Update dependency pylint to v4.0.9

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pylint (changelog)	4.0.4 → 4.0.9

---

Release Notes

pylint-dev/pylint (pylint)

v4.0.9

Compare Source

What's new in Pylint 4.0.9?

Release date: 2026-09-23

Security Fixes

• Someone without access to the configuration or linted code, but with access
  to the cache directory (predictable PYLINT_HOME on a multi-user host) can no
  longer write a crafted pickle that will runs arbitrary code when pylint access its
  stat cache. The result cache is now stored as JSON instead of pickle,
  preventing code-execution. The workaround is upgrading or not pointing PYLINT_HOME
  to an untrusted, shared, or group-writable directory. The default value, ~/.cache/pylint,
  is writable only by the user running pylint. (CVE with the same information pending)

False Positives Fixed

• Fixed a false positive for no-self-use on a method that only uses
  self before a locally defined class (or other nested method), because
  the checker's could-be-a-function tracking state was not restored after
  visiting the nested method.

  Closes #​3705

• Fix a false positive for :ref:not-callable when calling functions constructed with
  types.FunctionType or types.LambdaType.

  Closes #​7500

• Fix a false positive for unnecessary-direct-lambda-call when a directly called
  lambda in a class body wraps a comprehension containing an assignment expression.
  PEP 572 makes that a SyntaxError without the lambda's scope, so following the
  message produced code that would not compile.

  Closes #​9294

• Fix a false positive for :ref:unnecessary-ellipsis when an ellipsis is the
  sole body statement of a method defined on a Protocol.

  Closes #​9319

• Fix a false positive for :ref:bad-exception-cause when the bases of the class
  being raised from cannot be inferred, such as an exception deriving from a
  C extension class. :ref:raising-non-exception and
  :ref:catching-non-exception already guard the same inherit_from_std_ex
  helper with has_known_bases.

  Refs #​11399

False Negatives Fixed

• method-hidden is no longer silenced when the hidden method shares its name with
  a builtin function or with a function defined at module level. Only members of the
  ancestor classes themselves can excuse the method now.

  Refs #​11361

Other Bug Fixes

• Fix a block-scoped # pylint: disable= directive placed inside an if
  body leaking into sibling elif/else blocks for messages such as
  stop-iteration-return, which default to a line-based (rather than
  node-based) message scope.

  Closes #​3136

• Fix a false positive for declare-non-slot when a class variable is
  annotated with ClassVar without an initial value.

  Closes #​9950

• Fix a crash in the no-member checker when attribute lookup raises an
  InferenceError.

  Closes #​11356

• Fix a crash in the unnecessary-default-type-args check when a Generator
  or AsyncGenerator subscript holds an empty tuple, such as Generator[()].

  Closes #​11357

• Fix a crash in method-hidden when a method shadows a name that builtins
  binds to a node without a statement, such as help or license. Every class
  inherits from object, which lives in the builtins module, so no base class
  was needed to trigger it.

  Closes #​11361
  Closes #​8079

v4.0.8

Compare Source

What's new in Pylint 4.0.8?

Release date: 2026-08-29

False Positives Fixed

• Fix a false positive for :ref:unspecified-encoding when an open call uses a mode
  argument that cannot be inferred.

  Closes #​10201

• Fix a false positive for invalid-name (C0103) on names assigned in an
  if __name__ == "__main__": block. Such a block reads like a script body, so
  a name there is now accepted if it matches either the constant or the variable
  naming style.

  Closes #​10766

• Fix false positives for :ref:invalid-str-returned, :ref:invalid-repr-returned,
  :ref:invalid-format-returned, :ref:invalid-bytes-returned, :ref:invalid-hash-returned,
  :ref:invalid-index-returned, :ref:invalid-length-returned,
  :ref:invalid-length-hint-returned, :ref:invalid-getnewargs-returned and
  :ref:invalid-getnewargs-ex-returned when the returned value is an instance of a
  subclass of the expected builtin type, such as self in a str subclass or a
  namedtuple.

  Closes #​11306

• Fix false positives for :ref:bad-string-format-type when the argument is an
  instance of a subclass of int, float or str, such as bool or an
  IntEnum member formatted with %d.

  Closes #​11315

False Negatives Fixed

• redundant-unittest-assert now also flags assertEqual and assertNotEqual
  when both compared values are constants, e.g. self.assertEqual(5, 5).

  Closes #​11321

Other Bug Fixes

• Fix a crash in the docparams extension when a raised name does not infer to an exception, such as raise sum or raise some_module. Such objects have no ancestors(), which aborted the whole file with an astroid-error fatal message.

  Closes #​11228

• Fix a crash in the use-yield-from checker (AttributeError: 'Subscript' object has no attribute 'name') when a loop target is a subscript, attribute, or tuple.

  Closes #​11286

• Fix a crash in the docparams extension (AttributeError: 'AssignName' object has no attribute 'decorators') when a class has non-function attributes sharing the name of a property setter.

  Closes #​11287

Other Changes

• Upgrade the isort upper bound so isort 9 can be installed alongside pylint.

  Closes #​11351

v4.0.7

Compare Source

What's new in Pylint 4.0.7?

Release date: 2026-08-09

False Positives Fixed

• Fix a false positive for invalid-name when a module-level variable is assigned
  an instance of a TypedDict subclass. Such a name is a value, not a type
  definition, so it is now checked against the constant or variable regex instead
  of class-rgx.

  Closes #​11231

Other Bug Fixes

• Fix a crash in the bad-open-mode check when the mode argument of
  open is the NotImplemented constant (Python >= 3.14).

  Closes #​11099

• Fix a crash in the not-context-manager and not-async-context-manager
  checks when the context manager infers to a value without a name, such as the
  slice returned by with slice(...) / async with slice(...).

  Closes #​11102

• Fix a false positive for nested-min-max (W3301) when the inner min/max call carries a keyword argument such as key=. Flattening the call dropped the keyword and changed the result, so nested calls whose inner call has keyword arguments are no longer flagged.

  Closes #​11130

• Fix a false suggestion from nested-min-max (W3301): when rewriting a nested min/max into a splat call, arguments positioned after the splatted call were silently dropped, so the suggested code changed the result.

  Closes #​11134

• Fix a false positive for too-many-locals (R0914): PEP 695 type parameters, i.e. the T1 and T2 in a generic def f[T1, T2] signature, were counted as local variables. They are type-system constructs, not runtime locals, and are now excluded from the local-variable count.

  Closes #​11136

• Fix literal-comparison (R0123) emitting a corrupted suggestion for identifiers
  that contain is (e.g. axis is 5 was rendered ax== == 5). The suggestion
  is now rebuilt from the operands and operator.

  Closes #​11146

• Fix false positives in bad-string-format-type (E1307) for valid % formatting:
  %i/%u applied to a float (both truncate like %d) and %a applied to any
  non-int type (%a is type-agnostic like %s/%r).

  Closes #​11147

• Fix a false positive for :ref:useless-parent-delegation when an override changes
  the default value of a positional-only parameter.

  Closes #​11148

• Fixed a crash in comparison-with-callable when comparing a lambda assigned as a class attribute.

  Closes #​11175

• too-many-lines could be reported at the line of a # pylint: disable=too-many-lines
  pragma found in a previously linted module. Pragma positions are now reset between
  modules, so the message is reported at line 1 (or at the current module's own pragma)
  regardless of which files were linted before.

  Refs #​11191

• Fix a crash when a call unpacks a dictionary whose keys are not string
  constants, e.g. copy.copy(**{-1: 1}).

  Closes #​11222

v4.0.6

Compare Source

What's new in Pylint 4.0.6?

Release date: 2026-06-14

False Positives Fixed

• implicit-str-concat is no longer emitted for an implicit concatenation of
  a raw string with a non-raw one (e.g. r"\d" "\n"). Such literals cannot be
  merged into a single string, so the concatenation is intentional rather than a
  forgotten comma.

  Closes #​6663

• Fix a false positive for invalid-name (C0103) where the default
  typevar-rgx rejected TypeVar names containing digits, such as
  Ec2T.

  Closes #​8499

• Fix a false positive for too-many-arguments in (non-static) methods and classmethods.

  Closes #​8675

• Fix a false positive for no-member when a value is inferred to several
  possible types and at least one of them defines a dynamic __getattr__.

  Closes #​9833

• Fix a false positive for function-redefined (E0102) when reusing names that
  match dummy-variables-rgx (such as _), which is common for
  pytest-bdd step definitions. This restores the behavior from before pylint
  4.0.0; as a consequence the false negative fixed in #​9894 is reintroduced for
  functions whose name matches dummy-variables-rgx.

  Closes #​10665

• Fix undefined-variable false positive when a name used as a metaclass
  argument in a nested class is referenced again later in the module.

  Closes #​10823

• Fix a false positive for unused-variable where global variables matching
  dummy-variables-rgx were still reported as unused when
  allow-global-unused-variables was disabled.

  Closes #​10890

• Fix a false positive for bad-dunder-name when there is a user-defined __suppress_context__ attribute on exception subclasses.

  Closes #​10960

• Fix used-before-assignment false positive for names bound by from X import * in every branch of an if/elif/else chain.

  Refs #​10980

• Check for metaclass call signature when evaluating arguments of a class call.

  Closes #​11032

• Fix false positive method-hidden when cached_property is imported directly with from functools import cached_property.

  Refs #​11037

Other Bug Fixes

• Fix the suggestion of unnecessary-comprehension for a dict comprehension
  that iterates a dict directly, e.g. {a: b for a, b in d}. Iterating a dict
  yields its keys, so the suggestion is now dict(d.keys()) instead of the
  incorrect dict(d), which would simply copy d.

  Closes #​8256

• Fix a crash in consider-using-enumerate when the for loop target is an attribute (e.g. for self.idx in range(len(x))) rather than a simple variable name.

  Closes #​10099

• Fix crash when checking attribute-defined-outside-init on classes that inherit from a base class pylint cannot fully analyze.

  Closes #​10892

• Fix add_message silently overwriting an explicit col_offset=0 (or any other zero-valued line/end_lineno/end_col_offset) with the AST node's value. The internal _add_one_message helper used a falsey check (if not col_offset:) to detect an omitted argument, which incorrectly treated a legitimate 0 the same as None. It now uses an identity check against None.

  Refs #​11020

• Fix a crash in the name checker when a non-constant value is passed as the covariant or contravariant argument of a TypeVar.

  Closes #​11022

• Fix a crash in the variable checker when a name resolves to a dataclass-synthesized __init__, which has no line number.

  Closes #​11023

• Fix a crash in the variables checker when NotImplemented is used as the test of an if statement, which raised a TypeError in a boolean context on Python 3.14.

  Closes #​11025

• Avoided a crash from the implicit booleaness checker for len() calls without arguments.

  Closes #​11028

• Fix a crash in the variables checker when a class declares a metaclass whose
  attribute-access chain does not bottom out at a name (e.g.
  class C(metaclass=None._)).
  Originally reported as pylint-dev/astroid#3066.

  Refs #​11031

• Fix a crash in the name checker when a chained assignment of a TypeAlias
  value has a non-name target such as a Subscript (for example
  a[0] = b = TypeAlias).

  Closes #​11056

• Fix a crash in the deprecated checker when __import__ is called with a
  non-string constant argument (for example __import__(1)).

  Closes #​11059

• Avoid crashing when enum member inference fails while checking enum subclasses.

  Closes #​11069

• Prevent a crash in unexpected-keyword-arg analysis when
  infer_call_result() raises InferenceError while inspecting
  decorator return signatures.

  Closes #​11070

• Fix a crash in the typecheck checker when a class uses a non-class object
  (for example a function) as its metaclass= argument.

  Closes #​11071

• Allow digits in ParamSpec and TypeVarTuple names for invalid-name check.

  The default paramspec-rgx and typevartuple-rgx patterns rejected names
  containing digits (e.g. Ec2P, S3Ts), emitting a false invalid-name
  (C0103). Allow digits in the lowercase segments, consistent with the
  typevar and typealias patterns.

  Closes #​11090

Performance Improvements

• The duplicate-code checker no longer runs when its message (R0801) is disabled, even if reports=yes is set. Previously, the checker's report (RP0801) would cause the expensive similarity computation to run regardless.

  Closes #​3443

v4.0.5

Compare Source

What's new in Pylint 4.0.5?

Release date: 2026-02-20

False Positives Fixed

• Fix possibly-used-before-assignment false positive when using self.fail() in tests.

  Closes #​10743

• Fixed false positive for logging-unsupported-format when no arguments are provided to logging functions.

  According to Python's logging documentation, no formatting is performed when no arguments are supplied, so strings like logging.error("%test") are valid.

  Closes #​10752

• Fix a false positive for invalid-name where a dataclass field typed with Final
  was evaluated against the class_const regex instead of the class_attribute regex.

  Closes #​10790

• Avoid emitting unspecified-encoding (W1514) when py-version is 3.15+.

  Refs #​10791

Other Bug Fixes

• Fix --known_third_party config being ignored.

  Closes #​10801

• Fixed dynamic color mapping for "fail-on" messages when using multiple reporter/output formats.

  Closes #​10825

• dependency on isort is now set to <9, permitting to use isort 8.

  Closes #​10857

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.