deps(uv): bump the uv-minor-patch group with 26 updates

[dependabot]

Bumps the uv-minor-patch group with 26 updates:

Package	From	To
fastapi	0.142.2	0.143.0
pycparser	3.0	3.11
pypdf	6.19.0	6.20.0
sqlalchemy	2.1.3	2.1.4
pymssql	2.4.2	2.4.3
fastavro	1.12.2	1.13.1
opentelemetry-api	1.45.0	1.45.1
opentelemetry-sdk	1.45.0	1.45.1
opentelemetry-exporter-otlp	1.45.0	1.45.1
opentelemetry-instrumentation-fastapi	0.66b0	0.66b1
opentelemetry-instrumentation-sqlalchemy	0.66b0	0.66b1
opentelemetry-instrumentation-logging	0.66b0	0.66b1
hypothesis	6.168.4	6.168.5
iniconfig	2.3.0	2.3.1
ruff	0.16.10	0.17.0
ast-serialize	0.11.2	0.12.1
cbor2	6.1.4	6.1.5
coverage	7.16.1	7.16.2
fqdn	1.5.1	1.6.0
identify	2.6.19	2.6.20
jsonpointer	3.1.1	3.2.0
nodeenv	1.10.0	1.11.0
platformdirs	4.11.11	4.12.4
soupsieve	2.9.2	2.10
tzdata	2026.4	2026.5
virtualenv	21.9.0	21.14.6

Updates fastapi from 0.142.2 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

• 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

• 🐛 Isolate FastAPI telemetry for excluded requests. PR #16470 by @​tiangolo.

0.142.3

Fixes

• 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

• 📝 Remove HTML title from newsletter to avoid the tooltip. PR #16461 by @​tiangolo.
• 📝 Embed the FastAPI and friends newsletter signup form. PR #16459 by @​tiangolo.
• 📝 Update skill, use Asyncer for blocking code in threads. PR #16420 by @​tiangolo.

Translations

• 🌐 Update translations for fr (add-missing). PR #16436 by @​pr-submit[bot].
• 🌐 Update translations for hi (add-missing). PR #16435 by @​pr-submit[bot].
• 🌐 Update translations for tr (add-missing). PR #16434 by @​pr-submit[bot].
• 🌐 Update translations for zh (add-missing). PR #16433 by @​pr-submit[bot].
• 🌐 Update translations for zh-hant (add-missing). PR #16432 by @​pr-submit[bot].
• 🌐 Update translations for pt (add-missing). PR #16431 by @​pr-submit[bot].
• 🌐 Update translations for de (add-missing). PR #16430 by @​pr-submit[bot].
• 🌐 Update translations for uk (add-missing). PR #16429 by @​pr-submit[bot].
• 🌐 Update translations for ja (add-missing). PR #16428 by @​pr-submit[bot].
• 🌐 Update translations for ko (add-missing). PR #16425 by @​pr-submit[bot].
• 🌐 Update translations for es (add-missing). PR #16426 by @​pr-submit[bot].
• 🌐 Update translations for ru (add-missing). PR #16427 by @​pr-submit[bot].
• 🌐 Update Russian LLM-prompt. PR #16449 by @​YuriiMotov.

Internal

• 👷 Fix deprecated command in bump-pre-commit-hooks workflow. PR #16463 by @​YuriiMotov.
• 🔧 Update sponsors: remove Render. PR #16457 by @​tiangolo.
• 🔨 Use gpt-6-astra model for translations. PR #16453 by @​YuriiMotov.
• ⬆ Bump the python-packages group across 1 directory with 14 updates. PR #16447 by @​dependabot[bot].
• ⬆ Bump starlette from 1.6.0 to 1.7.0. PR #16440 by @​dependabot[bot].
• ⬆ Bump pyjwt from 2.13.0 to 2.15.0. PR #16423 by @​dependabot[bot].
• ⬆ Bump gitpython from 3.1.60 to 3.1.62. PR #16444 by @​dependabot[bot].

