Skip to content

Upgrading black 25 to 26

Breaking25.12.0 → 26.10.1Breaking1Security7Platform1New21Changed35Fixed80Other14

Full comparisonBack to black
Fetching 8 releases from GitHub…7 / 8
BreakingUpgrade verdict

1 breaking change and a platform requirement change and 6 security fixes.

In plain terms
  • Black now follows Git's .gitignore rules more closely: a file stays ignored if a pattern matches it, even when its parent directory is unignored. Some files that were previously formatted will now be skipped.
  • Black now runs on Python 3.15, but there are no prebuilt wheels for it yet, so it may be slower until wheels ship later in the 3.15 release cycle.
  • A security problem was found in the GitHub Action that ships with Black. If your repository uses that action, update it right away.
  • When the GitHub Action reads the required Black version from your project settings, it now only accepts real released versions and rejects things like URLs.
Must act Top 5 of 8 that need code or config changes

What you must change

Breaking1
Bumps pathspec to v1 and fixes .gitignore handling so files stay ignored even if a parent directory is unignored.
pathspec
26.1.0GitHub ReleaseSummarizedView source
Security6
Fixes a security issue in Black's bundled GitHub Action; users of the action should update immediately.
psf/black@stable
26.10.1GitHub ReleaseSummarizedView source
GitHub Action now only accepts released Black versions from tool.black.required-version, rejecting values such as URL references.
tool.black.required-versionHigh
26.10.1GitHub ReleaseSummarizedView source
Disables browser-originated requests by default, adds configurable origin allowlisting and request body limits, and bounds executor submissions to improve backpressure.
26.3.1GitHub ReleaseSummarizedView source
Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
High · CVSS 7.5
26.3.1GitHub AdvisoryOriginalView source
Hardens parsing of black requirements in the GitHub Action with use_pyproject so only version specifiers are accepted and direct references like black @ https://... are rejected.
use_pyprojectpsf/black@stable
26.3.0GitHub ReleaseSummarizedView source
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.
Critical · CVSS 9.8
26.3.0GitHub AdvisoryOriginalView source
Platform1
Adds Python 3.15 support; compiled wheels are not yet provided for 3.15, so performance may be slower there.
26.5.0GitHub ReleaseSummarizedView source