py-geventhttpclient: updated to 2.6.1
2.6.1 (2026-10-09)
Added
- Python 3.15 is supported explicitly
2.6.0 (2026-10-05)
Added
- Type annotations across the package, with a `py.typed` marker
- Basic auth added: `BasicAuth("user", "pass")`, or the `requests`-style
`("user", "pass")` tuple, on a `Session` or a single request
- `geventhttpclient.httpx`, an httpx-compatible client on the same engine
- Requests compatibility improved: `history`, `elapsed`, `cookies`,
`links`, `encoding`, `iter_content()`, `iter_lines()`, `json()`,
`bool()`, `close()` and `raise_for_status` with the response attached
[33 lines not shown]
py-gevent: updated to 26.9.0
26.9.0 (2026-09-16)
Bugfixes
- Fix :class:`gevent.event.AsyncResult` re-raising an exception with a
traceback that kept growing by the frames of every previous
:meth:`~gevent.event.AsyncResult.get` call, instead of starting fresh
from the traceback captured when :meth:`~gevent.event.AsyncResult.set_exception`
was called.
- Make gevent's file objects properly report the full mode string.
Previously a 'b' or 't' suffix could be missing.
- ThreadPool workers no longer call the profile and trace setters when no
hooks are configured. This matches ``threading.Thread`` and avoids
unnecessary PEP 578 audit events and thread coordination.
- An exception while preparing a ThreadPool worker to run a task, such as
an audit hook rejecting ``sys.setprofile()``, no longer leaves the caller
blocked or leaks a pool slot. The exception is raised in the greenlet
[2 lines not shown]
py-xarray: updated to 2026.9.0
2026.9.0
This release adds read support for Zarr V3 rectilinear (variable-sized) chunks,
Arrow PyCapsule export for :py:class:DataArray, a new
:py:meth:DataArray.plot.lines plotting method, :py:class:DataTree support in
:py:func:apply_ufunc, and flox-accelerated groupby medians. Bottleneck is now
disabled by default, the remaining zarr-python 2 compatibility code has been
removed, and the minimum h5netcdf version is now 1.8. It also includes many bug
fixes.
This is the last xarray release that will support Python 3.11. Future releases
will require Python 3.12 or later.
py-gammu: updated to 3.5.0
3.5.0
* Datetime and time values returned by Gammu are now timezone-aware, using
fixed UTC offsets. Zero offsets use UTC. Aware inputs preserve their UTC
offset and wall-clock fields; naive inputs retain a zero offset. Code that
compares or subtracts returned datetimes with naive datetimes needs to use
compatible timezone-aware values. Phone backends and file formats may not
preserve timezone information.
* Fixed memory ownership in configuration handling and memory leaks when SMS
conversion fails.
* Improved bounds checking for Unicode strings and truncated XPM bitmaps, and
validation of phonebook photo data.
* Reject out-of-range integers, malformed numeric strings, and invalid SMS
validity values instead of silently accepting or truncating them.
* Preserve MMS indicator metadata during conversion and reject negative message
sizes.
* Fixed asynchronous worker cleanup after command errors and preserved the
[2 lines not shown]
gammu: updated to 1.45.1
1.45.1
* Bound ringtone names and BMP palette offsets to prevent buffer overflows
when parsing crafted files and Siemens modem responses.
* Probe socat for supported baud rates in the proxy backend.
doc: Update roundcube and related pacakges to 1.6.20
Previous commit was accidently one.
mail/roundcube
mail/roundcube-plugin-enigma
mail/roundcube-plugin-password
mail/roundcube-plugin-zipdownload
py-httptools: updated to 0.9.0
0.9.0
Upgrade llhttp to 9.4.3
Build CPython 3.15 wheels
Add RISC-V 64-bit wheels
Add Windows ARM64 support in CI
Build PPC64LE wheels
Modernize test and release workflows
py-httpx2: updated to 2.14.0
2.14.0 (October 18th, 2026)
Added
* Match IP CIDR ranges, like `192.168.0.0/16` and `[fe80::]/10`, in `NO_PROXY` and `mounts`. Requests to any address in the range now bypass the proxy; previously only the network address itself did.
* Accept bracketed IPv6 addresses, like `[::1]` and `[::1]:8080`, in `NO_PROXY`.
Changed
* Raise `InvalidURL` for a `mounts` key with an IP host followed by anything other than a valid CIDR prefix, like `all://10.0.0.0/33`.
Fixed
* Ignore `NO_PROXY` entries that cannot be parsed, instead of raising `InvalidURL` when the client is created.
* Import `httpx2` on FIPS-enforced Python builds without `hashlib.md5`. `DigestAuth` raises `ProtocolError` when the server asks for an unavailable algorithm.
* Handle reads after an ASGI WebSocket app shuts down, instead of leaking `anyio` exceptions.
* Stop the sync WebSocket session from hanging on exit when its event queue is full.
py-httpcore2: updated to 2.14.0
2.14.0 (October 18th, 2026)
Fixed
* Keep `CONNECT` and absolute-form proxy targets when the request sets the `target` extension.
* Stop blocking reads when an HTTP/2 server lowers `SETTINGS_MAX_CONCURRENT_STREAMS` while requests are in flight.
* Raise `WriteError` instead of `anyio.EndOfStream` when writing after the peer closes a TLS connection without `close_notify`.
py-checkdmarc: updated to 6.0.4
6.0.4
Fixed
SPF: concatenate TXT character-strings without removing literal quotes or
backslashes before selecting records, so a split within or immediately after
v=spf1 is accepted in top-level, include:, and redirect= lookups as
required by RFC 7208 section 3.3
DNS: escape literal quotes and backslashes in quoted TXT output so payload
characters remain distinct from string boundaries (RFC 1035 section 5.1)
DNS: preserve UTF-8 sequences split across TXT byte boundaries, retaining
the original string lengths for SPF size warnings (RFC 1035 section 3.3)
DNS: escape linefeeds in quoted TXT output so dnspython can parse it back
into the original byte strings
SPF: decode non-digit DNS escapes in quoted input to parse_spf_record()
so escaped mechanism names and values can be assessed (RFC 1035 section 5.1)
SPF: accept surrounding spaces, tabs, and line endings in quoted parser
[2 lines not shown]
py-test-mock: updated to 3.17.0
3.17.0
* Failures of mock assertions such as ``assert_called_with`` are again reported only once, instead of two or three times with the original error from the ``mock`` module chained before them.
* Mock assertion failures no longer show misleading introspection when they are not about the arguments of the last call: ``assert_called``, ``assert_called_once``, ``assert_not_called``, ``assert_any_call``, their ``await`` counterparts, and ``assert_called_once_with``/``assert_awaited_once_with`` when the mock was not called (awaited) exactly once. The introspection also no longer reports arguments passed by position versus by keyword as different for autospecced mocks, and no longer shows empty ``Args:``/``Kwargs:`` sections when assertion rewriting is not available.
* ``assert_has_calls`` and ``assert_has_awaits`` failures no longer show pytest introspection, which compared the expected and actual calls position by position and so reported differences between unrelated calls. The mock's own message, listing the expected and actual calls, is still shown.
py-tortoise-orm: updated to 1.1.9
1.1.9
Added
Q.__bool__() so Q objects with no filters/children (including nested empty Q children) are falsy.
PostgreSQL password credential now accepts a sync or async callable, resolved once per new connection, to support short-lived credentials such as AWS RDS/Aurora IAM tokens and Azure Entra ID tokens.
Changed
tortoise.contrib.starlette now only supports Starlette 1.0+ (This does not affect FastAPI users; you can continue using FastAPI with any version of Starlette).
Fixed
Aggregates now apply _filter when the aggregated argument is an F() or a combined expression (e.g. Sum(F("price") * F("qty"), _filter=Q(status="paid"))). Previously the filter was silently dropped and every row was aggregated.
Negating an already negated Q now cancels out: ~~Q(...) and .exclude(~Q(...)) used to keep a single NOT, so they returned the rows the caller meant to drop.
PostgreSQL and Oracle RemoveIndex / partial RemoveConstraint now schema-qualify DROP INDEX, so indexes on models with Meta.schema can be dropped when they are not on the connection search_path.
ForeignKeyField/OneToOneField no longer lose a declared source_field when deconstructed. makemigrations wrote the generated <field>_id backing field name as the column name, so a migrated schema disagreed with generate_schemas() and neither path reported an error.
[15 lines not shown]
py-wrapt: updated to 2.5.1
2.5.1
Bugs Fixed
A LazyObjectProxy created with an interface argument that declared a path-like type, such as os.PathLike or pathlib.Path, did not define the __fspath__() special method on the class it generated. Because os.fspath() looks up __fspath__() on the type of the object, passing such a proxy to os.fspath(), the builtin open() or other standard library functions accepting paths raised TypeError before the factory callable had been invoked to create the wrapped object. The __fspath__() special method is now added when the declared interface provides it, in the same way as is already done for the other special methods looked up on the type, so the first path conversion triggers creation of the wrapped object and succeeds.
A callback passed to wrapt.WeakFunctionProxy which was callable but evaluated as false, such as an event emitter object which reports its number of subscribers via __len__() and is empty when first created, was passed the underlying weak reference object instead of the proxy when the wrapped function expired. Where the wrapped function was a bound method, such a callback could also be called twice, once each when the instance and the function expired. Only None is now treated as meaning no callback was supplied, which mirrors the behaviour of weakref.ref() and weakref.proxy() in the standard library, so these callbacks now receive the proxy and are called only once, as for any other callback.
A wrapt.AdapterFactory instance passed as the adapter argument to wrapt.decorator was ignored, and so never called, if the instance evaluated as false, such as when the factory class defined __bool__() or __len__(). The decorated function then retained its original signature instead of that produced by the factory. Whether an adapter factory was supplied is now determined by type before the truth value of the adapter is considered, so such factories are always called. As a consequence of this change a factory can now also return None, or any other false value, to indicate that no adapter should be used for a particular function, where previously this failed with an obscure error.
py-zope.interface: updated to 8.7
8.7 (2026-10-15)
- Release Python 3.15 binary wheels.
- Fix free-threaded (no-GIL) data races in the C lookup caches. Concurrent
``lookup()`` and ``changed()`` calls could crash while cache fields were
being replaced. Their lifetimes are now guarded by a critical section on
Python 3.13+. Also affects GIL builds.
- Fix reference leaks in the C optimizations when the lazy import of
``zope.interface.declarations`` fails partway through.
- Drop support for Python 3.10.
- Remove the C optimizations' code path for static types, which was only
used on Python < 3.11.
