This is flake8-bugbear, not bandit. Still makes sense to change though (I reran a flaky job).

I see that this simplifies our config, but Ruff doesn't have great coverage for stubs in its test suite. And I still basically think there's ~no benefit from having any of the flake8-bugbear rules being run on our stubs. So I would probably slightly lean towards keeping this blnaket exclusion, just in case Ruff adds some new flake8-bugbear rules in the future that don't make sense for stubs and forgets to explicitly skip the rule for stubs. (That would be a bug in Ruff! But it also sounds like a very plausible bug.)

[...] just in case Ruff adds some new flake8-bugbear rules in the future that don't make sense for stubs and forgets to explicitly skip the rule for stubs. (That would be a bug in Ruff! But it also sounds like a very plausible bug.)

Honestly, for me it's less about config simplification (although I do like having less arbitrary exclusions), and more that I would like such a Ruff "bug" about rules misapplying to stubs to be found and reported! (as long as it's for a rule group we do use outside of stubs, to lint our scripts and tests)

Since we pin our dependencies, it wouldn't make our tests "suddenly start failing". And since we autoupdate through PRs, such changes can be caught earlier.

I'm also unsure atm if Ruff's ecosystem check can bypass per-file exclusions to see if it would incorrectly apply a rule to stubs.