chore(deps): update dependency pylint to v4.1.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	OpenSSF
pylint (changelog)	dependency-groups	minor	==4.0.8 → ==4.1.1	4.1.2

---

Release Notes

pylint-dev/pylint (pylint)

v4.1.1

Compare Source

What's new in Pylint 4.1.1?

Release date: 2026-09-29

Other Changes

• Pylint 4.1.0 could not be uploaded to PyPI, because it required an unreleased
  version of dill on Python 3.15, and PyPI refuses such a dependency. 4.1.1 is
  the first 4.1 release available on PyPI, see the 4.1.0 changes below.

  Refs #​11495

v4.0.10

Compare Source

What's new in Pylint 4.0.10?

Release date: 2026-09-29

False Positives Fixed

• Fix false positives for :ref:unnecessary-lambda when a variable referenced in
  the called expression is assigned, reassigned, or deleted later in the same scope.

  Closes #​8192

• Fix a false positive for unused-argument in dataclass __new__ methods
  when the arguments are consumed by a generated __init__ method.

  Closes #​9843

• Fix a false positive for missing-kwoa when keyword-only arguments are passed
  through a **kwargs dictionary that is not a literal at the call site, for
  example one filled with options["key"] = value after its creation.

  Closes #​10029

• ungrouped-imports no longer reports imports inside mutually exclusive
  OS guard branches (if os.name == "nt": / if sys.platform == "win32":),
  matching the existing behavior for sys.version_info guards.

  Closes #​10460

Other Bug Fixes

• A TypeError crash could occur when checking a for loop that
  iterates over a subscript with non-numeric constant bounds or a zero
  step, e.g. for a, b in {"k": [][0: ""]}.values():.

  Closes #​11472

• Fix a crash (AttributeError: 'ClassDef' object has no attribute 'expr') in the
  import-private-name extension when an annotated assignment's value is an
  attribute access on a call rooted at a non-Name node, e.g. x: str = ''().a.

  Closes #​11479

v4.0.9

Compare Source

What's new in Pylint 4.0.9?

Release date: 2026-09-23

Security Fixes

• Someone without access to the configuration or linted code, but with access
  to the cache directory (predictable PYLINT_HOME on a multi-user host) can no
  longer write a crafted pickle that will runs arbitrary code when pylint access its
  stat cache. The result cache is now stored as JSON instead of pickle,
  preventing code-execution. The workaround is upgrading or not pointing PYLINT_HOME
  to an untrusted, shared, or group-writable directory. The default value, ~/.cache/pylint,
  is writable only by the user running pylint. (CVE with the same information pending)

False Positives Fixed

• Fixed a false positive for no-self-use on a method that only uses
  self before a locally defined class (or other nested method), because
  the checker's could-be-a-function tracking state was not restored after
  visiting the nested method.

  Closes #​3705

• Fix a false positive for :ref:not-callable when calling functions constructed with
  types.FunctionType or types.LambdaType.

  Closes #​7500

• Fix a false positive for unnecessary-direct-lambda-call when a directly called
  lambda in a class body wraps a comprehension containing an assignment expression.
  PEP 572 makes that a SyntaxError without the lambda's scope, so following the
  message produced code that would not compile.

  Closes #​9294

• Fix a false positive for :ref:unnecessary-ellipsis when an ellipsis is the
  sole body statement of a method defined on a Protocol.

  Closes #​9319

• Fix a false positive for :ref:bad-exception-cause when the bases of the class
  being raised from cannot be inferred, such as an exception deriving from a
  C extension class. :ref:raising-non-exception and
  :ref:catching-non-exception already guard the same inherit_from_std_ex
  helper with has_known_bases.

  Refs #​11399

False Negatives Fixed

• method-hidden is no longer silenced when the hidden method shares its name with
  a builtin function or with a function defined at module level. Only members of the
  ancestor classes themselves can excuse the method now.

  Refs #​11361

Other Bug Fixes

• Fix a block-scoped # pylint: disable= directive placed inside an if
  body leaking into sibling elif/else blocks for messages such as
  stop-iteration-return, which default to a line-based (rather than
  node-based) message scope.

  Closes #​3136

• Fix a false positive for declare-non-slot when a class variable is
  annotated with ClassVar without an initial value.

  Closes #​9950

• Fix a crash in the no-member checker when attribute lookup raises an
  InferenceError.

  Closes #​11356

• Fix a crash in the unnecessary-default-type-args check when a Generator
  or AsyncGenerator subscript holds an empty tuple, such as Generator[()].

  Closes #​11357

• Fix a crash in method-hidden when a method shadows a name that builtins
  binds to a node without a statement, such as help or license. Every class
  inherits from object, which lives in the builtins module, so no base class
  was needed to trigger it.

  Closes #​11361
  Closes #​8079

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.