build(deps-dev): bump the dev-tooling group with 3 updates - #257
Conversation
Bumps the dev-tooling group with 3 updates: [ruff](https://github.com/astral-sh/ruff), [types-pyyaml](https://github.com/python/typeshed) and [hatchling](https://github.com/pypa/hatch). Updates `ruff` from 0.15.22 to 0.16.2 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.22...0.16.2) Updates `types-pyyaml` from 6.0.12.20260518 to 6.0.12.20260724 - [Commits](https://github.com/python/typeshed/commits) Updates `hatchling` from 1.27.0 to 1.31.0 - [Release notes](https://github.com/pypa/hatch/releases) - [Commits](pypa/hatch@hatchling-v1.27.0...hatchling-v1.31.0) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-tooling - dependency-name: types-pyyaml dependency-version: 6.0.12.20260724 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-tooling - dependency-name: hatchling dependency-version: 1.31.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-tooling ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
ruff 0.16.2 adds RUF036, which requires None to be the last member of a type union. Five annotations predate the rule; the reorder is a no-op for type checking and for runtime. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
![my-reviewer-agent[bot]](https://avatars.githubusercontent.com/in/4343504?s=60&v=4){kind=small}
There was a problem hiding this comment.
리뷰 요약
dev-tooling 그룹 범프(ruff 0.15.22 → 0.16.2, types-pyyaml, hatchling 1.27.0 → 1.31.0)와 함께, 새 ruff 버전이 X | None 을 마지막에 두도록 요구하면서 발생한 union 순서 자동 수정이 src/korvid/core/audit.py 와 UI 테스트 2개에 반영되었습니다. 타입 어노테이션 순서 변경은 런타임 의미가 동일하므로 기능 회귀는 없습니다. 다만 lint 도구 버전이 두 곳에서 어긋나는 문제가 하나 있습니다.
발견 사항
pyproject.toml:60 — Warning
문제: dev 그룹의 ruff 는 0.16.2 이상으로 올라갔지만 .pre-commit-config.yaml 의 ruff-pre-commit rev 는 v0.15.22 그대로여서, pre-commit 과 CI(uv run ruff)가 서로 다른 ruff 로 검사하게 됩니다.
근거 (이 PR):
- "ruff>=0.8",
+ "ruff>=0.16.2",근거 (변경되지 않은 .pre-commit-config.yaml:3):
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.15.22수정: 같은 PR에서 rev: v0.16.2 로 함께 올리세요. 그대로 두면 이 PR이 만든 union 재정렬을 구버전 훅이 인지하지 못해, 로컬 pre-commit 은 통과하는데 CI 의 새 ruff 규칙만 실패하거나 반대로 훅 자동 수정이 되돌리는 상황이 반복됩니다.
pyproject.toml:46 — Suggestion
문제: hatchling 을 ==1.31.0 으로 정확히 고정해 두어, 이후 패치 릴리스마다 dependabot PR 을 다시 받아야 합니다.
근거:
-requires = ["hatchling==1.27.0"]
+requires = ["hatchling==1.31.0"]수정: 재현 가능한 빌드를 위한 의도적 핀이면 그대로 두되, 목적이 "PEP 639 지원 하한 보장"이라면 바로 위 주석(hatchling >=1.26 required)과 일치하도록 hatchling>=1.31,<2 형태를 검토하세요. 1.28.0 이 Python 3.9 지원을 제거했지만 이 프로젝트는 requires-python = ">=3.11" 이라 영향이 없습니다.
테스트: 이번 변경은 어노테이션 순서 조정뿐이라 신규 테스트는 필요하지 않습니다. 다만 filterwarnings = ["error"] 설정 때문에 새 ruff/hatchling 조합에서 신규 DeprecationWarning 이 나오면 테스트가 실패하므로, 머지 전 전체 테스트 스위트 통과를 반드시 확인하세요.
COMMENT
The dev-tooling bump moved pyproject's build requirement to hatchling 1.31.0 but left scripts/release/build-constraints.txt pinned at 1.27.0 with its old hashes, so the release would have built with a different backend than the project declares. test_release_build_toolchain_is_fully_pinned caught it, which is what it is for - the pin exists so a release artifact can be rebuilt byte for byte, and a bump that updates one of the three places silently breaks that. Hashes taken from PyPI for both the wheel and the sdist; hatchling's own requirements are unchanged at 1.31.0, so the rest of the constraint file still resolves. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 participant
Bumps the dev-tooling group with 3 updates: ruff, types-pyyaml and hatchling.
Updates
rufffrom 0.15.22 to 0.16.2Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
5b48a04Bump 0.16.2 (#27555)1b9e5fcUpdate Swatinem/rust-cache action to v2.9.2 (#27568)c4e86fc[ty] Add helper extension methods for half-range and equality constraints (#2...17a00de[ty] Reuse primer commands in memory reports (#27553)6ea296b[ty] Normalize type labels in structured docstrings (#26923)2fc445f[ty] Diagnose invalid getattr calls (#27502)22c7823[ty] Enable (but downrank) auto-import completion suggestions from stub-only ...05160d5[ty] Diagnose invalid descriptor__get__calls (#27400)baea3d0[ty] Expose strict analysis options in the playground (#27543)c88946e[ty] Bump ecosystem-analyzer for strict project settings (#27542)Updates
types-pyyamlfrom 6.0.12.20260518 to 6.0.12.20260724Commits
Updates
hatchlingfrom 1.27.0 to 1.31.0Release notes
Sourced from hatchling's releases.
Commits
4b3fd7drelease Hatchling v1.31.019ced89Fix env-dependency extras being dropped when a metadata hook is configured (#...3b45c75Prepare hatchling for release 1.31.0 (#2330)e3d9b95Addresses bug where blank lines are dropped when there is no shebang (#2328)9bc573cPrepare for 1.17.1 hatch release (#2329)bbb12bbPass --no-header to uv pip compile for deterministic lockfiles (#2327)8c06373Fix uv lock check header comparison (#2317)5cfbb54fix: skip extend injection if already present in ruff config (#2305)cf85971fix: use TemporaryDirectory + pylock*.toml for temp lock files (#2303)40c471cDocs: Add hatch-calver to version scheme plugins (#1725)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions