chore: bump CI actions and dependencies, widen ruff rule set, drop bandit

.github/workflows/ci.yml

@@ -22,11 +22,11 @@ jobs:
         uses: actions/checkout@v7
       - name: Set up python
         id: setup-python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version-file: ".python-version"
       - name: Set up uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
         with:
           enable-cache: true
           version-file: "pyproject.toml"
@@ -40,8 +40,6 @@ jobs:
         run: uv run mypy
       - name: Run ty
         run: uv run ty check
-      - name: Run bandit
-        run: uv run bandit -r src
       - name: Test with pytest
         run: uv run pytest tests --cov=src
       - name: Minimize uv cache
@@ -57,11 +55,11 @@ jobs:
         uses: actions/checkout@v7
       - name: Set up python
         id: setup-python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version-file: ".python-version"
       - name: Set up uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
         with:
           enable-cache: true
           version-file: "pyproject.toml"

.pre-commit-config.yaml

@@ -16,7 +16,7 @@ repos:
 
   # ruff - linting + formatting
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.20
+    rev: v0.16.0
     hooks:
       - id: ruff
         name: ruff
@@ -25,29 +25,18 @@ repos:
 
   # mypy - lint-like type checking
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v2.1.0
+    rev: v2.3.0
     hooks:
       - id: mypy
         name: mypy
 
   # ty - lint-like type checking (Astral, preview)
   - repo: https://github.com/astral-sh/ty-pre-commit
-    rev: v0.0.55
+    rev: v0.0.63
     hooks:
       - id: ty
         name: ty
 
-  # bandit - find common security issues
-  - repo: https://github.com/pycqa/bandit
-    rev: 1.9.4
-    hooks:
-      - id: bandit
-        name: bandit
-        exclude: ^tests/
-        args:
-          - -r
-          - src
-
   - repo: local
     hooks:
       - id: pytest
@@ -59,7 +48,7 @@ repos:
 
   # oxfmt - formatting YAML, JSON, Markdown, ...
   - repo: https://github.com/oxc-project/mirrors-oxfmt
-    rev: v0.56.0
+    rev: v0.60.0
     hooks:
       - id: oxfmt
         types_or: [yaml, markdown, json]

README.md

@@ -2,7 +2,6 @@
   <a href="https://github.com/astral-sh/uv" target="blank"><img src="https://github.com/astral-sh/uv/blob/8674968a17e5f2ee0dda01d17aaf609f162939ca/docs/assets/logo-letter.svg" height="100" alt="uv logo" /></a>
   <a href="https://pre-commit.com/" target="blank"><img src="https://pre-commit.com/logo.svg" height="100" alt="pre-commit logo" /></a>
   <a href="https://github.com/astral-sh/ruff" target="blank"><img src="https://raw.githubusercontent.com/astral-sh/ruff/8c20f14e62ddaf7b6d62674f300f5d19cbdc5acb/docs/assets/bolt.svg" height="100" alt="ruff logo" style="background-color: #ef5552" /></a>
-  <a href="https://bandit.readthedocs.io/" target="blank"><img src="https://raw.githubusercontent.com/pycqa/bandit/main/logo/logo.svg" height="100" alt="bandit logo" /></a>
   <a href="https://docs.pytest.org/" target="blank"><img src="https://raw.githubusercontent.com/pytest-dev/pytest/main/doc/en/img/pytest_logo_curves.svg" height="100" alt="pytest logo" /></a>
 </p>
 
@@ -121,14 +120,6 @@ Rules are defined in the [`pyproject.toml`](pyproject.toml).
 
 For more configuration options and details, see the [ty documentation](https://github.com/astral-sh/ty).
 
-### bandit
-
-[bandit](https://bandit.readthedocs.io/) is a tool designed to find common security issues in Python code.
-
-Rules are defined in the [`pyproject.toml`](pyproject.toml).
-
-For more configuration options and details, see the [configuration docs](https://bandit.readthedocs.io/).
-
 ---
 
 ## Testing
@@ -211,14 +202,6 @@ To run mypy:
 uv run mypy
 ```
 
-### Security
-
-To run bandit:
-
-```bash
-uv run bandit -r src
-```
-
 ### Pre-commit
 
 To run all pre-commit hooks against all files:

pyproject.toml

@@ -21,10 +21,9 @@ build-backend = "uv_build"
 dev = [
   "pytest>=9.1.1",
   "pytest-cov>=7.1.0",
-  "mypy>=2.1.0",
-  "bandit>=1.9.4",
-  "ruff>=0.15.20",
-  "ty>=0.0.55",
+  "mypy>=2.3.0",
+  "ruff>=0.16.0",
+  "ty>=0.0.63",
 ]
 
 [tool.uv]
@@ -46,6 +45,10 @@ src = ["src", "tests"]
 
 [tool.ruff.lint]
 extend-select = [
+  "A",
+  "ANN401",
+  "ARG",
+  "B",
   "C4",
   "D200",
   "D201",
@@ -60,49 +63,50 @@ extend-select = [
   "D402",
   "D403",
   "D404",
-  "D419",
+  "D417",
   "E",
+  "EM",
+  "ERA001",
   "F",
+  "FBT",
   "FURB",
-  "G010",
+  "G",
   "I",
   "INP001",
-  "N805",
-  "PERF101",
-  "PERF102",
+  "ISC003",
+  "LOG",
+  "N",
   "PERF401",
-  "PERF402",
+  "PERF403",
+  "PGH003",
   "PGH004",
-  "PGH005",
-  "PIE794",
-  "PIE796",
-  "PIE807",
-  "PIE810",
-  "PLC",
-  "PLR",
-  "RET502",
-  "RET503",
-  "RET504",
-  "RET505",
-  "RUF015",
-  "RUF032",
-  "RUF033",
-  "RUF034",
+  "PL",
+  "PT",
+  "PTH",
+  "RET",
+  "RSE102",
+  "RUF005",
+  "RUF006",
+  "RUF021",
+  "RUF036",
   "RUF037",
-  "RUF041",
   "RUF043",
-  "RUF046",
-  "RUF057",
-  "RUF059",
   "RUF060",
   "RUF061",
   "RUF064",
-  "RUF100",
   "RUF102",
   "RUF103",
   "RUF104",
-  "S101",
+  "S",
+  "SIM",
+  "SLF001",
+  "SLOT",
   "T20",
+  "TC",
+  "TID252",
+  "TRY300",
+  "TRY301",
+  "TRY400",
   "UP",
   "W",
 ]

tests/test_python_boilerplate.py

@@ -2,5 +2,4 @@
 
 
 def test_hello_world() -> None:
-    if hello_world() != "Hello World":
-        raise ValueError('Expected value to be "Hello World"')
+    assert hello_world() == "Hello World"