Upgrade to release 26.10.1:
General
- Load the vendored FlatBuffers runtime only when a FlatBuffers
message is first built or parsed, instead of on every import
autobahn. The runtime imports numpy whenever numpy is installed,
so up to 26.7.1 every process importing autobahn also loaded numpy,
including WebSocket-only users such as Django Channels applications
served by Daphne. Every autobahn import now needs about 13-17 MB
less memory on CPython and 18-24 MB less on PyPy, and none loads
numpy. A new documentation page (docs/memory-footprint.rst, just
memory-footprint) shows the import memory footprint per release on
CPython and PyPy.
Wheels
- Publish native Windows ARM64 (win_arm64) wheels with NVX for
CPython 3.11-3.14, built on GitHub’s windows-11-arm runners (PyPy
publishes no Windows ARM64 interpreter); thanks to @ndabas.
cryptography currently publishes no win_arm64 wheel, so the build
compiles it against an OpenSSL from vcpkg.
- Build cryptography against an OpenSSL from vcpkg on Windows x86_64
too: cryptography 50.0.2 publishes its Windows PyPy wheels for PyPy
8 (pp80) only, and the pypy311 wheel build uses PyPy 7.3 (pp73), so
pip builds it from source there.
WebSocket
- Make all four per-message compression extensions
(permessage-deflate, -bzip2, -brotli, -snappy) enforce the
decompression budget the same way: decompression stops near the
remaining maxMessagePayloadSize budget instead of decompressing a
whole frame first, and “over budget” as well as “budget already
used up” raise PayloadExceededError. brotli now bounds its output
with Decompressor.process(output_buffer_limit=...), snappy is
decompressed one framing chunk at a time, and deflate no longer
lets one octet through once the budget is used up.
- Add autobahn.exception.PayloadCorruptError: every compression
extension now raises it for input it cannot decompress (corrupt,
truncated, or not the extension’s format), instead of the library’s
own exception (zlib.error, OSError, brotli.error, …), and snappy no
longer accepts such input silently. The protocol fails the
connection with close code 1007 (invalid frame payload data), the
same for every extension and on both Twisted and asyncio.
- Fix permessage-brotli failing on the second message of a connection
when context takeover was negotiated (the default): the compressor
and decompressor were reused after their brotli stream had
finished. Each message is now a new brotli stream, which is the
wire format brotli used for the first message already, and for no
context takeover.
- Fix an asyncio WebSocket connection being left open, but no longer
serviced, when an exception escaped the processing of received
data: the connection is now dropped, as on Twisted.
- Add a documentation page on WebSocket compression
(docs/websocket/compression.rst): for each of the four extensions,
which Python package and which compression library (and bundled
version) it uses on CPython and on PyPy, plus context takeover,
decompression limits and the handling of invalid data. The old,
unpublished page under docs/work/ did not cover permessage-brotli
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
