py-httptools: updated to 0.9.0
0.9.0
Upgrade llhttp to 9.4.3
Build CPython 3.15 wheels
Add RISC-V 64-bit wheels
Add Windows ARM64 support in CI
Build PPC64LE wheels
Modernize test and release workflows
py-httpx2: updated to 2.14.0
2.14.0 (October 18th, 2026)
Added
* Match IP CIDR ranges, like `192.168.0.0/16` and `[fe80::]/10`, in `NO_PROXY` and `mounts`. Requests to any address in the range now bypass the proxy; previously only the network address itself did.
* Accept bracketed IPv6 addresses, like `[::1]` and `[::1]:8080`, in `NO_PROXY`.
Changed
* Raise `InvalidURL` for a `mounts` key with an IP host followed by anything other than a valid CIDR prefix, like `all://10.0.0.0/33`.
Fixed
* Ignore `NO_PROXY` entries that cannot be parsed, instead of raising `InvalidURL` when the client is created.
* Import `httpx2` on FIPS-enforced Python builds without `hashlib.md5`. `DigestAuth` raises `ProtocolError` when the server asks for an unavailable algorithm.
* Handle reads after an ASGI WebSocket app shuts down, instead of leaking `anyio` exceptions.
* Stop the sync WebSocket session from hanging on exit when its event queue is full.
py-httpcore2: updated to 2.14.0
2.14.0 (October 18th, 2026)
Fixed
* Keep `CONNECT` and absolute-form proxy targets when the request sets the `target` extension.
* Stop blocking reads when an HTTP/2 server lowers `SETTINGS_MAX_CONCURRENT_STREAMS` while requests are in flight.
* Raise `WriteError` instead of `anyio.EndOfStream` when writing after the peer closes a TLS connection without `close_notify`.
py-checkdmarc: updated to 6.0.4
6.0.4
Fixed
SPF: concatenate TXT character-strings without removing literal quotes or
backslashes before selecting records, so a split within or immediately after
v=spf1 is accepted in top-level, include:, and redirect= lookups as
required by RFC 7208 section 3.3
DNS: escape literal quotes and backslashes in quoted TXT output so payload
characters remain distinct from string boundaries (RFC 1035 section 5.1)
DNS: preserve UTF-8 sequences split across TXT byte boundaries, retaining
the original string lengths for SPF size warnings (RFC 1035 section 3.3)
DNS: escape linefeeds in quoted TXT output so dnspython can parse it back
into the original byte strings
SPF: decode non-digit DNS escapes in quoted input to parse_spf_record()
so escaped mechanism names and values can be assessed (RFC 1035 section 5.1)
SPF: accept surrounding spaces, tabs, and line endings in quoted parser
[2 lines not shown]
py-test-mock: updated to 3.17.0
3.17.0
* Failures of mock assertions such as ``assert_called_with`` are again reported only once, instead of two or three times with the original error from the ``mock`` module chained before them.
* Mock assertion failures no longer show misleading introspection when they are not about the arguments of the last call: ``assert_called``, ``assert_called_once``, ``assert_not_called``, ``assert_any_call``, their ``await`` counterparts, and ``assert_called_once_with``/``assert_awaited_once_with`` when the mock was not called (awaited) exactly once. The introspection also no longer reports arguments passed by position versus by keyword as different for autospecced mocks, and no longer shows empty ``Args:``/``Kwargs:`` sections when assertion rewriting is not available.
* ``assert_has_calls`` and ``assert_has_awaits`` failures no longer show pytest introspection, which compared the expected and actual calls position by position and so reported differences between unrelated calls. The mock's own message, listing the expected and actual calls, is still shown.
py-tortoise-orm: updated to 1.1.9
1.1.9
Added
Q.__bool__() so Q objects with no filters/children (including nested empty Q children) are falsy.
PostgreSQL password credential now accepts a sync or async callable, resolved once per new connection, to support short-lived credentials such as AWS RDS/Aurora IAM tokens and Azure Entra ID tokens.
Changed
tortoise.contrib.starlette now only supports Starlette 1.0+ (This does not affect FastAPI users; you can continue using FastAPI with any version of Starlette).
Fixed
Aggregates now apply _filter when the aggregated argument is an F() or a combined expression (e.g. Sum(F("price") * F("qty"), _filter=Q(status="paid"))). Previously the filter was silently dropped and every row was aggregated.
Negating an already negated Q now cancels out: ~~Q(...) and .exclude(~Q(...)) used to keep a single NOT, so they returned the rows the caller meant to drop.
PostgreSQL and Oracle RemoveIndex / partial RemoveConstraint now schema-qualify DROP INDEX, so indexes on models with Meta.schema can be dropped when they are not on the connection search_path.
ForeignKeyField/OneToOneField no longer lose a declared source_field when deconstructed. makemigrations wrote the generated <field>_id backing field name as the column name, so a migrated schema disagreed with generate_schemas() and neither path reported an error.
[15 lines not shown]
py-wrapt: updated to 2.5.1
2.5.1
Bugs Fixed
A LazyObjectProxy created with an interface argument that declared a path-like type, such as os.PathLike or pathlib.Path, did not define the __fspath__() special method on the class it generated. Because os.fspath() looks up __fspath__() on the type of the object, passing such a proxy to os.fspath(), the builtin open() or other standard library functions accepting paths raised TypeError before the factory callable had been invoked to create the wrapped object. The __fspath__() special method is now added when the declared interface provides it, in the same way as is already done for the other special methods looked up on the type, so the first path conversion triggers creation of the wrapped object and succeeds.
A callback passed to wrapt.WeakFunctionProxy which was callable but evaluated as false, such as an event emitter object which reports its number of subscribers via __len__() and is empty when first created, was passed the underlying weak reference object instead of the proxy when the wrapped function expired. Where the wrapped function was a bound method, such a callback could also be called twice, once each when the instance and the function expired. Only None is now treated as meaning no callback was supplied, which mirrors the behaviour of weakref.ref() and weakref.proxy() in the standard library, so these callbacks now receive the proxy and are called only once, as for any other callback.
A wrapt.AdapterFactory instance passed as the adapter argument to wrapt.decorator was ignored, and so never called, if the instance evaluated as false, such as when the factory class defined __bool__() or __len__(). The decorated function then retained its original signature instead of that produced by the factory. Whether an adapter factory was supplied is now determined by type before the truth value of the adapter is considered, so such factories are always called. As a consequence of this change a factory can now also return None, or any other false value, to indicate that no adapter should be used for a particular function, where previously this failed with an obscure error.
py-zope.interface: updated to 8.7
8.7 (2026-10-15)
- Release Python 3.15 binary wheels.
- Fix free-threaded (no-GIL) data races in the C lookup caches. Concurrent
``lookup()`` and ``changed()`` calls could crash while cache fields were
being replaced. Their lifetimes are now guarded by a critical section on
Python 3.13+. Also affects GIL builds.
- Fix reference leaks in the C optimizations when the lazy import of
``zope.interface.declarations`` fails partway through.
- Drop support for Python 3.10.
- Remove the C optimizations' code path for static types, which was only
used on Python < 3.11.
py-cftime: updated to 1.6.6.1
1.6.6.1
* ensure has_year_zero=False is ignored for idealized calendars, including when
constructing year zero dates
* include free-threaded wheels
py-joserfc: updated to 1.7.7
1.7.7
- **JWK**: Reject recognized DER, PEM, and SSH asymmetric public keys when
importing oct keys, including public key bytes embedded in an oct JWK.
Preserve warnings for input that only resembles an asymmetric key.
- Replace legacy union type hints with ``|`` syntax.
1.7.6
- **JWE**: Limit base64url-encoded additional authenticated data to 65,536 bytes
before copying or decoding it in JSON serialization. Configure the limit with
``JWERegistry(max_aad_length=...)``.
- **JWT**: Reject non-string ``jti`` claims, including arrays containing an expected
token ID, even when no claim options are configured.
- **JWT**: Report the correct claim name for invalid ``iss`` values.
- **JWS & JWE**: Validate compact token size before splitting it into segments.
- **JWK**: Handle key set equality comparisons with unrelated types.
libarchive: updated to 3.8.10
3.8.10
New features:
7z: add Delta, RISCV, ARMTHUMB and IA64 filters for non-lzma archives
libarchive: support digest with nettle 4 and mbedtls 3
tar: add --mode option
Security and Bug Fixes
see ChangeLog
ccache: updated to 4.14.2
Ccache 4.14.2
Compatibility changes
On Windows, ccache now requires Windows 8 or later.
Bug fixes
Fixed false inode cache hits on Windows by using full 128-bit file IDs when available.
Fixed caching of precompiled headers with clang-cl, icx-cl and icx after MSVC updates by hashing the compiler’s target triple.
Fixed handling of nonexistent or non-directory -fprebuilt-module-path arguments on Windows with Visual Studio 2026.
Fixed preservation of inherited signal handling, including SIGPIPE, in compiler processes.
Fixed a symlink race when creating the fallback storage helper IPC directory in /tmp.
Fixed logging of credentials when using --stop-storage-helpers.
Fixed spurious errors when a storage helper closes its connection before responding to a stop request.
Fixed undefined behavior when handling empty byte buffers.
Fixed MSVC debug iterator assertions when handling empty byte buffers.
[12 lines not shown]
