⬆️ deps(deps): Bump the python-packages group with 13 updates

[dependabot]

Bumps the python-packages group with 13 updates:

Package	From	To
django	6.0.5	6.0.6
django-environ	0.13.0	0.14.0
django-health-check	4.4.1	4.4.3
django-permissions-policy	4.30.0	4.32.0
coverage	7.14.1	7.14.3
django-upgrade	1.30.0	1.31.1
mutmut	3.5.0	3.6.0
prek	0.4.3	0.4.6
pytest	9.0.3	9.1.1
ruff	0.15.15	0.15.20
zizmor	1.25.2	1.26.1
certifi	2026.5.20	2026.6.17
idna	3.17	3.18

Updates django from 6.0.5 to 6.0.6

Commits

• ee93f65 [6.0.x] Bumped version for 6.0.6 release.
• 1721035 [6.0.x] Fixed CVE-2026-48587 -- Ignored whitespace padding when checking Vary...
• 664652f [6.0.x] Fixed CVE-2026-35193 -- Varied on Authorization when caching non-publ...
• b433025 [6.0.x] Fixed CVE-2026-8404 -- Used Cache-Control directives case-insensitive...
• 625a670 [6.0.x] Fixed CVE-2026-7666 -- Delayed setting SMTP connection until fully co...
• c807d9c [6.0.x] Fixed CVE-2026-6873 -- Prevented signed cookie salt namespace collisi...
• 98a75e3 [6.0.x] Included commit hash in checksum file when building artifacts for rel...
• dd895d6 [6.0.x] Updated translations from Transifex.
• 49ca2db [6.0.x] Updated links to severity levels in release notes.
• c9f32a2 [6.0.x] Added stub release notes and release date for 6.0.6 and 5.2.15.
• Additional commits viewable in compare view

Updates django-environ from 0.13.0 to 0.14.0

Release notes

Sourced from django-environ's releases.

v0.14.0

django-environ 0.14.0 improves type annotations across Env and updates Env.read_env() to support caller-owned file-like objects without closing them.

This is the final django-environ release supporting Python 3.9.

Added

• Type annotations and matching docstring information for Env methods.
• A conditional typing_extensions dependency providing TypeAlias on Python 3.9.

Changed

• Env.read_env() now accepts path-like and file-like objects without closing file-like objects supplied by the caller.

Fixed

• Env.read_env() now raises an explicit error when it cannot determine the caller frame used to resolve the default .env path.

Full changelog: joke2k/django-environ@v0.13.0...v0.14.0

PyPI: https://pypi.org/project/django-environ/0.14.0/

Changelog

Sourced from django-environ's changelog.

v0.14.0_ - 18-June-2026

Added +++++

• Added type annotations and matching docstring information to Env methods [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.
• Added a Python 3.9 compatibility dependency on typing_extensions for TypeAlias [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Changed +++++++

• Updated Env.read_env() to accept path-like and file-like objects without closing file-like objects supplied by the caller [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Fixed +++++

• Added an explicit error when Env.read_env() cannot determine its caller frame while resolving the default .env path [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Commits

• 6e1b461 Merge pull request #635 from joke2k/release/0.14.0
• b65f66e chore(release): prepare 0.14.0
• 39f980a Merge pull request #633 from joke2k/hotfix/0.14-apply-pr-600
• 020825c ci: allow release and hotfix PRs to target main
• 6c1dd5b fix(typing): support TypeAlias on Python 3.9
• c0d7b2b Ensure Env.read_env supports any file-like object
• c41ee54 Guard against an inability to read stack frames
• 64bfe4b Add type information to docstrings
• 791df95 Add type annotations to str and bool parameters of methods in Env
• 4370592 Merge branch 'develop' into main
• See full diff in compare view

Updates django-health-check from 4.4.1 to 4.4.3

Release notes

Sourced from django-health-check's releases.

4.4.3

What's Changed

• Fix #742 -- Remove blank lines in OpenMetrics output by @​pfcodes in codingjoe/django-health-check#741

New Contributors

• @​pfcodes made their first contribution in codingjoe/django-health-check#741

Full Changelog: codingjoe/django-health-check@4.4.2...4.4.3

4.4.2

What's Changed

• Add sponsors to readme

Full Changelog: codingjoe/django-health-check@4.4.1...4.4.2

Commits

• 46c7d08 Fix #742 -- Remove blank lines in OpenMetrics output (#741)
• 0ef6677 [pre-commit.ci] pre-commit autoupdate
• bf59fb0 Bump actions/checkout from 6 to 7
• 2409afb [pre-commit.ci] pre-commit autoupdate
• c2fb029 Update sponsor image link in README.md
• 5e0ec1f [pre-commit.ci] pre-commit autoupdate
• ccb4f7f Bump codecov/codecov-action from 6 to 7
• d09fca3 Add sponsors section
• 537935f [pre-commit.ci] pre-commit autoupdate
• 7221356 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates django-permissions-policy from 4.30.0 to 4.32.0

Changelog

Sourced from django-permissions-policy's changelog.

4.32.0 (2026-06-26)

• Add Django 6.1 support.

• Drop Django 4.2 to 5.1 support.

• Update feature list from Chrome and Firefox sources.

  New features:

  • webnn

4.31.0 (2026-06-12)

• Added decorators for per-view header control: @permissions_policy_override and @permissions_policy_report_only_override.

• Made ImproperlyConfigured errors name the responsible setting.

Commits

• d8abcb5 Version 4.32.0
• 44a81c2 Update feature names from Chrome and Firefox source code (#550)
• beafbaf Add Django 6.1 support (#549)
• cf10287 Drop Django 4.2 to 5.1 support (#548)
• 4fc2642 [pre-commit.ci] pre-commit autoupdate (#546)
• 52ea40b Version 4.31.0
• 74ab57f Add policy override decorators (#547)
• 020c0e2 Made ImproperlyConfigured errors name the responsible setting (#545)
• e8fb916 Improve GitHub Actions workflow (#544)
• 6568c11 Upgrade dependencies (#543)
• See full diff in compare view

Updates coverage from 7.14.1 to 7.14.3

Changelog

Sourced from coverage's changelog.

Version 7.14.3 — 2026-06-22

• Fix: the default ... exclusion rule now also matches function bodies whose closing return-type bracket is on its own line (for example, after a long -> dict[ ... ] annotation that a formatter has split over multiple lines). Closes issue 2185, thanks Mengjia Shang <pull 2196_>.

• Fix: On 3.13t, we incorrectly issued Couldn't import C tracer errors. We can't import the C tracer because in 7.14.2 we stopped shipping compiled wheels for 3.13t. Thanks, Hugo van Kemenade <pull 2203_>_.

.. _issue 2185: coveragepy/coveragepy#2185 .. _pull 2196: coveragepy/coveragepy#2196 .. _pull 2203: coveragepy/coveragepy#2203

.. _changes_7-14-2:

Version 7.14.2 — 2026-06-20

• Fix: some messages were being written to stdout, making coverage json -o - useless for capturing JSON output. Now messages are written to stderr, fixing issue 2197_.

• Fix: CoverageData kept one SQLite connection per thread that recorded coverage, but never closed them when those threads terminated. On long runs with many short-lived threads this leaked one file descriptor per dead thread, eventually failing with OSError: [Errno 24] Too many open files. Connections belonging to terminated threads are now closed and dropped. Fixes issue 2192. Thanks, Matthew Lloyd <pull 2193_>.

• Fix: when using sys.monitoring, we were assuming we could use the COVERAGE_ID tool id. But other tools might also assume they could use that id. Pre-allocated ids don't really make sense, so now we search for a usable one instead. Fixes issue 2187_.

• Following the advice of cibuildwheel <no-13t_>_, we no longer distribute wheels for Python 3.13 free-threaded.

.. _issue 2187: coveragepy/coveragepy#2187 .. _issue 2192: coveragepy/coveragepy#2192 .. _pull 2193: coveragepy/coveragepy#2193 .. _issue 2197: coveragepy/coveragepy#2197 .. _no-13t: https://py-free-threading.github.io/ci/#building-free-threaded-wheels-with-cibuildwheel

.. _changes_7-14-1:

Commits

• 22f13ea docs: sample HTML for 7.14.3
• 2ca4e5f docs: prep for 7.14.3
• 01d714e docs: add changelog entry for #2203
• f36248d fix: don't emit 'Couldn't import C tracer' warning for 3.13t (#2203)
• 86d73d1 docs: thanks, Mengjia Shang
• 3d4ae3c docs: add the #2196 pr link to CHANGES
• f4b2b4d fix: exclude ... bodies after multi-line return-type annotations (#2185) (#...
• 1980ed0 chore: bump sigstore/gh-action-sigstore-python (#2201)
• bca3217 build: since we don't ship 3.13t, don't test it
• 77550d8 docs: oops, mismatched pull requests
• Additional commits viewable in compare view

Updates django-upgrade from 1.30.0 to 1.31.1

Changelog

Sourced from django-upgrade's changelog.

1.31.1 (2026-06-26)

• Remove the settings_logging_admin_email_handler fixer because it made an incorrect change and cannot be salvaged.

  Thanks to Mike Edmunds for spotting the mistake in this GitHub comment <https://github.com/adamchainz/django-upgrade/pull/662#discussion_r3463198673>. PR [#671](https://github.com/adamchainz/django-upgrade/issues/671) <https://github.com/adamchainz/django-upgrade/pull/671>.

1.31.0 (2026-06-25)

• Support Django 6.1 as a target version.

  PR [#646](https://github.com/adamchainz/django-upgrade/issues/646) <https://github.com/adamchainz/django-upgrade/pull/646>__.

• Add Django 6.1+ :ref:mail_get_connection <mail_get_connection> fixer to replace no-argument mail get_connection() calls with mailers.default, and remove inline connection=get_connection() kwargs from mail sending functions.

  PR [#666](https://github.com/adamchainz/django-upgrade/issues/666) <https://github.com/adamchainz/django-upgrade/pull/666>__.

• Add Django 6.1+ :ref:mail_fail_silently <mail_fail_silently> fixer to remove fail_silently=False keyword arguments from mail sending function calls.

  PR [#668](https://github.com/adamchainz/django-upgrade/issues/668) <https://github.com/adamchainz/django-upgrade/pull/668>__.

• Add Django 6.1+ settings_logging_admin_email_handler fixer to rename the email_backend argument of AdminEmailHandler in the LOGGING setting to using.

  PR [#662](https://github.com/adamchainz/django-upgrade/issues/662) <https://github.com/adamchainz/django-upgrade/pull/662>__.

• Add Django 6.1+ compatibility_imports :ref:fixer entries <postgres_bit_aggregates> to move BitAnd, BitOr, and BitXor imports from django.contrib.postgres.aggregates to django.db.models.

  PR [#658](https://github.com/adamchainz/django-upgrade/issues/658) <https://github.com/adamchainz/django-upgrade/pull/658>__.

• Add Django 6.1+ :ref:transaction_savepoint <transaction_savepoint> fixer to rename django.db.transaction\’s savepoint to savepoint_create.

  PR [#660](https://github.com/adamchainz/django-upgrade/issues/660) <https://github.com/adamchainz/django-upgrade/pull/660>__.

• Add Django 2.0+ :ref:render_to_response <render_to_response> fixer to rewrite render_to_response() calls to render(), inserting request as the first argument.

  PR [#669](https://github.com/adamchainz/django-upgrade/issues/669) <https://github.com/adamchainz/django-upgrade/pull/669>__.

• Extend :ref:test_http_headers <test_http_headers> fixer to cover AsyncClient, AsyncRequestFactory, and self.async_client.*() calls.

  Thanks to Benjamin Aduo in PR [#633](https://github.com/adamchainz/django-upgrade/issues/633) <https://github.com/adamchainz/django-upgrade/pull/633>__.

• Extend :ref:django_urls <django_urls> fixer to convert translated URL patterns wrapped in translation functions, like _(r'^about/$'), when the pattern is convertible.

  PR [#667](https://github.com/adamchainz/django-upgrade/issues/667) <https://github.com/adamchainz/django-upgrade/pull/667>__.

• Extend :ref:utils_timezone fixer to work when no import datetime statement exists, by inserting import datetime as dt when the name dt is unused.

  Thanks to Ryan Siemens for the report in Issue [#568](https://github.com/adamchainz/django-upgrade/issues/568) <https://github.com/adamchainz/django-upgrade/issues/568>__ and Benjamin Aduo for the implementation in PR [#631](https://github.com/adamchainz/django-upgrade/issues/631) <https://github.com/adamchainz/django-upgrade/pull/631>__.

... (truncated)

Commits

• 5adcd26 Version 1.31.1
• 8e6b2e7 Remove settings_logging_admin_email_handler fixer (#671)
• 1dc5977 Version 1.31.0
• b8ac97f Fix some fixers to correctly handle calls with starred arguments (#670)
• b39db9a Add Django 2.0+ fixer for render_to_response() (#669)
• dce3062 Add Django 6.1+ fixer for email function mail_fail_silently arg (#668)
• a0efd95 Add Django 6.1+ fixer for django.core.mail.get_connection() changes (#666)
• ecc46a3 Extend django_urls to handle translated URL patterns (#667)
• d6dbffa Fix versioned_branches fixer to avoid emptying parent block (#665)
• f682a9e Fix null_boolean_field fixer when NullBooleanField used as base class (#664)
• Additional commits viewable in compare view

Updates mutmut from 3.5.0 to 3.6.0

Changelog

Sourced from mutmut's changelog.

3.6.0

* Add `# pragma: no mutate block` and `# pragma: no mutate start/end` comments


Add do_not_mutate_patterns to disable mutations with a regex


Add only_mutate config to select which files get mutated


Also mutate methods decorated with (only) @staticmethod or @classmethod


Add use_setproctitle option to disable process renaming (automatically disabled on MacOS)


Add (unstable) timeout_multiplier and timeout_constant options


Rename paths_to_mutate to source_paths


Deprecate tests_dir in favor of pytest_add_cli_args_test_selection


Change max_stack_depth to only consider functions inside source_paths


Disable mutation of enums and @staticmethod/@classmethod methods when type_check_command is set, as these mutations break type checking


Fix mutation for enum class methods


Fix mutate_only_covered_lines when project uses custom coverage.py config


Fix execution when running mutmut via python -m mutmut run


Fix mutation of class _SomePrivateClass class methods


Fix mutation of default args


Fix mutmut browse crash when no file is selected yet


Fix timeout checker looking up the wrong mutant's expected test time, which could cause mutants to hang


Compare stats paths after resolving symlinks


Warn when mutmut cannot match mutants with the collected stats

Commits

• bd6057f Release
• e92d763 docs: fix comment about windows support and add unreleased changelog
• 4b61167 remove unused code for enums and staticmethod/classmethod
• 2bf799a compare stats paths after resolving symlinks
• c0f4c85 test: verify forward references work in class methods
• e481acd only count source paths for stack frame depth
• 43ea954 Refactor trampoline to use decorator
• 2644c8a extend mutation snapshot regression test
• ce6c587 fix: detect silent test-to-mutant key mismatch in stats
• b24a12b feat: add do_not_mutate_patterns config
• Additional commits viewable in compare view

Updates prek from 0.4.3 to 0.4.6

Release notes

Sourced from prek's releases.

0.4.6

Release Notes

Released on 2026-07-01.

Enhancements

• Verify managed toolchain downloads before installation (#2229)
• Add PREK_DOCKER_NO_INIT to opt-out Docker --init (#2242)
• Improve subprocess error messages (#2257)
• Split run concurrency knobs: PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES (#2276)

Performance

• Avoid allocating markdown extensions per file (#2245)
• Avoid unchanged config tracking writes (#2247)
• Delay trailing whitespace output buffer (#2244)
• Prefilter VCS permalink lines (#2253)
• Skip unnecessary submodule updates during hook repo clone (#2255)

Documentation

• Document language_version inferring for Python and Go (#2241)

Other changes

• Refactor env var handling (#2277)
• Use serde-saphyr for YAML string quoting (#2228)

Contributors

• @​shaanmajid
• @​j178

Install prek 0.4.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.6/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.6/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

... (truncated)

Changelog

Sourced from prek's changelog.

0.4.6

Released on 2026-07-01.

Enhancements

• Verify managed toolchain downloads before installation (#2229)
• Add PREK_DOCKER_NO_INIT to opt-out Docker --init (#2242)
• Improve subprocess error messages (#2257)
• Split run concurrency knobs: PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES (#2276)

Performance

• Avoid allocating markdown extensions per file (#2245)
• Avoid unchanged config tracking writes (#2247)
• Delay trailing whitespace output buffer (#2244)
• Prefilter VCS permalink lines (#2253)
• Skip unnecessary submodule updates during hook repo clone (#2255)

Documentation

• Document language_version inferring for Python and Go (#2241)

Other changes

• Refactor env var handling (#2277)
• Use serde-saphyr for YAML string quoting (#2228)

Contributors

• @​shaanmajid
• @​j178

0.4.5

Released on 2026-06-15.

✨Highlights

0.4.5 completes prek's pre-commit language coverage. With R, Conda, Perl, and coursier now supported, prek supports every language available in pre-commit, plus prek-only modern languages such as Bun and Deno.

This is full feature parity with pre-commit. The last major compatibility gap is closed, and prek is now on the path to 1.0.

💚 Sponsorship

If prek saves time for you or your team, please consider sponsoring the project on GitHub Sponsors. It helps keep

... (truncated)

Commits

• 643fba4 Bump version to 0.4.6 (#2280)
• b0f9261 Refactor env var handling (#2277)
• 8494d16 Split run concurrency knobs (#2276)
• f20bbaa Update sample config for .pre-commit-config.yaml (#2275)
• 5485289 Pin pre-commit repos to commit hash (#2274)
• d418ab3 Improve nix shebang parsing (#2271)
• cc261c1 Update actions/checkout action to v7 (#2267)
• 8d2dbba Update Rust crate itertools to 0.15.0 (#2265)
• 51db86c Update Rust crate phf to 0.14.0 (#2266)
• 1aa7d38 Update dependency uv to v0.11.23 (#2262)
• Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates ruff from 0.15.15 to 0.15.20

Release notes

Sourced from ruff's releases.

0.15.20

Release Notes

Released on 2026-06-25.

Preview features

• Allow human-readable names in rule selectors (#25887)
• Emit a warning instead of an error for unknown rule selectors (#26113)
• Match noqa shebang handling in ruff:ignore comments (#26286)
• [ruff] Remove pytest-fixture-autouse (RUF076) (#26240, #26371)

Documentation

• Add versioning sections to custom crate READMEs (#26317)
• Update ruff_python_parser README for crates.io (#26315)
• [perflint] Clarify that PERF402 applies to any iterable (#26242)

Contributors

• @​dhruvmanila
• @​MichaReiser
• @​ntBre
• @​trilamsr

Install ruff 0.15.20

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.20/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.15.20/ruff-installer.ps1 | iex"

Download ruff 0.15.20

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.20

Released on 2026-06-25.

Preview features

• Allow human-readable names in rule selectors (#25887)
• Emit a warning instead of an error for unknown rule selectors (#26113)
• Match noqa shebang handling in ruff:ignore comments (#26286)
• [ruff] Remove pytest-fixture-autouse (RUF076) (#26240, #26371)

Documentation

• Add versioning sections to custom crate READMEs (#26317)
• Update ruff_python_parser README for crates.io (#26315)
• [perflint] Clarify that PERF402 applies to any iterable (#26242)

Contributors

• @​dhruvmanila
• @​MichaReiser
• @​ntBre
• @​trilamsr

0.15.19

Released on 2026-06-23.

Preview features

• Support human-readable names when hovering suppression comments and in code actions (#26114)

Bug fixes

• Fall back to default settings when editor-only settings are invalid (#26244)
• Fix panic when inserting text at a notebook cell boundary (#26111)

Rule changes

• [pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801) (#26239)

Performance

• Avoid allocating when parsing single string literals (#26200)
• Avoid reallocating singleton call arguments (#26223)
• Lazily create source files for lint diagnostics (#26226)
• Optimize formatter text width and indentation (#26236)
• Reserve capacity for builtin bindings (#26229)
• Skip repeated-key checks for singleton dictionaries (#26228)
• Use ArrayVec for qualified name segments (#26224)

... (truncated)

Commits

• f82a36b Bump 0.15.20 (#26376)
• af32943 Improve the summarise-ecosystem-results skill (#26378)
• 485ebab Remove RUF076 name from schema (#26371)
• ef81835 [ty] Implement rust-analyzer's "Click for full compiler diagnostic" feature (...
• 572b31e [ruff] Remove pytest-fixture-autouse (RUF076) (#26240)
• f703f21 Allow human-readable names in rule selectors (#25887)
• 0d726b2 [ty] Reuse equality semantics for membership compatibility (#25955)
• dbe6e98 [ty] Infer definite equality comparison results (#26337)
• e700ea3 [ty] Prove TypedDict structural patterns exhaustive (#26285)
• 6a0d2ec [ty] Widen inferred class-valued instance attributes (#26338)
• Additional commits viewable in compare view

Updates zizmor from 1.25.2 to 1.26.1

Release notes

Sourced from zizmor's releases.

v1.26.1

This is a small corrective release for 1.26.0.

v1.26.0

New Features 🌈🔗

• New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#1985)

  Many thanks to @​andrew for proposing and implementing this improvement!

• New audit: unsound-ternary detects pseudo-ternary expressions that don't evaluate as expected (#2085)

  Many thanks to @​terror for proposing and implementing this improvement!

• New audit: adhoc-packages detects run: steps that install packages in an ad-hoc manner (#2061)

  Many thanks to @​connorshea for proposing and implementing this improvement!

Enhancements 🌱🔗

• The cache-poisoning audit now detects additional cache disablement heuristics (#2053)

• The known-vulnerable-actions audit is now configurable. See the configuration documentation for details (#2084)

• The excessive-permissions audit is now aware of the code-quality permission (#2088)

• The unpinned-uses audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @​v6) (#2127)

Performance Improvements 🚄🔗

• Most online audits are significantly faster, thanks to more precise retry handling (#2036) Bug Fixes 🐛🔗

• Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#2026)

  Many thanks to @​fionn for implementing this fix!

• Fixed a bug where ref-version-mismatch would fail to fully match some version comments (#2040)

• Fixed a bug where dependabot-cooldown would fail to honor the user's configured days when performing autofixes (#2055)

• Steps and jobs gated by statically-false if: conditions (e.g. if: false, if: ${{ false }}) are now skipped during auditing, since they cannot execute (#2059, #2069)

• Fixed a bug where ref-version-mismatch would fail to identify some valid version comments (#2073)

• Fixed a bug where unpinned-images would incorrectly flag empty matrix expansions as unpinned container image references (#2102)

• Fixed a bug where unpinned-images would incorrectly flag some matrix expansions as unpinned (#2098)

• The SARIF (--format=sarif) and GitHub Annotations (--format=github) output formats now provide more correct/useful paths, particularly when the user provides a relative path as input to zizmor rather than zizmor . (#1748,