chore(deps): update testing deps (minor)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
ops (changelog)	3.3.1 → 3.8.2
requests (changelog)	2.32.5 → 2.34.2
ruff (source, changelog)	0.14.5 → 0.16.7

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

canonical/operator (ops)

v3.8.2

Compare Source

Fixes

• Compare full event paths when skipping duplicate notices (#​2684)
• In ops.testing, don't pass a message when converting an unknown status by name (#​2700)

Documentation

• Give each best-practice admonition a stable anchor (#​2524)
• Reword text that vale 3.17 flags as misspelled (#​2695)
• Stop styling page references as blockquotes (#​2666)
• Make the custom-endpoint-name sample test actually test something (#​2664)
• Replace requests by urllib in K8s tutorial integration tests (#​2687)
• Recommend spread directly, rather than charmcraft test (#​2706)
• Extract sections in "how to write integration tests" to their own how-to guide (#​2662)

CI

• Point DB charm CI at the moved mysql-operators repo (#​2551)
• Switch example charm integration tests to Concierge k8s preset (#​2696)
• Use the upstream concierge presets again (#​2699)

v3.8.1

Compare Source

Fixes

• Align Juju naming rules with testing class rules (#​2570)
• Do not attempt to mutate secret data in grant/revoke during tests (#​2614)
• Allow IdentityDict to be assigned IdentityAccess (#​2628)
• Only decode fields used by the data class in Relation.load() (#​2636)
• Use juju.wait for workload version tests in Kubernetes tutorial (#​2650)

Documentation

• Wait longer for Loki data in Kubernetes tutorial integration tests (#​2611)
• Add more guidance about charm naming (#​2610)
• Fix tempo test_deploy URL (#​2631)
• Add how-to guide for debugging Kubernetes charms (#​2498)
• Revert to installed charmcraft for initing charms (#​2635)
• Grab workload version in Kubernetes tutorial (#​2559)
• Separate test_workload_version_is_set in Kubernetes tutorial chapter 3 (#​2638)
• Add how-to guide to configure jubilant logs (#​2619)
• Use autofunction for layer_from_rockcraft (#​2648)
• Remove log_cli and log_file ini options; keep them as CLI arguments for integration tests (#​2654)
• Fix typo in explanation of mock_version fixture usage (#​2647)
• Switch Kubernetes tutorial charms to rock version of demo server (#​2649)

Tests

• Type-check testing/src/scenario and fix uncovered errors (#​2615)

CI

• Add dependency-review-action on PRs (#​2587)
• Re-enable the tracing integration tests (#​2586)
• Adopt new dependabot conventions (#​2609)
• Drop unsupported cooldown.semver-major-days from github-actions block (#​2617)
• Open an issue if a scheduled workflow fails (#​2627)
• Hash-pin actions and drop zizmor config (#​2612)
• Use uv-venv-lock-runner in tracing tox, align deps (#​2651)

v3.8.0

Compare Source

Features

• Note the socket path in Pebble tracing spans (#​2555)

Fixes

• Treat remote unit zero as explicit (#​2454)
• Ensure resources are cleaned up in testing.Context (#​2506)
• Close SQLite storage in Harness.cleanup() (#​2507)
• Restore sys.breakpointhook on _Manager teardown (#​2542)
• Avoid errors in finalisation due to already-closed websocket (#​2548)
• Use the correct value for JUJU_HOOK_NAME when objects contain dashes (#​2552)
• Avoid double-closing the framework in testing teardown (#​2561)
• Don't leak exec I/O threads when waiting on the change fails (#​2558)
• Take Pebble defaults into consideration when consistency checking Checks (#​2567)
• Tear down Runtime.exec() when the charm raises (#​2581)

Documentation

• Fix small issues in K8s tutorial (#​2540)
• Document user-secret observer lifecycle and secret-changed semantics (#​2522)
• Replace CoC with link to Ubuntu Code of Conduct (#​2564)
• Add a small note about -W error in the unit test how-to (#​2560)
• Add doc about subordinate charms (#​2455)
• Add 26.04 to the versions page and mark 2.23 as LTS (#​2517)
• Clarify storage-detaching applies to both machine and K8s charms (#​2554)
• Add guidance about names of workload-less charms (#​2496)
• Fix first unit tests command in machine charm tutorial (#​2574)
• Extend security explanation page to cover SEC0030 V1.3 gaps (#​2571)
• Move docs to canonical.com/juju/docs/ops (#​2545)
• Fix docstring of _Event._is_action_event (#​2580)

Tests

• Treat warnings as errors when running unit tests (#​2541)
• Fix mock_temp_dir fixture's open() patch (#​2553)
• Add integration tests for ops.hookcmds (#​2520, #​2562)
• Fix integration test flakes on Juju 3 k8s and Juju 4 secrets (#​2584)

Refactoring

• Avoid yaml.load() to silence security scanner false positives (#​2523)
• Replace jsonpatch with an inline dict-diff (#​2578)
• Move the otlp-json package to be a regular ops-tracing module (#​2585)
• Distinguish between init and attribute types in testing state classes (#​2331)

CI

• Remove obsolete containerd workaround from integration workflow (#​2519)
• Use the sys.monitoring coverage core (#​2518)

v3.7.1

Compare Source

Fixes

• Pass the endpoint name through to relation-get (#​2499)

Documentation

• Add a how-to guide focused on debugging charms (#​2386)
• Add metadata descriptions to the debug and public listing how-to guides (#​2415)
• Update tutorials and how-tos to use pytest-jubilant (#​2406)
• Add how-to guide about CI (#​2405)
• Test COS Lite integration with the k8s-5-observe charm (#​2411)
• Update tutorials and example charms to match Charmcraft 4.2 (#​2407)
• Update api_demo_server version to support non-amd64 architectures (#​2448)
• Pin to 24.04 when launching VMs (#​2457)
• Explain how to remove errored apps in k8s tutorial (#​2445)
• Align example charms with pre-release Charmcraft (#​2444)
• Add how-to guide for naming and initialising a charm (#​2449)
• Add a how-to guide about publishing a charm (#​2420)
• In the tutorials, recommend initing from GitHub (#​2459)
• Fix integration tests of K8s tutorial charms (#​2471)
• Replace the PGP key with the upstream page in SECURITY.md (#​2474)
• Bump api_demo_server to 1.0.4 in docs and example charms (#​2473)
• Refresh the machine workloads how-to (#​2443)
• Add COS Lite integration tests to K8s tutorial (#​2478)
• Add git workflow guidance for contributors (#​2453)
• Update profile guidance in HACKING.md (#​2486)
• Explain how to add an icon to a charm (#​2451)
• Adopt latest Charmcraft profiles, incl juju_setup marker on integration tests (#​2497)
• Improve support for agents, with Sphinx Stack upgrade (#​2495)
• Improve how-to about managing files in containers (#​2470)
• Improve Container.pull docs to avoid leaky files (#​2508)
• Clarify Secret manage-permission error in testing.State (#​2510)

Tests

• Extend the type checking of the ops-scenario tests (#​2234, #​2235)
• Wait on ExecProcess after expected TypeError (#​2509)

CI

• Drop external action for checking PR title format (#​2388)
• Add a dependabot cooldown (#​2413)
• Sort the directory entries when updating the best practices list (#​2422)
• Configure dependabot for the example charms (#​2426)
• Pin zizmor and TIOBE tool versions in pyproject.toml rather than the workflow (#​2437)
• Add 26.04 to smoke tests and remove outdated metadata.yaml (#​2450)
• Use charmcraft test for example charm (#​2440)
• Add workflow_dispatch trigger to workflows where it is useful (#​2468)
• Ensure the correct job is selected in updating charm pins (#​2500)

v3.7.0

Compare Source

Features

• Enable interactive debugging via breakpoint in testing (#​2363)
• ops.testing autoload support for charmcraft extensions (#​2367)
• Allow testing.State.get_relation to accept relation objects (#​2359)
• Support charmcraft.yaml format as meta for testing.Context (#​2296)

Fixes

• Correct type annotation for StorageMeta.properties (#​2348)
• Move the testing.Container compatibility import so that mypy style checkers understand it (#​2343)
• Hold only copies of user provided meta/config/actions in testing.Context (#​2349)
• Deep-copy layer objects during testing.State plan rendering (#​2380)
• Return copies from testing.State secret_get and action_get (#​2379)
• Use timezone-aware datetimes in expiry calculation (#​2378)
• Warn before clearing non-empty container in testing (#​2365)

Documentation

• Replace links to juju.is by canonical.com/juju (#​2368)
• Refactor homepage to better put Ops in context (#​2370)
• Add pytest-operator migration guide from Jubilant docs (#​2381)
• Add a tip about AI help in the Jubilant migration guide (#​2382)
• Mention jhack scenario snapshot (#​2351)
• Update integration testing how-to guide (#​2390)
• Explain K8s charms briefly at the start of the tutorial (#​2392)
• Juju secrets identifier is now an opaque string (#​2387)

Tests

• Extend the type checking of the ops-scenario tests (#​2230)

CI

• Run ruff check --fix in tox -e format (#​2369)
• Check example charms with mypy in CI (#​2360)
• Update the list of published charms in the compatibility tests (#​2384)
• Adjust minimum Python version in broad charm compatibility tests (#​2317)

v3.6.0

Compare Source

Features

• Bump default Juju version in ops.testing.Context to 3.6.14 (#​2316)

Fixes

• Correct the Model.get_binding() return type (#​2329)
• Only show executable in ExecError.__str__, not full command line (#​2336)
• Support Pydantic MISSING sentinel in ops.Relation.save (#​2306)

Documentation

• Add how-to subcategory for managing containers (#​2309)
• Remove 2.19 version in docs, tweak ops.testing title (#​2332)
• Use "true" and "false" consistently in the reference documentation (#​2330)
• Add CLI args as another place to not put sensitive data (#​2334)
• Fix remote unit kwarg in testing example (#​2342)
• Clarify that secret labels are not names (#​2337)

Tests

• Set SCENARIO_BARE_CHARM_ERRORS=true in Ops tests that care (#​2314)

CI

• Fix releasing on branches with no versions.md doc (#​2323)

v3.5.2

Compare Source

Fixes

• Make testing.CheckInfo level arg type match pebble.CheckInfo.level (#​2274)
• Make testing consistency check aware that credential-get is available on k8s in newer Juju (#​2307)
• Drop unused setuptools_scm build dependency (#​2310)

Documentation

• Update Pebble version in Juju 3.6 (#​2295)
• Refresh K8s tutorial to use Concierge and uv-based Charmcraft profile (#​2285)
• Add missing "How to" in page titles (#​2289)
• Fix and improve observability part of K8s tutorial (#​2305)

v3.5.1

Compare Source

Fixes

• Use parse_rfc3339 for datetime parsing to support Juju 4 (#​2264)
• Correct the value of additional_properties in the action meta in Juju 4 (#​2250)
• Prevent KeyError on auth-type when creating CloudCredential object (#​2268)
• _checks_action should return empty list when there are no changes (#​2270)

Documentation

• Provide examples in unit testing how-to, and other small improvements (#​2251)
• Update the action how-to to explain the additionalProperties default flip (#​2249)
• For state-transition tests, clarify about immutability and reusing state (#​2153)
• Fix and clarify holistic example of handling storage (#​2098)
• Remove comments from K8s tutorial and clarify about persisting data (#​2253)
• Clarify handling of postgres relation data in K8s tutorial (#​2256)
• Improve unit tests of httpbin demo charm (#​2254)
• Add version information for tools in the charming ecosystem (#​2231)
• Avoid emojis that render differently across platforms (#​2273)
• Secrets over CMR comment added (#​2271)
• Fix charm name in httpbin deploy command (#​2276)
• Updated security@ubuntu.com PGP key (#​2286)

Tests

• Remove unnecessary test module (#​2247)

CI

• Replace git reference injection with wheel artifacts in charm test workflows (#​2252)
• Explicitly provide the charmcraft repo location in CI (#​2277)
• Remove outdated custom signature generation (#​2280)

v3.5.0

Compare Source

Features

• Env var to control exception wrapping in tests (#​2142)
• Deprecate testing.Context.charm_spec (#​2219)

Documentation

• Fix charmcraft init command (#​2210)
• Update CI examples to use uv and tox-uv (#​2213)
• Update and clarify info about environment prep (#​2217)
• Match Charmcraft profiles in tox.ini example for integration testing (#​2221)
• Use base 24.04 for httpbin-demo charm (#​2222)
• Clarify parts of the machine charm tutorial (#​2223)
• Match Charmcraft profiles in "Write and structure charm code" (#​2220)
• Use cosl binary in K8s tutorial charm to work around error (#​2232)
• Fix URL issues by updating doc starter pack (#​2238)

Tests

• Don't skip tests if ops[testing] isn't installed (#​2215)
• Switch the integration test charms to use the uv plugin (#​2218)

CI

• Avoid jitter in the best practice doc PRs (#​2193)
• Ignore PERF401 (manual list comprehension) across the repo (#​2201)
• The git commands need to be run in the operator directory as well (#​2197)
• Have cycle in the sbomber manifests use the default value (#​2209)
• Add pytest.warns to note an expected warning (#​2092)
• Update release script to handle non-final versions (#​2199)
• Add ops-tracing as a dependency for the observability tests (#​2239)
• Add scheduled workflow for packing and integration testing example charms (#​2233)

v3.4.0

Compare Source

Breaking Changes

• Fix: Change JujuContext.machine_id from int to str (#​2108)
• Fix: Ensure that the testing context manager is exited when an exception occurs (#​2117)

Features

• Add a low-level API for the Juju hook commands (#​2019)
• Make PebbleClient file methods also accept pathlib.PurePath (#​2097)
• Log the total number of deferred events (#​2161)
• Allow setting the Juju availability zone and principal unit in the testing Context (#​2187)

Fixes

• Allow actions without params or descriptions in ops[testing] (#​2090)
• Ensure ops.Pebble.pull cleans up temporary files if it errors (#​2087)
• Make secret info description visible to the charm in ops[testing] (#​2115)
• Raise ActionFailed when using Context as a context manager (#​2121)
• Detect categories with an exclamation mark indicating breaking changes (#​2132)
• Normalise Secret.owner to 'app' for ops[testing] output state (#​2127)
• Don't cache secret metadata in Ops (#​2143)
• Secret-info-get cannot be provided with both an ID and a label (#​2170)
• Minor hookcmds fixes (#​2175)

Documentation

• Update referenced examples for managing interfaces (#​2068)
• Tidy up spelling and formatting in several places (#​2060)
• Add missing assignment to state_out in unit tests how-to (#​2075)
• Update the holistic/delta explanation with the reconciler pattern (#​2029)
• Fix broken setup/teardown links in README (#​2094)
• Update info about release docs, mark testing changelog as not maintained (#​2074)
• Switch to makefile for building the docs (#​2073)
• Document how to extract the charm instance from the testing context (#​2084)
• Add a how-to guide for migrating away from Harness (#​2062)
• Rename hook tools to hook commands (#​2114)
• Remove legacy how-to guide for Harness (#​2122)
• Update the Juju release the metrics functionality is removed from 4.0 to 3.6.11 (#​2126)
• Clarify that Context is the testing context not only the Juju context (#​2123)
• Explain the Charmhub public listing process and add a reference list of best practices (#​1989)
• Expand next steps for K8s tutorial (#​2034)
• Remove mention of the simple Charmcraft profile (#​2138)
• Expand landing pages with summaries of pages (#​2140)
• Update environment setup for integration tests and K8s tutorial (#​2124)
• Replace machine charm tutorial by an improved tutorial (#​2119)
• Change HACKING.md instructions for maintaining Charmcraft profiles (#​2151)
• In integration tests, use consistent approach to logging and packing (#​2150)
• In integration testing how-to, clarify that Juju model is destroyed after all tests in the model complete (#​2154)
• Remove Charmcraft channel specifier from machine charm tutorial (#​2148)
• Add AI contribution note and style guideline for type annotation of return values (#​2168)
• Add ops[testing] to the ops.testing docstring (#​2171)
• Add links to the Juju hook from each event class (#​2176)
• Add a short umask note (#​2184)

