This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
Don't move comments along with delimiters, which could cause crashes (#4248)
Strengthen AST safety check to catch more unsafe changes to strings. Previous versions
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
Fix a bug where line-ranges exceeding the last code line would not work as expected
(#4273)
Performance
Fix catastrophic performance on docstrings that contain large numbers of leading tab
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
Note what happens when --check is used with --quiet (#4236)
This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
Don't move comments along with delimiters, which could cause crashes (#4248)
Strengthen AST safety check to catch more unsafe changes to strings. Previous versions
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
Fix a bug where line-ranges exceeding the last code line would not work as expected
(#4273)
Performance
Fix catastrophic performance on docstrings that contain large numbers of leading tab
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
Note what happens when --check is used with --quiet (#4236)
Fix: in some cases, even with [run] relative_files=True, a data file could be created with absolute path names. When combined with other relative data files, it was random whether the absolute file names would be made relative or not. If they weren't, then a file would be listed twice in reports, as detailed in issue 1752. This is now fixed: absolute file names are always made relative when combining. Thanks to Bruno Rodrigues dos Santos for support.
Fix: the last case of a match/case statement had an incorrect message if the branch was missed. It said the pattern never matched, when actually the branch is missed if the last case always matched.
Fix: clicking a line number in the HTML report now positions more accurately.
Fix: the report:format setting was defined as a boolean, but should be a string. Thanks, Tanaydin Sirin. It is also now documented on the configuration page <config_report_format>.
Fix: in some cases, even with [run] relative_files=True, a data file
could be created with absolute path names. When combined with other relative
data files, it was random whether the absolute file names would be made
relative or not. If they weren't, then a file would be listed twice in
reports, as detailed in issue 1752_. This is now fixed: absolute file
names are always made relative when combining. Thanks to Bruno Rodrigues dos
Santos for support.
Fix: the last case of a match/case statement had an incorrect message if the
branch was missed. It said the pattern never matched, when actually the
branch is missed if the last case always matched.
Fix: clicking a line number in the HTML report now positions more accurately.
Fix: the report:format setting was defined as a boolean, but should be a
string. Thanks, Tanaydin Sirin <pull 1754_>_. It is also now documented
on the :ref:configuration page <config_report_format>.
We’ve just uploaded mypy 1.9 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.
Breaking Changes
Because the version of typeshed we use in mypy 1.9 doesn't support 3.7, neither does mypy 1.9. (Jared Hance, PR 16883)
We are planning to enable
local partial types (enabled via the
--local-partial-types flag) later this year by default. This change
was announced years ago, but now it's finally happening. This is a
major backward-incompatible change, so we'll probably include it as
part of the upcoming mypy 2.0 release. This makes daemon and
non-daemon mypy runs have the same behavior by default.
Local partial types can also be enabled in the mypy config file:
local_partial_types = True
We are looking at providing a tool to make it easier to migrate
projects to use --local-partial-types, but it's not yet clear whether
this is practical. The migration usually involves adding some
explicit type annotations to module-level and class-level variables.
Basic Support for Type Parameter Defaults (PEP 696)
This release contains new experimental support for type parameter
defaults (PEP 696). Please try it
out! This feature was contributed by Marc Mueller.
Since this feature will be officially introduced in the next Python
feature release (3.13), you will need to import TypeVar, ParamSpec
or TypeVarTuple from typing_extensions to use defaults for now.
This example adapted from the PEP defines a default for BotT:
from typing import Generic
from typing_extensions import TypeVar
This release is not a usual bug fix release -- it contains features and improvements, being a follow up
to 8.1.0, which has been yanked from PyPI.
:::
Features
#11475: Added the new consider_namespace_packages{.interpreted-text role="confval"} configuration option, defaulting to False.
If set to True, pytest will attempt to identify modules that are part of namespace packages when importing modules.
#11653: Added the new verbosity_test_cases{.interpreted-text role="confval"} configuration option for fine-grained control of test execution verbosity.
See Fine-grained verbosity <pytest.fine_grained_verbosity>{.interpreted-text role="ref"} for more details.
Improvements
#10865: pytest.warns{.interpreted-text role="func"} now validates that warnings.warn{.interpreted-text role="func"} was called with a [str]{.title-ref} or a [Warning]{.title-ref}.
Currently in Python it is possible to use other types, however this causes an exception when warnings.filterwarnings{.interpreted-text role="func"} is used to filter those warnings (see [CPython #103577](python/cpython#103577) for a discussion).
While this can be considered a bug in CPython, we decided to put guards in pytest as the error message produced without this check in place is confusing.
#11311: When using --override-ini for paths in invocations without a configuration file defined, the current working directory is used
as the relative directory.
Previoulsy this would raise an AssertionError{.interpreted-text role="class"}.
#11475: --import-mode=importlib <import-mode-importlib>{.interpreted-text role="ref"} now tries to import modules using the standard import mechanism (but still without changing :pysys.path{.interpreted-text role="data"}), falling back to importing modules directly only if that fails.
This means that installed packages will be imported under their canonical name if possible first, for example app.core.models, instead of having the module name always be derived from their path (for example .env310.lib.site_packages.app.core.models).
#11801: Added the iter_parents() <_pytest.nodes.Node.iter_parents>{.interpreted-text role="func"} helper method on nodes.
It is similar to listchain <_pytest.nodes.Node.listchain>{.interpreted-text role="func"}, but goes from bottom to top, and returns an iterator, not a list.
#11850: Added support for sys.last_exc{.interpreted-text role="data"} for post-mortem debugging on Python>=3.12.
#11962: In case no other suitable candidates for configuration file are found, a pyproject.toml (even without a [tool.pytest.ini_options] table) will be considered as the configuration file and define the rootdir.
#11978: Add --log-file-mode option to the logging plugin, enabling appending to log-files. This option accepts either "w" or "a" and defaults to "w".
Previously, the mode was hard-coded to be "w" which truncates the file before logging.
- Add provision arguments to ToxParser to fix crash when provisioning new tox environment without list-dependencies by :user:`seyidaniels` (:issue:`3190`)
Improved Documentation - 4.14.2
Removed unused line from the 'fresh_subprocess' documentation. (:issue:3241)
v4.14.1 (2024-03-06)
Bugfixes - 4.14.1
- Fix crash with fresh subprocess, if the build backend is setuptools automatically enable fresh subprocesses for
build backend calls - by :user:`gaborbernat`. (:issue:`3235`)
v4.14.0 (2024-03-05)
Features - 4.14.0
Support enabling fresh subprocess for packaging build backends via :ref:fresh_subprocess - by :user:gaborbernat. (:issue:3227)
Allow plugins attaching additional information to --version via tox_append_version_info method in the plugin
module - by :user:gaborbernat. (:issue:3234)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the pip group with 9 updates:
24.2.0
24.3.0
1.1.1
1.2.1
7.4.3
7.4.4
1.8.0
1.9.0
3.6.2
3.7.0
8.0.2
8.1.1
4.13.0
4.14.2
2.31.0.20240218
2.31.0.20240311
1.16.21.20240301
1.16.21.20240311
Updates
black
from 24.2.0 to 24.3.0Release notes
Sourced from black's releases.
Changelog
Sourced from black's changelog.
Commits
552baf8
Prepare release 24.3.0 (#4279)f000936
Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)7b5a657
Fix --line-ranges behavior when ranges are at EOF (#4273)1abcffc
Use regex where we ignore case on windows (#4252)719e674
Fix 4227: Improve documentation for --quiet --check (#4236)e5510af
update plugin url for Thonny (#4259)6af7d11
Fix AST safety check false negative (#4270)f03ee11
Ensureblib2to3.pygram
is initialized before use (#4224)e4bfedb
fix: Don't move comments while splitting delimiters (#4248)d0287e1
Make trailing comma logic more concise (#4202)Updates
build
from 1.1.1 to 1.2.1Release notes
Sourced from build's releases.
Changelog
Sourced from build's changelog.
Commits
1e67c06
chore: bump version number to 1.2.1e5072e3
fix: support min width not detectable (#761)d5fb6fb
chore: prepare for 1.2.0 (#758)1ae6eb1
pre-commit: bump repositories (#757)a1f005d
pre-commit: bump repositories (#756)5076a56
uv: support double verbosity flag5662669
chore: bump mypy24c513d
chore: reformat using Black 2024 style08cdb76
ruff: bump version and update config97ea57b
perf: avoid compiling unused bytecode (#752)Updates
coverage[toml]
from 7.4.3 to 7.4.4Release notes
Sourced from coverage[toml]'s releases.
Changelog
Sourced from coverage[toml]'s changelog.
Commits
bc5e2d7
docs: sample HTML for 7.4.49b0008b
docs: prep for 7.4.4a536161
docs: thanks, Bruno Rodrigues dos Santose06e4f9
chore: make doc_upgradef30818e
chore: make upgrade1b19799
fix: ensure absolute paths are relative when combined #17521ef020d
build: more cheats for convenient URLs3d57a07
docs: document the report:format setting8e30221
fix: correct the type of report:format in config.py (#1754)6289be8
refactor: use dataclasses, no namedtupleUpdates
mypy
from 1.8.0 to 1.9.0Changelog
Sourced from mypy's changelog.
... (truncated)
Commits
5ff46f8
Remove +dev.155909a
[Release 1.9] Unsupport targetting 3.7. (#16883) (#16900)6615cab
[Release 1.9] Stubtest: ignore a new protocol dunder (#16895) (#16899)b956e6a
stubtest: Private parameters can be omitted (#16507)ede0b20
Bump ruff to 0.2.0 (#16870)7bdd61f
stubgen: Fix crash on star unpack of TypeVarTuple (#16869)8c2ef9d
Update hashes in sync-typeshed.py following recent typeshed sync0dd4b6f
Revert use ofParamSpec
forfunctools.wraps
dd12a2d
Revert typeshed ctypes changed132999
Revert sum literal integer change (#13961)Updates
pre-commit
from 3.6.2 to 3.7.0Release notes
Sourced from pre-commit's releases.
Changelog
Sourced from pre-commit's changelog.
Commits
7b4667e
v3.7.0d46c8fc
Merge pull request #3168 from pre-commit/fix-fail-fastfc62215
fix per-hook fail_fast to not fail on previous failures716da1e
Merge pull request #3155 from pre-commit/pre-commit-ci-update-config0939c11
[pre-commit.ci] pre-commit autoupdate3bdf9fb
Merge pull request #3150 from pre-commit/pre-commit-ci-update-config75b3e52
[pre-commit.ci] pre-commit autoupdate5e11c26
Merge pull request #3122 from glehmann/docker-ttye580096
give docker a tty output when expecting color7b868c3
Merge pull request #3132 from pre-commit/pre-commit-ci-update-configUpdates
pytest
from 8.0.2 to 8.1.1Release notes
Sourced from pytest's releases.
... (truncated)
Commits
81653ee
Adjust changelog manually for 8.1.1e60b4b9
Prepare release version 8.1.115fbe57
[8.1.x] Revert legacy path removals (#12093)86c3aab
[8.1.x] Do not import duplicated modules with --importmode=importlib (#12077)5b82b0c
[8.1.x] Yank version 8.1.0 (#12076)0a53681
Merge pull request #12054 from pytest-dev/release-8.1.0b9a167f
Prepare release version 8.1.000043f7
Merge pull request #12038 from bluetech/fixtures-rm-arg2indexf4e1025
Merge pull request #12048 from bluetech/fixture-teardown-excgroup43492f5
Merge pull request #12051 from jakkdl/test_debugging_pythonbreakpointUpdates
tox
from 4.13.0 to 4.14.2Release notes
Sourced from tox's releases.
Changelog
Sourced from tox's changelog.
Commits
ab9b504
release 4.14.22f6667f
Add Provision Arguments to ToxParser (#3246)380d2e2
[pre-commit.ci] pre-commit autoupdate (#3244)7514e01
Add missing space20732d6
[pre-commit.ci] pre-commit autoupdate (#3242)543b718
Bump pypa/gh-action-pypi-publish from 1.8.12 to 1.8.14 (#3239)1fb9356
Removed unneeded line (#3241)acbef2d
release 4.14.1969fbec
Fix fresh subprocesses and allow duplicate register config calls for the core...d37cb08
release 4.14.0Updates
types-requests
from 2.31.0.20240218 to 2.31.0.20240311Commits
Updates
types-six
from 1.16.21.20240301 to 1.16.21.20240311Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show