... (truncated)

Commits

• f5c6e9b 🔖 Release version 0.143.0 (#16477)
• 182c8b8 📝 Update release notes
• af889e4 💥 Require opt-in for automatic OpenTelemetry exporter setup (#16476)
• 9269f17 🔖 Release version 0.142.4 (#16471)
• 78ede01 📝 Update release notes
• 4e31a07 🐛 Isolate FastAPI telemetry for excluded requests (#16470)
• cb8dabc 🔖 Release version 0.142.3 (#16469)
• 787dc56 📝 Update release notes
• 6eae2f3 🐛 Cache OpenTelemetry tracers to preserve warning deduplication (#16468)
• 94918c1 📝 Update release notes
• Additional commits viewable in compare view

Updates pycparser from 3.0 to 3.11

Release notes

Sourced from pycparser's releases.

release_v3.11

Enhanced C11 support

Full Changelog: eliben/pycparser@release_v3.01...release_v3.11

release_v3.01

What's Changed

• Drop an unneeded direct build depndency on wheel by @​hroncok in eliben/pycparser#597
• fix: handle integer suffix in #line directive without crashing by @​SAY-5 in eliben/pycparser#601
• Update default branch to main by @​myd7349 in eliben/pycparser#602
• fix: raise ParseError instead of AssertionError on unmatched '}' by @​patchwright in eliben/pycparser#604
• Add support for Python 3.15 by @​kytta in eliben/pycparser#605
• Fix empty compound literal (type){} raising ParseError by @​IMGillusion in eliben/pycparser#606
• Fix compound literal statements in C generator by @​Rayan-and-beyond in eliben/pycparser#607
• Keep the contents of adjacent u8 string literals by @​SashaMIT in eliben/pycparser#609

Full Changelog: eliben/pycparser@release_v3.00...release_v3.01

Commits

• ccb3439 Prepare for release 3.11
• 1d31981 Fix concatenation escapes
• dbcd5fd Add missing fake types
• 8bc38aa Fix dropped specifiers in lists
• 17da57c Fix generation of _Alignas and _Atomic
• 61f979c Add C11's fake headers and some tests
• dfbe88b Fix unicode escapes
• 74588ec Unify string literal parsing
• 7adecd5 Fix implementation of _Static_assert
• b7f48c8 C generation for _Generic
• Additional commits viewable in compare view

Updates pypdf from 6.19.0 to 6.20.0

Release notes

Sourced from pypdf's releases.

Version 6.20.0, 2026-10-09

What's new

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173) by @​stefan6419846

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168) by @​stefan6419846

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164) by @​marshalltech81
• Parse numbers, indirect references, names and nulls faster (#4148) by @​MartinThoma
• Do not inherit PdfObject from a Protocol (#4149) by @​MartinThoma
• Speed up cloning direct objects (#4152) by @​MartinThoma

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154) by @​pasmud
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151) by @​metsw24-max

Robustness (ROB)

• Multiple changes by @​RavSinghChandan
• Accept an %%EOF marker that is not at the start of a line (#4136) by @​Dmao233
• Font / _cmapy.py: More robust guards around fontTools (#4157) by @​PJBrs
• Flatten the page tree iteratively (#4107) by @​MartinThoma
• Ignore invalid character codes for TrueType and Type1 font widths (#4117) by @​stefan6419846
• Restrict values to allowed range in CCITTFaxDecode (#4115) by @​stefan6419846
• Drop a /Kids entry resolving to null instead of raising a cycle error (#4108) by @​MartinThoma

Developer Experience (DEV)

• Declare official support for Python 3.15 by @​stefan6419846
• Declare protocol data members on PdfReader and PdfWriter (#4106) by @​ihsandeniz

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.20.0, 2026-10-09

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173)

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168)

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164)
• Parse numbers, indirect references, names and nulls faster (#4148)
• Do not inherit PdfObject from a Protocol (#4149)
• Speed up cloning direct objects (#4152)

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154)
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151)

Robustness (ROB)

• Accept an %%EOF marker that is not at the start of a line (#4136)
• Font / _cmapy.py: More robust guards around fontTools (#4157)
• Flatten the page tree iteratively (#4107)
• Ignore invalid character codes for TrueType and Type1 font widths (#4117)
• Restrict values to allowed range in CCITTFaxDecode (#4115)
• Drop a /Kids entry resolving to null instead of raising a cycle error (#4108)

Developer Experience (DEV)

• Declare official support for Python 3.15
• Declare protocol data members on PdfReader and PdfWriter (#4106)

Full Changelog

Commits

• 0309ab7 REL: 6.20.0
• 80a84d4 SEC: Limit work per stream (filter count, accumulated decoding work) (#4173)
• 4c20fa8 DEV: Declare official support for Python 3.15
• c64a4e4 ROB: Skip a Tj operator whose operand is not a string (#4171)
• 4714175 MAINT: Fix A001 (Variable is shadowing a Python builtin) (#4167)
• 921d778 ROB: Accept an %%EOF marker that is not at the start of a line (#4136)
• 1a6b050 ROB: Skip a TJ operator whose operand is not an array (#4166)
• 5b6a77a PI: Parse an embedded CFF font program once per stream (#4164)
• 79423c1 PI: Parse numbers, indirect references, names and nulls faster (#4148)
• 37e1cd6 ROB: Handle EOF when reading standard xref table (#4170)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.1.3 to 2.1.4

Release notes

Sourced from sqlalchemy's releases.

2.1.4

Released: October 7, 2026

orm

• [orm] [bug] [regression] Fixed regression caused by #13333 where assigning a MetaData object to the metadata attribute of a mapped Declarative class, in order to place that class's Table in a MetaData collection other than that of the _orm.registry, would emit a warning that the attribute name metadata should be left reserved. The warning is now emitted only when the metadata attribute is assigned to an object other than a MetaData.

  References: #13659

engine

• [engine] [bug] [regression] Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as CreateTable and DropTable as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by _engine.Connection.begin_nested(), was not closed after execution, and was instead left to be released when garbage collected. The cursor is now closed immediately, as was the case in 1.3 and as is already the case for INSERT, UPDATE, DELETE and _sql.text() statements.

  This change is also backported to: 2.0.55

  References: #13640

• [engine] [bug] Fixed issue in the _engine.Connection.execution_options.logging_token option where setting the value to None or another false value would raise AttributeError if a logging token had not already been established on that _engine.Connection, such as on a newly checked out connection, when the option was set at the _engine.Engine level, or when the token was reset to None more than once. Regression introduced in 2.0.30 as part of #11210.

  This change is also backported to: 2.0.55

  References: #13641

• [engine] [bug] [regression] Fixed regression where iterating a Result directly would create reference cycles that prevented the Result along with the DBAPI

... (truncated)

Commits

• See full diff in compare view

Updates pymssql from 2.4.2 to 2.4.3

Release notes

Sourced from pymssql's releases.

pymssql 2.0 greenish

Experimental support for greening for gevent, etc.

Changelog

Sourced from pymssql's changelog.

Version 2.4.3 - 2026-10-05 - Mikhail Terekhov

General

• Render Decimal parameters without scientific notation PR #1019·thanks to aminghadersohi
• Apply FreeTDS encryption level per connection (closes #924)

Commits

• a5b2558 Update ChangeLog.rst
• 296ec49 fix(connection): apply FreeTDS encryption level per connection
• e89da42 Render Decimal parameters without scientific notation
• See full diff in compare view

Updates fastavro from 1.12.2 to 1.13.1

Changelog

Sourced from fastavro's changelog.

2026-10-07 version 1.13.1

• Match reader named schema reference with inline writer schema (@​AnkitaAdvitot)

2026-10-05 version 1.13.0

• Remove support for Python 3.9 and 3.10 (@​scottbelden)
• Raise SchemaParseException for a malformed record field (@​eeshsaxena)
• Raise EOFError on truncated primitives instead of TypeError/struct.error (@​eeshsaxena)
• Release Python 3.15 wheels (@​Filimoa)

Commits

• 7abc3f8 1.13.1
• c2a909e reader: match reader named schema reference with inline writer schema (#896)
• c6e8208 1.13.0
• a735168 drop support for python 3.10 (#905)
• ef082ee Build and test CPython 3.15 wheels
• b8b9cef update cibuildwheel and remove the cpython-freethreading option
• 172452b Bump codecov/codecov-action from 7.0.0 to 7.1.1
• 7c46cf3 BinaryDecoder: raise EOFError on truncated primitives instead of TypeError/st...
• da0fba0 schema: raise SchemaParseException for a malformed record field (#895)
• a53bc04 ignore mypy issue with extra snappy import
• Additional commits viewable in compare view

Updates opentelemetry-api from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Commits

• 14971ce Prepare release 1.45.1/0.66b1 (#5752)
• 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
• a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
• d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
• db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
• See full diff in compare view

Updates opentelemetry-sdk from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-sdk's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Changelog

Sourced from opentelemetry-sdk's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Commits

• 14971ce Prepare release 1.45.1/0.66b1 (#5752)
• 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
• a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
• d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
• db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
• See full diff in compare view

Updates opentelemetry-exporter-otlp from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-exporter-otlp's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Changelog

Sourced from opentelemetry-exporter-otlp's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Commits

• 14971ce Prepare release 1.45.1/0.66b1 (#5752)
• 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
• a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
• d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
• db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
• See full diff in compare view

Updates opentelemetry-instrumentation-fastapi from 0.66b0 to 0.66b1

Release notes

Sourced from opentelemetry-instrumentation-fastapi's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

No significant changes.

