[iseletsk]

The reviewed record lists every version of PyPI black below 26.10.1 as affected (introduced: 0). The vulnerable code exists only in 26.10.0. This change sets introduced to 26.10.0.

Evidence

• The maintainers' repository advisory (GHSA-cg8m-r9f2-5wm2) gives the vulnerable range as 26.9.0, 26.10.0. No 26.9.0 release exists on PyPI, so this means 26.10.0 only.
• The bug came in with psf/black commit b5b1eb6f6 ([GHSA-43mq-6xmg-29vm] Apache Struts file upload logic is flawed #5399, 22 September 2026), "Support version specifiers in tool.black.required-version for GitHub Action". That commit added a path in action/main.py that returns a required-version value unchanged when it does not start with a digit. The Action then passes that value to pip install as black<value>, so @ https://… becomes a direct reference. The first release after this commit is 26.10.0 (4 October 2026).
• Before that commit, action/main.py always puts == or ~= in front of the value. I checked 26.3.1 and 26.5.1. With pip's requirement parser, a direct-reference value such as @ https://example.invalid/black.whl then gives an invalid requirement, and pip installs nothing.
• The fix ac1f715 (is your first time starting a discussion in this repository! This is a community we build together. Please be welcoming and open minded. Reporting a security vulnerability? Check out the repository's security policy. #5510) shipped in 26.10.1.

The bug is in the GitHub Action of the repository (action/main.py), which is not part of the PyPI wheel. This change keeps the PyPI package as the affected package, the same as the maintainers' advisory, and corrects only the version range.