chore(deps-dev): bump the dependencies group with 3 updates

[dependabot]

Bumps the dependencies group with 3 updates: ruff, semgrep and ty.

Updates ruff from 0.16.6 to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879

... (truncated)

Commits

• b5dba86 Bump version to 0.16.7 (#28496)
• 5992d05 Install rustfmt before linting releases (#28495)
• 1713a1f ensure prepare release changes pass prek (#28488)
• 18cdbb4 use scoped token for release workflow (#28484)
• c3813a5 add a workflow for preparing releases (#28486)
• 00948c0 Remove the "Who’s Using Ruff?" list (#28455)
• 86a2eba [pyupgrade] Stop recommending removed typing.no_type_check_decorator (`UP...
• 609e184 Stop defining __cached__ for Python 3.15 (#28476)
• 859ff2f [ty] Track symlinked directory status in listings (#28482)
• 77f6538 Use paid GitHub-hosted runners for Linux (#28478)
• Additional commits viewable in compare view

Updates semgrep from 1.176.1 to 1.177.0

Release notes

Sourced from semgrep's releases.

Release v1.177.0

1.177.0 - 2026-09-10

### Added

• Added native Supply Chain support for Bazel workspaces using rules_jvm_external. Semgrep now recognizes a maven_install.json pinned lockfile (versions 0.1.0 and 3, as emitted by rules_jvm_external 3.x through current) paired with a MODULE.bazel (or legacy WORKSPACE / WORKSPACE.bazel) marker as a Maven-ecosystem subproject, and attributes findings to the workspace root rather than the lockfile's directory. Workspace-declared root artifacts are identified via __INPUT_ARTIFACTS_HASH for accurate direct-vs-transitive classification; dependencies are emitted with Unknown transitivity when that field is not available. This is the first milestone of native Bazel coverage; broader ecosystem support (rules_python, rules_go, rules_js) and Bazel-aware reachability attribution follow. (SC-2008)
• Several performance improvements for regex-only rules where the underlying regex are inefficient to run on our default regex engine (currently PCRE2). For example, a rule matching FOOBAR(a+)\1 will skip any file that does not contain FOOBAR without running the regex. (scrt-979)

### Changed

• Prefilter conditions now evaluate their cheap string predicates before their expensive regex predicates. Since evaluation short-circuits, a file that a string check already rules in or out no longer pays for regex predicates (which is what a pattern's prefilter falls back to when no literal substring can be extracted from it, and which can be slow on files with very long lines). (prefilter-rank-conjuncts)
• Supply Chain scans can report dependencies from their Gradle module build files instead of the root manifest. This behavior is disabled by default during rollout and can be tested with --x-gradle-module-attribution. Enabling it can change finding IDs because finding paths change; the ID calculation is unchanged. (SC-2560)

### Fixed

• Speed up semgrep ci filtering when a deployment has many triage-ignored findings. (triage-ignored-performance)

• Semgrep no longer crashes with an OCaml stack trace when a proxy environment variable holds an unusable value. HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY set to an empty value is now ignored with a warning, and the scan proceeds without a proxy. A non-empty value that is not a usable proxy URL now exits with an error message, with any credentials in the URL redacted, instead of failing inside the HTTP client.

  Semgrep also now adds the missing scheme to a proxy URL supplied without one; https for HTTPS_PROXY and http` otherwise. (ENGINE-2208)

• Supply Chain: lockfileless Gradle scans now report a "Resource Inaccessible" resolution error when a repository refuses a request (for example a 401 from a private registry), instead of exiting successfully with a silently incomplete dependency list. (sc-3358)

### Infra/Release Changes

• Improves shutdown time during scans with --trace. (otel-shutdown-flush)

Changelog

Sourced from semgrep's changelog.

1.177.0 - 2026-09-10

### Added

• Added native Supply Chain support for Bazel workspaces using rules_jvm_external. Semgrep now recognizes a maven_install.json pinned lockfile (versions 0.1.0 and 3, as emitted by rules_jvm_external 3.x through current) paired with a MODULE.bazel (or legacy WORKSPACE / WORKSPACE.bazel) marker as a Maven-ecosystem subproject, and attributes findings to the workspace root rather than the lockfile's directory. Workspace-declared root artifacts are identified via __INPUT_ARTIFACTS_HASH for accurate direct-vs-transitive classification; dependencies are emitted with Unknown transitivity when that field is not available. This is the first milestone of native Bazel coverage; broader ecosystem support (rules_python, rules_go, rules_js) and Bazel-aware reachability attribution follow. (SC-2008)
• Several performance improvements for regex-only rules where the underlying regex are inefficient to run on our default regex engine (currently PCRE2). For example, a rule matching FOOBAR(a+)\1 will skip any file that does not contain FOOBAR without running the regex. (scrt-979)

### Changed

• Prefilter conditions now evaluate their cheap string predicates before their expensive regex predicates. Since evaluation short-circuits, a file that a string check already rules in or out no longer pays for regex predicates (which is what a pattern's prefilter falls back to when no literal substring can be extracted from it, and which can be slow on files with very long lines). (prefilter-rank-conjuncts)
• Supply Chain scans can report dependencies from their Gradle module build files instead of the root manifest. This behavior is disabled by default during rollout and can be tested with --x-gradle-module-attribution. Enabling it can change finding IDs because finding paths change; the ID calculation is unchanged. (SC-2560)

### Fixed

• Speed up semgrep ci filtering when a deployment has many triage-ignored findings. (triage-ignored-performance)

• Semgrep no longer crashes with an OCaml stack trace when a proxy environment variable holds an unusable value. HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY set to an empty value is now ignored with a warning, and the scan proceeds without a proxy. A non-empty value that is not a usable proxy URL now exits with an error message, with any credentials in the URL redacted, instead of failing inside the HTTP client.

  Semgrep also now adds the missing scheme to a proxy URL supplied without one; https for HTTPS_PROXY and http` otherwise. (ENGINE-2208)

• Supply Chain: lockfileless Gradle scans now report a "Resource Inaccessible" resolution error when a repository refuses a request (for example a 401 from a private registry), instead of exiting successfully with a silently incomplete dependency list. (sc-3358)

### Infra/Release Changes

• Improves shutdown time during scans with --trace. (otel-shutdown-flush)

1.176.0 - 2026-09-01

### Changed

• Homebrew installs of Semgrep are no longer supported on Intel Macs. (ENGINE-2951)

1.175.1 - 2026-09-03

... (truncated)

Commits

• See full diff in compare view

Updates ty from 0.0.79 to 0.0.80

Release notes

Sourced from ty's releases.

0.0.80

Release Notes

Released on 2026-09-09.

Bug fixes

• Fix --force-exclude for directories with an excluded ancestor (#28451)
• Preserve metaclass candidates after conflicts (#28461)

LSP server

• Give existing autofixes descriptive titles (#28456)
• Prevent LSP hangs during inlay hint bursts (#28390)

Diagnostic improvements

• Preserve redundant-condition diagnostics with unreachable operands (#28374)

Core type checking

• Check captured receivers when calling wrapped classmethods (#28467)
• Fix cached classmethods on generic classes (#28207)
• Fix disjointness of type guards and boolean literals (#28363)
• Infer tuple variance from the full tuple spec (#28446)
• Infer tuple variance more precisely (#28426)
• Preserve callable identity across specialized types (#28409)
• Preserve callback type context through ParamSpec forwarding (#28439)
• Preserve wrapped functions in precise functools.partial relations (#28460)
• Respect descriptor protocol for __set__ itself (#28408)
• Respect type-variable bounds in argument context (#28448)
• Unwrap union alternatives in overload implementations (#28468)

Performance

• Distribute len inference over unions (#28470)
• Fast-path concrete literal intersections (#28348)

Memory usage improvements

• Avoid excess capacity in multi-binding tables (#28412)
• Share equivalent place tables within a file (#28319)
• Share names in synthesized constructor parameters (#28398)

Contributors

• @​sharkdp
• @​charliermarsh
• @​ibraheemdev
• @​AlexWaygood

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.80

Released on 2026-09-09.

Bug fixes

• Fix --force-exclude for directories with an excluded ancestor (#28451)
• Preserve metaclass candidates after conflicts (#28461)

LSP server

• Give existing autofixes descriptive titles (#28456)
• Prevent LSP hangs during inlay hint bursts (#28390)

Diagnostic improvements

• Preserve redundant-condition diagnostics with unreachable operands (#28374)

Core type checking

• Check captured receivers when calling wrapped classmethods (#28467)
• Fix cached classmethods on generic classes (#28207)
• Fix disjointness of type guards and boolean literals (#28363)
• Infer tuple variance from the full tuple spec (#28446)
• Infer tuple variance more precisely (#28426)
• Preserve callable identity across specialized types (#28409)
• Preserve callback type context through ParamSpec forwarding (#28439)
• Preserve wrapped functions in precise functools.partial relations (#28460)
• Respect descriptor protocol for __set__ itself (#28408)
• Respect type-variable bounds in argument context (#28448)
• Unwrap union alternatives in overload implementations (#28468)

Performance

• Distribute len inference over unions (#28470)
• Fast-path concrete literal intersections (#28348)

Memory usage improvements

• Avoid excess capacity in multi-binding tables (#28412)
• Share equivalent place tables within a file (#28319)
• Share names in synthesized constructor parameters (#28398)

Contributors

• @​sharkdp
• @​charliermarsh
• @​ibraheemdev
• @​AlexWaygood
• @​MichaReiser

Commits

• 7fd8e15 Bump version to 0.0.80 (#4501)
• c163f21 Update dependency prek to v0.4.12 (#4494)
• 8ce0450 Update prek dependencies (#4495)
• 5d0aa7a Update actions/attest-build-provenance action to v4.2.2 (#4497)
• e22b86b Update Swatinem/rust-cache action to v2.9.2 (#4496)
• 5cde40f Document uv integration and workspace trust settings (#4339)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[acgetchell]

@coderabbitai review

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: acgetchell/la-stack/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 7bb1232a-6606-4e6b-bb03-8d8369e57c96

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}