[dependabot]

Bumps the python-minor-patch group with 2 updates: platformdirs and ruff.

Updates platformdirs from 4.11.8 to 4.11.10

Release notes

Sourced from platformdirs's releases.

4.11.10

What's Changed

• 👷 ci(release): docstrfmt the changelog before committing it by @​gaborbernat in tox-dev/platformdirs#551
• fix: only create the site dirs a call hands back by @​darrenhuai in tox-dev/platformdirs#550

Full Changelog: tox-dev/platformdirs@4.11.9...4.11.10

4.11.9

What's Changed

• fix: read user-dirs.dirs as shell assignments, not INI by @​darrenhuai in tox-dev/platformdirs#545
• fix: accept multipath in the site cache functions by @​darrenhuai in tox-dev/platformdirs#544
• fix: resolve PUBLIC before looking up the user home by @​emme1t in tox-dev/platformdirs#546
• fix: raise RuntimeError when the Android app folder is missing by @​Str0k in tox-dev/platformdirs#547

New Contributors

• @​emme1t made their first contribution in tox-dev/platformdirs#546
• @​Str0k made their first contribution in tox-dev/platformdirs#547

Full Changelog: tox-dev/platformdirs@4.11.8...4.11.9

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.11 (2026-09-19)

---

• Reject appname, appauthor and version values that leave the platform base directory (a .. segment, a leading separator, a drive or a UNC share) with ValueError, so ensure_exists cannot create directories outside it - by :user:Pitchfork-and-Torch. :pr:552

---

4.11.10 (2026-09-18)

---

• With ensure_exists, the site_*_dir and site_*_path properties and the iter_*_dirs iterators only create the site directories they return or yield, instead of every entry in the site list - by :user:darrenhuai. :pr:550

---

4.11.9 (2026-09-16)

---

• Accept multipath in :func:~platformdirs.site_cache_dir and :func:~platformdirs.site_cache_path. Without it, the function API could not return the Homebrew cache prefix that :attr:~platformdirs.macos.MacOS.site_cache_dir adds under multipath - by :user:darrenhuai. :pr:544
• Parse Unix user-dirs.dirs line by line like xdg-user-dir. The INI parser raised on a repeated key or a line without =, and returned trailing comments and backslash escapes inside :func:~platformdirs.user_documents_dir and the other media directories. The last valid assignment now wins, and platformdirs unescapes the quoted value and ignores text after the closing quote - by :user:darrenhuai. :pr:545
• Read PUBLIC before the home directory in :func:~platformdirs.user_publicshare_dir on Windows, so it no longer raises RuntimeError when PUBLIC is set and the home directory cannot be determined - by :user:emme1t. :pr:546
• Raise RuntimeError from :class:~platformdirs.android.Android directories when the app folder cannot be found, instead of TypeError: expected str, bytes or os.PathLike object, not NoneType - by :user:Str0k. :pr:547

---

4.11.8 (2026-09-08)

---

• Make :func:~platformdirs.user_data_path, :func:~platformdirs.user_config_path, :func:~platformdirs.user_preference_path and :func:~platformdirs.user_applications_path return the first site entry when root is redirected by use_site_for_root under multipath, matching their site_*_path twins. They passed the whole joined list to :class:~pathlib.Path, giving one unusable path such as /xdg/a/foo:/xdg/b/foo - by :user:darrenhuai. :pr:538

... (truncated)

Commits

• 35391fc Release 4.11.10
• 7d5c85d fix: only create the site dirs a call hands back (#550)
• 5118d32 👷 ci(release): docstrfmt the changelog before committing it (#551)
• 4ebd03d Release 4.11.9
• 0ae539b fix: raise RuntimeError when the Android app folder is missing (#547)
• de87396 fix: resolve PUBLIC before looking up the user home (#546)
• 2ba683b fix: accept multipath in the site cache functions (#544)
• bdb0a67 fix: read user-dirs.dirs as shell assignments, not INI (#545)
• 5921065 [pre-commit.ci] pre-commit autoupdate (#549)
• See full diff in compare view

Updates ruff from 0.16.7 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

• Visit functional TypedDict keyword arguments correctly (#28584)
• [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
• [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
• [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
• [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

• Add support for __lazy_modules__ (#28459)
• Recognize PEP-728 TypedDict class keywords (#28533)
• Recognize quoted types in typing.TypeForm (#28507)
• Support conditional assignment to __lazy_modules__ (#28491)
• [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
• [pyupgrade] Make the fix for UP040 always unsafe (#28526)
• [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
• [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
• [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

• Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

• [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

• @​VedantMadane
• @​alzeph
• @​charliermarsh
• @​fredrikblau
• @​ntBre
• @​zsol
• @​Aniket-a14
• @​r-b-1

Commits

• 62914c4 Bump version to 0.16.8 (#28648)
• c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
• ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
• 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
• 50020fb [ty] Avoid storing constraint nodes twice (#28375)
• 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
• 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
• d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
• fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
• 31131db [ty] Support type[A & B] (#27124)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Updated development tooling and supporting environment components to newer patched versions.
  • Refreshed package integrity records to ensure reliable, reproducible project setup.
  • No changes to user-facing functionality or publicly available features.

[coderabbitai]

Understand this PR’s impact

Explore downstream dependencies and potential security impact with Blast Radius.

View blast radius →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 4f2417aa-7b01-49a7-aeb5-6657c92ad06c

📥 Commits

Reviewing files that changed from the base of the PR and between 56d9501 and 914de93.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• pyproject.toml
• website/requirements.txt

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates the pinned Ruff version in two development dependency declarations. It also updates the pinned platformdirs version and hashes in the website requirements.

Changes

Dependency Pin Updates

Layer / File(s)	Summary
Update dependency pins pyproject.toml, website/requirements.txt	Ruff changes from 0.16.7 to 0.16.8 in both development dependency declarations. platformdirs changes from 4.11.8 to 4.11.10, with both package hashes replaced.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies a dependency maintenance change and specifies that the python-minor-patch group contains two updates. It matches the Ruff and platformdirs version bumps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}