fix(deps): update dependency pylint to v4.1.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pylint (changelog)	==4.0.6 → ==4.1.3

---

Release Notes

pylint-dev/pylint (pylint)

v4.1.3

Compare Source

What's new in Pylint 4.1.3?

Release date: 2026-10-11

False Positives Fixed

• Fixed a false positive for attribute-defined-outside-init when an
  attribute is assigned inside the setter of an old-style, non-decorator
  property(fget, fset) call. The decorator form (@property /
  @x.setter) was already exempted by the fix for #​409; the classic
  call form was not.

  Closes #​3325

• Fix a false positive for used-before-assignment when a name bound by an earlier
  target of the same assignment is used by a later target, as in a = b[a] = 0.

  Closes #​5955

• Fix a no-member false positive in a comprehension inside a branch that
  cannot run, such as if sys.platform == "win32": on Linux. Like the rest of
  the branch, the comprehension is no longer checked for missing members.

  Closes #​7240

• Fix a false positive for used-before-assignment when a name bound by a tuple
  or list target of a with item is used by a later item of the same with statement.

  Closes #​7545

• Fix false positives such as not-callable, not-an-iterable,
  unpacking-non-sequence and no-member on the result of a function whose
  body is only ..., like @overload and .pyi stubs. Such calls were
  inferred as returning None. This affected sqlalchemy.func,
  pydantic.Field, and the torch functions wrapped by _add_docstr,
  such as torch.linalg.qr.

  Closes #​8138
  Closes #​9218
  Closes #​9354
  Closes #​10087

• Fix a false positive for protected-access when a subclass of a subscripted
  generic base, such as class Child(Parent[T]), accesses a protected member
  through that base, such as Parent._foo(self).

  Closes #​8600

• Avoid emitting unreachable for a yield immediately after raise or
  sys.exit() that marks a function as a generator, matching the existing
  handling of return.

  Closes #​8909

• Fix a false positive for super-init-not-called in .pyi stub files, where
  every __init__ body is ... and cannot call the parent's __init__.

  Closes #​9096

• Fix a false positive for possibly-used-before-assignment when a lambda
  uses its parameters, including from a nested lambda, and that name is assigned
  later in the module.

  Closes #​9126

• Fix a false positive for useless-parent-delegation when a keyword-only
  parameter is passed to the parent under the same keyword but with a different value.

  Closes #​9226

• Fix a false positive for unused-argument in .pyi stub files, where
  function bodies are ... and cannot use their arguments.

  Closes #​9417

• Fix a false positive for used-before-assignment when a name assigned with an
  assignment expression in the condition of a comprehension is used in its element,
  for example [y for x in data if (y := f(x))].

  Closes #​9460

• Fixed false positive arguments-differ and signature-differs for
  typing.overload stubs. Overload stubs in a subclass are no longer compared
  to the overridden method, and an overridden method with overloads is compared
  through its implementation instead of its first stub.

  Closes #​10186
  Closes #​5264

• Stop emitting redefined-variable-type when the bare _ variable is
  reused to discard values of different types.

  Closes #​10374

• Allow the __main__ module name in the camelCase, PascalCase and
  UPPER_CASE naming styles without reporting invalid-name.

  Closes #​10442

• Fixed a false positive for unexpected-keyword-arg when a decorator that
  returns its argument unchanged is stacked above a decorator accepting **kwargs.

  Closes #​10831

• Fix invalid-name false positives for module-level all-caps aliases that
  preserve the name of an external callable.

  Closes #​11012

• redefined-builtin no longer warns for method parameters that retain a
  built-in name from an overridden method.

  Closes #​11438

• Fixed a false positive for useless-suppression of line-too-long when a # inside a string literal comes before the # pylint: disable=line-too-long comment.

  Closes #​11440

• Fix a false positive for unnecessary-ellipsis when an ellipsis is the
  sole body statement of a Protocol method defined inside a conditional block
  such as if TYPE_CHECKING:.

  Closes #​11459

• Fix a false positive for unnecessary-negation when negating a comparison
  between instances of a set or frozenset subclass.

  Refs #​11513

Other Bug Fixes

• Fix pyreverse hanging or crashing with a RecursionError when
  --all-associated (-S) follows an attribute whose inferred class is rebuilt by
  astroid on every inference, such as a numpy array.

  Closes #​3602

• Fix a crash in pyreverse when a diagram includes a class created by
  namedtuple, or an argparse.Namespace.

  Closes #​10767

• The "difference" column of the "Messages by category" and "Duplication" reports
  (--reports=y) now shows the change since the previous run instead of repeating
  the previous count.

  Closes #​11520

• Fixed nested-min-max suggesting a non-equivalent rewrite when an inner
  min/max call had multiple arguments.

  Refs #​11593

• Using several output formats that all write to stdout (for example --output-format=colorized,no-header)
  now raises an error instead of printing every message more than once.

  Closes #​11597

• Fixed an IndexError crash in the typecheck checker when an Enum class defines an __init__ method without arguments.

  Closes #​11608

• Fix a crash in the duplicate-code checker when min-similarity-lines is set to 0.
  The checker is now disabled in that case, as documented.

  Closes #​11625

v4.1.2

Compare Source

What's new in Pylint 4.1.2?

Release date: 2026-10-03

False Positives Fixed

• Fixed a false positive unbalanced-tuple-unpacking when unpacking a tuple
  concatenation whose elements have several possible values.

  Fixed by upgrading astroid to 4.3.3.

  Closes #​2621

Other Bug Fixes

• Fixed a crash when calling __bases__ on a class.

  Fixed by upgrading astroid to 4.3.3.

  Closes #​11491

• Fix a crash (astroid-error) when the class of a called attribute cannot
  be fully inferred, for example when the attribute is used as a with
  statement target or inside a comprehension.

  Closes #​11492

• Fix a crash when a name bound by a type statement (a TypeVar) is used in a with statement.

  Closes #​11510

• Fixed a crash (TypeError) in the variables checker when checking a class
  whose metaclass name binding has no line number, for example a class defined
  with metaclass=__annotations__.

  Closes #​11511

• Fix a crash in the using-final-decorator-in-unsupported-version check
  when import final is used.

  Closes #​11521

• Fix a crash when a plugin passes confidence=None to add_message, as
  pylint-pytest does, for a message that is disabled. confidence=None is
  accepted again and means UNDEFINED, like in pylint 4.0. Passing it
  explicitly to add_message, add_ignored_message or Message now emits a
  DeprecationWarning: it will raise an error in pylint 5.0.

  Closes #​11530

v4.1.1

Compare Source

What's new in Pylint 4.1.1?

Release date: 2026-09-29

Other Changes

• Pylint 4.1.0 could not be uploaded to PyPI, because it required an unreleased
  version of dill on Python 3.15, and PyPI refuses such a dependency. 4.1.1 is
  the first 4.1 release available on PyPI, see the 4.1.0 changes below.

  Refs #​11495

v4.0.10

Compare Source

What's new in Pylint 4.0.10?

Release date: 2026-09-29

False Positives Fixed

• Fix false positives for :ref:unnecessary-lambda when a variable referenced in
  the called expression is assigned, reassigned, or deleted later in the same scope.

  Closes #​8192

• Fix a false positive for unused-argument in dataclass __new__ methods
  when the arguments are consumed by a generated __init__ method.

  Closes #​9843

• Fix a false positive for missing-kwoa when keyword-only arguments are passed
  through a **kwargs dictionary that is not a literal at the call site, for
  example one filled with options["key"] = value after its creation.

  Closes #​10029

• ungrouped-imports no longer reports imports inside mutually exclusive
  OS guard branches (if os.name == "nt": / if sys.platform == "win32":),
  matching the existing behavior for sys.version_info guards.

  Closes #​10460

Other Bug Fixes

• A TypeError crash could occur when checking a for loop that
  iterates over a subscript with non-numeric constant bounds or a zero
  step, e.g. for a, b in {"k": [][0: ""]}.values():.

  Closes #​11472

• Fix a crash (AttributeError: 'ClassDef' object has no attribute 'expr') in the
  import-private-name extension when an annotated assignment's value is an
  attribute access on a call rooted at a non-Name node, e.g. x: str = ''().a.

  Closes #​11479

v4.0.9

Compare Source

What's new in Pylint 4.0.9?

Release date: 2026-09-23

Security Fixes

• Someone without access to the configuration or linted code, but with access
  to the cache directory (predictable PYLINT_HOME on a multi-user host) can no
  longer write a crafted pickle that will runs arbitrary code when pylint access its
  stat cache. The result cache is now stored as JSON instead of pickle,
  preventing code-execution. The workaround is upgrading or not pointing PYLINT_HOME
  to an untrusted, shared, or group-writable directory. The default value, ~/.cache/pylint,
  is writable only by the user running pylint. (CVE with the same information pending)

False Positives Fixed

• Fixed a false positive for no-self-use on a method that only uses
  self before a locally defined class (or other nested method), because
  the checker's could-be-a-function tracking state was not restored after
  visiting the nested method.

  Closes #​3705

• Fix a false positive for :ref:not-callable when calling functions constructed with
  types.FunctionType or types.LambdaType.

  Closes #​7500

• Fix a false positive for unnecessary-direct-lambda-call when a directly called
  lambda in a class body wraps a comprehension containing an assignment expression.
  PEP 572 makes that a SyntaxError without the lambda's scope, so following the
  message produced code that would not compile.

  Closes #​9294

• Fix a false positive for :ref:unnecessary-ellipsis when an ellipsis is the
  sole body statement of a method defined on a Protocol.

  Closes #​9319

• Fix a false positive for :ref:bad-exception-cause when the bases of the class
  being raised from cannot be inferred, such as an exception deriving from a
  C extension class. :ref:raising-non-exception and
  :ref:catching-non-exception already guard the same inherit_from_std_ex
  helper with has_known_bases.

  Refs #​11399

False Negatives Fixed

• method-hidden is no longer silenced when the hidden method shares its name with
  a builtin function or with a function defined at module level. Only members of the
  ancestor classes themselves can excuse the method now.

  Refs #​11361

Other Bug Fixes

• Fix a block-scoped # pylint: disable= directive placed inside an if
  body leaking into sibling elif/else blocks for messages such as
  stop-iteration-return, which default to a line-based (rather than
  node-based) message scope.

  Closes #​3136

• Fix a false positive for declare-non-slot when a class variable is
  annotated with ClassVar without an initial value.

  Closes #​9950

• Fix a crash in the no-member checker when attribute lookup raises an
  InferenceError.

  Closes #​11356

• Fix a crash in the unnecessary-default-type-args check when a Generator
  or AsyncGenerator subscript holds an empty tuple, such as Generator[()].

  Closes #​11357

• Fix a crash in method-hidden when a method shadows a name that builtins
  binds to a node without a statement, such as help or license. Every class
  inherits from object, which lives in the builtins module, so no base class
  was needed to trigger it.

  Closes #​11361
  Closes #​8079

v4.0.8

Compare Source

What's new in Pylint 4.0.8?

Release date: 2026-08-29

False Positives Fixed

• Fix a false positive for :ref:unspecified-encoding when an open call uses a mode
  argument that cannot be inferred.

  Closes #​10201

• Fix a false positive for invalid-name (C0103) on names assigned in an
  if __name__ == "__main__": block. Such a block reads like a script body, so
  a name there is now accepted if it matches either the constant or the variable
  naming style.

  Closes #​10766

• Fix false positives for :ref:invalid-str-returned, :ref:invalid-repr-returned,
  :ref:invalid-format-returned, :ref:invalid-bytes-returned, :ref:invalid-hash-returned,
  :ref:invalid-index-returned, :ref:invalid-length-returned,
  :ref:invalid-length-hint-returned, :ref:invalid-getnewargs-returned and
  :ref:invalid-getnewargs-ex-returned when the returned value is an instance of a
  subclass of the expected builtin type, such as self in a str subclass or a
  namedtuple.

  Closes #​11306

• Fix false positives for :ref:bad-string-format-type when the argument is an
  instance of a subclass of int, float or str, such as bool or an
  IntEnum member formatted with %d.

  Closes #​11315

False Negatives Fixed

• redundant-unittest-assert now also flags assertEqual and assertNotEqual
  when both compared values are constants, e.g. self.assertEqual(5, 5).

  Closes #​11321

Other Bug Fixes

• Fix a crash in the docparams extension when a raised name does not infer to an exception, such as raise sum or raise some_module. Such objects have no ancestors(), which aborted the whole file with an astroid-error fatal message.

  Closes #​11228

• Fix a crash in the use-yield-from checker (AttributeError: 'Subscript' object has no attribute 'name') when a loop target is a subscript, attribute, or tuple.

  Closes #​11286

• Fix a crash in the docparams extension (AttributeError: 'AssignName' object has no attribute 'decorators') when a class has non-function attributes sharing the name of a property setter.

  Closes #​11287

Other Changes

• Upgrade the isort upper bound so isort 9 can be installed alongside pylint.

  Closes #​11351

v4.0.7

Compare Source

What's new in Pylint 4.0.7?

Release date: 2026-08-09

False Positives Fixed

• Fix a false positive for invalid-name when a module-level variable is assigned
  an instance of a TypedDict subclass. Such a name is a value, not a type
  definition, so it is now checked against the constant or variable regex instead
  of class-rgx.

  Closes #​11231

Other Bug Fixes

• Fix a crash in the bad-open-mode check when the mode argument of
  open is the NotImplemented constant (Python >= 3.14).

  Closes #​11099

• Fix a crash in the not-context-manager and not-async-context-manager
  checks when the context manager infers to a value without a name, such as the
  slice returned by with slice(...) / async with slice(...).

  Closes #​11102

• Fix a false positive for nested-min-max (W3301) when the inner min/max call carries a keyword argument such as key=. Flattening the call dropped the keyword and changed the result, so nested calls whose inner call has keyword arguments are no longer flagged.

  Closes #​11130

• Fix a false suggestion from nested-min-max (W3301): when rewriting a nested min/max into a splat call, arguments positioned after the splatted call were silently dropped, so the suggested code changed the result.

  Closes #​11134

• Fix a false positive for too-many-locals (R0914): PEP 695 type parameters, i.e. the T1 and T2 in a generic def f[T1, T2] signature, were counted as local variables. They are type-system constructs, not runtime locals, and are now excluded from the local-variable count.

  Closes #​11136

• Fix literal-comparison (R0123) emitting a corrupted suggestion for identifiers
  that contain is (e.g. axis is 5 was rendered ax== == 5). The suggestion
  is now rebuilt from the operands and operator.

  Closes #​11146

• Fix false positives in bad-string-format-type (E1307) for valid % formatting:
  %i/%u applied to a float (both truncate like %d) and %a applied to any
  non-int type (%a is type-agnostic like %s/%r).

  Closes #​11147

• Fix a false positive for :ref:useless-parent-delegation when an override changes
  the default value of a positional-only parameter.

  Closes #​11148

• Fixed a crash in comparison-with-callable when comparing a lambda assigned as a class attribute.

  Closes #​11175

• too-many-lines could be reported at the line of a # pylint: disable=too-many-lines
  pragma found in a previously linted module. Pragma positions are now reset between
  modules, so the message is reported at line 1 (or at the current module's own pragma)
  regardless of which files were linted before.

  Refs #​11191

• Fix a crash when a call unpacks a dictionary whose keys are not string
  constants, e.g. copy.copy(**{-1: 1}).

  Closes #​11222

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.