fix(deps): update dependency black to v26 [security] - #312
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Copy link
Copy Markdown
Contributor
Author
⚠️ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: poetry.lockUpdating dependencies
Resolving dependencies...
The current project's supported Python range (>=3.9,<3.12) is not compatible with some of the required packages Python requirement:
- black requires Python >=3.10, so it will not be installable for Python >=3.9,<3.10
- black requires Python >=3.10, so it will not be installable for Python >=3.9,<3.10
Because no versions of black match >26.3,<26.3.1 || >26.3.1,<26.4
and black (26.3.0) requires Python >=3.10, black is forbidden.
So, because black (26.3.1) requires Python >=3.10
and ni-python-styleguide depends on black (>=26.3,<26.4), version solving failed.
* Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties
For black, a possible solution would be to set the `python` property to ">=3.10,<3.12"
For black, a possible solution would be to set the `python` property to ">=3.10,<3.12"
https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
https://python-poetry.org/docs/dependency-specification/#using-environment-markers
|
Sorry, something went wrong.
renovate
Bot
requested review from
bkeryan,
mshafer-NI and
neilvana
as code owners
July 7, 2026 22:49
Copy link
Copy Markdown
Contributor
|
Thank you for contributing! 👋 |
Sorry, something went wrong.
renovate
Bot
force-pushed
the
users/renovate/pypi-black-vulnerability
branch
4 times, most recently
from
bcc774f to
39ba656
Compare
July 17, 2026 21:49
renovate
Bot
force-pushed
the
users/renovate/pypi-black-vulnerability
branch
from
39ba656 to
0d21555
Compare
August 3, 2026 12:20
renovate
Bot
force-pushed
the
users/renovate/pypi-black-vulnerability
branch
from
0d21555 to
c8e8a47
Compare
August 10, 2026 18:03
renovate
Bot
force-pushed
the
users/renovate/pypi-black-vulnerability
branch
3 times, most recently
from
a53a18a to
5e9fac4
Compare
August 24, 2026 17:29
renovate
Bot
force-pushed
the
users/renovate/pypi-black-vulnerability
branch
from
5e9fac4 to
42c9253
Compare
August 24, 2026 20:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
At least 1 approving review is required to merge this pull request.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
Black: Arbitrary file writes from unsanitized user input in cache file name
CVE-2026-32274 / GHSA-3936-cmfr-pm3m
More informationDetails
Impact
Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.
Patches
Fixed in Black 26.3.1.
Workarounds
Do not allow untrusted user input into the value of the --python-cell-magics option.
Severity
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
CVE-2026-31900 / GHSA-v53h-f6m7-xcgm / PYSEC-2026-2120
More informationDetails
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.
Severity
References
This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).
Black: Arbitrary file writes from unsanitized user input in cache file name
CVE-2026-32274 / GHSA-3936-cmfr-pm3m / PYSEC-2026-2121
More informationDetails
Impact
Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.
Patches
Fixed in Black 26.3.1.
Workarounds
Do not allow untrusted user input into the value of the --python-cell-magics option.
Severity
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
CVE-2026-32274 / GHSA-3936-cmfr-pm3m / PYSEC-2026-2121
More informationDetails
Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
Severity
References
This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).
Release Notes
psf/black (black)v26.3.1
Compare Source
Stable style
exact-length placeholders for short magics and aborting if a placeholder can no longer
be unmasked safely (#5038)
Configuration
magic names cannot affect cache paths (#5038)
Blackd
and request body limits, and bound executor submissions to improve backpressure
(#5039)
v26.3.0
Compare Source
Stable style
comments on the same line, preventing AST equivalence failures (#4888)
Preview style
a trailing comma (#4884)
commas (one-item tuples) (#4929)
Packaging
frozen environments (#4930)
Performance
(#4996)
installation and creation of either a uvloop/winloop eventloop or default eventloop
(#4996)
Output
version, since AST safety checks cannot parse newer syntax. Also replace the
misleading "INTERNAL ERROR" message with an actionable error explaining the version
mismatch (#4983)
Blackd
windows when winloop is installed. (#4996)
Integrations
enabled so that only version specifiers are accepted and direct references such as
black @ https://... are rejected. Users should upgrade to the latest version of the
action as soon as possible. This update is received automatically when using
psf/black@stable, and is independent of the version of Black installed by the
action. (#5031)
Documentation
simplify_power_operator_hugging, and wrap_long_dict_values_in_parens features
(#4987)
v26.1.0
Compare Source
Highlights
Introduces the 2026 stable style (#4892), stabilizing the following changes:
statements, except when the line after the import is a comment or an import statement
(#4489)
such as def foo(): return "mock" # fmt: skip, where previously the declaration would
have been incorrectly collapsed (#4800)
strings if preceded by comments (#4764)
(#1879)
normalize file newlines both from and to (#4710)
types in except and except* without as (#4720)
side of assignments while preserving magic trailing commas and intentional multiline
formatting (#4865)
between # and type: or between type: and value to # type: (value) (#4645)
The following change was not in any previous stable release:
This release alo bumps pathspec to v1 and fixes inconsistencies with Git's
.gitignore logic (#4958). Now, files will be ignored if a pattern matches them, even
if the parent directory is directly unignored. For example, Black would previously
format exclude/not_this/foo.py with this .gitignore:
Now, exclude/not_this/foo.py will remain ignored. To ensure exclude/not_this/ and
all of it's children are included in formatting (and in Git), use this .gitignore:
This new behavior matches Git. The leading */ are only necessary if you wish to ignore
matching subdirectories (like the previous behavior did), and not just matching root
directories.
Output
Integrations
v25.12.0
Compare Source
Highlights
Stable style
removed, particularly affecting Jupytext's # %% [markdown] comments (#4845)
string literals, or on dictionary entries with long lines (#4872)
Preview style
magic trailing commas and intentional multiline formatting (#4865)
Packaging
Integrations
file for artifact capture and log cleanliness (#4824)
Configuration
📅 Schedule: (in timezone US/Central)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.