chore(deps): update all non-major dependencies by khepri-bot[bot] · Pull Request #51 · gordon-code/cuid2

khepri-bot · 2026-09-28T05:34:20Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
astral-sh/setup-uv	action	minor	`v10.0.1` → `v10.1.0`	`v10.2.0`
github/codeql-action	action	minor	`v4.37.9` → `v4.38.1`	`v4.38.2`
ruff (source, changelog)	dependency-groups	patch	`==0.16.6` → `==0.16.8`	`0.16.10` (+1)
tox (changelog)	dependency-groups	minor	`==4.61.2` → `==4.63.0`	`4.64.8` (+8)

Release Notes

astral-sh/setup-uv (astral-sh/setup-uv)

`v10.1.0`: 🌈 New output `python-runtime-id`and respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output `python-runtime-id`

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

fix: respect no proxy directive @mj0nez (#1037)
Use JSON + a typed wrapper instead of TS codegen @woodruffw (#1025)

🚀 Enhancements

Expose a Python "identity" output @woodruffw (#1036)
Verify downloads with astral-sh/versions checksums @zaniebot (#1033)

🧰 Maintenance

chore: update known checksums for 0.12.12 @github-actions[bot] (#1041)
chore: update known checksums for 0.12.10/0.12.11 @github-actions[bot] (#1038)
chore: update known checksums for 0.12.9 @github-actions[bot] (#1035)
chore: update known checksums for 0.12.7/0.12.8 @github-actions[bot] (#1031)
chore: update known checksums for 0.12.6 @github-actions[bot] (#1030)
chore: update known checksums for 0.12.5 @github-actions[bot] (#1020)
Use self-repo syntax for all in-repo actions/reusable workflows @woodruffw (#1024)
Pin one-shot tools @woodruffw (#1022)
ci: remove obsolete direct push attempts @eifinger (#1019)

📚 Documentation

docs: update version references to v10.0.1 @github-actions[bot] (#1018)

⬆️ Dependency updates

chore(deps-dev): roll up Dependabot updates @eifinger (#1043)
Harden npm install defaults @zaniebot (#1026)
Add dependency cooldowns @woodruffw (#1021)

github/codeql-action (github/codeql-action)

`v4.38.1`

Compare Source

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

`v4.38.0`

Compare Source

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
Update default CodeQL bundle version to 2.27.0. #4129

astral-sh/ruff (ruff)

`v0.16.8`

Compare Source

Released on 2026-09-16.

Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)
[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
[flake8-simplify] Preserve operand order in SIM109 fix (#27824)
[pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
[pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

Add support for __lazy_modules__ (#28459)
Recognize PEP-728 TypedDict class keywords (#28533)
Recognize quoted types in typing.TypeForm (#28507)
Support conditional assignment to __lazy_modules__ (#28491)
[flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
[pyupgrade] Make the fix for UP040 always unsafe (#28526)
[pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
[ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
[ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

[flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

`v0.16.7`

Compare Source

Released on 2026-09-10.

Preview features

[ruff] Add rule for default values on method receivers (RUF077) (#26700)
[ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

Alternate nested quotes inside format spec interpolations (#28259)
[flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
[flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
[pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

Correct D211 and D203 rule conflict diagnostic (#28444)
Recognize slice and frozendict generics (#28477)
Stop defining __cached__ for Python 3.15 (#28476)
[pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

Reuse parser name lookups when interning (#28399)
Speed up inherited configuration resolution (#28299)

Documentation

Fix line-length path in --config example (#28392)
Remove the "Who’s Using Ruff?" list (#28455)

Other changes

Embed archive checksums in the shell installer (#28281)

Contributors

tox-dev/tox (tox)

`v4.63.0`

Compare Source

What's Changed

🐛 fix(run): keep package env interrupt logs in parallel by @gaborbernat in #4079
🐛 fix(extras): dedupe static extras resolution and other copies by @gaborbernat in #4080

Full Changelog: tox-dev/tox@4.62.1...4.63.0

`v4.62.1`

Compare Source

What's Changed

test: skip POSIX-venv wheel-build tests on Windows by @iam-kira in #4078
fix(config): clear markers overridden by unconditional set_env values by @jakezwang in #4077

New Contributors

@iam-kira made their first contribution in #4078
@jakezwang made their first contribution in #4077

Full Changelog: tox-dev/tox@4.62.0...4.62.1

`v4.62.0`

Compare Source

What's Changed

🐛 fix(type): pass the latest ty and close Any gaps by @gaborbernat in #4075
🐛 fix(config): honor an empty TOX_FACTOR override by @gaborbernat in #4074

Full Changelog: tox-dev/tox@4.61.5...4.62.0

`v4.61.5`

Compare Source

What's Changed

chore(type): narrow execute_async cwd for pyrefly 1.3 by @yuefdev in #4069
docs: fix the parameter list on Loader.build by @hxperl in #4070
fix(config): reject boolean TOML range bounds by @yuefdev in #4066
fix(config): accept empty set_env lists by @yuefdev in #4065
fix: correct coverage startup environment variable by @yuefdev in #4067
fix(config): let empty factor fallbacks override TOML group defaults by @glaziermag in #4072

New Contributors

@yuefdev made their first contribution in #4069
@hxperl made their first contribution in #4070
@glaziermag made their first contribution in #4072

Full Changelog: tox-dev/tox@4.61.4...4.61.5

`v4.61.4`

Compare Source

What's Changed

🐛 fix(execute): keep spaces in quoted shebang interpreter paths by @r3wretrhy in #4064

New Contributors

@r3wretrhy made their first contribution in #4064

Full Changelog: tox-dev/tox@4.61.3...4.61.4

`v4.61.3`

Compare Source

What's Changed

📝 docs: name the actor across the factor and override prose by @gaborbernat in #4058
🐛 fix(config): read a set_env file as UTF-8 by @MohammedAlkindi in #4059
fix(config): register bare env_list factor labels by @dylanpulver in #4062
fix(config): preserve Windows UNC paths by @MohammedAlkindi in #4060
fix(tox_env): normalize dependency extra names by @MohammedAlkindi in #4061

Full Changelog: tox-dev/tox@4.61.2...4.61.3

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

khepri-bot Bot added the renovate label Sep 28, 2026

khepri-bot Bot requested a review from a team September 28, 2026 05:34

khepri-bot Bot force-pushed the renovate/all-non-major-dependencies branch 5 times, most recently from d10b741 to 3716eee Compare October 3, 2026 16:31

chore(deps): update all non-major dependencies

c0dff2f

khepri-bot Bot force-pushed the renovate/all-non-major-dependencies branch from 3716eee to c0dff2f Compare October 3, 2026 21:26

Navigation Menu

chore(deps): update all non-major dependencies - #51

chore(deps): update all non-major dependencies#51
khepri-bot[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major-dependencies

khepri-bot Bot commented Sep 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

khepri-bot Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Changes

NO_PROXY

New output python-runtime-id

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

Bug fixes

Rule changes

CLI

Configuration

Contributors

Preview features

Bug fixes

Rule changes

Performance

Documentation

Other changes

Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

khepri-bot Bot commented Sep 28, 2026 •

edited

Loading

`v10.1.0`: 🌈 New output `python-runtime-id`and respect NO_PROXY

New output `python-runtime-id`