chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
astral-sh/ruff-pre-commit	repository	patch	v0.15.1 → v0.15.5
docker/build-push-action	action	major	v6 → v7
docker/setup-buildx-action	action	major	v3 → v4
ghcr.io/astral-sh/uv	final	patch	0.10.3 → 0.10.9
pycqa/bandit	repository	patch	1.9.3 → 1.9.4

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)

v0.15.5

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.15.5

v0.15.4

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.15.4

v0.15.3

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.15.3

v0.15.2

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.15.2

docker/build-push-action (docker/build-push-action)

v7

Compare Source

docker/setup-buildx-action (docker/setup-buildx-action)

v4

Compare Source

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.10.9

Compare Source

Released on 2026-03-06.

Enhancements

• Add fbgemm-gpu, fbgemm-gpu-genai, torchrec, and torchtune to the PyTorch list (#​18338)
• Add torchcodec to PyTorch List (#​18336)
• Log the duration we took before erroring (#​18231)
• Warn when using uv_build settings without uv_build (#​15750)
• Add fallback to /usr/lib/os-release on Linux system lookup failure (#​18349)
• Use cargo auditable to include SBOM in uv builds (#​18276)

Configuration

• Add an environment variable for UV_VENV_RELOCATABLE (#​18331)

Performance

• Avoid toml Document overhead (#​18306)
• Use a single global workspace cache (#​18307)

Bug fixes

• Continue on trampoline job assignment failures (#​18291)
• Handle the hard link limit gracefully instead of failing (#​17699)
• Respect build constraints for workspace members (#​18350)
• Revalidate editables and other dependencies in scripts (#​18328)
• Support Python 3.13+ on Android (#​18301)
• Support cp3-none-any (#​17064)
• Skip tool environments with broken links to Python on Windows (#​17176)

Documentation

• Add documentation for common marker values (#​18327)
• Improve documentation on virtual dependencies (#​18346)

v0.10.8

Compare Source

Released on 2026-03-03.

Python

• Add CPython 3.10.20
• Add CPython 3.11.15
• Add CPython 3.12.13

Enhancements

• Add Docker images based on Docker Hardened Images (#​18247)
• Add resolver hint when --exclude-newer filters out all versions of a package (#​18217)
• Configure a real retry minimum delay of 1s (#​18201)
• Expand uv_build direct build compatibility (#​17902)
• Fetch CPython from an Astral mirror by default (#​18207)
• Download uv releases from an Astral mirror in installers by default (#​18191)
• Add SBOM attestations to Docker images (#​18252)
• Improve hint for installing meson-python when missing as build backend (#​15826)

Configuration

• Add UV_INIT_BARE environment variable for uv init (#​18210)

Bug fixes

• Prevent uv tool upgrade from installing excluded dependencies (#​18022)
• Promote authentication policy when saving tool receipts (#​18246)
• Respect exclusions in scripts (#​18269)
• Retain default-branch Git SHAs in pylock.toml files (#​18227)
• Skip installed Python check for URL dependencies (#​18211)
• Respect constraints during --upgrade (#​18226)
• Fix uv tree orphaned roots and premature deduplication (#​17212)

Documentation

• Mention cooldown and tweak inline script metadata in dependency bots documentation (#​18230)
• Move cache prune in GitLab to after_script (#​18206)

v0.10.7

Compare Source

Released on 2026-02-27.

Bug fixes

• Fix handling of junctions in Windows Containers on Windows (#​18192)

Enhancements

• Activate logging for middleware retries (#​18200)
• Upload uv releases to a mirror (#​18159)

v0.10.6

Compare Source

Released on 2026-02-24.

Bug fixes

• Apply lockfile marker normalization for fork markers (#​18116)
• Fix Python version selection for scripts with a requires-python conflicting with .python-version (#​18097)
• Preserve file permissions when using reflinks on Linux (#​18187)

Documentation

• Remove verbose documentation from optional dependencies help text (#​18180)

v0.10.5

Compare Source

Released on 2026-02-23.

Enhancements

• Add hint when named index is found in a parent config file (#​18087)
• Add warning for uv lock --frozen (#​17859)
• Attempt to use reflinks by default on Linux (#​18117)
• Fallback to hardlinks after reflink failure before copying (#​18104)
• Filter pylock.toml wheels by tags and requires-python (#​18081)
• Validate wheel filenames are normalized during uv publish (#​17783)
• Fix message when exclude-newer invalidates the lock file (#​18100)
• Change the missing files log level to debug (#​18075)

Performance

• Improve performance of repeated conflicts with an extra (#​18094)

Bug fixes

• Fix --no-emit-workspace with --all-packages on single-member workspaces (#​18098)
• Fix UV_NO_DEFAULT_GROUPS rejecting truthy values like 1 (#​18057)
• Fix iOS detection (#​17973)
• Propagate project-level conflicts to package extras (#​18096)
• Use a global build concurrency semaphore (#​18054)

Documentation

• Update documentation heading for environment variable files (#​18122)
• Fix comment about uv export formats (#​17900)
• Make it clear that Windows is supported in user- and system- level configuration docs (#​18106)

v0.10.4

Compare Source

Released on 2026-02-17.

Enhancements

• Remove duplicate references to the affected paths when showing uv python errors (#​18008)
• Skip discovery of workspace members that contain only git-ignored files, including in sub-directories (#​18051)

Bug fixes

• Don't panic when initialising a package at the filesystem root (e.g. uv init / --name foo) (#​17983)
• Fix permissions on wheel and sdist files produced by the uv_build build backend (#​18020)
• Revert locked file change to fix locked files on NFS mounts (#​18071)

pycqa/bandit (pycqa/bandit)

v1.9.4

Compare Source

What's Changed

• chore: fixed some typos in comments by @​jakob1379 in PyCQA#1351
• Bump docker/login-action from 3.6.0 to 3.7.0 by @​dependabot[bot] in PyCQA#1353
• Bump docker/build-push-action from 6.18.0 to 6.19.2 by @​dependabot[bot] in PyCQA#1357
• Fix B613 crash when reading from stdin by @​worksbyfriday in PyCQA#1361
• Include filename in nosec 'no failed test' warning by @​worksbyfriday in PyCQA#1363
• Fix B615 false positive when revision is set via variable by @​worksbyfriday in PyCQA#1358
• Lower version guard in check_ast_node to Python 3.12 by @​rcgray in PyCQA#1355
• Fix B106 reporting wrong line number on multiline function calls by @​worksbyfriday in PyCQA#1360

New Contributors

• @​jakob1379 made their first contribution in PyCQA#1351
• @​worksbyfriday made their first contribution in PyCQA#1361
• @​rcgray made their first contribution in PyCQA#1355

Full Changelog: PyCQA/bandit@1.9.3...1.9.4

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.