build(deps-dev): bump the pip group across 1 directory with 5 updates

[dependabot]

Bumps the pip group with 5 updates in the / directory:

Package	From	To
ruff	0.15.16	0.15.20
semgrep	1.165.0	1.168.0
zizmor	1.25.2	1.26.1
pytest	9.0.3	9.1.1
prek	0.4.4	0.4.5

Updates ruff from 0.15.16 to 0.15.20

Release notes

Sourced from ruff's releases.

0.15.20

Release Notes

Released on 2026-06-25.

Preview features

• Allow human-readable names in rule selectors (#25887)
• Emit a warning instead of an error for unknown rule selectors (#26113)
• Match noqa shebang handling in ruff:ignore comments (#26286)
• [ruff] Remove pytest-fixture-autouse (RUF076) (#26240, #26371)

Documentation

• Add versioning sections to custom crate READMEs (#26317)
• Update ruff_python_parser README for crates.io (#26315)
• [perflint] Clarify that PERF402 applies to any iterable (#26242)

Contributors

• @​dhruvmanila
• @​MichaReiser
• @​ntBre
• @​trilamsr

Install ruff 0.15.20

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.20/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.15.20/ruff-installer.ps1 | iex"

Download ruff 0.15.20

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.20

Released on 2026-06-25.

Preview features

• Allow human-readable names in rule selectors (#25887)
• Emit a warning instead of an error for unknown rule selectors (#26113)
• Match noqa shebang handling in ruff:ignore comments (#26286)
• [ruff] Remove pytest-fixture-autouse (RUF076) (#26240, #26371)

Documentation

• Add versioning sections to custom crate READMEs (#26317)
• Update ruff_python_parser README for crates.io (#26315)
• [perflint] Clarify that PERF402 applies to any iterable (#26242)

Contributors

• @​dhruvmanila
• @​MichaReiser
• @​ntBre
• @​trilamsr

0.15.19

Released on 2026-06-23.

Preview features

• Support human-readable names when hovering suppression comments and in code actions (#26114)

Bug fixes

• Fall back to default settings when editor-only settings are invalid (#26244)
• Fix panic when inserting text at a notebook cell boundary (#26111)

Rule changes

• [pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801) (#26239)

Performance

• Avoid allocating when parsing single string literals (#26200)
• Avoid reallocating singleton call arguments (#26223)
• Lazily create source files for lint diagnostics (#26226)
• Optimize formatter text width and indentation (#26236)
• Reserve capacity for builtin bindings (#26229)
• Skip repeated-key checks for singleton dictionaries (#26228)
• Use ArrayVec for qualified name segments (#26224)

... (truncated)

Commits

• f82a36b Bump 0.15.20 (#26376)
• af32943 Improve the summarise-ecosystem-results skill (#26378)
• 485ebab Remove RUF076 name from schema (#26371)
• ef81835 [ty] Implement rust-analyzer's "Click for full compiler diagnostic" feature (...
• 572b31e [ruff] Remove pytest-fixture-autouse (RUF076) (#26240)
• f703f21 Allow human-readable names in rule selectors (#25887)
• 0d726b2 [ty] Reuse equality semantics for membership compatibility (#25955)
• dbe6e98 [ty] Infer definite equality comparison results (#26337)
• e700ea3 [ty] Prove TypedDict structural patterns exhaustive (#26285)
• 6a0d2ec [ty] Widen inferred class-valued instance attributes (#26338)
• Additional commits viewable in compare view

Updates semgrep from 1.165.0 to 1.168.0

Release notes

Sourced from semgrep's releases.

Release v1.168.0

1.168.0 - 2026-06-24

### Added

• Added an experimental --x-dependency-paths flag to scan and ci that includes the full dependency path(s) for transitive supply-chain findings in --json and --sarif output. (SC-3547)

### Changed

• Malicious supply chain rules are now labeled "Malicious" instead of "Basic" in the scan analysis summary table. (SC-3504)

### Infra/Release Changes

• semgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)
• Aliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)
• The metavariable-regex and metavariable-comparison (re.match()) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)

Release v1.167.0

1.167.0 - 2026-06-17

### Added

• Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding)
• Added a nosemgrep_disabled field to the scan configuration so the platform can disable nosemgrep inline ignore comments org-wide for a scan. (APPEX-1122)
• Semgrep now skips binary files (images, archives, compiled executables, etc.) during scanning by default, detected via matching file extensions to known file-format magic bytes Pass --no-exclude-binary-files to scan binary files as before. (ENGINE-2708)

### Fixed

• semgrep ci with --sarif now correctly populates the output's ignores field with nosemgrep-suppressed findings, in accordance with other output formatters. (gh-6651)

### Infra/Release Changes

• Updated the ocaml-tree-sitter-core submodule to the latest upstream main, providing

  • improved thread-safety
  • bumps the tree-sitter CLI option used from 0.20.6 to 0.20.8.

  (ocaml-tree-sitter-core-bump)

Release v1.166.0

1.166.0 - 2026-06-11

### Added

• Pro: Added experimental cross-file (interfile) analysis for Gosu, enabling taint tracking across multiple Gosu source files. (gosu-interfile)

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.168.0 - 2026-06-24

### Added

• Added an experimental --x-dependency-paths flag to scan and ci that includes the full dependency path(s) for transitive supply-chain findings in --json and --sarif output. (SC-3547)

### Changed

• Malicious supply chain rules are now labeled "Malicious" instead of "Basic" in the scan analysis summary table. (SC-3504)

### Infra/Release Changes

• semgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)
• Aliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)
• The metavariable-regex and metavariable-comparison (re.match()) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)

1.167.0 - 2026-06-17

### Added

• Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding)
• Added a nosemgrep_disabled field to the scan configuration so the platform can disable nosemgrep inline ignore comments org-wide for a scan. (APPEX-1122)
• Semgrep now skips binary files (images, archives, compiled executables, etc.) during scanning by default, detected via matching file extensions to known file-format magic bytes Pass --no-exclude-binary-files to scan binary files as before. (ENGINE-2708)

### Fixed

• semgrep ci with --sarif now correctly populates the output's ignores field with nosemgrep-suppressed findings, in accordance with other output formatters. (gh-6651)

### Infra/Release Changes

• Updated the ocaml-tree-sitter-core submodule to the latest upstream main, providing

  • improved thread-safety
  • bumps the tree-sitter CLI option used from 0.20.6 to 0.20.8.

  (ocaml-tree-sitter-core-bump)

1.166.0 - 2026-06-11

### Added

• Pro: Added experimental cross-file (interfile) analysis for Gosu, enabling taint tracking across multiple Gosu source files. (gosu-interfile)
• Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more (ENGINE-2789)

... (truncated)

Commits

• 3167f9c chore: release 1.168.0
• 94ac223semgrep/semgrep-proprietary#6651
• fd5e60esemgrep/semgrep-proprietary#6602
• acf763esemgrep/semgrep-proprietary#6655
• b635c1fsemgrep/semgrep-proprietary#6653
• b0a3bb4semgrep/semgrep-proprietary#6654
• d03aad0 chore(spacegrep): migrate Comment.ml from libpcre 8.x to libpcre2 10.x (semgr...
• 8855bc5 refactor(docker): do not create duplicate unused artifacts (semgrep/semgrep-p...
• 51c6552 refactor(ci): delegate archive-handling to {download,upload}-artifact (semg...
• d9d8813semgrep/semgrep-proprietary#6652
• Additional commits viewable in compare view

Updates zizmor from 1.25.2 to 1.26.1

Release notes

Sourced from zizmor's releases.

v1.26.1

This is a small corrective release for 1.26.0.

v1.26.0

New Features 🌈🔗

• New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#1985)

  Many thanks to @​andrew for proposing and implementing this improvement!

• New audit: unsound-ternary detects pseudo-ternary expressions that don't evaluate as expected (#2085)

  Many thanks to @​terror for proposing and implementing this improvement!

• New audit: adhoc-packages detects run: steps that install packages in an ad-hoc manner (#2061)

  Many thanks to @​connorshea for proposing and implementing this improvement!

Enhancements 🌱🔗

• The cache-poisoning audit now detects additional cache disablement heuristics (#2053)

• The known-vulnerable-actions audit is now configurable. See the configuration documentation for details (#2084)

• The excessive-permissions audit is now aware of the code-quality permission (#2088)

• The unpinned-uses audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @​v6) (#2127)

Performance Improvements 🚄🔗

• Most online audits are significantly faster, thanks to more precise retry handling (#2036) Bug Fixes 🐛🔗

• Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#2026)

  Many thanks to @​fionn for implementing this fix!

• Fixed a bug where ref-version-mismatch would fail to fully match some version comments (#2040)

• Fixed a bug where dependabot-cooldown would fail to honor the user's configured days when performing autofixes (#2055)

• Steps and jobs gated by statically-false if: conditions (e.g. if: false, if: ${{ false }}) are now skipped during auditing, since they cannot execute (#2059, #2069)

• Fixed a bug where ref-version-mismatch would fail to identify some valid version comments (#2073)

• Fixed a bug where unpinned-images would incorrectly flag empty matrix expansions as unpinned container image references (#2102)

• Fixed a bug where unpinned-images would incorrectly flag some matrix expansions as unpinned (#2098)

• The SARIF (--format=sarif) and GitHub Annotations (--format=github) output formats now provide more correct/useful paths, particularly when the user provides a relative path as input to zizmor rather than zizmor . (#1748, #2095)

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.26.1

This is a small corrective release for 1.26.0.

1.26.0

New Features 🌈

• New audit: [typosquat-uses] detects #!yaml uses: clauses that reference likely typoed actions (#1985)

  Many thanks to @​andrew for proposing and implementing this improvement!

• New audit: [unsound-ternary] detects pseudo-ternary expressions that don't evaluate as expected (#2085)

  Many thanks to @​terror for proposing and implementing this improvement!

• New audit: [adhoc-packages] detects #!yaml run: steps that install packages in an ad-hoc manner (#2061)

  Many thanks to @​connorshea for proposing and implementing this improvement!

Enhancements 🌱

• The [cache-poisoning] audit now detects additional cache disablement heuristics (#2053)

• The [known-vulnerable-actions] audit is now configurable. See the configuration documentation for details (#2084)

• The [excessive-permissions] audit is now aware of the code-quality permission (#2088)

• The [unpinned-uses] audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @v6) (#2127)

Performance Improvements 🚄

• Most online audits are significantly faster, thanks to more precise retry handling (#2036)

Bug Fixes 🐛

• Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#2026)

  Many thanks to @​fionn for implementing this fix!

• Fixed a bug where [ref-version-mismatch] would fail to fully match some version comments (#2040)

... (truncated)

Commits

• 597db4d zizmor 1.26.1 (#2137)
• 97037cd zizmor 1.26.0 (#2136)
• 3fecda6 Bump trophies (#2135)
• cdaf536 Add InputGroup::root (#2095)
• d7672f9 docs: fix release note references (#2132)
• 5420162 docs: pin manual uvx zizmor examples (#2131)
• e9d4a44 feat(unpinned-uses): pin to full version when fixing a major ref (#2127)
• e638658 [BOT] update JSON schemas from SchemaStore (#2126)
• 2c47399 chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group (#2125)
• cd68f65 chore(deps): bump the github-actions group across 1 directory with 3 updates ...
• Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates prek from 0.4.4 to 0.4.5

Release notes

Sourced from prek's releases.

0.4.5

Release Notes

Released on 2026-06-15.

✨Highlights

0.4.5 completes prek's pre-commit language coverage. With R, Conda, Perl, and coursier now supported, prek supports every language available in pre-commit, plus prek-only modern languages such as Bun and Deno.

This is full feature parity with pre-commit. The last major compatibility gap is closed, and prek is now on the path to 1.0.

💚 Sponsorship

If prek saves time for you or your team, please consider sponsoring the project on GitHub Sponsors. It helps keep new features, performance work, and maintenance moving.

Enhancements

• Add Perl language support (#2201)
• Add R language support (#2206)
• Add Conda language support (#2203)
• Add coursier language support (#2194)
• Add group filters to list (#2152)
• Remove legacy repo path support (#2150)
• Skip cloning fully filtered remote repos (#2151)

Performance

• Avoid building JSON trees in syntax hooks (#2156)
• Scan mixed line endings without line vector (#2160)
• Skip file scan for always-run no-filename hooks (#2155)
• Use fixed buffer for EOF scan (#2163)
• Use fixed buffer for private key scan (#2164)

Bug fixes

• Fix pretty-format-json CRLF handling (#2210)
• Handle missing blobs in diff snapshots (#2211)
• Ignore coursier channel from working repo (#2202)

Contributors

• @​j178

Install prek 0.4.5

... (truncated)

Changelog

Sourced from prek's changelog.

0.4.5

Released on 2026-06-15.

✨Highlights

0.4.5 completes prek's pre-commit language coverage. With R, Conda, Perl, and coursier now supported, prek supports every language available in pre-commit, plus prek-only modern languages such as Bun and Deno.

This is full feature parity with pre-commit. The last major compatibility gap is closed, and prek is now on the path to 1.0.

💚 Sponsorship

If prek saves time for you or your team, please consider sponsoring the project on GitHub Sponsors. It helps keep new features, performance work, and maintenance moving.

Enhancements

• Add Perl language support (#2201)
• Add R language support (#2206)
• Add Conda language support (#2203)
• Add coursier language support (#2194)
• Add group filters to list (#2152)
• Remove legacy repo path support (#2150)
• Skip cloning fully filtered remote repos (#2151)

Performance

• Avoid building JSON trees in syntax hooks (#2156)
• Scan mixed line endings without line vector (#2160)
• Skip file scan for always-run no-filename hooks (#2155)
• Use fixed buffer for EOF scan (#2163)
• Use fixed buffer for private key scan (#2164)

Bug fixes

• Fix pretty-format-json CRLF handling (#2210)
• Handle missing blobs in diff snapshots (#2211)
• Ignore coursier channel from working repo (#2202)

Contributors

• @​j178

Commits

• bb31082 Update README.md
• fa4e2dc Bump version to 0.4.5 (#2221)
• e9336fa Add R language support (#2206)
• 97a5a15 Update Rust crate which to v8.0.3 (#2219)
• 20a519a Update Rust crate ignore to v0.4.26 (#2218)
• 88f0e2b Update dependency uv to v0.11.19 (#2214)
• 7bd4300 Update GitHub Actions to v7 (#2220)
• 48ed5cc Update Rust crate async_zip to 0.0.18 (#2217)
• 257e98a Update pre-commit to v1.47.2 (#2216)
• 0c04602 Update GitHub Actions (#2215)
• Additional commits viewable in compare view