Changelog

Sourced from opentelemetry-instrumentation-fastapi's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

No significant changes.

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-sqlalchemy from 0.66b0 to 0.66b1

Release notes

Sourced from opentelemetry-instrumentation-sqlalchemy's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

No significant changes.

Changelog

Sourced from opentelemetry-instrumentation-sqlalchemy's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

No significant changes.

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-logging from 0.66b0 to 0.66b1

Release notes

Sourced from opentelemetry-instrumentation-logging's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

No significant changes.

Changelog

Sourced from opentelemetry-instrumentation-logging's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

No significant changes.

Commits

• See full diff in compare view

Updates hypothesis from 6.168.4 to 6.168.5

Commits

• ca2a4c6 Bump hypothesis version to 6.168.5 and update changelog
• c1c9957 Merge pull request #4894 from MarcoGorelli/django-from-field-return-type
• f92f61c Fix the return type of django's from_field
• See full diff in compare view

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

• Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
• A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

• iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

• The README example now uses IniConfig.parse() (#79, thanks @​MbappeWU).
• Fixed the issue tracker link (#74, thanks @​stefan6419846).

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#71
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#72
• Fix link to issues by @​stefan6419846 in pytest-dev/iniconfig#74
• parse_lines: keep values as list of lines, join once by @​RonnyPfannschmidt in pytest-dev/iniconfig#78
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#73
• test: expect sorted all after ruff autofix by @​RonnyPfannschmidt in pytest-dev/iniconfig#80
• docs: use parse API in the README example by @​MbappeWU in pytest-dev/iniconfig#79
• Strip leading UTF-8 BOM when reading INI files by @​Pitchfork-and-Torch in pytest-dev/iniconfig#76
• changelog: add BOM stripping (#76) to 2.3.1 by @​RonnyPfannschmidt in pytest-dev/iniconfig#81

New Contributors

• @​stefan6419846 made their first contribution in pytest-dev/iniconfig#74
• @​MbappeWU made their first contribution in pytest-dev/iniconfig#79
• @​Pitchfork-and-Torch made their first contribution in pytest-dev/iniconfig#76

Full Changelog: pytest-dev/iniconfig@v2.3.0...v2.3.1

Changelog

Sourced from iniconfig's changelog.

2.3.1

• fix quadratic parse time for values with many continuation lines (#78, regarding #77)
• strip a leading UTF-8 BOM when reading INI files, which previously raised ParseError (#76)
• internal: iniconfig._parse.ParsedLine.value is now a list of lines

Commits

• 316fbfa changelog: add BOM stripping (#76) to 2.3.1 (#81)
• d2dcb72 Strip leading UTF-8 BOM when reading INI files (#76)
• 40d8c03 Merge pull request #79 from MbappeWU/codex/docs-parse-inline-comments
• 48359c3 Merge pull request #80 from pytest-dev/claude/fix-iniconfig-test-eukh2n
• b153213 test: expect sorted all after ruff RUF022 autofix
• 4fddfab Merge pull request #73 from pytest-dev/pre-commit-ci-update-config
• 15852c2 [pre-commit.ci] auto fixes from pre-commit.com hooks
• 2e68639 [pre-commit.ci] pre-commit autoupdate
• 23c9e08 docs: use parse API in the README example
• e038536 Merge pull request #78 from RonnyPfannschmidt/claude/dazzling-einstein-h8zq7m
• Additional commits viewable in compare view

Updates ruff from 0.16.10 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

  The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

• Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

  The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

• Remove support for ruff-lsp (#28750)

  Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

• lazy-import-mismatch (TID254)
• lazy-import-immediately-resolved (TID255)
• os-path-commonprefix (RUF071)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3...

  Description has been truncated

[github-actions]

requirements.txt / pylock.toml drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/2082/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
uv export --format pylock.toml --frozen --all-extras --all-groups --output-file pylock.toml
git add requirements.txt pylock.toml
git commit -S -m "chore(deps): regenerate requirements.txt and pylock.toml after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt and pylock.toml from the workflow artifact on this run when present.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.