tests/test_docstrings.py imports pytest_examples and
tests/test_tzinfo.py imports pydantic, neither of which the ptest
package depends on. pytest stops at the collection errors, so no test
ran at all:
E ModuleNotFoundError: No module named 'pytest_examples'
E ModuleNotFoundError: No module named 'pydantic'
Add both. test_docstrings.py then looks for core_schema.py and
README.md relative to the source tree, so install README.md and point
it at the installed core_schema.py.
Skip the ruff lint step of the docstring examples, as python3-pydantic
does. Outside the source tree ruff doesn't treat pydantic_core as first
party and flags the import order (I001) of 23 examples, plus a couple
of style rules newer than the examples. The examples are still run.
6025 tests pass and 126 are skipped on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_docs.py imports time_machine. The collection error stops
pytest before any test runs:
E ModuleNotFoundError: No module named 'time_machine'
With it, 6892 tests pass and 242 are skipped on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_pep517_backend.py imports the in-tree build backend from
packaging/pep517_backend, which pytest.ini puts on the path when run
from the source tree but which is not installed. Collection fails and
pytest stops without running any test:
E ModuleNotFoundError: No module named 'pep517_backend'
The test checks the CFLAGS/CPPFLAGS handling of the build backend,
which has no use on the target, so remove it.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2.19.1 declares protobuf < 6, while meta-python provides 7.36, and
google-cloud-pubsub 2.39.2, which Home Assistant 2026.11 uses, requires
google-api-core >= 2.25.0.
New runtime dependencies: proto-plus and opentelemetry-api. pytz is no
longer used. The package is built with setuptools.build_meta now. The
sdist on PyPI was renamed from google-api-core-2.19.1.tar.gz to
google_api_core-2.44.0.tar.gz; the underscore form is the pypi.bbclass
default, so PYPI_PACKAGE_SDIST, which pointed at the old name, is
dropped.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
1.63.2 declares protobuf < 6, while meta-python provides 7.36. The new
release accepts protobuf < 8. Needed by the google-api-core upgrade.
The package is built with setuptools.build_meta now. The sdist on PyPI
was renamed from googleapis-common-protos-1.63.2.tar.gz to
googleapis_common_protos-1.76.0.tar.gz; the underscore form is the
pypi.bbclass default, so PYPI_PACKAGE_SDIST, which pointed at the old
name, is dropped.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
python3-google-api-core 2.x requires proto-plus. A recipe for 1.27.1
exists in meta-python-ai, but meta-python cannot depend on that layer.
Only protobuf is a runtime dependency; google-api-core is needed by the
test suite only.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pydantic 2.14.1 in its test requirements and
package constraints. Upgraded together with python3-pydantic-core
2.50.1, which it pins.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pydantic 2.14.1 pins pydantic-core 2.50.1; with 2.46.5, "import pydantic"
raises SystemError because the versions do not match.
Refresh 0001-cargo.toml-Update-bitvec-to-use-radium-1.x.patch and
regenerate python3-pydantic-core-crates.inc with
bitbake -c update_crates.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins orjson 3.13.0.
Refresh the two x86 guard patches and regenerate
python3-orjson-crates.inc with bitbake -c update_crates.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pylint 4.1.3 in its test requirements.
Drop patches that are no longer needed:
- 0002-pyproject.toml-Keep-tool.setuptools.license-files.patch rewrote
the PEP 639 license and license-files keys into the older
tool.setuptools form. 4.1.3 requires setuptools >= 77, which handles
the PEP 639 keys, and OE-Core provides 84.0.0.
- 0003-astroid-4.1.2-endlineno.patch adjusted functional test
expectations for astroid 4.1.2 (for example MyClass instead of
MyClass.my_method). 4.1.3 ships the same expectations.
- 0004-checkers-variables-do-not-pass-asname-to-Import.infer.patch was
a backport of upstream commit 554b1d192434, which is part of 4.1.3.
Refresh 0001-Adjust-test-expectations-for-ptest.patch. The expected
output was regenerated by running the functional test with pylint 4.1.3
and astroid 4.3.4 installed into a virtualenv and the tests outside the
source tree, which is how the ptest sees pylint.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pytest-socket 0.8.1 in its test
requirements.
0.8.x builds with uv_build instead of poetry-core. Backport the upstream
change that allows uv_build < 0.14, since OE-Core provides 0.13.7.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins lru-dict 1.4.1.
The sdist is now published as lru_dict-*.tar.gz, the default name, so
drop PYPI_PACKAGE_SDIST. 1.4.x pins the build to setuptools==80.9.0 and
no longer needs wheel; relax the setuptools pin with a patch and drop
the python3-wheel-native dependency.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins SQLAlchemy 2.0.54 (core and the recorder
integration).
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pychromecast 14.1.1 for its cast integration.
Drop 0001-pyproject.toml-relax-build-requirements.patch. It removed the
upper bounds setuptools < 83 and wheel < 0.47 from the build
requirements. 14.1.1 allows setuptools < 85 and wheel < 0.49, and
OE-Core provides setuptools 84.0.0 and wheel 0.48.0, which are within
the new bounds.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Needed together with the Cython 3.3.1 upgrade in OE-Core: 0.4.1, with the
backported "Update Cython to version 3.2.3" patch, requires
Cython ~= 3.2.0 and does not build with Cython 3.3. Home Assistant
2026.11 also pins propcache 0.5.4.
Drop both local patches:
- 0001-Update-Cython-to-version-3.2.3-184.patch backported the change
from Cython ~= 3.1.0 to Cython ~= 3.2.0. 0.5.4 requires
Cython >= 3.2.0 (packaging/pep517_backend/_backend.py), so the
backport is not needed; it would even pin the build back to
Cython ~= 3.2.0.
- 0001-build-wheel-in-place.patch hardcoded build_inplace=True in the
in-tree build backend. 0.5.4 adds the build-inplace config setting
for this, so the recipe passes "-C build-inplace=true" in
PEP517_BUILD_OPTS instead.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 requires httpcore2, anyio and truststore, so "import httpx2"
fails with "No module named 'httpcore2'". Home Assistant 2026.11 imports
httpx2 at startup and does not start without them.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 imports httpcore2, which is released as a separate package from
the same repository and with the same version.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 and httpcore2 require truststore. Home Assistant 2026.11 pins
truststore 0.10.4.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
numba is optional for haversine, but haversine only catches
ModuleNotFoundError. With the NumPy 2.5 from OE-Core, numba 0.66 (as in
meta-python-ai) raises
ImportError: Numba needs NumPy 2.4 or less. Got NumPy 2.5.
which makes "import haversine" fail. Catch ImportError instead.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pint requires flexcache, flexparser and typing-extensions, but only the
ptest package pulled in flexcache and flexparser, so "import pint" fails
with "No module named 'flexcache'" on an image without the ptest.
pint is extended to native and nativesdk, so flexcache and flexparser
are as well.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The upgrade to 1.4.4 only changed SRC_URI[sha256sum], which is unused
since the recipe fetches from git, so SRCREV still pointed at a 1.4.2
era commit and the package installed pika 1.4.2 under version 1.4.4.
Point SRCREV at the 1.4.4 tag commit and drop the unused checksum. Add
tag=${PV} to SRC_URI so that the fetcher checks that SRCREV is the
commit of the release tag.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
get_new_ids() keeps the ids it saw in earlier calls, including those of
objects freed since. When the list created by test_at_addrs reuses one
of those addresses it is not reported as new and the test fails, which
was seen on musl qemux86-64:
{'python3-objgraph': ['tests.py:AtAddrsTest.test_at_addrs']}
Refresh the baseline right before creating the list.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The client unit tests mock socket.socket but not socket.getaddrinfo(), so
every test resolves example.com. Without working DNS in the image (e.g.
yoe-musl-sysvinit qemux86-64) all of tests/test_client.py fails.
Backport the upstream fix that uses localhost instead.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 6.1.0:
- No functional changes, only in binary wheels released to PyPI
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.4.5:
- Improve performance of get_literal_values()
- Expand chained type aliases in get_literal_values()
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.3.3:
Security:
- The limit on <use> expansions added in 2.3.1 counted expansions,
not their size. Each expansion copies and renders the whole
element it refers to, so a few kilobytes of nested <use> groups
with a large group at the bottom could still take minutes and
gigabytes to render (CWE-400, GHSA-xpfm-fw4h-qxwv, an incomplete
fix of GHSA-555j-qj3j-c8jv). The elements copied by all
expansions of a document, external SVGs included, are now limited
too (MAX_USE_CLONED_ELEMENTS, 20,000); once it is spent the
remaining <use> elements are skipped and an error is logged.
Thanks to Adrian Korwel for the report.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.0:
- BREAK: The contents of an HTML template are no longer treated as
part of the document. Selectors do not descend into a template,
and elements inside one can't see beyond it, which also applies
to pseudo-classes such as :lang(), :disabled, and :default.
select and filter will still reach the contents of a template
when they are called on the template itself, for example
soup.template.select('p'). See the FAQ for more information.
- BREAK: The contents of an iframe are no longer treated as a
separate document, as they are not one in a browser. Elements in
an iframe are normal children, so :root does not match them, and
:default, :indeterminate, :checked, :dir(), :lang(), and
:read-write treat them like any other element. Recent versions of
html.parser, lxml, and html5lib all escape the contents of an
iframe like a browser does, so this mostly affects XHTML, Python
versions that still don't escape such content in their specific
html.parser, and elements added to an iframe by hand.
:-soup-contains() now also includes the escaped text in an
iframe. See the FAQ for more information.
- NEW: Update :disabled and :enabled to treat option and optgroup
elements inside a disabled select as disabled, following a recent
HTML specification update.
- FIX: Fix the subsequent-sibling combinator and :has(~ ...) never
matching top level elements of a fragment that has no root
element, unless caching was disabled.
- FIX: :indeterminate now treats a radio button group without a
form as extending across the whole document instead of the top
level element that contains it, and it no longer ignores radio
buttons at the top level.
- FIX: Fix :default to treat a button with a missing or invalid
type, and an input with type="image", as submit buttons.
- FIX: Fix :in-range and :out-of-range raising TypeError when the
document contains an input without a type attribute.
- FIX: :read-write (and :read-only) now treat
contenteditable="plaintext-only" elements as editing hosts and
match the editable elements inside an editing host, following the
nearest contenteditable state.
- FIX: :read-write (and :read-only) now ignore contenteditable on
non-HTML elements, such as an SVG foreignObject, as the attribute
only applies to HTML elements. Such elements inherit the state of
their parent.
- FIX: :checked now only matches the last radio button with a
checked attribute in a radio button group, as in a browser, where
a group is the radio buttons with the same name and form,
including the form attribute. :default still matches all of them,
and the contents of a template are unaffected as they are not
connected.
- FIX: :dir() and :defined no longer affect the rest of the
selector list they are in. Previously, a selector list that used
either of them could not have its combinators cross an iframe,
ignored the specified namespaces, and matched nothing in XML, not
even the parts that didn't use them. They still do not match in
XML, but :not(:dir(ltr)) and :not(:defined) now do.
- FIX: :default and :indeterminate now honor the form attribute,
which can associate a submit button or radio button with a form
it is not in, or leave it without a form. It is ignored in a
template, as in the HTML specification. Submit buttons outside of
a form can now be its default button.
- FIX: :default, :checked, and :indeterminate now handle a form
inside a form like a browser. In HTML, a browser ignores the
nested form and takes its end tag for that of the parent, which
matters for parsers that keep the nested form, such as
html.parser. In XHTML and in a template, nested forms are real
forms.
- FIX: :checked now matches the option that a browser would select.
Without multiple, that is only the last option with a selected
attribute in a select, and if there are none and the select shows
a single option, the first option that is not disabled. :default
still only considers the selected attribute.
- FIX: Fix [attribute!=value] excluding values that only start with
the specified value, and in XML documents, type values that
contain a newline.
- FIX: Match the values of every attribute that the HTML
specification lists as ASCII case insensitive (rel, method, lang,
dir, ...) without ASCII case sensitivity on HTML elements in HTML
documents, not just type. Non-HTML elements are matched case
sensitively.
- FIX: :dir() now matches non-HTML elements, such as SVG and
MathML, by the direction they inherit from their parent (the dir
attribute only applies to HTML elements), and HTML elements
inside them, such as in an SVG foreignObject, by the direction of
their ancestors.
- FIX: Fix :dir() ignoring the value of an input with dir="auto"
and a missing or empty type.
- FIX: :dir() now uses a table generated from Unicode 18 instead of
unicodedata, so results no longer depend on the Unicode version
of the Python in use, and unassigned code points use their
default direction.
- FIX: :dir() now uses the value of an input with dir="auto" when
type is hidden, password, submit, reset, or button, as the HTML
specification does.
- FIX: dir="auto" and bdi now analyze the text of non-HTML
elements, such as SVG and MathML, and only ignore HTML elements
such as script, style, and bdi. The text directly in an iframe is
analyzed as well, and the contents of a template, which are not
part of the document, are not.
- FIX: :dir() no longer lets the contents of a template inherit
direction from the template or its ancestors, as they are not
part of the document. They are left to right unless they specify
otherwise.
- FIX: :dir() now matches a bdi element that is the root by its
text instead of assuming left to right.
- FIX: :dir() now treats any element without a parent element as
left to right, not just the root. Before, all but the first top
level element of a fragment parsed with html.parser never
matched.
- FIX: :dir() now accepts any identifier, as CSS requires,
including escaped ones. Values other than ltr and rtl do not
match anything.
- FIX: Respect namespaces provided by the parser when the root is
not an HTML element, such as an svg element extracted from an
html5lib document. Previously every element in such a tree was
treated as an HTML element, which affected namespace selectors,
namespaced attributes, and HTML specific pseudo-classes.
- FIX: Fix :lang() treating an element with an empty lang or
xml:lang attribute as having the language of a tagged ancestor.
- FIX: Cache forms without a default button when matching :default
to avoid quadratic time on forms with many non-default submit
candidates.
- FIX: Fix :in-range and :out-of-range matching elements whose
value, min, or max has a trailing newline; per HTML, such values
are not valid, so they are treated like a missing value and
cannot be out of range.
- FIX: Fix :in-range and :out-of-range raising ValueError when a
date, month, week, or local date and time input has a year with
more digits than Python will convert; such a year is now treated
as invalid.
- FIX: Fix :in-range and :out-of-range not recognizing a
datetime-local value, min, or max that uses a single space
instead of T to separate the date and time.
- FIX: Search a form only once for checked radio buttons when
matching :indeterminate to avoid quadratic time on forms with
many radio button groups.
- FIX: :lang() now uses the lang attribute of SVG elements, as the
HTML specification does (with xml:lang taking precedence).
Previously only xml:lang was considered for elements outside the
HTML namespace.
- FIX: :defined no longer matches HTML elements with an is
attribute (customized built-in elements), which, like custom
elements, are undefined until they are registered.
- FIX: Cache the index of each child when matching the general
sibling combinator (a ~ b and :has(~ b)) to avoid quadratic time
when the first matching sibling is far into a long list of
siblings.
- FIX: Match attribute values with the i modifier using ASCII case
insensitivity.
- FIX: Treat an input with an unknown type, such as type="foo", as
a text input in :placeholder-shown, :read-write, :read-only and
:dir(), as an invalid type is in the Text state in the HTML
specification.
- FIX: Fix :enabled and :disabled never matching input elements
with type="hidden".
- FIX: :required no longer matches input elements of types the
required attribute does not apply to (hidden, range, color,
submit, image, reset and button). Like in browsers, they match
:optional.
- FIX: Cache whether an element is or has a matching ancestor when
matching the descendant combinator (a b) to avoid time that grows
with the depth of the document to the power of the number of
combinators.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 5.18.1:
- Fix enter/leave room in connect handler, when a message queue is
used (regression introduced in v5.18.0)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 7.5.1:
- Type aliases with list of types in values crash execution
- Performance regression in Grep File
- Execution crashes if library import argument cannot be converted
- Tests in Markdown files get line numbers relative to the code
blocks, not to the file
- Argument conversion failing unexpectedly causes bad error
messages with keywords and crashes elsewhere (e.g. with listeners)
- --parseinclude with multiple data sources fails with "Suite '...'
contains no tests or tasks"
For more details, see the full release notes.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.16.2:
- Discard the late response of a cancelled request
- Fix missed buffered serial replies after a delayed wakeup
- Test case for cancelling request.
- Test wrong response gets discarded.
- Answer ILLEGAL_VALUE for a Write Single Coil value other than
0x0000/0xFF00
- Partial solve ext. cancel sideeffects.
- Correct CI for PR runs.
- Report bad file record frames as undecodable
- Wait for data when an RTU request arrives split
- return ILLEGAL_VALUE for out-of-range counts
- Correct doc of write_coils / readwrite_registers
- Isolate PDU methods (using decoder).
- Fix decoders.decode()
- Fix convert_to_registers mutate value.
- add fixtures for PDU, socket and content.
- Combine decode in pdu.
- Allow multiple frames with bad decoding.
- Echo transaction id and device id in exception for undecodable
request.
- Remove rtu_byte_count_pos from pdu.
- Remove packet when MDAP is wrong.
- Correct fc in exception response.
- Multiple frames in one packet.
