Repository navigation
Fix GitHub Action crash on dependency-group includes - #5479
Merged
Merged
Conversation
find_black_version_in_array() called .split() on every entry, so an
{include-group = "..."} table in [dependency-groups] raised AttributeError
when use_pyproject is enabled. Skip non-string entries; every group is
already scanned on its own, so included groups are still checked.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
luketainton
pushed a commit
to luketainton/luke_instant-msg-api
that referenced
this pull request
Oct 10, 2026
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [black](https://github.com/psf/black) ([changelog](https://github.com/psf/black/blob/main/CHANGES.md)) | `<26.10.1,>=26.10.0` β `<26.10.2,>=26.10.1` |  |  | --- ### Release Notes <details> <summary>psf/black (black)</summary> ### [`v26.10.1`](https://github.com/psf/black/blob/HEAD/CHANGES.md#Version-26101) [Compare Source](psf/black@26.10.0...26.10.1) ##### Highlights This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using `psf/black@stable`, and is independent of the version of Black installed by the action. When the GitHub Action reads version specifiers from `tool.black.required-version`, it now only accepts released versions of Black, as it already did for `black` requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as `GHSA-cg8m-r9f2-5wm2`; a CVE identifier is pending. ##### Stable style - Fix a long Jupyter notebook assignment magic (for example `x = !ls -la`) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged ([#​5481](psf/black#5481)) - Keep repeated lines outside the selected `--line-ranges` unchanged ([#​5436](psf/black#5436)) - Fix `--line-ranges` formatting lines that follow a statement when formatting joins or re-indents that statement ([#​5484](psf/black#5484)) - Fix `--line-ranges` crashing with an internal error when an unselected statement has a `# fmt: skip` comment on the last line before a closing bracket ([#​5477](psf/black#5477)) - Prevent moving an encoding declaration (for example `# -*- coding: latin-1 -*-`) onto the first two lines of a file ([#​5487](psf/black#5487)) - Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit ([#​5494](psf/black#5494)) ##### Preview style - Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment ([#​5455](psf/black#5455)) - Fix the unstable `string_processing` feature removing backslash-newline sequences from raw strings, which changed their value ([#​5482](psf/black#5482)) - Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) ([#​5473](psf/black#5473)) - Parenthesize expressions with parameter comments when they exceed the line length under `--preview` ([#​5442](psf/black#5442)) - Fix `wrap_long_dict_values_in_parens` dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit ([#​5492](psf/black#5492)) - Fix the unstable `string_processing` feature adding a space after `*` or `**` in a PEP 695 type parameter (`* Ts = ...`) when it splits a string in the parameter's default ([#​5504](psf/black#5504)) - Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment ([#​5498](psf/black#5498)) ##### Configuration - Add `--cache-dir` to configure the cache directory from the command line ([#​5433](psf/black#5433)) - Don't cache a file as formatted after formatting or checking it with `--line-ranges`, which made a later full `black --check` pass and `black` skip the unformatted lines ([#​5476](psf/black#5476)) - Respect a `.gitignore` that starts with a UTF-8 byte order mark. The mark became part of the first pattern, so that pattern never matched and Black formatted files that git ignores ([#​5497](psf/black#5497)) ##### Performance - Avoid quadratic runtime when splitting very long lines with many trailing bracket pairs (such as consecutive subscripts) ([#​5475](psf/black#5475)) ##### Integrations - Fix the GitHub Action crashing on dependency-group includes when `use_pyproject` is enabled ([#​5479](psf/black#5479)) - When the GitHub Action reads version specifiers from `tool.black.required-version`, it now only accepts released versions of Black, as it already did for `black` requirements in dependency lists. Other values, such as URL references, are now rejected. ([#​5510](psf/black#5510)) </details> --- ### Configuration π **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) π¦ **Automerge**: Enabled. β» **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. π **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNDkuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE0OS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==--> Reviewed-on: https://git.tainton.uk/luke/instant-msg-api/pulls/292 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
With
use_pyproject: true, the GitHub Action crashes before installing Black when any[dependency-groups]array contains an{include-group = "..."}table, which thedependency-groups specification
allows (Black's own
pyproject.tomluses them):find_black_version_in_array()calls.split(";")on every entry. Becauseread_version_specifier_from_pyproject()already scans every dependency group (and thenproject.dependencies/ optional dependencies), an included group is checked on its own,so the fix only needs to skip non-string entries. Lookup order and version handling are
unchanged; this does not add include resolution or combine specifiers across groups
(deliberately deferred in #4606).
The crash also happens when an unrelated earlier group contains an include and the Black
pin lives in a later group or in
project.dependencies.Tests:
tests/test_github_action.pyruns the wholeaction/main.pyentrypoint viarunpywithsubprocess.runmocked, and checks the requirement passed topip installand the formatter invocation. Cases cover includes before/after a pin, a pin inside the
included group, an unrelated include before a
project.dependenciespin, plain projectpins, extras + markers, and the existing "unpinned" / "missing" error paths. Four of the
eight cases fail with the
AttributeErrorabove without the fix.AI assistance (OpenAI Codex / Claude) was used to investigate and prepare this change; the
diff was reviewed before submission.
Checklist - did you ...
--previewstyle, following the stability policy? (not a style change)CHANGES.mdif necessary?