fix: cap fastapi below 0.140 and adopt ruff 0.16.0

[lesnik512]

Fixes #152.

Two unrelated upstream releases landed between last Monday's green run and today's failure.

fastapi 0.140.0 (2026-07-24) — the test break

fastapi 0.140.0 made Dependant a slotted dataclass, and model is no longer a field. faststream 0.7.2 assigns dependant.model in _internal/fastapi/get_dependant.py:131, so every FastStream-in-FastAPI route now raises:

AttributeError: 'Dependant' object has no attribute 'model' and no __dict__ for setting new attributes

That failed 6 tests in tests/test_fastapi.py on 3.11–3.14 and free-threaded. The bug is upstream in faststream, tracked at ag2ai/faststream#2959 (opened the same day); no fix is released.

Why cap the published extra, not just dev: faststream 0.7.2 declares no fastapi dependency at all — not even an optional extra (its extras are cli, confluent, kafka, mqtt, nats, otel, prometheus, rabbit, redis). It reaches FastAPI through an optional import and expects the caller to supply it. So nothing in the dependency graph stops a fresh pip install faststream-outbox[fastapi] from resolving fastapi 0.140.0 and handing the user a broken integration. This extra is the only place the pairing can be constrained.

The exit is clean: when faststream ships the fix, drop the fastapi cap and raise the faststream floor instead. Both cap sites carry a comment saying so.

ruff 0.16.0 (2026-07-23) — the lint break

• CPY001 (missing-copyright-notice) left preview, so select = ["ALL"] now selects it — 62 hits. Ignored, matching the existing entry in modern-di.
• ISC004 ×2 and one unused RUF100 noqa: BLE001, both autofixable — taken as-is.
• Markdown formatting is new in 0.16.0 — 17 files reformatted.

Verified against ruff 0.15.22 (last week's green run): both check and format were clean, so every lint finding here is new in 0.16.0.

Verification

just lint-ci green locally. just test needs docker (unavailable on this machine), so I ran the two affected files directly against the pinned fastapi 0.139.2: 301 passed, including all 10 in tests/test_fastapi.py. CI covers the rest.

🤖 Generated with Claude Code

[github-actions]

Benchmark gate

✅ gate passed

scenario	msg/s	delete/msg	WALrec/msg	WALB/msg	fpi	upd	del	dead_tup
consumer/w1/b10	978	1.000	6.79	916	242	5000	5000	10000
consumer/w1/b100	975	1.000	6.83	919	243	5000	5000	10000
consumer/w2/b10	1110	1.000	6.80	963	242	5000	5000	10000
consumer/w2/b100	1324	1.000	6.73	955	243	5000	5000	10000
consumer/w4/b10	1020	1.000	6.78	958	242	5000	5000	10000
consumer/w4/b100	1522	1.000	6.86	1033	244	5000	5000	10000
consumer/w1/b100/tfbs100	5410	0.010	6.07	1116	243	5000	5000	10000
producer/w1/b100	2134	0.000	3.04	584	0	0	0	0

Gated (fails the build): delete_calls + tuple counters (upd/del/ins) + the producer's insert_calls/select_calls, exact; wal_records within a 10% band. msg/s, WAL bytes and total calls are informational (timing/FPI noise).