chore(deps): update dev-dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
pyrefly	==1.1.0 → ==1.1.1			dependency-groups	patch
ruff (source, changelog)	==0.15.17 → ==0.15.18			dependency-groups	patch
uv	0.11.21 → 0.11.22				patch

---

Release Notes

astral-sh/ruff (ruff)

v0.15.18

Compare Source

Released on 2026-06-18.

Preview features

• Handle nested ruff:ignore comments (#​25791)
• Stop displaying severity in output (#​26050)
• Use human-readable names in CLI output (#​25937)
• Use human-readable names in LSP and playground diagnostics (#​26058)
• [pydocstyle] Prevent property docstrings starting with verbs (D421) (#​23775)
• [flake8-pyi] Extend PYI033 to Python files (#​26129)

Bug fixes

• Detect equivalent numeric mapping keys (#​26009)
• Detect mapping keys equivalent to booleans (#​25982)
• Detect repeated signed and complex dictionary keys (#​26007)

Rule changes

• [flake8-pyi] Rename PYI033 to legacy-type-comment (#​26131)

Performance

• Use ThinVec for call keywords (#​25999)
• Inline parser recovery context checks (#​26038)
• Match parser keywords as bytes (#​26037)
• Move value parsing out of lexing (#​25360)

Server

• Render subdiagnostics and secondary annotations as related information (#​26011)

Documentation

• Update fix availability for always-fixable rules (#​26091)
• [flake8-tidy-imports] Add fix safety section (TID252) (#​17491)

Parser

• Reject __debug__ lambda parameters (#​26022)
• Reject _ as a match-pattern target (#​25977)
• Reject multiple starred names in sequence patterns (#​25976)
• Reject parenthesized star imports (#​26021)
• Reject starred comprehension targets (#​26023)
• Reject unparenthesized generator expressions in class bases (#​25978)
• Reject yield expressions after commas (#​26024)
• Validate function type parameter default order (#​25981)

Playground

• Make diagnostic links clickable (#​26104)
• Use diagnostic tags (#​26105)

Contributors

• @​AlexWaygood
• @​ntBre
• @​gtkacz
• @​MichaReiser
• @​charliermarsh
• @​Kalmaegi

astral-sh/uv (uv)

v0.11.22

Compare Source

Released on 2026-06-18.

Enhancements

• Publish wheels before sdists in uv publish (#​19831)
• Add TY and RUFF env vars for providing paths for binaries used by uv format and uv check (#​19821)

Preview features

• Allow configuring preview features in uv.toml and pyproject.toml (#​18437)
• Update the lockfile during uv check --no-sync (#​19909)
• Add --script to uv check and uv metadata (#​19860)
• Report workspace-exclusive dependency groups in workspace metadata (#​19862)
• Support SARIF as a uv audit output (#​19872)

Performance

• Use a more deadlock-resistant concurrent hashmap in the resolver (#​19532)

Bug fixes

• Update string marker ordering semantics to match upstream clarified rules (#​19808)
• Reject extras that have the same normalized name (#​19871)
• Reject dependency group include-group entries that have additional fields (#​19866)
• Reject invalid UTF-8 URL credentials (#​19814)
• Validate that PEP 517 backend-paths exist when building sdists (#​19834)
• Validate that pylock.toml files do not have an unsupported a lock-version (#​19869)
• Validate that the environment satisfies the packages.requires-python of a pylock.toml (#​19868)
• Allow uv to be recursively invoked by PEP 517 build hooks (#​19879)
• Allow empty credentials.toml files (#​19815)
• Fix transparent Python upgrades in project environments (#​19890)
• Handle non-file editable URLs in uv pip list (#​19867)
• Fix incorrect output from uv tree --invert (#​19910)
• Fix environment locking of uv venv in a project (#​19837)
• Fix handling of workspace-exclusive dependency groups in uv tree (#​19905)

Documentation

• Archive the 0.10.x changelog (#​19813)

Other changes

• Mark more tests as requiring network for vendors that need to run tests offline (#​19819)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.