Update dependency ruff to v0.15.18

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ruff (source, changelog)	0.15.17 → 0.15.18

---

Release Notes

astral-sh/ruff (ruff)

v0.15.18

Compare Source

Released on 2026-06-18.

Preview features

• Handle nested ruff:ignore comments (#​25791)
• Stop displaying severity in output (#​26050)
• Use human-readable names in CLI output (#​25937)
• Use human-readable names in LSP and playground diagnostics (#​26058)
• [pydocstyle] Prevent property docstrings starting with verbs (D421) (#​23775)
• [flake8-pyi] Extend PYI033 to Python files (#​26129)

Bug fixes

• Detect equivalent numeric mapping keys (#​26009)
• Detect mapping keys equivalent to booleans (#​25982)
• Detect repeated signed and complex dictionary keys (#​26007)

Rule changes

• [flake8-pyi] Rename PYI033 to legacy-type-comment (#​26131)

Performance

• Use ThinVec for call keywords (#​25999)
• Inline parser recovery context checks (#​26038)
• Match parser keywords as bytes (#​26037)
• Move value parsing out of lexing (#​25360)

Server

• Render subdiagnostics and secondary annotations as related information (#​26011)

Documentation

• Update fix availability for always-fixable rules (#​26091)
• [flake8-tidy-imports] Add fix safety section (TID252) (#​17491)

Parser

• Reject __debug__ lambda parameters (#​26022)
• Reject _ as a match-pattern target (#​25977)
• Reject multiple starred names in sequence patterns (#​25976)
• Reject parenthesized star imports (#​26021)
• Reject starred comprehension targets (#​26023)
• Reject unparenthesized generator expressions in class bases (#​25978)
• Reject yield expressions after commas (#​26024)
• Validate function type parameter default order (#​25981)

Playground

• Make diagnostic links clickable (#​26104)
• Use diagnostic tags (#​26105)

Contributors

• @​AlexWaygood
• @​ntBre
• @​gtkacz
• @​MichaReiser
• @​charliermarsh
• @​Kalmaegi

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...

workspace/pushgateway

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	github.com/prometheus/prometheus	v0.302.1	0.311.3	CVE-2026-42151	github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
🟠 HIGH	github.com/prometheus/prometheus	v0.302.1	0.311.3, 0.305.2	CVE-2026-42154	github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint
🟠 HIGH	golang.org/x/oauth2	v0.25.0	0.27.0	CVE-2025-22868	golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
🔴 CRITICAL	stdlib	v1.24.1	1.24.13, 1.25.7, 1.26.0-rc.3	CVE-2025-68121	crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
🟠 HIGH	stdlib	v1.24.1	1.24.4	CVE-2025-22874	crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509
🟠 HIGH	stdlib	v1.24.1	1.24.12, 1.25.6	CVE-2025-61726	golang: net/url: Memory exhaustion in query parameter parsing in net/url
🟠 HIGH	stdlib	v1.24.1	1.24.11, 1.25.5	CVE-2025-61729	crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate
🟠 HIGH	stdlib	v1.24.1	1.25.8, 1.26.1	CVE-2026-25679	net/url: Incorrect parsing of IPv6 host literals in net/url
🟠 HIGH	stdlib	v1.24.1	1.25.9, 1.26.2	CVE-2026-32280	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
🟠 HIGH	stdlib	v1.24.1	1.25.9, 1.26.2	CVE-2026-32281	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
🟠 HIGH	stdlib	v1.24.1	1.25.9, 1.26.2	CVE-2026-32283	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	v1.24.1	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...