Sourced from ruff's releases.

0.14.1

Release Notes

Released on 2025-10-16.

Preview features

• [formatter] Remove parentheses around multiple exception types on Python 3.14+ (#20768)
• [flake8-bugbear] Omit annotation in preview fix for B006 (#20877)
• [flake8-logging-format] Avoid dropping implicitly concatenated pieces in the G004 fix (#20793)
• [pydoclint] Implement docstring-extraneous-parameter (DOC102) (#20376)
• [pyupgrade] Extend UP019 to detect typing_extensions.Text (UP019) (#20825)
• [pyupgrade] Fix false negative for TypeVar with default argument in non-pep695-generic-class (UP046) (#20660)

Bug fixes

• Fix false negatives in Truthiness::from_expr for lambdas, generators, and f-strings (#20704)
• Fix syntax error false positives for escapes and quotes in f-strings (#20867)
• Fix syntax error false positives on parenthesized context managers (#20846)
• [fastapi] Fix false positives for path parameters that FastAPI doesn't recognize (FAST003) (#20687)
• [flake8-pyi] Fix operator precedence by adding parentheses when needed (PYI061) (#20508)
• [ruff] Suppress diagnostic for f-string interpolations with debug text (RUF010) (#20525)

Rule changes

• [airflow] Add warning to airflow.datasets.DatasetEvent usage (AIR301) (#20551)
• [flake8-bugbear] Mark B905 and B912 fixes as unsafe (#20695)
• Use DiagnosticTag for more rules - changes display in editors (#20758,#20734)

Documentation

• Update Python compatibility from 3.13 to 3.14 in README.md (#20852)
• Update lint.flake8-type-checking.quoted-annotations docs (#20765)
• Update setup instructions for Zed 0.208.0+ (#20902)
• [flake8-datetimez] Clarify docs for several rules (#20778)
• Fix typo in RUF015 description (#20873)

Other changes

• Reduce binary size (#20863)
• Improved error recovery for unclosed strings (including f- and t-strings) (#20848)

Contributors

• @​ntBre
• @​Paillat-dev
• @​terror
• @​pieterh-oai
• @​MichaReiser
• @​TaKO8Ki

... (truncated)

Sourced from ruff's changelog.

0.14.1

Released on 2025-10-16.

Preview features

• [formatter] Remove parentheses around multiple exception types on Python 3.14+ (#20768)
• [flake8-bugbear] Omit annotation in preview fix for B006 (#20877)
• [flake8-logging-format] Avoid dropping implicitly concatenated pieces in the G004 fix (#20793)
• [pydoclint] Implement docstring-extraneous-parameter (DOC102) (#20376)
• [pyupgrade] Extend UP019 to detect typing_extensions.Text (UP019) (#20825)
• [pyupgrade] Fix false negative for TypeVar with default argument in non-pep695-generic-class (UP046) (#20660)

Bug fixes

• Fix false negatives in Truthiness::from_expr for lambdas, generators, and f-strings (#20704)
• Fix syntax error false positives for escapes and quotes in f-strings (#20867)
• Fix syntax error false positives on parenthesized context managers (#20846)
• [fastapi] Fix false positives for path parameters that FastAPI doesn't recognize (FAST003) (#20687)
• [flake8-pyi] Fix operator precedence by adding parentheses when needed (PYI061) (#20508)
• [ruff] Suppress diagnostic for f-string interpolations with debug text (RUF010) (#20525)

Rule changes

• [airflow] Add warning to airflow.datasets.DatasetEvent usage (AIR301) (#20551)
• [flake8-bugbear] Mark B905 and B912 fixes as unsafe (#20695)
• Use DiagnosticTag for more rules - changes display in editors (#20758,#20734)

Documentation

• Update Python compatibility from 3.13 to 3.14 in README.md (#20852)
• Update lint.flake8-type-checking.quoted-annotations docs (#20765)
• Update setup instructions for Zed 0.208.0+ (#20902)
• [flake8-datetimez] Clarify docs for several rules (#20778)
• Fix typo in RUF015 description (#20873)

Other changes

• Reduce binary size (#20863)
• Improved error recovery for unclosed strings (including f- and t-strings) (#20848)

Contributors

• @​ntBre
• @​Paillat-dev
• @​terror
• @​pieterh-oai
• @​MichaReiser
• @​TaKO8Ki
• @​ageorgou

... (truncated)

