chore(deps): bump black from 25.1.0 to 26.3.1 in the uv group across 1 directory#2290
chore(deps): bump black from 25.1.0 to 26.3.1 in the uv group across 1 directory#2290dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps the uv group with 1 update in the / directory: [black](https://github.com/psf/black). Updates `black` from 25.1.0 to 26.3.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](psf/black@25.1.0...26.3.1) --- updated-dependencies: - dependency-name: black dependency-version: 26.3.1 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
LGTM — routine Dependabot bump of a dev-only transitive dependency.
Extended reasoning...
Overview
This is a Dependabot-generated PR that only modifies uv.lock. It bumps black from 25.1.0 to 26.3.1, along with its transitive dependencies: pathspec (0.12.1 → 1.0.4) and a new transitive dependency pytokens (0.4.1). No application code is touched.
Security risks
None. black is not a direct dependency of this project — it is pulled in transitively by pytest-examples (a dev dependency used for formatting verification in tests). The upstream changelog for black 26.3.x notes security hardening fixes (blackd request handling, cache path sanitization), which are improvements, not regressions. All wheels are fetched from PyPI with pinned SHA256 hashes.
Level of scrutiny
Low. This is a purely mechanical lockfile update for a dev-only tooling dependency. black is never loaded at runtime or shipped to consumers of the SDK — it only runs during test execution via pytest-examples. CI will catch any formatting/compatibility regressions.
Other factors
No prior reviews or outstanding comments on this PR. The diff structure is exactly what uv produces for a version bump. There are no manual edits or unexpected additions beyond the declared dependency graph.
Bumps the uv group with 1 update in the / directory: black.
Updates
blackfrom 25.1.0 to 26.3.1Release notes
Sourced from black's releases.
... (truncated)
Changelog
Sourced from black's changelog.
... (truncated)
Commits
c6755bbPrepare release 26.3.1 (#5046)69973fdHarden blackd browser-facing request handling (#5039)4937fe6Fix some shenanigans with the cache file and IPython (#5038)2e641d1docs: remove outdated Black Playground references (#5044)c014b22Remove unused internal code (#5041)0dae20bAdd new changelog (#5036)c5c1cbdMinor release patches (#5035)7e5a828docs: clarify relationship between Black style and PEP 8 (#5025)69705dedocs: add clearer pyproject configuration guidance (#5026)35ea679Prepare release 26.3.0 (#5032)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.