Update dependency ruff to v0.15.19

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ruff (source, changelog)	0.15.18 → 0.15.19

---

Release Notes

astral-sh/ruff (ruff)

v0.15.19

Compare Source

Released on 2026-06-23.

Preview features

• Support human-readable names when hovering suppression comments and in code actions (#​26114)

Bug fixes

• Fall back to default settings when editor-only settings are invalid (#​26244)
• Fix panic when inserting text at a notebook cell boundary (#​26111)

Rule changes

• [pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801) (#​26239)

Performance

• Avoid allocating when parsing single string literals (#​26200)
• Avoid reallocating singleton call arguments (#​26223)
• Lazily create source files for lint diagnostics (#​26226)
• Optimize formatter text width and indentation (#​26236)
• Reserve capacity for builtin bindings (#​26229)
• Skip repeated-key checks for singleton dictionaries (#​26228)
• Use ArrayVec for qualified name segments (#​26224)

Documentation

• [flake8-pyi] Note that PYI051 is an opinionated stylistic rule (#​26179)
• [pyupgrade] Clarify UP029 as a Python 2 compatibility rule (#​26243)

Other changes

• Publish Ruff crates to crates.io (#​26271)

Contributors

• @​MakenRosa
• @​MichaReiser
• @​trilamsr
• @​ntBre
• @​sanjibani
• @​charliermarsh

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-27145	*x509.Certificate).VerifyHostname previously called matchHostnames in ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	*x509.Certificate).VerifyHostname previously called matchHostnames in ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	*x509.Certificate).VerifyHostname previously called matchHostnames in ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	Decoding a maliciously-crafted MIME header containing many invalid enc ...

workspace/bin/alertmanager

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	golang.org/x/crypto	v0.51.0	0.52.0	CVE-2026-39827	An authenticated SSH client that repeatedly opened channels which were ...
🟠 HIGH	golang.org/x/crypto	v0.51.0	0.52.0	CVE-2026-39828	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
🟠 HIGH	golang.org/x/crypto	v0.51.0	0.52.0	CVE-2026-39829	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
🟠 HIGH	golang.org/x/crypto	v0.51.0	0.52.0	CVE-2026-39830	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
🟠 HIGH	golang.org/x/crypto	v0.51.0	0.52.0	CVE-2026-39835	SSH servers which use CertChecker as a public key callback without set ...
🟠 HIGH	golang.org/x/crypto	v0.51.0	0.52.0	CVE-2026-42508	golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
🟠 HIGH	golang.org/x/crypto	v0.51.0	0.52.0	CVE-2026-46595	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
🟠 HIGH	golang.org/x/crypto	v0.51.0	0.52.0	CVE-2026-46597	An incorrectly placed cast from bytes to int allowed for server-side p ...