Upgrade to release 1.10.0:
Leaner URL-encoded form parsing:
Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no
longer drops the last field when a stream ends early, and lets you
compare FormData that holds several uploads under one key.
- Forms with many fields parse faster and use less memory (#3724).
FormParser builds each field in the parser callbacks instead of
queueing every event and replaying it. On CodSpeed, 1000 fields
went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the
max_fields limit case went from 6,880 B to 864 B.
- The last field is kept when the request stream ends without an
empty chunk (#3599). The parser is now finalized once the stream
is exhausted, so custom streams that never yield a final b"" no
longer lose their last field.
- FormData with repeated uploads can be compared (#3619). Comparing
two FormData objects with several UploadFile values under the
same key used to raise TypeError.
Behaviour changes:
- Multidict equality keeps the order of values under a repeated key
(#3619). Keys can still appear in any order, but
QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer
equal, matching what getlist() returns.
- starlette.formparsers.FormMessage is deprecated (#3724). The
parser no longer uses it, and FormParser.messages is gone.
Calling FormMessage(...) emits a StarletteDeprecationWarning.
Routing and URL generation:
- Path parameter values that look like a placeholder are kept as
they are (#3725). url_path_for("route", category="{id}", id="42")
on /{category}/{id} now returns /{id}/42 instead of /42/42.
Substitution also got faster, from 549 ns to 520 ns with two
parameters and from 1,078 ns to 779 ns with five.
- Route matching does less work per request (#3665, #3722). Match
members are compared by identity, cutting up to 4.9% of the
instructions per dispatch in the routing benchmarks.
- WSGIMiddleware strips root_path only at a path segment boundary
(#3718). A request to /application under a root_path of /app no
longer becomes /lication.
- FloatConvertor reports NaN and infinity correctly (#3716). NaN
was reported as a negative float.
Middleware, responses and config:
- Handled exceptions no longer keep requests alive (#3205).
Starlette clears the traceback after an exception handler runs,
so an exception instance reused across requests, such as a
module-level HTTPException, no longer pins per-request objects in
memory.
- Middlewares accept http.response.start without headers (#3721).
BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default
the omitted field to an empty list instead of raising KeyError.
- FileResponse ignores Range on methods other than GET and HEAD
(#3679). A POST endpoint that returns a file now sends the full
file, as RFC 9110 requires.
- Config strips one pair of matching outer quotes from env file
values (#3720). KEY='say "hi"' now reads as say "hi" instead of
say "hi.
Extend the ptest runtime dependencies to fix test cases from
tests/middleware/test_opentelemetry.py.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add recipe for OpenTelemetry Python API, release 1.45.1:
- Make AnyValue and AttributeValue explicit type aliases
- Fix quadratic time parsing of the tracestate header and discard
tracestate headers longer than 8192 characters
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
PKGV = "4.3+git${GITPKGV}" counts the commits up to SRCREV, which is
always 1 with shallow clones, so successive SRCREVs only compare by hash
and gitpkgv warns:
WARNING: tvheadend: Shallow cloning enabled - gitpkgv.bbclass will not
generate sortable versions
Drop gitpkgv and let PKGV default to PV, to which the fetcher appends the
PR server AUTOINC and the revision (4.3+git0+cc60283368). The AUTOINC
starts below the commit count used so far, so bump PE to keep the upgrade
path from existing packages.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
SRCREV is the 2.11.8 tag, so PKGV = "${GITPKGVTAG}" only evaluates to
2.11.8 with a full clone. With shallow clones it becomes 0.0-1-g<hash>,
a downgrade, and gitpkgv warns:
WARNING: freerdp: Shallow cloning enabled - gitpkgv.bbclass will not
generate sortable versions
Drop gitpkgv and let PKGV default to PV.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Both recipes set PKGV = "${GITPKGVTAG}". With shallow clones there are no
tags or history, so the 2.1.1 recipe, whose SRCREV is exactly the 2.1.1
tag, got PKGV 0.0-1-g<hash>, a downgrade from 2.1.1, and gitpkgv warns:
WARNING: libusbmuxd: Shallow cloning enabled - gitpkgv.bbclass will not
generate sortable versions
Drop gitpkgv. PKGV now defaults to PV: 2.1.1 for the release recipe, and
2.0.2+git<AUTOINC>+<hash> for the git recipe.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
PKGV = "${GITPKGVTAG}" relies on "git describe --tags --exact-match",
which never matches here since SRCREV is not a tag, so PKGV fell back to
0.0-<commit count>-g<hash>, below every release. With shallow clones the
count is always 1 as well, and gitpkgv warns:
WARNING: usbmuxd: Shallow cloning enabled - gitpkgv.bbclass will not
generate sortable versions
Drop gitpkgv and let PKGV default to PV, to which the fetcher appends the
PR server AUTOINC and the revision (1.1.2+git0+01c94c77f5). That is
sortable with or without shallow clones.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Drop quickjs packageconfig. Previously 2.69.0 marked quickjs as
deprecated and in 2.70.0 the option has been removed.
Drop pulseaudio and ddcutil packageconfig. The libraries libpulse and
libddcutil are not used in the Linux build anymore and got removed.
Full changelog: https://github.com/fastfetch-cli/fastfetch/releases/tag/2.70.0
Signed-off-by: Tafil Avdyli <tafil@tafhub.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
nngpp has not had any activity in the last six years and is not
compatible with NNG v2.
Signed-off-by: Nate Kent <nate@nkent.net>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fixes several commands on Linux 7.1 and 7.2, which OE-Core master
now ships as linux-yocto 7.2.
Update crash-memory-driver to the same revision.
AI-Generated: Uses Claude
Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The release tarball ships sql/yy_{mariadb,oracle}.{cc,hh} generated on
MariaDB's build host. The parser is regenerated in ${B} with
bison-native, but sql/*.cc include "yy_mariadb.hh", which resolves to the
stale copy next to them in ${S}. Its #line directives carry
/home/buildbot/tarball-docker/... into the debug info and libmariadbd.a,
which the buildpaths QA check reports since it matches the /home/build
HOME of the yoe build container:
QA Issue: File /usr/lib/libmariadbd.a in package
libmysqlclient-staticdev contains a reference to the build host HOME
directory. [buildpaths]
It also silently mixes a header from one bison run with a parser from
another. Delete the shipped files before configuring so that only the
build's own bison output is used.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The nettle crypto backend (RSA-AES security type) has no PACKAGECONFIG, so
meson auto-detects it from the sysroot: non-deterministic, nettle missing
from DEPENDS, and broken against nettle 4.0 (split sha.h, changed EAX
arity) which neatvnc 1.0.1 has not adopted.
Add the toggle with its nettle/hogweed/gmp deps and default it off, so the
build is deterministic and green on nettle 4.0; gnutls TLS is unaffected.
The real fix is a nettle-4.0 port of src/crypto/nettle in neatvnc upstream;
this only keeps the recipe building meanwhile.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.7.6:
- add, add_with_flags, add_with_affix and remove apply the
dictionary's ICONV rules to the word, as spell does, so a
caller that converted the word itself must stop doing so
- A personal dictionary exclusion such as *afterwards also
rejects the word when the dictionary has it only as an affixed
form
- stem and analyze give st: stem fields again with
COMPLEXPREFIXES
- analyze lists every analysis of a compound word, where a
rejected split of the word could hide the splits after it
- The text and XML parsers check the character after a character
entity such as à
- The interactive mode shows the first digit of a two digit
suggestion number
- The -a pipe interface checks a line of any length in one piece
- The hunspell tool takes -- as the end of the options, the -u2
sed script escapes the word and the suggestion, and a zipped
ODF file whose name starts with - can be checked
- The hunspell tool no longer searches the OpenOffice.org 2.x and
3 folders or LibreOffice's user wordbook folder for
dictionaries, and searches /Library/Spelling and
~/Library/Spelling only on macOS
- On Windows, search the share\hunspell, share\myspell and
share\myspell\dicts folders of the installation that holds
hunspell.exe
- New configure option --disable-tools to build and install only
the library
- A static-only build records that in the installed hunvisapi.h,
so its users need not define HUNSPELL_STATIC
- Install the Hungarian hunspell.5 in hu/man5
- Use Mozilla's own FileMgr and csutil code in MOZILLA_CLIENT
builds
- A CMake build of the library, as an alternative to configure
- New configure option --enable-werror, off by default
- Man page: the fallback dictionary is en_US, the SYNOPSIS lists
-u, -U, -u2, -u3, -P and --trace, and -a reads a file with the
pipe protocol too
- Build fixes: MinGW, the BSDs, macOS, makealias without gawk or
GNU sed, readline and curses detection, and the release tarball
ships the CMake files and all the test data
- oss-fuzz and Coverity fixes and hardening
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.2.20:
- Added zlog_fsync(), to flush the logs to disk on demand.
- Added zlog_is_init(), so a library can tell whether the program
around it has already set zlog up.
- Added zlog_category_has_rules(), so a caller can tell a
category the configuration covers from one it has never heard of.
- Added zlog_fini_try(), which gives up instead of waiting for
the configuration lock. zlog_fini() from a signal handler that
interrupted a thread inside zlog waits forever.
- A rotating rule keeps its file open between messages: two
syscalls a line instead of four, and about 1.8x faster.
- An oversized message is formatted once instead of twice:
"%.200m" of a 4MB message is about twice as fast, for identical
output.
- A message longer than buffer max is truncated instead of being
dropped.
- Every %E(NAME) in a format or a file path is replaced, not just
the first one. Two of them used to fail zlog_init().
- The rotate lock file falls back to /tmp/zlog.lock when the
configuration file is not writable, instead of failing every
rotation silently. It is created 0644 rather than 0777, and a
symbolic link in its place is refused.
- The pthread return values in the writer thread are checked in
release builds too, not only where asserts are compiled in.
- hzlog prints the buffer length in front of the dump.
- Include guards no longer use identifiers reserved to the
implementation; the public one is ZLOG_ZLOG_H.
- __DATE__ and __TIME__ are gone, so the build is reproducible.
- Fixed the install and test targets in the top level Makefile.
- zlog.spec is gone: CPack generates its own, and the
distributions that package zlog use their own.
- Dead code removed from conf.c, level_list.c and thread.c, and
the debug messages removed from CMakeLists.txt.
- The release procedure is written down in doc/developer.md and
no longer names a version, the rotate lock file section of the
users guide says what the code does, and CLAUDE.md is corrected
and translated to English.
- Typos fixed throughout the tree.
- Tests added for zlog_init(NULL), the rotation lock file, buffer
max truncation, %E() replacement, and the return values
test_press_write2 used to ignore
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pyproject.toml specifies setuptools.build_meta as the build backend, so
inherit python_setuptools_build_meta instead of setuptools3. Fixes:
QA Issue: inherits setuptools3 but has pyproject.toml specifying backend
setuptools.build_meta, use the correct class [pep517-backend]
pyproject-build checks the build requirements, so add the wheel and
Cython build dependencies and relax the strict Cython==3.1.1 pin, as
python3-grpcio already does. The C++ sources are pre-generated, so
Cython is not actually run.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.10.1:
Bugfixes:
- irc: fix memory leak in SASL authentication with mechanism
"ecdsa-nist256p-challenge"
- irc: reject an empty SASL challenge received with mechanism
"ecdsa-nist256p-challenge"
Security:
- relay: limit size of data queued for sending to a client to
prevent memory exhaustion
- relay: reject fragmented, compressed or oversized websocket
control frames received from a client
- relay: limit size of partial message received from a client to
prevent memory exhaustion
- script: reject script names containing path separators in the
scripts repository file to prevent writing files outside the
scripts directory
- xfer: fix comparison of status in search of transfers, preventing
a remote peer from starting a file transfer that was not accepted
by the user
- xfer: limit size of partial message received in DCC chat to
prevent memory exhaustion
- xfer: remove path from filename received in DCC file transfer to
prevent writing the file outside the download directory
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 5.0.4:
- Fixed crash with large jumbo block sizes with encryption enabled
- Fixed NAK counting when checking for excess NAKs
- Fixed invalid read of server -a option
- Fixed fragmentation for block sizes close to 1500 and 9000 byte
MTUs
- Removed unnecessary PROXY_KEY messages during unencrypted
sessions
- Disabled deprecation warnings for OpenSSL
- Cache name lookups for incoming packets to decrease load
- Minor fixes for Apple builds
- Fixed Windows header file inclusions
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.49.4:
- vddk: Deprecate this plugin
- server/public.c: Try harder to make a timestamp
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.3.0:
- ipc: Add unix:// scheme, including on Windows, and winpipe:// on
Windows
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.14.1:
- Fixed a -Wsign-compare warning in MMDB_open() that broke builds
with -Werror on platforms where ssize_t is 32 bits, such as i686.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.2.0:
- Added the --cidr option, which prints the network in CIDR notation
(e.g., 192.168.123.0/24); the JSON output has the new CIDR key
- Added the --binary option, which prints the bits of an address,
or of the network part of a network, as a diagram that maps the
address to its bits
- The geographic information includes the city (CITY), which was
never printed, the accuracy radius of the coordinates in
kilometers (ACCURACYRADIUS), the continent (CONTINENT), the postal
code (POSTALCODE), the time zone (TIMEZONE), the autonomous system
(ASN, ASORG) and its network (ASNETWORK), e.g., the ISP's
allocation, and the network for which the database holds these
values (GEONETWORK).
- Added the --wildcard option, which prints the IPv4 wildcard
(inverse) mask (e.g., 0.0.0.255 for a /24); --all-info shows it
too, and the JSON output then has the new WILDCARD key
- Added the --format option, which selects the output format: human,
shell (VAR=VALUE), json or value; with it the specific info
options select exactly the fields printed in every format, e.g.,
"ipcalc --format=json -n -m 192.168.1.5/24" prints only NETWORK
and NETMASK. Without --format the output is unchanged
- The -j and --no-decorate options are deprecated in favor of
--format=json, --format=value and --format=human; they keep
working unchanged with a hint.
- Removed support for libGeoIP, whose databases are no longer
published; geographic information requires libmaxminddb.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 9.1.3:
Security Fixes:
- GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster
Pub/Sub message construction that could allow an authenticated
client to potentially execute arbitrary code by publishing an
oversized message
Bug Fixes:
- Fix stream commands that mutate consumer-group or PEL state
(XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) not
triggering WATCH and client-side tracking invalidation
- Reject module write commands while the server is paused for
writes, preventing a crash from module timer callbacks during
CLIENT PAUSE WRITE or CLUSTER FAILOVER
- Fix event loop busy-spinning on virtual machines by not using raw
TSC for the monotonic clock when the kernel clocksource is not
tsc
- Fix a crash in ValkeyModule_HashHasStringRef on a missing or
expired field and correct wrong return values in the hash
stringRef module APIs
- Fix a server abort on a RESTORE payload declaring a string length
that overflows the allocation size; such payloads are now
rejected as bad data
- Fix ZINTER/ZINTERSTORE returning input-order-dependent scores
when a weighted term is 0*inf; a NaN weighted score now counts as
0, matching ZUNION
- Clear a stale primary-failure gossip flag on replicas so later
failovers don't incorrectly skip the election delay
(#4533)
- Correct ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry
and ValkeyModule_ACLAddLogEntryByUserName declarations to return
int as implemented, fixing undefined behavior on targets with
strict call signature checks
- valkey-check-aof now recognizes RDB base files with the VALKEY
signature instead of misreporting a valid multipart AOF as
invalid
- Fix module commands that access undeclared keys in other slots
reading or writing the wrong slot in cluster mode, and aborting
in debug builds
- Reject relative expire times in SET/GETEX, RESTORE, and
ValkeyModule_SetExpire that overflow when added to the current
time, preventing server aborts from negative expires
- HDEL, HGETDEL, HPERSIST, and HEXPIRE no longer propagate fields
they treat as expired, preventing replica and AOF-reload
divergence
- Fix a server crash when loading an ACL file containing a selector
with an unmatched parenthesis
- Fix a segfault on Alpine/musl when Lua is built as a module,
caused by a symbol clash on an internal clock function
- COPY of a hash now includes expired-but-unreaped fields so their
deletion is propagated and replicas stay in sync
- Restore acceptance of hexadecimal float sorted set scores (such
as 0x10), keeping replication and AOF replay compatible with
Valkey 9.0
- Sorted set range commands with a negative LIMIT offset now return
an empty result instead of a spurious element on btree-encoded
keys
- Fix listpack encoding incompatibility that caused RDB load and
replication failures for entries of certain lengths between 9.0
and 9.1.x
- Fix atomic slot migration not replicating evictions on the import
target, which let replicas grow far past maxmemory
- Redact error text in server logs when hide-user-data-from-log is
enabled, so command arguments no longer leak into logs
- Fix HSETEX and HGETEX failing to parse their arguments when the
key is named fields
- Fix cluster config saving to avoid publishing truncated
nodes.conf files, losing the startup lock after the first save,
and failing every save on SMB filesystems such as Azure Files;
the lock now lives on a separate nodes.conf.lock file
- Fix LSET on 64-bit builds silently modifying the wrong element
for out-of-range indexes instead of returning an index out of
range error
- Fix atomic slot migration with cluster-databases > 1 applying
writes made during the snapshot to the wrong database on the
target
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.2.0:
- Dictionary expectations must include parameters with empty
values. A request for flag=&foo=123 previously matched {"foo":
"123"}. It now requires {"flag": "", "foo": "123"}.
Bug Fixes:
- Preserve empty query values when matching dictionaries and
MultiDict objects. Both flag= and flag match {"flag": ""} and no
longer match {}. For repeated parameters, dictionary matching
uses the first value even when it is empty. MultiDict matching
includes every empty value.
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.17.2:
Preview features:
- [complexity] Add unnecessary-regular-expression-compile
Bug fixes:
- Avoid syntax errors for type variables with starred constraints
(UP040, UP046, UP047, RUF053)
- [pydocstyle] Treat backslash-escaped *args and kwargs as
documented (D417)
- [pylint] Avoid false positive on starred elements (PLE0643)
- [pylint] Mark fixes unsafe when deleting comments (PLR5501,PLW0120)
- [pyupgrade] Mark fix unsafe when deleting comments (UP035)
Performance:
- Avoid intermediate names in lint name resolution
- Prefilter bidirectional Unicode checks by UTF-8 leading bytes
- Share postfix parsing and reduce expression copies
Configuration:
- [pylint] Add a configurable allowlist for magic-value-comparison
(PLR2004)
Documentation:
- Clarify documentation and correct stale guidance
- [pyupgrade] Remove mentions of variance related to fix safety
(UP040, UP047)
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 8.7:
- Release Python 3.15 binary wheels.
- Fix free-threaded (no-GIL) data races in the C lookup caches.
Concurrent lookup() and changed() calls could crash while cache
fields were being replaced. Their lifetimes are now guarded by a
critical section on Python 3.13+. Also affects GIL builds.
- Fix reference leaks in the C optimizations when the lazy import
of zope.interface.declarations fails partway through.
- Drop support for Python 3.10.
- Remove the C optimizations' code path for static types, which was
only used on Python < 3.11.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.3.1:
- Keep the form prefix when FieldList renumbers its entries
- Speed up URL validation on hostnames with many dashes
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 21.14.13:
- Stop bash running commands from --prompt or an environment name
containing $(...), backticks or a backslash after shopt -s
promptvars, set -o posix, or in a child shell that inherits an
exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by rozzkml. zsh now
draws the prompt from psvar[9], which is never parsed as shell
syntax.
Write the .venv redirect and the wheel RECORD with exclusive create, so
a link planted after the existence check cannot redirect the write. On
POSIX, a read-only .venv redirect that points at a virtualenv is
replaced.
License-Update: Copyright years updated
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.9.0:
What's Changed:
Features:
- perf: cache coordinate-type and handler lookups in dispatch
- ci: run Awkward backend tests on GPU
- perf(awkward): gather each operand's coordinates with one carry
- feat: validate coordinate names in one place, for every backend
- feat: test on Python 3.15 and 3.15t
- fix: dot/eta closer to ROOT, compare vector results with ROOT's.
Fixes:
- fix: not_equal, is_perpendicular, and is_spacelike predicate
logic
- fix: correct awkward backend field-leak, behavior, and dict-input
bugs
- fix: correct multiple bugs in the NumPy backend
- fix: exports crash without optional deps, Vector.like() type
safety, and docstring corrections
- fix: correct several Numba backend bugs
- fix: symbolic sign, Max/Min, and numeric copysign in the SymPy
backend
- fix: correct overload param names, __array__ protocol,
_wrap_result precedence, duplicate alias guard
- fix: align Lorentz/planar coordinate conventions across
signatures
- fix: do not use Self on Python 3.10
- fix: give a useful error when ProjectionClass*D is missing
Documentation:
- feat(docs): add llms.txt and Markdown page versions
Maintenance:
- chore: fix noxfile, CI pass gate, and stale config
- Dependencies update
- chore: secure CI
- ci: use nox session for gpu ci
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.36.0:
Breaking changes:
- Drops support for Python v3.9 and v3.10. Python v3.11 or newer is
required.
- Stricter validation: the following inputs, previously accepted by
mistake, are now rejected.
- isin() now verifies the check digit, which was previously
ignored. Lowercase ISINs are still accepted.
- cusip() and sedol() require a numeric check digit.
- md5(), sha1(), sha224(), sha256(), sha384(), sha512(),
base16(), base32(), base58() and base64() reject trailing
characters, such as a trailing newline.
- ind_pan() requires a full-string match.
- fr_ssn() no longer accepts a comma as the gender or Corsica
department character.
- domain() rejects an underscore in the last label and names
longer than 253 octets once IDNA-encoded, as defined by RFC
1035.
- mastercard() accepts only the 2221-2720 range of the 2-series
BINs.
- eth_address() rejects non-hexadecimal characters.
- mac_address() rejects mixed separators.
- slug() rejects a trailing newline, and telnet URIs reject
control characters.
Features:
- feat(uri): add telnet URI validation per RFC 4248
- Accept file:// URLs per RFC 8089
- cron: accept a step over a range (e.g. 1-5/2) and in list items
- Accept lowercase IBANs in iban()
- fix(cron): accept day-of-week 7 as a Sunday alias
- Accept a trailing dot on simple hostnames with rfc_1034
- fix(crypto_addresses): accept testnet (tb) segwit addresses
Maintenance:
- chore(deps): bump requests from 2.32.3 to 2.32.4 in /package
- fix: reject MAC addresses with mixed separators
- feat: Optimize slug. Extend tests.
- chore: update codebase to reflect new username
- docs: correct PossibleValueTypes note in between to include None
- chore!: drop Python 3.9 and 3.10, bump vulnerable dev
dependencies
- fix: restore certifi and jinja2 pins downgraded by stale lock
- chore: use native pyproject config for tox and pytest
- test: cover RFC length limits for domain() and hostname()
- chore!: adopt uv and PEP 735 dependency groups
- ci: update GitHub Actions to their latest versions
- docs: explain why the documentation is hosted on the maintainer's
fork
- docs: hide badges from the man page; upgrade docs tooling to
latest stable
- ci: deploy versioned documentation with mike from the fork
- docs!: build and version the online documentation with Zensical
- ci: publish to PyPI with trusted publishing
License-Update: Copyright years updated
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 6.0.0:
Changed:
- Assorted cleanup refactors
Removed:
- Reduce bytes-like support to only bytes and bytearray
Fixed:
- Allow default handler to handle bytes
- Update build dependencies to avoid warning about missing
[tool.setuptools_scm] section
- Tighten UTF-8 validation for ujson.loads()-ing strings from bytes
- Fix memory leak when the default() handler returns
non-serialisable objects until its recursion limit is hit
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.67.1:
- Preserve ignore (-) and invert (!) exit code prefixes on commands
when referenced via TOML { replace = "ref", ... }.
- Installing from a pylock.toml with no dependency_groups selected
now uses the lock file's default-groups, as 751 specifies.
Previously packages marked 'default' in dependency_groups (as
written by pdm export -f pylock) were skipped - by
pcbeingused333.
- A positional {factor:N} label in an env_base now resolves against
that table's own factors, so with several env_base tables or an
env_list product it no longer expands to an empty string.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 6.6:
- Python 3.15 is now supported. Python 3.9 and 3.10 are no longer
supported; 3.11 is the minimum supported version.
- Free-threaded python interpreters are now supported; prebuilt
wheels are available for 3.14t and 3.15t.
- Windows on ARM is now supported and prebuilt wheels are available.
