chore(deps): update dependency ruff to v0.16.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ruff (source, changelog)	==0.15.22 → ==0.16.4

---

Release Notes

astral-sh/ruff (ruff)

v0.16.4

Compare Source

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#​26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#​27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#​27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#​27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#​27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#​27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#​27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#​27753)
• [syntax-errors] Detect duplicate keyword arguments (#​17804)
• [syntax-errors] Detect parameters declared nonlocal (#​27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#​27807)
• Support pull diagnostics for notebook cells (#​27779)

Documentation

• Add default indicator to rules table (#​27724)
• Fix broken link to Python docs (#​27757)

Other changes

• Fix s390x stacker assembly in release builds (#​27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#​25464)
• Reduce configuration deserialization code size (#​27924)
• Check packed AST index bounds (#​27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot
• @​ewdurbin
• @​woodruffw
• @​Sacrimento
• @​lakshayxi
• @​WhiteFox0-0
• @​baltasarblanco

v0.16.3

Compare Source

Released on 2026-08-13.

Preview features

• [pylint] Fix false negatives on negative numbers (PLR6104) (#​27251)
• [pyupgrade] Add rule to replace while 1 with while True (UP048) (#​27190)

Bug fixes

• [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#​27687)
• [pylint] Allow continue in finally on Python 3.8 (#​27626)
• [pylint] Fix PLE1307 false positive with bools (#​27651)
• [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#​27560)
• [pylint] Improve handling of concatenated strings (PLE1300) (#​27659)

Rule changes

• [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#​27527)

Performance

• Enable PGO for Linux x86-64 Ruff releases (#​27570)
• Enable PGO for Linux ARM64 Ruff releases (#​27574)
• Enable PGO for Windows x86-64 Ruff releases (#​27573)
• Enable PGO for macOS ARM64 Ruff releases (#​27572)
• Reduce Expr size to 64 bytes (#​27591)

CLI

• Hyperlink rule codes in ruff check --statistics output (#​27646)

Documentation

• [ruff] Also suggest asyncio.TaskGroup (RUF006) (#​27461)

Other changes

• Use mimalloc v3 (#​27586)

Contributors

• @​Andrej730
• @​alonfaraj
• @​romero-deshaw
• @​Avasam
• @​tjkuson
• @​charliermarsh
• @​chirizxc
• @​saberoueslati
• @​MichaReiser

v0.16.2

Compare Source

Released on 2026-08-06.

Bug fixes

• [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#​27335)

Server

• Register formatting capabilities dynamically to exclude TOML files (#​27332)

Contributors

• @​MeGaGiGaGon
• @​charliermarsh
• @​epage
• @​sharkdp
• @​ntBre

v0.16.1

Compare Source

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#​27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#​27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#​27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#​26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#​27230)
• [flake8-bugbear] Mark range as immutable (B008) (#​27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#​26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#​25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#​23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#​27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#​26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#​27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#​27303)
• Lint TOML files in the LSP (#​26862)

Documentation

• Cover pycon Markdown formatting (#​27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#​27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#​27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#​27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#​27170)
• Vendor latest annotate-snippets (#​27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878
• @​MichaReiser
• @​ntBre
• @​HarshalPatel1972
• @​mjpieters
• @​joshuavetos
• @​jesco-absolute
• @​vidigoat
• @​baltasarblanco
• @​ribru17
• @​oh-summy
• @​Jayashanker-Padishala

v0.16.0

Compare Source

Released on 2026-07-23.

Check out the blog post for a migration
guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for
  more details and the new Default Rules page for a
  full listing of the enabled rules.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the
  documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  
  # ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and
  gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the
  full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location
  fields in the JSON output format may now be null rather than defaulting to the empty string and
  row 1, column 1, respectively.

Stabilization

The following rules have been stabilized and are no longer in preview:

• airflow3-incompatible-function-signature
  (AIR303)
• missing-copyright-notice
  (CPY001)
• unnecessary-from-float (FURB164)
• sorted-min-max (FURB192)
• implicit-string-concatenation-in-collection-literal
  (ISC004)
• log-exception-outside-except-handler
  (LOG004)
• invalid-bool-return-type
  (PLE0304)
• too-many-positional-arguments
  (PLR0917)
• stop-iteration-return (PLR1708)
• none-not-at-end-of-union
  (RUF036)
• access-annotations-from-class-dict
  (RUF063)
• duplicate-entry-in-dunder-all
  (RUF068)

The following behaviors have been stabilized:

• blind-except (BLE001) is now suppressed when
  the exception is logged via logging methods other than critical, error and exception.
• future-required-type-annotation
  (FA102) now checks for additional PEP 585-compatible
  APIs, such as those from collections.abc.
• f-string-in-get-text-func-call
  (INT001),
  format-in-get-text-func-call
  (INT002), and
  printf-in-get-text-func-call
  (INT003) now check for additional common ways of using the gettext module, such as assigning
  it to builtins._.
• suspicious-url-open-usage
  (S310) now resolves local string literal bindings to avoid more false positives.
• snmp-insecure-version (S508) and
  snmp-weak-cryptography (S509) now
  support the recommended API from newer versions of PySNMP.
• typing-text-str-alias (UP019) now
  recognizes typing_extensions.Text in addition to typing.Text.

Preview features

• [pyupgrade] Fix false positive with TypeVar default before Python 3.13 (UP040) (#​26888)

Bug fixes

• [ruff] Fix missing check on unrecognized early bound (RUF016) (#​26986)

Rule changes

• Insert a space after the colon in Ruff suppression comments (#​27123)

Performance

• [pyupgrade] Speed up unnecessary-future-import (UP010) (#​27047)

Documentation

• [ruff] Add missing period in "Why is this bad?" section (RUF200) (#​26930)
• [flake8-simplify] Clarify os.environ behavior on Windows (SIM112) (#​26972)
• [pydocstyle] Document fix safety (D400) (#​26971)

Contributors

• @​jonathandung
• @​Joosboy
• @​MichaReiser
• @​Andrej730
• @​ntBre
• @​zaniebot

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

LGTM — trivial dev-dependency bump.

Extended reasoning...

Overview

This PR only touches requirements-dev.txt, bumping the pinned ruff version from 0.15.21 to 0.15.22 (an autogenerated pip-compile lockfile change). No source code, application logic, or dependency tree structure changes.

Security risks

None. Ruff is a dev-only linting tool, not part of the runtime dependency graph, so this doesn't affect production code paths or attack surface.

Level of scrutiny

Minimal scrutiny is appropriate — this is a routine patch-level bump of a dev tool, generated by Renovate/pip-compile, with only the single version line changed.

Other factors

No CODEOWNER-sensitive paths, no logic changes, no tests needed. Safe to approve without human review.

[claude]

⚠️ Code review skipped — your organization has reached its monthly code review spending cap.

An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.

Once the cap resets or is raised, push a new commit or reopen this pull request to trigger a review.

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, push a new commit or reopen this pull request to trigger a review.

[claude]

LGTM — trivial dev-dependency bump (ruff 0.15.22 → 0.16.2), no runtime impact.

Extended reasoning...

Overview

This PR only touches requirements-dev.txt, an autogenerated pip-compile lockfile, bumping the ruff dev/lint dependency from 0.15.22 to 0.16.2 (and its transitive pin comment). No application source files, no runtime dependencies, and no CI/config files are modified.

Security risks

None. ruff is a linter used only in development/CI, not shipped as part of the pyUSPTO package or executed against untrusted input at runtime. The change is a single version pin bump with no other diff.

Level of scrutiny

Minimal scrutiny is warranted — this is a mechanical, Renovate-generated dependency bump to a single line in a lockfile. Ruff 0.16.x does expand its default rule set significantly, which could surface new lint findings in a future ruff check run, but that would fail visibly in CI/local dev rather than silently breaking anything, and does not affect correctness of the shipped library.

Other factors

File is autogenerated (pip-compile) so there's no hand-written logic to review. No prior review comments on this PR to reconcile. Bug hunting system found no issues.

[claude]

LGTM — routine dev-tool version bump with no code or behavior impact.

What was reviewed: the single-line change to requirements-dev.txt bumping ruff from 0.15.22 to 0.16.3 (a dev/lint-only dependency, not shipped to users). No other files are touched.

Extended reasoning...

Overview

This PR is an autogenerated Renovate dependency update that bumps ruff (the dev-only linter/formatter) from 0.15.22 to 0.16.3 in requirements-dev.txt. It is a one-line diff in a pip-compile-generated lockfile; no application source code is touched.

Security risks

None. ruff is a development-time linting/formatting tool, not a runtime dependency shipped with the package. It has no code path that touches user data, auth, crypto, or network I/O in production. The changelog entries (mostly new lint rules, bug fixes to existing rules, and performance work) present no supply-chain or security concern beyond the standard trust already placed in this well-known, widely-adopted tool from Astral.

Level of scrutiny

Minimal scrutiny is appropriate here — this is a mechanical lockfile bump for a dev tool, auto-generated by Renovate/pip-compile, with no ambiguity or design decisions involved.

Other factors

The diff is a single line, the file is machine-generated, and the bug-hunting pass found no issues. There are no outstanding comments on the PR to address. A version bump like this could theoretically change lint behavior (ruff 0.16.0 significantly expanded its default rule set), which could cause CI to fail if new lint violations are surfaced — but that would show up immediately in CI rather than being a latent risk, so it doesn't warrant blocking approval here.

[claude]

LGTM — trivial dev-dependency version bump.

What was reviewed: the only change is bumping the pinned ruff version in requirements-dev.txt from 0.15.22 to 0.16.4 (a lockfile entry generated by pip-compile). No source code, CI config, or runtime dependencies are affected.

Extended reasoning...

Overview

Single-line change to requirements-dev.txt, an autogenerated pip-compile lockfile, bumping the pinned ruff dev dependency from 0.15.22 to 0.16.4. This is a standard Renovate-generated dependency update PR with no other files touched.

Security risks

None. ruff is a dev-only linting tool, not a runtime dependency, and the change is just a version pin bump in a lockfile.

Level of scrutiny

Minimal scrutiny is appropriate — this is a mechanical, autogenerated lockfile change with no logic, config, or behavioral changes to review. Renovate/Mend already reports high compatibility/confidence badges for this update.

Other factors

No prior comments or reviews on this PR that need addressing. No bugs were found by the bug hunting system, consistent with the trivial nature of the diff.