- 
 
- 
  Notifications
 You must be signed in to change notification settings 
- Fork 66
Update dependency black to v24 [SECURITY] - autoclosed #356
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
 
  Closed
 
 
 Conversation
 
 
 This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
 Learn more about bidirectional Unicode characters
 
 
 
 
 
 
 @renovate
renovate
bot
 changed the title
(削除) Update dependency black to v24 [SECURITY] (削除ここまで)
(追記) Update dependency black to v24 [SECURITY] - autoclosed (追記ここまで)
 Mar 26, 2024 
 
 
 
 @renovate
renovate
bot
 changed the title
(削除) Update dependency black to v24 [SECURITY] - autoclosed (削除ここまで)
(追記) Update dependency black to v24 [SECURITY] (追記ここまで)
 Mar 27, 2024 
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 from
 March 27, 2024 01:14  
 
f073966 to
 b334afc  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 from
 August 6, 2024 07:27  
 
b334afc to
 47a1a3f  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 from
 August 18, 2024 10:53  
 
47a1a3f to
 ec73045  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 2 times, most recently
 from
 November 3, 2024 11:07  
 
63d8250 to
 ffd9e2d  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 from
 January 14, 2025 20:23  
 
ffd9e2d to
 95cf397  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 from
 January 30, 2025 19:11  
 
95cf397 to
 0286d0c  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 from
 March 3, 2025 12:51  
 
0286d0c to
 550ca2d  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 2 times, most recently
 from
 March 17, 2025 18:50  
 
30021ab to
 fc0652f  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 from
 April 8, 2025 12:24  
 
fc0652f to
 08175ad  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 from
 May 7, 2025 12:12  
 
08175ad to
 75f25f9  
 Compare
 
  @renovate
 renovate
bot
 force-pushed
 the
 
 
 renovate/pypi-black-vulnerability
 
 branch
 from
 August 10, 2025 13:06  
 
75f25f9 to
 5c24e81  
 Compare
 
 
 
 @renovate
renovate
bot
 changed the title
(削除) Update dependency black to v24 [SECURITY] (削除ここまで)
(追記) Update dependency black to v24 [SECURITY] - autoclosed (追記ここまで)
 Sep 1, 2025 
 
 
 
 Sign up for free
 to join this conversation on GitHub.
 Already have an account?
 Sign in to comment
 
 
 Add this suggestion to a batch that can be applied as a single commit.
 This suggestion is invalid because no changes were made to the code.
 Suggestions cannot be applied while the pull request is closed.
 Suggestions cannot be applied while viewing a subset of changes.
 Only one suggestion per line can be applied in a batch.
 Add this suggestion to a batch that can be applied as a single commit.
 Applying suggestions on deleted lines is not supported.
 You must change the existing code in this line in order to create a valid suggestion.
 Outdated suggestions cannot be applied.
 This suggestion has been applied or marked resolved.
 Suggestions cannot be applied from pending reviews.
 Suggestions cannot be applied on multi-line comments.
 Suggestions cannot be applied while the pull request is queued to merge.
 Suggestion cannot be applied right now. Please check back later.
 
 
 
 
Uh oh!
There was an error while loading. Please reload this page.
This PR contains the following updates:
23.12.1->24.3.0==23.12.1->==24.3.0GitHub Vulnerability Alerts
CVE-2024-21503
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Release Notes
psf/black (black)
v24.3.0Compare Source
Highlights
This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
(#4273)
Performance
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
--checkis used with--quiet(#4236)v24.2.0Compare Source
Stable style
(#4218)
Preview style
hug_parens_with_braces_and_square_bracketsfeature to the unstable styledue to an outstanding crash and proposed formatting tweaks (#4198)
expression (#4154)
(#4185)
casestatementifguards (#4214).Configuration
pyproject.tomlthat is missing atool.blacksection whendiscovering project root and configuration. Since Black continues to use version
control as an indicator of project root, this is expected to primarily change behavior
for users in a monorepo setup (desirably). If you wish to preserve previous behavior,
simply add an empty
[tool.black]to the previously discoveredpyproject.toml(#4204)
Output
SyntaxWarnings orDeprecationWarnings produced by theastmodule when performing equivalence checks (#4189)
Integrations
v24.1.1Compare Source
Bugfix release to fix a bug that made Black unusable on certain file systems with strict
limits on path length.
Preview style
Configuration
do not support long paths (#4176)
v24.1.0Compare Source
Highlights
This release introduces the new 2024 stable style (#4106), stabilizing the following
changes:
if-elseexpressions (#2278)...are formatted morecompactly (#3796)
(#3368)
withstatement(#3489)
entry (#3393)
--skip-magic-trailing-commaor-C, trailing commas are stripped fromsubscript expressions with more than 1 element (#3209)
# fmt: skipwith other comments (#3959)There are already a few improvements in the
--previewstyle, which are slated for the2025 stable style. Try them out and
share your feedback. In the past, the preview
style has included some features that we were not able to stabilize. This year, we're
adding a separate
--unstablestyle for features with known problems. Now, the--previewstyle only includes features that we actually expect to make it into nextyear's stable style.
Stable style
Several bug fixes were made in features that are moved to the stable style in this
release:
unlike other binary operators (#4109)
blocks, except immediately before a docstring (#4130)
Preview style
--unstablestyle, covering preview features that have known problems that wouldblock them from going into the stable style. Also add the
--enable-unstable-featureflag; for example, use
--enable-unstable-feature hug_parens_with_braces_and_square_bracketsto apply thispreview feature throughout 2024, even if a later Black release downgrades the feature
to unstable (#4096)
# fmt: skipcomments (#4146)Configuration
pyproject.tomlcontains an invalid key (#4165)--experimental-string-processingflag. This feature cancurrently be enabled with
--preview --enable-unstable-feature string_processing.(#4096)
Integrations
(#3940) for better compatibility with older versions of pre-commit (#4137)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.