chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
astral-sh/ruff-pre-commit	repository	patch	v0.14.9 -> v0.14.10
astral-sh/uv-pre-commit	repository	patch	0.9.17 -> 0.9.18
biomejs/pre-commit	repository	patch	v2.3.8 -> v2.3.10
filelock	dependency-groups	patch	3.20.0 -> 3.20.1
mypy (changelog)	dependency-groups	patch	1.19.0 -> 1.19.1
pre-commit	dependency-groups	patch	4.5.0 -> 4.5.1
pre-commit/mirrors-mypy	repository	patch	v1.19.0 -> v1.19.1
ruff (source, changelog)	dependency-groups	patch	0.14.9 -> 0.14.10
tombi-toml/tombi-pre-commit	repository	patch	v0.7.7 -> v0.7.8
		lockFileMaintenance	All locks refreshed

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)

v0.14.10

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.14.10

astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)

v0.9.18

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.9.18

biomejs/pre-commit (biomejs/pre-commit)

v2.3.10

Compare Source

v2.3.9

Compare Source

tox-dev/py-filelock (filelock)

v3.20.1

Compare Source

What's Changed

• CVE-2025-68146: Fix TOCTOU symlink vulnerability in lock file creation by @​gaborbernat in tox-dev/filelock#461

Full Changelog: tox-dev/filelock@3.20.0...3.20.1

python/mypy (mypy)

v1.19.1

Compare Source

• Fix noncommutative joins with bounded TypeVars (Shantanu, PR 20345)
• Respect output format for cached runs by serializing raw errors in cache metas (Ivan Levkivskyi, PR 20372)
• Allow types.NoneType in match cases (A5rocks, PR 20383)
• Fix mypyc generator regression with empty tuple (BobTheBuidler, PR 20371)
• Fix crash involving Unpack-ed TypeVarTuple (Shantanu, PR 20323)
• Fix crash on star import of redefinition (Ivan Levkivskyi, PR 20333)
• Fix crash on typevar with forward ref used in other module (Ivan Levkivskyi, PR 20334)
• Fail with an explicit error on PyPy (Ivan Levkivskyi, PR 20389)

pre-commit/pre-commit (pre-commit)

v4.5.1

Compare Source

==================

Fixes

• Fix language: python with repo: local without additional_dependencies.
  • #​3597 PR by @​asottile.

pre-commit/mirrors-mypy (pre-commit/mirrors-mypy)

v1.19.1

Compare Source

astral-sh/ruff (ruff)

v0.14.10

Compare Source

Released on 2025-12-18.

Preview features

• [formatter] Fluent formatting of method chains (#​21369)
• [formatter] Keep lambda parameters on one line and parenthesize the body if it expands (#​21385)
• [flake8-implicit-str-concat] New rule to prevent implicit string concatenation in collections (ISC004) (#​21972)
• [flake8-use-pathlib] Make fixes unsafe when types change in compound statements (PTH104, PTH105, PTH109, PTH115) (#​22009)
• [refurb] Extend support for Path.open (FURB101, FURB103) (#​21080)

Bug fixes

• [pyupgrade] Fix parsing named Unicode escape sequences (UP032) (#​21901)

Rule changes

• [eradicate] Ignore ruff:disable and ruff:enable comments in ERA001 (#​22038)
• [flake8-pytest-style] Allow match and check keyword arguments without an expected exception type (PT010) (#​21964)
• [syntax-errors] Annotated name cannot be global (#​20868)

Documentation

• Add uv and ty to the Ruff README (#​21996)
• Document known lambda formatting deviations from Black (#​21954)
• Update setup.md (#​22024)
• [flake8-bandit] Fix broken link (S704) (#​22039)

Other changes

• Fix playground Share button showing "Copied!" before clipboard copy completes (#​21942)

Contributors

• @​dylwil3
• @​charliecloudberry
• @​charliermarsh
• @​chirizxc
• @​ntBre
• @​zanieb
• @​amyreese
• @​hauntsaninja
• @​11happy
• @​mahiro72
• @​MichaReiser
• @​phongddo
• @​PeterJCLaw

tombi-toml/tombi-pre-commit (tombi-toml/tombi-pre-commit)

v0.7.8

Compare Source

See: https://github.com/tombi-toml/tombi/releases/tag/v0.7.8

---

Configuration

📅 Schedule: Branch creation - "before 4am on monday" in timezone UTC, Automerge - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone UTC.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.