chore(deps): update all non-major dependencies

[khepri-bot]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
astral-sh/setup-uv	action	minor	v10.0.1 → v10.1.0	v10.2.0
ruff (source, changelog)	dependency-groups	patch	==0.16.6 → ==0.16.8	0.16.10 (+1)

---

Release Notes

astral-sh/setup-uv (astral-sh/setup-uv)

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @​mj0nez (#​1037)
• Use JSON + a typed wrapper instead of TS codegen @​woodruffw (#​1025)

🚀 Enhancements

• Expose a Python "identity" output @​woodruffw (#​1036)
• Verify downloads with astral-sh/versions checksums @​zaniebot (#​1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @​github-actions[bot] (#​1041)
• chore: update known checksums for 0.12.10/0.12.11 @​github-actions[bot] (#​1038)
• chore: update known checksums for 0.12.9 @​github-actions[bot] (#​1035)
• chore: update known checksums for 0.12.7/0.12.8 @​github-actions[bot] (#​1031)
• chore: update known checksums for 0.12.6 @​github-actions[bot] (#​1030)
• chore: update known checksums for 0.12.5 @​github-actions[bot] (#​1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @​woodruffw (#​1024)
• Pin one-shot tools @​woodruffw (#​1022)
• ci: remove obsolete direct push attempts @​eifinger (#​1019)

📚 Documentation

• docs: update version references to v10.0.1 @​github-actions[bot] (#​1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @​eifinger (#​1043)
• Harden npm install defaults @​zaniebot (#​1026)
• Add dependency cooldowns @​woodruffw (#​1021)

astral-sh/ruff (ruff)

v0.16.8

Compare Source

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#​28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#​27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#​27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#​28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#​28505)

Rule changes

• Add support for __lazy_modules__ (#​28459)
• Recognize PEP-728 TypedDict class keywords (#​28533)
• Recognize quoted types in typing.TypeForm (#​28507)
• Support conditional assignment to __lazy_modules__ (#​28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#​28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#​28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#​28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#​28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#​28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#​28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#​28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

v0.16.7

Compare Source

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#​26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#​28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#​28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#​27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#​26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#​28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#​28444)
• Recognize slice and frozendict generics (#​28477)
• Stop defining __cached__ for Python 3.15 (#​28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#​28475)

Performance

• Reuse parser name lookups when interning (#​28399)
• Speed up inherited configuration resolution (#​28299)

Documentation

• Fix line-length path in --config example (#​28392)
• Remove the "Who’s Using Ruff?" list (#​28455)

Other changes

• Embed archive checksums in the shell installer (#​28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879
• @​jonathandung
• @​jogo-openai

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.