fix(deps): update python-dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
filelock	==3.32.3 → ==3.32.4
ruff (source, changelog)	==0.16.3 → ==0.16.4
semgrep (changelog)	==1.173.0 → ==1.174.0
uvicorn (changelog)	==0.52.3 → ==0.52.4

---

Release Notes

tox-dev/py-filelock (filelock)

v3.32.4

Compare Source

What's Changed

• 🐛 fix: retry transient denials on open and claim read by @​gaborbernat in tox-dev/filelock#705
• 🧪 test: deflake six scheduled-run failures by @​gaborbernat in tox-dev/filelock#704
• 🧪 test: cover a reclaimed private record for real by @​gaborbernat in tox-dev/filelock#706
• 🧪 test(fork): fork once the event loop has closed by @​gaborbernat in tox-dev/filelock#714
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in tox-dev/filelock#713
• escape the hostname every marker publishes by @​dxbjavid in tox-dev/filelock#709

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

astral-sh/ruff (ruff)

v0.16.4

Compare Source

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#​26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#​27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#​27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#​27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#​27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#​27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#​27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#​27753)
• [syntax-errors] Detect duplicate keyword arguments (#​17804)
• [syntax-errors] Detect parameters declared nonlocal (#​27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#​27807)
• Support pull diagnostics for notebook cells (#​27779)

Documentation

• Add default indicator to rules table (#​27724)
• Fix broken link to Python docs (#​27757)

Other changes

• Fix s390x stacker assembly in release builds (#​27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#​25464)
• Reduce configuration deserialization code size (#​27924)
• Check packed AST index bounds (#​27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot
• @​ewdurbin
• @​woodruffw
• @​Sacrimento
• @​lakshayxi
• @​WhiteFox0-0
• @​baltasarblanco

semgrep/semgrep (semgrep)

v1.174.0

Compare Source

### Added

• Diff scans now report which dependency source files were added or modified relative to the merge base. (changed-dependency-sources)

### Changed

• Partial scans (--x-partial-scan-rule-id) now resolve dependencies only for
  subprojects whose ecosystem is evaluated by the rules being run. Subprojects in
  any other ecosystem are skipped and reported to semgrep-app as skipped
  subprojects. (SC-3830)

Kludex/uvicorn (uvicorn)

v0.52.4: Version 0.52.4

Compare Source

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#​3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.