)]}'
{
  "commit": "d9909181be32b46f65e3a3ccca43b7dca6507224",
  "tree": "7c9b0da6453adbdb5dcd3a1c1b4dcba10f370829",
  "parents": [
    "bfbcc014dd0be8763c467040eebd19baf926735b"
  ],
  "author": {
    "name": "dependabot[bot]",
    "email": "49699333+dependabot[bot]@users.noreply.github.com",
    "time": "Fri Oct 30 05:34:13 2026 +0000"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Fri Oct 30 05:34:13 2026 +0000"
  },
  "message": "build(deps-dev): Bump pylint from 2.17.7 to 4.0.9 in /examples/bzlmod (#4383)\n\nBumps [pylint](https://github.com/pylint-dev/pylint) from 2.17.7 to\n4.0.9\nin /examples/bzlmod and replaces `pylint-print` with\n`pylint-per-file-ignores`.\n\n`pylint-print 1.0.1` is incompatible with Pylint 4.0+ due to the removal\nof `IAstroidChecker` from `pylint.interfaces`. Replace it with\n`pylint-per-file-ignores` in `examples/bzlmod` to demonstrate plugin\nloading via `py_console_script_binary(deps \u003d [...])`, and update\n`entry_points` tests and documentation accordingly.\n\nFixes Dependabot alert 942:\nhttps://github.com/bazel-contrib/rules_python/security/dependabot/942\n\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/releases\"\u003epylint\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.0.9\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s new in Pylint 4.0.9?\u003c/h2\u003e\n\u003cp\u003eRelease date: 2026-09-23\u003c/p\u003e\n\u003ch2\u003eSecurity Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSomeone without access to the configuration or linted code, but with\naccess\nto the cache directory (predictable \u003ccode\u003ePYLINT_HOME\u003c/code\u003e on a\nmulti-user host) can no\nlonger write a crafted pickle that will runs arbitrary code when pylint\naccess its\nstat cache. The result cache is now stored as JSON instead of pickle,\npreventing code-execution. The workaround is upgrading or not pointing\n\u003ccode\u003ePYLINT_HOME\u003c/code\u003e\nto an untrusted, shared, or group-writable directory. The default value,\n\u003ccode\u003e~/.cache/pylint\u003c/code\u003e,\nis writable only by the user running pylint. (CVE with the same\ninformation pending)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFalse Positives Fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eFixed a false positive for \u003ccode\u003eno-self-use\u003c/code\u003e on a method that\nonly uses\n\u003ccode\u003eself\u003c/code\u003e before a locally defined class (or other nested\nmethod), because\nthe checker\u0027s could-be-a-function tracking state was not restored after\nvisiting the nested method.\u003c/p\u003e\n\u003cp\u003eCloses \u003ca\nhref\u003d\"https://redirect.github.com/pylint-dev/pylint/issues/3705\"\u003e#3705\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFix a false positive for :ref:\u003ccode\u003enot-callable\u003c/code\u003e when calling\nfunctions constructed with\n\u003ccode\u003etypes.FunctionType\u003c/code\u003e or \u003ccode\u003etypes.LambdaType\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eCloses \u003ca\nhref\u003d\"https://redirect.github.com/pylint-dev/pylint/issues/7500\"\u003e#7500\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFix a false positive for \u003ccode\u003eunnecessary-direct-lambda-call\u003c/code\u003e\nwhen a directly called\nlambda in a class body wraps a comprehension containing an assignment\nexpression.\nPEP 572 makes that a \u003ccode\u003eSyntaxError\u003c/code\u003e without the lambda\u0027s\nscope, so following the\nmessage produced code that would not compile.\u003c/p\u003e\n\u003cp\u003eCloses \u003ca\nhref\u003d\"https://redirect.github.com/pylint-dev/pylint/issues/9294\"\u003e#9294\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFix a false positive for :ref:\u003ccode\u003eunnecessary-ellipsis\u003c/code\u003e when\nan ellipsis is the\nsole body statement of a method defined on a \u003ccode\u003eProtocol\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eCloses \u003ca\nhref\u003d\"https://redirect.github.com/pylint-dev/pylint/issues/9319\"\u003e#9319\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFix a false positive for :ref:\u003ccode\u003ebad-exception-cause\u003c/code\u003e when\nthe bases of the class\nbeing raised from cannot be inferred, such as an exception deriving from\na\nC extension class. :ref:\u003ccode\u003eraising-non-exception\u003c/code\u003e and\n:ref:\u003ccode\u003ecatching-non-exception\u003c/code\u003e already guard the same\n\u003ccode\u003einherit_from_std_ex\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/303703fe107fa812c42a66edfc88a5702a63f1f1\"\u003e\u003ccode\u003e303703f\u003c/code\u003e\u003c/a\u003e\nBump pylint to 4.0.9, update changelog (\u003ca\nhref\u003d\"https://redirect.github.com/pylint-dev/pylint/issues/11448\"\u003e#11448\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/b342384e6cb10986f3fa66093d99464b3ced4199\"\u003e\u003ccode\u003eb342384\u003c/code\u003e\u003c/a\u003e\nFix block-scoped disable leaking into sibling elif/else blocks (\u003ca\nhref\u003d\"https://redirect.github.com/pylint-dev/pylint/issues/11429\"\u003e#11429\u003c/a\u003e)\n(\u003ca\nhref\u003d\"https://redirect.github.com/pylint-dev/pylint/issues/11445\"\u003e#11445\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d\"\u003e\u003ccode\u003e58c87cf\u003c/code\u003e\u003c/a\u003e\nStore the results cache as JSON instead of pickle\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/e3f4942a2ff51d28b69435587eee53ab44ebfb9c\"\u003e\u003ccode\u003ee3f4942\u003c/code\u003e\u003c/a\u003e\n[Backport maintenance/4.0.x] Fix crash on failed attribute inference (\u003ca\nhref\u003d\"https://redirect.github.com/pylint-dev/pylint/issues/11443\"\u003e#11443\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/faf47f9f079c9461832a7bd7dcea61d44f6348b9\"\u003e\u003ccode\u003efaf47f9\u003c/code\u003e\u003c/a\u003e\n[Backport maintenance/4.0.x] Fix false positive no-self-use when a\nmethod con...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/20c7bb9ef1468b38e61de43d2e3a7314f938e04f\"\u003e\u003ccode\u003e20c7bb9\u003c/code\u003e\u003c/a\u003e\n[Backport maintenance/4.0.x] Fix a crash in method-hidden for methods\nnamed a...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/47e67578bef317ff0feb0211ba84ba3ba958645f\"\u003e\u003ccode\u003e47e6757\u003c/code\u003e\u003c/a\u003e\n[Backport maintenance/4.0.x] Fix bad-exception-cause false positive when\nthe ...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/ae3ee5354062ca35c0d243f673a2bf3ee2e4f376\"\u003e\u003ccode\u003eae3ee53\u003c/code\u003e\u003c/a\u003e\n[Backport maintenance/4.0.x] Fix not-callable false positive for\ntypes.Functi...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/3e444be6ef29e675f2f559960a60ee24a0372687\"\u003e\u003ccode\u003e3e444be\u003c/code\u003e\u003c/a\u003e\n[Backport maintenance/4.0.x] Fix a crash in\nunnecessary-default-type-args for...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/commit/8f2dd4fcaa85fa43b33da6b0fed4af3a22314984\"\u003e\u003ccode\u003e8f2dd4f\u003c/code\u003e\u003c/a\u003e\n[Backport maintenance/4.0.x] Fix declare-non-slot false positives for\nClassVa...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/pylint-dev/pylint/compare/v2.17.7...v4.0.9\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dpylint\u0026package-manager\u003duv\u0026previous-version\u003d2.17.7\u0026new-version\u003d4.0.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts\npage](https://github.com/bazel-contrib/rules_python/network/alerts).\n\n\u003c/details\u003e\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "426147f59637725692e078e6fb5cccef92b33656",
      "old_mode": 33188,
      "old_path": "docs/_includes/py_console_script_binary.md",
      "new_id": "18f63a5efaf7992a1c8149f7f35e0e3a394d6581",
      "new_mode": 33188,
      "new_path": "docs/_includes/py_console_script_binary.md"
    },
    {
      "type": "modify",
      "old_id": "04cccb2830e76e5174d670c5abf3b9ed2f7c9099",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/entry_points/BUILD.bazel",
      "new_id": "6c500217baa3decfb34c0a386995c4cec7350f0f",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/entry_points/BUILD.bazel"
    },
    {
      "type": "modify",
      "old_id": "3c6e02a3c41778fd3774f6a9651907c631c468ba",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/entry_points/tests/BUILD.bazel",
      "new_id": "3fdd4b8ed5eb40ce0a6506c1505db096a5418ba6",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/entry_points/tests/BUILD.bazel"
    },
    {
      "type": "modify",
      "old_id": "bb3dbab66082445d4a666ec38b08512b8c6e6973",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/entry_points/tests/file_with_pylint_errors.py",
      "new_id": "c7f48b9893d0984f917c4caa70e324e3bc9e6c09",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/entry_points/tests/file_with_pylint_errors.py"
    },
    {
      "type": "modify",
      "old_id": "24ffb15303f19effd52bdf2c567671761af7e976",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/entry_points/tests/pylint_deps_test.py",
      "new_id": "d07a0adb52447d4a522970d5b7f8f593454496cf",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/entry_points/tests/pylint_deps_test.py"
    },
    {
      "type": "modify",
      "old_id": "4dc95667b75b09e5a2c0ec43c09c5ed193b830b5",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/entry_points/tests/pylint_test.py",
      "new_id": "e9f39fc30deca2518cea9c3977a2c9b058138a79",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/entry_points/tests/pylint_test.py"
    },
    {
      "type": "modify",
      "old_id": "d8127dd7c507bf8d040660ed385987cdd4f912a6",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/pyproject.toml",
      "new_id": "d20f8756e01c8c99356286b2e4777c254b1ee54c",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/pyproject.toml"
    },
    {
      "type": "modify",
      "old_id": "73dd7c1e7a77f2880235a17ce0dcf60f6e8e9792",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/uv.lock",
      "new_id": "9788ae523efcfe1da1bd37b3846381ea38572936",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/uv.lock"
    }
  ]
}