fix(deps): update python-dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
alembic (changelog)	==1.19.1 → ==1.19.2
filelock	==3.32.4 → ==3.32.5
ruff (source, changelog)	==0.16.5 → ==0.16.6
semgrep (changelog)	==1.175.0 → ==1.176.1

---

Release Notes

tox-dev/py-filelock (filelock)

v3.32.5

Compare Source

What's Changed

• 🧪 test(fork): report where a stalled fork stops by @​gaborbernat in tox-dev/filelock#715
• 📝 docs: say that mode is read-only in the thread-local section by @​Gares95 in tox-dev/filelock#716
• 🐛 fix(lease): clear token after failed acquire by @​lprnmns in tox-dev/filelock#721

New Contributors

• @​lprnmns made their first contribution in tox-dev/filelock#721

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

astral-sh/ruff (ruff)

v0.16.6

Compare Source

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#​28219)
• [flake8-pytest-style] Add an autofix for PT020 (#​27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#​28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#​27313)

Bug fixes

• Validate unary expressions when parsing (#​28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#​28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#​27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#​28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#​27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#​27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#​28027)

Documentation

• Add another example and glob reference for lint.per-file-ignores (#​28106)
• Add duplicate work guidance (#​28229)
• [flake8-async] Document thread offloading (ASYNC240) (#​28008)
• [pyupgrade] Clarify default encoding argument handling (UP012) (#​27315)

Other changes

• Allow unary plus in match patterns on Python 3.15 (#​28231)

Contributors

• @​flying-sheep
• @​pikammmmm
• @​fly1d
• @​waterWang
• @​Pierre-Sassoulas
• @​ntBre
• @​jelle-openai
• @​ericbuehl
• @​tjkuson
• @​AbhinavMir
• @​Whning0513
• @​chirizxc

semgrep/semgrep (semgrep)

v1.176.0

### Changed

• Homebrew installs of Semgrep are no longer supported on Intel Macs. (ENGINE-2951)

v1.175.1

### Fixed

• Fixed scans run with --trace that would fail with Stdlib.Effect.Unhandled(Eio__core__Cancel.Get_context) when a secret would fail to validate (CODE-9906)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.