build(deps-dev): bump ruff from 0.15.22 to 0.16.0 by dependabot[bot] · Pull Request #1854 · sigstore/sigstore-python

dependabot · 2026-07-30T19:34:28Z

Bumps ruff from 0.15.22 to 0.16.0.

Release notes

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes
Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.
Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:
import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os
Fixes are now shown in check and format --check output:
❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted
This example also shows off the Markdown formatting.
format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:
❯ ruff format --check --output-format github .
::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted
See the CLI help or documentation for the full list of supported formats.
The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes
Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.
Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:
import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os
Fixes are now shown in check and format --check output:
❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted
This example also shows off the Markdown formatting.
format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

a2635fd Bump 0.16.0 (#27136)
3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
17ef711 Stabilize --add-ignore (#27125)
ef912bb Add newly stabilized rules to defaults (#27055)
b30f040 Stabilize new default rules (#27035)
bcd70c5 Exclude Markdown files from format-dev runs (#27052)
87e51e2 Fix format --check spans for syntax errors (#27045)
afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.22 to 0.16.0. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.22...0.16.0) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

No functional changes are intended. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku · 2026-07-31T10:58:55Z

ruff 0.16 enables loads of good rulesets so we get a lot of new complaints.

I've started fixing these but have not quite finished yet, a few left to fix.

lru_cache on instance method means the instance is never GC'd. The alternative approache would have been to make the method a @cached_property instead but that's an API change. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Making SignedNote a BaseModel is also possible but there seems to be no benefit. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku · 2026-08-06T13:22:55Z

/gcbrun

jku · 2026-08-06T15:52:01Z

I've started fixing these but have not quite finished yet, a few left to fix.

Should be all done now

dependabot · 2026-08-07T19:34:05Z

A newer version of ruff exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

woodruffw · 2026-08-07T22:04:08Z


-    note: StrictStr = Field(..., alias="note")
-    signatures: list[RekorSignature] = Field(..., alias="signatures")
+    note: str


Hmm, I'm not sure if this one is 1-1? I think StrictStr adds more validations (like not being empty) on top of str.

The issue is that the containing class is a dataclass (and not a pydantic BaseModel) so IIUC these don't actually do anything currently.

So the alternative would be to make SignedNote a BaseModel but that would be more of a change than what I do here

woodruffw · 2026-08-07T22:04:16Z


    inner = (index ^ (size - 1)).bit_length()
-    border = bin(index >> inner).count("1")
+    border = (index >> inner).bit_count()


dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 30, 2026

Various fixes to new ruff complaints

0cefc2b

No functional changes are intended. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku added 3 commits August 6, 2026 14:18

tuf: Avoid lru_cache, implement cache manually

4af8ad8

lru_cache on instance method means the instance is never GC'd. The alternative approache would have been to make the method a @cached_property instead but that's an API change. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

rekor checkpoint: Remove unused pydantic syntax

e9cf96f

Making SignedNote a BaseModel is also possible but there seems to be no benefit. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

linter: silence a blind-exception complaint

cfda91d

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

woodruffw approved these changes Aug 7, 2026

View reviewed changes

woodruffw reviewed Aug 7, 2026

View reviewed changes

Navigation Menu

Uh oh!

build(deps-dev): bump ruff from 0.15.22 to 0.16.0 - #1854

build(deps-dev): bump ruff from 0.15.22 to 0.16.0#1854
dependabot[bot] wants to merge 5 commits into
mainfrom
dependabot/uv/ruff-0.16.0

dependabot Bot commented on behalf of github Jul 30, 2026

Uh oh!

jku commented Jul 31, 2026

Uh oh!

jku commented Aug 6, 2026

Uh oh!

jku commented Aug 6, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 7, 2026

Uh oh!

woodruffw Aug 7, 2026

Uh oh!

jku Aug 10, 2026 •

edited

Loading

Uh oh!

woodruffw Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 30, 2026

0.16.0

Release Notes

Breaking changes

0.16.0

Breaking changes

Uh oh!

jku commented Jul 31, 2026

Uh oh!

jku commented Aug 6, 2026

Uh oh!

jku commented Aug 6, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 7, 2026

Uh oh!

woodruffw Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

jku Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

woodruffw Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jku Aug 10, 2026 •

edited

Loading