Update dependency black to v26 [SECURITY] by renovate[bot] · Pull Request #1350 · ni/measurement-plugin-python

renovate · 2026-11-04T19:46:20Z

This PR contains the following updates:

Package	Change	Age	Confidence
black (changelog)	`25.12.0` → `26.10.1`

Black: Arbitrary file writes from unsanitized user input in cache file name

CVE-2026-32274 / GHSA-3936-cmfr-pm3m

More information

Details

Impact

Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.

Patches

Fixed in Black 26.3.1.

Workarounds

Do not allow untrusted user input into the value of the --python-cell-magics option.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Black: GitHub Action installs unvalidated required-version from pyproject.toml

CVE-2026-114134 / GHSA-cg8m-r9f2-5wm2

More information

Details

Summary

The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.

Details

This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation.

Proof of concept

Reproduction requires a victim to use Black's GitHub Action with use_pyproject: true. The attacker would then issue a PR to the victim's repository with pyproject.toml edited so that Black points to a malicious repository.

Impact

This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the use_pyproject: true setting.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

CVE-2026-31900 / GHSA-v53h-f6m7-xcgm / PYSEC-2026-2120

More information

Details

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Black: Arbitrary file writes from unsanitized user input in cache file name

CVE-2026-32274 / GHSA-3936-cmfr-pm3m / PYSEC-2026-2121

More information

Details

Impact

Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.

Patches

Fixed in Black 26.3.1.

Workarounds

Do not allow untrusted user input into the value of the --python-cell-magics option.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

CVE-2026-32274 / GHSA-3936-cmfr-pm3m / PYSEC-2026-2121

More information

Details

Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Black: GitHub Action installs unvalidated required-version from pyproject.toml

CVE-2026-114134 / GHSA-cg8m-r9f2-5wm2

More information

Details

Summary

The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.

Details

This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation.

Proof of concept

Reproduction requires a victim to use Black's GitHub Action with use_pyproject: true. The attacker would then issue a PR to the victim's repository with pyproject.toml edited so that Black points to a malicious repository.

Impact

This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the use_pyproject: true setting.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

psf/black (black)

`v26.10.1`

Compare Source

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that
use the action are encouraged to update to the latest version of Black immediately. This
update is received automatically when using psf/black@stable, and is independent of
the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it
now only accepts released versions of Black, as it already did for black requirements
in dependency lists. Other values, such as URL references, are now rejected. This issue
has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped
in parentheses, which IPython can no longer run; such cells are now left unchanged
(#5481)
Keep repeated lines outside the selected --line-ranges unchanged (#5436)
Fix --line-ranges formatting lines that follow a statement when formatting joins or
re-indents that statement (#5484)
Fix --line-ranges crashing with an internal error when an unselected statement has a
# fmt: skip comment on the last line before a closing bracket (#5477)
Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto
the first two lines of a file (#5487)
Fix adding an extra trailing blank line inside a multi-line module docstring when its
last line is near the line length limit (#5494)
Preserve blank lines between imports and unselected statements when using
--line-ranges, and ensure a blank line is added between an unselected import and a
newly formatted statement (#5493, #5649)
Keep the parentheses around a walrus that is the only item in a set (for example
{(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't
parse it without them (#5502)

Preview style

Do not split short expressions on delimiters (such as binary operators, comparisons,
or comprehensions) inside brackets when preceded by a standalone comment (#5455)
Fix the unstable string_processing feature removing backslash-newline sequences from
raw strings, which changed their value (#5482)
Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in
assignments (such as annotated assignments or subscript targets) (#5473)
Parenthesize expressions with parameter comments when they exceed the line length
under --preview (#5442)
Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand
side that contains a dictionary, leaving a line over the length limit (#5492)
Fix the unstable string_processing feature adding a space after * or ** in a PEP
695 type parameter (* Ts = ...) when it splits a string in the parameter's default
(#5504)
Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an
earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

Add --cache-dir to configure the cache directory from the command line (#5433)
Don't cache a file as formatted after formatting or checking it with --line-ranges,
which made a later full black --check pass and black skip the unformatted lines
(#5476)
Respect a .gitignore that starts with a UTF-8 byte order mark. The mark became part
of the first pattern, so that pattern never matched and Black formatted files that git
ignores (#5497)

Performance

Avoid quadratic runtime when splitting very long lines with many trailing bracket
pairs (such as consecutive subscripts) (#5475)

Integrations

Fix the GitHub Action crashing on dependency-group includes when use_pyproject is
enabled (#5479)
When the GitHub Action reads version specifiers from tool.black.required-version, it
now only accepts released versions of Black, as it already did for black
requirements in dependency lists. Other values, such as URL references, are now
rejected. (#5510)

`v26.10.0`

Compare Source

Stable style

--line-ranges no longer inserts an empty line after a docstring when the range
covers only the docstring itself (#5312)
Fix # fmt: skip on a bracketed ternary turning the surrounding tuple into a call
(#5464)
Fix crash when # fmt: skip is placed on a one-line function or class with PEP 695
type parameters (#5429)
Fix an inline comment after the closing bracket of optional parentheses being moved
inside the parentheses when the parenthesized expression contains own-line comments
(#5395)
Fix unparseable output when # fmt: skip is placed on a bracket of an if, while,
for, or with header (#5401, #5405)
Fix crash when formatting parenthesized expressions with multiple inline comments and
# fmt: skip (#5414)
Fix parsing Jupyter notebook assignment magics when non-ASCII characters appear
earlier on the line (#5381)
Preserve blank lines that come immediately before a # fmt: on comment (#5300)
Keep the parentheses around the target of an annotated assignment (e.g.
(x): int = 5), which prevent CPython from including the name in __annotations__
(#5321)
Stop treating a t-string in docstring position as a docstring (e.g. t" spam " as
the first statement of a module, class or function) (#5287)
Fix unparseable output for a t-string whose replacement field contains a quote (e.g.
t'\'{a["b"]}\'') (#5265)
Fix unparseable output for a triple-quoted string whose body ends in an
already-escaped double quote (e.g. '''\'''\"''') (#5262)
Fix --skip-magic-trailing-comma dropping the trailing comma from a split
single-element tuple used as a lambda parameter default (#5246)
Fix unstable formatting when an inline comment sits on optional parentheses (e.g. a
parenthesized assert message) (#5241)
Fix --skip-magic-trailing-comma dropping the trailing comma of a one-element
subscript (a[x,]) when the line is long enough to be split and contains a power
operator (#5272)
Fix crash when a standalone comment sits between tokens of a comprehension or lambda
(#5144)
Fix inline comments on a bracket inside a comprehension being dropped (#5330)
Respect the magic trailing comma in a PEP 695 type parameter list containing a
*TypeVarTuple or **ParamSpec (#5244)
Fix crash when a comment-only # fmt: off/# fmt: on block is followed by a with
statement after another standalone comment (#5189)
Fix a crash when splitting case case if ... match patterns at very small line
lengths (#5147)
Fix multiline docstring indentation when leading tabs are used inside indented
docstrings (#5148)
Respect # fmt: skip on a line that opens a bracket (e.g.
from x import ( # fmt: skip) when a standalone comment is among the bracket's
contents (#5161)
Fix an AST safety error when separate # type: ignore comments in a parenthesized
attribute chain were merged onto one physical line (#5297)
Preserve comments and blank lines outside requested ranges when formatting with
--line-ranges (#5175)
Fix crash when # fmt: skip is used on one-line async def, async with, and
async for statements containing a semicolon (#5311)
Stop converting form feeds or other similar characters in docstrings into newlines
(#5461)
Fix --skip-source-first-line turning the skipped line's CRLF ending into \r\r\n
when reformatting a file with CRLF line endings (#5438)

Preview style

New preview features

Add missing blank lines after classes whose last method has an ellipsis body (#5439)
Split only the brackets holding a magic trailing comma when more trailers follow them
(e.g. stop splitting inside the [2] of [1,][2](3)) (#5448)
Keep dictionary keys containing operators together on one line when the value can be
wrapped onto a new line instead (#5435)
Remove redundant parentheses around individual variables in unpacking targets (e.g.
for (x), (y) in points: becomes for x, y in points:) (#5416)
Normalize uppercase T prefixes on t-strings to lowercase (#5425)
Remove redundant parentheses around generator expressions (#5304, #5369)
Preserve two blank lines before a top-level class starting inside a # fmt: off block
after an import (#5238)
Fix unnecessary parentheses around short right-hand expressions in indexed assignments
(e.g. x[key] = expr) (#5095)
Parenthesize tuple expressions in yield statements for consistency with function
calls and returns (#5170)
Stop splitting between a variable and its operator (not in, ==, is, ...) when
the right-hand side is a bracketed expression, and instead split inside the brackets
(#5135)
In .pyi stub files, enforce a blank line after a function or method that has a
docstring-only body when another comment or statement follows it (#5158)

Updates to existing preview features

Fix crash in stub files when # fmt: skip is placed on a function in a group of
same-name decorated functions (e.g. @overloads or a property setter) (#5430)
Keep the parentheses around a lambda used as the iterable of a comprehension (e.g.
[x for x in (lambda: 0) if x]) (#5176, #5200)

Updates to existing unstable features

Do not treat multi-line expressions with merged strings and trailing # type: ignore
comments as single-line unsplittable expressions (#5466)
Fix duplicated inline comment when stripping the parentheses around a string or
merging a backslash-continued string on the same line (#5449)
Split long stringified return annotations even when the function has parameters
(#5427)
Don't hug brackets when doing so would join two # type: ignore comments onto one
line (#5271)
Fix a crash when # type: ignore is lost during formatting of a long parenthesized
string (#5329)
Fix only the first part of an implicitly concatenated unmergeable string (e.g.
r"..." r"...") being wrapped in parentheses (#5434)

Configuration

Add support for NO_COLOR environment variable to disable ANSI output (#5129)
Remove spurious target version warning when runtime version is included in a
--target-version flag (#5167)
Fix --force-exclude not excluding files whose path contains .. (e.g.
black ../generated/file.py run from a subdirectory) (#5471)
Fall back to the default configuration, with a warning, when the given sources share
no common project root (e.g. they are on different drives on Windows) instead of
crashing (#5386)
Fix loading a stale cached pyproject.toml path when --code is used from different
working directories in the same process (#5152)
Add validation for --line-ranges values (#5107)
Ignore empty cache files instead of raising an EOFError (#5192)
Reject non-string include and force-exclude values in pyproject.toml (#5193)
Validate BLACK_NUM_WORKERS values and report invalid values as usage errors instead
of crashing (#5211)
Ignore permission errors when reading cache (#5258)

Packaging

Reduce the size of Linux standalone binaries by stripping debug symbols during the
PyInstaller release build (#5223)
Black is now released using GitHub
Immutable Releases
(#5296)

Performance

Fix superlinear runtime growth with the number of input files (#5450)
Improve performance on strings containing many consecutive backslashes (#5163)
Improve performance on files with many # fmt: skip/# fmt: off/# fmt: on comments
(#5169, #5190, #5232)
Improve performance on long calls and collections (#5177)
Improve performance on multiline strings inside large collections (e.g. a dict literal
with triple-quoted strings as values) (#5188)
Improve performance on files with many soft keywords (e.g. match/case blocks)
(#5186)
Improve performance on long semicolon-separated statements (in the stable style) and
large dict literals (in --preview) (#5184)
Improve performance of --line-ranges on files with many sibling blocks (a long
if/elif chain, a match with many cases, or many top-level definitions) (#5213)
Improve performance on deeply nested bracketed expressions (#5171, #5242)
Improve performance on lists and subscripts holding one long expression without
operators (e.g. a long run of implicitly concatenated strings inside []) (#5239)
Improve performance on deeply chained operations (e.g. a long a ** b ** c ** ...
chain) (#5235)
Improve performance on long if/elif chains and other compound statements with many
clauses (#5322)
Improve performance of string_processing:
- when merging implicitly concatenated f-strings containing long string literals
  (#5165)
- when merging long implicitly concatenated strings (#5173, #5194)
- when rewriting large nodes (e.g. "%s ..." % (a, b, c, ...)) (#5178, #5199, #5220)
- when splitting long string literals (#5183)

Output

Report parser failures using editor-friendly path:line:column locations (#5237)
Fix crash when writing formatted code or diffs to a sys.stdout that has no buffer
attribute (e.g. in Jupyter notebooks) (#5411)
Report parse failures on Black's own output as internal errors (#5383)

Blackd

Return HTTP 400 instead of 500 when the X-Python-Variant header is empty or has an
empty entry (e.g. a trailing comma) (#5428)
Allow optional whitespace around comma-separated versions and pyi in the
X-Python-Variant header (#5441)

Integrations

Remove unused migrate-black script (#5319)
Support PEP 440 version specifiers in tool.black.required-version for the GitHub
Action (#5399)
Add outputs (is_formatted, change_count, same_count, failure_count) to GitHub
Action runs (#5408)

Documentation

Document vim-python-pep8-indent, which provides an indentexpr for Black-style
insert-mode indentation (#5288)

`v26.5.1`

Compare Source

Stable style

Fix unstable formatting of annotated assignments whose subscript annotation contains
an inline comment (e.g. x: list[ # pyright: ignore[...]) (#5130)
Preserve inline comments (including # type: ignore) immediately before a
# fmt: skip line, avoiding AST equivalence failures (#5139)

Packaging

Correct the version in the published executables (#5137)

Documentation

Add Neovim integration guide covering conform.nvim, ALE, and simple command approaches
(#5124)

`v26.5.0`

Compare Source

Highlights

Add support for unpacking in comprehensions (PEP 798) and for lazy imports (PEP 810),
both new syntactic features in Python 3.15 (#5048)
Python 3.15 is now supported. Compiled wheels are not yet provided for Python 3.15, so
performance may be slower than on existing Python versions. Wheels will be provided
once Python 3.15 is later in its release cycle. (#5127)

Stable style

Fix # fmt: skip being ignored in nested if expressions with parenthesized in
clauses (#4903)
Add syntactic support for Python 3.15 (#5048)
Fix crash when an f-string follows a # fmt: off comment inside brackets (#5097)
Preserve multiline compound statement headers when # fmt: skip is placed on the
colon line (#5117)

Preview style

Improve heuristics around whether blank lines should appear before, within and after
groups of same-name decorated functions (such as @overload groups) in .pyi stub
files (#5021)
Fix blank lines being removed between a function and a decorated class in .pyi stub
files (#5092)
Prevent string merger from creating unsplittable long lines when a pragma comment
(e.g. # type: ignore) follows the closing bracket (#5096)

Packaging

Run CI on 3.15 (#5127)

Output

Improve parse error readability by showing multi-line output with an error pointer.
(#5068)
Add SourceASTParseError to distinguish source parse failures from internal safety
errors, improving error reporting when Black's lenient parser accepts input that
ast.parse() rejects (#5080)

Blackd

Return HTTP 400 (Bad Request) for source parse failures instead of HTTP 500, keeping
HTTP 500 only for genuine internal safety errors (#5080)

Integrations

Added documentation for doctest formatting tools and updated the integrations index to
match (#4916)

Documentation

Use "Version X.Y.Z" headings in changelog for stable permalink anchors on ReadTheDocs
(#5063)
Note in the editor integrations that the SublimeText sublack plugin is archived and
unmaintained (#5082)

`v26.3.1`

Compare Source

Stable style

Prevent Jupyter notebook magic masking collisions from corrupting cells by using
exact-length placeholders for short magics and aborting if a placeholder can no longer
be unmasked safely (#5038)

Configuration

Always hash cache filename components derived from --python-cell-magics so custom
magic names cannot affect cache paths (#5038)

Blackd

Disable browser-originated requests by default, add configurable origin allowlisting
and request body limits, and bound executor submissions to improve backpressure
(#5039)

`v26.3.0`

Compare Source

Stable style

Don't double-decode input, causing non-UTF-8 files to be corrupted (#4964)
Fix crash on standalone comment in lambda default arguments (#4993)
Preserve parentheses when # type: ignore comments would be merged with other
comments on the same line, preventing AST equivalence failures (#4888)

Preview style

Fix bug where if guards in case blocks were incorrectly split when the pattern had
a trailing comma (#4884)
Fix string_processing crashing on unassigned long string literals with trailing
commas (one-item tuples) (#4929)
Simplify implementation of the power operator "hugging" logic (#4918)

Packaging

Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in
frozen environments (#4930)

Performance

Introduce winloop for windows as an alternative to uvloop (#4996)
Remove deprecated function uvloop.install() in favor of uvloop.new_event_loop()
(#4996)
Rename maybe_install_uvloop function to maybe_use_uvloop to simplify loop
installation and creation of either a uvloop/winloop eventloop or default eventloop
(#4996)

Output

Emit a clear warning when the target Python version is newer than the running Python
version, since AST safety checks cannot parse newer syntax. Also replace the
misleading "INTERNAL ERROR" message with an actionable error explaining the version
mismatch (#4983)

Blackd

Introduce winloop to be used when windows in use which enables blackd to run faster on
windows when winloop is installed. (#4996)

Integrations

Remove unused gallery script (#5030)
Harden parsing of black requirements in the GitHub Action when use_pyproject is
enabled so that only version specifiers are accepted and direct references such as
black @ https://... are rejected. Users should upgrade to the latest version of the
action as soon as possible. This update is received automatically when using
psf/black@stable, and is independent of the version of Black installed by the
action. (#5031)

Documentation

Expand preview style documentation with detailed examples for wrap_comprehension_in,
simplify_power_operator_hugging, and wrap_long_dict_values_in_parens features
(#4987)
Add detailed documentation for formatting Jupyter Notebooks (#5009)

`v26.1.0`

Compare Source

Highlights

Introduces the 2026 stable style (#4892), stabilizing the following changes:

always_one_newline_after_import: Always force one blank line after import
statements, except when the line after the import is a comment or an import statement
(#4489)
fix_fmt_skip_in_one_liners: Fix # fmt: skip behavior on one-liner declarations,
such as def foo(): return "mock" # fmt: skip, where previously the declaration would
have been incorrectly collapsed (#4800)
fix_module_docstring_detection: Fix module docstrings being treated as normal
strings if preceded by comments (#4764)
fix_type_expansion_split: Fix type expansions split in generic functions (#4777)
multiline_string_handling: Make expressions involving multiline strings more compact
(#1879)
normalize_cr_newlines: Add \r style newlines to the potential newlines to
normalize file newlines both from and to (#4710)
remove_parens_around_except_types: Remove parentheses around multiple exception
types in except and except* without as (#4720)
remove_parens_from_assignment_lhs: Remove unnecessary parentheses from the left-hand
side of assignments while preserving magic trailing commas and intentional multiline
formatting (#4865)
standardize_type_comments: Format type comments which have zero or more spaces
between # and type: or between type: and value to # type: (value) (#4645)

The following change was not in any previous stable release:

Regenerated the _width_table.py and added tests for the Khmer language (#4253)

This release also bumps pathspec to v1 and fixes inconsistencies with Git's
.gitignore logic (#4958). Now, files will be ignored if a pattern matches them, even
if the parent directory is directly unignored. For example, Black would previously
format exclude/not_this/foo.py with this .gitignore:

exclude/
!exclude/not_this/

Now, exclude/not_this/foo.py will remain ignored. To ensure exclude/not_this/ and
all of its children are included in formatting (and in Git), use this .gitignore:

*/exclude/*
!*/exclude/not_this/

This new behavior matches Git. The leading */ are only necessary if you wish to ignore
matching subdirectories (like the previous behavior did), and not just matching root
directories.

Output

Explicitly shutdown the multiprocessing manager when run in diff mode too (#4952)

Integrations

Upgraded PyPI upload workflow to use Trusted Publishing (#4611)

Configuration

📅 Schedule: (in timezone US/Central)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

bkeryan · 2026-11-04T19:59:55Z

 name = "ni-python-styleguide"
-version = "0.5.2"
+version = "0.4.7"


"Renovate, uhh, finds a way." --Dr. Ian Malcolm, Jurassic Park, probably

Downgrading ni-python-styleguide allows it to upgrade black.

@dixonjoel @mshafer-NI

Yeah, this was funny. I'm assuming we don't want to downgrade ni-python-styleguide to upgrade black? And we'll wait for 0.5.3?

0.6, since the next version of black changes formatting.

"[Poetry], uhhh, finds a way."

If you change this line to

measurement-plugin-python/packages/generator/pyproject.toml

Line 39 in 085b57f

ni-python-styleguide = ">=0.4.1"

to "^0.5.1", then poetry will not consider downgrading ni-python-styleguide to be a valid solution to "poetry upgrade black" (and will instead error telling Renovate, "I'm sorry, [Renovate]. I can't do that".

Result: #1353

Lint 1s Run poetry run ni-python-styleguide lint Traceback (most recent call last): File "/home/runner/work/measurement-plugin-python/measurement-plugin-python/packages/generator/.venv/lib/python3.11/site-packages/flake8/plugins/finder.py", line 296, in _load_plugin obj = plugin.entry_point.load() ^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/hostedtoolcache/Python/3.11.18/x64/lib/python3.11/importlib/metadata/__init__.py", line 202, in load module = import_module(match.group('module')) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/hostedtoolcache/Python/3.11.18/x64/lib/python3.11/importlib/__init__.py", line 126, in import_module return _bootstrap._gcd_import(name[level:], package, level) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "<frozen importlib._bootstrap>", line 1204, in _gcd_import File "<frozen importlib._bootstrap>", line 1176, in _find_and_load File "<frozen importlib._bootstrap>", line 1147, in _find_and_load_unlocked File "<frozen importlib._bootstrap>", line 690, in _load_unlocked File "<frozen importlib._bootstrap_external>", line 940, in exec_module File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed File "/home/runner/work/measurement-plugin-python/measurement-plugin-python/packages/generator/.venv/lib/python3.11/site-packages/flake8_import_order/flake8_linter.py", line 6, in <module> from flake8_import_order.checker import ( File "/home/runner/work/measurement-plugin-python/measurement-plugin-python/packages/generator/.venv/lib/python3.11/site-packages/flake8_import_order/checker.py", line 8, in <module> from flake8_import_order.styles import lookup_entry_point File "/home/runner/work/measurement-plugin-python/measurement-plugin-python/packages/generator/.venv/lib/python3.11/site-packages/flake8_import_order/styles.py", line 3, in <module> from pkg_resources import iter_entry_points ModuleNotFoundError: No module named 'pkg_resources'

github-actions · 2026-11-04T21:34:31Z

Test Results

58 files ±0 58 suites ±0 1h 8m 32s ⏱️ -17s
675 tests ±0 671 ✅ - 4 0 💤 ±0 4 ❌ + 4
19 400 runs ±0 18 290 ✅ - 56 1 054 💤 ±0 56 ❌ +56

For more details on these failures, see this check.

Results for commit 6cbed6b. ± Comparison against base commit 28c674b.

♻️ This comment has been updated with latest results.

renovate · 2026-11-05T23:23:51Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 26.x releases. But if you manually upgrade to 26.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

renovate Bot requested review from bkeryan, csjall and dixonjoel as code owners November 4, 2026 19:46

bkeryan reviewed Nov 4, 2026

View reviewed changes

Update dependency black to v26 [SECURITY]

6cbed6b

renovate Bot force-pushed the users/renovate/pypi-black-vulnerability branch from 1199b37 to 6cbed6b Compare November 5, 2026 21:21

bkeryan closed this Nov 5, 2026

renovate Bot deleted the users/renovate/pypi-black-vulnerability branch November 6, 2026 18:39

Navigation Menu

Repository navigation

Update dependency black to v26 [SECURITY] - #1350

Update dependency black to v26 [SECURITY]#1350
renovate[bot] wants to merge 1 commit into
mainfrom
users/renovate/pypi-black-vulnerability

renovate Bot commented Nov 4, 2026 •

edited

Loading

Uh oh!

bkeryan Nov 4, 2026 •

edited

Loading

Uh oh!

dixonjoel Nov 4, 2026

Uh oh!

mshafer-NI Nov 4, 2026

Uh oh!

mshafer-NI Nov 4, 2026

Uh oh!

mshafer-NI Nov 4, 2026

Uh oh!

bkeryan Nov 5, 2026

Uh oh!

bkeryan Nov 5, 2026

Uh oh!

github-actions Bot commented Nov 4, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Nov 5, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

renovate Bot commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Black: Arbitrary file writes from unsanitized user input in cache file name

Details

Impact

Patches

Workarounds

Severity

References

Black: GitHub Action installs unvalidated required-version from pyproject.toml

Details

Summary

Details

Proof of concept

Impact

Severity

References

CVE-2026-31900 / GHSA-v53h-f6m7-xcgm / PYSEC-2026-2120

Details

Severity

References

Black: Arbitrary file writes from unsanitized user input in cache file name

Details

Impact

Patches

Workarounds

Severity

References

CVE-2026-32274 / GHSA-3936-cmfr-pm3m / PYSEC-2026-2121

Details

Severity

References

Black: GitHub Action installs unvalidated required-version from pyproject.toml

Details

Summary

Details

Proof of concept

Impact

Severity

References

Release Notes

Highlights

Stable style

Preview style

Configuration

Performance

Integrations

Stable style

Preview style

New preview features

Updates to existing preview features

Updates to existing unstable features

Configuration

Packaging

Performance

Output

Blackd

Integrations

Documentation

Stable style

Packaging

Documentation

Highlights

Stable style

Preview style

Packaging

Output

Blackd

Integrations

Documentation

Stable style

Configuration

Blackd

Stable style

Preview style

Packaging

Performance

Output

Blackd

renovate Bot commented Nov 4, 2026 •

edited

Loading

bkeryan Nov 4, 2026 •

edited

Loading

github-actions Bot commented Nov 4, 2026 •

edited

Loading