[dependabot]

Bumps the uv-minor-patch group with 2 updates: complexipy and ruff.

Updates complexipy from 8.0.1 to 8.1.0

Release notes

Sourced from complexipy's releases.

8.1.0

Minor release: complexipy now ships a language server. complexipy lsp gives any editor with an LSP client inlay hints, hover, and warnings, and the VS Code extension and a new Zed extension run on top of it. The CLI gains --fix for machine-applicable suggestions and --select/--ignore for rule selection, Python 3.15 syntax parses, and a JSON schema describes the configuration.

Added

• A language server: complexipy lsp speaks the Language Server Protocol on stdio, so any editor with an LSP client gets complexity feedback with no per-editor code. It answers inlay hint requests with the cognitive complexity of each function and, optionally, the increment contributed by each line; it answers hover requests with the function total, its threshold status, and the top refactoring suggestion, built on demand for the hovered function so large files stay responsive; and it publishes a warning for every function above max-complexity-allowed. Diagnostics respect inline ignore comments, so the editor and the CLI agree. The per-function hint sits at the end of the line that closes the declaration, so a wrapped signature keeps the hint on its closing line, and a document that does not parse keeps the last parsed hints plus one complexipy-parse-error warning, placed where the parser fails, until it parses again. Configuration problems, such as an unknown rule id in select, appear in the editor as a warning message (#272). The server reloads the configuration when a configuration file at a folder root changes, in editors that watch files for it (#257). A Zed extension in zed/ starts the server in Zed, and the inlay hints carry a left padding so they do not touch the code (#255). See Editor Integration for the VS Code, Neovim, and Zed setup.

• The VS Code extension is now a client of the language server and drops its bundled WASM engine (#253). Results update while you type, with no save (#133), and hints and warnings follow max-complexity-allowed and the [tool.complexipy.lsp] settings (#127). The extension needs the complexipy command, and a complexipy.server.path setting points it at a specific binary.

• The VS Code extension is published to OpenVSX as well as the Visual Studio Marketplace, so VSCodium and other VS Code forks can install it (#145). A vscode-v* tag publishes the same VSIX to both registries.

• A [tool.complexipy.lsp] configuration section, with inlay-hints (threshold, always, or never), per-line-hints, and diagnostics. Hints are gated on max-complexity-allowed by default, so a project that sets no options sees feedback only where it matters.

• complexipy-core gains a config feature that owns configuration file discovery, so the CLI and the server read complexipy.toml, .complexipy.toml, and pyproject.toml through one code path.

• The server applies exclude one pattern at a time: a malformed pattern is reported once per configuration load and skipped while the remaining patterns keep applying, and a list too large to compile as one program is reported once and still applied. A CLI run stops on either.

• Each workspace folder reads its own configuration (#273). In a workspace with several folders, a document uses the threshold, rule selection, exclude patterns, and [tool.complexipy.lsp] settings of the deepest folder that contains it, and a document outside every folder uses the first folder. The server declares workspace folder support, so folders that the editor adds or removes take effect without a restart.

• Per-rule suppression and rule selection (#208). --select and --ignore (repeatable and comma-separated) pick the active refactoring rules, and ignore wins on conflict. complexipy.toml, .complexipy.toml, and pyproject.toml take matching select and ignore keys, and a flag replaces the toml key it names. A toml value splits on commas like the flags, so select = "C007, C002" names two rules. An ignore comment accepts a bracketed rule list, # complexipy: ignore[C007], which suppresses only the named rules for one function, while a bare marker keeps suppressing the whole function. An inactive rule disappears from every output format and never consumes a slot of the per-function plan cap, so a hidden rule can never block a visible one. An unknown rule id warns on stderr that it matches no registered rule, and a second warning says so when select and ignore leave no rule active. Rule selection never changes the exit code.

• --fix applies machine-applicable suggestions to the source files (#204). A suggestion is fixable when its tier is MachineApplicable and its replacement is a faithful splice (spliceable), which covers C002 (loop guards) and C007 (collapsible if); C005 is not spliceable and stays out. --fix changes only functions whose complexity is above max-complexity-allowed, and every pass checks the threshold again, so a function stops changing once it passes. Functions at or under the threshold keep their suggestions in the report and are never rewritten. One run fixes every analyzed file, bottom-to-top within each file, and prints a syntax-highlighted unified diff of the applied changes, with line numbers, one context line per hunk, and the rule that fired, plus a summary of fixed and skipped fixes that shows the reduction per fix. Every summary line carries the file's line numbers from before the run, and each skip reports once. The run repeats pass by pass, up to 8 passes, until no fixable plan remains, so a fix that exposes a new fixable plan is applied in a later pass; later passes label their diffs. Long diff rows truncate at the terminal width. When nothing is fixable the run prints No fixes to apply. --fix runs in any git state: uncommitted changes, untracked files, and a missing repository never block it, and no extra flag is needed. A fix keeps the file's line endings and its trailing newline. A fix that would produce invalid Python is reverted and reported, and the write is a parse-checked temp file renamed over the original with its permissions kept. The report and the gates measure the post-fix state, so re-analyzing a fixed file shows the finding gone and the exact measured reduction. --fix --dry-run prints only the diff and writes nothing. --select/--ignore decide which rules may fix.

• Python 3.15 support (#265). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) now parse in the CLI, the language server, the Python API, and the web build. A lazy import adds no complexity, and an unpacking comprehension scores like the plain one. Releases now publish CPython 3.15 wheels for Windows and macOS.

• A JSON schema for the configuration (#270). complexipy.schema.json describes every key of complexipy.toml, .complexipy.toml, and [tool.complexipy], including [diff] and [lsp], so a TOML language server such as Taplo offers completion, hover text, and validation. The schema rejects unknown keys. complexipy itself still ignores them.

Changed

• lsp is a reserved first argument: complexipy lsp starts the language server, so a file or directory with that name needs complexipy -- lsp to be analyzed. On a terminal the server prints that hint when both the reserved word and a path named lsp are present.
• StringOrList moved from complexipy-cli::types to the new complexipy-core config module, and the CLI still re-exports it from its old path. Every workspace crate remains publish = false, so no published Rust API changes.
• Added manylinux_2_31_riscv64 wheel builds for RISC-V support. The release matrix now separates the Rust toolchain triple (target) from the platform shorthand (arch), which keeps the existing wheel and artifact names unchanged. (#259)
• RuleCategory, Applicability, and DiffStatus are real enum.Enum subclasses: they iterate, they carry .name and .value, and isinstance(x, enum.Enum) holds.
• requires-python is now >=3.8,<3.16, so installers stop choosing complexipy on a Python version no release has built or tested. The bound rises when a release adds the next Python version. On Python 3.16 and later, pip falls back to 8.0.1, the last release without the bound. (#281)

Fixed

• --color governs every styled line the CLI writes, on stdout and stderr. auto turns color off when the stream is not a terminal or NO_COLOR is set, no removes it from the report, the banner, and the warnings, and --plain output is never styled. In 8.0.1 the report carried ANSI codes on a pipe, under --color no, and under NO_COLOR.

PRs

• feat(lsp): add a language server for editor integration by @​rohaquinlop in rohaquinlop/complexipy#258
• feat: support riscv64 manylinux builds by @​threexc in rohaquinlop/complexipy#259
• ci: stop repeating the extension build and the wheel matrix by @​rohaquinlop in rohaquinlop/complexipy#260
• docs(rules): define and pin the applicability tier policy by @​rohaquinlop in rohaquinlop/complexipy#261
• feat(rules): add per-rule suppression and selection by @​rohaquinlop in rohaquinlop/complexipy#262
• feat(cli): add --fix to apply machine-applicable suggestions by @​rohaquinlop in rohaquinlop/complexipy#264
• ci: cut Rust test binaries and skip CI for non-code changes by @​rohaquinlop in rohaquinlop/complexipy#266

... (truncated)

Changelog

Sourced from complexipy's changelog.

[8.1.0] - 2026-10-18

Added

• A language server: complexipy lsp speaks the Language Server Protocol on stdio, so any editor with an LSP client gets complexity feedback with no per-editor code. It answers inlay hint requests with the cognitive complexity of each function and, optionally, the increment contributed by each line; it answers hover requests with the function total, its threshold status, and the top refactoring suggestion, built on demand for the hovered function so large files stay responsive; and it publishes a warning for every function above max-complexity-allowed. Diagnostics respect inline ignore comments, so the editor and the CLI agree. The per-function hint sits at the end of the line that closes the declaration, so a wrapped signature keeps the hint on its closing line, and a document that does not parse keeps the last parsed hints plus one complexipy-parse-error warning, placed where the parser fails, until it parses again. Configuration problems, such as an unknown rule id in select, appear in the editor as a warning message (#272). The server reloads the configuration when a configuration file at a folder root changes, in editors that watch files for it (#257). A Zed extension in zed/ starts the server in Zed, and the inlay hints carry a left padding so they do not touch the code (#255). See Editor Integration for the VS Code, Neovim, and Zed setup.

• The VS Code extension is now a client of the language server and drops its bundled WASM engine (#253). Results update while you type, with no save (#133), and hints and warnings follow max-complexity-allowed and the [tool.complexipy.lsp] settings (#127). The extension needs the complexipy command, and a complexipy.server.path setting points it at a specific binary.

• The VS Code extension is published to OpenVSX as well as the Visual Studio Marketplace, so VSCodium and other VS Code forks can install it (#145). A vscode-v* tag publishes the same VSIX to both registries.

• A [tool.complexipy.lsp] configuration section, with inlay-hints (threshold, always, or never), per-line-hints, and diagnostics. Hints are gated on max-complexity-allowed by default, so a project that sets no options sees feedback only where it matters.

• complexipy-core gains a config feature that owns configuration file

... (truncated)

Commits

• cec85bd fix(tests): overflow the exclude program on 32-bit windows too
• 446a902 fix(ci): give the windows test venv the setup-python interpreter path
• f5ce56e docs(changelog): release 8.1.0
• a8335a8 docs(release): move the vscode extension release steps to RELEASING.md
• 9d151cc chore(release): bump version to 8.1.0
• 6fc3384 docs(install): add uv tool install as an installation option
• 83be163 Merge pull request #286 from rohaquinlop/issue-270-config-json-schema
• 26f7bfc docs(config): document the configuration json schema
• 9e637d7 feat(config): generate a json schema for the configuration
• 941a844 chore(deps): add schemars and jsonschema for the config schema
• Additional commits viewable in compare view

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions