Ruff v0.16 turns on 413 default rules, assumes you’ll autofix with an agent

TL;DR

• Ruff v0.16.0 enables 413 default rules, up from 59, breaking unpinned CI pipelines.
• Escape hatch restores prior behavior via select = ["E4", "E7", "E9", "F"] in [lint].
• Simon Willison used Codex and Claude Code to auto-fix 1,538 of 1,618 violations in sqlite-utils.
• Astral now ships this default under OpenAI ownership after a reported $750M March 2026 acquisition.

A dev-tool release rarely gets its own day-level frame, but Ruff v0.16.0 earns one. Astral flipped the default rule set from 59 to 413 — a 7× expansion that turns any project with an unpinned ruff dependency into a CI failure the morning of the upgrade. There’s a one-line escape hatch that pins the old defaults while keeping the fast engine, so the fire drill is optional. What isn’t optional is noticing what the remediation path now looks like: Simon Willison fixed 1,538 of 1,618 new violations in sqlite-utils by pointing Codex and Claude Code at the diff. The upgrade assumes you have an agent.

The governance subtext is the second half of the story. Astral has been an OpenAI subsidiary since a reported $750M acquisition in March 2026, which means the vendor now setting Python’s de facto lint defaults is the same vendor selling the coding agents that make the new defaults tractable. That’s not a scandal — it’s a shape worth naming while the ink is still wet.

Ruff v0.16.0 expands default checks from 59 to 413 rules

Source: simon-willison · published 2026-07-25

TL;DR

• Ruff v0.16.0 turns on 413 default rules, up from 59, breaking CI for anyone with an unpinned ruff dev dependency.
• Escape hatch: select = ["E4", "E7", "E9", "F"] in [lint] restores the old defaults while keeping the fast engine.
• Simon Willison ran Codex and Claude Code to auto-fix 1,538 of 1,618 violations in sqlite-utils alone.
• Governance subtext: Astral is now an OpenAI subsidiary after a reported $750M acquisition in March 2026.

The default just moved under you

Ruff’s default rule set had not been touched since v0.1.0. In the interim the project grew from 708 to 968 rules, and only 59 shipped on by default — a mismatch maintainer Micha Reiser explicitly frames as the reason for the reset ¹. v0.16.0 activates 354 additional rules across roughly 34 categories, pulling in swathes of bugbear, pyupgrade, simplify, and parts of pylint that used to be opt-in ². Some of the new defaults catch real bugs (blind except Exception, useless attribute access, naive datetime.now()); many are stylistic; a few, like RUF015, silently rewrite next(iter(x)) patterns in ways that swap IndexError for StopIteration.

If you don’t want the new posture, the fix is one line — select = ["E4", "E7", "E9", "F"] — and you keep the v0.16.0 speed improvements ²¹. That’s worth knowing before you spend an afternoon triaging 1,600 diagnostics.

The agent-shaped release

Willison’s post ends with the tell: he had Codex (GPT-5.6) and Claude Code (Opus 5) grind through the upgrades on Datasette, sqlite-utils, and LLM. The Ruff output — file, line, rule code, plain-English fix hint — is essentially a machine-readable work queue. That is not an accident of API design anymore. Astral was acquired by OpenAI in March 2026 for a reported $750M, and Charlie Marsh’s team now sits inside the Codex division ³.

Anaconda’s response to the deal warned of “priority drift” — the risk that Ruff and uv get tuned for OpenAI’s agent pipelines rather than for the humans who install them from PyPI, with no independent-maintainer commitments in the acquisition terms ⁴. A release that dramatically expands the surface area of machine-fixable diagnostics, shipped four months after that acquisition, is at minimum consistent with the concern.

The --unsafe-fixes problem

The demo workflow — uvx ruff@latest check . --fix --unsafe-fixes piped into an agent — leans on two layers of automated judgment. Both are shakier than the pull-request diff suggests. Practitioners tracking agent reliability report that coding agents “frequently ‘fix’ code that was already correct” and introduce “GhostApproval” regressions where the patch passes lint and tests but adds subtle bugs ⁵. --unsafe-fixes is exactly the setting where that compounds: Ruff won’t ask, and the agent won’t either.

There’s also a depth question the speed pitch elides. Ruff finishes a 47k-line codebase in ~180ms; Pylint takes 47 seconds — but still catches cross-file logical bugs Ruff skips by design ⁶. The new defaults push Ruff further into Pylint’s problem space without closing that gap.

Takeaway

Pin your Ruff version, or accept the new posture deliberately. And if you’re going to let an agent auto-apply 1,500 fixes in one commit, review the diff like you would from a contractor you just met — because functionally, you did.

Footnotes

1. GitHub issue #22621 - maintainer Micha Reiser — https://github.com/astral-sh/ruff/issues/22621

   While ‘noisy’ rules without fixes are generally avoided, some are included if they catch ‘very important’ issues that developers should handle manually; the tool had grown from 708 to 968 rules since the last default update.

   ↩ ↩²

2. pydevtools.com - Ruff 0.16.0 default rules breakdown — https://pydevtools.com/blog/ruff-0-16-0-default-rules/

   Users can revert to the previous conservative rule set by adding select = ["E4", "E7", "E9", "F"] to the [lint] section of their configuration while still benefiting from the performance improvements of the v0.16.0 engine.

   ↩ ↩²

3. Simon Willison - OpenAI acquiring Astral — https://simonwillison.net/2026/Mar/19/openai-acquiring-astral/

   OpenAI acquired Astral on March 19, 2026 for a reported $750M, folding Charlie Marsh and the Ruff/uv/ty engineering team into the Codex division.

   ↩

4. Anaconda blog - ‘When the world begins to shift underneath your feet’ — https://www.anaconda.com/blog/when-the-world-begins-to-shift-underneath-your-feet

   Independent observers point to a lack of formal governance structures or independent-maintainer commitments in the Astral acquisition, warning of ‘priority drift’ where updates may prioritize OpenAI’s training pipelines over the general needs of Python developers.

   ↩

5. Autonoma - AI agent reliability testing — https://getautonoma.com/blog/ai-agent-reliability-testing

   Agents frequently ‘fix’ code that was already correct or introduce over-engineered solutions just to clear a linter warning; developers report ‘GhostApproval’ risks where agent-generated fixes pass linting and tests but introduce subtle security vulnerabilities.

   ↩

6. Stackademic - Ruff vs Flake8 vs Pylint benchmark — https://blog.stackademic.com/i-tested-ruff-vs-flake8-vs-pylint-one-tool-replaced-all-three-eb63c15d2d66

   On a ~47,000-line codebase Ruff completes checks in ~180ms while Flake8 takes 8 seconds and Pylint takes 47 seconds, though Pylint still catches cross-file logical bugs that Ruff bypasses in favor of speed.

   ↩