chore(deps): update all non-major dependencies

[khepri-bot]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
github/codeql-action	action	patch	v4.37.7 → v4.37.9	v4.38.0
pylint (changelog)	dependency-groups	patch	==4.0.7 → ==4.0.8
ruff (source, changelog)	dependency-groups	patch	==0.16.3 → ==0.16.5	0.16.7 (+1)
tox (changelog)	dependency-groups	minor	==4.60.0 → ==4.61.2	4.61.4 (+1)

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

pylint-dev/pylint (pylint)

v4.0.8

Compare Source

What's new in Pylint 4.0.8?

Release date: 2026-08-29

False Positives Fixed

• Fix a false positive for :ref:unspecified-encoding when an open call uses a mode
  argument that cannot be inferred.

  Closes #​10201

• Fix a false positive for invalid-name (C0103) on names assigned in an
  if __name__ == "__main__": block. Such a block reads like a script body, so
  a name there is now accepted if it matches either the constant or the variable
  naming style.

  Closes #​10766

• Fix false positives for :ref:invalid-str-returned, :ref:invalid-repr-returned,
  :ref:invalid-format-returned, :ref:invalid-bytes-returned, :ref:invalid-hash-returned,
  :ref:invalid-index-returned, :ref:invalid-length-returned,
  :ref:invalid-length-hint-returned, :ref:invalid-getnewargs-returned and
  :ref:invalid-getnewargs-ex-returned when the returned value is an instance of a
  subclass of the expected builtin type, such as self in a str subclass or a
  namedtuple.

  Closes #​11306

• Fix false positives for :ref:bad-string-format-type when the argument is an
  instance of a subclass of int, float or str, such as bool or an
  IntEnum member formatted with %d.

  Closes #​11315

False Negatives Fixed

• redundant-unittest-assert now also flags assertEqual and assertNotEqual
  when both compared values are constants, e.g. self.assertEqual(5, 5).

  Closes #​11321

Other Bug Fixes

• Fix a crash in the docparams extension when a raised name does not infer to an exception, such as raise sum or raise some_module. Such objects have no ancestors(), which aborted the whole file with an astroid-error fatal message.

  Closes #​11228

• Fix a crash in the use-yield-from checker (AttributeError: 'Subscript' object has no attribute 'name') when a loop target is a subscript, attribute, or tuple.

  Closes #​11286

• Fix a crash in the docparams extension (AttributeError: 'AssignName' object has no attribute 'decorators') when a class has non-function attributes sharing the name of a property setter.

  Closes #​11287

Other Changes

• Upgrade the isort upper bound so isort 9 can be installed alongside pylint.

  Closes #​11351

astral-sh/ruff (ruff)

v0.16.5

Compare Source

Released on 2026-08-27.

Preview features

• Allow rules without codes (#​28049)
• Introduce category selectors (#​27666)
• Update preview default rules and categories (#​27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#​28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#​28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#​28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#​27978)

Documentation

• Document rule acceptance guidelines (#​27910)
• Document the new category selectors (#​27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

v0.16.4

Compare Source

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#​26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#​27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#​27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#​27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#​27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#​27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#​27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#​27753)
• [syntax-errors] Detect duplicate keyword arguments (#​17804)
• [syntax-errors] Detect parameters declared nonlocal (#​27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#​27807)
• Support pull diagnostics for notebook cells (#​27779)

Documentation

• Add default indicator to rules table (#​27724)
• Fix broken link to Python docs (#​27757)

Other changes

• Fix s390x stacker assembly in release builds (#​27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#​25464)
• Reduce configuration deserialization code size (#​27924)
• Check packed AST index bounds (#​27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot
• @​ewdurbin
• @​woodruffw
• @​Sacrimento
• @​lakshayxi
• @​WhiteFox0-0
• @​baltasarblanco

tox-dev/tox (tox)

v4.61.2

Compare Source

What's Changed

• chore: add license-files, remove licence classifier (PEP 639) by @​mwtoews in #​4052
• 🐛 fix(config): stop splitting factor names that look like ranges by @​MohammedAlkindi in #​4053
• 📝 docs(config): cover the keys that had no reference entry by @​gaborbernat in #​4056
• 📝 docs(config): document how factors work by @​gaborbernat in #​4055
• 📝 docs: name the actor in the factor and schema prose by @​gaborbernat in #​4057

New Contributors

• @​mwtoews made their first contribution in #​4052

Full Changelog: tox-dev/tox@4.61.1...4.61.2

v4.61.1

Compare Source

What's Changed

• 🐛 fix(schema): declare prefix in the labeled factor group's not clause by @​gaborbernat in #​4051

Full Changelog: tox-dev/tox@4.61.0...4.61.1

v4.61.0

Compare Source

What's Changed

• docs: fix dead virtualenv discovery link in explanation.rst by @​CAOShurong in #​4042
• Replace deprecated load_module in docs conf by @​gaborbernat in #​4043
• ✨ feat(toml): allow labeling a range factor group by @​gaborbernat in #​4049
• 🐛 fix(config): substitute inside override values by @​gaborbernat in #​4048
• ✨ feat(toml): declare factor group defaults and per-run overrides by @​gaborbernat in #​4050

Full Changelog: tox-dev/tox@4.60.1...4.61.0

v4.60.1

Compare Source

What's Changed

• Stop Windows pytest-timeout kills in CI by @​gaborbernat in #​4026
• fix(config): report a malformed ini as a handled error instead of a traceback by @​VXNCXNX in #​4027
• Handle unreadable configuration files by @​SirHegel in #​4035
• fix: a semicolon truncates a value read from a set_env file by @​VXNCXNX in #​4030
• fix: report an invalid --skip-env regex as a handled error by @​VXNCXNX in #​4029
• docs: drop the claim that tox -e py skips tests with missing dependencies by @​MohammedAlkindi in #​4036
• 🔧 chore: drop the now-unused ty ignore directive by @​gaborbernat in #​4039
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in #​4038
• Report a bad ini core value as a handled error by @​VXNCXNX in #​4028
• Report an empty TOML command value as a handled error by @​dylanpulver in #​4041

New Contributors

• @​VXNCXNX made their first contribution in #​4027
• @​SirHegel made their first contribution in #​4035
• @​MohammedAlkindi made their first contribution in #​4036
• @​dylanpulver made their first contribution in #​4041

Full Changelog: tox-dev/tox@4.60.0...4.60.1

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.