[pip] (deps): Bump the dev-dependencies group across 1 directory with 9 updates

[dependabot]

Bumps the dev-dependencies group with 9 updates in the / directory:

Package	From	To
idna	3.19	3.20
urllib3	2.7.0	2.8.0
coverage	7.16.0	7.16.1
filelock	3.32.5	4.0.3
platformdirs	4.11.7	4.11.12
pyright	1.1.411	1.1.414
python-discovery	1.6.0	1.6.1
ruff	0.16.6	0.16.9
virtualenv	21.7.8	21.12.1

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Commits

• d55e65e Release 3.20
• 0c0824a Pre-release 3.20rc0
• bd7c316 Note Python 3.15 support in the 3.20 changelog
• b6cce85 Merge pull request #276 from kjd/unicode-18
• 9a4bc59 Update to Unicode 18.0.0
• dfab5a0 Merge branch 'python-3.15'
• 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
• cd17392 Merge pull request #274 from kjd/fix-decode-length-check
• c5796d7 Skip the decode round-trip check for domains past encode's length limit
• d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
• Additional commits viewable in compare view

Updates urllib3 from 2.7.0 to 2.8.0

Release notes

Sourced from urllib3's releases.

2.8.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Fixed the following security issues:

• The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)
• HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)
• Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)

[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.

Configure proxy CA certificates and client certificates in proxy_ssl_context, and proxy identity checks with proxy_assert_hostname or proxy_assert_fingerprint. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.

[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.

Deprecations & Removals

• Deprecated using an empty collection as the Retry option allowed_methods to retry any verb. (#5044)

Features

• Added Url.auth_decoded and Url.auth_decoded_joined convenience properties to the result of parse_url(). (#4945)
• Added basic_auth_encoding and proxy_basic_auth_encoding parameters to urllib3.util.make_headers(). (#5092)

Bugfixes

• Fixed response header handling to replace obsolete folded header lines (obs-fold) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as Set-Cookie. (#1362)

• Fixed usage of proxy_ssl_context with ProxyManager when use_forwarding_for_https=True. Passing ssl_context instead of proxy_ssl_context for HTTPS proxies in this configuration now emits a FutureWarning and will raise an error in v3.0. (#2577)

• Changed behavior of the default ConnectionPool.pool initialization. LifoQueue is now resolved from the queue module after the ConnectionPool is instantiated instead of using the default cached QueueCls class property. This is done because sometimes the queue.LifoQueue is monkey-patched late in the program, such as by gevent. (#3289)

• Raised UnrewindableBodyError instead of ValueError when retrying a request whose body had tell() but not seek(). (#3779)

• Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (#3785)

• Fixed HTTPResponse.drain_conn() to discard unread response data in 64 KiB chunks (same as the default amt when doing HTTPResponse.stream(...)). (#5019)

• Fixed is_ipaddress() to detect non-standard IPv4 forms accepted by socket.connect, such as hex (0x7f000001), octal (0177.0.0.1), and decimal integers (2130706433), ensuring SSL certificate verification uses the correct mode for these addresses. (#5029)

• Fixed HTTPConnectionPool.urlopen raising a misleading FullPoolError instead of ValueError when called with an invalid timeout argument on a pool created with block=True. (#5059)

• Fixed port-zero handling to preserve explicit :0 values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, connection_from_url(), and HTTP/2 request authority. (#5071, #5101)

• Fixed a bug where PoolManager passed the assert_hostname and assert_fingerprint parameters to HTTP connection pools. (#5077)

• Fixed HTTPConnectionPool.urlopen() and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (#5079)

• Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (#5091)

• Fixed HTTPSConnection.connect() overriding ProxyConfig.ssl_context's certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.

  HTTPSConnection no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its ssl_context as a fallback when an HTTPS proxy forwards an HTTP target. (#5093)

• Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (#5095)

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.8.0 (2026-09-15)

Security

Fixed the following security issues:

• The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77>__)
• HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw>__)
• Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g>__)

.. caution::

urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
Configure proxy CA certificates and client certificates in
proxy_ssl_context, and proxy identity checks with
proxy_assert_hostname or proxy_assert_fingerprint.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.

