-
Notifications
You must be signed in to change notification settings - Fork 0
Update dependency black to v24 [SECURITY] #14
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
renovate
wants to merge
1
commit into
main
Choose a base branch
from
renovate/pypi-black-vulnerability
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
d39683b
to
f3f95e5
Compare
243337c
to
a5ad8cc
Compare
a796cb5
to
2c71045
Compare
060631a
to
aae382d
Compare
49ab3a3
to
24a08e1
Compare
da2ff4a
to
71caa7b
Compare
475dd64
to
5c0b016
Compare
985fe7d
to
1cf406e
Compare
b0672c3
to
6d39f74
Compare
6d39f74
to
1c4dd44
Compare
13542f3
to
a28202f
Compare
a28202f
to
fa93dfc
Compare
c21df39
to
55afa47
Compare
ffb8ee8
to
bce424f
Compare
bce424f
to
9f474ab
Compare
9f474ab
to
13ff0d9
Compare
13ff0d9
to
3351cb3
Compare
3351cb3
to
a745468
Compare
a745468
to
3cef0f3
Compare
3cef0f3
to
4f1cbe8
Compare
4f1cbe8
to
1ae0b2f
Compare
e249c7d
to
f419007
Compare
f419007
to
923d740
Compare
923d740
to
2b2716b
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^23.1
->^24.3.0
GitHub Vulnerability Alerts
CVE-2024-21503
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Release Notes
psf/black (black)
v24.3.0
Compare Source
Highlights
This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
(#4273)
Performance
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
--check
is used with--quiet
(#4236)v24.2.0
Compare Source
Stable style
(#4218)
Preview style
hug_parens_with_braces_and_square_brackets
feature to the unstable styledue to an outstanding crash and proposed formatting tweaks (#4198)
expression (#4154)
(#4185)
case
statementif
guards (#4214).Configuration
pyproject.toml
that is missing atool.black
section whendiscovering project root and configuration. Since Black continues to use version
control as an indicator of project root, this is expected to primarily change behavior
for users in a monorepo setup (desirably). If you wish to preserve previous behavior,
simply add an empty
[tool.black]
to the previously discoveredpyproject.toml
(#4204)
Output
SyntaxWarning
s orDeprecationWarning
s produced by theast
module when performing equivalence checks (#4189)
Integrations
v24.1.1
Compare Source
Bugfix release to fix a bug that made Black unusable on certain file systems with strict
limits on path length.
Preview style
Configuration
do not support long paths (#4176)
v24.1.0
Compare Source
Highlights
This release introduces the new 2024 stable style (#4106), stabilizing the following
changes:
if
-else
expressions (#2278)...
are formatted morecompactly (#3796)
(#3368)
with
statement(#3489)
entry (#3393)
--skip-magic-trailing-comma
or-C
, trailing commas are stripped fromsubscript expressions with more than 1 element (#3209)
# fmt: skip
with other comments (#3959)There are already a few improvements in the
--preview
style, which are slated for the2025 stable style. Try them out and
share your feedback. In the past, the preview
style has included some features that we were not able to stabilize. This year, we're
adding a separate
--unstable
style for features with known problems. Now, the--preview
style only includes features that we actually expect to make it into nextyear's stable style.
Stable style
Several bug fixes were made in features that are moved to the stable style in this
release:
unlike other binary operators (#4109)
blocks, except immediately before a docstring (#4130)
Preview style
--unstable
style, covering preview features that have known problems that wouldblock them from going into the stable style. Also add the
--enable-unstable-feature
flag; for example, use
--enable-unstable-feature hug_parens_with_braces_and_square_brackets
to apply thispreview feature throughout 2024, even if a later Black release downgrades the feature
to unstable (#4096)
# fmt: skip
comments (#4146)Configuration
pyproject.toml
contains an invalid key (#4165)--experimental-string-processing
flag. This feature cancurrently be enabled with
--preview --enable-unstable-feature string_processing
.(#4096)
Integrations
(#3940) for better compatibility with older versions of pre-commit (#4137)
v23.12.1
Compare Source
Packaging
d
extra by default (#4108)v23.12.0
Compare Source
Highlights
It's almost 2024, which means it's time for a new edition of Black's stable style!
Together with this release, we'll put out an alpha release 24.1a1 showcasing the draft
2024 stable style, which we'll finalize in the January release. Please try it out and
share your feedback.
This release (23.12.0) will still produce the 2023 style. Most but not all of the
changes in
--preview
mode will be in the 2024 stable style.Stable style
# fmt: off
automatically dedents when used with the--line-ranges
option, even when it is not within the specified line range. (#4084)
Preview style
indented less (#4012)
docstring (#4060)
--line-length
(#4086)functions or class definitions (#4066) (#4103)
Configuration
--line-ranges
now skips Black's internal stability check in--safe
mode. Thisavoids a crash on rare inputs that have many unformatted same-content lines. (#4034)
Packaging
Integrations
v23.11.0
Compare Source
Highlights
--line-ranges
command-line option(#4020)
Stable style
await (a ** b)
(#3994)fixes a crash (#4019)
Preview style
less (#3964)
indented less (#3992)
now preserved (#4005)
case
blocks were not split into multiple lines. Also enablegeneral trailing comma rules on
case
blocks (#4024)class definition (#4028)
Configuration
--include
(#3976)Performance
Integrations
formatter (#3940)
v23.10.1
Compare Source
Highlights
Preview style
Packaging
Integrations
summary
parameter. (#3958)
Documentation
https://github.com/psf/black/issues/39683968
v23.10.0
Compare Source
Stable style
Preview style
multiple lines (#3899)
Configuration
BLACK_CACHE_DIR
is set (#3937)Parser
type
were not accepted insidematch
statements(#3950)
(#3949)
Output
code (#3933)
(#3938)
Integrations
v23.9.1
Compare Source
Due to various issues, the previous release (23.9.0) did not include compiled mypyc
wheels, which make Black significantly faster. These issues have now been fixed, and
this release should come with compiled wheels once again.
There will be no wheels for Python 3.12 due to a bug in mypyc. We will provide 3.12
wheels in a future release as soon as the mypyc bug is fixed.
Packaging
Performance
decreasing the size of the cache (#3877)
v23.9.0
Compare Source
Preview style
if sys.version_info > (3, x):
) and a function definition on the same level (#3862)Configuration
Performance
IPython
if notebook cells do not contain magics (#3782)Blackd
blackd
with single character input (#3558)Integrations
official pre-commit mirror. Swapping
https://github.com/psf/black
tohttps://github.com/psf/black-pre-commit-mirror
inyour
.pre-commit-config.yaml
will make Black about 2x faster (#3828).black.env
folder specified byENV_PATH
will now be removed on the completionof the GitHub Action (#3759)
v23.7.0
Compare Source
Highlights
supported until further notice (#3765)
Stable style
PEP 604 unions (#3735)
under some circumstances (#3745)
type: ignore
within parentheses(#3740)
(#3773)
Preview style
parentheses (#3640)
Configuration
--workers
argument to Black can now be specified via theBLACK_NUM_WORKERS
environment variable (#3743)
.pytest_cache
,.ruff_cache
and.vscode
are now excluded by default (#3691)pyproject.toml
settings when running--stdin-filename
and the
pyproject.toml
found isn't in the current working directory (#3719)exclude
andextend-exclude
have invalid data types inpyproject.toml
, instead of silently doing the wrong thing (#3764)Packaging
LANG=C
(#3768)Parser
Performance
IPython
in a case where we wouldn't need it (#3748)Output
Blackd
blackd
argument parser now shows the default values for options in their helptext (#3712)
Integrations
PYTHONWARNDEFAULTENCODING = 1
(#3763)
Documentation
cite this software (#3723)
the latest code base (#3755)
v23.3.0
Compare Source
Highlights
This release fixes a longstanding confusing behavior in Black's GitHub action, where the
version of the action did not determine the version of Black being run (issue #3382). In
addition, there is a small bug fix around imports and a number of improvements to the
preview style.
Please try out the
preview style
with
black --preview
and tell us your feedback. All changes in the preview style areexpected to become part of Black's stable style in January 2024.
Stable style
# fmt: skip
and# fmt: off
no longer have an extra blank lineadded when they are right after another import line (#3610)
Preview style
entry (#3393)
async def
,async for
, andasync with
statements are now formatted consistentlycompared to their non-async version. (#3609)
with
statements that contain two context managers will be consistently wrapped inparentheses (#3589)
(#3445)
、
U+3001IDEOGRAPHIC COMMA,
。
U+3002 IDEOGRAPHIC FULL STOP, &,
U+FF0C FULLWIDTH COMMA)besides before spaces (#3445)
...
(#3564)Parser
Integrations
version input is not specified (#3543)
Documentation
vulnerabilities should be reported through Tidelift (#3612)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.