- Prebuilt wheels are now available for riscv64, ppc64le, and s390x
architectures on Linux. These architectures are experimental and
have limited support and testing.
- PyPy 8.0 is now supported (for both Python 3.11 and 3.12).
- Error messages have been improved in many places.
- Improved handling of asyncio.CancelledError in various parts of
the framework.
- New feature cross_origin_protection provides a new mechanism for
protecting against XSRF and other cross-origin attacks. This
feature is easier to use than xsrf_cookies and is expected to
become the default in Tornado 6.7.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.2.0:
- Support Python 3.15
- Add signature for frozendict
- Support Python 3.15 and refresh dev tooling
- Add more tests for merge, get_in, and dissoc
- Expose combined __annotations__ on composed functions
- Fix interpose([]) raising StopIteration
- Add pysentry-pre-commit
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.5.0:
- Binary wheels for Python 3.15
- Set nested inline array/table limit to 400 to fix mypyc generated
binaries crashing unrecoverably in constrained environments (e.g.
worker thread in a python:3.13-alpine image)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.3.2:
Security:
- A long run of digits in the arguments of a path arc command (A or
a) could make parsing take exponential time, so a tiny SVG could
block a process for minutes or longer (CWE-1333, CWE-400,
GHSA-249c-7rgc-f52h). Arc arguments are now read one token at a
time, without regex backtracking. Parsing of a malformed arc
stops at the first argument that does not fit.
Fixed:
- Accept explicit plus signs on arc rotation and endpoints, and
tab, carriage return and line feed separators in transform
arguments, as allowed by SVG.
- svg2rlg() no longer unpacks a .svgz file to a sibling .svg file,
which overwrote an existing file of that name and then deleted
it. The compressed data is now read as a stream.
- A <use> that refers to itself, or to a cycle of elements that
each <use> the next one, no longer crashes with RecursionError.
The offending <use> is skipped and an error is logged, as already
done for cyclic references between external files.
Extend RDEPENDS with the runtime dependency python3-reportlab.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.0.4:
- FIX: Keep own and descendant text separate when combining
:-soup-contains() and :-soup-contains-own().
- FIX: Cache resolved directionality when matching :dir() to avoid
quadratic time on deeply nested dir="auto" elements.
- FIX: Fix auto handling in regard to :dir() selector. When an
element with dir="auto" (or a <bdi>) contains no strong direction
characters, it should be assumed as left-to-right and not assume
the direction of the parent.
- FIX: Match numeric input ranges correctly when values or bounds
use scientific notation.
- FIX: Fix :in-range and :out-of-range raising ValueError for week
inputs whose week-year is 10000 or greater.
- FIX: Fix :nth-last-child(an+b of S) matching the wrong elements
when the first sibling tested does not match S.
- FIX: escape() now only leaves non-ASCII identifier code points
unescaped, as defined by the CSS specification. All other
non-ASCII characters are escaped.
- FIX: Allow unescaped U+0080 - U+009F characters in identifiers to
match browser behavior.
- FIX: Fix :in-range and :out-of-range treating time and
datetime-local values with seconds as invalid.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.4:
- Install in the defined prefix
- Use setuptools instead of distutils
License-Update: Check from line 1 to 13. License remains the same.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 4.2.0:
- Start building CPython 3.15 wheels
- Use the first-key error message in the C scanner
- Support large integer stringification thresholds in both encoders
- Check circular references introduced by custom JSON methods
- ci: build and test riscv64 wheels
- Prep for v4.2.0 - Update CHANGES and build matrix
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 3.2.0:
Features:
- Added support for dynamic-metadata 0.4+ through the
setuptools_git_versioning.dynamic_metadata provider.
This enables automatic versioning with scikit-build-core 1.0+
and other compatible backends.
- Added new prefer_tag: bool = False option for
:ref:version-file-option.
Deprecation:
- Deprecated the setuptools_git_versioning.scikit_metadata
provider.
Migrate to [[tool.dynamic-metadata]] with provider =
"setuptools_git_versioning.dynamic_metadata" on scikit-build-core
1.0+ or another compatible backend.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Leon Anavi
Khem Raj
Tafil Avdyli
Nate Kent
Prasanth R
Johannes Schneider