fix(security): update dependencies [SECURITY] by renovate[bot] · Pull Request #812 · ansible/ansible-dev-tools

renovate · 2026-10-23T03:12:48Z

This PR contains the following updates:

Package	Change	Age	Confidence
black (changelog)	`26.5.1` → `26.10.1`
setuptools (changelog)	`84.0.0` → `84.1.0`

Black: GitHub Action installs unvalidated required-version from pyproject.toml

CVE-2026-114134 / GHSA-cg8m-r9f2-5wm2

More information

Details

Summary

The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.

Details

This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation.

Proof of concept

Reproduction requires a victim to use Black's GitHub Action with use_pyproject: true. The attacker would then issue a PR to the victim's repository with pyproject.toml edited so that Black points to a malicious repository.

Impact

This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the use_pyproject: true setting.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Black: GitHub Action installs unvalidated required-version from pyproject.toml

CVE-2026-114134 / GHSA-cg8m-r9f2-5wm2

More information

Details

Summary

The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.

Details

This is similar to the previous CVE-2026-31900. The value in tool.black.required-version is accepted as the version to be installed by the action without validation.

Proof of concept

Reproduction requires a victim to use Black's GitHub Action with use_pyproject: true. The attacker would then issue a PR to the victim's repository with pyproject.toml edited so that Black points to a malicious repository.

Impact

This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the use_pyproject: true setting.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

GHSA-xmj3-9gf7-h52w

More information

Details

Summary

On Windows, attacker-controlled content in a wheel's
.dist-info/namespace_packages.txt can cause setuptools' legacy wheel
installation path to create an __init__.py outside the requested
destination_eggdir.

The attacker can influence the destination path, but not the contents of
the created file.

Details

Tested setuptools commit:

6ead555c5fb29bc57fe6105b1bffc163f56fd558

Relevant source:

setuptools/wheel.py

SHA-256:

359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd

The relevant call path is:

Wheel(wheel_path).install_as_egg(destination)
→ _install_as_egg
→ _convert_metadata
→ _fix_namespace_packages

A wheel can provide attacker-controlled content in:

<distribution>.dist-info/namespace_packages.txt

The namespace value is eventually used approximately as:

mod_dir = os.path.join(destination_eggdir, *mod.split('.'))
mod_init = os.path.join(mod_dir, '__init__.py')

If mod is a Windows drive-qualified absolute path containing no dots,
mod.split('.') preserves it as a single component.
On Windows, os.path.join(destination_eggdir, absolute_component) discards
the original base directory and resolves to the attacker-supplied absolute
path.
The existing wheel filename and ZIP traversal checks do not validate this
metadata value before it is subsequently interpreted as a filesystem path.

```markdown

##### PoC

The reproduction was performed entirely inside a disposable temporary
directory.

Layout:

```text
sandbox/
    destination/
    outside/
    input/
    canary.txt

A synthetic wheel was created containing:

demo_pkg-1.0.dist-info/namespace_packages.txt

whose content was the absolute path of:

sandbox\outside

The real acquired setuptools implementation was then invoked:

setuptools.wheel.Wheel(synthetic_wheel).install_as_egg(
    sandbox_destination
)

The operation completed without exception.

Expected metadata was created under:

sandbox\destination\EGG-INFO

but setuptools also created:

sandbox\outside\__init__.py

The file did not exist before execution.

Its contents were:

__import__('pkg_resources').declare_namespace(__name__)

The unrelated canary remained byte-identical.

The sandbox was deleted after recording the evidence.


##### Impact

A crafted wheel can cause setuptools to create a fixed-content
`__init__.py` outside the intended installation directory at a
filesystem path influenced by the wheel, with the permissions of the
process performing the installation.

The demonstrated reproduction required the target parent directory to
already exist.

#### Severity
- CVSS Score: 1.0 / 10 (Low)
- Vector String: `CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N`

#### References
- [https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w](https://redirect.github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w)
- [https://github.com/pypa/setuptools/pull/5329](https://redirect.github.com/pypa/setuptools/pull/5329)
- [https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af](https://redirect.github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af)
- [https://github.com/pypa/setuptools/releases/tag/v84.1.0](https://redirect.github.com/pypa/setuptools/releases/tag/v84.1.0)
- [https://github.com/advisories/GHSA-xmj3-9gf7-h52w](https://redirect.github.com/advisories/GHSA-xmj3-9gf7-h52w)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xmj3-9gf7-h52w) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description
[GHSA-xmj3-9gf7-h52w](https://redirect.github.com/advisories/GHSA-xmj3-9gf7-h52w)

<details>
<summary>More information</summary>

#### Details
##### Summary

On Windows, attacker-controlled content in a wheel's
`.dist-info/namespace_packages.txt` can cause setuptools' legacy wheel
installation path to create an `__init__.py` outside the requested
`destination_eggdir`.

The attacker can influence the destination path, but not the contents of
the created file.

##### Details

Tested setuptools commit:

`6ead555c5fb29bc57fe6105b1bffc163f56fd558`

Relevant source:

`setuptools/wheel.py`

SHA-256:

`359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd`

The relevant call path is:

`Wheel(wheel_path).install_as_egg(destination)`
→ `_install_as_egg`
→ `_convert_metadata`
→ `_fix_namespace_packages`

A wheel can provide attacker-controlled content in:

`<distribution>.dist-info/namespace_packages.txt`

The namespace value is eventually used approximately as:

```python
mod_dir = os.path.join(destination_eggdir, *mod.split('.'))
mod_init = os.path.join(mod_dir, '__init__.py')

If mod is a Windows drive-qualified absolute path containing no dots,
mod.split('.') preserves it as a single component.
On Windows, os.path.join(destination_eggdir, absolute_component) discards
the original base directory and resolves to the attacker-supplied absolute
path.
The existing wheel filename and ZIP traversal checks do not validate this
metadata value before it is subsequently interpreted as a filesystem path.

```markdown

##### PoC

The reproduction was performed entirely inside a disposable temporary
directory.

Layout:

```text
sandbox/
    destination/
    outside/
    input/
    canary.txt

A synthetic wheel was created containing:

demo_pkg-1.0.dist-info/namespace_packages.txt

whose content was the absolute path of:

sandbox\outside

The real acquired setuptools implementation was then invoked:

setuptools.wheel.Wheel(synthetic_wheel).install_as_egg(
    sandbox_destination
)

The operation completed without exception.

Expected metadata was created under:

sandbox\destination\EGG-INFO

but setuptools also created:

sandbox\outside\__init__.py

The file did not exist before execution.

Its contents were:

__import__('pkg_resources').declare_namespace(__name__)

The unrelated canary remained byte-identical.

The sandbox was deleted after recording the evidence.


##### Impact

A crafted wheel can cause setuptools to create a fixed-content
`__init__.py` outside the intended installation directory at a
filesystem path influenced by the wheel, with the permissions of the
process performing the installation.

The demonstrated reproduction required the target parent directory to
already exist.

#### Severity
- CVSS Score: 1.0 / 10 (Low)
- Vector String: `CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N`

#### References
- [https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w](https://redirect.github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w)
- [https://github.com/pypa/setuptools/pull/5329](https://redirect.github.com/pypa/setuptools/pull/5329)
- [https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af](https://redirect.github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af)
- [https://github.com/pypa/setuptools](https://redirect.github.com/pypa/setuptools)
- [https://github.com/pypa/setuptools/releases/tag/v84.1.0](https://redirect.github.com/pypa/setuptools/releases/tag/v84.1.0)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xmj3-9gf7-h52w) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>psf/black (black)</summary>

### [`v26.10.1`](https://redirect.github.com/psf/black/blob/HEAD/CHANGES.md#Version-26101)

[Compare Source](https://redirect.github.com/psf/black/compare/26.10.0...26.10.1)

##### Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that
use the action are encouraged to update to the latest version of Black immediately. This
update is received automatically when using `psf/black@stable`, and is independent of
the version of Black installed by the action.

When the GitHub Action reads version specifiers from `tool.black.required-version`, it
now only accepts released versions of Black, as it already did for `black` requirements
in dependency lists. Other values, such as URL references, are now rejected. This issue
has been registered as `GHSA-cg8m-r9f2-5wm2`; a CVE identifier is pending.

##### Stable style

- Fix a long Jupyter notebook assignment magic (for example `x = !ls -la`) being wrapped
  in parentheses, which IPython can no longer run; such cells are now left unchanged
  ([#&#8203;5481](https://redirect.github.com/psf/black/issues/5481))
- Keep repeated lines outside the selected `--line-ranges` unchanged ([#&#8203;5436](https://redirect.github.com/psf/black/issues/5436))
- Fix `--line-ranges` formatting lines that follow a statement when formatting joins or
  re-indents that statement ([#&#8203;5484](https://redirect.github.com/psf/black/issues/5484))
- Fix `--line-ranges` crashing with an internal error when an unselected statement has a
  `# fmt: skip` comment on the last line before a closing bracket ([#&#8203;5477](https://redirect.github.com/psf/black/issues/5477))
- Prevent moving an encoding declaration (for example `# -*- coding: latin-1 -*-`) onto
  the first two lines of a file ([#&#8203;5487](https://redirect.github.com/psf/black/issues/5487))
- Fix adding an extra trailing blank line inside a multi-line module docstring when its
  last line is near the line length limit ([#&#8203;5494](https://redirect.github.com/psf/black/issues/5494))
- Keep the parentheses around a walrus that is the only item in a set (for example
  `{(x := f())}`) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't
  parse it without them ([#&#8203;5502](https://redirect.github.com/psf/black/issues/5502))

##### Preview style

- Do not split short expressions on delimiters (such as binary operators, comparisons,
  or comprehensions) inside brackets when preceded by a standalone comment ([#&#8203;5455](https://redirect.github.com/psf/black/issues/5455))
- Fix the unstable `string_processing` feature removing backslash-newline sequences from
  raw strings, which changed their value ([#&#8203;5482](https://redirect.github.com/psf/black/issues/5482))
- Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in
  assignments (such as annotated assignments or subscript targets) ([#&#8203;5473](https://redirect.github.com/psf/black/issues/5473))
- Parenthesize expressions with parameter comments when they exceed the line length
  under `--preview` ([#&#8203;5442](https://redirect.github.com/psf/black/issues/5442))
- Fix `wrap_long_dict_values_in_parens` dropping the parentheses around a right-hand
  side that contains a dictionary, leaving a line over the length limit ([#&#8203;5492](https://redirect.github.com/psf/black/issues/5492))
- Fix the unstable `string_processing` feature adding a space after `*` or `**` in a PEP
  695 type parameter (`* Ts = ...`) when it splits a string in the parameter's default
  ([#&#8203;5504](https://redirect.github.com/psf/black/issues/5504))
- Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an
  earlier bracket split exceeds the line length only due to a trailing comment ([#&#8203;5498](https://redirect.github.com/psf/black/issues/5498))

##### Configuration

- Add `--cache-dir` to configure the cache directory from the command line ([#&#8203;5433](https://redirect.github.com/psf/black/issues/5433))
- Don't cache a file as formatted after formatting or checking it with `--line-ranges`,
  which made a later full `black --check` pass and `black` skip the unformatted lines
  ([#&#8203;5476](https://redirect.github.com/psf/black/issues/5476))
- Respect a `.gitignore` that starts with a UTF-8 byte order mark. The mark became part
  of the first pattern, so that pattern never matched and Black formatted files that git
  ignores ([#&#8203;5497](https://redirect.github.com/psf/black/issues/5497))

##### Performance

- Avoid quadratic runtime when splitting very long lines with many trailing bracket
  pairs (such as consecutive subscripts) ([#&#8203;5475](https://redirect.github.com/psf/black/issues/5475))

##### Integrations

- Fix the GitHub Action crashing on dependency-group includes when `use_pyproject` is
  enabled ([#&#8203;5479](https://redirect.github.com/psf/black/issues/5479))
- When the GitHub Action reads version specifiers from `tool.black.required-version`, it
  now only accepts released versions of Black, as it already did for `black`
  requirements in dependency lists. Other values, such as URL references, are now
  rejected. ([#&#8203;5510](https://redirect.github.com/psf/black/issues/5510))

### [`v26.10.0`](https://redirect.github.com/psf/black/blob/HEAD/CHANGES.md#Version-26100)

[Compare Source](https://redirect.github.com/psf/black/compare/26.5.1...26.10.0)

##### Stable style

- `--line-ranges` no longer inserts an empty line after a docstring when the range
  covers only the docstring itself ([#&#8203;5312](https://redirect.github.com/psf/black/issues/5312))
- Fix `# fmt: skip` on a bracketed ternary turning the surrounding tuple into a call
  ([#&#8203;5464](https://redirect.github.com/psf/black/issues/5464))
- Fix crash when `# fmt: skip` is placed on a one-line function or class with PEP 695
  type parameters ([#&#8203;5429](https://redirect.github.com/psf/black/issues/5429))
- Fix an inline comment after the closing bracket of optional parentheses being moved
  inside the parentheses when the parenthesized expression contains own-line comments
  ([#&#8203;5395](https://redirect.github.com/psf/black/issues/5395))
- Fix unparseable output when `# fmt: skip` is placed on a bracket of an `if`, `while`,
  `for`, or `with` header ([#&#8203;5401](https://redirect.github.com/psf/black/issues/5401), [#&#8203;5405](https://redirect.github.com/psf/black/issues/5405))
- Fix crash when formatting parenthesized expressions with multiple inline comments and
  `# fmt: skip` ([#&#8203;5414](https://redirect.github.com/psf/black/issues/5414))
- Fix parsing Jupyter notebook assignment magics when non-ASCII characters appear
  earlier on the line ([#&#8203;5381](https://redirect.github.com/psf/black/issues/5381))
- Preserve blank lines that come immediately before a `# fmt: on` comment ([#&#8203;5300](https://redirect.github.com/psf/black/issues/5300))
- Keep the parentheses around the target of an annotated assignment (e.g.
  `(x): int = 5`), which prevent CPython from including the name in `__annotations__`
  ([#&#8203;5321](https://redirect.github.com/psf/black/issues/5321))
- Stop treating a t-string in docstring position as a docstring (e.g. `t"  spam  "` as
  the first statement of a module, class or function) ([#&#8203;5287](https://redirect.github.com/psf/black/issues/5287))
- Fix unparseable output for a t-string whose replacement field contains a quote (e.g.
  `t'\'{a["b"]}\''`) ([#&#8203;5265](https://redirect.github.com/psf/black/issues/5265))
- Fix unparseable output for a triple-quoted string whose body ends in an
  already-escaped double quote (e.g. `'''\'''\"'''`) ([#&#8203;5262](https://redirect.github.com/psf/black/issues/5262))
- Fix `--skip-magic-trailing-comma` dropping the trailing comma from a split
  single-element tuple used as a lambda parameter default ([#&#8203;5246](https://redirect.github.com/psf/black/issues/5246))
- Fix unstable formatting when an inline comment sits on optional parentheses (e.g. a
  parenthesized assert message) ([#&#8203;5241](https://redirect.github.com/psf/black/issues/5241))
- Fix `--skip-magic-trailing-comma` dropping the trailing comma of a one-element
  subscript (`a[x,]`) when the line is long enough to be split and contains a power
  operator ([#&#8203;5272](https://redirect.github.com/psf/black/issues/5272))
- Fix crash when a standalone comment sits between tokens of a comprehension or lambda
  ([#&#8203;5144](https://redirect.github.com/psf/black/issues/5144))
- Fix inline comments on a bracket inside a comprehension being dropped ([#&#8203;5330](https://redirect.github.com/psf/black/issues/5330))
- Respect the magic trailing comma in a PEP 695 type parameter list containing a
  `*TypeVarTuple` or `**ParamSpec` ([#&#8203;5244](https://redirect.github.com/psf/black/issues/5244))
- Fix crash when a comment-only `# fmt: off`/`# fmt: on` block is followed by a `with`
  statement after another standalone comment ([#&#8203;5189](https://redirect.github.com/psf/black/issues/5189))
- Fix a crash when splitting `case case if ...` match patterns at very small line
  lengths ([#&#8203;5147](https://redirect.github.com/psf/black/issues/5147))
- Fix multiline docstring indentation when leading tabs are used inside indented
  docstrings ([#&#8203;5148](https://redirect.github.com/psf/black/issues/5148))
- Respect `# fmt: skip` on a line that opens a bracket (e.g.
  `from x import (  # fmt: skip`) when a standalone comment is among the bracket's
  contents ([#&#8203;5161](https://redirect.github.com/psf/black/issues/5161))
- Fix an AST safety error when separate `# type: ignore` comments in a parenthesized
  attribute chain were merged onto one physical line ([#&#8203;5297](https://redirect.github.com/psf/black/issues/5297))
- Preserve comments and blank lines outside requested ranges when formatting with
  `--line-ranges` ([#&#8203;5175](https://redirect.github.com/psf/black/issues/5175))
- Fix crash when `# fmt: skip` is used on one-line `async def`, `async with`, and
  `async for` statements containing a semicolon ([#&#8203;5311](https://redirect.github.com/psf/black/issues/5311))
- Stop converting form feeds or other similar characters in docstrings into newlines
  ([#&#8203;5461](https://redirect.github.com/psf/black/issues/5461))
- Fix `--skip-source-first-line` turning the skipped line's CRLF ending into `\r\r\n`
  when reformatting a file with CRLF line endings ([#&#8203;5438](https://redirect.github.com/psf/black/issues/5438))

##### Preview style

##### New preview features

- Add missing blank lines after classes whose last method has an ellipsis body ([#&#8203;5439](https://redirect.github.com/psf/black/issues/5439))
- Split only the brackets holding a magic trailing comma when more trailers follow them
  (e.g. stop splitting inside the `[2]` of `[1,][2](3)`) ([#&#8203;5448](https://redirect.github.com/psf/black/issues/5448))
- Keep dictionary keys containing operators together on one line when the value can be
  wrapped onto a new line instead ([#&#8203;5435](https://redirect.github.com/psf/black/issues/5435))
- Remove redundant parentheses around individual variables in unpacking targets (e.g.
  `for (x), (y) in points:` becomes `for x, y in points:`) ([#&#8203;5416](https://redirect.github.com/psf/black/issues/5416))
- Normalize uppercase `T` prefixes on t-strings to lowercase ([#&#8203;5425](https://redirect.github.com/psf/black/issues/5425))
- Remove redundant parentheses around generator expressions ([#&#8203;5304](https://redirect.github.com/psf/black/issues/5304), [#&#8203;5369](https://redirect.github.com/psf/black/issues/5369))
- Preserve two blank lines before a top-level class starting inside a `# fmt: off` block
  after an import ([#&#8203;5238](https://redirect.github.com/psf/black/issues/5238))
- Fix unnecessary parentheses around short right-hand expressions in indexed assignments
  (e.g. `x[key] = expr`) ([#&#8203;5095](https://redirect.github.com/psf/black/issues/5095))
- Parenthesize tuple expressions in `yield` statements for consistency with function
  calls and returns ([#&#8203;5170](https://redirect.github.com/psf/black/issues/5170))
- Stop splitting between a variable and its operator (`not in`, `==`, `is`, ...) when
  the right-hand side is a bracketed expression, and instead split inside the brackets
  ([#&#8203;5135](https://redirect.github.com/psf/black/issues/5135))
- In `.pyi` stub files, enforce a blank line after a function or method that has a
  docstring-only body when another comment or statement follows it ([#&#8203;5158](https://redirect.github.com/psf/black/issues/5158))

##### Updates to existing preview features

- Fix crash in stub files when `# fmt: skip` is placed on a function in a group of
  same-name decorated functions (e.g. `@overload`s or a property setter) ([#&#8203;5430](https://redirect.github.com/psf/black/issues/5430))
- Keep the parentheses around a lambda used as the iterable of a comprehension (e.g.
  `[x for x in (lambda: 0) if x]`) ([#&#8203;5176](https://redirect.github.com/psf/black/issues/5176), [#&#8203;5200](https://redirect.github.com/psf/black/issues/5200))

##### Updates to existing unstable features

- Do not treat multi-line expressions with merged strings and trailing `# type: ignore`
  comments as single-line unsplittable expressions ([#&#8203;5466](https://redirect.github.com/psf/black/issues/5466))
- Fix duplicated inline comment when stripping the parentheses around a string or
  merging a backslash-continued string on the same line ([#&#8203;5449](https://redirect.github.com/psf/black/issues/5449))
- Split long stringified return annotations even when the function has parameters
  ([#&#8203;5427](https://redirect.github.com/psf/black/issues/5427))
- Don't hug brackets when doing so would join two `# type: ignore` comments onto one
  line ([#&#8203;5271](https://redirect.github.com/psf/black/issues/5271))
- Fix a crash when `# type: ignore` is lost during formatting of a long parenthesized
  string ([#&#8203;5329](https://redirect.github.com/psf/black/issues/5329))
- Fix only the first part of an implicitly concatenated unmergeable string (e.g.
  `r"..." r"..."`) being wrapped in parentheses ([#&#8203;5434](https://redirect.github.com/psf/black/issues/5434))

##### Configuration

- Add support for `NO_COLOR` environment variable to disable ANSI output ([#&#8203;5129](https://redirect.github.com/psf/black/issues/5129))
- Remove spurious target version warning when runtime version is included in a
  `--target-version` flag ([#&#8203;5167](https://redirect.github.com/psf/black/issues/5167))
- Fix `--force-exclude` not excluding files whose path contains `..` (e.g.
  `black ../generated/file.py` run from a subdirectory) ([#&#8203;5471](https://redirect.github.com/psf/black/issues/5471))
- Fall back to the default configuration, with a warning, when the given sources share
  no common project root (e.g. they are on different drives on Windows) instead of
  crashing ([#&#8203;5386](https://redirect.github.com/psf/black/issues/5386))
- Fix loading a stale cached `pyproject.toml` path when `--code` is used from different
  working directories in the same process ([#&#8203;5152](https://redirect.github.com/psf/black/issues/5152))
- Add validation for `--line-ranges` values ([#&#8203;5107](https://redirect.github.com/psf/black/issues/5107))
- Ignore empty cache files instead of raising an `EOFError` ([#&#8203;5192](https://redirect.github.com/psf/black/issues/5192))
- Reject non-string `include` and `force-exclude` values in `pyproject.toml` ([#&#8203;5193](https://redirect.github.com/psf/black/issues/5193))
- Validate `BLACK_NUM_WORKERS` values and report invalid values as usage errors instead
  of crashing ([#&#8203;5211](https://redirect.github.com/psf/black/issues/5211))
- Ignore permission errors when reading cache ([#&#8203;5258](https://redirect.github.com/psf/black/issues/5258))

##### Packaging

- Reduce the size of Linux standalone binaries by stripping debug symbols during the
  PyInstaller release build ([#&#8203;5223](https://redirect.github.com/psf/black/issues/5223))
- Black is now released using GitHub
  [Immutable Releases](https://docs.github.com/code-security/concepts/supply-chain-security/immutable-releases)
  ([#&#8203;5296](https://redirect.github.com/psf/black/issues/5296))

##### Performance

- Fix superlinear runtime growth with the number of input files ([#&#8203;5450](https://redirect.github.com/psf/black/issues/5450))
- Improve performance on strings containing many consecutive backslashes ([#&#8203;5163](https://redirect.github.com/psf/black/issues/5163))
- Improve performance on files with many `# fmt: skip`/`# fmt: off`/`# fmt: on` comments
  ([#&#8203;5169](https://redirect.github.com/psf/black/issues/5169), [#&#8203;5190](https://redirect.github.com/psf/black/issues/5190), [#&#8203;5232](https://redirect.github.com/psf/black/issues/5232))
- Improve performance on long calls and collections ([#&#8203;5177](https://redirect.github.com/psf/black/issues/5177))
- Improve performance on multiline strings inside large collections (e.g. a dict literal
  with triple-quoted strings as values) ([#&#8203;5188](https://redirect.github.com/psf/black/issues/5188))
- Improve performance on files with many soft keywords (e.g. `match`/`case` blocks)
  ([#&#8203;5186](https://redirect.github.com/psf/black/issues/5186))
- Improve performance on long semicolon-separated statements (in the stable style) and
  large dict literals (in `--preview`) ([#&#8203;5184](https://redirect.github.com/psf/black/issues/5184))
- Improve performance of `--line-ranges` on files with many sibling blocks (a long
  `if`/`elif` chain, a `match` with many cases, or many top-level definitions) ([#&#8203;5213](https://redirect.github.com/psf/black/issues/5213))
- Improve performance on deeply nested bracketed expressions ([#&#8203;5171](https://redirect.github.com/psf/black/issues/5171), [#&#8203;5242](https://redirect.github.com/psf/black/issues/5242))
- Improve performance on lists and subscripts holding one long expression without
  operators (e.g. a long run of implicitly concatenated strings inside `[]`) ([#&#8203;5239](https://redirect.github.com/psf/black/issues/5239))
- Improve performance on deeply chained operations (e.g. a long `a ** b ** c ** ...`
  chain) ([#&#8203;5235](https://redirect.github.com/psf/black/issues/5235))
- Improve performance on long `if`/`elif` chains and other compound statements with many
  clauses ([#&#8203;5322](https://redirect.github.com/psf/black/issues/5322))
- Improve performance of `string_processing`:
  - when merging implicitly concatenated f-strings containing long string literals
    ([#&#8203;5165](https://redirect.github.com/psf/black/issues/5165))
  - when merging long implicitly concatenated strings ([#&#8203;5173](https://redirect.github.com/psf/black/issues/5173), [#&#8203;5194](https://redirect.github.com/psf/black/issues/5194))
  - when rewriting large nodes (e.g. `"%s ..." % (a, b, c, ...)`) ([#&#8203;5178](https://redirect.github.com/psf/black/issues/5178), [#&#8203;5199](https://redirect.github.com/psf/black/issues/5199), [#&#8203;5220](https://redirect.github.com/psf/black/issues/5220))
  - when splitting long string literals ([#&#8203;5183](https://redirect.github.com/psf/black/issues/5183))

##### Output

- Report parser failures using editor-friendly `path:line:column` locations ([#&#8203;5237](https://redirect.github.com/psf/black/issues/5237))
- Fix crash when writing formatted code or diffs to a `sys.stdout` that has no `buffer`
  attribute (e.g. in Jupyter notebooks) ([#&#8203;5411](https://redirect.github.com/psf/black/issues/5411))
- Report parse failures on Black's own output as internal errors ([#&#8203;5383](https://redirect.github.com/psf/black/issues/5383))

##### *Blackd*

- Return HTTP 400 instead of 500 when the `X-Python-Variant` header is empty or has an
  empty entry (e.g. a trailing comma) ([#&#8203;5428](https://redirect.github.com/psf/black/issues/5428))
- Allow optional whitespace around comma-separated versions and `pyi` in the
  `X-Python-Variant` header ([#&#8203;5441](https://redirect.github.com/psf/black/issues/5441))

##### Integrations

- Remove unused `migrate-black` script ([#&#8203;5319](https://redirect.github.com/psf/black/issues/5319))
- Support PEP 440 version specifiers in `tool.black.required-version` for the GitHub
  Action ([#&#8203;5399](https://redirect.github.com/psf/black/issues/5399))
- Add outputs (`is_formatted`, `change_count`, `same_count`, `failure_count`) to GitHub
  Action runs ([#&#8203;5408](https://redirect.github.com/psf/black/issues/5408))

##### Documentation

- Document `vim-python-pep8-indent`, which provides an `indentexpr` for Black-style
  insert-mode indentation ([#&#8203;5288](https://redirect.github.com/psf/black/issues/5288))

</details>

<details>
<summary>pypa/setuptools (setuptools)</summary>

### [`v84.1.0`](https://redirect.github.com/pypa/setuptools/compare/v84.0.0...v84.1.0)

[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v84.0.0...v84.1.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone UTC)

- Branch creation
  - "before 4am"
- Automerge
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ansible/ansible-dev-tools).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaG9yZSIsImRlcGVuZGVuY2llcyIsImZpeCJdfQ==-->

coderabbitai · 2026-10-23T03:13:19Z

_{Comment @coderabbitai help to get the list of available commands.}

renovate Bot requested a review from a team as a code owner October 23, 2026 03:12

renovate Bot added chore dependencies fix labels Oct 23, 2026

github-project-automation Bot added this to 🧰 devtools project board Oct 23, 2026

renovate Bot enabled auto-merge (squash) October 23, 2026 03:12

fix(security): update dependencies [SECURITY]

673b551

renovate Bot force-pushed the renovate/security branch from 6442dca to 673b551 Compare October 24, 2026 01:36

Navigation Menu

Repository navigation

fix(security): update dependencies [SECURITY] - #812

fix(security): update dependencies [SECURITY]#812
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/security

renovate Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Black: GitHub Action installs unvalidated required-version from pyproject.toml

Details

Summary

Details

Proof of concept

Impact

Severity

References

Black: GitHub Action installs unvalidated required-version from pyproject.toml

Details

Summary

Details

Proof of concept

Impact

Severity

References

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

Details

Summary

Details

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 23, 2026 •

edited

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading