build(deps): bump ruff from 0.15.21 to 0.16.1 in /modules/cve-scan

[dependabot]

Bumps ruff from 0.15.21 to 0.16.1.

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878
• @​MichaReiser

... (truncated)

Commits

• 80790b3 Bump 0.16.1 (#27330)
• 63830f3 [ty] Borrow from constraint set storage less often (#27328)
• f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
• 0d80497 Lint TOML files in the LSP (#26862)
• d91586b Update prek dependencies (#27293)
• 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
• b20daf7 [ty] refactor: add helper function to send partial results (#27249)
• 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
• 7c3e2db [ty] Fix enum class container assignability (#27318)
• d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR updates the 'ruff' development dependency in the /modules/cve-scan directory. Codacy reports that the changes are up to standards with no new issues or complexity increases.

There is a minor gap in the implementation: the acceptance criteria suggest that the pyproject.toml should be updated, but only the uv.lock file was included in the changes. Additionally, the update should be validated by running the linter against the codebase to ensure no new rules trigger failures.

Test suggestions

• Execute the ruff linter using version 0.16.1 against the /modules/cve-scan codebase to ensure no new regressions or incompatible linting rules are introduced.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Execute the ruff linter using version 0.16.1 against the /modules/cve-scan codebase to ensure no new regressions or incompatible linting rules are introduced.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[dependabot]

A newer version of ruff exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.