[dependabot]

Bumps the ruff-pre-commit group with 1 update in the / directory: https://github.com/astral-sh/ruff-pre-commit.

Updates https://github.com/astral-sh/ruff-pre-commit from v0.16.9 to 0.17.0

Release notes

Sourced from https://github.com/astral-sh/ruff-pre-commit's releases.

v0.17.0

See: https://github.com/astral-sh/ruff/releases/tag/0.17.0

v0.16.10

See: https://github.com/astral-sh/ruff/releases/tag/0.16.10

Commits

• 44b5042 Mirror: 0.17.0
• e2053c9 Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#184)
• f12be1e Mirror: 0.16.10
• 6089d41 Document adding quarto to types_or for Quarto code fence formatting (#183)
• See full diff in compare view

[hleroy]

REVIEW NEEDED

Checks: ci / tests ✅ · conventional-title ✅ · GitGuardian Security Checks ✅ · MERGEABLE / CLEAN
Release age: ruff 0.16.10 published 2026-10-01 (16 days) — past the 7-day cooldown:, not fresh, not a security update, not yanked, 0 OSV advisories.

This is a ruff PR, so it is REVIEW NEEDED by rule — not because anything is wrong with the release. Ruff is pinned in two places that must move together, and Dependabot only moved one of them.

Package	Old → New	Type	Finding
ruff-pre-commit	v0.16.9 → v0.16.10	patch	Release notes for 0.16.10 are limited to: two preview items (a categories migration guide, and UP052 context-manager iterator annotations), a diagnostics memory reduction, a server-side change (skip uv format in untrusted workspaces), docs, and a Rust toolchain bump to 1.99 / MSRV 1.97. No stable rule changes, no formatter changes, no default changes.

The sync problem — this is what needs a human:

This PR moves .pre-commit-config.yaml:36 to v0.16.10:

  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.16.10        # ← this PR

but leaves pyproject.toml:53 behind:

  "ruff==0.16.9",        # ← needs the same bump to 0.16.10

There is no counterpart PR open. .github/dependabot.yml ignores version-update:semver-patch for ruff in both the uv and pre-commit entries precisely so the pair arrives together — and 0.16.9 → 0.16.10 is a patch, so the uv-side PR was correctly suppressed. This pre-commit PR appears to have slipped past that same ignore, most likely because the tag format changed (v0.16.9 → the release tagged 0.16.10), which is not classified as a clean semver-patch update. So merging it alone produces exactly the divergence the config was written to prevent: the local --fix hook running 0.16.10 while CI's ruff check (from the pyproject pin, inside the django image) runs 0.16.9.

Note that .claude/hooks/session-start.sh derives RAINRADAR_RUFF from pyproject.toml, so it follows that pin automatically — there is no third place to edit.

Two reasonable resolutions, both for a human to pick:

1. Sync by hand — amend pyproject.toml:53 to "ruff==0.16.10" (plus the uv.lock refresh) on a separate branch and land both at 0.16.10. I have not pushed to this Dependabot branch, per the rubric.
2. Close this PR — a patch-only ruff bump is the churn the semver-patch ignore was written to avoid, and 0.16.10 contains nothing stable that affects this repo. Waiting for a minor bump (0.17.x), where both PRs arrive together, is the configured intent.

Impact on this codebase (if it does land at matched versions): grepped pyproject.toml for preview — not enabled, so UP052 and the other preview items are inert; lint.select carries no preview-only rules. No stable rule was added, removed or re-categorised in 0.16.10, so the existing lint.select set and every # noqa waiver behave identically. The formatter is unchanged, so PEP 758 output (except A, B: without parentheses, which this repo depends on) is unaffected. The server/uv format change is editor-only and never runs in CI or pre-commit.

Invariants considered: Ruff dual-pin — violated by this PR in isolation; that is the verdict. Python 3.14 / PEP 758 — safe: no formatter change, and ruff 0.16.10 still defaults as before (the Python-version default move to 3.11/3.15 is in 0.17.0, not here — worth knowing for the next ruff PR). Coverage ≥85% / ruff check clean — CI is green at 0.16.9 and 0.16.10 has no stable rule changes, so neither is at risk. No runtime invariant is in scope: ruff is lint-only.

Verdict rationale: The release itself is clean and I found nothing in 0.16.9 → 0.16.10 that this codebase exercises. The blocker is purely the dual-pin invariant: this PR would leave .pre-commit-config.yaml at 0.16.10 and pyproject.toml:53 at 0.16.9. Per the rubric every ruff PR is REVIEW NEEDED regardless, and here the counterpart is genuinely missing rather than merely unmerged, so a maintainer decision is required. Not merging.

_{Automated weekly Dependabot triage.}

---

Generated by Claude Code

[hleroy]

REVIEW NEEDED

Re-triaged: this PR already carried review-needed (applied 2026-10-17), but Dependabot pushed a new head commit b9688d0 on 2026-10-19T14:56:45Z, after the label — so it is not skipped as idempotent. Verdict is unchanged; the reasoning below is refreshed for the current head.