• 2bffef5 Bump 0.14.1 (#20925)
• e64d772 Standardize syntax error construction (#20903)
• 0369668 [pydoclint] Implement docstring-extraneous-parameter (DOC102) (#20376)
• 058fc37 [ty] Fix panic 'missing root' when handling completion request (#20917)
• ec9faa3 [ty] Run file watching tests serial when using nextest (#20918)
• 7155a62 [ty] Add version hint for failed stdlib attribute accesses (#20909)
• a67e069 More CI improvements (#20920)
• 6a1e91c [ty] Check typeshed VERSIONS for parent modules when reporting failed stdlib ...
• 3db5d59 Don't use codspeed or depot runners in CI jobs on forks (#20894)
• d23826c [ty] cache Type::is_redundant_with (#20477)
• Additional commits viewable in compare view

Sourced from zizmor's releases.

v1.15.2

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would fail to parse some Dependabot configuration files due to missing support for some schedule formats (#1247)

v1.15.1

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would fail to parse Dependabot configuration files due to missing support for some package ecosystems (#1240)

v1.15.0

This release comes with support for auditing Dependabot configuration files! Like with composite action definition auditing (introduced in v1.0.0), Dependabot configuration auditing is enabled by default but can be disabled as part of input collection.

To complement this new functionality, this release comes with two new audits: dependabot-execution and dependabot-cooldown.

New Features 🌈🔗

• New audit: dependabot-execution detects Dependabot configurations that allow insecure external code execution (#1220)

• New audit: dependabot-cooldown detects Dependabot configurations that do not include cooldown settings, or that set an insufficient cooldown (#1223)

Performance Improvements 🚄🔗

• zizmor now uses jemalloc as its default allocator on non-MSVC targets, which should significantly improve performance for Linux and macOS users (#1200)

Enhancements 🌱🔗

• zizmor now unconditionally emits its version number to stderr on startup (#1199)

• The ref-version-mismatch audit now supports auto-fixes for many findings (#1205)

  Many thanks to @​mostafa for implementing this improvement!

• The [impostor-commit] audit now supports auto-fixes for many findings (#1090)

  Many thanks to @​mostafa for implementing this improvement!

• zizmor is now more resilient to sporadic request failures when performing GitHub API requests (#1219)

• --collect=dependabot is now supported as a collection option, allowing users to audit only Dependabot configuration files (#1215)

• The --fix mode (introduced with v1.10.0) is now considered stable and no longer experimental (#1232)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would fail instead of analyzing single-file inputs that lacked an explicit parent path component, e.g. zizmor foo.yml instead of zizmor ./foo.yml (#1212)

Deprecations ⚠️🔗

• The workflows-only and actions-only values for --collect are now deprecated. These values have been replaced with workflows and actions, respectively, which have the same behavior but can be composed together with other collection modes. The deprecated modes will be removed in a future release (#1228)

... (truncated)

Sourced from zizmor's changelog.

1.15.2

Bug Fixes 🐛

• Fixed a bug where zizmor would fail to parse some Dependabot configuration files due to missing support for some schedule formats (#1247)

1.15.1

Bug Fixes 🐛

• Fixed a bug where zizmor would fail to parse Dependabot configuration files due to missing support for some package ecosystems (#1240)

1.15.0

This release comes with support for auditing Dependabot configuration files! Like with composite action definition auditing (introduced in v1.0.0), Dependabot configuration auditing is enabled by default but can be disabled as part of input collection.

To complement this new functionality, this release comes with two new audits: [dependabot-execution] and [dependabot-cooldown].

New Features 🌈

• New audit: [dependabot-execution] detects Dependabot configurations that allow insecure external code execution (#1220)

• New audit: [dependabot-cooldown] detects Dependabot configurations that do not include cooldown settings, or that set an insufficient cooldown (#1223)

Performance Improvements 🚄

• zizmor now uses jemalloc as its default allocator on non-MSVC targets, which should significantly improve performance for Linux and macOS users (#1200)

Enhancements 🌱

• zizmor now unconditionally emits its version number to stderr on startup (#1199)

• The [ref-version-mismatch] audit now supports auto-fixes for many findings (#1205)

  Many thanks to @​mostafa for implementing this improvement!

... (truncated)

• a4c6c3b chore: release zizmor 1.15.2 (#1249)
• 41b3983 bump github-actions-models to 0.36.0 (#1248)
• 2189780 feat: Add validation for extended Dependabot schedule intervals (#1247)
• 7984062 chore: prep release 1.15.1 (#1243)
• e9e4eb9 models: add devcontainers as a known ecosystem (#1240)
• 4494b8a prep for 1.15.0 release (#1236)
• cbe25bb deps: bump tower-http (#1234)
• 6e1a300 chore: bump github-actions-models to 0.33.0 (#1233)
• d9c2d95 feat: stabilize the auto-fix mode (#1232)
• 7ad9afb docs: bump trophies (#1231)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions