Bump black from 23.12.1 to 26.3.1

[dependabot]

Bumps black from 23.12.1 to 26.3.1.

Release notes

Sourced from black's releases.

26.3.1

Stable style

• Prevent Jupyter notebook magic masking collisions from corrupting cells by using exact-length placeholders for short magics and aborting if a placeholder can no longer be unmasked safely (#5038)

Configuration

• Always hash cache filename components derived from --python-cell-magics so custom magic names cannot affect cache paths (#5038)

Blackd

• Disable browser-originated requests by default, add configurable origin allowlisting and request body limits, and bound executor submissions to improve backpressure (#5039)

26.3.0

Stable style

• Don't double-decode input, causing non-UTF-8 files to be corrupted (#4964)
• Fix crash on standalone comment in lambda default arguments (#4993)
• Preserve parentheses when # type: ignore comments would be merged with other comments on the same line, preventing AST equivalence failures (#4888)

Preview style

• Fix bug where if guards in case blocks were incorrectly split when the pattern had a trailing comma (#4884)
• Fix string_processing crashing on unassigned long string literals with trailing commas (one-item tuples) (#4929)
• Simplify implementation of the power operator "hugging" logic (#4918)

Packaging

• Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in frozen environments (#4930)

Performance

• Introduce winloop for windows as an alternative to uvloop (#4996)
• Remove deprecated function uvloop.install() in favor of uvloop.new_event_loop() (#4996)
• Rename maybe_install_uvloop function to maybe_use_uvloop to simplify loop installation and creation of either a uvloop/winloop evenloop or default eventloop (#4996)

Output

... (truncated)

Changelog

Sourced from black's changelog.

26.3.1

Stable style

• Prevent Jupyter notebook magic masking collisions from corrupting cells by using exact-length placeholders for short magics and aborting if a placeholder can no longer be unmasked safely (#5038)

Configuration

• Always hash cache filename components derived from --python-cell-magics so custom magic names cannot affect cache paths (#5038)

Blackd

• Disable browser-originated requests by default, add configurable origin allowlisting and request body limits, and bound executor submissions to improve backpressure (#5039)

26.3.0

Stable style

• Don't double-decode input, causing non-UTF-8 files to be corrupted (#4964)
• Fix crash on standalone comment in lambda default arguments (#4993)
• Preserve parentheses when # type: ignore comments would be merged with other comments on the same line, preventing AST equivalence failures (#4888)

Preview style

• Fix bug where if guards in case blocks were incorrectly split when the pattern had a trailing comma (#4884)
• Fix string_processing crashing on unassigned long string literals with trailing commas (one-item tuples) (#4929)
• Simplify implementation of the power operator "hugging" logic (#4918)

Packaging

• Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in frozen environments (#4930)

Performance

• Introduce winloop for windows as an alternative to uvloop (#4996)
• Remove deprecated function uvloop.install() in favor of uvloop.new_event_loop() (#4996)
• Rename maybe_install_uvloop function to maybe_use_uvloop to simplify loop installation and creation of either a uvloop/winloop evenloop or default eventloop (#4996)

... (truncated)

Commits

• c6755bb Prepare release 26.3.1 (#5046)
• 69973fd Harden blackd browser-facing request handling (#5039)
• 4937fe6 Fix some shenanigans with the cache file and IPython (#5038)
• 2e641d1 docs: remove outdated Black Playground references (#5044)
• c014b22 Remove unused internal code (#5041)
• 0dae20b Add new changelog (#5036)
• c5c1cbd Minor release patches (#5035)
• 7e5a828 docs: clarify relationship between Black style and PEP 8 (#5025)
• 69705de docs: add clearer pyproject configuration guidance (#5026)
• 35ea679 Prepare release 26.3.0 (#5032)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

This PR bumps the black dev dependency from 23.12.1 to 26.3.1, covering over two years of releases including bug fixes for non-UTF-8 file corruption, Jupyter notebook magic masking, and several crash fixes. The change is low-risk since black is a dev-only formatter tool with no impact on production code.

Key changes included in this bump:

• pyproject.toml: Version constraint widened from ^23.3.0 to >=23.3,<27.0 to allow the major version jump.
• poetry.lock: black's minimum Python requirement raised from >=3.8 to >=3.10 — the project already constrains to >=3.10,<3.12, so this is compatible.
• New transitive dependency pytokens 0.4.1 introduced (a fast Python tokenizer used internally by black).
• pathspec bumped from 0.12.1 to 1.0.4 (minimum requirement raised from >=0.9.0 to >=1.0.0).
• Lock file was regenerated with Poetry 2.2.1 (previously 2.1.1), which may require team members to update their local Poetry installation.

Confidence Score: 5/5

• This PR is safe to merge — it only updates a dev-only code formatter with no production impact.
• Black is a dev-only dependency used solely for code formatting. The project already requires Python >=3.10, which satisfies black 26.3.1's minimum requirement of >=3.10. All changes are confined to the lockfile and version constraint. No production code is affected.
• No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Black version constraint loosened from ^23.3.0 to >=23.3,<27.0 to accommodate the major version bump to 26.3.1.
poetry.lock	Lock file regenerated with Poetry 2.2.1 (up from 2.1.1); black bumped to 26.3.1, pathspec bumped to 1.0.4, and new transitive dependency pytokens 0.4.1 added.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[black 26.3.1] --> B[click >=8.0.0]
    A --> C[mypy-extensions >=0.4.3]
    A --> D[packaging >=22.0]
    A --> E[pathspec >=1.0.0\nnew: 1.0.4]
    A --> F[platformdirs >=2]
    A --> G[pytokens >=0.4.0,<0.5.0\nNEW dependency]
    A --> H[tomli - python < 3.11]
    A --> I[typing-extensions - python < 3.11]

    style G fill:#f90,color:#000
    style E fill:#ffe,color:#000

Loading

_{Last reviewed commit: c604fd6}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pathspec@​0.12.1 ⏵ 1.0.4	+1
	pytokens@​0.4.1

View full report