Bump shfmt-py from 4.0.0 to 4.1.0

[dependabot]

Bumps shfmt-py from 4.0.0 to 4.1.0.

Release notes

Sourced from shfmt-py's releases.

v4.1.0

Bundles shfmt v3.14.0 (upstream release), up from 3.13.1 in v4.0.0.

- repo: https://github.com/MaxWinterstein/shfmt-py
  rev: v4.1.0
  hooks:
    - id: shfmt

Built from the same commit as v4.1.0rc1, which validated the whole pipeline end to end.

Packaging and supply chain

• Published via PyPI Trusted Publishing (OIDC). No API token is involved any more, and every artifact now ships PEP 740 attestations — a verifiable link from each file back to this repository, workflow and commit. Check the "Verified details" panel on PyPI.
• Upstream's BSD-3-Clause notice now travels with the binary as LICENSE-shfmt, and the distribution declares MIT AND BSD-3-Clause.
• Every GitHub Action is pinned by digest.
• The README shipped inside these artifacts advertises this release's rev:. Earlier releases carried the previous tag — v4.0.0's PyPI page told you to pin v3.13.0.3.

Hook behaviour

• require_serial removed from the shfmt hook. Its stated rationale was inherited from shellcheck-py and never applied to shfmt. No measurable difference for users: with 4 files or fewer, pre-commit runs a single process either way, and shfmt formats 60 files in single-digit milliseconds.
• The hook is now tested end to end in CI on Linux and Windows, which nothing covered before.

Docs

The README was rewritten around the questions people actually arrive with: the three install paths and what each verifies, the args: override that silently drops -w, how parser and printer flags disable EditorConfig wholesale, and why pre-commit hook installs need GitHub reachable even behind a PyPI mirror.

Also

• Supported Python versions declared as classifiers (3.9–3.14)
• Accurate PyPI summary, plus issue/changelog/upstream links
• The checksum guard in setup.py is unit-tested; the checksum-update bot now fails loudly instead of committing a partial update

v4.1.0rc1

Bundles shfmt v3.14.0 (upstream release).

Pre-release. pip install shfmt-py will not pick this up — pre-releases are skipped unless you ask for them explicitly:

pip install --pre shfmt-py

Why this exists

A dry run of the release pipeline before cutting v4.1.0, covering several paths that no PR build can exercise because they only run on a release event:

• Publishing to PyPI via Trusted Publishing (OIDC) rather than a stored API token, and the PEP 740 attestations that come with it
• Stamping this release's own rev: into the README that ships inside the artifacts — previous releases advertised the previous tag on their PyPI page
• The version assertion that every artifact filename matches the tag

... (truncated)

Commits

• dc4b7ed Update dependency mvdan/sh to v3.14.0 (#67)
• b974626 Let Renovate keep rebasing its own checksum PRs (#82)
• 760468f Stamp the release's own rev into the published README (#76)
• 94abf95 Pin every action by digest, not just the ones with nothing to steal (#78)
• 3d269d7 Fail the checksum bot when a substitution misses (#81)
• 6c708c7 Make the PyPI page findable and navigable (#79)
• 4b61c4b Test the checksum guard that decides what lands on users' PATH (#80)
• a233c75 Publish to PyPI via Trusted Publishing instead of an API token (#77)
• b7a5706 Rewrite README around the questions users actually arrive with (#71)
• 2a483b1 Cover the pre-commit hook in CI
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)