From d93f30a302f8b930074fe14a2be7b2088ba28111 Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Mon, 20 Jul 2026 21:45:04 +0100 Subject: [PATCH 01/19] Bump version (#13202) --- aiohttp/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aiohttp/__init__.py b/aiohttp/__init__.py index 4c63f90e1fa..7fd200da5a6 100644 --- a/aiohttp/__init__.py +++ b/aiohttp/__init__.py @@ -1,4 +1,4 @@ -__version__ = "3.14.2" +__version__ = "3.14.2.dev0" from typing import TYPE_CHECKING From b001c4cb606a3b626f3052136b1578b325cd6d08 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 11:03:44 +0000 Subject: [PATCH 02/19] Bump filelock from 3.30.2 to 3.31.0 (#13208) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.30.2 to 3.31.0.
Release notes

Sourced from filelock's releases.

3.31.0

What's Changed

Full Changelog: https://github.com/tox-dev/filelock/compare/3.30.3...3.31.0

3.30.3

What's Changed

New Contributors

Full Changelog: https://github.com/tox-dev/filelock/compare/3.30.2...3.30.3

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.31.2 (2026-07-21)

  • filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

3.31.1 (2026-07-20)

  • A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

3.31.0 (2026-07-18)

  • Support Termux/Android, whose CPython ships without os.link and reports sys.platform == "android". import filelock and both FileLock and SoftFileLock now work there, StrictSoftFileLock reports its missing hard-link support only when acquired, and process liveness reads /proc on Android instead of PID-only checks. :pr:678
  • StrictSoftFileLock no longer lets two processes hold the lock at once under heavy contention. A holder now keeps its intent claim for the whole hold, so a contender whose directory scan races the holder's freshly linked claim can no longer miss it and win alongside it. A held lock now exposes both an intent and a held claim. :pr:678

3.30.3 (2026-07-17)

  • AsyncFileLock and AsyncSoftFileLock no longer raise a deadlock RuntimeError when a different asyncio task waits for a lock they hold; the check now scopes holders to the owning task, so only a same-task reacquire is refused. :pr:676
  • Keep both tables of contents on screen at any browser font size. The widened body column sized itself in em against the reader's font size while the breakpoints that fold the layout resolve em against a fixed 16px, so a reader whose default font is larger than 16px had the right-hand table of contents clipped off the edge. The body column now flexes instead, and the right-hand table of contents hides only at the mobile breakpoint. :pr:673
  • Color the mermaid diagrams from whichever theme is active. They previously carried a light palette baked into each diagram's source, which stayed light on a dark page. :pr:674

3.30.2 (2026-07-16)

  • Stop :class:~filelock.SoftFileLease deleting a live marker whose mode it does not implement. An unrecognized mode now names its owner instead of reading as malformed, so a record written by a newer filelock survives the grace window rather than being evicted after two seconds. :pr:672

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.30.2&new-version=3.31.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 89cc73b184f..93603b70001 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -79,7 +79,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.30.2 +filelock==3.31.0 # via # python-discovery # virtualenv diff --git a/requirements/dev.txt b/requirements/dev.txt index 60e7d4435be..502859d8c54 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -77,7 +77,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.30.2 +filelock==3.31.0 # via # python-discovery # virtualenv diff --git a/requirements/lint.txt b/requirements/lint.txt index da04bfc171e..a15ceefb2c2 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -32,7 +32,7 @@ exceptiongroup==1.3.1 # via # aiofastnet # pytest -filelock==3.30.2 +filelock==3.31.0 # via # python-discovery # virtualenv From 1000b29f36855e39c1aaee01bcaa3e590f932aaa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 11:11:47 +0000 Subject: [PATCH 03/19] Bump platformdirs from 4.10.0 to 4.10.1 (#13209) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.10.0 to 4.10.1.
Release notes

Sourced from platformdirs's releases.

4.10.1

What's Changed

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.10.0...4.10.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.10.1 (2026-07-18)

  • Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

4.10.0 (2026-05-28)

  • Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
  • Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
  • Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

4.9.6 (2026-04-09)

  • Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen
  • Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

4.9.4 (2026-03-05)

  • Respect XDG_CONFIG_HOME when reading the user-dirs configuration :pr:453 - by :user:bysiber
  • Create the directory in Android :func:~platformdirs.user_log_dir and :func:~platformdirs.user_runtime_dir when ensure_exists is set :pr:452 - by :user:bysiber

4.9.2 (2026-02-16)

  • No user-facing changes

... (truncated)

Commits
  • 2e74013 Release 4.10.1
  • 3076722 📝 docs(changelog): rebuild against release history (#510)
  • 42751ce 🚀 ci(release): towncrier changelog + publish on tag push (#509)
  • d2e5756 fix(windows): stop leaking ctypes pointer types on repeated calls (#507)
  • 4f52c4f build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 in the all group (#506)
  • f68e56f build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 in the all group (#504)
  • 806560b build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the all group (#502)
  • 795aac4 [pre-commit.ci] pre-commit autoupdate (#503)
  • 99977a9 [pre-commit.ci] pre-commit autoupdate (#500)
  • 4bd7bb3 :moneybag: Surface GitHub Sponsors + thanks.dev
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.10.0&new-version=4.10.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 93603b70001..e2f819666c0 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -159,7 +159,7 @@ pip-tools==7.5.3 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.10.0 +platformdirs==4.10.1 # via # python-discovery # virtualenv diff --git a/requirements/dev.txt b/requirements/dev.txt index 502859d8c54..775b851ae28 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -156,7 +156,7 @@ pip-tools==7.5.3 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.10.0 +platformdirs==4.10.1 # via # python-discovery # virtualenv diff --git a/requirements/lint.txt b/requirements/lint.txt index a15ceefb2c2..6e69a98f643 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -64,7 +64,7 @@ packaging==26.2 # via pytest pathspec==1.1.1 # via mypy -platformdirs==4.10.0 +platformdirs==4.10.1 # via # python-discovery # virtualenv From 236f2a529330d71c3dec201c9f4a0d48aae4376a Mon Sep 17 00:00:00 2001 From: arshsmith Date: Wed, 22 Jul 2026 02:58:05 +0530 Subject: [PATCH 04/19] [PR #13180/ee53d655 backport][3.15] drop every copy of credential headers on cross-origin redirect (#13205) **This is a backport of PR #13180 as merged into master (ee53d6558083e245f3aae7e864ed5523d138c9db).** --- CHANGES/13180.bugfix.rst | 2 ++ aiohttp/client.py | 6 ++--- tests/test_client_functional.py | 47 ++++++++++++++++++++++++++++++++- 3 files changed, 51 insertions(+), 4 deletions(-) create mode 100644 CHANGES/13180.bugfix.rst diff --git a/CHANGES/13180.bugfix.rst b/CHANGES/13180.bugfix.rst new file mode 100644 index 00000000000..d1e676e5be8 --- /dev/null +++ b/CHANGES/13180.bugfix.rst @@ -0,0 +1,2 @@ +Fixed the client dropping only the first ``Authorization``, ``Cookie`` and +``Proxy-Authorization`` header when a redirect crosses an origin -- by :user:`arshsmith1`. diff --git a/aiohttp/client.py b/aiohttp/client.py index 116005def1f..1882c2c864f 100644 --- a/aiohttp/client.py +++ b/aiohttp/client.py @@ -984,9 +984,9 @@ async def _connect_and_send_request( if url.origin() != redirect_origin: auth = None cookies = None - headers.pop(hdrs.AUTHORIZATION, None) - headers.pop(hdrs.COOKIE, None) - headers.pop(hdrs.PROXY_AUTHORIZATION, None) + headers.popall(hdrs.AUTHORIZATION, None) + headers.popall(hdrs.COOKIE, None) + headers.popall(hdrs.PROXY_AUTHORIZATION, None) url = parsed_redirect_url params = {} diff --git a/tests/test_client_functional.py b/tests/test_client_functional.py index 2064ec2aafe..9470876d002 100644 --- a/tests/test_client_functional.py +++ b/tests/test_client_functional.py @@ -34,7 +34,7 @@ ZstdCompressor = None # type: ignore[assignment,misc] # pragma: no cover import pytest -from multidict import MultiDict +from multidict import CIMultiDict, MultiDict from pytest_mock import MockerFixture from yarl import URL @@ -3678,6 +3678,51 @@ async def close(self) -> None: assert resp.status == 200 +async def test_drop_duplicate_auth_headers_on_redirect_to_other_host( + aiohttp_server: AiohttpServer, +) -> None: + """Every copy of a credential header is dropped, not just the first one.""" + + async def srv_from(request: web.Request) -> NoReturn: + assert list(request.headers.getall("Authorization")) == [ + "Basic first", + "Basic second", + ] + raise web.HTTPFound(server_to.make_url("/path2")) + + async def srv_to(request: web.Request) -> web.Response: + assert "Authorization" not in request.headers, "Header wasn't dropped" + assert "Proxy-Authorization" not in request.headers + assert "Cookie" not in request.headers + return web.Response() + + app_from = web.Application() + app_from.router.add_get("/path1", srv_from) + server_from = await aiohttp_server(app_from) + + app_to = web.Application() + app_to.router.add_get("/path2", srv_to) + server_to = await aiohttp_server(app_to) + + # Two servers on the same host but different ports are different origins, + # so following the redirect must strip the credential headers. + headers = CIMultiDict( + ( + ("Authorization", "Basic first"), + ("Authorization", "Basic second"), + ("Proxy-Authorization", "Basic first"), + ("Proxy-Authorization", "Basic second"), + ("Cookie", "a=b"), + ("Cookie", "c=d"), + ) + ) + + url = server_from.make_url("/path1") + async with aiohttp.ClientSession() as client: + async with client.get(url, headers=headers) as resp: + assert resp.status == 200 + + async def test_drop_auth_on_redirect_to_other_host_with_global_auth_and_base_url( create_server_for_url_and_handler, ) -> None: From 240099e5216a01b32919dcd8dd5c6c0b1bf83671 Mon Sep 17 00:00:00 2001 From: arshsmith Date: Wed, 22 Jul 2026 03:29:24 +0530 Subject: [PATCH 05/19] [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on cross-origin redirect (#13204) **This is a backport of PR #13180 as merged into master (ee53d6558083e245f3aae7e864ed5523d138c9db).** --- CHANGES/13180.bugfix.rst | 2 ++ aiohttp/client.py | 6 ++--- tests/test_client_functional.py | 47 ++++++++++++++++++++++++++++++++- 3 files changed, 51 insertions(+), 4 deletions(-) create mode 100644 CHANGES/13180.bugfix.rst diff --git a/CHANGES/13180.bugfix.rst b/CHANGES/13180.bugfix.rst new file mode 100644 index 00000000000..d1e676e5be8 --- /dev/null +++ b/CHANGES/13180.bugfix.rst @@ -0,0 +1,2 @@ +Fixed the client dropping only the first ``Authorization``, ``Cookie`` and +``Proxy-Authorization`` header when a redirect crosses an origin -- by :user:`arshsmith1`. diff --git a/aiohttp/client.py b/aiohttp/client.py index 1150e09a9dd..12f236d6c95 100644 --- a/aiohttp/client.py +++ b/aiohttp/client.py @@ -974,9 +974,9 @@ async def _connect_and_send_request( if url.origin() != redirect_origin: auth = None cookies = None - headers.pop(hdrs.AUTHORIZATION, None) - headers.pop(hdrs.COOKIE, None) - headers.pop(hdrs.PROXY_AUTHORIZATION, None) + headers.popall(hdrs.AUTHORIZATION, None) + headers.popall(hdrs.COOKIE, None) + headers.popall(hdrs.PROXY_AUTHORIZATION, None) url = parsed_redirect_url params = {} diff --git a/tests/test_client_functional.py b/tests/test_client_functional.py index 2064ec2aafe..9470876d002 100644 --- a/tests/test_client_functional.py +++ b/tests/test_client_functional.py @@ -34,7 +34,7 @@ ZstdCompressor = None # type: ignore[assignment,misc] # pragma: no cover import pytest -from multidict import MultiDict +from multidict import CIMultiDict, MultiDict from pytest_mock import MockerFixture from yarl import URL @@ -3678,6 +3678,51 @@ async def close(self) -> None: assert resp.status == 200 +async def test_drop_duplicate_auth_headers_on_redirect_to_other_host( + aiohttp_server: AiohttpServer, +) -> None: + """Every copy of a credential header is dropped, not just the first one.""" + + async def srv_from(request: web.Request) -> NoReturn: + assert list(request.headers.getall("Authorization")) == [ + "Basic first", + "Basic second", + ] + raise web.HTTPFound(server_to.make_url("/path2")) + + async def srv_to(request: web.Request) -> web.Response: + assert "Authorization" not in request.headers, "Header wasn't dropped" + assert "Proxy-Authorization" not in request.headers + assert "Cookie" not in request.headers + return web.Response() + + app_from = web.Application() + app_from.router.add_get("/path1", srv_from) + server_from = await aiohttp_server(app_from) + + app_to = web.Application() + app_to.router.add_get("/path2", srv_to) + server_to = await aiohttp_server(app_to) + + # Two servers on the same host but different ports are different origins, + # so following the redirect must strip the credential headers. + headers = CIMultiDict( + ( + ("Authorization", "Basic first"), + ("Authorization", "Basic second"), + ("Proxy-Authorization", "Basic first"), + ("Proxy-Authorization", "Basic second"), + ("Cookie", "a=b"), + ("Cookie", "c=d"), + ) + ) + + url = server_from.make_url("/path1") + async with aiohttp.ClientSession() as client: + async with client.get(url, headers=headers) as resp: + assert resp.status == 200 + + async def test_drop_auth_on_redirect_to_other_host_with_global_auth_and_base_url( create_server_for_url_and_handler, ) -> None: From abdccaf9b8271eb9ab173af188abb6168f9ed2a8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 10:51:08 +0000 Subject: [PATCH 06/19] Bump actions/setup-python from 6.3.0 to 7.0.0 (#13215) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0.
Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: https://github.com/actions/setup-python/compare/v6...v7.0.0

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-python&package-manager=github_actions&previous-version=6.3.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-cd.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 411d60c2931..a3d94bc5753 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -67,7 +67,7 @@ jobs: make sync-direct-runtime-deps git diff --exit-code -- requirements/runtime-deps.in - name: Setup Python - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 with: python-version: 3.11 - name: Cache PyPI @@ -430,7 +430,7 @@ jobs: submodules: true - name: Setup Python 3.13.2 id: python-install - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 with: python-version: 3.13.2 cache: pip @@ -482,7 +482,7 @@ jobs: submodules: true - name: Setup Python id: python-install - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 with: python-version: '3.12' - name: Install dependencies @@ -568,7 +568,7 @@ jobs: with: submodules: true - name: Setup Python - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 - name: Install build tooling and cython run: >- python -m @@ -666,7 +666,7 @@ jobs: fi shell: bash - name: Setup Python - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 with: python-version: 3.x - name: Install build tooling and cython From 55d7d7fe6ee10d3a3405fe83904f4e3dcbd1082c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:22:07 +0000 Subject: [PATCH 07/19] Bump sphinxcontrib-mermaid from 2.0.3 to 2.1.0 (#13220) Bumps [sphinxcontrib-mermaid](https://github.com/mgaitan/sphinxcontrib-mermaid) from 2.0.3 to 2.1.0.
Changelog

Sourced from sphinxcontrib-mermaid's changelog.

2.1.0 (July 18, 2026)

  • Add mermaid_config option for passing a global Mermaid configuration (#215)
  • Load the ZenUML plugin lazily, only on pages that contain a ZenUML diagram, and confine its injected stylesheet to the diagram subtree so it no longer restyles the host theme (#252)
  • Skip injecting the Mermaid JavaScript when the output format does not support it (#253)
  • Fix d3 zoom on nested SVGs (#179)
  • Fix fullscreen button positioning inconsistency (#225)
  • Fix interactions between the fullscreen, zoom, and lazy-render features (#254)
Commits
  • 6d7611b Merge pull request #257 from mgaitan/tkp/210
  • c53952b Bump version to 2.1.0
  • c5bfe4a Merge pull request #256 from timkpaine/tkp/escape-generated-javascript
  • 7244a8c Escape generated JavaScript values
  • f4cf3e6 Merge pull request #254 from timkpaine/tkp/recent-integration-fixes
  • e96f80c fix(html): Correct Mermaid feature interactions
  • 2395a38 Merge pull request #225 from yarikoptic/bf-fullscreen
  • e0178bd Merge pull request #253 from timkpaine/tkp/pr-132-skip-static-js
  • c5bafdb test(fullscreen): Cover button positioning
  • c09d852 Fix fullscreen button positioning inconsistency
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sphinxcontrib-mermaid&package-manager=pip&previous-version=2.0.3&new-version=2.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc-spelling.txt | 2 +- requirements/doc.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index e2f819666c0..cd9fd5d9926 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -261,7 +261,7 @@ sphinxcontrib-htmlhelp==2.1.0 # via sphinx sphinxcontrib-jsmath==1.0.1 # via sphinx -sphinxcontrib-mermaid==2.0.3 +sphinxcontrib-mermaid==2.1.0 # via -r requirements/doc.in sphinxcontrib-qthelp==2.0.0 # via sphinx diff --git a/requirements/dev.txt b/requirements/dev.txt index 775b851ae28..0e097f6d1d8 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -253,7 +253,7 @@ sphinxcontrib-htmlhelp==2.1.0 # via sphinx sphinxcontrib-jsmath==1.0.1 # via sphinx -sphinxcontrib-mermaid==2.0.3 +sphinxcontrib-mermaid==2.1.0 # via -r requirements/doc.in sphinxcontrib-qthelp==2.0.0 # via sphinx diff --git a/requirements/doc-spelling.txt b/requirements/doc-spelling.txt index 2b6cd4e33a7..c0a09cf0639 100644 --- a/requirements/doc-spelling.txt +++ b/requirements/doc-spelling.txt @@ -73,7 +73,7 @@ sphinxcontrib-htmlhelp==2.1.0 # via sphinx sphinxcontrib-jsmath==1.0.1 # via sphinx -sphinxcontrib-mermaid==2.0.3 +sphinxcontrib-mermaid==2.1.0 # via -r requirements/doc.in sphinxcontrib-qthelp==2.0.0 # via sphinx diff --git a/requirements/doc.txt b/requirements/doc.txt index a5e06ed48cf..b39e69335aa 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -68,7 +68,7 @@ sphinxcontrib-htmlhelp==2.1.0 # via sphinx sphinxcontrib-jsmath==1.0.1 # via sphinx -sphinxcontrib-mermaid==2.0.3 +sphinxcontrib-mermaid==2.1.0 # via -r requirements/doc.in sphinxcontrib-qthelp==2.0.0 # via sphinx From 6ad395cf9bb3b2a4ccd5527bcad9b6c2732ab0ff Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:22:14 +0000 Subject: [PATCH 08/19] Bump pip-tools from 7.5.3 to 7.6.0 (#13219) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [pip-tools](https://github.com/jazzband/pip-tools) from 7.5.3 to 7.6.0.
Release notes

Sourced from pip-tools's releases.

v7.6.0

2026-07-13

Features

  • The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by @​Dzhud.

    PRs and issues: #1142

  • Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by @​miettal.

    PRs and issues: #2288

  • pip-tools is now compatible with pip 26.1 -- @​gaborbernat.

    PRs and issues: #2379

Improved documentation

  • Fixed the contents sidebar for the index doc -- by @​sirosen.

    PRs and issues: #2169

  • pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

    Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

    PRs and issues: #2318

  • pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

    -- by @​sirosen

Contributor-facing changes

  • CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by @​sirosen.

    PRs and issues: #2079, #2132, #2348

  • pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

    Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

    PRs and issues: #2278, #2318

  • Started running {pypi}zizmor as a part of CI pipelines to improve security of how we configure GitHub Actions CI/CD -- by @​webknjaz.

    PRs and issues: #2327

  • pip-tools docs now support GitHub Flavored Markdown admonition blocks -- by @​webknjaz.

... (truncated)

Changelog

Sourced from pip-tools's changelog.

v7.6.0

2026-07-13

Features

  • The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by {user}Dzhud.

    PRs and issues: {issue}1142

  • Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by {user}miettal.

    PRs and issues: {issue}2288

  • pip-tools is now compatible with pip 26.1 -- {user}gaborbernat.

    PRs and issues: {issue}2379

Improved documentation

  • Fixed the contents sidebar for the index doc -- by {user}sirosen.

    PRs and issues: {issue}2169

  • pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by {user}sirosen.

    Thanks to {user}0cjs, {user}gpshead, {user}mr-c, {user}samdoran, {user}webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

    PRs and issues: {issue}2318

  • pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

    -- by {user}sirosen

Contributor-facing changes

  • CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by {user}sirosen.

    PRs and issues: {issue}2079, {issue}2132, {issue}2348

... (truncated)

