This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
Don't move comments along with delimiters, which could cause crashes (#4248)
Strengthen AST safety check to catch more unsafe changes to strings. Previous versions
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
Fix a bug where line-ranges exceeding the last code line would not work as expected
(#4273)
Performance
Fix catastrophic performance on docstrings that contain large numbers of leading tab
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
Note what happens when --check is used with --quiet (#4236)
This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
Don't move comments along with delimiters, which could cause crashes (#4248)
Strengthen AST safety check to catch more unsafe changes to strings. Previous versions
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
Fix a bug where line-ranges exceeding the last code line would not work as expected
(#4273)
Performance
Fix catastrophic performance on docstrings that contain large numbers of leading tab
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
Note what happens when --check is used with --quiet (#4236)
All postprocessors are now run on heading content.
Footnote references are now stripped from heading content. Fixes #660.
A more robust striptags is provided to convert headings to plain text.
Unlike, the markupsafe implementation, HTML entities are not unescaped.
The plain text name, rich html, and unescaped raw data-toc-label are
saved to toc_tokens, allowing users to access the full rich text content of
the headings directly from toc_tokens.
The value of data-toc-label is sanitized separate from heading content
before being written to name. This fixes a bug which allowed markup through
in certain circumstances. To access the raw unsanitized data, retrieve the
value from token['data-toc-label'] directly.
An html.unescape call is made just prior to calling slugify so that
slugify only operates on Unicode characters. Note that html.unescape is
not run on name, html, or data-toc-label.
The functions get_name and stashedHTML2text defined in the toc extension
are both deprecated. Instead, third party extensions should use some
combination of the new functions run_postprocessors, render_inner_html and
striptags.
Fixed
Include scripts/*.py in the generated source tarballs (#1430).
Ensure lines after heading in loose list are properly detabbed (#1443).
Give smarty tree processor higher priority than toc (#1440).
Permit carets (^) and square brackets (]) but explicitly exclude
backslashes (\) from abbreviations (#1444).
In attribute lists (attr_list, fenced_code), quoted attribute values are
now allowed to contain curly braces (}) (#1414).
All postprocessors are now run on heading content.
Footnote references are now stripped from heading content. Fixes #660.
A more robust striptags is provided to convert headings to plain text.
Unlike, the markupsafe implementation, HTML entities are not unescaped.
The plain text name, rich html, and unescaped raw data-toc-label are
saved to toc_tokens, allowing users to access the full rich text content of
the headings directly from toc_tokens.
The value of data-toc-label is sanitized separate from heading content
before being written to name. This fixes a bug which allowed markup through
in certain circumstances. To access the raw unsanitized data, retrieve the
value from token['data-toc-label'] directly.
An html.unescape call is made just prior to calling slugify so that
slugify only operates on Unicode characters. Note that html.unescape is
not run on name, html, or data-toc-label.
The functions get_name and stashedHTML2text defined in the toc extension
are both deprecated. Instead, third party extensions should use some
combination of the new functions run_postprocessors, render_inner_html and
striptags.
Fixed
Include scripts/*.py in the generated source tarballs (#1430).
Ensure lines after heading in loose list are properly detabbed (#1443).
Give smarty tree processor higher priority than toc (#1440).
Permit carets (^) and square brackets (]) but explicitly exclude
backslashes (\) from abbreviations (#1444).
In attribute lists (attr_list, fenced_code), quoted attribute values are
now allowed to contain curly braces (}) (#1414).
We’ve just uploaded mypy 1.9 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.
Breaking Changes
Because the version of typeshed we use in mypy 1.9 doesn't support 3.7, neither does mypy 1.9. (Jared Hance, PR 16883)
We are planning to enable
local partial types (enabled via the
--local-partial-types flag) later this year by default. This change
was announced years ago, but now it's finally happening. This is a
major backward-incompatible change, so we'll probably include it as
part of the upcoming mypy 2.0 release. This makes daemon and
non-daemon mypy runs have the same behavior by default.
Local partial types can also be enabled in the mypy config file:
local_partial_types = True
We are looking at providing a tool to make it easier to migrate
projects to use --local-partial-types, but it's not yet clear whether
this is practical. The migration usually involves adding some
explicit type annotations to module-level and class-level variables.
Basic Support for Type Parameter Defaults (PEP 696)
This release contains new experimental support for type parameter
defaults (PEP 696). Please try it
out! This feature was contributed by Marc Mueller.
Since this feature will be officially introduced in the next Python
feature release (3.13), you will need to import TypeVar, ParamSpec
or TypeVarTuple from typing_extensions to use defaults for now.
This example adapted from the PEP defines a default for BotT:
from typing import Generic
from typing_extensions import TypeVar
This release is not a usual bug fix release -- it contains features and improvements, being a follow up
to 8.1.0, which has been yanked from PyPI.
:::
Features
#11475: Added the new consider_namespace_packages{.interpreted-text role="confval"} configuration option, defaulting to False.
If set to True, pytest will attempt to identify modules that are part of namespace packages when importing modules.
#11653: Added the new verbosity_test_cases{.interpreted-text role="confval"} configuration option for fine-grained control of test execution verbosity.
See Fine-grained verbosity <pytest.fine_grained_verbosity>{.interpreted-text role="ref"} for more details.
Improvements
#10865: pytest.warns{.interpreted-text role="func"} now validates that warnings.warn{.interpreted-text role="func"} was called with a [str]{.title-ref} or a [Warning]{.title-ref}.
Currently in Python it is possible to use other types, however this causes an exception when warnings.filterwarnings{.interpreted-text role="func"} is used to filter those warnings (see [CPython #103577](python/cpython#103577) for a discussion).
While this can be considered a bug in CPython, we decided to put guards in pytest as the error message produced without this check in place is confusing.
#11311: When using --override-ini for paths in invocations without a configuration file defined, the current working directory is used
as the relative directory.
Previoulsy this would raise an AssertionError{.interpreted-text role="class"}.
#11475: --import-mode=importlib <import-mode-importlib>{.interpreted-text role="ref"} now tries to import modules using the standard import mechanism (but still without changing :pysys.path{.interpreted-text role="data"}), falling back to importing modules directly only if that fails.
This means that installed packages will be imported under their canonical name if possible first, for example app.core.models, instead of having the module name always be derived from their path (for example .env310.lib.site_packages.app.core.models).
#11801: Added the iter_parents() <_pytest.nodes.Node.iter_parents>{.interpreted-text role="func"} helper method on nodes.
It is similar to listchain <_pytest.nodes.Node.listchain>{.interpreted-text role="func"}, but goes from bottom to top, and returns an iterator, not a list.
#11850: Added support for sys.last_exc{.interpreted-text role="data"} for post-mortem debugging on Python>=3.12.
#11962: In case no other suitable candidates for configuration file are found, a pyproject.toml (even without a [tool.pytest.ini_options] table) will be considered as the configuration file and define the rootdir.
#11978: Add --log-file-mode option to the logging plugin, enabling appending to log-files. This option accepts either "w" or "a" and defaults to "w".
Previously, the mode was hard-coded to be "w" which truncates the file before logging.
#415: MockType and AsyncMockType can be imported from pytest_mock for type annotation purposes.
#420: Fixed a regression which would cause mocker.patch.object to not being properly cleared between tests.
v3.13.0
#417: spy now has spy_return_list, which is a list containing all the values returned by the spied function.
pytest-mock now requires pytest>=6.2.5.
#410: pytest-mock's setup.py file is removed.
If you relied on this file, e.g. to install pytest using setup.py install,
please see Why you shouldn't invoke setup.py directly for alternatives.
[#415](https://github.com/pytest-dev/pytest-mock/issues/415) <https://github.com/pytest-dev/pytest-mock/pull/415>_: MockType and AsyncMockType can be imported from pytest_mock for type annotation purposes.
[#420](https://github.com/pytest-dev/pytest-mock/issues/420) <https://github.com/pytest-dev/pytest-mock/issues/420>_: Fixed a regression which would cause mocker.patch.object to not being properly cleared between tests.
3.13.0 (2024-03-21)
[#417](https://github.com/pytest-dev/pytest-mock/issues/417) <https://github.com/pytest-dev/pytest-mock/pull/417>_: spy now has spy_return_list, which is a list containing all the values returned by the spied function.
pytest-mock now requires pytest>=6.2.5.
[#410](https://github.com/pytest-dev/pytest-mock/issues/410) <https://github.com/pytest-dev/pytest-mock/pull/410>: pytest-mock's setup.py file is removed.
If you relied on this file, e.g. to install pytest using setup.py install,
please see Why you shouldn't invoke setup.py directly <https://blog.ganssle.io/articles/2021/10/setup-py-deprecated.html#summary> for alternatives.
As of v0.23, pytest-asyncio attaches an asyncio event loop to each item of the test suite (i.e. session, packages, modules, classes, functions) and allows tests to be run in those loops when marked accordingly. Pytest-asyncio currently assumes that async fixture scope is correlated with the new event loop scope. This prevents fixtures from being evaluated independently from the event loop scope and breaks some existing test suites (see #706). For example, a test suite may require all fixtures and tests to run in the same event loop, but have async fixtures that are set up and torn down for each module. If you're affected by this issue, please continue using the v0.21 release, until it is resolved.
Fix typing errors with recent versions of mypy #769
Prevent DeprecationWarning about internal use of asyncio.get_event_loop() from affecting test cases #757
Known issues
As of v0.23, pytest-asyncio attaches an asyncio event loop to each item of the test suite (i.e. session, packages, modules, classes, functions) and allows tests to be run in those loops when marked accordingly. Pytest-asyncio currently assumes that async fixture scope is correlated with the new event loop scope. This prevents fixtures from being evaluated independently from the event loop scope and breaks some existing test suites (see #706). For example, a test suite may require all fixtures and tests to run in the same event loop, but have async fixtures that are set up and torn down for each module. If you're affected by this issue, please continue using the v0.21 release, until it is resolved.
Commits
c34da04 [docs] Mentioned pytest 8.2 compatibility fix in changelog.
143f745 Fix compatibility with pytest 8.2 FixtureDef.unittest removal
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the optional group with 9 updates:
24.2.0
24.3.0
3.5.2
3.6
9.5.12
9.5.16
1.8.0
1.9.0
3.5.0.20240129
3.6.0.20240316
8.1.0
8.1.1
3.12.0
3.14.0
0.23.5
0.23.6
0.5
0.6
Updates
black
from 24.2.0 to 24.3.0Release notes
Sourced from black's releases.
Changelog
Sourced from black's changelog.
Commits
552baf8
Prepare release 24.3.0 (#4279)f000936
Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)7b5a657
Fix --line-ranges behavior when ranges are at EOF (#4273)1abcffc
Use regex where we ignore case on windows (#4252)719e674
Fix 4227: Improve documentation for --quiet --check (#4236)e5510af
update plugin url for Thonny (#4259)6af7d11
Fix AST safety check false negative (#4270)f03ee11
Ensureblib2to3.pygram
is initialized before use (#4224)e4bfedb
fix: Don't move comments while splitting delimiters (#4248)d0287e1
Make trailing comma logic more concise (#4202)Updates
markdown
from 3.5.2 to 3.6Release notes
Sourced from markdown's releases.
Changelog
Sourced from markdown's changelog.
Commits
e524b8f
Bump version to 3.63d8afc6
Allow attr_list quoted values to contain curly braces9edba85
Refactor abbr escapinge4ab4a6
Refactor TOC sanitationa18765c
Explicitly omit carot and backslash from abbr421f1e8
Give smarty tree processor higher priority than tocc334a3e
Ensure lines after heading in loose list are properly detabbedea92856
Update the license template so GitHub can detect ita2effd6
Disable mkdocstrings show_symbol_type_toc option to work around searching iss...91f9a12
Restore Attribute symbol type in mkdocstrings templateUpdates
mkdocs-material
from 9.5.12 to 9.5.16Release notes
Sourced from mkdocs-material's releases.
Changelog
Sourced from mkdocs-material's changelog.
... (truncated)
Commits
8956524
Updated Insiders changelog0db4e66
Updated changelog29cf44b
Improved resilience of privacy plugin6c9ba87
Prepare 9.5.16 releasef2bfab9
Updated dependencies9e40207
Updated dependenciesa2cb35d
Improved error handling on social plugin (#6818)abfac1a
Switched to Babel'sformat_datetime
to allow for time in formatted dates (#...01b2dd1
Updated Russian translationsad72336
Fixed social plugin Google Fonts integrationUpdates
mypy
from 1.8.0 to 1.9.0Changelog
Sourced from mypy's changelog.
... (truncated)
Commits
5ff46f8
Remove +dev.155909a
[Release 1.9] Unsupport targetting 3.7. (#16883) (#16900)6615cab
[Release 1.9] Stubtest: ignore a new protocol dunder (#16895) (#16899)b956e6a
stubtest: Private parameters can be omitted (#16507)ede0b20
Bump ruff to 0.2.0 (#16870)7bdd61f
stubgen: Fix crash on star unpack of TypeVarTuple (#16869)8c2ef9d
Update hashes in sync-typeshed.py following recent typeshed sync0dd4b6f
Revert use ofParamSpec
forfunctools.wraps
dd12a2d
Revert typeshed ctypes changed132999
Revert sum literal integer change (#13961)Updates
types-markdown
from 3.5.0.20240129 to 3.6.0.20240316Commits
Updates
pytest
from 8.1.0 to 8.1.1Release notes
Sourced from pytest's releases.
... (truncated)
Commits
81653ee
Adjust changelog manually for 8.1.1e60b4b9
Prepare release version 8.1.115fbe57
[8.1.x] Revert legacy path removals (#12093)86c3aab
[8.1.x] Do not import duplicated modules with --importmode=importlib (#12077)5b82b0c
[8.1.x] Yank version 8.1.0 (#12076)0a53681
Merge pull request #12054 from pytest-dev/release-8.1.0Updates
pytest-mock
from 3.12.0 to 3.14.0Release notes
Sourced from pytest-mock's releases.
Changelog
Sourced from pytest-mock's changelog.
Commits
8733134
Update CHANGELOG for 3.14.05257e3c
Refactor MockCache to have a narrow interface4faf92a
Fix regression with mocker.patch not being undone correctly6bd8712
Drop pre-Python 3.8 support code366966b
ExportMockType
/AsyncMockType
for type annotations (#415)852116b
Merge pull request #418 from pytest-dev/release-3.13.0ef9461b
Add instructions on how to start deploy from command-line5b9d285
Release 3.13.06d5d6dc
Implementspy_return_list
(#417)dc28a0e
[pre-commit.ci] pre-commit autoupdate (#416)Updates
pytest-asyncio
from 0.23.5 to 0.23.6Release notes
Sourced from pytest-asyncio's releases.
Commits
c34da04
[docs] Mentioned pytest 8.2 compatibility fix in changelog.143f745
Fix compatibility with pytest 8.2 FixtureDef.unittest removal13d4b79
Remove unused function_removesuffix
cdd2c49
UseFixtureRequest
instead ofSubRequest
c3429fa
Build(deps): Bump packaging from 23.2 to 24.0 in /dependencies/docs5f2338d
Build(deps): Bump pypa/gh-action-pypi-publish from 1.8.12 to 1.8.14726c6e0
Build(deps): Bump coverage from 7.4.3 to 7.4.4 in /dependencies/default8bd8288
Build(deps): Bump pytest from 8.0.2 to 8.1.1 in /dependencies/defaultef3b347
Build(deps): Bump packaging from 23.2 to 24.0 in /dependencies/defaultb22d84e
[docs] Fixes the example showing how to run all tests in a session-scoped loop.Updates
async-solipsism
from 0.5 to 0.6Commits
462abab
Fix content-type for README3e011a7
Add dist directory to .gitignore6398818
Update README for 0.6 releasebec1263
Bump version to 0.67ce816c
Move package config into pyproject.toml2b5b163
Run GHA on pull request tood47ed8c
Fix GHA (hopefully)a1495c3
Generate requirements.txt with pip-compile448a203
Improve compatibility with pytest-asyncio 0.23393e7b5
Drop support for end-of-life Python versionsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show