10941 Commits
Author SHA1 Message Date
Leon Anavi 0563530a78 python3-zeroconf: Upgrade 0.151.5 -> 0.153.0
Upgrade to release 0.153.0:

- Drop Python 3.10 support

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:34 -08:00
Leon Anavi 9242b140bb python3-wtforms: Upgrade 3.3.1 -> 3.3.2
Upgrade to release 3.3.2:

What's Changed:

- chore(deps): Bump the "dependencies" group with 1 update across
  multiple ecosystems

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:34 -08:00
Leon Anavi e231f03b8f python3-wrapt: Upgrade 2.5.1 -> 2.5.2
Upgrade to release 2.5.2:

- The special methods added to the class generated for an
  wrapt.AutoObjectProxy, and adjusted when __wrapped__ was
  reassigned, were determined by inspecting the wrapped object
  itself, rather than the type of the wrapped object. As special
  methods are only ever looked up on the type of an object, this
  gave the wrong result in several cases. When the wrapped object
  was a class, the special methods it defined for its instances
  were added to the proxy class, so a proxy for a class defining
  __set_name__() raised TypeError when assigned to an attribute in
  a class body, a proxy for a class defining __get__() was bound as
  a descriptor on attribute access, and a proxy for a class
  defining __await__() or __iter__() was reported as awaitable or
  iterable by inspect.isawaitable() and collections.abc checks,
  even though the class itself was not. Special methods provided by
  the metaclass of a wrapped class, such as __iter__(), were not
  added to the proxy class. When the wrapped object was an
  instance, instance attributes shadowing the dunder names were
  treated as special methods of the wrapped object, and special
  methods which a __dir__() method of the wrapped object did not
  report were missed. The special methods are now always determined
  from the type of the wrapped object, so a proxy behaves the same
  as the object it wraps. This also covers a wrapt.LazyObjectProxy
  whose factory returns an object, as resolving the wrapped object
  reassigns __wrapped__. With thanks to ybai08 for pull request
  #361 which identified the issue.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:34 -08:00
Leon Anavi 010f86076f python3-twisted: Upgrade 26.4.0 -> 26.10.0
Upgrade to release 26.10.0:

Security fixes:

- CVE-2026-83813 (GHSA-jj36-9pvh-vj5r)
- CVE-2023-44487 (GHSA-vpp8-g58w-m8mp)
- CVE-2026-115778 (GHSA-cwm5-jh59-mwxr)
- CVE-2026-115775 (GHSA-3476-c5c2-fr73)
- CVE-2026-115877 (GHSA-q7qq-6mhp-9rc4)
- CVE-2026-115774 (GHSA-2qrf-pqgx-qh9v)
- CVE-2026-115776 (GHSA-53xc-49m8-p798)

Features:

- It is now possible to set the SO_REUSEPORT and SO_REUSEADDR TCP
  socket flags from user code.
- Python 3.14 is now supported.
- twisted.internet.defer.Deferred.__iter__, used when awaiting a
  Deferred, is now about 2-3% faster.

Bugfixes:

- twisted.internet.tcp.Port.startListening() now closes the socket
  when raising CannotListenError.
- Initiating a TCP connection with an address literals and a port
  outside of the 1-65535 range in twisted.internet.tcp.BaseClient
  and twisted.internet.iocpreactor.tcp.Client now triggers an
  errback instead of an unhandled error. This change might also fix
  other unhandled errors occurred while connecting using address
  literals.
- twisted.logger.LoggingFile.fileno now raises
  io.UnsupportedOperation instead of returning -1. This fixes an
  interoperability issue with multiprocessing.
- twistd now exits with a non-zero status when given an unknown
  subcommand.
- twisted.internet.testing.MemoryReactor.removeAll() now returns
  what was removed to comply with IReactorFDSet.removeAll()

- twisted.internet.asyncioreactor.AsyncioSelectorReactor.callLater
  now has the same signature as
  twisted.internet.interfaces.IReactorTime.callLater.
  twisted.internet.asyncioreactor.AsyncioSelectorReactor.callFromThread
  now has the same signature as
  twisted.internet.interfaces.IReactorFromThreads.callFromThread.

- twisted.protocols.ftp.FTPClient now uses ip address of the
  original ftp server to open passive data connections by default,
  instead of trusting PASV responses.

Improved Documentation:

- The "Writing Servers" and "UDP Networking" documentation pages
  have been updated to remove obsolete references to persisting the
  reactor (a feature gone from Twisted for several decades now),
  and to better explain the factory and protocol setup and teardown
  lifecycle.
- Twisted's policy documentation now includes a prominently
  featured, clear explanation of our AI policy: to wit, including
  the outputs of generative AI systems is forbidden.

Deprecations and Removals:

- twisted.internet.tcp.Connection no longer supports returning a
  non-None value from a protocol's dataReceived method, deprecated
  since Twisted 11.0.0.
- twisted.internet.error.PotentialZombieWarning, deprecated since
  Twisted 10.0, has been removed.
- Implementations of twisted.internet.interfaces.IProcessProtocol
  are now required to provide a processExited method. Omitting this
  method was deprecated in Twisted 8.2.
- twisted.internet.ssl.protocolNegotiationMechanisms and
  twisted.internet.ssl.ProtocolNegotiationSupport are deprecated
  because all supported TLS backends provide ALPN. Callers can
  configure ALPN without checking for support.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi ea007add6c python3-trio: Upgrade 0.34.0 -> 0.35.0
Upgrade to release 0.35.0:

- Mark that Trio supports 3.15.
- Ensure that Trio consistently encodes all hostnames using IDNA
  2008.
- Avoid erroring when running in a CPython built for an Android API
  version less than 24.
- Ensure trio.lowlevel.notify_closing works even on events that
  have been deleted, e.g. because they were registered as one shot
  events.
- trio.Process no longer emits an EncodingWarning on Linux when
  Python runs with -X warn_default_encoding
  (or PYTHONWARNDEFAULTENCODING=1).
- The typing for async-file-objects is now consistent about what it
  exposes based on what is exposed by the underlying object.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi f3f36654a0 python3-socketio: Upgrade 5.17.0 -> 5.18.0
Upgrade to release 5.18.0:

- Reject events over HTTP before the connection completes

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi fc02b4475a python3-python-multipart: Upgrade 0.0.32 -> 0.0.33
Upgrade to release 0.0.33:

This release lets you cap URL-encoded form fields as they stream in, and
fixes several upload and decoding edge cases. It also drops Python 3.10
and adds Python 3.15.

- Limit URL-encoded fields while streaming. The new opt-in
  MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise
  FormParserError before oversized data is buffered. Both default
  to no limit, and multipart forms are unaffected.
- Nameless uploads no longer crash when spilled to disk.
  Uploads without a filename used to raise AttributeError when
  UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
- UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME. A str
  upload directory used to fail on the first write to disk.
- Decoded data is complete before callbacks run (#336, #355).
  Content-Transfer-Encoding decoders are finalized at the end of
  each part, and quoted-printable escapes split across writes
  decode correctly.
- parse_options_header lowercases content types with parameters
 . Multipart/Form-Data; boundary=abc now returns
  multipart/form-data, the same as headers without parameters.
- Faster opening boundary matching. Complete boundaries are
  matched in one step.
- Faster parser state lookups. Parser states are
  module-level enum members, so their repr is now multipart.END
  instead of <MultipartState.END: 12>.
- Faster querystring callback dispatch.
- Python 3.10 is no longer supported. Python 3.11 is now the
  minimum.
- Python 3.15 is supported.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi 135ffe8da0 python3-pytest-codspeed: Upgrade 5.0.3 -> 5.0.4
Upgrade to release 5.0.4:

- Support pytest 9.2: pytest --codspeed no longer crashes at
  session start when pytest-benchmark is installed
- build: pin -std=c11 for instrument-hooks core.c
- docs(readme): bump action version to v5
- feat: warn when running on an unsupported Python version
- ci: migrate to github default arm runners
- ci: use 26.04 image instead of latest
- ci: test against stable python 3.15 and 3.15t
- docs: add Python 3.15 to README version badge

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi 9c5f02348d python3-pytest-asyncio: Upgrade 1.4.1 -> 1.4.1.post1
Upgrade to release 1.4.1.post1:

Changed:

- Removed the upper version bound on the pytest dependency.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:33 -08:00
Leon Anavi 1f86ceb4c8 python3-oauthlib: Upgrade 4.0.0 -> 4.0.1
Upgrade to release 4.0.1:

- CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token
  endpoint did not validate the device_code parameter. A request
  with a known client_id and a bogus device_code could obtain a
  bearer token. DeviceCodeGrant.validate_token_request now calls
  DeviceCodeGrant.validate_device_code(), which rejects missing or
  unknown device codes (invalid_request / invalid_grant) and
  delegates the code's authorization status to the new
  RequestValidator.validate_device_code() hook, per RFC 8628
  Section 3.5.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi 01ba445a0e python3-nodeenv: Upgrade 1.11.1 -> 1.12.0
Upgrade to release 1.12.0:

- feat(nodeenv): print shell completion scripts with shtab
- fix(nodeenv): point npm_config_prefix at the env in activate.bat
  and Activate.ps1
- fix(nodeenv): install npm from the registry tarball on Windows
- fix(nodeenv): read quoted config values and mirror credentials
- fix: stop putting ^/dev/null on PATH in activate.fish
- fix(nodeenv): retry broken node downloads and stop hanging on
  stalls
- fix: do not require python2 to build node from source
- fix(nodeenv): do not put the venv bin on PATH twice with -p
- fix(nodeenv): skip node.js pre-releases for latest and ranges
- fix: preserve fish activation environment
- fix(nodeenv): read a config value raw when interpolation fails
- fix(nodeenv): ignore source trees during prebuilt installs
- fix(nodeenv): escape glob characters in prebuilt paths
- fix(nodeenv): raise on bad config references again
- Make tox configuration more flexible
- chore(tests): port the Makefile test targets to pytest
- Align Python support metadata and runtime with Python 3.10+
- perf(nodeenv): unpack the node.js zip archive in parallel
- docs(site): new landing page for ekalinin.github.io/nodeenv
- docs(site): show GitHub stars and PyPI downloads badges
- docs: update isolated installation instructions
- docs(contributing): add contributing guide and templates

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi ae61861875 python3-jsonpatch: Upgrade 1.38 -> 1.39
Upgrade to release 1.39:

- Test that the code examples in the docs run and match their
  output
- Raise JsonPatchConflict when removing from immutable containers
- docs: explain copy and in-place behavior when a patch fails

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi fb7795bbc5 python3-ipython: Upgrade 9.17.1 -> 9.18.1
Upgrade to release 9.18.1:

- The main change in this release is that themes are now JSON data:
  you can install a theme by putting a file in your IPython
  directory, or from a package, without writing any code.
- The release also fixes a number of completion regressions, fixes
  WebP handling in ~IPython.display.Image, stops get_tail from
  wiping the history database when ipykernel asks for n=None, and
  adds ~IPython.core.formatters.DisplayFormatter.register_formatter.
- theme_table can no longer be mutated, and the individual theme
  objects are no longer importable from IPython.utils.PyColorize.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi 0e0c8dbe07 python3-huey: Upgrade 3.5.3 -> 3.5.4
Upgrade to release 3.5.4:

- Fix possible hang if worker holding the stop flag was killed
  while holding it.
- Lots of refactoring/cleanup.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi 25b9cdfcd4 python3-grpcio-reflection: Upgrade 1.85.0 -> 1.85.1
Upgrade to release 1.85.1:

- Fixes Denial of service in Health Watch RPC
- Fixes Memory leak in AsyncIO client-streaming calls with
  interceptors

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:32 -08:00
Leon Anavi 4b9a01eaaa python3-grpcio-channelz: Upgrade 1.85.0 -> 1.85.1
Upgrade to release 1.85.1:

- Fixes Denial of service in Health Watch RPC
- Fixes Memory leak in AsyncIO client-streaming calls with
  interceptors

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi c9b9aa121d python3-flask-socketio: Upgrade 5.7.0 -> 5.7.1
Upgrade to release 5.7.1:

- Update version of python-socketio dependency
- Add Python 3.15 and PyPy 3.12 to CI

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi 276523852d python3-fastjsonschema: Upgrade 2.22.2 -> 2.22.3
Upgrade to release 2.22.3:

- Fixed property names with { or } being evaluated as format string
  in error messages
- Fixed numeric keywords (minimum, maximum, multipleOf,
  exclusiveMinimum, exclusiveMaximum) being applied to booleans
- Fixed propertyNames: false crashing on non-object values
- Fixed the date-time format accepting months, days and hours out
  of range (such as 2020-19-39T29:00:00Z) and rejecting a leap
  second (23:59:60Z)
- Fixed the date and date-time formats accepting days that do not
  exist in their month, such as 2021-02-29 and 2021-04-31
- Fixed the time format accepting hours, minutes, seconds and
  offsets out of range (such as 29:99:99)
- Fixed minimum and maximum being exclusive in draft 06 and later
  when exclusiveMinimum or exclusiveMaximum is set to a number
  other than zero
- Fixed bools in uniqueItems
- Added type annotations for public API and py.typed marker
  (PEP 561)
- Added message to JsonSchemaValuesException joining messages of
  all collected errors

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi b0c03dffde python3-cmd2: Upgrade 4.3.1 -> 4.4.0
Upgrade to release 4.4.0:

- Fix history ranges starting past the end
- Fix History.truncate() leaving session start index stale
- Flush window title updates without waiting for a prompt
- Fix two races behind the flaky pipeline job-control test
- Add security policy naming the Security Maintainer
- Preserve history session boundaries across list mutations
- Track history session membership by entry instead of index
- Preserve live history while persisting a bounded copy
- Address review feedback on persisted history copy

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi ff180c6359 python3-cbor2: Upgrade 6.1.5 -> 6.2.0.post1
Upgrade to release 6.2.0.post1:

- Build Pyodide (pyemscripten) wheels for Python 3.14

From 6.2.0:

- Added the strict_hashable_types parameter to CBORDecoder, load()
  and loads() which, when enabled, restricts map keys and set
  elements to text strings and byte strings in order to prevent
  denial-of-service attacks via hash collisions
  (GHSA-p6xp-9h6j-r278)
- Documented decoding concatenated CBOR objects with EOF checks
  between objects
- Fixed CBOREncoder.encode_to_bytes() sharing the string reference
  namespace of the enclosing encode operation when called from a
  default hook
- Fixed the encoder writing the repr() of a bytes regular
  expression pattern (tag 35) instead of the pattern itself, so the
  regular expression decoded back as the text pattern b'...' and no
  longer matched the same input
- Fixed shared references (tag 29) allowing the decoder to
  construct object graphs nested deeper than max_depth, which could
  crash the interpreter with a segmentation fault when such an
  object was hashed (as a map key or set member)
  (GHSA-55vx-2phh-7grr)
- Fixed mission conversion of date values (tags 100 and 1004) to
  JSON as ISO formatted strings
- Fixed a PanicException on Python 3.10 when decoding a string-form
  datetime (tag 0) whose fractional seconds part contains a
  multi-byte Unicode numeric character, as the microsecond padding
  treated those as digits and then truncated the part on a byte
  index inside one of them
- Fixed the decoder accepting a set (tag 258) whose payload is not
  an array, folding a text string, byte string or map into a set of
  its characters, bytes or keys instead of rejecting it
- Fixed the decoder accepting a non-integer exponent or mantissa in
  a decimal fraction (tag 4) or a bigfloat (tag 5)

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi 5426691227 python3-cachetools: Upgrade 7.2.7 -> 7.2.8
Upgrade to release 7.2.8:

- Fix type stubs for TTLCache and TLRUCache with default timer.
- Minor documentation and unit test improvements.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:31 -08:00
Leon Anavi f2963e81ee python3-anyio: Upgrade 4.15.1 -> 4.16.0
Upgrade to release 4.16.0:

- Added BlockingPortal.call_async() for asynchronously calling into
  an event loop with optional abandonment on cancellation
- Added SOCK_SEQPACKET support to connect_unix() and
  create_unix_listener()
- Changed UDP sockets on the asyncio backend to make send() wait
  until the datagram has been passed to the operating system
- Fixed documentation implying that use_uvloop=True falls back to
  the standard event loop when uvloop (winloop on Windows) is not
  installed, and showed how to skip the corresponding pytest
  backend variant when the dependency is missing
- Fixed get_current_task() on the asyncio backend raising an opaque
  TypeError: cannot create weak reference to 'NoneType' object
  instead of a clear error when called from a callback scheduled
  via loop.call_soon_threadsafe() (e.g. from within
  from_thread.run_sync()), where asyncio.current_task() is
  legitimately None
- Fixed CancelScope on the asyncio backend swallowing a native
  Task.cancel() that was delivered in the same event loop iteration
  as the scope's own cancellation (such as a move_on_after()
  deadline expiring), which left the host task with a pending
  cancellation request that never raised CancelledError (\#1214)
- Fixed UDP socket closing hanging if a datagram send was still in
  flight
- Fixed concurrent aclose_forcefully() calls on asyncio socket
  streams returning before the underlying socket was closed
- Fixed aclose() on sockets not checkpointing, and thus failing to
  raise a cancellation exception when called inside a cancelled
  scope (affected UNIX socket streams and UNIX datagram sockets on
  asyncio, and all sockets on Trio)
- Fixed aclose() on asyncio TCP socket listeners not checkpointing,
  and leaking the listening socket if cancelled while another task
  was waiting in accept()
- Fixed accept() on asyncio UNIX socket listeners hanging forever,
  and leaving the listening socket registered with the event loop,
  when the listener was closed by another task
- Fixed send() on asyncio TCP and UDP sockets returning normally,
  despite the data being discarded, when the socket was closed by
  another task (or, for TCP, the connection was lost) while send()
  was waiting for the operating system to accept the data
- Fixed SocketStream.send() on the asyncio backend handing its data
  to a paused transport after a previous send() was cancelled
- Fixed sleep() treating a negative delay (including -inf)
  inconsistently across backends (asyncio returned immediately;
  Trio raised ValueError) by raising ValueError on all backends
- Fixed create_tcp_listener() occasionally failing with a message
  like Could not create 2 listeners with a consistent port when an
  ephemeral port is requested and IPv6 is enabled and the
  dual-stack path is not available or a specific local host name
  was given
- Fixed AsyncFile not shielding against cancellation while closing
- Fixed TemporaryDirectory.cleanup() reacting to cancellation
  prematurely when the host task was already cancelled, causing the
  actual cleanup operation to be skipped
- Fixed a NaN deadline being accepted on asyncio while Trio raised
  ValueError, which silently disabled the timeout
  (fail_after(math.nan) returned instead of raising TimeoutError);
  CancelScope now rejects it on both backends
- Fixed FileReadStream and FileWriteStream leaving files open when
  cancelled during context manager exit, including unflushed writes
- Fixed Condition.notify() and Condition.notify_all() failing when
  the underlying lock was acquired directly rather than through the
  condition
- Fixed importing AnyIO with loaders that do not provide __file__,
  such as PyOxidizer, raising TypeError instead of falling back to
  eager imports
- Fixed text receive streams silently discarding incomplete
  characters at end-of-file instead of applying the configured
  decoding error handler
- Fixed Semaphore(fast_acquire=True) losing its fast-acquire
  behavior when instantiated outside a running event loop
- Fixed BlockingPortalProvider permanently failing with an
  AttributeError on every subsequent use if the first attempt to
  start its blocking portal failed
- Fixed create_udp_socket() silently ignoring the local_port
  argument when local_host was omitted, making the socket bind to a
  random ephemeral port instead of the requested one
- Fixed worker threads on the asyncio backend never returning to
  the idle pool (and thus never being reused or pruned) when a
  to_thread.run_sync() call was cancelled after it had been queued
  for the worker but before the worker thread had picked it up
- Fixed pytest plugin running Hypothesis async tests only on the
  first parametrized backend instead of each backend
- Fixed TypeError when subclassing an existing TypedAttributeSet
  subclass, and this subclass contains type annotations
- Fixed Lock.locked() (and Condition.locked()) raising
  NoEventLoopError when the lock was created outside a running
  event loop
- Fixed connect_tcp() leaking a connected socket when an enclosing
  cancel scope was cancelled before the connection attempt task
  group exited
- Fixed create_connected_udp_socket() silently ignoring local_port
  when local_host was not given: the local address was left unset,
  so the OS picked an ephemeral port instead of the requested one
- Fixed BlockingPortalProvider not passing the exception raised in
  its with block on to the start_blocking_portal() context manager
  it wraps
- Fixed anyio.itertools.islice() not consuming the first start
  items when stop <= start
- Fixed BufferedByteReceiveStream.receive_exactly() and
  receive_until() returning buffered data after explicit closure
  instead of raising ClosedResourceError
- Fixed a TLS stream sending records the peer could no longer
  decrypt after a cancelled send() lost an already-encrypted
  record; the stream now raises BrokenResourceError on further use
  instead
- Fixed close() on memory object streams not waking up tasks
  blocked in send() or receive() on the same stream
- Fixed anyio.itertools.product() acquiring and consuming unused
  input iterables when repeat=0
- Fixed SpooledTemporaryFile rolling over to disk on writes when
  max_size is zero (the default)
- Fixed Trio UDP sockets remaining open when initialization failed
  or was cancelled
- Fixed SpooledTemporaryFile.rollover() moving the current file
  position to the end of the file
- Fixed cancellation during temporary directory creation leaving
  the directory behind while its context manager is retained
- Fixed cancellation during SpooledTemporaryFile.rollover() losing
  buffered contents
- Fixed TextSendStream.send() re-emitting the byte order mark on
  every item with BOM-emitting encodings (utf-16, utf-32,
  utf-8-sig), which made the peer decode a stray \ufeff in front of
  every message after the first
- Fixed buffered byte streams returning empty bytes when a wrapped
  object stream received empty messages instead of waiting for data
  or raising EndOfStream
- Fixed BlockingPortal crashing with InvalidStateError when a
  future it returned was cancelled just as the callable was
  completing
- Fixed UNIXSocketStream.send_fds() silently truncating messages on
  short socket writes
- Fixed cancelled TCP receives on the asyncio backend leaving
  transport reads enabled, allowing incoming data to accumulate
  while the application was not receiving.
- Fixed CapacityLimiter.acquire_on_behalf_of() on asyncio releasing
  the wrong borrower when the acquiring task was cancelled during
  the cancel-shielded checkpoint that runs after a non-blocking
  acquisition

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-03 07:10:30 -08:00
Khem Raj 0faea72623 python3-tomlkit: Remove recipe, it is in oe-core now
python3-tomlkit was added to oe-core (46d3b26a63 "python3-tomlkit: add
new recipe (from meta-oe)") and is at 0.15.2 there, so the meta-python
0.15.1 copy is not used. Drop it, and drop it from the meta-python ptest
list as oe-core's ptest-packagelists.inc already lists it.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Ross Burton <ross.burton@arm.com>
2026-11-03 07:10:30 -08:00
Kris Gavvala 53cf975e9b python3-pillow: patch CVE-2026-112393
This patch applies the upstream fix and related tests in commit [1]
to address the issue in [2].

[1] https://github.com/python-pillow/Pillow/commit/78c08bd4d9c08037f77465a61d90633f669013f4
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf

Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-02 19:16:17 -08:00
Leon Anavi 6568ff3954 python3-asciitree: Upgrade 0.3.3 -> 1.0.0
Upgrade to release 1.0.0:

- Configurable layout spaces through BoxStyle.gfx["SPACE"], with an
  ordinary-space fallback for existing palettes.
- Declared the existing public API stable, without breaking changes
  from 0.4.0.

Fixes:

WARNING: python3-asciitree-1.0.0-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml specifying backend
setuptools.build_meta, use the correct class [pep517-backend]

License-Update: Update copyright years to 2015-2026

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-11-02 06:49:25 -08:00
Khem Raj f3da02099d python3-fastapi: Upgrade 0.141.1 -> 0.162.0
Release notes: https://github.com/fastapi/fastapi/releases

* opentelemetry-api is now a runtime dependency
* Add opentelemetry-sdk and git to ptest dependencies, used by the new
  telemetry and translation script tests
* Ignore telemetry tests that need logfire, the opentelemetry OTLP
  exporter and the opentelemetry fastapi instrumentation, which are not
  packaged in meta-python
* Fixes the ptest hang in
  test_frontend_dependency_restores_existing_dependency_stacks with
  starlette 1.10, fixed upstream in 0.142.0

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:21 -07:00
Khem Raj 4faf8dd010 python3-opentelemetry-sdk: Add missing runtime dependencies
opentelemetry-sdk requires opentelemetry-api, opentelemetry-semantic-conventions
and typing-extensions, without them importing opentelemetry.sdk fails with:

ModuleNotFoundError: No module named 'opentelemetry.semconv'

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:21 -07:00
Khem Raj 8d36a79a6e python3-opentelemetry-semantic-conventions: Add missing runtime dependencies
opentelemetry-semantic-conventions requires opentelemetry-api and
typing-extensions.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:20 -07:00
Khem Raj 61e1cb4a0f python3-opentelemetry-api: Add missing runtime dependency
opentelemetry-api requires typing-extensions.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:20 -07:00
Khem Raj 4f1d8f85f0 python3-platformdirs: Fix ptest failures on musl
test_runtime_dir_unreachable_xdg_runtime_dir_warns hardcodes the glibc
strerror(ELOOP) text "Too many levels of symbolic links", whereas musl
reports "Symbolic link loop". Backport the upstream fix which uses
os.strerror() instead.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:20 -07:00
Khem Raj 2b8a5e012d python3-pyroute2: Add missing python3-resource runtime dependency
pyroute2/ndb/task_manager.py imports the resource module and it is
pulled in when importing pyroute2, so every ptest module failed to
import with:

ModuleNotFoundError: No module named 'resource'

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 20:59:20 -07:00
Khem Raj df1403411f tuna: Fix build with PEP 517 frontends
setup.py imports tuna.version from the source tree. The setuptools
build_meta backend does not put the source directory on sys.path, so
do_compile fails:

  File "<string>", line 9, in <module>
  ModuleNotFoundError: No module named 'tuna'
  ERROR Backend subprocess exited when trying to invoke get_requires_for_build_wheel

It only worked so far because python3targetconfig added an empty entry,
i.e. the current directory, to PYTHONPATH. The same happens with a plain
"python3 -m build" outside of OE.

pyproject.toml already gets the version from tuna.version via
[tool.setuptools.dynamic], so drop the import from setup.py.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:08:46 -07:00
Khem Raj 54697429ce python3-wxgtk4: Use python_setuptools_build_meta
pyproject.toml specifies setuptools.build_meta as the build backend.
Inheriting setuptools3 with INSANE_SKIP for pep517-backend was a
workaround for the top level build.py shadowing pyproject-build's own
"build" module, which is fixed in oe-core's python3targetconfig class
("python3targetconfig: Do not add the current directory to PYTHONPATH").

pyproject.toml pins sip == 6.12.0, which is only used to regenerate the
wrapper sources that the sdist already ships, so skip the build
dependency check.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:08:46 -07:00
Leon Anavi 3d159389a6 python3-webencodings: Upgrade 0.5.1 -> 0.6.1
Upgrade to release 0.6.1:

- Update CI dependencies
- Drop support of Python 3.10, support Python 3.15
- Replace deprecated license classifier
- Use HTTP server for Doconfly

Fixes:

WARNING: python3-webencodings-0.6.1-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml specifying backend
flit_core.buildapi, use the correct class [pep517-backend]

License-Update: Use LICENSE file

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:27 -07:00
Leon Anavi 4b4abef8ae python3-requests-futures: Upgrade 1.0.2 -> 1.1.0
Upgrade to release 1.1.0:

- Cancel queued requests on close
- Remove the unused build attribute and the Python 2.7 NullHandler
  fallback
- Close owned sessions after their background requests finish,
  including when using a supplied executor, and reject requests
  after close
- Pickle check covers request arguments, not just the callable
- background_callback now emits a DeprecationWarning instead of a
  log line
- Fix pool sizing for supplied sessions
- Preserve falsy callback results

Fixes:

WARNING: python3-requests-futures-1.1.0-r0 do_check_backend:
QA Issue: inherits setuptools3 but has pyproject.toml specifying
backend setuptools.build_meta, use the correct class [pep517-backend]

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:27 -07:00
Leon Anavi 5b209da1fe python3-pyunormalize: Upgrade 17.0.0 -> 18.0.0
Upgrade to release 18.0.0:

- Upgrade to Unicode 18.0.0.
- Drop support for Python 3.8 (requires Python 3.9+).
- Refactor architecture and optimize table loading for better
  performance.
- Modernize packaging (pyproject.toml) and adopt Nox for testing.

Fixes:

WARNING: python3-pyunormalize-18.0.0-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml specifying backend
setuptools.build_meta, use the correct class [pep517-backend]

License-Update: Copyright years updated

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:27 -07:00
Leon Anavi 1e6c7bf820 python3-hexbytes: Upgrade 1.3.1 -> 2.0.0
Upgrade to release 2.0.0:

- Add support for Python 3.13 & 3.14
- Drop support for Python 3.8 & 3.9
- performance: remove redundant cast
- chore: partial upgrade project management to ApeWorX standard
- fix(docs): build with uv
- fix(docs): skip --locked because uv.lock file is not used
- fix(docs): use official uv install command

Fixes:

WARNING: python3-hexbytes-2.0.0-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml specifying backend
setuptools.build_meta, use the correct class [pep517-backend]

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:27 -07:00
Leon Anavi 5b84398c78 python3-eth-account: Upgrade 0.13.7 -> 0.14.0
Upgrade to release 0.14.0:

- Fix BaseModel typing error on Pydantic >= 2.12
- Template upgrade
- Bump eth-utils to allow for CamelModel usage
- Add cell proofs for peerdas compat (Fusaka)
- Inherit from eth-utils CamelModel for pydantic types
- Breaking/add remaining breaking changes for major
- refactor: drop <3.10; add <=3.14; migrate to prek and ruff; use
  Github Actions

Fixes:

WARNING: python3-eth-account-0.14.0-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml specifying backend
setuptools.build_meta, use the correct class [pep517-backend]

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:27 -07:00
Leon Anavi 246db463ff python3-eth-abi: Upgrade 5.2.0 -> 6.0.0
Upgrade to release 6.0.0:

- add funding.json
- docs: fix the installation package
- Template upgrades
- feat: optimize encode and decode
- refactor: drop <3.10; add <=3.14; migrate to prek and ruff; use
  Github Actions

Fixes:

WARNING: python3-eth-abi-6.0.0-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml specifying backend
setuptools.build_meta, use the correct class [pep517-backend]

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:26 -07:00
Leon Anavi 7ef2c50fc4 python3-canmatrix: Upgrade 1.2 -> 1.3.3
Upgrade to release 1.3.3:

- restore toplevel re-exports for full 1.2 API compatibility
- docs: quote pip extras url in installation instructions
- ci: test python 3.9 in the matrix
- dbc: import BA_ BU_ attribute for unknown ecu
- j1939: fill unset bits with 1 on encode
- fix: fix canmatrix.utils import in xlsx

Fixes:

WARNING: python3-canmatrix-1.3.3-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml specifying backend
setuptools.build_meta, use the correct class [pep517-backend]

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:26 -07:00
Leon Anavi 5d70416431 python3-tzdata: Upgrade 2026.5 -> 2026.6
Upgrade to release 2026.6:

- Cuba will not fall back 2026-11-01; stays on -04 through
  2027-11-07.
- No more leap seconds, and leap second tables no longer expire.
- Improve 1965/1966 data for Brazil.

Changes to future timestamps:

- Cuba will not fall back to -05 on 2026-11-01 and instead plans to
  maintain -04 through 2027-11-07.

Changes to past timestamps:

- In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966
  it ended DST on 03-01 at 01:00 not 00:00.

Changes to documentation and commentary:

- Documentation and commentary now reflect leap seconds' demise.

Changes to commentary:

- Discussion on timekeeping in northwestern Ontario has been updated
  to reflect that provincial regulation has been issued to allow
  these areas to stay aligned with America/Winnipeg and follow
  Manitoba's adoption of year-round -05 after all.

- Discussion on timekeeping in Saskatchewan has been updated to
  document its new Time Act, 2026 which comes into force on
  2026-10-30. No change is expected.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:26 -07:00
Leon Anavi 56c0ca8cfa python3-ruff: Upgrade 0.17.2 -> 0.17.3
Upgrade to release 0.17.3:

Preview features:

- [suspicious] Add shared-clock-mock

Bug fixes:

- [pyupgrade] Avoid incorrect conversions to f-strings (UP032)

Performance:

- Buffer stdout in ruff format
- Specialize ASCII identifier lexing
- Speed up identifier and keyword lexing

Documentation:

- [flake8-bandit] Describe what the rule actually checks for
  httpx (S113)

This work was sponsored by GOVCERT.LU.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:26 -07:00
Leon Anavi 565bafc1db python3-pytz: Upgrade 2026.5 -> 2026.6
Upgrade to release 2026.6:

- IANA 2026f
- tz changes for Brazil
- Northwestern Ontario is expected to follow Manitoba

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:26 -07:00
Leon Anavi 9880a7318c python3-pyflakes: Upgrade 4.0.3 -> 4.1.0
Upgrade to release 4.1.0:

- Drop support for EOL python 3.10
- Significant performance improvements
- Fix handling of Literal and Annotated for lazy imports

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:26 -07:00
Leon Anavi ede588be5e python3-opentelemetry-sdk: Upgrade 1.45.1 -> 1.45.2
Upgrade to release 1.45.2:

- opentelemetry-sdk, opentelemetry-configuration,
  opentelemetry-exporter-prometheus: enforce metric cardinality
  limits (default 2000) with the otel.metric.overflow attribute,
  configurable through View(aggregation_cardinality_limit=...),
  reader cardinality_limits and declarative configuration

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:25 -07:00
Leon Anavi 45c03930d6 python3-opentelemetry-api: Upgrade 1.45.1 -> 1.45.2
Upgrade to release 1.45.2:

- opentelemetry-api: limit traceparent header length to 512
  characters in TraceContextTextMapPropagator during extraction

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:25 -07:00
Leon Anavi 67052aeb6f python3-nodeenv: Upgrade 1.11.0 -> 1.11.1
Upgrade to release 1.11.1:

- fix(nodeenv): skip node.js pre-releases for latest and ranges

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:25 -07:00
Leon Anavi 9aafbf160e python3-msgpack: Upgrade 1.2.3 -> 1.2.4
Upgrade to release 1.2.4:

- fallback: pass object_pairs_hook a list of pairs
- fallback: leave the object unread when a header type does not
  match
- fallback: return bytes from Unpacker.read_bytes
- Run tracemalloc tests sequentially

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:25 -07:00
Leon Anavi a969fa7099 python3-jsonpatch: Upgrade 1.37 -> 1.38
Upgrade to release 1.38:

- Document whole-document results and root replacement
- Preserve one-shot operation iterators during patch validation
- Clean temporary output after fdopen setup failure
- Extend CI: lint, package build, docs build, PyPy, Windows/macOS

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:25 -07:00
Leon Anavi 9d258a953c python3-importlib-metadata: Upgrade 9.1.0 -> 10.1.0
Upgrade to release 10.1.0:

- Prefer valid distributions when collecting entry points
- Revert "Prefer the greater metadata directory when a path
  supplies several"
- Prefer valid distributions when collecting entry points.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-30 09:06:25 -07:00