fix: bump black to 26.3.1 (arbitrary file write via cache filename)

[ajaiswal-qsi-strand]

fix: bump black to 26.3.1 (arbitrary file write via cache filename)

Summary

Bumps the pinned black from 25.1.0 to 26.3.1 to address a security vulnerability, and releases as 2.0.1.

Why

black versions < 26.3.1 are vulnerable to arbitrary file writes from unsanitized user input in the cache file name (GHSA / Dependabot high-severity advisory). Since fourmat pins black with an exact version (black==25.1.0), downstream consumers cannot upgrade black without updating fourmat.

Changes

• setup.py: black==25.1.0 → black==26.3.1
• setup.py: version 2.0.0 → 2.0.1

Testing

• fourmat check — exit 0 (self-lint passes with black 26.3.1)
• pytest test/ — 5 passed
• black --version → 26.3.1

Note: running fourmat check on Python 3.10 emits black's standard AST safety-check warning (config targets py312); this is environment-related and non-fatal (exit 0). CI's tox matrix runs py310/311/312 separately.

[c0state]

This relaxes the version specifier, which is a philosophical change, but users of this library should pin it on their end if desired I think? (nothing in this repo is asserting exact formatting it looks like, eg: tests)

[c0state]

The CI failure is unrelated to the Black upgrade. Each matrix job uses actions/setup-python to expose one Python version, but the subsequent bare tox command attempts the full py310,py311,py312 envlist.

This had been masked because the previously resolved tox version skipped missing interpreters by default. The current unpinned tox release correctly treats them as failures.

Could you update .github/workflows/ci.yaml so each matrix entry maps its Python version to a tox environment (3.10 → py310, etc.) and invoke only that environment, e.g. tox -e ${{ matrix.tox-env }}?

[ajaiswal-qsi-strand]

The CI failure is unrelated to the Black upgrade. Each matrix job uses actions/setup-python to expose one Python version, but the subsequent bare tox command attempts the full py310,py311,py312 envlist.

This had been masked because the previously resolved tox version skipped missing interpreters by default. The current unpinned tox release correctly treats them as failures.

Could you update .github/workflows/ci.yaml so each matrix entry maps its Python version to a tox environment (3.10 → py310, etc.) and invoke only that environment, e.g. tox -e ${{ matrix.tox-env }}?

Hi, fixed. Each matrix entry now maps its Python version to a single tox env and runs only that one:

• 3.10 → py310, 3.11 → py311, 3.12 → py312
• Changed the bare tox to tox -e ${{ matrix.tox-env }} via a matrix include

This way each job runs only the env matching its installed interpreter, instead of the full py310,py311,py312 envlist. Verified locally: tox -e py310 runs a single env and passes (py310: OK).