Commits
  • 27f6a96 Merge pull request #2420 from sirosen/release/v7.6.0
  • cbe77f0 Apply suggestions from code review
  • 015146e Update changelog for version 7.6.0
  • 9a2d2c1 Merge pull request #2414 from jazzband/pre-commit-ci-update-config
  • fc3f877 Merge pull request #2418 from jazzband/dependabot/pip/docs/soupsieve-2.8.4
  • 5247a6b [pre-commit.ci] pre-commit autoupdate
  • 3d1faf6 Bump soupsieve from 2.8.3 to 2.8.4 in /docs
  • 57637db Merge pull request #2419 from sirosen/fix-test-failure
  • 4695c37 Fix the fake_with_deps test package
  • 24f4230 Merge pull request #2413 from webknjaz/maintenance/nested-zizmor-gha-workflow...
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip-tools&package-manager=pip&previous-version=7.5.3&new-version=7.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index cd9fd5d9926..aa16d52e41e 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -155,7 +155,7 @@ pathspec==1.1.1 # via mypy pip==26.1.2 # via pip-tools -pip-tools==7.5.3 +pip-tools==7.6.0 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in diff --git a/requirements/dev.txt b/requirements/dev.txt index 0e097f6d1d8..ee781ed6fec 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -152,7 +152,7 @@ pathspec==1.1.1 # via mypy pip==26.1.2 # via pip-tools -pip-tools==7.5.3 +pip-tools==7.6.0 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in From 49f65d54150397892f7bcc4aae887767d51c322d Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Wed, 22 Jul 2026 11:14:50 -1000 Subject: [PATCH 09/19] [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded buffer slice (#13223) --- CHANGES/13222.bugfix.rst | 1 + aiohttp/_http_parser.pyx | 9 ++-- tests/test_http_parser.py | 93 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+), 4 deletions(-) create mode 100644 CHANGES/13222.bugfix.rst diff --git a/CHANGES/13222.bugfix.rst b/CHANGES/13222.bugfix.rst new file mode 100644 index 00000000000..dcdda17051c --- /dev/null +++ b/CHANGES/13222.bugfix.rst @@ -0,0 +1 @@ +Fixed error message construction in the C HTTP parser -- by :user:`bdraco`. diff --git a/aiohttp/_http_parser.pyx b/aiohttp/_http_parser.pyx index d772e60aeae..0fe6084e571 100644 --- a/aiohttp/_http_parser.pyx +++ b/aiohttp/_http_parser.pyx @@ -675,11 +675,12 @@ cdef class HttpParser: ex = self._last_error self._last_error = None else: - after = cparser.llhttp_get_error_pos(self._cparser) - before = data[:after - base] - after_b = after.split(b"\r\n", 1)[0] + error_pos = cparser.llhttp_get_error_pos(self._cparser) + error_off = error_pos - base + before = data[:error_off] + after = data[error_off:].split(b"\r\n", 1)[0] before = before.rsplit(b"\r\n", 1)[-1] - data = before + after_b + data = before + after pointer = " " * (len(repr(before))-1) + "^" ex = parser_error_from_errno(self._cparser, data, pointer) self._payload = None diff --git a/tests/test_http_parser.py b/tests/test_http_parser.py index 7f3e73f3d5b..fcc1b601863 100644 --- a/tests/test_http_parser.py +++ b/tests/test_http_parser.py @@ -2005,6 +2005,99 @@ async def test_http_response_parser_bad_chunked_strict_c( response.feed_data(text) +# The C parser builds its error message from a snippet of the fed buffer. That +# snippet must be sliced out of the bounded ``data`` bytes object; materializing the +# raw llhttp error-position pointer instead runs strlen past the end of the buffer. +# These tests pin the snippet to bytes that lie inside the fed input, and cover error +# positions right at the buffer end where the over-read used to happen. + +_CHUNKED_RESP_HDR = b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n" + +# (malformed body appended to a chunked response header, expected error snippet, +# llhttp error reason) +_BAD_CHUNKED_RESPONSES = [ + (b"0\rX\r\n\r\n", b"0\rX", "Expected LF after chunk size"), + (b"5\r\nhello\rX\r\n0\r\n\r\n", b"hello\rX", "Expected LF after chunk data"), + (b"5\r\nhelloXY\r\n0\r\n\r\n", b"helloXY", "Expected LF after chunk data"), + (b"1\r\nA\rB\r\n0\r\n\r\n", b"A\rB", "Expected LF after chunk data"), + (b"0_2e\r\n\r\n", b"0_2e", "Invalid character in chunk size"), +] + +# Same, but the buffer ends exactly at the offending byte so the error position sits +# at the end of the input with no trailing CRLF to bound the old strlen-based slice. +_BAD_CHUNKED_RESPONSES_AT_END = [ + (b"0\rX", b"0\rX", "Expected LF after chunk size"), + (b"5\r\nhello\rX", b"hello\rX", "Expected LF after chunk data"), + (b"0_", b"0_", "Invalid character in chunk size"), +] + +_BAD_REQUESTS_AT_END = [ + (b"GET / HTTP/1.1\r\nHost: x\n", b"Host: x\n"), + (b"POST / HTTP/1.1\r\nHost: x\r\nA: b\x01", b"A: b\x01"), +] + + +@pytest.mark.skipif(NO_EXTENSIONS, reason="Only tests C parser.") +@pytest.mark.parametrize( + ("body", "snippet", "reason"), + _BAD_CHUNKED_RESPONSES + _BAD_CHUNKED_RESPONSES_AT_END, +) +async def test_c_parser_error_snippet_bounded_response( + body: bytes, snippet: bytes, reason: str +) -> None: + loop = asyncio.get_running_loop() + protocol = ResponseHandler(loop) + response = HttpResponseParserC( + protocol, loop, 2**16, max_line_size=8190, max_field_size=8190 + ) + protocol._parser = response + text = _CHUNKED_RESP_HDR + body + assert snippet in text + match = f"{re.escape(reason)}[\\s\\S]*{re.escape(repr(snippet))}" + with pytest.raises(http_exceptions.BadHttpMessage, match=match): + response.feed_data(text) + + +@pytest.mark.skipif(NO_EXTENSIONS, reason="Only tests C parser.") +@pytest.mark.parametrize(("text", "snippet"), _BAD_REQUESTS_AT_END) +def test_c_parser_error_snippet_at_buffer_end_request( + loop: asyncio.AbstractEventLoop, + server: Server, + text: bytes, + snippet: bytes, +) -> None: + protocol = RequestHandler(server, loop=loop) + parser = HttpRequestParserC( + protocol, loop, 2**16, max_line_size=8190, max_field_size=8190 + ) + protocol._parser = parser + assert snippet in text + with pytest.raises(http_exceptions.BadHttpMessage, match=re.escape(repr(snippet))): + parser.feed_data(text) + + +@pytest.mark.skipif(NO_EXTENSIONS, reason="Only tests C parser.") +@pytest.mark.parametrize("split", [1, 2, 3, 5]) +@pytest.mark.parametrize(("body", "snippet", "reason"), _BAD_CHUNKED_RESPONSES) +async def test_c_parser_error_snippet_fragmented_response( + body: bytes, snippet: bytes, reason: str, split: int +) -> None: + # Feed the malformed body in two pieces so the second feed runs through the + # tail-prepend path before the error is reported; the parser must report a clean + # error rather than reading past the buffer. The snippet offset shifts with the + # split, so pin the stable llhttp reason instead. + loop = asyncio.get_running_loop() + protocol = ResponseHandler(loop) + response = HttpResponseParserC( + protocol, loop, 2**16, max_line_size=8190, max_field_size=8190 + ) + protocol._parser = response + response.feed_data(_CHUNKED_RESP_HDR) + with pytest.raises(http_exceptions.BadHttpMessage, match=re.escape(reason)): + response.feed_data(body[:split]) + response.feed_data(body[split:]) + + async def test_http_response_parser_notchunked(response) -> None: text = b"HTTP/1.1 200 OK\r\nTransfer-Encoding: notchunked\r\n\r\n1\r\nT\r\n3\r\nest\r\n0\r\n\r\n" messages, upgrade, tail = response.feed_data(text) From 21f9a5b79b06ec8d48a5dee771174a562c521af5 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Wed, 22 Jul 2026 11:18:08 -1000 Subject: [PATCH 10/19] [PR #13222/f4866933 backport][3.15] Build C parser error message from bounded buffer slice (#13224) --- CHANGES/13222.bugfix.rst | 1 + aiohttp/_http_parser.pyx | 9 ++-- tests/test_http_parser.py | 93 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+), 4 deletions(-) create mode 100644 CHANGES/13222.bugfix.rst diff --git a/CHANGES/13222.bugfix.rst b/CHANGES/13222.bugfix.rst new file mode 100644 index 00000000000..dcdda17051c --- /dev/null +++ b/CHANGES/13222.bugfix.rst @@ -0,0 +1 @@ +Fixed error message construction in the C HTTP parser -- by :user:`bdraco`. diff --git a/aiohttp/_http_parser.pyx b/aiohttp/_http_parser.pyx index d772e60aeae..0fe6084e571 100644 --- a/aiohttp/_http_parser.pyx +++ b/aiohttp/_http_parser.pyx @@ -675,11 +675,12 @@ cdef class HttpParser: ex = self._last_error self._last_error = None else: - after = cparser.llhttp_get_error_pos(self._cparser) - before = data[:after - base] - after_b = after.split(b"\r\n", 1)[0] + error_pos = cparser.llhttp_get_error_pos(self._cparser) + error_off = error_pos - base + before = data[:error_off] + after = data[error_off:].split(b"\r\n", 1)[0] before = before.rsplit(b"\r\n", 1)[-1] - data = before + after_b + data = before + after pointer = " " * (len(repr(before))-1) + "^" ex = parser_error_from_errno(self._cparser, data, pointer) self._payload = None diff --git a/tests/test_http_parser.py b/tests/test_http_parser.py index 07ec7a56945..9799300ac84 100644 --- a/tests/test_http_parser.py +++ b/tests/test_http_parser.py @@ -2039,6 +2039,99 @@ async def test_http_response_parser_bad_chunked_strict_c( response.feed_data(text) +# The C parser builds its error message from a snippet of the fed buffer. That +# snippet must be sliced out of the bounded ``data`` bytes object; materializing the +# raw llhttp error-position pointer instead runs strlen past the end of the buffer. +# These tests pin the snippet to bytes that lie inside the fed input, and cover error +# positions right at the buffer end where the over-read used to happen. + +_CHUNKED_RESP_HDR = b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n" + +# (malformed body appended to a chunked response header, expected error snippet, +# llhttp error reason) +_BAD_CHUNKED_RESPONSES = [ + (b"0\rX\r\n\r\n", b"0\rX", "Expected LF after chunk size"), + (b"5\r\nhello\rX\r\n0\r\n\r\n", b"hello\rX", "Expected LF after chunk data"), + (b"5\r\nhelloXY\r\n0\r\n\r\n", b"helloXY", "Expected LF after chunk data"), + (b"1\r\nA\rB\r\n0\r\n\r\n", b"A\rB", "Expected LF after chunk data"), + (b"0_2e\r\n\r\n", b"0_2e", "Invalid character in chunk size"), +] + +# Same, but the buffer ends exactly at the offending byte so the error position sits +# at the end of the input with no trailing CRLF to bound the old strlen-based slice. +_BAD_CHUNKED_RESPONSES_AT_END = [ + (b"0\rX", b"0\rX", "Expected LF after chunk size"), + (b"5\r\nhello\rX", b"hello\rX", "Expected LF after chunk data"), + (b"0_", b"0_", "Invalid character in chunk size"), +] + +_BAD_REQUESTS_AT_END = [ + (b"GET / HTTP/1.1\r\nHost: x\n", b"Host: x\n"), + (b"POST / HTTP/1.1\r\nHost: x\r\nA: b\x01", b"A: b\x01"), +] + + +@pytest.mark.skipif(NO_EXTENSIONS, reason="Only tests C parser.") +@pytest.mark.parametrize( + ("body", "snippet", "reason"), + _BAD_CHUNKED_RESPONSES + _BAD_CHUNKED_RESPONSES_AT_END, +) +async def test_c_parser_error_snippet_bounded_response( + body: bytes, snippet: bytes, reason: str +) -> None: + loop = asyncio.get_running_loop() + protocol = ResponseHandler(loop) + response = HttpResponseParserC( + protocol, loop, 2**16, max_line_size=8190, max_field_size=8190 + ) + protocol._parser = response + text = _CHUNKED_RESP_HDR + body + assert snippet in text + match = f"{re.escape(reason)}[\\s\\S]*{re.escape(repr(snippet))}" + with pytest.raises(http_exceptions.BadHttpMessage, match=match): + response.feed_data(text) + + +@pytest.mark.skipif(NO_EXTENSIONS, reason="Only tests C parser.") +@pytest.mark.parametrize(("text", "snippet"), _BAD_REQUESTS_AT_END) +def test_c_parser_error_snippet_at_buffer_end_request( + loop: asyncio.AbstractEventLoop, + server: Server, + text: bytes, + snippet: bytes, +) -> None: + protocol = RequestHandler(server, loop=loop) + parser = HttpRequestParserC( + protocol, loop, 2**16, max_line_size=8190, max_field_size=8190 + ) + protocol._parser = parser + assert snippet in text + with pytest.raises(http_exceptions.BadHttpMessage, match=re.escape(repr(snippet))): + parser.feed_data(text) + + +@pytest.mark.skipif(NO_EXTENSIONS, reason="Only tests C parser.") +@pytest.mark.parametrize("split", [1, 2, 3, 5]) +@pytest.mark.parametrize(("body", "snippet", "reason"), _BAD_CHUNKED_RESPONSES) +async def test_c_parser_error_snippet_fragmented_response( + body: bytes, snippet: bytes, reason: str, split: int +) -> None: + # Feed the malformed body in two pieces so the second feed runs through the + # tail-prepend path before the error is reported; the parser must report a clean + # error rather than reading past the buffer. The snippet offset shifts with the + # split, so pin the stable llhttp reason instead. + loop = asyncio.get_running_loop() + protocol = ResponseHandler(loop) + response = HttpResponseParserC( + protocol, loop, 2**16, max_line_size=8190, max_field_size=8190 + ) + protocol._parser = response + response.feed_data(_CHUNKED_RESP_HDR) + with pytest.raises(http_exceptions.BadHttpMessage, match=re.escape(reason)): + response.feed_data(body[:split]) + response.feed_data(body[split:]) + + async def test_http_response_parser_notchunked(response) -> None: text = b"HTTP/1.1 200 OK\r\nTransfer-Encoding: notchunked\r\n\r\n1\r\nT\r\n3\r\nest\r\n0\r\n\r\n" messages, upgrade, tail = response.feed_data(text) From 5e392ce0456f5235a4ee6ad46f0e806df2f15873 Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Wed, 22 Jul 2026 23:15:16 +0100 Subject: [PATCH 11/19] Release v3.14.3 (#13225) --- CHANGES.rst | 27 +++++++++++++++++++++++++++ CHANGES/13180.bugfix.rst | 2 -- CHANGES/13222.bugfix.rst | 1 - aiohttp/__init__.py | 2 +- 4 files changed, 28 insertions(+), 4 deletions(-) delete mode 100644 CHANGES/13180.bugfix.rst delete mode 100644 CHANGES/13222.bugfix.rst diff --git a/CHANGES.rst b/CHANGES.rst index 03aac46c4d1..7f20a025e43 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -10,6 +10,33 @@ .. towncrier release notes start +3.14.3 (2026-07-22) +=================== + +Bug fixes +--------- + +- Fixed the client dropping only the first ``Authorization``, ``Cookie`` and + ``Proxy-Authorization`` header when a redirect crossed an origin -- by :user:`arshsmith1`. + + + *Related issues and pull requests on GitHub:* + :issue:`13180`. + + + +- Fixed error message construction in the C HTTP parser -- by :user:`bdraco`. + + + *Related issues and pull requests on GitHub:* + :issue:`13222`. + + + + +---- + + 3.14.2 (2026-07-20) =================== diff --git a/CHANGES/13180.bugfix.rst b/CHANGES/13180.bugfix.rst deleted file mode 100644 index d1e676e5be8..00000000000 --- a/CHANGES/13180.bugfix.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fixed the client dropping only the first ``Authorization``, ``Cookie`` and -``Proxy-Authorization`` header when a redirect crosses an origin -- by :user:`arshsmith1`. diff --git a/CHANGES/13222.bugfix.rst b/CHANGES/13222.bugfix.rst deleted file mode 100644 index dcdda17051c..00000000000 --- a/CHANGES/13222.bugfix.rst +++ /dev/null @@ -1 +0,0 @@ -Fixed error message construction in the C HTTP parser -- by :user:`bdraco`. diff --git a/aiohttp/__init__.py b/aiohttp/__init__.py index 7fd200da5a6..e548b4f3a5e 100644 --- a/aiohttp/__init__.py +++ b/aiohttp/__init__.py @@ -1,4 +1,4 @@ -__version__ = "3.14.2.dev0" +__version__ = "3.14.3" from typing import TYPE_CHECKING From 7caf784628ce5c72bed88005d021dfb6ed56df76 Mon Sep 17 00:00:00 2001 From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 02:06:11 +0000 Subject: [PATCH 12/19] [PR #13226/76bb64eb backport][3.15] Shard release publishing and signing across a gated matrix (#13227) Co-authored-by: J. Nick Koston --- .github/workflows/ci-cd.yml | 154 +++++++++++++++++++++++++++++------- CHANGES/13226.contrib.rst | 1 + 2 files changed, 127 insertions(+), 28 deletions(-) create mode 100644 CHANGES/13226.contrib.rst diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index a3d94bc5753..37b5d050c77 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -712,7 +712,7 @@ jobs: path: ./wheelhouse/*.whl deploy: - name: Deploy + name: Deploy (${{ matrix.group }}) needs: - build-tarball - build-wheels @@ -725,12 +725,54 @@ jobs: contents: write # IMPORTANT: mandatory for making GitHub Releases id-token: write # IMPORTANT: mandatory for trusted publishing & sigstore + # TAG is shared by the two release-existence steps. GITHUB_TOKEN stays scoped + # to the steps that need it rather than job-wide, so third-party actions in + # this job never see it in their environment. + env: + TAG: ${{ github.ref_name }} + + # The required-reviewer pypi environment gates this job, so a human must + # approve before anything is created or published. Release creation and + # publishing all live in this one gated matrix, so a release needs a single + # approval: the groups are pending together and a reviewer approves them in + # one review (see the strategy comment below). environment: name: pypi url: https://pypi.org/p/aiohttp + strategy: + # The PyPI publish and the Sigstore signing each mint one short-lived OIDC + # identity per job and reuse it for every file, so signing the whole dist + # set in a single job can outlast the token and fail partway through + # (pypa/gh-action-pypi-publish#307). Splitting the work across groups, each + # its own job with a fresh identity signing only its share, keeps every + # signing loop well under the token lifetime. + # + # The groups run in parallel and all target the pypi environment, so they + # are pending for approval at the same time and a reviewer approves them in + # a single review rather than one prompt per group. The first group + # (job-index 0) creates the GitHub Release and the others wait for it; each + # group only ever touches its own disjoint share of dists, so the + # concurrent Release asset uploads never collide. fail-fast is off and + # every step is idempotent, so a single failed group can be re-run on its + # own. + # + # Each label "N of M" self-encodes its own position and total, which is the + # only source of truth for the split. Keep `group` the sole matrix axis: an + # include/exclude entry would renumber strategy.job-index / job-total, but + # the label-derived split below stays correct as long as job-index 0 is the + # first label. + fail-fast: false + matrix: + group: + - 1 of 2 + - 2 of 2 + steps: - name: Checkout + # Only the release-creating group needs the repo (create-release reads + # CHANGES.rst and aiohttp/__init__.py); the others only touch dist/. + if: ${{ strategy.job-index == 0 }} uses: actions/checkout@v7 with: submodules: true @@ -743,32 +785,64 @@ jobs: path: dist pattern: dist-* merge-multiple: true - - name: Collected dists - run: | - tree dist + - name: Select this group's distributions + # Keep only this group's share of the dists so the job signs a bounded set. + # index and count come from the "N of M" label, the single source of truth + # for the split; to add a group, extend the matrix list above (e.g. + # "1 of 3" .. "3 of 3"). + # + # The split is fully deterministic: the same built dists always sort the + # same way (LC_ALL=C, byte order, independent of runner locale) and land in + # the same group, so re-running a single failed group reprocesses exactly + # its own share and never touches another group's dists. + id: group + shell: bash + env: + GROUP: ${{ matrix.group }} + run: | + set -euo pipefail + index=$(( ${GROUP%% of *} - 1 )) + count=${GROUP##* of } + shopt -s nullglob + mapfile -t all < <(printf '%s\n' dist/*.whl dist/*.tar.gz | LC_ALL=C sort) + i=0 + inputs=() + for f in "${all[@]}"; do + if [ "$(( i % count ))" -eq "${index}" ]; then + inputs+=("${f}") + else + rm -f -- "${f}" + fi + i=$(( i + 1 )) + done + echo "Group ${GROUP} keeps ${#inputs[@]} of ${#all[@]} dist(s):" + printf ' %s\n' "${inputs[@]}" + echo "sigstore-inputs=${inputs[*]}" >> "${GITHUB_OUTPUT}" - name: Check whether the GitHub Release already exists - # Allows re-running the deploy job after a partial failure (e.g. PyPI - # upload error) without the Make Release step failing with HTTP 422 - # because the tag/release was created on a prior attempt. Treat - # only the literal `release not found` reply as "does not exist"; - # other failures (auth, rate-limit, network) re-raise so the job - # fails loudly instead of falling through to Make Release. + # The first group owns Release creation. Skipping Make Release when the + # release already exists lets the job be re-run after a partial failure + # without hitting HTTP 422. Query the API and branch on the HTTP status, + # not on prose: a 404 means "create it", any other failure (auth, + # rate-limit, network) re-raises so the job fails loudly. + if: ${{ strategy.job-index == 0 }} id: gh-release env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - TAG: ${{ github.ref_name }} run: | - if gh release view "${TAG}" --repo "${GITHUB_REPOSITORY}" \ - >/dev/null 2>err; then + set -euo pipefail + if gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \ + --silent 2>err; then echo 'exists=true' >> "${GITHUB_OUTPUT}" - elif grep -qx 'release not found' err; then + elif grep -q 'HTTP 404' err; then echo 'exists=false' >> "${GITHUB_OUTPUT}" else cat err >&2 exit 1 fi - name: Make Release - if: steps.gh-release.outputs.exists != 'true' + # The first group creates the Release and uploads its share of the + # packages; the other groups add their packages and signatures below. + if: ${{ strategy.job-index == 0 && steps.gh-release.outputs.exists != 'true' }} uses: aio-libs/create-release@v1.6.6 with: changes_file: CHANGES.rst @@ -780,28 +854,52 @@ jobs: :issue:`(\d+)` fix_issue_repl: >- #\1 - - - name: >- - Publish 🐍📦 to PyPI + - name: Wait for the GitHub Release + # The other groups do not create the Release; they wait for the first + # group to create it before they publish or upload anything, so a failure + # to create the Release blocks the irreversible PyPI upload too. Only a + # 404 counts as "not yet"; any other API failure re-raises immediately + # instead of silently retrying for the whole timeout. + if: ${{ strategy.job-index != 0 }} + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + set -euo pipefail + for _ in $(seq 1 150); do + if gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \ + --silent 2>err; then + exit 0 + fi + if ! grep -q 'HTTP 404' err; then + cat err >&2 + exit 1 + fi + sleep 2 + done + echo "GitHub Release ${TAG} did not appear in time" >&2 + exit 1 + - name: Publish 🐍📦 to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: - # Allow re-running the deploy job after a partial PyPI upload - # without failing on dists that were already published. + # Allow re-running after a partial PyPI upload without failing on + # dists that a prior attempt already published. skip-existing: true - - name: Sign the dists with Sigstore uses: sigstore/gh-action-sigstore-python@v3.4.0 with: - inputs: >- - ./dist/*.tar.gz - ./dist/*.whl - + inputs: ${{ steps.group.outputs.sigstore-inputs }} - name: Upload artifact signatures to GitHub Release # Confusingly, this action also supports updating releases, not - # just creating them. This is what we want here, since we've manually + # just creating them. This is what we want here, since the first group # created the release above. + # + # The groups run this concurrently against the same release, which is safe: + # each group's files are a disjoint share, so asset names never collide, and + # with no body/name inputs the action preserves the existing release + # metadata (it writes back what it reads) rather than clearing it, so the + # concurrent metadata updates are identical no-ops. The Wait step above + # guarantees the release (with its notes) already exists first. uses: softprops/action-gh-release@v3.0.2 with: - # dist/ contains the built packages, which smoketest-artifacts/ - # contains the signatures and certificates. + # dist/ holds this group's packages plus their Sigstore signatures. files: dist/** diff --git a/CHANGES/13226.contrib.rst b/CHANGES/13226.contrib.rst new file mode 100644 index 00000000000..9b21890e561 --- /dev/null +++ b/CHANGES/13226.contrib.rst @@ -0,0 +1 @@ +Split release publishing and signing across multiple jobs so each stays within the short-lived signing token lifetime, fixing intermittent release upload failures -- by :user:`bdraco`. From 7ce317f23565a906a43e180b7467749b006e6c30 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 11:19:50 +0000 Subject: [PATCH 13/19] Bump filelock from 3.31.0 to 3.31.1 (#13232) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.31.0 to 3.31.1.
Release notes