- Remove rtu_frame_size from pdu.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.5.0:
Breaking changes:
- DateData.period can take the new values "quarter" and
"part_of_day", and with RETURN_TIME_AS_PERIOD enabled a relative
date with hours, minutes or seconds, such as "2 hours ago", now
has the "time" period instead of "day" (#1417, #1437, #1473)
- Stop caching and sharing Settings instances: creating one with
the same settings twice now gives two different objects, and the
Settings.registry_key attribute no longer exists
- Remove the leftovers of fastText support from dateparser_cli: the
fasttext_manager and exceptions modules and
utils.create_data_model_home(); utils.dateparser_model_home and
utils.DEFAULT_WINDOWS_CACHE_DIR are now pathlib.Path objects
- Remove Locale.to_parserinfo() and HijriDate.weekday(), which
always raised an exception (#1406, #1457)
Deprecations:
- Deprecate dateparser.timezone_parser.convert_to_local_tz()
and dateparser.timezone_parser.build_tz_offsets()
- Emit a FutureWarning naming the TZ value from parse(),
DateDataParser and search_dates() when the local timezone cannot
be determined; a future version will raise RuntimeError instead
of failing to parse the date (#1403, #1556)
- Deprecate dateparser.utils.registry() and Settings.get_key(),
which now emit a FutureWarning (#1442, #1556)
- Deprecate get_week_start() and get_week_end() in
dateparser.utils.time_spans, and calling generate_time_span()
without base_date or settings; all of them now emit a
FutureWarning (#1393, #1556)
- Deprecate dateparser.date.RE_TRIM_COLONS (GHSA-fmxc-97cw-ph6p
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-fmxc-97cw-ph6p>_)
Security fixes:
- Make sentence splitting in search_dates() linear on long
punctuation runs, to prevent quadratic backtracking (ReDoS) for
Arabic, Bengali, Cantonese, Chinese, Hindi, Japanese and Persian
(GHSA-rx9v-94ff-9cc2
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-rx9v-94ff-9cc2>_)
- Prevent quadratic regex matching (ReDoS) on long digit runs in
Cantonese, Chinese and Japanese, and a ValueError on runs of more
than 4,300 digits on Python 3.10.7 and later (GHSA-g8fh-jxm9-6qfx
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-g8fh-jxm9-6qfx>_)
- Bound the lookahead of the Chinese month simplification, to
prevent quadratic parsing time on long runs of numbers followed
by 月 (GHSA-q7fp-xwcm-6x9f
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-q7fp-xwcm-6x9f>_)
- Prevent quadratic regex matching (ReDoS) on long runs of digits
or whitespace (GHSA-gqj4-wf6c-wmcg
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-gqj4-wf6c-wmcg>_)
- Strip trailing colons in linear time, to prevent quadratic
backtracking (ReDoS) on long colon runs (GHSA-fmxc-97cw-ph6p
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-fmxc-97cw-ph6p>_)
- Split strings into known words in linear time, to prevent
quadratic parsing time on long runs of words like month names
(GHSA-jxmm-w6rw-32ch
<https://github.com/scrapinghub/dateparser/security/advisories/GHSA-jxmm-w6rw-32ch>_)
New features:
- Add a STRICT_DATE_ORDER setting that turns an explicit DATE_ORDER
from a preference into a requirement: "year" reads a two-digit
year only from the position DATE_ORDER gives it, and "all" also
keeps the day and month where the order puts them
- Add a TIMEZONE_ABBREVIATIONS setting to override the offset of
timezone abbreviations, e.g. to read IST as India Standard Time
instead of Israel Standard Time
- Parse parts of the day, such as "tomorrow morning", "this
evening" or "8 in the evening", at the times set by the new
PARTS_OF_DAY setting; the new DateData.part_of_day attribute
tells which one was found
- Add DateData.parts, which lists the date parts (day, month, year,
time…) read from the input rather than filled in from defaults
- Add an add_period argument to search_dates() to also return the
period of each date
- Add a date_formats argument to search_dates(), to find dates
written in the given formats; it requires strategy="ngram" and
raises ValueError with the default "split" strategy
- Add the French Republican calendar and the Minguo (Taiwanese)
calendar (#1483, #1489)
- Parse calendar quarters, such as "2025Q1", "2025-Q3" or "Q4
2025", as a month of that quarter picked by PREFER_MONTH_OF_YEAR
(by default, the month as far into the quarter as the current
month is into its own)
- Parse "last", "this" and "next" before a weekday in English, e.g.
"next Friday", as the closest occurrence of that weekday before,
on or after, and after the current date, whatever
PREFER_DATES_FROM is, except for the abbreviations "wed", "sat"
and "sun"; search_dates() now includes the word in its matches
- Parse "the Nth of last/this/next month" as a day of that month
- Parse Roman numeral years written in capitals, e.g. "5 March
MDCCLXXVI"; a short one such as "MMX" is read as a year only next
to a month name, e.g. "April MMX"
- Parse dates with a bare UTC offset, such as "+03"
- Parse AM/PM written before the time, e.g. "PM 2:26" or "下午
02:26:26"
- Parse ISO 8601 fractional seconds written with a decimal comma,
e.g. "12:30:45,123"
- Parse English number words from thirteen to ninety-nine, e.g.
"forty-five seconds ago"
- Parse "fortnight" and "century" in English relative dates, and
read "a decade from now" as the future instead of the past
- Match month and weekday names in date_formats in the given
languages, so formats with literal text work, e.g. "el %d de %B
de %Y" for "el 15 de junio de 2020" with languages=["es"]
- When a date does not parse, try the other meanings of ambiguous
words, such as Spanish "mar" (martes or marzo), and read
a token that is both a weekday and a month abbreviation as the
weekday when that is what fits
- In search_dates(), find dates written:
- right after a label and a colon in Chinese or Japanese, e.g.
"日期：2020年12月28日"
- next to a relative date without a comma
- joined by words that search skips, like "and"
- inside parentheses, square brackets or straight quotes, e.g.
'He said "May 5, 2020"' or "(Friday)"
Fixes:
- Take the current date, used to fill in the missing parts of a
date such as "12:30" or "Nov" and to apply PREFER_DATES_FROM,
from the TIMEZONE setting (the local time zone by default)
instead of UTC
- Keep the %z offset when parsing with date_formats, and return a
timezone-aware date for it unless RETURN_AS_TIMEZONE_AWARE is
False
- Read year-first dates, such as "2021-01-13", as YMD unless
DATE_ORDER starts with the year
- Swap the day and the month when they do not fit an explicit
DATE_ORDER, whatever its value, e.g. "01/13/2021" with DMY
- Read a lone number next to a four-digit year as the month under
any DATE_ORDER
- Apply PREFER_DAY_OF_MONTH before PREFER_DATES_FROM picks the year
, and apply PREFER_DAY_OF_MONTH and PREFER_MONTH_OF_YEAR
to relative dates such as "last year"
- Apply an explicit DATE_ORDER to every date that search_dates()
finds, not only to the first one
- Stop dropping extra numbers when parsing dates: a string with
more numbers than a date has, such as "5 10 Jan 2020" or
"03/04/2021 5", now returns None instead of a date built from
some of them
- Stop reading two adjacent numbers of a Russian numeric date as
one compound ordinal, so parse("20 03 2021", languages=["ru"])
returns 20 March 2021 instead of the 23rd of the current month
- Return None for strings with only skipped words, such as "year"
or "hour minute", instead of today, which also stops
search_dates() from returning them (#1440, #1564)
- Stop ignoring numbers without a unit in relative dates, so
"03/06/2020 hour", "03/06/2020 day" or "01.02.2011 godz. 08:39"
no longer parse as a number of hours or days ago
- Stop reading "Nth day" as a number of days, e.g. "the 1st day of
March 2015"
- Parse "at 22h" and "à 22h" as a time of day, not as hours ago; a
bare "à 22h" is still read as English hours ago unless
languages=["fr"] is given or the text has other French words,
such as "demain à 22h"
- Keep the future direction of a relative expression that
search_dates() finds next to punctuation, e.g. "in 2 hours,
thanks"
- Stop French "sept" being read as 7 when it means September, e.g.
"1 sept 2024" with languages=["fr"] and "le 3 sept à 10h" with or
without languages; "sept" now means 7 only before a duration unit
or a clock time ("sept jours", "sept heures", "sept:30"), so a
day written as a word, as in "sept mai 2020", no longer parses,
and a bare "sept" is read as September
- Parse dates with a numeric offset followed by a redundant
timezone abbreviation, e.g. "-0500 (CDT)", or with an
abbreviation glued to the time, e.g. "2019-09-28WIB19:17:34"
- Recognize UTC offsets written with Unicode dash-like characters,
such as "−05:00"
- Keep complete week dates (year, week number and weekday) when
parsing with date_formats, including %G ISO week years
- Fix negative timestamps with subseconds
- Keep AM when searching for dates after a time
- Keep full stops between digits in search_dates() sentences
- Fix search_dates() dropping text next to a standalone accent mark
- Fix search_dates() raising IndexError for the zh-Hans, zh-Hant
and yue locales, including when it detects one of them in the
text, e.g. "聽日"
- In search_dates(), include the closing bracket in the matched
text, e.g. "8 May 2020 (16:05)", and stop including separators
such as "/" or "|"
- Split a relative date from a numeric date that follows it in
search_dates(), e.g. "3 days later on 2010-05-10"
- Stop growing internal caches with every distinct RELATIVE_BASE
value
- Fix parse() and DateDataParser returning None when region does
not match the language of the text, e.g. parse("12 mars 2020",
languages=["fr"], region="MX") or parse("5 de marzo de 2020",
region="US")
- Fix dateparser.utils.get_logger() raising AttributeError when
logging.config had not been imported
Improvements:
- Speed up parse() by about 35%, skip locales that cannot
change the outcome of a failed parse, and speed up import
by compiling the timezone regexes lazily
- Arabic: parse relative dates that use قبل for "ago",
Egyptian and informal ة→ه spellings, numbered Levantine
month names such as "كانون 2" in the ar-SY, ar-JO, ar-LB, ar-PS
and ar-IQ locales only, e.g. locales=["ar-SY"] or region="SY"
, Arabic dates typed with Persian yeh and kaf and Persian
dates typed with Arabic ones, and Arabic month names and
Arabic-Indic digits in Hijri dates
- Chinese: add the supplementary data of zh to zh-Hans and zh-Hant
, and parse 后天, 大后天 and 大前天 as relative days
- Chinese and Japanese: parse dates with spaces around 年, 月 and 日
- French: parse "midi" as noon, e.g. "demain à midi" ("après-midi"
and "avant midi" are still not read as noon); this also applies
when no languages are given, so search_dates() can return "MIDI"
in an English text as 12:00
- Indonesian: add old-style month abbreviations, such as "Djan" or
"Peb"
- Korean: parse absolute dates written with 년, 월, 일, 시 and 분
- Slovak: parse "pozajtra"
- Swedish: parse ordinal day suffixes like "24:e" and "1:a"
- Thai: parse relative dates with spaced ago/in words
- Vietnamese: parse dates with zero-padded months
- Add type hints
- Document search_dates() in the API reference, add a
performance section, explain how DEFAULT_LANGUAGES
relates to the languages argument and how date_formats
falls back to the other parsers
- Show the whole README on PyPI
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.2.0:
- Add i8, u64, u32 and u16 native integer types
- Drop support for Python 3.8 and 3.9, officially support 3.14 and
3.15
- Permit building with flit core 4
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 5.7.2:
- Proper routing of an event called * in the catch-all handler
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 6.1.3:
Security fixes:
- CVE-2026-108147: Potential memory exhaustion in MultiPartParser
via base64-encoded file upload
- CVE-2026-111211: Potential log injection via unescaped geometry
form values
- CVE-2026-111362: Server-side request forgery via crs member of
GeoJSON geometrie
- CVE-2026-113593: Potential exposure of private data via empty
and missing Vary headers
- CVE-2026-113733: Password hash disclosure to “view only” admin
users with custom user models
- CVE-2026-114582: Server-side request forgery via
SpatialReference string input
Bug fixes:
- Fixed a bug in Django 6.1 where accessing a deferred field with
the FETCH_PEERS fetch mode overwrote values that peer instances
had already modified locally or loaded via refresh_from_db() with
an explicit fields argument. The fix also addresses a KeyError
when a peer's row had been deleted
- Fixed a regression in Django 6.1 where the YAML serializer
crashed if passed the sort_keys option
- Fixed a regression in Django 6.1 where a Value expression with a
None value and an output field other than JSONField crashed on
SQLite when used in a top-level JSONField in lookup. Using such an
expression in an IN lookup is likely unintended, since SQL NULL
cannot match any value.
- Fixed a regression in Django 6.1 where legend_tag() with a
custom attrs could add the required_css_class more than once.
- Added compatibility for oracledb 26.0.0+
- Fixed a crash in makemessages on Windows when processing files
with non-ASCII names on Python 3.15+, or with UTF-8 mode enabled
on older Python versions.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 7.17.1:
- Fix: a one-line class or function body immediately followed by
another statement (such as class Foo: ... on its own line) was
incorrectly reported as a missing branch when using the
sys.monitoring core. This is now fixed.
- Fix: the HTML report only rewrites a file's page when the file or
its data has changed, but each page also links to the previous
and next files. When the set of reported files changed, unchanged
pages kept their old links. For example, with skip_covered, a
file that became 100% covered had its page deleted, but the pages
next to it still linked to it. Now a page is also rewritten when
its neighbors change.
- Fix: --fail-under now uses at least the decimal precision of the
threshold for both the comparison and failure message. With
precision=0, a total of 0.4 now passes --fail-under=0.3 and fails
--fail-under=0.5 with the message "total of 0.4 is less than
fail-under=0.5". Previously, the comparison rounded the total to
zero and the message could claim "1 is less than 0".
- Fix: the HTML report escaped file names twice, so a name with &,
<, or quotes in it was shown with entities like &. Now they
are properly escaped only once.
- Fix: --source=/ measured no files. A file system root can't be a
source directory, so now it is an error.
- In an abundance of caution, prevent forged SQLite journal files
from deleting files they shouldn't.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.4.1:
- Size the relay test's payload from the pipe capacity
- Publish releases from GitHub Actions with PyPI provenance
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 26.11.1:
- Security: parse the HTTP headers of the WebSocket opening
handshake strictly (RFC 9112, RFC 9110). The header block was
split with str.splitlines(), which also splits on VT, FF, FS, GS,
RS, NEL and on a bare CR or LF, so a peer could make autobahn see
header lines that a front proxy treats as part of a header value,
for example an X-Forwarded-For used with trustXForwardedFor.
Lines are now separated by CRLF only. ⚠ behaviour change — a
header block with a bare CR or LF, obs-fold, whitespace before
the colon, an invalid header name, a header line without a colon
(was skipped), or a control character in a header value or the
status line is rejected: the server fails the handshake with HTTP
400, the client fails the handshake or the proxy CONNECT. A bare
LF is rejected deliberately, although RFC 9112 allows accepting
it as a line end. obs-text (0x80-0xFF) in header values is still
allowed, and header values are trimmed of SP and HTAB only. This
fixes advisory GHSA-2gqc-mwv3-66rp
- Security: raise the floors of the compress extra (and so all)
to brotli>=1.2.1 (CPython) and brotlicffi>=1.2.1.0 (PyPy), the
releases with the fix for CVE-2026-111497, an out-of-bounds write
in the brotli decoder that permits remote code execution.
permessage-brotli decodes data sent by the WebSocket peer; it is
not used unless an application offers or accepts it. The brotli
1.0.10 and 1.1.1 backports of the fix are not enough, since the
permessage-brotli receive path needs the decompression limit of
brotli 1.2. New tests check the declared floors and the installed
version
- Add tests for the HTTP header parsing of the WebSocket opening
handshake, on the server, the client and the explicit proxy
CONNECT, run on Twisted and asyncio
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 6.10.1:
- Recognize trace operations defined in view docstrings, instead
of silently dropping them
- Fix intersect OneOf and Equal choices in field2choices
- Drop support for marshmallow 3, which is EOL
- Drop support for Python 3.10
- Test against Python 3.15
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The test is parametrized over gateway types; it imports "remote" from
its tmp_path and then deletes that directory, but the module stays in
sys.modules. Every run after the first got the stale module back and
failed with "OSError: could not get source code". Drop the cached
module before importing it.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
1.7.5 replaced py.process.ForkedFunc with multiprocessing, so swap the
python3-py runtime dependency for python3-multiprocessing. The sdist is
now named pytest_forked, the pypi class default, so drop
PYPI_PACKAGE_SDIST.
Backport the pending upstream fix for pytest 9.2, where TestReport
carries a NodeId object in _id that marshal cannot serialize; every
forked test crashed with "ValueError: unmarshallable object". This made
python3-starlette ptests report no results at all; all of them pass
now on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The project dropped setup.py, switch to python_setuptools_build_meta.
The sdist is now named pytest_benchmark, which is the pypi class
default, so drop PYPI_PACKAGE_SDIST. License checksum change is due
to the copyright year update.
5.1.0 broke every test with pytest 9.2 and Python 3.14:
AttributeError: 'Function' object has no attribute '_nodeid'
PendingDeprecationWarning: FileType is deprecated.
which made ptests fail in python3-pint, python3-fastjsonschema,
python3-portion, python3-tblib, python3-construct and
python3-pydantic-core. These now all pass on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
4.2.9 needs hatch-fancy-pypi-readme as a build backend plugin, add
it to DEPENDS.
This also fixes ptest failures seen with 4.2.4, e.g.
test_post_open_failure_closes_fd[fstat] and the soft lock
lease/stale tests; all ptests pass now on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_sequence_docs.py executes the code examples embedded in
docs/usage.rst, resolved relative to the tests directory. The file was
not installed, so all 26 tests in it failed with:
FileNotFoundError: [Errno 2] No such file or directory:
'/usr/lib/python3-cbor2/ptest/docs/usage.rst'
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Regenerate python3-cbor2-crates.inc to match the bundled Cargo.lock.
The previous crates list was stale (bigdecimal 0.4.10 vs 0.4.11 locked),
which made cargo metadata fail in do_compile with:
failed to select a version for the requirement `bigdecimal = "^0.4.10"`
(locked to 0.4.11)
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Khem Raj
Thomas Roos
Leon Anavi
Bartosz Golaszewski