[dependabot]

Bumps black from 26.5.1 to 26.10.1.

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
• Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

• Add --cache-dir to configure the cache directory from the command line (#5433)
• Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)
• Keep the parentheses around a walrus that is the only item in a set (for example {(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't parse it without them (#5502)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
• Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

... (truncated)

Commits

• 258e7db Prepare release 26.10.1 (#5511)
• ac1f715 Action: validate required-version better (#5510)
• fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
• 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
• 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
• c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
• 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
• c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
• eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
• 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
• Additional commits viewable in compare view

[github-actions]

🤖 Claude Code Review

PR Review: Bump black from 26.5.1 to 26.10.1

The diff changes one line in pyproject.toml:73. It bumps the lint dependency group pin for black on Python > 3.11. The Python ≤ 3.11 pin (25.11.0) is unchanged.

Code Quality

• ✅ Style conventions: The pin format matches the neighbouring entries.
• ✅ No commented-out code.
• ✅ Meaningful names / DRY: Not applicable to this change.
• ✅ Defects: I found none in the change itself.
  • This is a minor-version bump of a formatter in a dev-only group. It has no runtime impact on the library.
  • Black's stable style can change between releases (a yearly style-stability update). If the new version reformats existing code, the CI black --check step could fail. I did not run Black here, so confirm that CI passes.
  • The 3.10/3.11 pin stays on 25.11.0, so the two Python tracks may format slightly differently. This already applies to the existing pins.
• ✅ .claude/CLAUDE.md: It is not touched. It has no local-environment-specific content.

Testing

• ✅ Not applicable: There is no new code. Unit tests, integration tests, edge cases and coverage are unaffected.
• ⚠️ CI: The lint/format job on Python 3.12 and 3.13 is the effective test for this change. Verify that it is green.

Documentation

• ✅ README / API docs / inline comments: No updates needed.
• ℹ️ CHANGELOG.md: It was not updated. Dependabot dev-tooling bumps typically don't need an entry, but check this repo's convention.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials, no sensitive data in logs, and no license files (.lic or AQAAAD strings).
• ✅ Supply chain: The bump comes from the Black package on PyPI. It is pinned to an exact version, which is good practice.

Summary

This is a low-risk, dev-only dependency bump. I have no blocking issues. The one thing to confirm is that CI formatting checks pass with Black 26.10.1.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Code review: bump black 26.5.1 → 26.10.1

The diff changes one line in pyproject.toml. It raises the pinned black version in the lint dependency group for Python > 3.11. The pin for Python ≤ 3.11 stays at 25.11.0, which is correct, because newer black releases drop support for those versions.

Code Quality

• ✅ Style conventions: The pin format matches the neighbouring entries, including the environment marker.
• ✅ No commented-out code.
• ✅ Variable names, DRY: Not applicable.
• ✅ Defects: I found none. I haven't run black 26.10.1 against the repo, so I can't say whether the new version reformats any existing files. If CI runs black --check, its result will show that. A minor-version bump of a formatter can change formatting rules.
• ✅ .claude/CLAUDE.md: It contains nothing specific to a local environment. The diff doesn't touch it. Its code-style section (line length 120, Black) is still accurate.

Testing

• ✅ Not applicable: No code changed, so no new tests are needed. CI lint and format checks are the relevant validation.

Documentation

• ✅ README and API docs: No update is needed.
• ✅ CHANGELOG.md: Dependabot-style dev-tooling bumps usually don't get an entry. The earlier bumps in the log (virtualenv and mypy) appear to follow the same pattern.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials, no sensitive data in logs.
• ✅ Input validation and error handling: Not applicable.
• ✅ No license files: No .lic files or AQAAAD strings are in the diff.

Verdict

✅ Approve. This is a low-risk, dev-only dependency bump. Before merging, confirm that CI passes on Python 3.12 and 3.13, in particular the black --check step.

Automated code review analyzing defects and coding standards