SAP / pylint-per-file-ignores / 23025900599

99%

push

github

Update dependency black to v26.3.1 [SECURITY] (#145)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [black](https://redirect.github.com/psf/black)
([changelog](https://redirect.github.com/psf/black/blob/main/CHANGES.md))
| `==26.3.0` → `==26.3.1` |
![age](https://developer.mend.io/api/mc/badges/age/pypi/black/26.3.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/black/26.3.0/26.3.1?slim=true)
|

### GitHub Vulnerability Alerts

####
[CVE-2026-32274](https://redirect.github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m)

### Impact

Black writes a cache file, the name of which is computed from various
formatting options. The value of the `--python-cell-magics` option was
placed in the filename without sanitization, which allowed an attacker
who controls the value of this argument to write cache files to
arbitrary file system locations.

### Patches

Fixed in Black 26.3.1.

### Workarounds

Do not allow untrusted user input into the value of the
`--python-cell-magics` option.

---

### Release Notes

<details>
<summary>psf/black (black)</summary>

###
[`v26.3.1`](https://redirect.github.com/psf/black/blob/HEAD/CHANGES.md#2631)

[Compare
Source](https://redirect.github.com/psf/black/compare/26.3.0...26.3.1)

##### Stable style

- Prevent Jupyter notebook magic masking collisions from corrupting
cells by using
exact-length placeholders for short magics and aborting if a placeholder
can no longer
be unmasked safely
([#&#8203;5038](https://redirect.github.com/psf/black/issues/5038))

##### Configuration

- Always hash cache filename components derived from
`--python-cell-magics` so custom
magic names cannot affect cache paths
([#&#8203;5038](https://redirect.github.com/psf/black/issues/5038))

##### *Blackd*

- Disable browser-originated requests by default, add... (continued)

12 of 12 branches covered (100.0%)

Branch coverage included in aggregate %.

91 of 92 relevant lines covered (98.91%)

0.99 hits per line