Deprecations & Removals

• Deprecated using an empty collection as the Retry option allowed_methods to retry any verb. ([#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044>__)

Features

• Added Url.auth_decoded and Url.auth_decoded_joined convenience properties to the result of parse_url(). ([#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945>__)
• Added basic_auth_encoding and proxy_basic_auth_encoding parameters to urllib3.util.make_headers(). ([#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092>__)

Bugfixes

... (truncated)

Commits

• b1d30ab Release 2.8.0
• 9016d7e Skip test_read_chunked_with_trailing_data_does_not_hang for brotlicffi (#5258)
• 9101f58 Fix nox -s docs warning (#5256)
• cd770b0 Merge commit from fork
• ea2ad7b Merge commit from fork
• 0716e31 Fix loading unencrypted client keys with a password in pyOpenSSL (#5255)
• 43c68c8 Test pickling of InvalidChunkLength (#5247)
• 308b279 Share security policy between GitHub and Read the Docs (#5253)
• 53fa073 Add policy on duplicate pull requests (#5252)
• 5f2a6a8 Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (#5232)
• Additional commits viewable in compare view

Updates coverage from 7.16.0 to 7.16.1

Release notes

Sourced from coverage's releases.

7.16.1

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
• Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

Changelog

Sourced from coverage's changelog.

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

• Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

.. _issue 1563: coveragepy/coveragepy#1563 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Commits

• ccbb992 docs: prep for 7.16.1
• 0697ccc chore: make upgrade
• 12f3595 chore: bump docker/setup-qemu-action in the action-dependencies group (#2280)
• 35b58d3 fix: CoverageData.update() can be called twice on an in-memory database. #2279
• 92e1ce9 chore: bump the action-dependencies group with 4 updates (#2278)
• bf07310 build: quote var expansion (actionlint SC2086)
• 3c434f5 quality: use shellcheck-py to get shellcheck in GitHub CI
• 632f397 build: use .txt instead of .pip, even though it's a stupid extension
• ffc6a4a test: only run diff-cover on pull requests
• 33553b3 fix: exclude the case line when an irrefutable case body is excluded (#2269)
• Additional commits viewable in compare view

Updates filelock from 3.32.5 to 4.0.3

Release notes

Sourced from filelock's releases.

4.0.3

What's Changed

• 🐛 fix(api): skip the fork audit hook on CPython <3.12 by @​gaborbernat in tox-dev/filelock#747

Full Changelog: tox-dev/filelock@4.0.2...4.0.3

4.0.2

What's Changed

• docs: create the data directory in the async cache example by @​agammann in tox-dev/filelock#740
• fix: ignore broken sphinx-llm release by @​gaborbernat in tox-dev/filelock#742
• 🐛 fix(api): serialize concurrent transitions on shared locks by @​gaborbernat in tox-dev/filelock#745
• 🐛 fix(async-rw): give each task its own hold by @​gaborbernat in tox-dev/filelock#746

New Contributors

• @​agammann made their first contribution in tox-dev/filelock#740

Full Changelog: tox-dev/filelock@4.0.1...4.0.2

4.0.1

What's Changed

• fix: reject invalid poll_interval before sleep by @​Pitchfork-and-Torch in tox-dev/filelock#739

New Contributors

• @​Pitchfork-and-Torch made their first contribution in tox-dev/filelock#739

Full Changelog: tox-dev/filelock@4.0.0...4.0.1

4.0.0

What's Changed

• 🐛 fix(soft-rw): replace the state mutex with a generation log by @​gaborbernat in tox-dev/filelock#738

Full Changelog: tox-dev/filelock@3.32.7...4.0.0

3.32.7

What's Changed

• Fix final symlink test on musl by @​lprnmns in tox-dev/filelock#737
• 📝 docs: say acquire() falls back to the lock's blocking attribute by @​hxperl in tox-dev/filelock#733

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.4 (2026-09-26)

---

• Hostnames that still differ after their first 253 escaped characters now publish distinct owners, so a soft lock no longer takes another such host's live holder for its own and reclaims its marker. :pr:748

---

4.0.3 (2026-09-23)

---

• Importing filelock on CPython 3.10 or 3.11 no longer makes new threads fail with RuntimeError: Cannot install a trace function while another trace function is being installed under coverage or a debugger. filelock skips its fork-safety audit hook there, so forking from inside a thread's own lock-state transition no longer raises immediately on those versions. :pr:747

---

4.0.2 (2026-09-23)

---

• Concurrent acquire() and release() on a thread_local=False lock no longer leak the OS lock, close a descriptor twice, drop a lease token, or leave a false deadlock after a cross-thread release (:issue:744). :pr:745
• :class:~filelock.AsyncReadWriteLock and :class:~filelock.AsyncSoftReadWriteLock now give each asyncio task its own hold, so tasks sharing one instance no longer enter the write lock together. :pr:746
• Correct the async cache example to create its data directory and clarify automatic creation of lock-file parent directories. :pr:740
• Exclude sphinx-llm 1.1.0 from documentation dependencies because its Markdown builder emits unknown-node warnings. :pr:742

---

4.0.1 (2026-09-19)

---

• poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739

---

4.0.0 (2026-09-17)

---

• The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as

... (truncated)

Commits

• 5283806 Release 4.0.3
• fd10e07 🐛 fix(api): skip the fork audit hook on CPython <3.12 (#747)
• 2d4530f Release 4.0.2
• 6c46312 🐛 fix(async-rw): give each task its own hold (#746)
• fe0e99d 🐛 fix(api): serialize concurrent transitions on shared locks (#745)
• b26beda build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
• 10572ec fix: ignore broken sphinx-llm release (#742)
• 6c10af3 [pre-commit.ci] pre-commit autoupdate (#741)
• 9380408 docs: create the data directory in the async cache example (#740)
• b5016c4 Release 4.0.1
• Additional commits viewable in compare view

Updates platformdirs from 4.11.7 to 4.11.12

Release notes

Sourced from platformdirs's releases.

4.11.12

What's Changed

• docs: preserve nested directories in the migration recipe by @​agammann in tox-dev/platformdirs#553
• fix: ignore broken sphinx-llm release by @​gaborbernat in tox-dev/platformdirs#556
• fix: ignore relative XDG user directory environment variables by @​darrenhuai in tox-dev/platformdirs#554

New Contributors

• @​agammann made their first contribution in tox-dev/platformdirs#553

Full Changelog: tox-dev/platformdirs@4.11.11...4.11.12

4.11.11

What's Changed

• fix: reject app arguments that leave the base directory by @​Pitchfork-and-Torch in tox-dev/platformdirs#552

New Contributors

• @​Pitchfork-and-Torch made their first contribution in tox-dev/platformdirs#552

Full Changelog: tox-dev/platformdirs@4.11.10...4.11.11

4.11.10

What's Changed

• 👷 ci(release): docstrfmt the changelog before committing it by @​gaborbernat in tox-dev/platformdirs#551
• fix: only create the site dirs a call hands back by @​darrenhuai in tox-dev/platformdirs#550

Full Changelog: tox-dev/platformdirs@4.11.9...4.11.10

4.11.9

What's Changed

• fix: read user-dirs.dirs as shell assignments, not INI by @​darrenhuai in tox-dev/platformdirs#545
• fix: accept multipath in the site cache functions by @​darrenhuai in tox-dev/platformdirs#544
• fix: resolve PUBLIC before looking up the user home by @​emme1t in tox-dev/platformdirs#546
• fix: raise RuntimeError when the Android app folder is missing by @​Str0k in tox-dev/platformdirs#547

New Contributors

• @​emme1t made their first contribution in tox-dev/platformdirs#546
• @​Str0k made their first contribution in tox-dev/platformdirs#547

Full Changelog: tox-dev/platformdirs@4.11.8...4.11.9

4.11.8

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.12.0 (2026-09-26)

---

• Add place_*_file methods that return a file path under a user directory and create its missing parents with mode 0o700. :pr:585
• Add find_<kind>_file and find_<kind>_files to look up an existing file across the user and site directories of each kind that has an iter_<kind>_paths method. :pr:586
• Add :func:platformdirs.testing.isolated_dirs and the platformdirs_isolated pytest fixture to resolve every directory under one test root. :pr:590
• Emit :class:~platformdirs.RuntimeDirWarning when the Unix :func:~platformdirs.user_runtime_dir falls back from XDG_RUNTIME_DIR. :pr:599
• Read user_templates_dir, user_publicshare_dir and user_bin_dir on Windows from their known folders. :pr:587
• Create missing user app directories and their parents with mode 0700 under ensure_exists on POSIX platforms. :pr:588
• Raise RuntimeError for a Unix or macOS directory under the home when no home resolves, and read the password database for an empty HOME. :pr:589
• Skip an XDG_RUNTIME_DIR or /run/user/<uid> that is not a private directory of the user, and reject a symlink or file as the runtime-<uid> fallback. :pr:599
• Use the app container layout on iOS, such as ~/Library/Application Support for data. :pr:600
• Document that a Homebrew Python puts the Homebrew prefix first in the macOS shared directories, with or without multipath. :pr:591
• Document that the macOS media directories honor the XDG_*_DIR variables. :pr:592
• Document the WIN_PD_OVERRIDE_COMMON_PROGRAMS variable. :pr:593
• Document /usr/local/share/applications as the Linux site_applications_dir default. :pr:594
• Correct the BSD user_runtime_dir defaults and describe the temporary directory fallback. :pr:595
• Describe how platformdirs detects Android, finds the app folder and places the shared folders. :pr:596
• Document that Microsoft Store Python redirects only new files and folders under AppData. :pr:597
• Show how to load a font on Windows after copying it into user_fonts_dir. :pr:598

---

4.11.15 (2026-09-26)

---

• Fix the pyjnius lookup of the Android app folder and media directories, which always failed. :pr:580
• Detect Android from sys.getandroidapilevel when ANDROID_DATA and ANDROID_ROOT are unset. :pr:581
• Put Android shared-storage directories under the current user's /storage/emulated/, not user 0's. :pr:582
• Move Android videos to Movies and the five non-standard media folders, such as Desktop, into Documents. :pr:583

---

... (truncated)

Commits

• 0975949 Release 4.11.12
• f0f5667 fix: ignore relative XDG user directory environment variables (#554)
• 1f944d0 fix: ignore broken sphinx-llm release (#556)
• 3e2e590 [pre-commit.ci] pre-commit autoupdate (#555)
• 897097b docs: preserve nested directories in the migration recipe (#553)
• 321e35a Release 4.11.11
• 902c268 fix: reject app arguments that leave the base directory (#552)
• 35391fc Release 4.11.10
• 7d5c85d fix: only create the site dirs a call hands back (#550)
• 5118d32 👷 ci(release): docstrfmt the changelog before committing it (#551)
• Additional commits viewable in compare view

Updates pyright from 1.1.411 to 1.1.414

Commits

• 1aa6dfe Pyright NPM Package update to 1.1.414 (#370)
• 5ecb4df tests: retry network tests (#369)
• 978501b chore: bump timeout for pylance version check
• 474b7be Pyright NPM Package update to 1.1.413 (#365)
• 4502e5d ci: auto merge version bumps (#368)
• f9a9a6e [pyright updated to 1.1.412] Update Version (#364)
• See full diff in compare view

Updates python-discovery from 1.6.0 to 1.6.1

Release notes

Sourced from python-discovery's releases.

v1.6.1

What's Changed

• 📄 docs(py_info): cover system_exe in all four dimensions by @​gaborbernat in tox-dev/python-discovery#128
• 🐛 fix(discovery): skip empty PATH entries by @​gaborbernat in tox-dev/python-discovery#132

Full Changelog: tox-dev/python-discovery@1.6.0...1.6.1

Changelog

Sourced from python-discovery's changelog.

Bug fixes - 1.6.1

• Skip empty PATH entries during interpreter discovery - by :user:gaborbernat. (:issue:129)

Improved documentation - 1.6.1

• Document :attr:~python_discovery.PythonInfo.system_exe across the tutorial, the how-to guide and the explanation of how resolution reaches a base interpreter. The class diagram in the how-to guide had :attr:~python_discovery.PythonInfo.system_executable typed str rather than str | None - by :user:gaborbernat. (:issue:128)

---

v1.6.0 (2026-08-28)

---

Commits

• 2689028 release 1.6.1
• 5d64819 🐛 fix(discovery): skip empty PATH entries (#132)
• 4df3120 [pre-commit.ci] pre-commit autoupdate (#131)
• 51d87b6 [pre-commit.ci] pre-commit autoupdate (#130)
• 91154df [pre-commit.ci] pre-commit autoupdate (#129)
• cbf85fc 📄 docs(py_info): cover system_exe in all four dimensions (#128)
• See full diff in compare view

Updates ruff from 0.16.6 to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#28699)
• Update rules table with category information (#28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#28509)
• [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
• [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

• @​qinpei-dev
• @​sanjayrohith
• @​ntBre
• @​webdevsamran
• @​zaniebot
• @​ewdurbin
• @​MichaReiser
• @​spaceone
• @​IbrahimKhan12
• @​devtechedge
• @​GruffElixir

Install ruff 0.16.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#28699)
• Update rules table with category information (#28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#28509)
• [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
• [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

• @​qinpei-dev
• @​sanjayrohith
• @​ntBre
• @​webdevsamran
• @​zaniebot
• @​ewdurbin
• @​MichaReiser
• @​spaceone
• @​IbrahimKhan12
• @​devtechedge
• @​GruffElixir

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)

... (truncated)

Commits

• 0be08a2 Bump version to 0.16.9 (#28882)
• b4920b7 Rename ruff_cli to ruff_command_line (#28881)
• 47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
• 8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
• 5edf5a1 Use target form in rooster.version_files (#28876)
• 915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
• 4710e1a ci(github): update version number in placeholder of issue template (#28871)
• eedfc62 [ty] Propagate outer type context through cast calls (#28855)
• ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
• dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
• Additional commits viewable in compare view

Updates virtualenv from 21.7.8 to 21.12.1

Release notes

Sourced from virtualenv's releases.

21.12.1

What's Changed

• 🐛 fix(create): limit .venv redirect to projects by @​gaborbernat in pypa/virtualenv#3316

Full Changelog: pypa/virtualenv@21.12.0...21.12.1

21.12.0

What's Changed

• ✨ feat(create): point a .venv redirect per PEP 832 by @​gaborbernat in pypa/virtualenv#3204

Full Changelog: pypa/virtualenv@21.11.1...21.12.0

21.11.1

What's Changed

• 📝 docs(security): close threat items resolved by 21.11.0 by @​gaborbernat in pypa/virtualenv#3313
• 🐛 fix(build): ship test inputs in the sdist and check it by @​Gonghan-Princess in pypa/virtualenv#3315

New Contributors

• @​Gonghan-Princess made their first contribution in pypa/virtualenv#3315

Full Changelog: pypa/virtualenv@21.11.0...21.11.1

21.11.0

What's Changed

• ci(pre-release): disable the uv cache by @​gaborbernat in pypa/virtualenv#3288
• ci: pass expressions to run scripts via env by @​gaborbernat in pypa/virtualenv#3292
• ci(release): audit egress in build and publish by @​gaborbernat in pypa/virtualenv#3289
• 📝 docs: define maintainer roles and access by @​gaborbernat in pypa/virtualenv#3290
• ci: resolve zizmor auditor findings by @​gaborbernat in pypa/virtualenv#3297
• ci(pre-commit): freeze hook revs to commit SHAs by @​gaborbernat in pypa/virtualenv#3298
• docs: link docs and pyvideo over https by @​gaborbernat in pypa/virtualenv#3300
• docs(development): add a one-year roadmap by @​gaborbernat in pypa/virtualenv#3304
• 🐛 fix(seed): fail closed when PyPI digest is unknown by @​gaborbernat in pypa/virtualenv#3302
• ✨ feat(release): publish SBOMs as release assets by @​gaborbernat in pypa/virtualenv#3299
• docs(security): describe the project under the CRA by @​gaborbernat in pypa/virtualenv#3295
• docs(template): name the trust boundary crossed by @​gaborbernat in pypa/virtualenv#3296
• ♻️ refactor(sbom): type the SPDX renderer by @​gaborbernat in pypa/virtualenv#3307
• ✨ feat(zipapp): publish an SBOM for the zipapp by @​gaborbernat in pypa/virtualenv#3310
• 👷 ci(check): pin test tool downloads and bump them weekly by @​gaborbernat in pypa/virtualenv#3293
• 📝 docs: explain what a release publishes and how to verify it by @​gaborbernat in pypa/virtualenv#3305

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.12.1

• Limit the :PEP:832 .venv redirect to folders holding a pyproject.toml and no .venv yet, so virtualenv foo in a scratch folder, and tools such as tox or nox building environments through virtualenv, no longer claim a folder's default environment - by :user:gaborbernat.

  • --venv-redirect writes the redirect in any folder and replaces an earlier virtualenv redirect.
  • A flag on the command line overrides the environment variable and the config file in either direction. (:issue:3316)

---

v21.12.0 (2026-09-24)

---

Features - 21.12.0

• Write the PEP 838 <https://peps.python.org/pep-0838/>_ python-version key into pyvenv.cfg, holding the target interpreter's feature release. The new :doc:reference/files page covers it alongside every other file a created environment holds - by :user:konstin. (:issue:3193)

• Point a .venv redirect file in the parent folder at the created environment, per PEP 832 <https://peps.python.org/pep-0832/>_, so editors and type checkers can find it - by :user:gaborbernat.

  • virtualenv leaves a .venv folder alone, and a redirect pointing at an environment it did not create.
  • Pass --no-venv-redirect to opt out.
  • The feature is provisional while PEP 832 is a draft: a minor or patch release may change it in backward incompatible ways to follow the PEP. (:issue:3204)

---

v21.11.1 (2026-09-23)

---

Bugfixes - 21.11.1

• Include the pre-commit configuration and the zipapp lock file in the source distribution, so downstream packagers can run the test suite from it. (:issue:3314)

---

v21.11.0 (2026-09-23)

---

Features - 21.11.0

• Attach the CycloneDX SBOM and an SPDX 2.3 rendering of it (virtualenv.cdx.json, virtualenv.spdx.json) to each GitHub release, and attest the SPDX document against the sdist and wheel. (:issue:3299)
• Describe the zipapp in its own CycloneDX SBOM, which lists virtualenv, the embedded pip ...

  Description has been truncated

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.