Sourced from filelock's releases.

3.31.1

What's Changed

Full Changelog: https://github.com/tox-dev/filelock/compare/3.31.0...3.31.1

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.0 (2026-07-21)

  • SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685
  • Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683
  • The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

3.31.2 (2026-07-21)

  • filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

3.31.1 (2026-07-20)

  • A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

3.31.0 (2026-07-18)

  • Support Termux/Android, whose CPython ships without os.link and reports sys.platform == "android". import filelock and both FileLock and SoftFileLock now work there, StrictSoftFileLock reports its missing hard-link support only when acquired, and process liveness reads /proc on Android instead of PID-only checks. :pr:678
  • StrictSoftFileLock no longer lets two processes hold the lock at once under heavy contention. A holder now keeps its intent claim for the whole hold, so a contender whose directory scan races the holder's freshly linked claim can no longer miss it and win alongside it. A held lock now exposes both an intent and a held claim. :pr:678

3.30.3 (2026-07-17)

  • AsyncFileLock and AsyncSoftFileLock no longer raise a deadlock RuntimeError when a different asyncio task

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.31.0&new-version=3.31.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index aa16d52e41e..8fb5bec15f7 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -79,7 +79,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.31.0 +filelock==3.31.1 # via # python-discovery # virtualenv diff --git a/requirements/dev.txt b/requirements/dev.txt index ee781ed6fec..ae7740dd9ea 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -77,7 +77,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.31.0 +filelock==3.31.1 # via # python-discovery # virtualenv diff --git a/requirements/lint.txt b/requirements/lint.txt index 6e69a98f643..f8e0b695601 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -32,7 +32,7 @@ exceptiongroup==1.3.1 # via # aiofastnet # pytest -filelock==3.31.0 +filelock==3.31.1 # via # python-discovery # virtualenv From 89fd79a56bf0e9ff929ea16cae65a014fec1bbce Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 11:20:35 +0000 Subject: [PATCH 14/19] Bump aiofastnet from 0.19.0 to 0.20.0 (#13231) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [aiofastnet](https://github.com/tarasko/aiofastnet) from 0.19.0 to 0.20.0.
Release notes

Sourced from aiofastnet's releases.

0.20.0

  • Performance improvements from @​river-walras in SSL fallback engine.
  • Fix potential hangups in SSLEngineFallback for some specific ssl MemoryBIO sizes.
  • Simplify logic by always using SSLTransport_Transport when ssl fallback engine is used.
Changelog

Sourced from aiofastnet's changelog.

0.20.0

  • Performance improvements from @​river-walras in SSL fallback engine.
  • Fix potential hangups in SSLEngineFallback for some specific ssl MemoryBIO sizes.
  • Simplify logic by always using SSLTransport_Transport when ssl fallback engine is used.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiofastnet&package-manager=pip&previous-version=0.19.0&new-version=0.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/runtime-deps.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index 4ec9298409e..42b5b1b5aec 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.19.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/base.txt b/requirements/base.txt index c08ba7a3ea8..ba4f09b36ca 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.19.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 8fb5bec15f7..4d8e6a6f112 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==0.19.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in diff --git a/requirements/dev.txt b/requirements/dev.txt index ae7740dd9ea..bd7a2a9a26d 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==0.19.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in diff --git a/requirements/lint.txt b/requirements/lint.txt index f8e0b695601..4a15762e869 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 # via -r requirements/lint.in -aiofastnet==0.19.0 +aiofastnet==0.20.0 # via -r requirements/lint.in annotated-types==0.7.0 # via pydantic diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index 9af389ad565..2afdf1e364f 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.19.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 99b1ab02696..ec3a7b49075 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.19.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index 13c580c7152..58ac836ee4a 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.19.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/test.txt b/requirements/test.txt index 8203da6e9fa..5b980a93d93 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.19.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in From 6fd40b6d9f7c2c85ce4512c7e2e6083fa5c9d418 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 11:24:50 +0000 Subject: [PATCH 15/19] Bump yarl from 1.24.2 to 1.24.5 (#13233) Bumps [yarl](https://github.com/aio-libs/yarl) from 1.24.2 to 1.24.5.
Release notes

Sourced from yarl's releases.

1.24.5

[!IMPORTANT] The v1.24.3 and v1.24.4 releases never published: their wheel builds failed on the emulated odd architectures, so no packages reached PyPI and no GitHub release was created for either version. No changes were lost; everything intended for v1.24.3 and v1.24.4 shipped in v1.24.5. Their changelog entries are reproduced below.

Contributor-facing changes

  • Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

    Related issues and pull requests on GitHub: #1806.

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

  • Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

    Related issues and pull requests on GitHub: #1804.

v1.24.3

(2026-07-19)

Bug fixes

... (truncated)

Changelog

Sourced from yarl's changelog.

v1.24.5

(2026-07-19)

Contributor-facing changes

  • Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:1806.

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

  • Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:1804.

v1.24.3

(2026-07-19)

... (truncated)

Commits
  • 0b30cb0 Release 1.24.5 (#1807)
  • 56150c8 Run the IDNA sweep test only on native Linux x86_64 (#1806)
  • 515adca Release 1.24.4 (#1805)
  • ab5dec2 Do not install hypothesis in the wheel-build test env (#1804)
  • f9d10fb Release 1.24.3 (#1803)
  • 058b7cb Test lone surrogate handling in encoded and parsed URL paths (#991)
  • a181cee Update hypothesis requirement from >=6.156.4 to >=6.157.0 in /requirements (#...
  • 28c1bcc Encode scheme-shaped path colon in relative-path builders (#1802)
  • 51e2802 Reject hosts with Unicode default-ignorable code points (#1801)
  • 3921a73 Drop lone surrogates that split a percent escape in the Cython quoter (#1752)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=yarl&package-manager=pip&previous-version=1.24.2&new-version=1.24.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/runtime-deps.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index 42b5b1b5aec..597a70ae897 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -52,5 +52,5 @@ typing-extensions==4.16.0 ; python_version < "3.13" # aiosignal # exceptiongroup # multidict -yarl==1.24.2 +yarl==1.24.5 # via -r requirements/runtime-deps.in diff --git a/requirements/base.txt b/requirements/base.txt index ba4f09b36ca..621e8eeeb57 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -54,5 +54,5 @@ typing-extensions==4.16.0 ; python_version < "3.13" # multidict uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpython" # via -r requirements/base.in -yarl==1.24.2 +yarl==1.24.5 # via -r requirements/runtime-deps.in diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 4d8e6a6f112..15830e959dd 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -318,7 +318,7 @@ wait-for-it==2.3.0 # via -r requirements/test-common-base.in wheel==0.47.0 # via pip-tools -yarl==1.24.2 +yarl==1.24.5 # via -r requirements/runtime-deps.in zlib-ng==1.0.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index bd7a2a9a26d..010961af355 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -308,7 +308,7 @@ wait-for-it==2.3.0 # via -r requirements/test-common-base.in wheel==0.47.0 # via pip-tools -yarl==1.24.2 +yarl==1.24.5 # via -r requirements/runtime-deps.in zlib-ng==1.0.0 # via diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index 2afdf1e364f..1f9ecddd96b 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -48,5 +48,5 @@ typing-extensions==4.16.0 ; python_version < "3.13" # aiosignal # exceptiongroup # multidict -yarl==1.24.2 +yarl==1.24.5 # via -r requirements/runtime-deps.in diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index ec3a7b49075..d56e8b4da33 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -157,7 +157,7 @@ typing-inspection==0.4.2 # via pydantic wait-for-it==2.3.0 # via -r requirements/test-common-base.in -yarl==1.24.2 +yarl==1.24.5 # via -r requirements/runtime-deps.in zlib-ng==1.0.0 # via -r requirements/test-common.in diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index 58ac836ee4a..24572914aa0 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -104,5 +104,5 @@ typing-extensions==4.16.0 ; python_version < "3.13" # multidict wait-for-it==2.3.0 # via -r requirements/test-common-base.in -yarl==1.24.2 +yarl==1.24.5 # via -r requirements/runtime-deps.in diff --git a/requirements/test.txt b/requirements/test.txt index 5b980a93d93..bc82f04f1d7 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -159,7 +159,7 @@ uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpytho # via -r requirements/base.in wait-for-it==2.3.0 # via -r requirements/test-common-base.in -yarl==1.24.2 +yarl==1.24.5 # via -r requirements/runtime-deps.in zlib-ng==1.0.0 # via -r requirements/test-common.in From 054572c4c1bbb70fd96bbdbdeb66c53711c5c5e7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 11:18:37 +0000 Subject: [PATCH 16/19] Bump github/codeql-action from 4.37.1 to 4.37.2 (#13240) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.1 to 4.37.2.
Release notes

Sourced from github/codeql-action's releases.

v4.37.2

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007
Changelog

Sourced from github/codeql-action's changelog.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007
Commits
  • e064762 Merge pull request #4027 from github/update-v4.37.2-385bcdc5a
  • e0faed8 Add a couple of change notes
  • 73aad0e Update changelog for v4.37.2
  • 385bcdc Merge pull request #4026 from github/dependabot/npm_and_yarn/tar-7.5.20
  • de0229c Merge branch 'main' into dependabot/npm_and_yarn/tar-7.5.20
  • 115e8cb Merge pull request #4010 from github/mbg/ts/update-release-branch
  • dbdf0b0 Bump tar from 7.5.16 to 7.5.20
  • 830c231 Merge pull request #4023 from github/mbg/ff/remove-new-remote-file-addresses-ff
  • 69fd9e9 Merge pull request #4024 from github/mbg/private-registry/make-docker-available
  • b855687 Always make docker_registry registries available
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4.37.1&new-version=4.37.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6d4bf162d59..7dea00c06e5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -29,17 +29,17 @@ jobs: uses: actions/checkout@v7 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.1 + uses: github/codeql-action/init@v4.37.2 with: languages: ${{ matrix.language }} config-file: ./.github/codeql.yml queries: +security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@v4.37.1 + uses: github/codeql-action/autobuild@v4.37.2 if: ${{ matrix.language == 'python' || matrix.language == 'javascript' }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.1 + uses: github/codeql-action/analyze@v4.37.2 with: category: "/language:${{ matrix.language }}" From 89a0a16dd606cae0fcafbaaa77edc3559c8f5d98 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 11:26:55 +0000 Subject: [PATCH 17/19] Bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#13238) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.
Release notes

Sourced from astral-sh/setup-uv's releases.

v9.0.0 🌈 Change prune-cache default to false

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure. Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes

🐛 Bug fixes

  • fix: fall back to distribution ID when os-release has no version field @​cxzhong (#961)

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

Commits
  • c771a70 chore(deps): roll up Dependabot updates (#970)
  • 2f537ca chore: update known checksums for 0.11.30 (#968)
  • 2269552 Speed up version client by partial response reads (#807)
  • 47a7f4f Change prune-cache default to false (#967)
  • 71966ef chore(deps): roll up Dependabot updates (#962)
  • f12b1f0 fix: fall back to distribution ID when os-release has no version field (#961)
  • ecd24dd chore: update known checksums for 0.11.29 (#960)
  • 6a19136 docs: update version references to v8.3.2 (#949)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/setup-uv&package-manager=github_actions&previous-version=8.3.2&new-version=9.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-cd.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 37b5d050c77..aa4d6072c0e 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -175,7 +175,7 @@ jobs: # important: do not use system python env: UV_PYTHON_PREFERENCE: only-managed - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@v9.0.0 with: python-version: ${{ matrix.pyver }} activate-environment: true @@ -282,7 +282,7 @@ jobs: # important: do not use system python env: UV_PYTHON_PREFERENCE: only-managed - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@v9.0.0 with: python-version: ${{ matrix.pyver }} activate-environment: true @@ -354,7 +354,7 @@ jobs: # important: do not use system python env: UV_PYTHON_PREFERENCE: only-managed - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@v9.0.0 with: python-version: ${{ matrix.pyver }} activate-environment: true From 44500bba76e37075b51c10bb68a0ddf79bb82744 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 11:36:32 +0000 Subject: [PATCH 18/19] Bump filelock from 3.31.1 to 3.31.2 (#13242) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.31.1 to 3.31.2.
Release notes

Sourced from filelock's releases.

3.31.2

What's Changed

Full Changelog: https://github.com/tox-dev/filelock/compare/3.31.1...3.31.2

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.0 (2026-07-21)

  • SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685
  • Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683
  • The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

3.31.2 (2026-07-21)

  • filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

3.31.1 (2026-07-20)

  • A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

3.31.0 (2026-07-18)

  • Support Termux/Android, whose CPython ships without os.link and reports sys.platform == "android". import filelock and both FileLock and SoftFileLock now work there, StrictSoftFileLock reports its missing hard-link support only when acquired, and process liveness reads /proc on Android instead of PID-only checks. :pr:678
  • StrictSoftFileLock no longer lets two processes hold the lock at once under heavy contention. A holder now keeps its intent claim for the whole hold, so a contender whose directory scan races the holder's freshly linked claim can no longer miss it and win alongside it. A held lock now exposes both an intent and a held claim. :pr:678

3.30.3 (2026-07-17)

  • AsyncFileLock and AsyncSoftFileLock no longer raise a deadlock RuntimeError when a different asyncio task

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.31.1&new-version=3.31.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 15830e959dd..33370dd6e73 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -79,7 +79,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.31.1 +filelock==3.31.2 # via # python-discovery # virtualenv diff --git a/requirements/dev.txt b/requirements/dev.txt index 010961af355..5c4488d7d34 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -77,7 +77,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.31.1 +filelock==3.31.2 # via # python-discovery # virtualenv diff --git a/requirements/lint.txt b/requirements/lint.txt index 4a15762e869..d58ce47bff7 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -32,7 +32,7 @@ exceptiongroup==1.3.1 # via # aiofastnet # pytest -filelock==3.31.1 +filelock==3.31.2 # via # python-discovery # virtualenv From 7154c0d603bac60e9fe44402eaea9df90f25eacd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 12:02:11 +0000 Subject: [PATCH 19/19] Bump aiofastnet from 0.20.0 to 0.21.0 (#13244) Bumps [aiofastnet](https://github.com/tarasko/aiofastnet) from 0.20.0 to 0.21.0.
Release notes

Sourced from aiofastnet's releases.

0.21.0

  • Various performance improvements in TCP and SSL transports
  • Change default ssl_outgoing_bio_size from 64Kb to 256Kb. This improves walltime benchmark results for bigger messages
Changelog

Sourced from aiofastnet's changelog.

0.21.0

  • Various performance improvements in TCP and SSL transports
  • Change default ssl_outgoing_bio_size from 64Kb to 256Kb. This improves walltime benchmark results for bigger messages
Commits

Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/runtime-deps.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index 597a70ae897..57c3d708d65 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.21.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/base.txt b/requirements/base.txt index 621e8eeeb57..3c52350bac3 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.21.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 33370dd6e73..4ff5ccf6c1d 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.21.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in diff --git a/requirements/dev.txt b/requirements/dev.txt index 5c4488d7d34..4e5d975bf1e 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.21.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in diff --git a/requirements/lint.txt b/requirements/lint.txt index d58ce47bff7..8b25d9a18a5 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 # via -r requirements/lint.in -aiofastnet==0.20.0 +aiofastnet==0.21.0 # via -r requirements/lint.in annotated-types==0.7.0 # via pydantic diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index 1f9ecddd96b..8974d9b729e 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.21.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index d56e8b4da33..c3145e04d48 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.21.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index 24572914aa0..491b68ff55c 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.21.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/test.txt b/requirements/test.txt index bc82f04f1d7..ddaa2539e24 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==0.20.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==0.21.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in