chore(py): pin ruff rules with select, adopt 0.16

.pre-commit-config.yaml

@@ -13,10 +13,12 @@ repos:
     hooks:
       - id: taskcluster_yml
 -   repo: https://github.com/astral-sh/ruff-pre-commit
-    # Bump in lockstep with the big-code-analysis-py/pyproject.toml
-    # `ruff>=0.6,<0.16` floor. `ruff-check` and `ruff-format` are the
+    # Bump in lockstep with the ruff version `uv.lock` resolves under
+    # the big-code-analysis-py/pyproject.toml `ruff>=0.13,<0.17` bound
+    # (`rg '^ruff==' big-code-analysis-py/requirements/dev.txt`), which
+    # is also what CI installs. `ruff-check` and `ruff-format` are the
     # current hook IDs (the legacy `ruff` alias is deprecated).
-    rev: v0.15.14
+    rev: v0.16.2
     hooks:
     -   id: ruff-check
         args: [--fix]

CHANGELOG.md

@@ -81,6 +81,32 @@ for historical reference.
   reachable crash: every one rests on an invariant as solid as the 37
   `expect` sites left alone. The difference is that an `unwrap()` states
   no invariant, which is the whole basis for gating it (#1227).
+- The Python bindings' ruff config states its rule set absolutely
+  (`select`) instead of relative to ruff's defaults (`extend-select`),
+  and the dev-extra bound moves to `ruff>=0.13,<0.17` with `uv.lock`
+  and the `requirements/` exports resolving 0.16.2. ruff 0.16.0 grew its
+  default rule set from 59 rules to 413, which under `extend-select`
+  took this config from 265 enabled rules to 501 and pulled in 28
+  families it never selected — `PLC` / `PLE` / `PLR` / `PLW` among
+  them, silently overriding the deliberate omission of Pylint's design
+  rules that the config comment states. The same release *dropped* 18
+  opinionated `E` / `F` rules from the defaults, which a
+  defaults-relative config would have lost just as quietly. Under
+  `select` the count is 265 on 0.15.22 (unchanged, so nothing was lost
+  by dropping the implicit defaults) and 268 on 0.16.2, the three
+  additions being new `RUF` rules in an already-selected family.
+  `ruff check` passes on 0.15.22 and 0.16.2 with no `noqa`, no
+  suppressions, and no source changes; the three diagnostics 0.16
+  reported (`DTZ001`, `BLE001`, `PYI044`) were all in families this
+  config never asked for. The `ruff-pre-commit` `rev:` in
+  `.pre-commit-config.yaml` moves to `v0.16.2` to match what `uv.lock`
+  resolves (it had drifted to `v0.15.14` against a locked 0.15.22).
+  The floor moves off `0.6` in the same breath because it was already
+  fiction: `UP038` left ruff's stable set in 0.13, and every release
+  from 0.6.0 through 0.12.12 flags the same five
+  `isinstance(x, (A, B))` sites here — under the old `extend-select`
+  config identically, so this states what was always true rather than
+  changing anything (#1222).
 
 ## [2.1.0] - 2026-08-06
 

CONTRIBUTING.md

@@ -195,6 +195,15 @@ reviewable commit). Resolve `uv.lock` rebase conflicts by re-running
 --require-hashes -r …` in the workflows), so a `uv.lock` change and
 its regenerated exports must land in the same commit.
 
+Note that `make py-relock` re-resolves but does not *upgrade*: `uv
+lock` keeps a package at its locked version as long as that version
+still satisfies the requirement, so widening a bound alone changes
+nothing. Adopting a newer release is a second, explicit step —
+`uv lock --upgrade-package <name>` from `big-code-analysis-py`,
+followed by the two `uv export` commands `py-relock` runs. #1222
+raised ruff's ceiling to `<0.17` and would have shipped a still-locked
+0.15.22 without it.
+
 Alternative install paths (`mise install` via `mise.toml`, direct
 `pipx install ruff/mypy/pyright/maturin`, `python -m venv .venv &&
 pip install -e ".[dev]"`) still work but bypass `uv.lock`; resolved

Makefile

@@ -780,7 +780,7 @@ py-relock:
 # dir's own `extend-exclude` (e.g. `_native.pyi`) against the wrong base and
 # spuriously flag excluded files. The smoke dir has nothing to exclude, so
 # pointing `--config` at the bindings pyproject just gives it the same
-# ruleset (line-length 100, the extend-select set) (#995).
+# ruleset (line-length 100, the `[tool.ruff.lint] select` set) (#995).
 py-fmt:
 	@if command -v ruff >/dev/null 2>&1; then \
 	  echo "Formatting Python sources..."; \

big-code-analysis-py/pyproject.toml

@@ -68,7 +68,17 @@ dev = [
   # already fiction before this — the previous `[misc]` spelling was
   # just as version-specific — so this states what was always true.
   "mypy>=2.3",
-  "ruff>=0.6,<0.16",
+  # Floor is 0.13, not the historical 0.6, because `UP038`
+  # (non-pep604-isinstance) was removed from ruff's stable set in 0.13
+  # and this tree has five `isinstance(x, (A, B))` call sites that any
+  # 0.6-0.12.12 run flags. Measured: 0.6.0, 0.9.0, 0.12.0 and 0.12.12
+  # all report the same five, 0.13.0 onward report none — under the
+  # pre-#1222 `extend-select` config identically, so the floor was
+  # already fiction and this states what was always true. The ceiling
+  # is exclusive-of-0.17 rather than open because ruff moves its
+  # *defaults* on minor bumps; `[tool.ruff.lint] select` below makes
+  # that harmless for the rule set, but formatter output still shifts.
+  "ruff>=0.13,<0.17",
   "pyright>=1.1.380",
   "maturin>=1.7,<2.0",
 ]
@@ -142,8 +152,9 @@ no-default-features = true
 # ---------------------------------------------------------------------------
 # Linting and formatting (ruff). Config is intentionally nested under
 # [tool.ruff.lint] — ruff 0.2+ requires the nested form and emits a
-# deprecation warning on top-level `extend-select` / `ignore` (gone
-# entirely in 0.6+).
+# deprecation warning on top-level `select` / `ignore` (gone entirely
+# in 0.6+, so below this crate's `ruff>=0.13` floor; kept because it
+# explains why the nested form is not incidental).
 # ---------------------------------------------------------------------------
 [tool.ruff]
 target-version = "py312"
@@ -160,7 +171,18 @@ extend-exclude = ["target", "python/big_code_analysis/_native.pyi"]
 # style. Full `PL` (Pylint) is deliberately omitted — its design rules
 # (PLR0913 too-many-arguments, PLR0915 too-many-statements) would
 # force test-suite refactors that belong in a follow-up issue.
-extend-select = ["E", "F", "W", "I", "B", "UP", "SIM", "RUF", "PERF", "PT"]
+#
+# `select`, not `extend-select`, so the set is absolute rather than
+# relative to whatever ruff currently ships as its default. That
+# distinction is not cosmetic: ruff 0.16.0 grew its defaults from 59
+# rules to 413, which under `extend-select` took this config from 265
+# enabled rules to 501 and silently enabled 28 families it never asked
+# for — `PLC` / `PLE` / `PLR` / `PLW` among them, overriding the
+# deliberate Pylint omission stated just above (#1222). The same
+# release *dropped* 18 opinionated `E` / `F` rules from the defaults,
+# which a defaults-relative config would have lost just as quietly.
+# Adding a family here is how the set grows; a ruff upgrade is not.
+select = ["E", "F", "W", "I", "B", "UP", "SIM", "RUF", "PERF", "PT"]
 
 [tool.ruff.lint.flake8-pytest-style]
 # Existing tests use the tuple form for parametrize names

big-code-analysis-py/requirements/dev.txt

@@ -334,25 +334,25 @@ pytest-cov==7.1.0 ; python_full_version < '3.15' and sys_platform != 'emscripten
     --hash=sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2 \
     --hash=sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678
     # via big-code-analysis
-ruff==0.15.22 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
-    --hash=sha256:11c1c715af53a09f714e011106bffc419751ec8232fcb5da42173284ea3fec6f \
-    --hash=sha256:1877d63b9d24ed278744f1523fd11b85540566d54641f97c566d7d9dc5ca5296 \
-    --hash=sha256:1e0dd1b2e4d3d585f897a0d137cbf4eaf6223bef4e8ce34d6bb12556c5f9249e \
-    --hash=sha256:225dbf095a87f1d9f90f5fd7924d2613ee452a75a4308c63a8f50f761787aa7c \
-    --hash=sha256:365523eb91d9224e1bcb03b022fbf0facb8f9e23792a2c53d9d4b3924bdbdebb \
-    --hash=sha256:3f15175b1fb580126f58285a5dae6b2ea89000136d980c64499211f116b54809 \
-    --hash=sha256:44423e73493737f5e7c5b41d475483898ff37afcdae38bc3da5085e29af1c2d8 \
-    --hash=sha256:62d425005c1835eb24e2ee4161cb90e8db263415f4a71c8c72c33abaa6c0c224 \
-    --hash=sha256:630479b18625f5ffc373f77603a22a9f8ac0acd7ff0501178b5db28ec71e9c64 \
-    --hash=sha256:72af58b951b0ae395935ae79763dc349bc0eb706319d28f7a33ad2cfb3cfc178 \
-    --hash=sha256:742a29cf29bddb7c8327895d6a10e0e6c5b38a96dd407af9b5d0857f809c0576 \
-    --hash=sha256:9be63ba1eb936acd2d1342fb8337c356353706fce233b2a15a09a97037e6acde \
-    --hash=sha256:a1606c510bd7215680d32efab38965f7cdec3ef69f5170a3f4791404ffdd5262 \
-    --hash=sha256:b82c6482946e9eda7ff2e091d25b8bad3f718684e1916d41bd56873cee05b697 \
-    --hash=sha256:e1168075b72158510839f250027659cdd78476f40507dd517892304c41318661 \
-    --hash=sha256:e5ba0e4a13fd14abbed2a77b517a3911290c6c6c59ef67784328d1668fab76cf \
-    --hash=sha256:e8b9b3f8779a4f08c969defc3c8c35abffaa757e601ed5ae66d6d1db6519969a \
-    --hash=sha256:fabfd168afdf29fee5be98b831efa9683c94d7c5a3b58b9ce5a2e38444589a74
+ruff==0.16.2 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
+    --hash=sha256:20e66910f2c37cc753f9ef6580c914a621b80c4fa3549d3e3521e29d0f5bfc3f \
+    --hash=sha256:335c621622c4650330be50842561c6586ac6971bb8ab5407fe34dcc9efb16bbe \
+    --hash=sha256:3c8de4cf2181f01d57946d87d777aa52916976fc09942aed89938fab5e013318 \
+    --hash=sha256:40ea8c0594feb894e89c8c61ab9c103d38b0ea72dfde6c594107147ca31b1140 \
+    --hash=sha256:4ce4e02bad779bef557f541a1b31f20d6abeae1cc05ed1b1ac019d4ffd1044c8 \
+    --hash=sha256:81806b08329130005dd4a8a8394a0c9da8c6f4cafb16ba438d2a2ee6a18bedf1 \
+    --hash=sha256:9a48cc05c6fbc811ca81b5d7ba95375affea6582d1b8024e455e41afbbf55344 \
+    --hash=sha256:a2c0d14fcbb26c91f0f867a6dc9bd71bbc30b1b6151829c884f23faeab2e5700 \
+    --hash=sha256:ab3d62dde0b19facdd632008cc4827fc28ada7736c6bd35ab6f1050f0bfed53f \
+    --hash=sha256:bcabe2f6d0fc7819f1431793005af4e4de7371927d037345bf941252b195b9fa \
+    --hash=sha256:bf3a63d78fb39f4bf5ac8ae52051c5520505301abe19ba4e204c453b3f09bb0b \
+    --hash=sha256:c24788a980581e1d7ea3a0cbe4344c4fbeb0a6a9b1f4713aa46bb104f8294690 \
+    --hash=sha256:c3d7828d12e8927a6fc65fe38e2c2541b9e762d360a1786d752cb1b8883b3c9c \
+    --hash=sha256:c7e36fbfba65510548156902bcf1350a979a958ce0347ce0f90d73894036b39f \
+    --hash=sha256:d614e95cedf38a2053fd351c55b103ba30d017d61688fdbfd40ee0412852a99f \
+    --hash=sha256:e0422abdf70070255fc4073ce9dfc814cc03db577013761ddd09bc1e4a9a4fbd \
+    --hash=sha256:e43e1f5b8388da9eca1b9e88328d47a5cec794633ccf6f7484ac2dd15eee92c0 \
+    --hash=sha256:f0eab35f80df8f134aae5d1630e751901321d317cc8e50dc39e36fa3ed34cd12
     # via big-code-analysis
 typing-extensions==4.16.0 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
     --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \