chore(deps)(deps): bump the dev-tools group across 1 directory with 2 updates

[dependabot]

Bumps the dev-tools group with 2 updates in the / directory: ruff and mypy.

Updates ruff from 0.15.12 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

• 9e4938c Bump 0.16.5 (#28110)
• aad0e90 Allow rules without codes (#28049)
• 5fdab73 Update preview default rules and categories (#27877)
• 29c8e5b Document rule acceptance guidelines (#27910)
• 50a4d7f Document the new category selectors (#27906)
• ada8795 Introduce category selectors (#27666)
• d894723 [ty] Infer lambda parameters through callable type aliases (#28109)
• 2685fde [ty] Narrow functional enum members in == and match (#28103)
• efcffd2 [ty] Intersection simplifications with subtype-related generic specialization...
• eb78048 [ty] Bump ecosystem-analyzer for HTML escaping (#28104)
• Additional commits viewable in compare view

Updates mypy from 1.14.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• Additional commits viewable in compare view

[dependabot]

Assignees

The following users could not be added as assignees: YOUR_GITHUB_USERNAME. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automerge-candidate, dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Large PR Warning
Reviewable lines changed: 465
Warning threshold: 300 lines
Consider splitting for easier review

📋 Best Practices for Large Changes

1. Refactoring + Features: Separate into 2 PRs
2. Multiple Features: One PR per feature
3. Database + Code: Separate migration from logic
4. Generated Code: Exclude it from reviewable-size accounting

---

✅ This PR passes the blocking limit but is larger than recommended.

[github-actions]

L9 Audit Harness Report

• Generated: 2026-09-05T22:09:11.563672+00:00
• Repo root: /home/runner/work/Cognitive.Engine.Graphs/Cognitive.Engine.Graphs
• Overall result: ✅ PASSED
• Exit code: 0

Step Results

Step	Status	Exit Code	Notes
Architecture Audit	✅ Passed	0
Spec Coverage	✅ Passed	0
Contract Wiring	✅ Passed	0

Architecture Audit Findings

Severity	Count
🔴 CRITICAL	0
🟠 HIGH	0
🟡 MEDIUM	17
🔵 LOW	0

See artifacts/audit_report.md for full details.

Spec Coverage

• ✅ Implemented: 37
• ⚠️ Partial: 9
• ❌ Missing: 0
• Total features: 46

Category	Implemented	Partial	Missing	Total
gates	10	0	0	10
scoring	7	0	0	7
v1.1_node	2	0	0	2
v1.1_edge	2	0	0	2
v1.1_action	0	2	0	2
v1.1_scoring	1	1	0	2
action_handler	0	6	0	6
gds_algorithm	5	0	0	5
research_pattern	10	0	0	10

See artifacts/coverage_report.md for full details.

Next Steps

All checks passed. Safe to merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud