[easy][minor] Freeze ruff libraries to the REV that the TAG points to. #6375

slawlor · 2025-12-09T12:59:02Z

Tags can move and be re-aliased to different revisions, and this actually freezes the rev (similar to how a published crate would) so that it only applies to this specific commit hash. (Tag release link: https://github.com/astral-sh/ruff/releases/tag/0.14.1)

This has caused some minor problems when vendoring sources where Ruff is used by other projects and is already pulled in by a rev, causing cargo vendor to crash.

Thanks for the awesome project!

Summary by CodeRabbit

Chores
- Pinned four internal parsing/text dependencies to specific commit revisions (keeping the same source) to ensure reproducible builds and stability. No other dependencies or configuration changed; no public APIs or runtime behavior altered.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

coderabbitai · 2025-12-09T12:59:31Z

Walkthrough

Four ruff-related dependencies in Cargo.toml were changed from git tag "0.14.1" to a specific git revision 2bffef59665ce7d2630dfd72ee99846663660db8; repository URLs remain unchanged and no other files or configs were modified.

Changes

Cohort / File(s)	Summary
Dependency version pinning `Cargo.toml`	Replace four ruff-related dependencies (`ruff_python_parser`, `ruff_python_ast`, `ruff_text_size`, `ruff_source_file`) referencing git tag `"0.14.1"` with the specific git revision `2bffef59665ce7d2630dfd72ee99846663660db8` to ensure reproducible builds.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Verify the git revision hash is correct and intentional
Confirm all four dependency entries use the identical revision
Ensure no other dependency fields (features, optional flags) were unintentionally altered

Poem

🐰 I nibbled tags and found a hash,
Four ruff friends snug in one small stash,
Pinned and steady, no surprise,
I dance in code with polished eyes. 🥕

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: freezing ruff libraries to specific commit revisions instead of tags, which is the core modification in Cargo.toml.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

📜 Recent review details

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a2b665e and cd30f90.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

Cargo.toml (1 hunks)

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2025-11-29T12:17:28.606Z

Learnt from: CR
Repo: RustPython/RustPython PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-11-29T12:17:28.606Z
Learning: Applies to **/*.py : Use ruff for linting Python code

Applied to files:

Cargo.toml

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

Cargo.toml (1)
154-157: Approve dependency pinning strategy.

The conversion from tag-based to revision-based pinning across all four ruff crates is the correct approach to prevent the vendoring issues caused by moving tags. Using the same revision hash for all four interdependent crates ensures compatibility.

Consider adding a brief comment above these dependencies to document which upstream release this revision corresponds to, for future maintainers:
+# Pinned to revision of Ruff v0.14.1 tag for stable vendoring (tags can move/realias)
+# See: https://github.com/astral-sh/ruff/releases/tag/0.14.1
 ruff_python_parser = { git = "https://github.com/astral-sh/ruff.git", rev = "2bffef59665ce7d2630dfd72ee99846663660db8" }

📜 Review details

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a99164f and a2b665e.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

Cargo.toml (1 hunks)

🧰 Additional context used

🧠 Learnings (2)

📓 Common learnings

Learnt from: CR
Repo: RustPython/RustPython PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-11-29T12:17:28.606Z
Learning: Applies to Lib/**/*.py : Minimize modifications to CPython standard library files in the `Lib/` directory; modifications should be minimal and only to work around RustPython limitations

📚 Learning: 2025-11-29T12:17:28.606Z

Learnt from: CR
Repo: RustPython/RustPython PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-11-29T12:17:28.606Z
Learning: Applies to **/*.py : Use ruff for linting Python code

Applied to files:

Cargo.toml

coderabbitai · 2025-12-09T13:01:49Z

Cargo.toml

+ruff_python_parser = { git = "https://github.com/astral-sh/ruff.git", rev = "2bffef59665ce7d2630dfd72ee99846663660db8" }
+ruff_python_ast = { git = "https://github.com/astral-sh/ruff.git", rev = "2bffef59665ce7d2630dfd72ee99846663660db8" }
+ruff_text_size = { git = "https://github.com/astral-sh/ruff.git", rev = "2bffef59665ce7d2630dfd72ee99846663660db8" }
+ruff_source_file = { git = "https://github.com/astral-sh/ruff.git", rev = "2bffef59665ce7d2630dfd72ee99846663660db8" }


⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify the revision hash in the ruff repository # Check if the commit hash is accessible and what tag it belongs to echo "=== Checking if commit hash exists in ruff repository ===" git ls-remote https://github.com/astral-sh/ruff.git 2bffef59665ce7d2630dfd72ee99846663660db8 2>&1 | head -10 echo -e "\n=== Checking all tags pointing to or near this commit ===" git ls-remote --tags https://github.com/astral-sh/ruff.git | grep -E "(0\.14|2bffef)" | head -20 echo -e "\n=== Confirming tag 0.14.1 exists ===" git ls-remote --tags https://github.com/astral-sh/ruff.git refs/tags/0.14.1 2>&1 echo -e "\n=== Getting the commit hash of tag 0.14.1 ===" git ls-remote --tags https://github.com/astral-sh/ruff.git refs/tags/0.14.1 2>&1 | awk '{print $1}' echo -e "\n=== Checking recent tags ===" git ls-remote --tags https://github.com/astral-sh/ruff.git | grep -E "^[a-f0-9]" | tail -20

Repository: RustPython/RustPython

Length of output: 186

🌐 Web query:

ruff commit 2bffef59665ce7d2630dfd72ee99846663660db8 tag 0.14.1

💡 Result:

Yes — the GitHub release tag 0.14.1 points to commit 2bffef59665ce7d2630dfd72ee99846663660db8 (short: 2bffef5). Released Oct 16, 2025. [1][2]

Sources:
[1] GitHub release page for 0.14.1.
[2] Commit view (Bump 0.14.1 — 2bffef5).

🌐 Web query:

astral-sh ruff 0.14.1 release tag commit

💡 Result:

The 0.14.1 release tag points to commit 2bffef59665ce7d2630dfd72ee99846663660db8 (released 2025-10-16). [1][2]

Sources:
[1] astral-sh/ruff Releases (0.14.1).
[2] Commit 2bffef59665ce7d2630dfd72ee99846663660db8 on astral-sh/ruff.

🌐 Web query:

ruff Python linter version 0.14.1 release notes

💡 Result:

Ruff v0.14.1 — Release notes (released Oct 16, 2025)

Preview features:

formatter: remove parentheses around multiple exception types on Python 3.14+.

flake8-bugbear: omit annotation in preview fix for B006.

flake8-logging-format: avoid dropping implicitly concatenated pieces in G004 fix.

pydoclint: add docstring-extraneous-parameter (DOC102).

pyupgrade: extend UP019 to detect typing_extensions.Text; fix UP046 false negative for TypeVar with default in non-PEP695 generic classes.

Bug fixes:

Fix false negatives in truthiness analysis for lambdas, generators, and f-strings.

Fix syntax-error false positives for escapes/quotes in f-strings and for parenthesized context managers.

FastAPI, flake8-pyi, and ruff-specific diagnostic fixes (several rule-specific fixes).

Rule changes:

Add AIR301 warning for airflow.datasets.DatasetEvent usage.

Mark B905 and B912 fixes as unsafe; more rules use DiagnosticTag (editor display changes).

Documentation:

Update Python compatibility to 3.14 in README; various docs updates and typos fixed.

Other:

Reduce binary size; improved error recovery for unclosed strings; install/download assets and installer commands included.

Sources: GitHub release notes for ruff 0.14.1. [1] Additional changelog mirror. [2]

References:
[1] GitHub — astral-sh/ruff: Release 0.14.1 (Oct 16, 2025).
[2] Ruff CHANGELOG / mirrors (0.14.1).

🌐 Web query:

ruff releases after 0.14.1 0.15 0.14.2 latest version 2025

💡 Result:

Ruff releases after 0.14.1 (Oct 16, 2025) in 2025:

0.14.2 — Oct 23, 2025. [1]

0.14.3 — Oct 30, 2025. [1]

0.14.4 — Nov 06, 2025. [1]

0.14.6 — Nov 21, 2025 (latest listed on the project releases page). [1]

There is no 0.15 release listed on the official releases page as of these entries. [1]

Source: Ruff releases (astral-sh/ruff) on GitHub. [1]

🌐 Web query:

astral-sh ruff latest release version December 2025

💡 Result:

The latest ruff release is v0.14.8 — released December 4, 2025. [1][2]

Sources:
[1] astral-sh/ruff Releases (GitHub).
[2] Astral — ruff / product site.

Update dependencies to the latest ruff patch version.

The revision hash 2bffef59665ce7d2630dfd72ee99846663660db8 correctly corresponds to tag 0.14.1. However, seven patch releases have been published since (0.14.2 through 0.14.8, released Dec 4, 2025). Consider updating to 0.14.8 or the latest stable patch to incorporate bug fixes and improvements from recent releases.

ShaharNaveh

Generally, I'm fine with this change. Can you please add the tag version as a comment? it will be easier to track which ruff version we use.

Ty:)

Tags can move and be re-aliased to different revisions, and this actually freezes the rev (similar to how a published crate would) so that it only applies to this specific commit hash.

youknowone

Thanks! I didn't know tag is possible to cause problems

youknowone · 2025-12-09T14:19:57Z

Could you tell me what are you building with RustPython if you don't mind? Just in curiuos.

coderabbitai bot reviewed Dec 9, 2025

View reviewed changes

ShaharNaveh suggested changes Dec 9, 2025

View reviewed changes

Freeze ruff libraries to the REV that the TAG points to.

cd30f90

Tags can move and be re-aliased to different revisions, and this actually freezes the rev (similar to how a published crate would) so that it only applies to this specific commit hash.

slawlor force-pushed the frozen branch from a2b665e to cd30f90 Compare December 9, 2025 14:13

youknowone approved these changes Dec 9, 2025

View reviewed changes

youknowone merged commit 6003c87 into RustPython:main Dec 9, 2025
2 checks passed

slawlor deleted the frozen branch December 9, 2025 14:26

coderabbitai bot mentioned this pull request Dec 31, 2025

Update ruff to 0.14.10 #6271

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[easy][minor] Freeze ruff libraries to the REV that the TAG points to. #6375

[easy][minor] Freeze ruff libraries to the REV that the TAG points to. #6375

Uh oh!

slawlor commented Dec 9, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Dec 9, 2025 •

edited

Loading

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Dec 9, 2025

Uh oh!

ShaharNaveh left a comment

Uh oh!

youknowone left a comment

Uh oh!

Uh oh!

youknowone commented Dec 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[easy][minor] Freeze ruff libraries to the REV that the TAG points to. #6375

[easy][minor] Freeze ruff libraries to the REV that the TAG points to. #6375

Uh oh!

Conversation

slawlor commented Dec 9, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Pre-merge checks and finishing touches

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

ShaharNaveh left a comment

Choose a reason for hiding this comment

Uh oh!

youknowone left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

youknowone commented Dec 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

slawlor commented Dec 9, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Dec 9, 2025 •

edited

Loading