chore(deps): update all non-major dependencies

[khepri-bot]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
github/codeql-action	action	patch	v4.37.7 → v4.37.8	v4.37.9
ruff (source, changelog)	dependency-groups	patch	==0.16.3 → ==0.16.4	0.16.6 (+1)
tox (changelog)	dependency-groups	patch	==4.60.0 → ==4.60.1	4.61.3 (+3)

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.8

Compare Source

No user facing changes.

astral-sh/ruff (ruff)

v0.16.4

Compare Source

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#​26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#​27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#​27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#​27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#​27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#​27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#​27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#​27753)
• [syntax-errors] Detect duplicate keyword arguments (#​17804)
• [syntax-errors] Detect parameters declared nonlocal (#​27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#​27807)
• Support pull diagnostics for notebook cells (#​27779)

Documentation

• Add default indicator to rules table (#​27724)
• Fix broken link to Python docs (#​27757)

Other changes

• Fix s390x stacker assembly in release builds (#​27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#​25464)
• Reduce configuration deserialization code size (#​27924)
• Check packed AST index bounds (#​27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot
• @​ewdurbin
• @​woodruffw
• @​Sacrimento
• @​lakshayxi
• @​WhiteFox0-0
• @​baltasarblanco

tox-dev/tox (tox)

v4.60.1

Compare Source

What's Changed

• Stop Windows pytest-timeout kills in CI by @​gaborbernat in #​4026
• fix(config): report a malformed ini as a handled error instead of a traceback by @​VXNCXNX in #​4027
• Handle unreadable configuration files by @​SirHegel in #​4035
• fix: a semicolon truncates a value read from a set_env file by @​VXNCXNX in #​4030
• fix: report an invalid --skip-env regex as a handled error by @​VXNCXNX in #​4029
• docs: drop the claim that tox -e py skips tests with missing dependencies by @​MohammedAlkindi in #​4036
• 🔧 chore: drop the now-unused ty ignore directive by @​gaborbernat in #​4039
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in #​4038
• Report a bad ini core value as a handled error by @​VXNCXNX in #​4028
• Report an empty TOML command value as a handled error by @​dylanpulver in #​4041

New Contributors

• @​VXNCXNX made their first contribution in #​4027
• @​SirHegel made their first contribution in #​4035
• @​MohammedAlkindi made their first contribution in #​4036
• @​dylanpulver made their first contribution in #​4041

Full Changelog: tox-dev/tox@4.60.0...4.60.1

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.