Checks: ci / tests ✅ · conventional-title ✅ · GitGuardian Security Checks ✅ · MERGEABLE / CLEAN
Release age: ruff 0.17.0 published 2026-10-09 (15 days). Past the 7-day cooldown:, not fresh, not yanked. Single release in the range.

Package	Old → New	Type	Finding
astral-sh/ruff-pre-commit (rev)	v0.16.9 → v0.17.0	minor (ruff is pre-1.0; strict semver ⇒ minor)	The mirror is a thin wrapper: at tag v0.17.0 its pyproject.toml pins exactly ruff==0.17.0 (verified by cloning the mirror and reading git show v0.17.0:pyproject.toml), and the tag v0.17.0 exists upstream (git ls-remote --tags → 44b5042…). So this PR's real content is ruff 0.16.9 → 0.17.0, whose changelog is: default target-version 3.10 → 3.11 (3.14 → 3.15 for unconfigured syntax checks); seven flake8-datetimez rules (DTZ001/005/006/007/011/012/901) dropped from the default set; F406 added to defaults; datetime as dt added to the flake8-import-conventions map; formatter/I001/E501/W505 now ignore trailing pragma comments when measuring line length; TID254, TID255 and RUF071 promoted preview → stable; full output always shows unsafe fixes; Unicode 17; ruff-lsp support removed.

Why this cannot land on its own

ruff is pinned in two places that must move together:

• .pre-commit-config.yaml line 36, rev: of https://github.com/astral-sh/ruff-pre-commit — this PR (v0.16.9 → v0.17.0), and
• pyproject.toml [dependency-groups] dev → ruff==0.16.9 — PR chore(deps-dev): bump ruff from 0.16.9 to 0.17.0 in the ruff group #52, which bumps it to 0.17.0.

The two are version-matched (the mirror pins ruff==0.17.0), so #46 and #52 must be merged together. Merging this one alone leaves the local --fix hook on 0.17.0 while CI lints with 0.16.9 — the mismatch the repo's dependabot.yml ignore rules were written to avoid.

And #52 is currently red, for a real reason

ci / tests on #52 fails on ruff check with one error that applies to this bump too, since it is the same ruff:

ICN001 `datetime` should be imported as `dt`
  --> radar/logging_json.py:13:20

0.17.0 added datetime as dt to the convention map and this repo selects ICN. The fix is a two-line rename in radar/logging_json.py (line 13 import datetime as _dt → as dt; line 70 _dt.datetime.fromtimestamp(record.created, tz=_dt.UTC) → dt.…) — grepped _dt\b tree-wide and those are the only two occurrences. ICN001's fix is marked unsafe, and this hook runs args: [--fix, --exit-non-zero-on-fix], so --fix will not repair it automatically: the hook will fail on every local commit until the rename lands. Per the hard rules nothing has been pushed to this Dependabot branch.

What green CI does and does not prove here. ci / tests lints with the ruff pinned in pyproject.toml (still 0.16.9 on this branch) and never runs pre-commit at all. So this PR's ✅ is no evidence about the hook — it merely confirms the repo is clean under the old ruff. The real evidence about 0.17.0's effect on this tree comes from #52's run: exactly one new finding (the ICN001 above), and zero from the newly stabilised TID254/TID255/RUF071 despite TID and RUF both being selected.

Impact on this codebase:

• DTZ de-defaulting is inert: lint.select names DTZ explicitly, so all seven rules stay on — which keeps the all archive time math is UTC and explicit invariant guarded.
• Default target-version change is inert: no target-version in [tool.ruff], so ruff derives py314 from requires-python = "==3.14.*"; PEP 758 except A, B: stays formatter-canonical and the new unconfigured 3.15 default never applies.
• Trailing-pragma line-length change: not visible to CI (which runs ruff check ., never ruff format --check), but this hook includes ruff-format, so it is the path where any reformat of lines with a trailing # noqa would appear. Worth a ruff format --diff pass when taking the pair.

Invariants: Ruff's two-place pin — the rule that makes any ruff PR REVIEW NEEDED; the counterpart (#52) and the exact rev: line are named above. Python 3.14 / PEP 758 — unaffected. pre-commit hooks change what runs on every commit — yes, and the ICN001 failure above is exactly that; it needs the rename first. conventional-pre-commit type list / gitleaks config — those revs are untouched by this diff.

Verdict rationale: Unchanged from the previous triage: any ruff bump is REVIEW NEEDED because Dependabot moves only one of the two pins, and this one additionally needs its counterpart #52 plus a two-line code change before either can go green. The release itself looks fine — ordinary new-rule churn, not a bad artifact — so this is not DO NOT MERGE. Suggested order: land the radar/logging_json.py rename on a branch of its own, then merge #52 and #46 together.

_{Automated weekly Dependabot triage.}

---

Generated by Claude Code

[hleroy]

Superseded by #52

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml