⬆️ Update dependency pylint to v4.1.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pylint (changelog)	==4.0.8 → ==4.1.2

---

Release Notes

pylint-dev/pylint (pylint)

v4.1.2

Compare Source

What's new in Pylint 4.1.2?

Release date: 2026-10-03

False Positives Fixed

• Fixed a false positive unbalanced-tuple-unpacking when unpacking a tuple
  concatenation whose elements have several possible values.

  Fixed by upgrading astroid to 4.3.3.

  Closes #​2621

Other Bug Fixes

• Fixed a crash when calling __bases__ on a class.

  Fixed by upgrading astroid to 4.3.3.

  Closes #​11491

• Fix a crash (astroid-error) when the class of a called attribute cannot
  be fully inferred, for example when the attribute is used as a with
  statement target or inside a comprehension.

  Closes #​11492

• Fix a crash when a name bound by a type statement (a TypeVar) is used in a with statement.

  Closes #​11510

• Fixed a crash (TypeError) in the variables checker when checking a class
  whose metaclass name binding has no line number, for example a class defined
  with metaclass=__annotations__.

  Closes #​11511

• Fix a crash in the using-final-decorator-in-unsupported-version check
  when import final is used.

  Closes #​11521

• Fix a crash when a plugin passes confidence=None to add_message, as
  pylint-pytest does, for a message that is disabled. confidence=None is
  accepted again and means UNDEFINED, like in pylint 4.0. Passing it
  explicitly to add_message, add_ignored_message or Message now emits a
  DeprecationWarning: it will raise an error in pylint 5.0.

  Closes #​11530

v4.1.1

Compare Source

What's new in Pylint 4.1.1?

Release date: 2026-09-29

Other Changes

• Pylint 4.1.0 could not be uploaded to PyPI, because it required an unreleased
  version of dill on Python 3.15, and PyPI refuses such a dependency. 4.1.1 is
  the first 4.1 release available on PyPI, see the 4.1.0 changes below.

  Refs #​11495

v4.0.10

Compare Source

What's new in Pylint 4.0.10?

Release date: 2026-09-29

False Positives Fixed

• Fix false positives for :ref:unnecessary-lambda when a variable referenced in
  the called expression is assigned, reassigned, or deleted later in the same scope.

  Closes #​8192

• Fix a false positive for unused-argument in dataclass __new__ methods
  when the arguments are consumed by a generated __init__ method.

  Closes #​9843

• Fix a false positive for missing-kwoa when keyword-only arguments are passed
  through a **kwargs dictionary that is not a literal at the call site, for
  example one filled with options["key"] = value after its creation.

  Closes #​10029

• ungrouped-imports no longer reports imports inside mutually exclusive
  OS guard branches (if os.name == "nt": / if sys.platform == "win32":),
  matching the existing behavior for sys.version_info guards.

  Closes #​10460

Other Bug Fixes

• A TypeError crash could occur when checking a for loop that
  iterates over a subscript with non-numeric constant bounds or a zero
  step, e.g. for a, b in {"k": [][0: ""]}.values():.

  Closes #​11472

• Fix a crash (AttributeError: 'ClassDef' object has no attribute 'expr') in the
  import-private-name extension when an annotated assignment's value is an
  attribute access on a call rooted at a non-Name node, e.g. x: str = ''().a.

  Closes #​11479

v4.0.9

Compare Source

What's new in Pylint 4.0.9?

Release date: 2026-09-23

Security Fixes

• Someone without access to the configuration or linted code, but with access
  to the cache directory (predictable PYLINT_HOME on a multi-user host) can no
  longer write a crafted pickle that will runs arbitrary code when pylint access its
  stat cache. The result cache is now stored as JSON instead of pickle,
  preventing code-execution. The workaround is upgrading or not pointing PYLINT_HOME
  to an untrusted, shared, or group-writable directory. The default value, ~/.cache/pylint,
  is writable only by the user running pylint. (CVE with the same information pending)

False Positives Fixed

• Fixed a false positive for no-self-use on a method that only uses
  self before a locally defined class (or other nested method), because
  the checker's could-be-a-function tracking state was not restored after
  visiting the nested method.

  Closes #​3705

• Fix a false positive for :ref:not-callable when calling functions constructed with
  types.FunctionType or types.LambdaType.

  Closes #​7500

• Fix a false positive for unnecessary-direct-lambda-call when a directly called
  lambda in a class body wraps a comprehension containing an assignment expression.
  PEP 572 makes that a SyntaxError without the lambda's scope, so following the
  message produced code that would not compile.

  Closes #​9294

• Fix a false positive for :ref:unnecessary-ellipsis when an ellipsis is the
  sole body statement of a method defined on a Protocol.

  Closes #​9319

• Fix a false positive for :ref:bad-exception-cause when the bases of the class
  being raised from cannot be inferred, such as an exception deriving from a
  C extension class. :ref:raising-non-exception and
  :ref:catching-non-exception already guard the same inherit_from_std_ex
  helper with has_known_bases.

  Refs #​11399

False Negatives Fixed

• method-hidden is no longer silenced when the hidden method shares its name with
  a builtin function or with a function defined at module level. Only members of the
  ancestor classes themselves can excuse the method now.

  Refs #​11361

Other Bug Fixes

• Fix a block-scoped # pylint: disable= directive placed inside an if
  body leaking into sibling elif/else blocks for messages such as
  stop-iteration-return, which default to a line-based (rather than
  node-based) message scope.

  Closes #​3136

• Fix a false positive for declare-non-slot when a class variable is
  annotated with ClassVar without an initial value.

  Closes #​9950

• Fix a crash in the no-member checker when attribute lookup raises an
  InferenceError.

  Closes #​11356

• Fix a crash in the unnecessary-default-type-args check when a Generator
  or AsyncGenerator subscript holds an empty tuple, such as Generator[()].

  Closes #​11357

• Fix a crash in method-hidden when a method shadows a name that builtins
  binds to a node without a statement, such as help or license. Every class
  inherits from object, which lives in the builtins module, so no base class
  was needed to trigger it.

  Closes #​11361
  Closes #​8079

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 2am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.