[ChiragAgg5k]

Why

Dependabot alert #4 (GHSA-3936-cmfr-pm3m, high): black before 26.3.1 builds its cache file name from unsanitized user input, allowing arbitrary file writes. black is only a development dependency in the test extra.

Black 26 requires Python 3.10, while this SDK still supports 3.9, so the pin carries a python_version >= '3.10' marker. Installing .[test] on 3.9 still works, it just skips black. 26.10.1 is the version the sdk-generator validation workflow already uses.

This file is generated from templates/python/pyproject.toml.twig in appwrite/sdk-generator, which gets the same change in a companion PR so the next generation does not revert it.

Package	Old	New
black	25.11.0	26.10.1

Verification

• pip install -e .[test] on Python 3.12 and 3.9: both succeed (3.9 skips black)
• black --check over appwrite, test and setup.py with 26.10.1: no changes needed
• python -m compileall appwrite/: passes
• python -m unittest: 977 tests, OK
• pip-audit --strict .: no known vulnerabilities

[hansi-codes]

🟢 Tier S · Ready to merge

The dependency update is scoped to the test extra and its Python version marker preserves the project's Python 3.9 support.

The test extra now pins Black 26.10.1 for Python 3.10 and newer, avoiding installation of a Black version that does not support the SDK's Python 3.9 minimum. Other test dependencies are unchanged.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 1

File	Change
pyproject.toml	Update the optional test dependency pin and gate Black on Python 3.10+.

---

_{Reviewed 6c8fb23 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary