[renovate]

This PR contains the following updates:

Package	Type	Update	Change
astral-sh/ruff-pre-commit	repository	patch	v0.17.3 → v0.17.4
astral-sh/ty-pre-commit	repository	patch	v0.0.95 → v0.0.100
ghcr.io/astral-sh/uv	final	patch	0.13.6 → 0.13.7
github/codeql-action	action	patch	v4.39.1 → v4.39.3
oxc-project/mirrors-oxfmt	repository	minor	v0.74.0 → v0.78.0
zizmorcore/zizmor-action	action	patch	v0.8.0 → v0.8.1

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

astral-sh/ruff-pre-commit

v0.17.4

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.17.4

astral-sh/ty-pre-commit

v0.0.100

Compare Source

See: https://github.com/astral-sh/ty/releases/tag/0.0.100

v0.0.99

Compare Source

See: https://github.com/astral-sh/ty/releases/tag/0.0.99

v0.0.98

Compare Source

See: https://github.com/astral-sh/ty/releases/tag/0.0.98

v0.0.97

Compare Source

See: https://github.com/astral-sh/ty/releases/tag/0.0.97

v0.0.96

Compare Source

See: https://github.com/astral-sh/ty/releases/tag/0.0.96

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.13.7

Compare Source

Released on 2026-11-03.

Preview features

• Add --output-version to uv workspace metadata for requesting a specific schema version (#​22958)
• Report aliased OSV records as a single vulnerability in uv audit (#​22990)

Bug fixes

• Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#​23008)
• Prevent uv's Windows trampolines from closing handles they did not inherit (#​22977)
• Allow uvx to run tools with CPython builds whose versions contain local identifiers (#​23013)
• Generate valid module names when uv init creates packaged projects whose names start with a digit (#​23022)
• Preserve comments around existing inline dependency groups when uv add updates a group (#​23017)
• Allow uv remove with an empty inline tool.uv.sources table (#​23012)

Documentation

• Correct the cache-keys inline table example (#​22984)

github/codeql-action

v4.39.3

Compare Source

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #​4283

v4.39.2

Compare Source

• Update default CodeQL bundle version to 2.27.4. #​4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​4243

oxc-project/mirrors-oxfmt

v0.78.0

Compare Source

v0.77.0

Compare Source

v0.76.0

Compare Source

v0.75.0

Compare Source

zizmorcore/zizmor-action

v0.8.1

Compare Source

Sponsorship is appreciated!

zizmor 1.32 is now the default version used by this action.

Full release notes: https://docs.zizmor.sh/release-notes/#​1320

Full Changelog: zizmorcore/zizmor-action@v0.8.0...v0.8.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.