Tests

• Re-enable testing consistency checks after disabling them (#​2141)
• Expand secrets integration and state transition tests (#​2130)

Refactoring

• Use ops.hookcmds in _ModelBackend (#​2116)
• Don't get the storage details from --help (#​2172)
• Drop 3.8 and 3.9 compatibility code (#​2173)
• Use json.dumps to produce the YAML in relation-set and state-set (#​2174)
• Rely on type annotations instead of casts in hookcmds (#​2179)

CI

• Add integration and state transition tests for the secrets API (#​2078)
• Temporarily disable tracing integration tests (#​2102)
• Add secrets tests follow-up (#​2105)
• Support monorepos in ops charm compatibility testing (#​2100)
• Test both Charmcraft 3 and Charmcraft 4 profiles (#​2103)
• Add automated doc checks (and related starter pack updates) (#​2099)
• Clean up accidental workflow trigger (#​2144)
• Test if package versions match dependency versions before publishing (#​2139)
• Update spelling (#​2167)
• Test against 4.0/stable (#​2186)
• Store charmcraft logs if smoke tests fail (#​2192)
• Use Juju channel 4/stable in Ops smoke tests (#​2190)

psf/requests (requests)

v2.34.2

Compare Source

• Moved headers input type back to Mapping to avoid invariance issues
  with MutableMapping and inferred dict types. Users calling
  Request.headers.update() may need to narrow typing in their code. (#​7441)

v2.34.1

Compare Source

Bugfixes

• Widened json input type from dict and list to Mapping
  and Sequence. (#​7436)
• Changed headers input type to MutableMapping and removed None from
  Request.headers typing to improve handling for users. (#​7431)
• Response.reason moved from str | None to str to improve handling
  for users. (#​7437)
• Fixed a bug where some bodies with custom __getattr__ implementations
  weren't being properly detected as Iterables. (#​7433)

v2.34.0

Compare Source

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by
  typeshed. Public API types should be fully compatible with mypy, pyright,
  and ty. We believe types are comprehensive but if you find issues, please
  report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for
  helping review and test the types ahead of the release. (#​7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify
  security considerations. (#​7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects
  should be able to start testing prior to its release in October. (#​7422)
• Requests added support for Python 3.14t. (#​7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing
  accidental looping when traversing the history list. (#​7328)
• Requests no longer performs greedy matching on no_proxy domains. The
  proxy_bypass implementation has been updated with CPython's fix from
  bpo-39057. (#​7427)
• Requests no longer incorrectly strips duplicate leading slashes in
  URI paths. This should address user issues with specific presigned
  URLs. Note the full fix requires urllib3 2.7.0+. (#​7315)

v2.33.1

Compare Source

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
  files in the tmp directory. (#​7305)
• Fixed Content-Type header parsing for malformed values. (#​7309)
• Improved error consistency for malformed header values. (#​7308)

v2.33.0

Compare Source

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that
  uses Requests, please take a look at #​7271. Give it a try, and report
  any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts
  contents to a non-deterministic location to prevent malicious file
  replacement. This does not affect default usage of Requests, only
  applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#​7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause
  malformed authentication to be applied to Requests on
  Python 3.11+. (#​7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#​7196)

Documentation

• Various typo fixes and doc improvements.

astral-sh/ruff (ruff)

v0.16.7

Compare Source

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#​26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#​28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#​28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#​27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#​26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#​28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#​28444)
• Recognize slice and frozendict generics (#​28477)
• Stop defining __cached__ for Python 3.15 (#​28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#​28475)

Performance

• Reuse parser name lookups when interning (#​28399)
• Speed up inherited configuration resolution (#​28299)

Documentation

• Fix line-length path in --config example (#​28392)
• Remove the "Who’s Using Ruff?" list (#​28455)

Other changes

• Embed archive checksums in the shell installer (#​28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879
• @​jonathandung
• @​jogo-openai

v0.16.6

Compare Source

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#​28219)
• [flake8-pytest-style] Add an autofix for PT020 (#​27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#​28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#​27313)

Bug fixes

• Validate unary expressions when parsing (#​28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#​28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#​27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#​28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#​27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#​27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#​28027)

Documentation

• Add another example and glob reference for lint.per-file-ignores (#​28106)
• Add duplicate work guidance (#​28229)
• [flake8-async] Document thread offloading (ASYNC240) (#​28008)
• [pyupgrade] Clarify default encoding argument handling (UP012) (#​27315)

Other changes

• Allow unary plus in match patterns on Python 3.15 (#​28231)

Contributors

• @​flying-sheep
• @​pikammmmm
• @​fly1d
• @​waterWang
• @​Pierre-Sassoulas
• @​ntBre
• @​jelle-openai
• @​ericbuehl
• @​tjkuson
• @​AbhinavMir
• @​Whning0513
• @​chirizxc

v0.16.5

Compare Source

Released on 2026-08-27.

Preview features

• Allow rules without codes (#​28049)
• Introduce category selectors (#​27666)
• Update preview default rules and categories (#​27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#​28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#​28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#​28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#​27978)

Documentation

• Document rule acceptance guidelines (#​27910)
• Document the new category selectors (#​27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

v0.16.4

Compare Source

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#​26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#​27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#​27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#​27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#​27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#​27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#​27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#​27753)
• [syntax-errors] Detect duplicate keyword arguments (#​17804)
• [syntax-errors] Detect parameters declared nonlocal (#​27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#​27807)
• Support pull diagnostics for notebook cells (#​27779)

Documentation

• Add default indicator to rules table (#​27724)
• Fix broken link to Python docs (#​27757)

Other changes

• Fix s390x stacker assembly in release builds (#​27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#​25464)
• Reduce configuration deserialization code size (#​27924)
• Check packed AST index bounds (#​27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot
• @​ewdurbin
• @​woodruffw
• @​Sacrimento
• @​lakshayxi
• @​WhiteFox0-0
• @​baltasarblanco

v0.16.3

Compare Source

Released on 2026-08-13.

Preview features

• [pylint] Fix false negatives on negative numbers (PLR6104) (#​27251)
• [pyupgrade] Add rule to replace while 1 with while True (UP048) (#​27190)

Bug fixes

• [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#​27687)
• [pylint] Allow continue in finally on Python 3.8 (#​27626)
• [pylint] Fix PLE1307 false positive with bools (#​27651)
• [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#​27560)
• [pylint] Improve handling of concatenated strings (PLE1300) (#​27659)

Rule changes

• [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#​27527)

Performance

• Enable PGO for Linux x86-64 Ruff releases (#​27570)
• Enable PGO for Linux ARM64 Ruff releases (#​27574)
• Enable PGO for Windows x86-64 Ruff releases (#​27573)
• Enable PGO for macOS ARM64 Ruff releases (#​27572)
• Reduce Expr size to 64 bytes (#​27591)

CLI

• Hyperlink rule codes in ruff check --statistics output (#​27646)

Documentation

• [ruff] Also suggest asyncio.TaskGroup (RUF006) (#​27461)

Other changes

• Use mimalloc v3 (#​27586)

Contributors

• @​Andrej730
• @​alonfaraj
• @​romero-deshaw
• @​Avasam
• @​tjkuson
• [@​charli

❗ Important

✂ PR body was truncated to here.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks