. Proceeding with squash merge.

---

Generated by Claude Code