[dependabot]

Bumps the ruff group with 1 update: ruff.

Updates ruff from 0.16.9 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

  The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

• Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

  The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

• Remove support for ruff-lsp (#28750)

  Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

• lazy-import-mismatch (TID254)
• lazy-import-immediately-resolved (TID255)
• os-path-commonprefix (RUF071)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits

• 5b27c1c Bump version to 0.17.0 (#29259)
• 8f362bf Integrate vendored Unicode names into Ruff
• 88a50d6 Revert upstream Unicode loose matching
• 276832a Revert upstream Unicode alias normalization
• 26911ca Vendor unicode_names2 from upstream
• 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
• bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
• 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
• dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
• ef23c9c Update default and latest Python versions for 3.15 (#28792)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[hleroy]

REVIEW NEEDED

Checks: ci / tests ❌ FAILED (real, not flaky) · conventional-title ✅ · GitGuardian Security Checks ✅ · mergeable_state blocked (by the failing check; no conflict)
Release age: ruff 0.17.0 published 2026-10-09 (15 days). Past the 7-day cooldown:, not fresh, not yanked. Single release in the range (patch bumps are ignored by dependabot.yml, and 0.16.9 → 0.17.0 is the next non-patch release).

Package	Old → New	Type	Finding
ruff	0.16.9 → 0.17.0	minor (ruff is pre-1.0; strict semver ⇒ minor)	Breaking: default target-version 3.10 → 3.11, and 3.14 → 3.15 for syntax checking when unconfigured; seven flake8-datetimez rules (DTZ001/005/006/007/011/012/901) removed from the default rule set; F406 added to defaults; full output now always shows unsafe fixes; the formatter, I001, E501 and W505 now consistently ignore trailing pragma comments when computing line length ("may reformat some existing imports"); Unicode 17 data; JUnit skipped attribute; conda-forge builds no longer embed Python. Promoted preview → stable: TID254 lazy-import-mismatch, TID255 lazy-import-immediately-resolved, RUF071 os-path-commonprefix. flake8-import-conventions: datetime as dt added as a conventional alias. ruff-lsp support removed.

Why CI is red — this is a real finding, not a flake

The ruff check step of ci / tests fails with exactly one error (job log):

ICN001 `datetime` should be imported as `dt`
  --> radar/logging_json.py:13:20
   |
13 | import datetime as _dt
   |                    ^^^
help: Alias `datetime` to `dt`
note: This is an unsafe fix and may change runtime behavior
Found 1 error.

This repo selects ICN in [tool.ruff] lint.select, and 0.17.0 added datetime as dt to the convention map — so the pre-existing _dt alias is now a violation. The fix is a two-line rename in one file (radar/logging_json.py:13 import datetime as _dt → as dt, and line 70 _dt.datetime.fromtimestamp(record.created, tz=_dt.UTC) → dt.…); grepped _dt\b across the tree and those are the only two occurrences of this alias (radar/lightning/ingest.py:69's _utc_dt and radar/views.py's start_dt/end_dt are unrelated local names). The alternative is an ICN001 entry in lint.ignore or a # noqa, but the rename matches the convention and is what the project would presumably want. Per the hard rules I have not pushed anything to this Dependabot branch — that code change is yours to make.

Note the hook form is affected too: ruff-check runs with args: [--fix, --exit-non-zero-on-fix], and ICN001's fix is marked unsafe, so --fix will not auto-apply it — the hook will simply fail on every commit until the rename lands.

Its counterpart PR

ruff is pinned in two places that must move together:

• pyproject.toml → ruff==0.17.0 (this PR), and
• .pre-commit-config.yaml → rev: of https://github.com/astral-sh/ruff-pre-commit, line 36, currently rev: v0.16.9.

Dependabot only updates the first here. The counterpart exists: #46 (ruff-pre-commit v0.16.9 → v0.17.0), which I verified pins exactly ruff==0.17.0 in the mirror's pyproject.toml at tag v0.17.0 — so the pair is version-matched. #46 and this PR must land together (and after the _dt rename), or the --fix hook and the CI ruff disagree about waivers and about trailing-pragma line length.

Impact on this codebase (what else 0.17.0 changes here):

• DTZ removed from defaults — not a problem, but worth knowing. lint.select lists DTZ explicitly, so all seven de-defaulted rules stay enabled. That matters because the all archive time math is UTC and explicit invariant leans on DTZ to catch a naive datetime.now(); the protection is intact precisely because the select is explicit rather than implicit.
• Default target-version change is inert: no target-version in [tool.ruff], so ruff reads requires-python = "==3.14.*" and targets py314. PEP 758 (except A, B: without parentheses) therefore stays formatter-canonical — the new unconfigured default of 3.15 never applies.
• TID254/TID255/RUF071 promoted to stable: the repo selects both TID and RUF, so these now run — and CI proves they produce zero findings on this tree (the run reports Found 1 error, the ICN001 above).
• Trailing-pragma line-length change is the one thing CI cannot see: the CI step runs ruff check . only, never ruff format --check. So a formatting delta on lines carrying a trailing # noqa (e.g. radar/providers/meteofrance_render.py:508) would surface locally via the ruff-format hook, not here. Worth one ruff format --diff pass when you take this.

Invariants: Ruff's two-place pin (the reason this is always REVIEW NEEDED) — named above with the exact line to sync and the counterpart PR. Python 3.14 / PEP 758 — unaffected, see target-version above. UTC time math via DTZ — preserved by the explicit DTZ select. Coverage ≥85% / ruff check clean — currently violated by ICN001 until the rename lands.

Verdict rationale: Any ruff bump is REVIEW NEEDED by rubric, because Dependabot can only move one of the two pins. Here there is a second, independent reason to escalate: CI is red for a genuine, reproducible lint finding introduced by 0.17.0's new datetime as dt convention, and clearing it needs a code change on this branch that triage is not allowed to push. Nothing about 0.17.0 looks bad — it is ordinary new-rule churn — so this is not DO NOT MERGE; it just needs a human to land the rename and merge this together with #46.

_{Automated weekly Dependabot triage.}

---

Generated by Claude Code