[dependabot]

Bumps the python-packages group with 2 updates: isort and pylint.

Updates isort from 8.0.1 to 9.0.1

Release notes

Sourced from isort's releases.

9.0.1

🪲 Fixes

• Restore python -m isort by excluding __main__ from mypyc compilation by @​DanielNoord with @​Copilot in PyCQA/isort#2643

Other changes

• Add changelog entries for last releases by @​DanielNoord in PyCQA/isort#2641

Full Changelog: PyCQA/isort@9.0.0...9.0.1

9.0.0

isort 9.0.0 is the result of several alpha and beta releases, as well as a small number of fixes added after the last beta. For release notes for the individual alphas and betas we would like to refer to:

• 9.0.0a2
• 9.0.0a3
• 9.0.0b1
• 9.0.0b2
• 9.0.0b5

Skipped version numbers are the result of changes to our release infrastructure that broke while creating the actual releases.

Please find below the full release notes for version 9.0.0, the newest release of isort after version 8.0.1.

---

isort 9.0.0 contains some significant changes and improvements. Most notably there is now support for Python 3.15 and its lazy imports and we have included several performance improvements as well as providing mypyc compiled wheels for all major platforms and supported versions of Python. In our own tests we saw speeds ups of more than 2x and 3x times, but this is highly dependent on the codebase isort needs to inspect.

The full list of changes is as follows:

💥 Breaking Changes

• Remove logic for deprecated options (#2498) @​DanielNoord

🚀 Features

• Sort lazy import statements (#2503) @​DanielNoord
• Add initial support for Python 3.15 (#2466) @​DanielNoord
• Compile with mypyc by @​DanielNoord in PyCQA/isort#2586
• Cache calls to posixpath.abspath by @​DanielNoord in PyCQA/isort#2606
• Consider private stdlib modules to be stdlib (#2295) @​devdanzin
• Add CLI Flag for --forced-separate (PyCQA/isort#2367) @​hirak99
• Add separate_packages option (#2313) @​alex-liang3

🪲 Fixes

• Fix inline comment duplication across merged from X import lines (#2499) @​copilot-swe-agent
• Fix src glob patterns passed via CLI (#2497) @​ReinerBRO
• Fix opening-line comment moving to alias attribute line on wrapped imports (#2491) @​copilot-swe-agent
• Fix multi_line_output=3/5 ignored when wrapping single imports with inline comments (#2474) @​copilot-swe-agent
• Fix false positive in check_code when using float_to_top + add_imports (#2492) @​copilot-swe-agent
• Fix: preserve bare # inline comments on imports (#2488) @​copilot-swe-agent

... (truncated)

Changelog

Sourced from isort's changelog.

Changelog

NOTE: isort follows the semver versioning standard. Find out more about isort's release policy here.

Please find a complete overview of all releases on Github.

Releases

Unreleased

9.0.0 August 26 2026

• Remove logic for deprecated options (#2498) @​DanielNoord
• Sort lazy import statements (#2503) @​DanielNoord
• Add initial support for Python 3.15 (#2466) @​DanielNoord
• Compile with mypyc by @​DanielNoord in PyCQA/isort#2586
• Cache calls to posixpath.abspath by @​DanielNoord in PyCQA/isort#2606
• Consider private stdlib modules to be stdlib (#2295) @​devdanzin
• Add CLI Flag for --forced-separate (PyCQA/isort#2367) @​hirak99
• Add separate_packages option (#2313) @​alex-liang3
• Fix inline comment duplication across merged from X import lines (#2499) @​copilot-swe-agent
• Fix src glob patterns passed via CLI (#2497) @​ReinerBRO
• Fix opening-line comment moving to alias attribute line on wrapped imports (#2491) @​copilot-swe-agent
• Fix multi_line_output=3/5 ignored when wrapping single imports with inline comments (#2474) @​copilot-swe-agent
• Fix false positive in check_code when using float_to_top + add_imports (#2492) @​copilot-swe-agent
• Fix: preserve bare # inline comments on imports (#2488) @​copilot-swe-agent
• Fix grouping of non-aliased imports when mixed with aliased imports from the same module (#2470) @​copilot-swe-agent
• Fix PyCQA/isort#2500: trusted publishing by @​staticdev in PyCQA/isort#2521
• Fix git_hook lazy=True option by @​sparrowt in PyCQA/isort#2542
• Honor # isort: off/on/split during float_to_top preprocessing with CRLF input by @​DanielNoord with @​Copilot in PyCQA/isort#2553
• Fix --sort-reexports crash with non-seekable streams (e.g. stdin) by @​Abdu-Ahmed in PyCQA/isort#2547
• Fix non-idempotent output with split_on_trailing_comma and a non-default wrap mode by @​sarathfrancis90 in PyCQA/isort#2554
• Fix non-idempotent NOQA wrap mode with imports that carry their own comment by @​sarathfrancis90 in PyCQA/isort#2556
• Fix NOQA wrap mode accumulating spaces before the comment on each run by @​sarathfrancis90 in PyCQA/isort#2558
• Fix NOQA not added to long imports in several output paths by @​urayoru113 in PyCQA/isort#2568
• Honor # isort: skip when a __future__ import is present (#2092) by @​apoorvdarshan in PyCQA/isort#2574
• fix: make sorted __all__ and literals black-compatible (#2280) by @​lord-haffi in PyCQA/isort#2576
• Honor skip comments when sorting reexports by @​sakshichitnis27 in PyCQA/isort#2581
• Keep aliased import when the plain name carries a comment by @​sarathfrancis90 in PyCQA/isort#2567
• fix: don't crash on --config-root without --resolve-all-configs by @​Gooh456 in PyCQA/isort#2597
• fix: check_code misses lines_before_imports-only changes (#2242) by @​gaoflow in PyCQA/isort#2563
• Fix preservation of form-feed blank lines by @​utkarshalpha in PyCQA/isort#2599
• Small clean up and fix inconsistency in handling of * imports by @​DanielNoord in PyCQA/isort#2619
• Fix word-wrapping of 'from ... import *' into invalid Python (#2267) by @​sudorm-rf0 in PyCQA/isort#2624
• Fix pylint disable-next comments at the start of imports by @​Neallin-917 in PyCQA/isort#2628
• Keep add_imports below a prefixed module docstring by @​Eljees in PyCQA/isort#2626
• Add read the docs configuration (#2504) @​DanielNoord

... (truncated)

Commits

• 131f4ad Fix review typing and import order in CLI invocation test
• 9491900 Test python -m isort invocation directly
• f0a2dca Fix python -m isort by excluding main from mypyc
• 037c2b2 Add changelog entries for last releases
• 727d119 Name the predicate and drive the prefix test off STRING_PREFIXES
• dec76bc Fix multiline docstring style
• cb179db Keep add_imports below a prefixed module docstring
• 7542f76 test: distinguish pylint disable-next comments
• 9f56767 Fix pylint disable-next comments at top of imports
• 0cba6f6 Delete .cruft.json
• Additional commits viewable in compare view

Updates pylint from 4.0.8 to 4.0.9

Release notes

Sourced from pylint's releases.

v4.0.9

What's new in Pylint 4.0.9?

Release date: 2026-09-23

Security Fixes

• Someone without access to the configuration or linted code, but with access to the cache directory (predictable PYLINT_HOME on a multi-user host) can no longer write a crafted pickle that will runs arbitrary code when pylint access its stat cache. The result cache is now stored as JSON instead of pickle, preventing code-execution. The workaround is upgrading or not pointing PYLINT_HOME to an untrusted, shared, or group-writable directory. The default value, ~/.cache/pylint, is writable only by the user running pylint. (CVE with the same information pending)

False Positives Fixed

• Fixed a false positive for no-self-use on a method that only uses self before a locally defined class (or other nested method), because the checker's could-be-a-function tracking state was not restored after visiting the nested method.

  Closes #3705

• Fix a false positive for :ref:not-callable when calling functions constructed with types.FunctionType or types.LambdaType.

  Closes #7500

• Fix a false positive for unnecessary-direct-lambda-call when a directly called lambda in a class body wraps a comprehension containing an assignment expression. PEP 572 makes that a SyntaxError without the lambda's scope, so following the message produced code that would not compile.

  Closes #9294

• Fix a false positive for :ref:unnecessary-ellipsis when an ellipsis is the sole body statement of a method defined on a Protocol.

  Closes #9319

• Fix a false positive for :ref:bad-exception-cause when the bases of the class being raised from cannot be inferred, such as an exception deriving from a C extension class. :ref:raising-non-exception and :ref:catching-non-exception already guard the same inherit_from_std_ex

... (truncated)

Commits

• 303703f Bump pylint to 4.0.9, update changelog (#11448)
• b342384 Fix block-scoped disable leaking into sibling elif/else blocks (#11429) (#11445)
• 58c87cf Store the results cache as JSON instead of pickle
• e3f4942 [Backport maintenance/4.0.x] Fix crash on failed attribute inference (#11443)
• faf47f9 [Backport maintenance/4.0.x] Fix false positive no-self-use when a method con...
• 20c7bb9 [Backport maintenance/4.0.x] Fix a crash in method-hidden for methods named a...
• 47e6757 [Backport maintenance/4.0.x] Fix bad-exception-cause false positive when the ...
• ae3ee53 [Backport maintenance/4.0.x] Fix not-callable false positive for types.Functi...
• 3e444be [Backport maintenance/4.0.x] Fix a crash in unnecessary-default-type-args for...
• 8f2dd4f [Backport maintenance/4.0.x] Fix declare-non-slot false positives for ClassVa...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.