fix(deps): update minor and patch updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
anki	==26.8.1 → ==26.9.2			project.dependencies	minor	26.9.3
pyrefly	==1.3.0 → ==1.3.1			dependency-groups	patch	1.3.2
ruff (source, changelog)	==0.16.7 → ==0.16.8			dependency-groups	patch	0.16.10 (+1)
uv	0.12.13 → 0.12.16			tools	patch	0.12.22 (+5)

---

Release Notes

ankitects/anki (anki)

v26.9.2

Compare Source

v26.9.1

Compare Source

v26.9

Compare Source

astral-sh/ruff (ruff)

v0.16.8

Compare Source

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#​28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#​27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#​27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#​28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#​28505)

Rule changes

• Add support for __lazy_modules__ (#​28459)
• Recognize PEP-728 TypedDict class keywords (#​28533)
• Recognize quoted types in typing.TypeForm (#​28507)
• Support conditional assignment to __lazy_modules__ (#​28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#​28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#​28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#​28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#​28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#​28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#​28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#​28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

astral-sh/uv (uv)

v0.12.16

Compare Source

Released on 2026-09-17.

Python

• Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#​21741)

Enhancements

• Verify downloaded wheels and source distributions against hashes supplied by package indexes (#​21562)
• Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#​21467)
• Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#​21766)
• Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#​21779)

Preview features

• Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#​21163)
• Honor configured and command-line index settings, including credentials, in uv upgrade (#​21776)
• Allow uv check to run in projects that are not managed by uv and outside workspaces (#​21777)
• Respect --python and UV_PYTHON when selecting the Python version for uv check (#​21744)

Bug fixes

• Redact Azure shared access signatures from displayed and logged URLs (#​21755)
• Check archive sizes from pylock.toml before reusing cached distributions (#​21609)
• Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#​20631)
• Use the bundled uv_build backend only when its version matches active version pins (#​21742)
• Handle malformed index URLs without panicking when credentials are configured (#​21784)
• Report a configuration error instead of panicking for proxy URLs without a host (#​21781)
• Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#​21783)

v0.12.15

Compare Source

Released on 2026-09-15.

This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using
uv pip install --system in python:* docker images or when using uv pip install --target .. (#​21699)

Performance

• Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#​21675)

Bug fixes

• Revert "Reject symlinked wheel installation destinations" (#​21699)

v0.12.14

Compare Source

Released on 2026-09-15.

Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. (#​17110, #​21599, #​21603)

Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. (#​17110)

Enhancements

• Resume interrupted downloads with HTTP Range requests when supported (#​21570)
• Show underlying causes and hints in user warnings (#​21565)
• Show resolver hints for failed uv tool upgrade operations (#​21566)

Preview features

• Export multiple dependency selections from a shared lockfile in one uv export --batch invocation with the batch-export preview feature (#​21618)

Performance

• Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task (#​21619)
• Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers (#​21593)
• Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task (#​21621)

Bug fixes

• Select releases that satisfy required-environments within each resolver fork instead of combining incompatible wheel coverage across forks (#​21672)
• Install packages with paths longer than MAX_PATH on Windows systems without long-path support enabled (#​21625)
• Prevent uv python install from overwriting valid unmanaged Python symlinks with relative targets on Unix (#​21639)
• Redact credentials and signatures from missing-path-segment URL errors (#​21616)
• Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation (#​21640)
• Prefer bin/python over bin/python3 when discovering interpreters in Unix environments (#​21559)
• Suppress managed-Python fallback warnings under --quiet (#​21565)
• Keep failed uv tool upgrade errors visible with -q while suppressing them with -qq (#​21566)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9pm on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.