[pre-commit.ci] pre-commit autoupdate (#185)

* [pre-commit.ci] pre-commit autoupdate

updates:
- [github.com/astral-sh/ruff-pre-commit: v0.15.16 → v0.15.17](astral-sh/ruff-pre-commit@v0.15.16...v0.15.17)

* ci(grype): allowlist transitive pyo3 advisories embedded in rpds-py

The grype gate fails on two pyo3 0.28.3 vulnerabilities CGC cannot remediate
from this repo — pyo3 is statically linked into the rpds-py wheel (transitive:
jupyter/jsonschema -> referencing -> rpds-py), fixable only by an upstream
conda-forge rebuild against pyo3 >= 0.29.0:

- GHSA-36hh-v3qg-5jq4 (HIGH):   OOB read in nth/nth_back for PyList/PyTuple
- GHSA-chgr-c6px-7xpp (MEDIUM): missing Sync bound on PyCFunction::new_closure

Each entry carries a revisit condition. The gate still fails on any other
fixable medium+ finding.

Assisted-With: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Chen Zhang <chenzhang8722@gmail.com>

Author: pre-commit-ci[bot]

.grype.yaml

@@ -67,3 +67,17 @@ ignore:
       name: qt
   - package:
       name: gstreamer
+
+  # pyo3 0.28.3 is statically linked into the rpds-py wheel (transitive:
+  # jupyter/jsonschema -> referencing -> rpds-py). grype catalogs it from the
+  # compiled binary, but it is not fixable from this repo — it needs an upstream
+  # conda-forge rebuild of rpds-py against pyo3 >= 0.29.0 (the first patched
+  # version). Remove both once that lands (the lockfile-update workflow will pick
+  # it up). The same advisories were fixed directly in the group's own Rust repos
+  # (NEREIDS/bm3dornl).
+  - vulnerability: GHSA-36hh-v3qg-5jq4 # HIGH: pyo3 OOB read in nth/nth_back for PyList/PyTuple
+    package:
+      name: pyo3
+  - vulnerability: GHSA-chgr-c6px-7xpp # MEDIUM: pyo3 missing Sync bound on PyCFunction::new_closure
+    package:
+      name: pyo3

.pre-commit-config.yaml

@@ -12,7 +12,7 @@ repos:
     - id: trailing-whitespace
 
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.15.16
+  rev: v0.15.17
   hooks:
     - id: ruff
       args: [--fix, --exit-non-zero-on-fix]