[dependabot]

Bumps the pip-patch-minor group with 2 updates in the / directory: ruff and tox.

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates tox from 4.65.5 to 4.67.1

Release notes

Sourced from tox's releases.

v4.67.1

Bug fixes - 4.67.1

• Preserve ignore (-) and invert (!) exit code prefixes on commands when referenced via TOML { replace = "ref", ... }. (#4169)
• Installing from a pylock.toml with no dependency_groups selected now uses the lock file's default-groups, as 751 specifies. Previously packages marked 'default' in dependency_groups (as written by pdm export -f pylock) were skipped - by pcbeingused333. (#4173)
• A positional {factor:N} label in an env_base now resolves against that table's own factors, so with several env_base tables or an env_list product it no longer expands to an empty string. (#4174)

PyPI release

Full Changelog: tox-dev/tox@4.67.0...4.67.1

v4.67.0

Features - 4.67.0

• Allow opting in to tox substitutions within TOML positional arguments with substitute = true. (#4165)

Bug fixes - 4.67.0

• Keep capturing the output of the packaging backend with --no-capture, so tox --no-capture no longer hangs at started backend while waiting for the backend's reply. (#4163)
• A leading UTF-8 byte order mark in tox.ini, setup.cfg, tox.toml or a TOML pyproject.toml no longer stops the configuration from loading - editors on Windows may add one. (#4166)
• tox --no-provision <command> no longer treats the command as the JSON output path: a global option placed before a subcommand now keeps it, so tox --no-provision list lists the environments instead of writing a file named list. (#4168)

Improved documentation - 4.67.0

• Link overridden argparse methods and logging.Handler.name in the plugin API reference. (#4170)

PyPI release

Full Changelog: tox-dev/tox@4.66.0...4.67.0

v4.66.0

Features - 4.66.0

• set_env environment files accept export KEY=value lines, setting KEY - by RavSinghChandan. (#4161)

Bug fixes - 4.66.0

... (truncated)

Changelog

Sourced from tox's changelog.

Bug fixes - 4.67.1

• Preserve ignore (-) and invert (!) exit code prefixes on commands when referenced via TOML { replace = "ref", ... }. (:issue:4169)
• Installing from a pylock.toml with no :ref:dependency_groups selected now uses the lock file's default-groups, as :PEP:751 specifies. Previously packages marked 'default' in dependency_groups (as written by pdm export -f pylock) were skipped - by :user:pcbeingused333. (:issue:4173)
• A positional {factor:N} label in an env_base now resolves against that table's own factors, so with several env_base tables or an env_list product it no longer expands to an empty string. (:issue:4174)

---

v4.67.0 (2026-10-17)

---

Features - 4.67.0

• Allow opting in to tox substitutions within TOML positional arguments with substitute = true. (:issue:4165)

Bug fixes - 4.67.0

• Keep capturing the output of the packaging backend with --no-capture, so tox --no-capture no longer hangs at started backend while waiting for the backend's reply. (:issue:4163)
• A leading UTF-8 byte order mark in tox.ini, setup.cfg, tox.toml or a TOML pyproject.toml no longer stops the configuration from loading - editors on Windows may add one. (:issue:4166)
• tox --no-provision <command> no longer treats the command as the JSON output path: a global option placed before a subcommand now keeps it, so tox --no-provision list lists the environments instead of writing a file named list. (:issue:4168)

Improved documentation - 4.67.0

• Link overridden argparse methods and logging.Handler.name in the plugin API reference. (:issue:4170)

---

v4.66.0 (2026-10-16)

---

Features - 4.66.0

• set_env environment files accept export KEY=value lines, setting KEY - by :user:RavSinghChandan. (:issue:4161)

Bug fixes - 4.66.0

• Remember a failed interpreter lookup for a virtualenv environment instead of repeating the full PATH scan for

... (truncated)

Commits

• 129a377 release 4.67.1
• 21d01be fix(config): resolve factor labels per env_base (#4174)
• 7a77f76 🐛 fix(pylock): use default-groups when no dependency group is selected (#4173)
• 59d3c99 fix(config): keep exit-code prefixes on TOML command references (#4172)
• 1de497f release 4.67.0
• 375a807 fix(config): read a UTF-8 BOM in the ini and TOML config sources (#4166)
• ba393c1 Allow opt-in substitution of TOML positional arguments (#4167)
• fa16bde fix(cli): --no-provision swallows the subcommand that follows it (#4168)
• e352fbe ♻️ refactor(docs): use public Sphinx hooks (#4171)
• 1d054ab 📝 docs(api): link overridden stdlib members (#4170)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[eschaar]

These Ruff and tox updates are included in consolidated PR #123. Keeping this PR open until #123 is merged; this branch should not be merged separately.

[eschaar]

Superseded by merged PR #123 (merge commit 9dfecb1), which includes these Ruff and tox updates and passed all applicable PR checks.