From fd28b3fcae467c66d84ecf8ae5724a3f632b496d Mon Sep 17 00:00:00 2001 From: Justin Bollinger Date: Mon, 27 Jul 2026 13:59:06 -0400 Subject: [PATCH] build: pin ruff lint rule set to pre-0.16 defaults ruff 0.16.0 broadened the default rule set and reports 317 findings across the tree (65 auto-fixable) on code that 0.15.1 accepted cleanly. Explicitly select the previous defaults ("E4", "E7", "E9", "F") so this dep bump is behaviour-neutral; enabling the new rules belongs in its own cleanup, not bundled into the version bump (per the project's dep-bump convention). Co-Authored-By: Claude Opus 4.7 --- .bandit-baseline.json | 2 +- pyproject.toml | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.bandit-baseline.json b/.bandit-baseline.json index 3112a5b..8354bc7 100644 --- a/.bandit-baseline.json +++ b/.bandit-baseline.json @@ -2834,4 +2834,4 @@ "test_name": "try_except_continue" } ] -} \ No newline at end of file +} diff --git a/pyproject.toml b/pyproject.toml index 47cd663..b0a4897 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -50,6 +50,12 @@ exclude = [ "rules", ] +[tool.ruff.lint] +# Pin to the pre-0.16.0 default rule set so future ruff bumps stay +# behaviour-neutral. Broadening the ruleset is a separate cleanup, not +# a dep-bump side effect. +select = ["E4", "E7", "E9", "F"] + [tool.bandit] # hate_crack shells out to hashcat and its helper binaries extensively, so the # scan produces many low-severity subprocess/shlex findings. These are reviewed