build(deps): bump the axm-audit group in /packages/axm-audit with 2 updates

[dependabot]

Bumps the axm-audit group in /packages/axm-audit with 2 updates: complexipy and ruff.

Updates complexipy from 6.2.0 to 7.0.1

Release notes

Sourced from complexipy's releases.

7.0.1

Patch release: partial runs (e.g. pre-commit hooks analyzing only staged files) no longer reorder the snapshot, so commits no longer produce a modified complexipy-snapshot.json. The release pipeline also gained artifact-upload retries and quieter notifications.

Fixed

• Snapshot entries for analyzed files are updated in place instead of being moved to the end of the file: partial runs (e.g. pre-commit hooks analyzing only staged files) no longer reorder the snapshot, so the snapshot stays byte-identical across commits that do not change complexity. (#226)

Changed

• The release pipeline now retries artifact uploads with pinned workflow versions and only notifies downstream repositories on tag releases, keeping non-tag pushes silent.
• Pinned maturin version in the release workflow to avoid GitHub API rate limits when resolving the latest version inside Docker build containers.

PRs

• fix(snapshot): keep analyzed entries in place on partial runs by @​rohaquinlop in rohaquinlop/complexipy#227

Full Changelog: rohaquinlop/complexipy@7.0.0...7.0.1

7.0.0

Major release: the refactoring suggestions are now a clippy-style lint system with measured reductions, diff comparison gains a --staged mode and a [tool.complexipy.diff] TOML section, and the deprecated output flags and TOML keys are removed. Check the migration guide before upgrading.

Features

• --suggest-refactors is now a clippy-style lint system: stable rule IDs (C001–C005, C007, C011), category and applicability metadata, path:line:col anchors with caret spans, verbatim suggestion rendering, and a documentation link per rule. (#209)
• Refactor-plan findings are included in JSON, SARIF, and GitLab exports when --suggest-refactors is passed; the SARIF rule catalog is built dynamically from the plans encountered. (#209)
• compute_diff, has_regressions, DiffEntry, and DiffStatus are now part of the public Python API, so CI tools can consume diff results as objects instead of parsing terminal output. (#210)
• collect_removable_ignored_locations() and RemovableIgnore are exported from the Python API. Every run now reports ignore comments that are no longer necessary (path:line function=X complexity=N <comment>) when the suppressed function is back under the allowed limit. (#213)
• --staged flag for git-index comparison — answers "what complexity am I about to commit?" instead of only what changed in the working tree; --staged alone defaults the baseline to HEAD and enforces, while --diff <ref> --staged enforces against the ref. (#218)
• [tool.complexipy.diff] TOML section so the comparison policy lives in the repository config: branch = "main" makes a plain complexipy . run behave like --diff main (enforcement included), staged = true enables staged comparison by default, and branch = "" opts out. CLI flags take precedence over the section. (#219)
• Refactor reductions are now measured instead of estimated: for every machine-applicable suggestion (C002, C007) the replacement is spliced into the source, re-parsed, and re-scored, so estimated_reduction and estimated_complexity_after report the literal delta of applying the suggestion — and ranking, overlap resolution, and the noise filter all operate on measured values. The new reduction_is_measured flag separates measured plans from help-only formula estimates, which the CLI renders with a ~ qualifier (Estimated reduction: ~-2) while measured plans render plain (Reduction: -2). Guard suggestions are now faithful splices for loops with statements before or after the if-chain and for multi-line loop headers; measurement failures fall back to the formula estimate — never a panic, never a fabricated number. (#225)

Fixed

• Snapshot updates now merge with the existing snapshot instead of replacing it: only the files analyzed in a run are touched, so partial runs (e.g. pre-commit hooks analyzing only staged files) no longer erase the baseline for unanalyzed files. (#215)
• The docs footer now renders its links as styled links instead of raw markdown text, on both the English and Spanish landing pages. (#216)

Changed

• Refactor-plan reduction estimates are now honest: the reduction math was rewritten and validated against measured before/after complexity, C004 no longer suggests splitting match statements, C006 was deleted because its gate could never fire, and C011 now fires on try → with → try chains. Overlapping plans are deduped against every overlap and capped at 5, reporting dropped ones as "... and N more suggestions". (#209)
• Condition extraction in the refactor rules now tracks bracket depth, string literals, and walrus := instead of a naive rfind(':'). (#209)
• file_complexity() now returns cwd-relative paths (matching git diff --name-only), and nested invocations resolve git paths via a git ls-files basename lookup — without this, diffing per-file results silently marked every function as NEW. (#210)
• Community standards files were added: CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, issue templates, and a pull request template. (#201)

Removed

... (truncated)

Changelog

Sourced from complexipy's changelog.

[7.0.1] - 2026-08-12

Changed

• The release pipeline now retries artifact uploads with pinned workflow versions and only notifies downstream repositories on tag releases, keeping non-tag pushes silent.
• Pinned maturin version in the release workflow to avoid GitHub API rate limits when resolving the latest version inside Docker build containers.

Fixed

• Snapshot entries for analyzed files are updated in place instead of being moved to the end of the file: partial runs (e.g. pre-commit hooks analyzing only staged files) no longer reorder the snapshot, so the snapshot stays byte-identical across commits that do not change complexity. (#226)

See the release notes for the full details.

[7.0.0] - 2026-08-10

!!! note "Migration"

The deprecated `--output-json`, `--output-csv`, `--output-gitlab`,
`--output-sarif`, and `--ratchet` flags and their TOML keys were
removed; use `--output-format` and `--diff` instead. See the
[migration guide](https://rohaquinlop.github.io/complexipy/migration/)
for each removed flag and key with its replacement.

Added

• --suggest-refactors is now a clippy-style lint system: stable rule IDs (C001-C005, C007, C011), category and applicability metadata, path:line:col anchors with caret spans, verbatim suggestion rendering, and a documentation link per rule. (#209)
• Refactor-plan findings are included in JSON, SARIF, and GitLab exports when --suggest-refactors is passed; the SARIF rule catalog is built dynamically from the plans encountered. (#209)
• compute_diff, has_regressions, DiffEntry, and DiffStatus are now part of the public Python API, so CI tools can consume diff results as objects instead of parsing terminal output; DiffStatus provides named constants such as DiffStatus.REGRESSED. (#210)
• collect_removable_ignored_locations() and RemovableIgnore are exported from the Python API. Every run now reports ignore comments that are no longer necessary (path:line function=X complexity=N <comment>) when the suppressed function is back under the allowed limit - the exit code is unaffected, the report is suppressed under --quiet, and it works under

... (truncated)

Commits

• 5767f64 ci(release): pin maturin version to avoid GitHub API rate limits in Docker bu...
• c3b46c5 chore: bump version 7.0.1
• 07d27e8 Merge pull request #227 from rohaquinlop/issue-226-snapshot-reorders-entries-...
• c4c5ec6 fix(snapshot): keep analyzed entries in place on partial runs
• a368738 ci(release): only notify downstream repos on tag releases
• 3abf4be ci(release): retry artifact uploads and pin current versions
• d51d0ec docs(changelog): add 7.0.0 migration callout
• 4c76e51 chore: bump version 7.0.0
• 8b50862 docs(changelog): finalize 7.0.0 release notes
• 899296d docs(changelog): add measured reductions entry
• Additional commits viewable in compare view

Updates ruff from 0.16.4 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

Commits

• 9e4938c Bump 0.16.5 (#28110)
• aad0e90 Allow rules without codes (#28049)
• 5fdab73 Update preview default rules and categories (#27877)
• 29c8e5b Document rule acceptance guidelines (#27910)
• 50a4d7f Document the new category selectors (#27906)
• ada8795 Introduce category selectors (#27666)
• d894723 [ty] Infer lambda parameters through callable type aliases (#28109)
• 2685fde [ty] Narrow functional enum members in == and match (#28103)
• efcffd2 [ty] Intersection simplifications with subtype-related generic specialization...
• eb78048 [ty] Bump ecosystem-analyzer for HTML escaping (#28104)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions