[lelia]

Ruff replaces Black and Flake8 and enforces linting and formatting on every pull request. Local commands and pre-commit hooks use the same locked Ruff version as CI.

Changes

• Add an unconditional Lint workflow, make lint / make format / make hooks targets, and pre-commit hooks using Ruff 0.17.4. Preserve the repository's 100-character line length and Python 3.10 support.
• Clear the maintained-code baseline and set complexity 12 and eight-argument limits. The 51 existing over-limit functions have individual suppressions; RUF100 rejects markers that become unnecessary.
• Exclude deliberately vulnerable app_tests/ and tests/fixtures/ targets and the generated CWE catalog. The generator and other development scripts remain linted.
• Preserve connector package exports, finding rule IDs, and the UTC trailing-Z notification format while modernizing imports, annotations, exception chaining, and subprocess handling. Add regression coverage for exports, rule labels, and timestamps.
• Make release-validation scripts and tests use the existing TOML compatibility dependency on Python 3.10. Add contributor guidance and [Unreleased] changelog entries; release version metadata stays with the separate release-preparation workflow.

Validation

• 516 tests passed, one skipped, on Python 3.12 with OpenGrep required, including Java scanner rule tests.
• 516 tests passed, one skipped, on Python 3.10.
• Ruff lint and format checks, pre-commit hooks, actionlint, and locked dependency validation.
• Wheel and sdist builds, release metadata checks, and current-release documentation checks.
• All GitHub checks pass, including the new Ruff gate, package or unit tests, dependency review, and CodeQL.
• Fourth wall review of added comments/docstrings, policy explanations, contributor guidance, changelog, and this description.

This is the Basics rollout. Shared workflow extraction and the cross-repository policy floor remain separate work.

Refs CE-451

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pre-commit@​4.6.2
	pypi/​ruff@​0.17.4

View full report

[socket-security-staging]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	High CVE: pypi filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files CVE: GHSA-v4x8-3wr5-3wq8 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (HIGH) Affected versions: >= 3.20.4 < 4.2.1 Patched version: 4.2.1 From: uv.lock → pypi/pre-commit@4.6.2 → pypi/filelock@4.1.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/filelock@4.1.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pre-commit@​4.6.2
	pypi/​ruff@​0.17.4

View full report

[cursor]

PR Summary

Low Risk
Primarily tooling and mechanical style changes with broad test/CI validation; limited intentional runtime tweaks (e.g. UTC timestamps, script compatibility).

Overview
Ruff replaces Black and Flake8 as the single linter and formatter, with a new GitHub Actions Lint workflow, Makefile targets (lint, format, hooks), and pre-commit hooks—all pinned to the same locked Ruff 0.17.4 via uv.

pyproject.toml drops Black/Flake8, adds a broad [tool.ruff] profile (100-char lines, Python 3.10 floor, complexity 12 and 8 max args, RUF100 to drop stale # noqa), and excludes vulnerable app_tests/, tests/fixtures/, and generated cwe_catalog.py.

The rest of the diff is largely Ruff-driven cleanup across scripts and socket_basics/ (modern typing, import order, formatting, targeted noqa: C901 on already-complex functions). Release/maintenance scripts gain tomlli fallbacks for Python 3.10. Changelog also notes timezone-aware UTC timestamps in notification formatters while keeping trailing-Z JSON output.

^{Reviewed by Cursor Bugbot for commit 2c704ef. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2c704ef. Configure here.}