⬆️(project) upgrade black to v24 [SECURITY] #793
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/pypi-black-vulnerability
branch
from
6cd74eb
to
9cd26b6
Compare
renovate
bot
force-pushed
the
renovate/pypi-black-vulnerability
branch
from
9cd26b6
to
a772dff
Compare
renovate
bot
force-pushed
the
renovate/pypi-black-vulnerability
branch
from
a772dff
to
d606838
Compare
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | pypi | black | 23.1.0 | 24.3.0 |
renovate
bot
force-pushed
the
renovate/pypi-black-vulnerability
branch
from
d606838
to
3480b82
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==23.1.0->==24.3.0GitHub Vulnerability Alerts
CVE-2024-21503
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Release Notes
psf/black (black)
v24.3.0Compare Source
Highlights
This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
(#4273)
Performance
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
--checkis used with--quiet(#4236)v24.2.0Compare Source
Stable style
(#4218)
Preview style
hug_parens_with_braces_and_square_bracketsfeature to the unstable styledue to an outstanding crash and proposed formatting tweaks (#4198)
expression (#4154)
(#4185)
casestatementifguards (#4214).Configuration
pyproject.tomlthat is missing atool.blacksection whendiscovering project root and configuration. Since Black continues to use version
control as an indicator of project root, this is expected to primarily change behavior
for users in a monorepo setup (desirably). If you wish to preserve previous behavior,
simply add an empty
[tool.black]to the previously discoveredpyproject.toml(#4204)
Output
SyntaxWarnings orDeprecationWarnings produced by theastmodule when performing equivalence checks (#4189)
Integrations
v24.1.1Compare Source
Bugfix release to fix a bug that made Black unusable on certain file systems with strict
limits on path length.
Preview style
Configuration
do not support long paths (#4176)
v24.1.0Compare Source
Highlights
This release introduces the new 2024 stable style (#4106), stabilizing the following
changes:
if-elseexpressions (#2278)...are formatted morecompactly (#3796)
(#3368)
withstatement(#3489)
entry (#3393)
--skip-magic-trailing-commaor-C, trailing commas are stripped fromsubscript expressions with more than 1 element (#3209)
# fmt: skipwith other comments (#3959)There are already a few improvements in the
--previewstyle, which are slated for the2025 stable style. Try them out and
share your feedback. In the past, the preview
style has included some features that we were not able to stabilize. This year, we're
adding a separate
--unstablestyle for features with known problems. Now, the--previewstyle only includes features that we actually expect to make it into nextyear's stable style.
Stable style
Several bug fixes were made in features that are moved to the stable style in this
release:
unlike other binary operators (#4109)
blocks, except immediately before a docstring (#4130)
Preview style
--unstablestyle, covering preview features that have known problems that wouldblock them from going into the stable style. Also add the
--enable-unstable-featureflag; for example, use
--enable-unstable-feature hug_parens_with_braces_and_square_bracketsto apply thispreview feature throughout 2024, even if a later Black release downgrades the feature
to unstable (#4096)
# fmt: skipcomments (#4146)Configuration
pyproject.tomlcontains an invalid key (#4165)--experimental-string-processingflag. This feature cancurrently be enabled with
--preview --enable-unstable-feature string_processing.(#4096)
Integrations
(#3940) for better compatibility with older versions of pre-commit (#4137)
v23.12.1Compare Source
Packaging
dextra by default (#4108)v23.12.0Compare Source
Highlights
It's almost 2024, which means it's time for a new edition of Black's stable style!
Together with this release, we'll put out an alpha release 24.1a1 showcasing the draft
2024 stable style, which we'll finalize in the January release. Please try it out and
share your feedback.
This release (23.12.0) will still produce the 2023 style. Most but not all of the
changes in
--previewmode will be in the 2024 stable style.Stable style
# fmt: offautomatically dedents when used with the--line-rangesoption, even when it is not within the specified line range. (#4084)
Preview style
indented less (#4012)
docstring (#4060)
--line-length(#4086)functions or class definitions (#4066) (#4103)
Configuration
--line-rangesnow skips Black's internal stability check in--safemode. Thisavoids a crash on rare inputs that have many unformatted same-content lines. (#4034)
Packaging
Integrations
v23.11.0Compare Source
Highlights
--line-rangescommand-line option(#4020)
Stable style
await (a ** b)(#3994)fixes a crash (#4019)
Preview style
less (#3964)
indented less (#3992)
now preserved (#4005)
caseblocks were not split into multiple lines. Also enablegeneral trailing comma rules on
caseblocks (#4024)class definition (#4028)
Configuration
--include(#3976)Performance
Integrations
formatter (#3940)
v23.10.1Compare Source
Highlights
Preview style
Packaging
Integrations
summaryparameter. (#3958)
Documentation
https://github.com/psf/black/issues/39683968
v23.10.0Compare Source
Stable style
Preview style
multiple lines (#3899)
Configuration
BLACK_CACHE_DIRis set (#3937)Parser
typewere not accepted insidematchstatements(#3950)
(#3949)
Output
code (#3933)
(#3938)
Integrations
v23.9.1Compare Source
Due to various issues, the previous release (23.9.0) did not include compiled mypyc
wheels, which make Black significantly faster. These issues have now been fixed, and
this release should come with compiled wheels once again.
There will be no wheels for Python 3.12 due to a bug in mypyc. We will provide 3.12
wheels in a future release as soon as the mypyc bug is fixed.
Packaging
Performance
decreasing the size of the cache (#3877)
v23.9.0Compare Source
Preview style
if sys.version_info > (3, x):) and a function definition on the same level (#3862)Configuration
Performance
IPythonif notebook cells do not contain magics (#3782)Blackd
blackdwith single character input (#3558)Integrations
official pre-commit mirror. Swapping
https://github.com/psf/blacktohttps://github.com/psf/black-pre-commit-mirrorinyour
.pre-commit-config.yamlwill make Black about 2x faster (#3828).black.envfolder specified byENV_PATHwill now be removed on the completionof the GitHub Action (#3759)
v23.7.0Compare Source
Highlights
supported until further notice (#3765)
Stable style
PEP 604 unions (#3735)
under some circumstances (#3745)
type: ignorewithin parentheses(#3740)
(#3773)
Preview style
parentheses (#3640)
Configuration
--workersargument to Black can now be specified via theBLACK_NUM_WORKERSenvironment variable (#3743)
.pytest_cache,.ruff_cacheand.vscodeare now excluded by default (#3691)pyproject.tomlsettings when running--stdin-filenameand the
pyproject.tomlfound isn't in the current working directory (#3719)excludeandextend-excludehave invalid data types inpyproject.toml, instead of silently doing the wrong thing (#3764)Packaging
LANG=C(#3768)Parser
Performance
IPythonin a case where we wouldn't need it (#3748)Output
Blackd
blackdargument parser now shows the default values for options in their helptext (#3712)
Integrations
PYTHONWARNDEFAULTENCODING = 1(#3763)
Documentation
cite this software (#3723)
the latest code base (#3755)
v23.3.0Compare Source
Highlights
This release fixes a longstanding confusing behavior in Black's GitHub action, where the
version of the action did not determine the version of Black being run (issue #3382). In
addition, there is a small bug fix around imports and a number of improvements to the
preview style.
Please try out the
preview style
with
black --previewand tell us your feedback. All changes in the preview style areexpected to become part of Black's stable style in January 2024.
Stable style
# fmt: skipand# fmt: offno longer have an extra blank lineadded when they are right after another import line (#3610)
Preview style
entry (#3393)
async def,async for, andasync withstatements are now formatted consistentlycompared to their non-async version. (#3609)
withstatements that contain two context managers will be consistently wrapped inparentheses (#3589)
(#3445)
、U+3001IDEOGRAPHIC COMMA,
。U+3002 IDEOGRAPHIC FULL STOP, &，U+FF0C FULLWIDTH COMMA)besides before spaces (#3445)
...(#3564)Parser
Integrations
version input is not specified (#3543)
Documentation
vulnerabilities should be reported through Tidelift (#3612)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.