Skip to content

build(deps): bump black from 25.9.0 to 26.3.1 - #22

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/black-26.3.1
Open

build(deps): bump black from 25.9.0 to 26.3.1#22
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/black-26.3.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps black from 25.9.0 to 26.3.1.

Release notes

Sourced from black's releases.

26.3.1

Stable style

  • Prevent Jupyter notebook magic masking collisions from corrupting cells by using exact-length placeholders for short magics and aborting if a placeholder can no longer be unmasked safely (#5038)

Configuration

  • Always hash cache filename components derived from --python-cell-magics so custom magic names cannot affect cache paths (#5038)

Blackd

  • Disable browser-originated requests by default, add configurable origin allowlisting and request body limits, and bound executor submissions to improve backpressure (#5039)

26.3.0

Stable style

  • Don't double-decode input, causing non-UTF-8 files to be corrupted (#4964)
  • Fix crash on standalone comment in lambda default arguments (#4993)
  • Preserve parentheses when # type: ignore comments would be merged with other comments on the same line, preventing AST equivalence failures (#4888)

Preview style

  • Fix bug where if guards in case blocks were incorrectly split when the pattern had a trailing comma (#4884)
  • Fix string_processing crashing on unassigned long string literals with trailing commas (one-item tuples) (#4929)
  • Simplify implementation of the power operator "hugging" logic (#4918)

Packaging

  • Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in frozen environments (#4930)

Performance

  • Introduce winloop for windows as an alternative to uvloop (#4996)
  • Remove deprecated function uvloop.install() in favor of uvloop.new_event_loop() (#4996)
  • Rename maybe_install_uvloop function to maybe_use_uvloop to simplify loop installation and creation of either a uvloop/winloop evenloop or default eventloop (#4996)

Output

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.3.1

Stable style

  • Prevent Jupyter notebook magic masking collisions from corrupting cells by using exact-length placeholders for short magics and aborting if a placeholder can no longer be unmasked safely (#5038)

Configuration

  • Always hash cache filename components derived from --python-cell-magics so custom magic names cannot affect cache paths (#5038)

Blackd

  • Disable browser-originated requests by default, add configurable origin allowlisting and request body limits, and bound executor submissions to improve backpressure (#5039)

Version 26.3.0

Stable style

  • Don't double-decode input, causing non-UTF-8 files to be corrupted (#4964)
  • Fix crash on standalone comment in lambda default arguments (#4993)
  • Preserve parentheses when # type: ignore comments would be merged with other comments on the same line, preventing AST equivalence failures (#4888)

Preview style

  • Fix bug where if guards in case blocks were incorrectly split when the pattern had a trailing comma (#4884)
  • Fix string_processing crashing on unassigned long string literals with trailing commas (one-item tuples) (#4929)
  • Simplify implementation of the power operator "hugging" logic (#4918)

Packaging

  • Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in frozen environments (#4930)

Performance

  • Introduce winloop for windows as an alternative to uvloop (#4996)
  • Remove deprecated function uvloop.install() in favor of uvloop.new_event_loop() (#4996)
  • Rename maybe_install_uvloop function to maybe_use_uvloop to simplify loop installation and creation of either a uvloop/winloop eventloop or default eventloop (#4996)

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 25, 2026
@dependabot
build(deps): bump black from 25.9.0 to 26.3.1
323cf0b 
Bumps [black](https://github.com/psf/black) from 25.9.0 to 26.3.1.
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@25.9.0...26.3.1)

---
updated-dependencies:
- dependency-name: black
  dependency-version: 26.3.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/black-26.3.1 branch from d233cab to 323cf0b Compare July 25, 2026 12:50
ourway added a commit that referenced this pull request Jul 31, 2026
@ourway @claude
fix(docs): quickstart now succeeds on a post-3.0.0 namespace; smoke a…
805fa3b 
…sserts both directions (issuedb #22)

Found while releasing 3.0.1: `make publish` aborted because the pre-publish
smoke test failed at add_membership. Confirmed NOT a 3.0.1 regression — the
released 3.0.0 wheel reproduces it identically.

Reproduced against the LIVE service, exactly as the README instructed a new user
to proceed:

    POST /api/role/engineers              -> 200
    POST /api/permission/engineers/deploy -> 200
    POST /api/membership/alice/engineers  -> 409 user_not_key_backed

The 409 is CORRECT and stays: strict user identity is the default for namespaces
created after 3.0.0 (SPEC 0008/0012), and this is the refusal shape runflow
asked for in 2.5.1. The defect is that the documented onboarding path predates
the flip and never taught the step that satisfies it, so every brand-new user
hit a wall on step 3 while grandfathering kept all 181 existing tenants working.

This is the consumer-facing instance of the hazard runflow described on
thr-00ea026de72c4dcab1d9 — a fresh namespace is strict from birth and RBAC is
dead on arrival. They found it in their environment-rebuild path; the same blind
spot was in our own front door.

Both supported paths are now documented in README.md and in all three quickstart
blocks of auth/docs_page.py (landing /, /claude, Python client section):

  1. key-first (default): POST /api/apikeys/user/<user> before the grant; the
     returned secret need not be kept if only the identity must exist
  2. opt-out: PUT /api/settings {"strict_users": false}, once per namespace, for
     consumers whose users can never hold auth keys

Each block says why the step exists and that the 409 is permanent, not a
transport fault, so retries never help.

scripts/smoke_install.sh now mirrors the documented sequence and asserts BOTH
directions: the keyless grant must be refused, then key issuance must release
exactly that block. A quickstart that cannot succeed now fails the release —
which is what would have caught this before 3.0.0 shipped.

Endpoint shapes were verified against the SERVED API before being written down,
not read off the source. That caught a real error in the first draft:
/api/settings is PUT, not POST. Live confirmation on fresh namespaces —
key-first path 200/200/200/200/true, and opt-out path 200 then
role/permission/membership/has_permission all 200 with no key ever issued.

ruff, mypy, 214 unit tests green; smoke passes on the built 3.0.1 wheel.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants