codecov[bot]
commented
7 months ago Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:
Project coverage is 92.32%. Comparing base (
f901052) to head (afba549).
Additional details and impacted files
```diff @@ Coverage Diff @@ ## main #116 +/- ## ======================================= Coverage 92.32% 92.32% ======================================= Files 33 33 Lines 834 834 Branches 125 125 ======================================= Hits 770 770 Misses 44 44 Partials 20 20 ```:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
This PR contains the following updates:
24.2.0->24.3.0GitHub Vulnerability Alerts
CVE-2024-21503
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Release Notes
psf/black (black)
### [`v24.3.0`](https://togithub.com/psf/black/blob/HEAD/CHANGES.md#2430) [Compare Source](https://togithub.com/psf/black/compare/24.2.0...24.3.0) ##### Highlights This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix [CVE-2024-21503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21503). This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher. ##### Stable style - Don't move comments along with delimiters, which could cause crashes ([#4248](https://togithub.com/psf/black/issues/4248)) - Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. ([#4270](https://togithub.com/psf/black/issues/4270)) - Fix a bug where line-ranges exceeding the last code line would not work as expected ([#4273](https://togithub.com/psf/black/issues/4273)) ##### Performance - Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes [CVE-2024-21503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21503). ([#4278](https://togithub.com/psf/black/issues/4278)) ##### Documentation - Note what happens when `--check` is used with `--quiet` ([#4236](https://togithub.com/psf/black/issues/4236))Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.