[dependabot]

Bumps the python-packages group with 12 updates:

Package	From	To
pyarrow	25.0.1	26.0.0
duckdb	1.5.5	1.5.6
linkml	1.11.1	1.12.1
linkml-runtime	1.11.1	1.12.1
pillow	12.3.0	13.0.0
poethepoet	0.48.0	0.49.0
pre-commit	4.6.2	4.7.0
ruff	0.16.9	0.17.2
pydata-sphinx-theme	0.21.0	0.23.0
black	26.5.1	26.10.1
isort	9.0.1	9.0.2
jupytext	1.19.5	1.19.6

Updates pyarrow from 25.0.1 to 26.0.0

Release notes

Sourced from pyarrow's releases.

Apache Arrow 26.0.0

Release Notes URL: https://arrow.apache.org/release/26.0.0.html

Apache Arrow 26.0.0 RC0

Release Notes: Release Candidate: 26.0.0 RC0

Commits

• 4461671 MINOR: [Release] Update versions for 26.0.0
• 9d03a26 MINOR: [Release] Update .deb/.rpm changelogs for 26.0.0
• 5ce3c95 MINOR: [Release] Update CHANGELOG.md for 26.0.0
• 28e6c67 GH-51687: [C++] Skipt tests that require threads if ARROW_ENABLE_THREADING=OF...
• 12409f8 GH-51682: [CI][C++] Add liburiparser-dev to system dependency image (#51683)
• 1deceed GH-51675: [Python][Packaging] Apply upstream fix to UriParser from vcpkg and ...
• cca44b5 GH-51638: [CI][C++][Parquet] Update expected JSON output in parquet-reader-te...
• 5183e21 GH-46901: [C++][Compute] Add remainder and modulo kernels (#48914)
• f0d043c MINOR: [Docs][C++] Fix doxygenfile path for arrow/flight/transport.h (#51677)
• 17be9c7 GH-51652: [Python] Add NumPy StringDType to Arrow conversion (#51157)
• Additional commits viewable in compare view

Updates duckdb from 1.5.5 to 1.5.6

Release notes

Sourced from duckdb's releases.

v1.5.6 Bugfix Release

See DuckDB's changelog for all changes in DuckDB.

Commits

• 802a345 set submodule pin to v1.5.6 release hash
• f4f4ad2 [duckdb-labs bot] Bump DuckDB submodule (#631)
• 3d35637 Bump submodule
• 2929d48 [duckdb-labs bot] Bump DuckDB submodule (#625)
• e1b6247 Bump submodule
• f487d2d [duckdb-labs bot] Bump DuckDB submodule (#624)
• ede665a Bump submodule
• f0829a7 [duckdb-labs bot] Bump DuckDB submodule (#623)
• 7e1aaa2 Bump submodule
• b385dbf [duckdb-labs bot] Bump DuckDB submodule (#621)
• Additional commits viewable in compare view

Updates linkml from 1.11.1 to 1.12.1

Release notes

Sourced from linkml's releases.

v1.12.1

A small point release that fixes install problems in 1.12.0 and one JSON Schema bug.

Install fixes

1.12.0 could be installed alongside dependency versions it doesn't work with. Both problems show up as import errors.

• linkml-runtime must now be ≥ 1.12.0. linkml 1.12 uses linkml_runtime.utils.rdf_canonicalize, which first shipped in linkml-runtime 1.12.0. With an older runtime, from linkml.validator import validate failed with ModuleNotFoundError. (#4119, fixes #4120)
• click must now be ≥ 8.3.3. With click 8.2.0–8.3.2, importing any generator failed with an ImportError on ParameterSource. (#4117)

Generator fixes

• gen-json-schema: a slot whose range is a type with no base now gets "type": "string". Before, the property was emitted as {} (1.12.0) or crashed the generator (1.11.1). (#4079, fixes #4078)
• gen-openapi:
  • Templates can now override the annotations on generated schemas. (#3961)
  • Schemas referenced under items, oneOf and allOf are now included. (#4098)

Documentation

• --use-curies is now documented for gen-json-schema and gen-jsonld-context. It explains that identifier slots keep their slot-name key, which maps to @id. (#4080)

Full Changelog: linkml/linkml@v1.12.0...v1.12.1

v1.12.0

LinkML 1.12.0 brings 155 pull requests from 28 contributors since v1.11.1, after two release candidates. It ships linkml-model v1.12.0 (#4085).

Upgrade notes

These changes can alter generated output or affect code that uses LinkML:

• Metamodel 1.12.0. The status metaslot is now a plain string, and anonymous_class_expression.is_a only accepts class definitions. Generated artifacts report metamodel_version: 1.12.0, so projects that commit generated files will see that line change. See the model release notes.
• An explicit class_uri is recorded as skos:exactMatch (exact_mappings), not skos:mappingRelation (mappings), in JSON-LD, RDF and merged YAML, matching what OWL already did. class_uri itself is unchanged (#2693, #4073).
• JSON Schema handles extra_slots and closed classes. extra_slots is now implemented (#2940), and classes without it stay closed (additionalProperties: false), as the metamodel specifies (#3612, #4021). Optional enum-valued slots now accept null (#3737).
• Enum permissible values are real enum members. MyEnum.ALIVE returns a singleton member of the enum, not a loose PermissibleValue, so identity, equality and hashing behave like a normal Python enum (#3597, #3505, #3593, #3596, #3683).
• Generated Python renames slots that clash with Python keywords by appending an underscore (#3317).
• Generators warn about mixed SchemaLoader/SchemaView namespace access with a DeprecationWarning (#3796).

Known issue

• gen-owl no longer emits element-level status values (#4048). Schemas that set status (e.g. status: bibo:status/published) lose those annotations from OWL output. A fix is ready if this causes problems (linkml-model#282); please comment on #4048 if it affects you.

Since the release candidates

If you tested rc1 or rc2: gen-jsonld keeps class_uri and no longer adds class self-mappings (#4073), accepts relative schema paths like dist/schema.yaml (#4074), and --use-curies keeps identifier keys valid JSON-LD (#4072). The bundled model is now the final v1.12.0 (#4085).

New generators

• OpenAPI (gen-openapi), including OpenAPI 3.1 and configurable output (#3300, #3511, #3512, #3765, #3807, #3963, #3974)
• BigQuery schemas with ARRAY, STRUCT, PARTITION BY and CLUSTER BY support (#3585)

... (truncated)

Commits

• bd10206 fix(jsonschema): type without a base gets a type
• c558879 Fix add use curies documentation
• 14b2871 fix(deps): require click >= 8.3.3
• d54d355 fix(deps): require linkml-runtime >= 1.12.0
• b64c36c Update office-hours.md
• 73530c1 Update metamodel test fixtures from linkml-model
• 8ded63c build(deps): bump platformdirs from 4.12.1 to 4.12.2 in the patch-updates gro...
• dcaf6a0 fix(openapigen): seed schemas referenced under items, oneOf and allOf
• 615ac58 feat(openapigen): let templates override generated schema annotations (#3961)
• 6ffd218 Vendor linkml-model 1.12.0 (#4085)
• Additional commits viewable in compare view

Updates linkml-runtime from 1.11.1 to 1.12.1

Updates pillow from 12.3.0 to 13.0.0

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

• Remove undocumented GifImagePlugin._save_netpbm #9901 [@​akx]
• Remove ExifTags.IFD.Makernote #9850 [@​radarhere]
• Drop support for Python 3.10 #9750 [@​hugovk]
• Remove deprecations for Pillow 13.0.0 #9751 [@​radarhere]

Deprecations

• Deprecate IM image format #9849 [@​radarhere]
• Deprecate ImageQt align8to32() in favour of raw encoder stride #9940 [@​akx]
• Deprecate JpegImageFile.load_djpeg #9924 [@​akx]

Documentation

• Update release notes for Pillow 13.0.0 #10223 [@​hugovk]
• Correct the ImageOps.fit centering corner documentation #10118 [@​FanWu-ai]
• Update Tidelift links #10102 [@​radarhere]
• Correct bullet point syntax in release notes #10069 [@​radarhere]
• Update ImageDraw signatures in docs #10065 [@​ZainnQureshii]
• Update macOS tested Pillow versions #10048 [@​hugovk]
• Add pillow-wmf and pillow-zx-spectrum to third-party plugins list #10037 [@​bitplane]
• Delete CLAUDE.md #10027 [@​hugovk]
• Add pillow-lunasvg to third-party plugins list #10016 [@​Maksim-Burtsev]
• Extend security policy #10018 [@​hugovk]
• Update Color3DLUT description #10004 [@​radarhere]
• Document the internal image distinctness constraints #9752 [@​akx]
• Update macOS tested Pillow versions #10000 [@​radarhere]
• Link security policy in project metadata #9980 [@​hugovk]
• Image.new(): correct docstring and comment about uninitialized memory #9960 [@​akx]
• Add AGENTS.md #9582 [@​aclark4life]
• Add release notes for #8811 #9937 [@​radarhere]
• Fixed typo #9923 [@​radarhere]
• Fixed typo #9922 [@​radarhere]
• C interface is internal #9879 [@​radarhere]
• Correct function references #9895 [@​radarhere]
• Revert move from python-pillow.org to python-pillow.github.io #9830 [@​aclark4life]
• Add additional CVE numbers to 12.3.0 release notes #9777 [@​radarhere]
• Remove remaining :rtype:s from docstrings #9742 [@​akx]
• Update macOS tested Pillow versions #9759 [@​radarhere]

Dependencies

• Update dependency cibuildwheel to v4.3.1 #10175 [@renovate[bot]]
• Update dependency cibuildwheel to v4.3.0 #10132 [@renovate[bot]]
• Update dependency harfbuzz to v14.5.0 #10108 [@renovate[bot]]
• Update github-actions #10111 [@renovate[bot]]

... (truncated)

Commits

• 293218a 13.0.0 version bump
• 262e8e4 Update release notes for Pillow 13.0.0 (#10223)
• af56ace Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 570df03 Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 53318b5 Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)
• 0a87417 Bound retained TIFF tag data by stream size (#10225)
• 11582e5 Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)
• 8501adc Fix test
• ec5f1cb Take libtiff scanline geometry tags from the image, not tiffinfo/exif
• 4b63dff Share TIFF tag data budget across frames
• Additional commits viewable in compare view

Updates poethepoet from 0.48.0 to 0.49.0

Release notes

Sourced from poethepoet's releases.

0.49.0

Enhancements

• Add true_string and false_string options to customize the string values that boolean args are exposed as by @​nat-n in nat-n/poethepoet#419
• Support the .yml file extension for poe_tasks.yml and included config files by @​Ab2nour in nat-n/poethepoet#426
• Remove the pastel dependency, leaving pyyaml (and tomli on older pythons) as the only runtime dependencies by @​nat-n in nat-n/poethepoet#411

Fixes

• Resolve glob patterns in cmd tasks after parameter expansion, so expansions and quotes inside square bracket patterns are respected and unmatched globs are passed on unescaped by @​nat-n in nat-n/poethepoet#425
• Handle absolute glob patterns (e.g. /etc/host*) and ** within a path component in cmd tasks instead of crashing by @​nat-n in nat-n/poethepoet#431
• Propagate errors and exit codes from failed subtasks: errors in a switch case or a ref'd task are no longer swallowed, and poe now exits with the exit code of the first failed subtask instead of 1 by @​nat-n in nat-n/poethepoet#430
• Resolve subtask arg defaults against the env inherited from the parent task by @​nat-n in nat-n/poethepoet#421
• Detect and report cyclic deps/uses instead of silently running nothing or crashing by @​nat-n in nat-n/poethepoet#421
• Report malformed, empty, and non-table config files with clear errors instead of tracebacks by @​nat-n in nat-n/poethepoet#428
• Fix boolean flags forwarded to python tasks being inverted when their default is templated by @​nat-n in nat-n/poethepoet#420

Breaking changes

These changes may affect a small number of existing configurations:

• Consistent sys.argv for Python tasks with declared args. Script tasks that call a function, and expr tasks, now get the same sys.argv as script tasks that run a module: declared args as parsed (with defaults applied), followed by any args given after --. Templates like ${VAR} in args given on the command line are also no longer expanded for these tasks, matching other task types. See the migration guide for an example. (nat-n/poethepoet#420)

• Square bracket glob patterns in cmd tasks are parsed like in bash. Whitespace, backslashes, quotes, and parameter expansions inside [...] are no longer taken literally, so e.g. [ -f foo ] is now four words rather than one pattern. To match a space or backslash, escape or quote it, e.g. [a\ b]. See the migration guide for details. (nat-n/poethepoet#425)

AI Agent Skill 🤖

• Teach the task graph (deps, uses, uses_env) and steer agents towards declarative poe features rather than bash logic by @​nat-n in nat-n/poethepoet#429

Upgrade an installed skill with:

poe _install_skill --upgrade

New Contributors

• @​Ab2nour made their first contribution in nat-n/poethepoet#426

Full Changelog: nat-n/poethepoet@v0.48.0...v0.49.0

Commits

• b8e96a9 Bump version to 0.49.0
• 98da6fe fix(cmd): handle absolute glob patterns and misplaced ** without crashing (...
• 5e67f11 fix: propagate errors and exit codes from failed subtasks (#430)
• 65f2390 fix!: resolve glob patterns in cmd tasks after parameter expansion (#425)
• 0f56a81 docs(skill): teach the task graph and steer bash logic to poe features (#429)
• eec9c33 fix!: consistent sys.argv for Python tasks with declared args (#420)
• ac60c37 fix(config): report malformed and non-table config files cleanly (#428)
• af160fe feat: support both .yaml and .yml file extensions (#426)
• 31b931e fix: resolve subtask arg defaults against the inherited env, and detect cycli...
• ee5b9bc feat: customize boolean argument string values (#419)
• Additional commits viewable in compare view

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Commits

• 65bb884 v4.7.0
• 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
• 860d07d don't leak GIT_* env into npm install for language: node
• 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
• 9905e88 use contextlib.chdir
• 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
• 2be1701 remove triple-nested withs for 3.14 coverage
• 4c8d22a py311+
• c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
• f49e251 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates ruff from 0.16.9 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

• Clarify documentation and correct stale guidance (#29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

• Clarify documentation and correct stale guidance (#29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

... (truncated)

Commits

• 30516b4 Bump version to 0.17.2 (#29637)
• 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
• 0d562aa [ty] Check inherited attribute conflicts (#28559)
• 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
• 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
• b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
• 32869b4 Avoid creating deployments for automation jobs (#29626)
• ec891ba Link the commit in pull request report footers (#29621)
• 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
• 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
• Additional commits viewable in compare view

Updates pydata-sphinx-theme from 0.21.0 to 0.23.0

Release notes

Sourced from pydata-sphinx-theme's releases.

v0.23.0

What's Changed

Improvements

• Loosen what keys can be cached in the sidebar by @​Yann-P in pydata/pydata-sphinx-theme#2500
• Declare color-scheme support and recommend light-dark() in the docs by @​anandghegde in pydata/pydata-sphinx-theme#2492
• Post-merge review for light-dark by @​Yann-P in pydata/pydata-sphinx-theme#2506

Fixes

• Prevent unwanted renders of PST sidebar, even if disabled in configuration by @​Yann-P in pydata/pydata-sphinx-theme#2507
• Fix shortening GitHub organization projects root links by @​Junaid-PK in pydata/pydata-sphinx-theme#2498
• Fix spacing between unnamed API return types by @​haoran3160-afk in pydata/pydata-sphinx-theme#2499

Maintenance

• Run npm audit; bump node version; add dep cooldown by @​Yann-P in pydata/pydata-sphinx-theme#2508

Dependencies

• Bump py-cov-action/python-coverage-comment-action from 4.3 to 4.5 by @​dependabot[bot] in pydata/pydata-sphinx-theme#2513
• [pre-commit.ci] pre-commit autoupdate hooks by @​pre-commit-ci[bot] in pydata/pydata-sphinx-theme#2518
• Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 by @​dependabot[bot] in pydata/pydata-sphinx-theme#2489

New Contributors

• @​anandghegde made their first contribution in pydata/pydata-sphinx-theme#2492
• @​haoran3160-afk made their first contribution in pydata/pydata-sphinx-theme#2499

Full Changelog: pydata/pydata-sphinx-theme@v0.22.0...v0.23.0

v0.23.0rc0

What's Changed

Improvements

• Loosen what keys can be cached in the sidebar by @​Yann-P in pydata/pydata-sphinx-theme#2500
• Declare color-scheme support and recommend light-dark() in the docs by @​anandghegde in pydata/pydata-sphinx-theme#2492

Fixes

• Fix shortening GitHub organization projects root links by @​Junaid-PK in pydata/pydata-sphinx-theme#2498
• Prevent unwanted renders of PST sidebar, even if disabled in configuration by @​Yann-P in pydata/pydata-sphinx-theme#2507
• Fix spacing between unnamed API return types by @​haoran3160-afk in pydata/pydata-sphinx-theme#2499

Maintenance

• Run npm audit; bump node version; add dep cooldown by @​Yann-P in pydata/pydata-sphinx-theme#2508
• Post-merge review for light-dark by @​Yann-P in pydata/pydata-sphinx-theme#2506

New Contributors

• @​anandghegde made their first contribution in pydata/pydata-sphinx-theme#2492
• @​haoran3160-afk made their first contribution in pydata/pydata-sphinx-theme#2499

... (truncated)

Commits

• 560ca12 Bump 0.23.0rc0 -> 0.23.0
• 1a2a2c3 Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 (#2489)
• 8a67845 [pre-commit.ci] pre-commit autoupdate hooks (#2518)
• ea0a529 Bump py-cov-action/python-coverage-comment-action from 4.3 to 4.5 (#2513)
• daccf13 Bump 0.22.0 -> 0.23.0rc0
• 642ca72 Loosen what keys can be cached in the sidebar (#2500)
• c223b82 Fix spacing between unnamed API return types (#2499)
• 9cfdc3e Run npm audit; bump node version; add dep cooldown (#2508)
• e0a5d5c Prevent unwanted renders of PST sidebar, even if disabled in configuration (#...
• 46a8149 Post-merge review for light-dark (#2506)
• Additional commits viewable in compare view

Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
• Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

• Add --cache-dir to configure the cache directory from the command line (#5433)
• Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)
• Keep the parentheses around a walrus that is the only item in a set (for example {(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't parse it without them (#5502)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default...

  Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0fce13ee-56a6-4a91-ba3e-d00450428433

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[d33bs]

Approving: verified jupytext header fix brings docs_and_integrations check green; previously accepted major bumps (pyarrow 25->26, Pillow 12->13) unchanged.