Path to this page:
Subject: CVS commit: pkgsrc/textproc/py-black
From: Adam Ciarcinski
Date: 2024-03-16 18:46:08
Message id: 20240316174609.0F477FA2C@cvs.NetBSD.org
Log Message:
py-black: updated to 24.3.0
24.3.0
Highlights
This release is a milestone: it fixes Black's first CVE security vulnerability. \
If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade \
immediately to fix
[CVE-2024-21503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21503).
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
- Don't move comments along with delimiters, which could cause crashes
- Strengthen AST safety check to catch more unsafe changes to strings. Previous \
versions
of Black would incorrectly format the contents of certain unusual f-strings \
containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented.
- Fix a bug where line-ranges exceeding the last code line would not work as expected
Performance
- Fix catastrophic performance on docstrings that contain large numbers of \
leading tab
characters. This fixes
[CVE-2024-21503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21503).
Documentation
- Note what happens when `--check` is used with `--quiet`
Files: