py-pikepdf: updated to 10.12.0
v10.12.0
Packaging and licensing
- Binary wheels now redistribute the licenses of the compiled third-party
libraries they bundle, along with an attribution manifest mapping each
component to its license. {issue}`736`
- The new `third-party-licenses/` directory documents every vendored binary:
qpdf and libjpeg-turbo on all platforms; OpenSSL and zlib (both statically
linked into `qpdf30.dll`) plus the Microsoft Visual C++ runtime on Windows;
the GnuTLS/Nettle/GMP stack on macOS; and the GCC runtime libraries on
musllinux. It also records what is deliberately *not* bundled -- notably
that Linux wheels use qpdf's built-in crypto and link no TLS library at all.
- These files are declared via PEP 639 `project.license-files`, so they ship
in `pikepdf-<version>.dist-info/licenses/` and are enumerated in the wheel's
`License-File` metadata. `License-Expression` remains `MPL-2.0`: pikepdf's
own license is unchanged, and the bundled libraries are separate works
[70 lines not shown]
py-nanobind: added version 3.0.1
nanobind is a small binding library that exposes C++ types in Python and vice
versa. It is reminiscent of Boost.Python and pybind11 and uses near-identical
syntax. In contrast to these existing tools, nanobind is more efficient:
bindings compile in a shorter amount of time, produce smaller binaries, and
have better runtime performance.
py-strich: updated to 0.20
0.20
All formats: numeric arguments (cell size, render options, encoder settings)
are validated for type and range up front
GS1-128: Code128Data.gs1 rejects payloads over the GS1 maximum of 48 data
characters
py-obspy: updated to 1.5.1
1.5.1
Changes:
- General:
* add helper function that wraps around `numpy.linalg.eig` but always
mimicks the behavior of numpy <2.5, which is to downcast results to real
valued arrays when possible. Replacing all `numpy.linalg.eig` calls in the
code base with this wrapper
- obspy.core:
* inventory: fix a bug that Latitude, Longitude and Distance did not accept
'measurement_units' when being initialized
- obspy.clients.fdsn:
* add new URL mapping 'EARTHSCOPE+USGS' and make it the default. This will
use EarthScope for dataselect and station web services and use USGS for
event web service. This is basically restoring the output users got before
IRIS-now-EarthScope discontinued serving an event web service which was a
mirror of USGS event web service
* update URL endpoint for IGN to https
[32 lines not shown]
py-statsmodels: updated to 0.15.0
0.15.0
SPEC-007: consistent use of rng for randomness
NamedTuple return values replace bare tuples
Formula engine: patsy is no longer the only option
Build system: meson-python replaces setuptools
Polars DataFrame support
New robust estimation tools
New models and statistical tests
New and improved plots
GLM and other model enhancements
Platform and packaging compatibility
Stricter input validation for string-valued options
A few consequential bug fixes
py-interface-meta: added version 2.0.1
interface_meta provides a convenient way to expose an extensible API with
enforced method signatures and consistent documentation.
py-autobahn: updated to 26.7.1
26.7.1
------
**Security**
* Fix WebSocket ``maxMessagePayloadSize`` being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past ``maxMessagePayloadSize`` is now rejected where it previously passed; uncompressed traffic and the per-frame ``maxFramePayloadSize`` wire guard are unaffected
* Fix the permessage-deflate ``max_message_size`` receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded ``decompress(…, max_length)`` left the remaining input in ``unconsumed_tail`` undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises ``PayloadExceededError`` as soon as the uncompressed size would exceed the cap
* Make bounded decompression backend-agnostic: ``decompress_message_data()`` gains an optional ``max_output_len`` argument (documented on the ``PerMessageCompress`` base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by ``maxFramePayloadSize``) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining ``maxMessagePayloadSize`` budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check
* Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio ``WampRawSocketFactory`` now exposes ``setProtocolOptions(maxMessagePayloadSize=...)`` / ``resetProtocolOptions()`` (bounds ``[512, 2**24]``, default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead ``max_size=None`` branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket ``max_message_size`` had no effect on the asyncio path
**FlatBuffers**
* Fix ``check_zlmdb_flatbuffers_version_in_sync()`` comparing the build-time ``version()`` (which is ``(0, 0, 0, None, None)`` on installed wheels, where the vendored FlatBuffers ``__git_version__`` is unstamped) — it now compares the reliably-stamped ``__version__`` and returns a version string. Added regression tests
* Make ``autobahn.flatbuffers.version()`` reliable on installed wheels: when the build-time ``__git_version__`` is a bare commit hash or ``"unknown"`` (shallow clone / submodule absent from the sdist), ``version()`` now falls back to parsing the static vendored ``__version__`` and returns ``(major, minor, patch, None, None)`` instead of ``(0, 0, 0, None, None)``; rich ``git describe`` detail is still returned on genuine dev/git builds. Also hardened ``hatch_build.py`` so it never stamps a non-parseable ``__git_version__``. Return shape is unchanged (5-tuple); no API break
**Build & CI/CD**
[5 lines not shown]
py-twine: updated to 7.0.0
twine 7.0.0 (2026-07-27)
Bugfixes
- Specify UTF-8 encoding when reading ``.pypirc`` files.
- Add missing subdependencies to ``--version`` output.
- The dependency on ``rich`` has been bumped to avoid a hang in some environments.
- Indices that respond with non-standard HTTP codes are now handled more gracefully.
Deprecations and Removals
- Fix uploading packages with metadata version 2.5. The fix no longer allows metadata version 2.0, which was never officially standardised.
py-anyio: updated to 4.15.0
4.15.0
- Added support for the newer keyword-only arguments on ``anyio.Path`` methods to match
the standard library ``pathlib.Path``:
* ``follow_symlinks`` on ``exists()`` (Python 3.12+)
* ``follow_symlinks`` on ``is_dir()`` (Python 3.13+)
* ``follow_symlinks`` on ``is_file()`` (Python 3.13+)
* ``follow_symlinks`` on ``owner()`` (Python 3.13+)
* ``follow_symlinks`` on ``group()`` (Python 3.13+)
* ``newline`` on ``read_text()`` (Python 3.13+)
- Added ``amap``, ``gather``, and ``as_completed`` utility functions to simplify common
patterns
- Added ``--anyio-mode`` command-line option as an alternative to the ``anyio_mode``
ini setting, and fix the pytest plugin's auto mode detection to recognize the mode
when set via either mechanism(e.g: ``pytest_asyncio``).
[73 lines not shown]
py-joblib: updated to 1.6.0
1.6.0
Fix caching of functions whose source cannot be retrieved, such as functions defined in a notebook cell. Their identity fell back to str(hash(func.__code__)), which is salted by PYTHONHASHSEED and so differed between processes. A worker reading the func_code.py written by another one concluded that the function had changed and wiped the whole cache directory for it, discarding results computed by its peers. func_code.py is also no longer rewritten in place, so a reader can no longer catch it half-written and draw the same conclusion.
Drop python 3.9 support. The oldest supported Python version is now Python 3.10.
Fix eval_expr (used to evaluate the pre_dispatch argument of Parallel) to raise a ValueError as documented instead of leaking a ZeroDivisionError for expressions that divide or take a modulo by zero.
MemorizedResult now forwards mmap_mode to its store backend, so a cached array reconstructed from a location is memory-mapped as requested instead of being loaded fully into memory.
Unvendor cloudpickle to more quickly benefit from maintenance releases of cloudpickle
Fix Memory.cache for functions with a keyword-only argument that has a default declared before a keyword-only argument without a default.
Fix behavior of filter_args on some precise cases.
Fix a concurrency error that could happen with unordered generator.
Fix: dump() now accepts any input os.PathLike object to be consistent with load.
The documentation now uses pydata sphinx theme. Furthermore, optional dependencies test and docs have been added to pyproject.toml.
Vendor loky 3.6.0
py-vdirsyncer: updated to 0.21.0
0.21.0
- Implement retrying for ``google`` storage type when a rate limit is reached.
- ``tenacity`` is now a required dependency.
- Drop support for Python 3.8.
- Retry transient network errors for nullipotent requests.
- Add support for Python 3.14.
