Update dependency black to v24 [SECURITY] #58
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==22.8.0->==24.3.0GitHub Vulnerability Alerts
CVE-2024-21503
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Release Notes
psf/black (black)
v24.3.0Compare Source
Highlights
This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
(#4273)
Performance
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
--checkis used with--quiet(#4236)v24.2.0Compare Source
Stable style
(#4218)
Preview style
hug_parens_with_braces_and_square_bracketsfeature to the unstable styledue to an outstanding crash and proposed formatting tweaks (#4198)
expression (#4154)
(#4185)
casestatementifguards (#4214).Configuration
pyproject.tomlthat is missing atool.blacksection whendiscovering project root and configuration. Since Black continues to use version
control as an indicator of project root, this is expected to primarily change behavior
for users in a monorepo setup (desirably). If you wish to preserve previous behavior,
simply add an empty
[tool.black]to the previously discoveredpyproject.toml(#4204)
Output
SyntaxWarnings orDeprecationWarnings produced by theastmodule when performing equivalence checks (#4189)
Integrations
v24.1.1Compare Source
Bugfix release to fix a bug that made Black unusable on certain file systems with strict
limits on path length.
Preview style
Configuration
do not support long paths (#4176)
v24.1.0Compare Source
Highlights
This release introduces the new 2024 stable style (#4106), stabilizing the following
changes:
if-elseexpressions (#2278)...are formatted morecompactly (#3796)
(#3368)
withstatement(#3489)
entry (#3393)
--skip-magic-trailing-commaor-C, trailing commas are stripped fromsubscript expressions with more than 1 element (#3209)
# fmt: skipwith other comments (#3959)There are already a few improvements in the
--previewstyle, which are slated for the2025 stable style. Try them out and
share your feedback. In the past, the preview
style has included some features that we were not able to stabilize. This year, we're
adding a separate
--unstablestyle for features with known problems. Now, the--previewstyle only includes features that we actually expect to make it into nextyear's stable style.
Stable style
Several bug fixes were made in features that are moved to the stable style in this
release:
unlike other binary operators (#4109)
blocks, except immediately before a docstring (#4130)
Preview style
--unstablestyle, covering preview features that have known problems that wouldblock them from going into the stable style. Also add the
--enable-unstable-featureflag; for example, use
--enable-unstable-feature hug_parens_with_braces_and_square_bracketsto apply thispreview feature throughout 2024, even if a later Black release downgrades the feature
to unstable (#4096)
# fmt: skipcomments (#4146)Configuration
pyproject.tomlcontains an invalid key (#4165)--experimental-string-processingflag. This feature cancurrently be enabled with
--preview --enable-unstable-feature string_processing.(#4096)
Integrations
(#3940) for better compatibility with older versions of pre-commit (#4137)
v23.12.1Compare Source
Packaging
dextra by default (#4108)v23.12.0Compare Source
Highlights
It's almost 2024, which means it's time for a new edition of Black's stable style!
Together with this release, we'll put out an alpha release 24.1a1 showcasing the draft
2024 stable style, which we'll finalize in the January release. Please try it out and
share your feedback.
This release (23.12.0) will still produce the 2023 style. Most but not all of the
changes in
--previewmode will be in the 2024 stable style.Stable style
# fmt: offautomatically dedents when used with the--line-rangesoption, even when it is not within the specified line range. (#4084)
Preview style
indented less (#4012)
docstring (#4060)
--line-length(#4086)functions or class definitions (#4066) (#4103)
Configuration
--line-rangesnow skips Black's internal stability check in--safemode. Thisavoids a crash on rare inputs that have many unformatted same-content lines. (#4034)
Packaging
Integrations
v23.11.0Compare Source
Highlights
--line-rangescommand-line option(#4020)
Stable style
await (a ** b)(#3994)fixes a crash (#4019)
Preview style
less (#3964)
indented less (#3992)
now preserved (#4005)
caseblocks were not split into multiple lines. Also enablegeneral trailing comma rules on
caseblocks (#4024)class definition (#4028)
Configuration
--include(#3976)Performance
Integrations
formatter (#3940)
v23.10.1Compare Source
Highlights
Preview style
Packaging
Integrations
summaryparameter. (#3958)
Documentation
https://github.com/psf/black/issues/39683968
v23.10.0Compare Source
Stable style
Preview style
multiple lines (#3899)
Configuration
BLACK_CACHE_DIRis set (#3937)Parser
typewere not accepted insidematchstatements(#3950)
(#3949)
Output
code (#3933)
(#3938)
Integrations
v23.9.1Compare Source
Due to various issues, the previous release (23.9.0) did not include compiled mypyc
wheels, which make Black significantly faster. These issues have now been fixed, and
this release should come with compiled wheels once again.
There will be no wheels for Python 3.12 due to a bug in mypyc. We will provide 3.12
wheels in a future release as soon as the mypyc bug is fixed.
Packaging
Performance
decreasing the size of the cache (#3877)
v23.9.0Compare Source
Preview style
if sys.version_info > (3, x):) and a function definition on the same level (#3862)Configuration
Performance
IPythonif notebook cells do not contain magics (#3782)Blackd
blackdwith single character input (#3558)Integrations
official pre-commit mirror. Swapping
https://github.com/psf/blacktohttps://github.com/psf/black-pre-commit-mirrorinyour
.pre-commit-config.yamlwill make Black about 2x faster (#3828).black.envfolder specified byENV_PATHwill now be removed on the completionof the GitHub Action (#3759)
v23.7.0Compare Source
Highlights
supported until further notice (#3765)
Stable style
PEP 604 unions (#3735)
under some circumstances (#3745)
type: ignorewithin parentheses(#3740)
(#3773)
Preview style
parentheses (#3640)
Configuration
--workersargument to Black can now be specified via theBLACK_NUM_WORKERSenvironment variable (#3743)
.pytest_cache,.ruff_cacheand.vscodeare now excluded by default (#3691)pyproject.tomlsettings when running--stdin-filenameand the
pyproject.tomlfound isn't in the current working directory (#3719)excludeandextend-excludehave invalid data types inpyproject.toml, instead of silently doing the wrong thing (#3764)Packaging
LANG=C(#3768)Parser
Performance
IPythonin a case where we wouldn't need it (#3748)Output
Blackd
blackdargument parser now shows the default values for options in their helptext (#3712)
Integrations
PYTHONWARNDEFAULTENCODING = 1(#3763)
Documentation
cite this software (#3723)
the latest code base (#3755)
v23.3.0Compare Source
Highlights
This release fixes a longstanding confusing behavior in Black's GitHub action, where the
version of the action did not determine the version of Black being run (issue #3382). In
addition, there is a small bug fix around imports and a number of improvements to the
preview style.
Please try out the
preview style
with
black --previewand tell us your feedback. All changes in the preview style areexpected to become part of Black's stable style in January 2024.
Stable style
# fmt: skipand# fmt: offno longer have an extra blank lineadded when they are right after another import line (#3610)
Preview style
entry (#3393)
async def,async for, andasync withstatements are now formatted consistentlycompared to their non-async version. (#3609)
withstatements that contain two context managers will be consistently wrapped inparentheses (#3589)
(#3445)
、U+3001IDEOGRAPHIC COMMA,
。U+3002 IDEOGRAPHIC FULL STOP, &，U+FF0C FULLWIDTH COMMA)besides before spaces (#3445)
...(#3564)Parser
Integrations
version input is not specified (#3543)
Documentation
vulnerabilities should be reported through Tidelift (#3612)
v23.1.0Compare Source
Highlights
This is the first release of 2023, and following our
stability policy,
it comes with a number of improvements to our stable style, including improvements to
empty line handling, removal of redundant parentheses in several contexts, and output
that highlights implicitly concatenated strings better.
There are also many changes to the preview style; try out
black --previewand give usfeedback to help us set the stable style for next year.
In addition to style changes, Black now automatically infers the supported Python
versions from your
pyproject.tomlfile, removing the need to set Black's targetversions separately.
Stable style
preview style (#3418). Specific changes:
(#3302) (22.12.0)
present) or as a single newline character (if a newline is present) (#3348)
(22.12.0)
parentheses (#3307) (22.12.0)
(#3370) (22.12.0)
--skip-string-normalization/-Snow prevents docstring prefixes from beingnormalized as expected (#3168) (since 22.8.0)
--skip-magic-trailing-commaor-C, trailing commas are stripped fromsubscript expressions with more than 1 element (#3209) (22.8.0)
parentheses (#3162) (22.8.0)
implicitly concatenated strings on its own line (#3227) (22.8.0)
(#3044, #3430) (22.6.0)
withstatements (#2926) (22.6.0)#%%are now standardised to# %%(#2919) (22.3.0)exceptstatements (#2939) (22.3.0)forloops (#2945) (22.3.0)# fmt: offand# fmt: on(#3439)Preview style
if-elseexpressions (#2278)and except clauses (#3423)
regular and f-strings start with an empty span (#3463)
before a dict's value (#3469)
# fmt: skipapplied or there is a standalone comment between decorators (#3470)
too long (#3430)
unnecessary parentheses around short values in dict literals are now removed; long
string lambda values are now wrapped in parentheses (#3440)
return type annotation is stringified and spans across multiple lines (#3462)
withstatementsor tuples (#3473)
code. Implicitly concatenated f-strings with different quotes can now be merged or
quote-normalized by changing the quotes used in expressions. (#3509)
await (yield)when Black is compiled with mypyc (#3533)Configuration
--target-versionfrom the project metadata specified inpyproject.toml(#3219)Packaging
0.971to0.991so mypycified Black can be built on armv7(#3380)
CPython
tomlirequirement on 3.11 alpha releases, workingaround a bug that would cause the requirement not to be installed on any non-final
Python releases (#3448)
packagingversion22.0or later. This is required for newfunctionality that needs to parse part of the project metadata (#3219)
Output
black --helpmultiple times will return the same help contents each time(#3516)
pyproject.tomlconfiguration variables(#3392)
relative path to the project root (#3385)
Integrations
latest_prereleasetag automation to follow latest black alpharelease on docker images (#3465)
Documentation
vim-pluginstallation instructions to offer more explicit options (#3468)v22.12.0Compare Source
Preview style
present) or as a single newline character (if a newline is present) (#3348)
parentheses (#3307)
fits on a single line (#3368)
(#3370)
Configuration
.gitignorerules by considering the.gitignorelocationand the relative path to the target file (#3338)
.gitignorepresence when more than one source directory isspecified (#3336)
Parser
passed as function args (for example,
any(match := my_re.match(text) for text in texts)) (#3327).Integrations
let g:black_use_virtualenv = 0(#3309)v22.10.0Compare Source
Highlights
supported until further notice.
Stable style
# fmt: onis used on a different block level than# fmt: off(#3281)
Preview style
(#3262)
Configuration
.ipynb_checkpointsdirectories are now excluded by default (#3293)--skip-source-first-line/-xoption to ignore the first line of source codewhile formatting (#3299)
Packaging
at once on macOS. Native x86-64 executables for macOS are available once again.
(#3275)
who install Black with its wheels from PyPI. (#3233)
Blackd
Integrations
g:black_preview) to enable/disable the preview style (#3246)jupyteroption (#3282)
<23) for Blackversion (#3265)
Configuration
📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.