From 8f3c1d155abcdef8a1e98f2e3f3435f7f711fea4 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Wed, 4 Jun 2025 11:36:08 -0400
Subject: [PATCH 001/231] Use `gh release` instead of someone's release action
(#635)
The upstream action times out because it requests every release (without
pagination), and there's no real need to use a third-party action for
this when the `gh` command does a perfectly fine job too.
---
.github/workflows/release.yml | 11 ++---------
Justfile | 22 ++++++++++++++++++++++
2 files changed, 24 insertions(+), 9 deletions(-)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aa2d3a707..83cee9b63 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,7 +41,7 @@ jobs:
- run: just release-dry-run ${{ secrets.GITHUB_TOKEN }} ${{ github.event.inputs.sha }} ${{ github.event.inputs.tag }}
if: ${{ github.event.inputs.dry-run == 'true' }}
- # Create the release itself.
+ # Set our identity for git operations (on the latest-release branch).
- name: Configure Git identity
if: ${{ github.event.inputs.dry-run == 'false' }}
run: |
@@ -66,14 +66,7 @@ jobs:
# Create a GitHub release.
- name: Create GitHub Release
if: ${{ github.event.inputs.dry-run == 'false' }}
- uses: ncipollo/release-action@v1
- with:
- tag: ${{ github.event.inputs.tag }}
- name: ${{ github.event.inputs.tag }}
- prerelease: true
- body: TBD
- allowUpdates: true
- updateOnlyUnreleased: true
+ run: just release-create ${{ github.events.input.tag }}
# Uploading the relevant artifact to the GitHub release.
- run: just release-run ${{ secrets.GITHUB_TOKEN }} ${{ github.event.inputs.sha }} ${{ github.event.inputs.tag }}
diff --git a/Justfile b/Justfile
index 0255bd223..c9b8167f0 100644
--- a/Justfile
+++ b/Justfile
@@ -67,6 +67,28 @@ release-set-latest-release tag:
echo "No changes to commit."
fi
+# Create a GitHub release object, or reuse an existing prerelease.
+release-create tag:
+ #!/usr/bin/env bash
+ set -euo pipefail
+ prerelease_exists=$(gh release view {{tag}} --json isPrerelease -t '{{{{.isPrerelease}}' 2>&1 || true)
+ case "$prerelease_exists" in
+ true)
+ echo "note: updating existing prerelease {{tag}}"
+ ;;
+ false)
+ echo "error: release {{tag}} already exists"
+ exit 1
+ ;;
+ "release not found")
+ gh release create {{tag}} --prerelease --notes TBD --verify-tag
+ ;;
+ *)
+ echo "error: unexpected gh cli output: $prerelease_exists"
+ exit 1
+ ;;
+ esac
+
# Perform the release job. Assumes that the GitHub Release has been created.
release-run token commit tag:
#!/bin/bash
From d2030cb517582a4b0fa7bdafe1aa7587b001ecdd Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Wed, 4 Jun 2025 11:20:38 -0500
Subject: [PATCH 002/231] Update to 3.14.0b1 (#610)
- https://github.com/python/cpython/pull/133027
- https://github.com/python/cpython/pull/133366
- https://github.com/python/cpython/pull/133284
- https://github.com/python/cpython/pull/133398
- https://github.com/python/cpython/issues/131298
- https://github.com/python/cpython/pull/132438
- https://github.com/python/cpython/pull/133012
---------
Co-authored-by: Wingy
Co-authored-by: Geoffrey Thomas
---
cpython-unix/build-cpython.sh | 10 ++++-
cpython-unix/extension-modules.yml | 35 +++++++++++------
cpython-unix/patch-jit-cflags-314.patch | 38 ++++++++++---------
.../patch-python-configure-hacl-no-simd.patch | 24 ++++++++++++
cpython-windows/build.py | 21 ++++++++++
pythonbuild/cpython.py | 25 ++++++++++++
pythonbuild/downloads.py | 17 +++++++--
src/validation.rs | 14 +++----
8 files changed, 144 insertions(+), 40 deletions(-)
create mode 100644 cpython-unix/patch-python-configure-hacl-no-simd.patch
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index b44bb9713..49e1873c6 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -466,7 +466,8 @@ if [ -n "${CPYTHON_OPTIMIZED}" ]; then
# Do not enable on x86-64 macOS because the JIT requires macOS 11+ and we are currently
# using 10.15 as a miniumum version.
- if [ "${TARGET_TRIPLE}" != "x86_64-apple-darwin" ]; then
+ # Do not enable when free-threading, because they're not compatible yet.
+ if [[ ! ( "${TARGET_TRIPLE}" == "x86_64-apple-darwin" || -n "${CPYTHON_FREETHREADED}" ) ]]; then
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} --enable-experimental-jit=yes-off"
fi
@@ -588,6 +589,13 @@ if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" && -n "${CROSS_COMPILING}" && "$
export PROFILE_TASK='-m test --pgo --ignore test_strftime_y2k'
fi
+# ./configure tries to auto-detect whether it can build 128-bit and 256-bit SIMD helpers for HACL,
+# but on x86-64 that requires v2 and v3 respectively, and on arm64 the performance is bad as noted
+# in the comments, so just don't even try. (We should check if we can make this conditional)
+if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]]; then
+ patch -p1 -i "${ROOT}/patch-python-configure-hacl-no-simd.patch"
+fi
+
# We use ndbm on macOS and BerkeleyDB elsewhere.
if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} --with-dbmliborder=ndbm"
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index 028eadde5..3d69f049b 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -43,7 +43,7 @@ _blake2:
minimum-python-version: "3.14"
- define: _DEFAULT_SOURCE
minimum-python-version: "3.14"
- # Disable `explicit_bzero`, it requires glib 2.25+
+ # Disable `explicit_bzero`, it requires glibc 2.25+
- define: LINUX_NO_EXPLICIT_BZERO
minimum-python-version: "3.14"
@@ -88,6 +88,9 @@ _collections:
_contextvars:
sources:
- _contextvarsmodule.c
+ config-c-only-conditional:
+ - config-c-only: true
+ minimum-python-version: "3.14"
_crypt:
maximum-python-version: "3.12"
@@ -315,12 +318,6 @@ _hmac:
includes:
- Modules/_hacl/
- Modules/_hacl/include/
- links:
- - :libHacl_Hash_Blake2.a
- - :libHacl_Hash_SHA1.a
- - :libHacl_Hash_SHA2.a
- - :libHacl_Hash_SHA3.a
- - :libHacl_Hash_MD5.a
defines:
- _BSD_SOURCE
- _DEFAULT_SOURCE
@@ -376,7 +373,6 @@ _md5:
sources-conditional:
- source: _hacl/Hacl_Hash_MD5.c
minimum-python-version: "3.12"
- maximum-python-version: "3.13"
defines-conditional:
- define: _BSD_SOURCE
minimum-python-version: "3.12"
@@ -435,6 +431,12 @@ _random:
sources:
- _randommodule.c
+
+_remote_debugging:
+ minimum-python-version: "3.14"
+ sources:
+ - _remote_debugging_module.c
+
_scproxy:
# _scproxy is Apple OS only.
# APIs required by _scproxy not available on iOS.
@@ -453,7 +455,6 @@ _sha1:
sources-conditional:
- source: _hacl/Hacl_Hash_SHA1.c
minimum-python-version: "3.12"
- maximum-python-version: "3.13"
includes:
- Modules/_hacl/include
defines-conditional:
@@ -475,7 +476,6 @@ _sha2:
- sha2module.c
sources-conditional:
- source: _hacl/Hacl_Hash_SHA2.c
- maximum-python-version: "3.13"
includes:
- Modules/_hacl/include
defines:
@@ -491,7 +491,6 @@ _sha3:
minimum-python-version: "3.12"
- source: _hacl/Hacl_Hash_SHA3.c
minimum-python-version: "3.12"
- maximum-python-version: "3.13"
includes:
- Modules/_hacl/include
defines-conditional:
@@ -617,6 +616,7 @@ _testcapi:
_testexternalinspection:
minimum-python-version: '3.13'
+ maximum-python-version: '3.13'
sources:
- _testexternalinspection.c
@@ -645,6 +645,8 @@ _testinternalcapi:
minimum-python-version: "3.13"
- source: _testinternalcapi/test_lock.c
minimum-python-version: "3.13"
+ - source: _testinternalcapi/complex.c
+ minimum-python-version: "3.14"
_testmultiphase:
minimum-python-version: '3.9'
@@ -769,6 +771,17 @@ _xxtestfuzz:
- _xxtestfuzz/_xxtestfuzz.c
- _xxtestfuzz/fuzzer.c
+_zstd:
+ # Disable on all targets until we add a zstd library
+ disabled-targets:
+ - .*
+ minimum-python-version: '3.14'
+ sources:
+ - _zstd/_zstdmodule.c
+ - _zstd/zdict.c
+ - _zstd/compressor.c
+ - _zstd/decompressor.c
+
_zoneinfo:
minimum-python-version: "3.9"
sources:
diff --git a/cpython-unix/patch-jit-cflags-314.patch b/cpython-unix/patch-jit-cflags-314.patch
index 81f6fd02a..3fc200ad6 100644
--- a/cpython-unix/patch-jit-cflags-314.patch
+++ b/cpython-unix/patch-jit-cflags-314.patch
@@ -1,5 +1,5 @@
diff --git a/Tools/jit/_targets.py b/Tools/jit/_targets.py
-index b3b065652e0..d361f57382e 100644
+index 6ceb4404e74..94b74b5c8b0 100644
--- a/Tools/jit/_targets.py
+++ b/Tools/jit/_targets.py
@@ -10,6 +10,7 @@
@@ -10,7 +10,7 @@ index b3b065652e0..d361f57382e 100644
import _llvm
import _schema
-@@ -42,6 +43,7 @@ class _Target(typing.Generic[_S, _R]):
+@@ -46,6 +47,7 @@ class _Target(typing.Generic[_S, _R]):
stable: bool = False
debug: bool = False
verbose: bool = False
@@ -18,7 +18,7 @@ index b3b065652e0..d361f57382e 100644
known_symbols: dict[str, int] = dataclasses.field(default_factory=dict)
def _get_nop(self) -> bytes:
-@@ -115,6 +117,7 @@ async def _compile(
+@@ -119,6 +121,7 @@ async def _compile(
) -> _stencils.StencilGroup:
o = tempdir / f"{opname}.o"
args = [
@@ -27,10 +27,10 @@ index b3b065652e0..d361f57382e 100644
"-DPy_BUILD_CORE_MODULE",
"-D_DEBUG" if self.debug else "-DNDEBUG",
diff --git a/Tools/jit/build.py b/Tools/jit/build.py
-index a8cb0f67c36..663874ad439 100644
+index 49b08f477db..49a1b11de47 100644
--- a/Tools/jit/build.py
+++ b/Tools/jit/build.py
-@@ -22,7 +22,11 @@
+@@ -26,11 +26,15 @@
parser.add_argument(
"-v", "--verbose", action="store_true", help="echo commands as they are run"
)
@@ -38,33 +38,37 @@ index a8cb0f67c36..663874ad439 100644
+ "--with-cflags", help="additional flags to pass to the compiler", default=""
+ )
args = parser.parse_args()
- args.target.debug = args.debug
- args.target.verbose = args.verbose
-+ args.target.cflags = args.with_cflags
- args.target.build(pathlib.Path.cwd(), comment=comment, force=args.force)
+ for target in args.target:
+ target.debug = args.debug
+ target.force = args.force
+ target.verbose = args.verbose
++ target.cflags = args.with_cflags
+ target.build(
+ out,
+ comment=comment,
diff --git a/configure b/configure
-index 1b75ddfa26d..3c9e550b5d3 100755
+index c51192f12c8..0dcef7c2617 100755
--- a/configure
+++ b/configure
-@@ -8399,7 +8399,7 @@ then :
+@@ -10863,7 +10863,7 @@ then :
else case e in #(
e) as_fn_append CFLAGS_NODIST " $jit_flags"
-- REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py $host"
-+ REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py $host --with-cflags=\"\$(CONFIGURE_CFLAGS)\""
+- REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host}"
++ REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --with-cflags=\"\$(CONFIGURE_CFLAGS)\""
JIT_STENCILS_H="jit_stencils.h"
if test "x$Py_DEBUG" = xtrue
then :
diff --git a/configure.ac b/configure.ac
-index c449bb5ebb3..5f9d08a4ee7 100644
+index a7b2f62579b..5998f896a4e 100644
--- a/configure.ac
+++ b/configure.ac
-@@ -1827,7 +1827,7 @@ AS_VAR_IF([jit_flags],
+@@ -2776,7 +2776,7 @@ AS_VAR_IF([jit_flags],
[],
[AS_VAR_APPEND([CFLAGS_NODIST], [" $jit_flags"])
AS_VAR_SET([REGEN_JIT_COMMAND],
-- ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py $host"])
-+ ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py $host --with-cflags=\"\$(CONFIGURE_CFLAGS)\""])
+- ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host}"])
++ ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --with-cflags=\"\$(CONFIGURE_CFLAGS)\""])
AS_VAR_SET([JIT_STENCILS_H], ["jit_stencils.h"])
AS_VAR_IF([Py_DEBUG],
[true],
diff --git a/cpython-unix/patch-python-configure-hacl-no-simd.patch b/cpython-unix/patch-python-configure-hacl-no-simd.patch
new file mode 100644
index 000000000..125aea33f
--- /dev/null
+++ b/cpython-unix/patch-python-configure-hacl-no-simd.patch
@@ -0,0 +1,24 @@
+diff --git a/configure.ac b/configure.ac
+index a7b2f62579b..06c0c0c0da0 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -7897,8 +7897,7 @@ AC_SUBST([LIBHACL_LDFLAGS])
+ # The SIMD files use aligned_alloc, which is not available on older versions of
+ # Android.
+ # The *mmintrin.h headers are x86-family-specific, so can't be used on WASI.
+-if test "$ac_sys_system" != "Linux-android" -a "$ac_sys_system" != "WASI" || \
+- { test -n "$ANDROID_API_LEVEL" && test "$ANDROID_API_LEVEL" -ge 28; }
++if false
+ then
+ dnl This can be extended here to detect e.g. Power8, which HACL* should also support.
+ AX_CHECK_COMPILE_FLAG([-msse -msse2 -msse3 -msse4.1 -msse4.2],[
+@@ -7930,8 +7929,7 @@ AC_SUBST([LIBHACL_BLAKE2_SIMD128_OBJS])
+ # Although AVX support is not guaranteed on Android
+ # (https://developer.android.com/ndk/guides/abis#86-64), this is safe because we do a
+ # runtime CPUID check.
+-if test "$ac_sys_system" != "Linux-android" -a "$ac_sys_system" != "WASI" || \
+- { test -n "$ANDROID_API_LEVEL" && test "$ANDROID_API_LEVEL" -ge 28; }
++if false
+ then
+ AX_CHECK_COMPILE_FLAG([-mavx2],[
+ [LIBHACL_SIMD256_FLAGS="-mavx2"]
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index e981a8ac2..15b0a44de 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -72,6 +72,10 @@
},
"_overlapped": {},
"_multiprocessing": {},
+ "_remote_debugging": {
+ # Added in 3.14
+ "ignore_missing": True
+ },
"_socket": {},
"_sqlite3": {"shared_depends": ["sqlite3"]},
# See the one-off calls to copy_link_to_lib() and elsewhere to hack up
@@ -90,6 +94,10 @@
"ignore_missing": True,
},
"_zoneinfo": {"ignore_missing": True},
+ "_zstd": {
+ # Added in 3.14
+ "ignore_missing": True
+ },
"pyexpat": {},
"select": {},
"unicodedata": {},
@@ -117,6 +125,7 @@
"_tkinter": ["tcl-8612", "tk-8612", "tix"],
"_uuid": ["uuid"],
"zlib": ["zlib"],
+ "_zstd": ["zstd"],
}
@@ -357,6 +366,7 @@ def hack_props(
sqlite_version = DOWNLOADS["sqlite"]["version"]
xz_version = DOWNLOADS["xz"]["version"]
zlib_version = DOWNLOADS[zlib_entry]["version"]
+ zstd_version = DOWNLOADS["zstd"]["version"]
mpdecimal_version = DOWNLOADS["mpdecimal"]["version"]
@@ -372,6 +382,7 @@ def hack_props(
xz_path = td / ("xz-%s" % xz_version)
zlib_prefix = "cpython-source-deps-" if zlib_entry == "zlib-ng" else ""
zlib_path = td / ("%s%s-%s" % (zlib_prefix, zlib_entry, zlib_version))
+ zstd_path = td / ("cpython-source-deps-zstd-%s" % zstd_version)
mpdecimal_path = td / ("mpdecimal-%s" % mpdecimal_version)
openssl_root = td / "openssl" / arch
@@ -416,6 +427,9 @@ def hack_props(
elif b"%s\\" % zlib_path
+ elif b"%s\\" % zstd_path
+
elif b"%s\\" % mpdecimal_path
@@ -1255,6 +1269,12 @@ def build_cpython(
"tk-windows-bin-8612", BUILD, local_name="tk-windows-bin.tar.gz"
)
+ # On CPython 3.14+, zstd is included
+ if meets_python_minimum_version(python_version, "3.14"):
+ zstd_archive = download_entry("zstd", BUILD)
+ else:
+ zstd_archive = None
+
# CPython 3.13+ no longer uses a bundled `mpdecimal` version so we build it
if meets_python_minimum_version(python_version, "3.13"):
mpdecimal_archive = download_entry("mpdecimal", BUILD)
@@ -1297,6 +1317,7 @@ def build_cpython(
tk_bin_archive,
xz_archive,
zlib_archive,
+ zstd_archive,
):
if a is None:
continue
diff --git a/pythonbuild/cpython.py b/pythonbuild/cpython.py
index e59eecd36..f339037ce 100644
--- a/pythonbuild/cpython.py
+++ b/pythonbuild/cpython.py
@@ -16,6 +16,19 @@
"properties": {
"build-mode": {"type": "string"},
"config-c-only": {"type": "boolean"},
+ "config-c-only-conditional": {
+ "type": "array",
+ "items": {
+ "type": "object",
+ "properties": {
+ "config-c-only": {"type": "boolean"},
+ "minimum-python-version": {"type": "string"},
+ "maximum-python-version": {"type": "string"},
+ },
+ "additionalProperties": False,
+ "required": ["config-c-only"],
+ },
+ },
"defines": {"type": "array", "items": {"type": "string"}},
"defines-conditional": {
"type": "array",
@@ -286,6 +299,18 @@ def derive_setup_local(
if info.get("config-c-only"):
config_c_only_wanted.add(name)
+ for entry in info.get("config-c-only-conditional", []):
+ python_min_match_setup = meets_python_minimum_version(
+ python_version, entry.get("minimum-python-version", "1.0")
+ )
+ python_max_match_setup = meets_python_maximum_version(
+ python_version, entry.get("maximum-python-version", "100.0")
+ )
+ if entry.get("config-c-only", False) and (
+ python_min_match_setup and python_max_match_setup
+ ):
+ config_c_only_wanted.add(name)
+
# Parse more files in the distribution for their metadata.
with tarfile.open(str(cpython_source_archive)) as tf:
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 12abd7aed..2fb34e894 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -82,10 +82,10 @@
"python_tag": "cp313",
},
"cpython-3.14": {
- "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0a7.tar.xz",
- "size": 23015952,
- "sha256": "71adbcec3ac9edf93308e55cfb4184f2eb4b16fda2bb0a5a382929ed29c8386d",
- "version": "3.14.0a7",
+ "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0b1.tar.xz",
+ "size": 23358200,
+ "sha256": "2ddd30a77c9f62e065ce648664a254b9b0c011bcdaa8c1c2787087e644cbeb39",
+ "version": "3.14.0b1",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp314",
@@ -429,4 +429,13 @@
"licenses": ["Zlib"],
"license_file": "LICENSE.zlib-ng.txt",
},
+ "zstd": {
+ "url": "https://github.com/python/cpython-source-deps/archive/refs/tags/zstd-1.5.7.tar.gz",
+ "size": 2440298,
+ "sha256": "f24b52470d12f466e9fa4fcc94e6c530625ada51d7b36de7fdc6ed7e6f499c8e",
+ "version": "1.5.7",
+ "library_names": ["zstd"],
+ "licenses": ["BSD-3-Clause"],
+ "license_file": "LICENSE.zstd.txt",
+ },
}
diff --git a/src/validation.rs b/src/validation.rs
index 55139df78..19aace00d 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -748,6 +748,7 @@ const GLOBAL_EXTENSIONS_PYTHON_3_13: &[&str] = &[
"_interpqueues",
"_interpreters",
"_sha2",
+ "_suggestions",
"_sysconfig",
"_tokenize",
"_typing",
@@ -758,7 +759,9 @@ const GLOBAL_EXTENSIONS_PYTHON_3_14: &[&str] = &[
"_interpchannels",
"_interpqueues",
"_interpreters",
+ "_remote_debugging",
"_sha2",
+ "_suggestions",
"_sysconfig",
"_tokenize",
"_typing",
@@ -800,7 +803,8 @@ const GLOBAL_EXTENSIONS_WINDOWS: &[&str] = &[
"winsound",
];
-const GLOBAL_EXTENSIONS_WINDOWS_3_14: &[&str] = &["_wmi"];
+// TODO(zanieb): Move `_zstd` to non-Windows specific once we add support on Unix.
+const GLOBAL_EXTENSIONS_WINDOWS_3_14: &[&str] = &["_wmi", "_zstd"];
const GLOBAL_EXTENSIONS_WINDOWS_PRE_3_13: &[&str] = &["_msi"];
@@ -1598,12 +1602,8 @@ fn validate_extension_modules(
]);
}
- if is_windows && matches!(python_major_minor, "3.13" | "3.14") {
- wanted.extend(["_suggestions"]);
- }
-
- if (is_linux || is_macos) && matches!(python_major_minor, "3.13" | "3.14") {
- wanted.extend(["_suggestions", "_testexternalinspection"]);
+ if (is_linux || is_macos) && matches!(python_major_minor, "3.13") {
+ wanted.insert("_testexternalinspection");
}
if (is_linux || is_macos) && matches!(python_major_minor, "3.12" | "3.13" | "3.14") {
From f77aba04edb028938eace39443b848be6d817b0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?=
Date: Wed, 4 Jun 2025 20:13:28 +0300
Subject: [PATCH 003/231] Bump stable Python versions: 3.13.4, 3.12.11,
3.11.13, 3.10.18 and 3.9.23 (#644)
https://discuss.python.org/t/python-3-13-4-3-12-11-3-11-13-3-10-18-and-3-9-23-are-now-available/94367
---
pythonbuild/downloads.py | 40 ++++++++++++++++++++--------------------
1 file changed, 20 insertions(+), 20 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 2fb34e894..8add331df 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -37,46 +37,46 @@
"license_file": "LICENSE.bzip2.txt",
},
"cpython-3.9": {
- "url": "https://www.python.org/ftp/python/3.9.22/Python-3.9.22.tar.xz",
- "size": 19652572,
- "sha256": "8c136d199d3637a1fce98a16adc809c1d83c922d02d41f3614b34f8b6e7d38ec",
- "version": "3.9.22",
+ "url": "https://www.python.org/ftp/python/3.9.23/Python-3.9.23.tar.xz",
+ "size": 19659284,
+ "sha256": "61a42919e13d539f7673cf11d1c404380e28e540510860b9d242196e165709c9",
+ "version": "3.9.23",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp39",
},
"cpython-3.10": {
- "url": "https://www.python.org/ftp/python/3.10.17/Python-3.10.17.tar.xz",
- "size": 19608144,
- "sha256": "4c68050f049d1b4ac5aadd0df5f27941c0350d2a9e7ab0907ee5eb5225d9d6b0",
- "version": "3.10.17",
+ "url": "https://www.python.org/ftp/python/3.10.18/Python-3.10.18.tar.xz",
+ "size": 19619316,
+ "sha256": "ae665bc678abd9ab6a6e1573d2481625a53719bc517e9a634ed2b9fefae3817f",
+ "version": "3.10.18",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp310",
},
"cpython-3.11": {
- "url": "https://www.python.org/ftp/python/3.11.12/Python-3.11.12.tar.xz",
- "size": 20112232,
- "sha256": "849da87af4df137710c1796e276a955f7a85c9f971081067c8f565d15c352a09",
- "version": "3.11.12",
+ "url": "https://www.python.org/ftp/python/3.11.13/Python-3.11.13.tar.xz",
+ "size": 20117496,
+ "sha256": "8fb5f9fbc7609fa822cb31549884575db7fd9657cbffb89510b5d7975963a83a",
+ "version": "3.11.13",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp311",
},
"cpython-3.12": {
- "url": "https://www.python.org/ftp/python/3.12.10/Python-3.12.10.tar.xz",
- "size": 20520960,
- "sha256": "07ab697474595e06f06647417d3c7fa97ded07afc1a7e4454c5639919b46eaea",
- "version": "3.12.10",
+ "url": "https://www.python.org/ftp/python/3.12.11/Python-3.12.11.tar.xz",
+ "size": 20525812,
+ "sha256": "c30bb24b7f1e9a19b11b55a546434f74e739bb4c271a3e3a80ff4380d49f7adb",
+ "version": "3.12.11",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp312",
},
"cpython-3.13": {
- "url": "https://www.python.org/ftp/python/3.13.3/Python-3.13.3.tar.xz",
- "size": 22654240,
- "sha256": "40f868bcbdeb8149a3149580bb9bfd407b3321cd48f0be631af955ac92c0e041",
- "version": "3.13.3",
+ "url": "https://www.python.org/ftp/python/3.13.4/Python-3.13.4.tar.xz",
+ "size": 22672472,
+ "sha256": "27b15a797562a2971dce3ffe31bb216042ce0b995b39d768cf15f784cc757365",
+ "version": "3.13.4",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp313",
From 5276f3b6042f5554ea69618ab1ada0cd3b7b2a84 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 5 Jun 2025 08:27:16 -0500
Subject: [PATCH 004/231] Update to 3.14.0b2 (#647)
---
cpython-unix/build-cpython.sh | 6 +++++
cpython-unix/patch-jit-cflags-314.patch | 24 +++++++++----------
.../patch-static-remote-debug-3.14.patch | 22 +++++++++++++++++
pythonbuild/downloads.py | 8 +++----
4 files changed, 44 insertions(+), 16 deletions(-)
create mode 100644 cpython-unix/patch-static-remote-debug-3.14.patch
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 49e1873c6..f3597e5b1 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -83,6 +83,12 @@ else
patch -p1 -i ${ROOT}/patch-xopen-source-ios-legacy.patch
fi
+# See https://github.com/python/cpython/pull/135146
+# TODO(zanieb): Drop in 3.14b3
+if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
+ patch -p1 -i ${ROOT}/patch-static-remote-debug-3.14.patch
+fi
+
# LIBTOOL_CRUFT is unused and breaks cross-compiling on macOS. Nuke it.
# Submitted upstream at https://github.com/python/cpython/pull/101048.
if [ -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_11}" ]; then
diff --git a/cpython-unix/patch-jit-cflags-314.patch b/cpython-unix/patch-jit-cflags-314.patch
index 3fc200ad6..3a16fb5dd 100644
--- a/cpython-unix/patch-jit-cflags-314.patch
+++ b/cpython-unix/patch-jit-cflags-314.patch
@@ -1,5 +1,5 @@
diff --git a/Tools/jit/_targets.py b/Tools/jit/_targets.py
-index 6ceb4404e74..94b74b5c8b0 100644
+index d0a1c081ffe..deb83f275d2 100644
--- a/Tools/jit/_targets.py
+++ b/Tools/jit/_targets.py
@@ -10,6 +10,7 @@
@@ -16,9 +16,9 @@ index 6ceb4404e74..94b74b5c8b0 100644
verbose: bool = False
+ cflags: str = ""
known_symbols: dict[str, int] = dataclasses.field(default_factory=dict)
+ pyconfig_dir: pathlib.Path = pathlib.Path.cwd().resolve()
- def _get_nop(self) -> bytes:
-@@ -119,6 +121,7 @@ async def _compile(
+@@ -120,6 +122,7 @@ async def _compile(
) -> _stencils.StencilGroup:
o = tempdir / f"{opname}.o"
args = [
@@ -27,10 +27,10 @@ index 6ceb4404e74..94b74b5c8b0 100644
"-DPy_BUILD_CORE_MODULE",
"-D_DEBUG" if self.debug else "-DNDEBUG",
diff --git a/Tools/jit/build.py b/Tools/jit/build.py
-index 49b08f477db..49a1b11de47 100644
+index 1afd0c76bad..96c4cb07593 100644
--- a/Tools/jit/build.py
+++ b/Tools/jit/build.py
-@@ -26,11 +26,15 @@
+@@ -39,11 +39,15 @@
parser.add_argument(
"-v", "--verbose", action="store_true", help="echo commands as they are run"
)
@@ -43,32 +43,32 @@ index 49b08f477db..49a1b11de47 100644
target.force = args.force
target.verbose = args.verbose
+ target.cflags = args.with_cflags
+ target.pyconfig_dir = args.pyconfig_dir
target.build(
- out,
comment=comment,
diff --git a/configure b/configure
-index c51192f12c8..0dcef7c2617 100755
+index 884f8a4b068..2e6740c33d9 100755
--- a/configure
+++ b/configure
@@ -10863,7 +10863,7 @@ then :
else case e in #(
e) as_fn_append CFLAGS_NODIST " $jit_flags"
-- REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host}"
-+ REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --with-cflags=\"\$(CONFIGURE_CFLAGS)\""
+- REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir ."
++ REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir . --with-cflags=\"\$(CONFIGURE_CFLAGS)\""
JIT_STENCILS_H="jit_stencils.h"
if test "x$Py_DEBUG" = xtrue
then :
diff --git a/configure.ac b/configure.ac
-index a7b2f62579b..5998f896a4e 100644
+index cf25148bad2..f8bfab7bf96 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2776,7 +2776,7 @@ AS_VAR_IF([jit_flags],
[],
[AS_VAR_APPEND([CFLAGS_NODIST], [" $jit_flags"])
AS_VAR_SET([REGEN_JIT_COMMAND],
-- ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host}"])
-+ ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --with-cflags=\"\$(CONFIGURE_CFLAGS)\""])
+- ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir ."])
++ ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir . --with-cflags=\"\$(CONFIGURE_CFLAGS)\""])
AS_VAR_SET([JIT_STENCILS_H], ["jit_stencils.h"])
AS_VAR_IF([Py_DEBUG],
[true],
diff --git a/cpython-unix/patch-static-remote-debug-3.14.patch b/cpython-unix/patch-static-remote-debug-3.14.patch
new file mode 100644
index 000000000..1c359c3dc
--- /dev/null
+++ b/cpython-unix/patch-static-remote-debug-3.14.patch
@@ -0,0 +1,22 @@
+diff --git a/Python/remote_debug.h b/Python/remote_debug.h
+index 6cbf1c8deaa..ab494ea71da 100644
+--- a/Python/remote_debug.h
++++ b/Python/remote_debug.h
+@@ -131,7 +131,7 @@ _Py_RemoteDebug_FreePageCache(proc_handle_t *handle)
+ }
+ }
+
+-void
++static void
+ _Py_RemoteDebug_ClearCache(proc_handle_t *handle)
+ {
+ for (int i = 0; i < MAX_PAGES; i++) {
+@@ -989,7 +989,7 @@ _Py_RemoteDebug_ReadRemoteMemory(proc_handle_t *handle, uintptr_t remote_address
+ #endif
+ }
+
+-int
++static int
+ _Py_RemoteDebug_PagedReadRemoteMemory(proc_handle_t *handle,
+ uintptr_t addr,
+ size_t size,
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 8add331df..d21bf9482 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -82,10 +82,10 @@
"python_tag": "cp313",
},
"cpython-3.14": {
- "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0b1.tar.xz",
- "size": 23358200,
- "sha256": "2ddd30a77c9f62e065ce648664a254b9b0c011bcdaa8c1c2787087e644cbeb39",
- "version": "3.14.0b1",
+ "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0b2.tar.xz",
+ "size": 23579860,
+ "sha256": "7ac9e84844bbc0a5a8f1f79a37a68b3b8caf2a58b4aa5999c49227cb36e70ea6",
+ "version": "3.14.0b2",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp314",
From 1a91cdade2eda52e9d911a3e85c98c848a5914bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=90=B4=E5=B0=8F=E7=99=BD?= <296015668@qq.com>
Date: Fri, 6 Jun 2025 00:15:41 +0800
Subject: [PATCH 005/231] fix(workflow): use correct input variable for
release-create step (#648)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The release-create step was using an incorrect variable name
(`github.events.input.tag`), which resulted in the `just release-create`
command being called without the required tag argument. This commit
updates the workflow to use the correct variable
(`github.event.inputs.tag`), ensuring the tag is properly passed to the
command.
-
https://github.com/loong64/python-build-standalone/actions/runs/15469452121/job/43549720438
Signed-off-by: 吴小白 <296015668@qq.com>
---
.github/workflows/release.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 83cee9b63..6381b3e52 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -66,7 +66,7 @@ jobs:
# Create a GitHub release.
- name: Create GitHub Release
if: ${{ github.event.inputs.dry-run == 'false' }}
- run: just release-create ${{ github.events.input.tag }}
+ run: just release-create ${{ github.event.inputs.tag }}
# Uploading the relevant artifact to the GitHub release.
- run: just release-run ${{ secrets.GITHUB_TOKEN }} ${{ github.event.inputs.sha }} ${{ github.event.inputs.tag }}
From ea5992016ef80f1de66146dd8865cb32d90b3cc0 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Fri, 6 Jun 2025 14:18:07 -0500
Subject: [PATCH 006/231] Add patch for stable `uuid.getnode` on 3.13 (#634)
Cherry-picks https://github.com/python/cpython/pull/134704
See #587
---
cpython-unix/build-cpython.sh | 7 +
.../patch-uuid-getnode-stable-3.13.patch | 708 ++++++++++++++++++
2 files changed, 715 insertions(+)
create mode 100644 cpython-unix/patch-uuid-getnode-stable-3.13.patch
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index f3597e5b1..a77d67150 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -76,6 +76,13 @@ if [ -n "${CROSS_COMPILING}" ]; then
fi
fi
+# `uuid.getnode()` is not stable on our libuuid, CPython should fallback to another method
+# Cherry-pick https://github.com/python/cpython/pull/134704 until it is released
+# We could backport this to more versions too, it won't be done by the upstream
+if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" && -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_14}" ]]; then
+ patch -p1 -i ${ROOT}/patch-uuid-getnode-stable-3.13.patch
+fi
+
# This patch is slightly different on Python 3.10+.
if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_10}" ]; then
patch -p1 -i ${ROOT}/patch-xopen-source-ios.patch
diff --git a/cpython-unix/patch-uuid-getnode-stable-3.13.patch b/cpython-unix/patch-uuid-getnode-stable-3.13.patch
new file mode 100644
index 000000000..11bdf83a0
--- /dev/null
+++ b/cpython-unix/patch-uuid-getnode-stable-3.13.patch
@@ -0,0 +1,708 @@
+diff --git a/Lib/test/test_uuid.py b/Lib/test/test_uuid.py
+index e7e44c6413c2e2..ce396aa942b6ed 100755
+--- a/Lib/test/test_uuid.py
++++ b/Lib/test/test_uuid.py
+@@ -1,6 +1,7 @@
+ import unittest
+ from test import support
+ from test.support import import_helper
++from test.support.script_helper import assert_python_ok
+ import builtins
+ import contextlib
+ import copy
+@@ -773,10 +774,37 @@ def test_cli_uuid5_ouputted_with_valid_namespace_and_name(self):
+ class TestUUIDWithoutExtModule(BaseTestUUID, unittest.TestCase):
+ uuid = py_uuid
+
++
+ @unittest.skipUnless(c_uuid, 'requires the C _uuid module')
+ class TestUUIDWithExtModule(BaseTestUUID, unittest.TestCase):
+ uuid = c_uuid
+
++ def check_has_stable_libuuid_extractable_node(self):
++ if not self.uuid._has_stable_extractable_node:
++ self.skipTest("libuuid cannot deduce MAC address")
++
++ @unittest.skipUnless(os.name == 'posix', 'POSIX only')
++ def test_unix_getnode_from_libuuid(self):
++ self.check_has_stable_libuuid_extractable_node()
++ script = 'import uuid; print(uuid._unix_getnode())'
++ _, n_a, _ = assert_python_ok('-c', script)
++ _, n_b, _ = assert_python_ok('-c', script)
++ n_a, n_b = n_a.decode().strip(), n_b.decode().strip()
++ self.assertTrue(n_a.isdigit())
++ self.assertTrue(n_b.isdigit())
++ self.assertEqual(n_a, n_b)
++
++ @unittest.skipUnless(os.name == 'nt', 'Windows only')
++ def test_windows_getnode_from_libuuid(self):
++ self.check_has_stable_libuuid_extractable_node()
++ script = 'import uuid; print(uuid._windll_getnode())'
++ _, n_a, _ = assert_python_ok('-c', script)
++ _, n_b, _ = assert_python_ok('-c', script)
++ n_a, n_b = n_a.decode().strip(), n_b.decode().strip()
++ self.assertTrue(n_a.isdigit())
++ self.assertTrue(n_b.isdigit())
++ self.assertEqual(n_a, n_b)
++
+
+ class BaseTestInternals:
+ _uuid = py_uuid
+diff --git a/Lib/uuid.py b/Lib/uuid.py
+index c286eac38e1ef4..6ab1658cc5249a 100644
+--- a/Lib/uuid.py
++++ b/Lib/uuid.py
+@@ -572,22 +572,24 @@ def _netstat_getnode():
+ try:
+ import _uuid
+ _generate_time_safe = getattr(_uuid, "generate_time_safe", None)
++ _has_stable_extractable_node = getattr(_uuid, "has_stable_extractable_node", False)
+ _UuidCreate = getattr(_uuid, "UuidCreate", None)
+ except ImportError:
+ _uuid = None
+ _generate_time_safe = None
++ _has_stable_extractable_node = False
+ _UuidCreate = None
+
+
+ def _unix_getnode():
+ """Get the hardware address on Unix using the _uuid extension module."""
+- if _generate_time_safe:
++ if _generate_time_safe and _has_stable_extractable_node:
+ uuid_time, _ = _generate_time_safe()
+ return UUID(bytes=uuid_time).node
+
+ def _windll_getnode():
+ """Get the hardware address on Windows using the _uuid extension module."""
+- if _UuidCreate:
++ if _UuidCreate and _has_stable_extractable_node:
+ uuid_bytes = _UuidCreate()
+ return UUID(bytes_le=uuid_bytes).node
+
+diff --git a/Modules/_uuidmodule.c b/Modules/_uuidmodule.c
+index c5e78b1510b5e3..c31a7e8fea5608 100644
+--- a/Modules/_uuidmodule.c
++++ b/Modules/_uuidmodule.c
+@@ -78,23 +78,47 @@ py_UuidCreate(PyObject *Py_UNUSED(context),
+ return NULL;
+ }
+
++static int
++py_windows_has_stable_node(void)
++{
++ UUID uuid;
++ RPC_STATUS res;
++ Py_BEGIN_ALLOW_THREADS
++ res = UuidCreateSequential(&uuid);
++ Py_END_ALLOW_THREADS
++ return res == RPC_S_OK;
++}
+ #endif /* MS_WINDOWS */
+
+
+ static int
+-uuid_exec(PyObject *module) {
++uuid_exec(PyObject *module)
++{
++#define ADD_INT(NAME, VALUE) \
++ do { \
++ if (PyModule_AddIntConstant(module, (NAME), (VALUE)) < 0) { \
++ return -1; \
++ } \
++ } while (0)
++
+ assert(sizeof(uuid_t) == 16);
+ #if defined(MS_WINDOWS)
+- int has_uuid_generate_time_safe = 0;
++ ADD_INT("has_uuid_generate_time_safe", 0);
+ #elif defined(HAVE_UUID_GENERATE_TIME_SAFE)
+- int has_uuid_generate_time_safe = 1;
++ ADD_INT("has_uuid_generate_time_safe", 1);
+ #else
+- int has_uuid_generate_time_safe = 0;
++ ADD_INT("has_uuid_generate_time_safe", 0);
+ #endif
+- if (PyModule_AddIntConstant(module, "has_uuid_generate_time_safe",
+- has_uuid_generate_time_safe) < 0) {
+- return -1;
+- }
++
++#if defined(MS_WINDOWS)
++ ADD_INT("has_stable_extractable_node", py_windows_has_stable_node());
++#elif defined(HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC)
++ ADD_INT("has_stable_extractable_node", 1);
++#else
++ ADD_INT("has_stable_extractable_node", 0);
++#endif
++
++#undef ADD_INT
+ return 0;
+ }
+
+diff --git a/configure b/configure
+index 1cd1f690f7b9c1..cc976aafc09b34 100755
+--- a/configure
++++ b/configure
+@@ -13381,6 +13381,7 @@ fi
+
+
+
++
+ have_uuid=missing
+
+ for ac_header in uuid.h
+@@ -13390,6 +13391,7 @@ if test "x$ac_cv_header_uuid_h" = xyes
+ then :
+ printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
+
++
+ for ac_func in uuid_create uuid_enc_be
+ do :
+ as_ac_var=`printf "%s\n" "ac_cv_func_$ac_func" | $as_tr_sh`
+@@ -13399,7 +13401,9 @@ then :
+ cat >>confdefs.h <<_ACEOF
+ #define `printf "%s\n" "HAVE_$ac_func" | $as_tr_cpp` 1
+ _ACEOF
+- have_uuid=yes
++
++ have_uuid=yes
++ ac_cv_have_uuid_h=yes
+ LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
+ LIBUUID_LIBS=${LIBUUID_LIBS-""}
+
+@@ -13489,6 +13493,7 @@ if test "x$ac_cv_header_uuid_uuid_h" = xyes
+ then :
+ printf "%s\n" "#define HAVE_UUID_UUID_H 1" >>confdefs.h
+
++ ac_cv_have_uuid_uuid_h=yes
+ py_check_lib_save_LIBS=$LIBS
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uuid_generate_time in -luuid" >&5
+ printf %s "checking for uuid_generate_time in -luuid... " >&6; }
+@@ -13570,8 +13575,9 @@ fi
+ printf "%s\n" "$ac_cv_lib_uuid_uuid_generate_time_safe" >&6; }
+ if test "x$ac_cv_lib_uuid_uuid_generate_time_safe" = xyes
+ then :
+- have_uuid=yes
+- printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
++
++ have_uuid=yes
++ ac_cv_have_uuid_generate_time_safe=yes
+
+ fi
+
+@@ -13615,6 +13621,7 @@ if test "x$ac_cv_header_uuid_uuid_h" = xyes
+ then :
+ printf "%s\n" "#define HAVE_UUID_UUID_H 1" >>confdefs.h
+
++ ac_cv_have_uuid_uuid_h=yes
+ py_check_lib_save_LIBS=$LIBS
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uuid_generate_time in -luuid" >&5
+ printf %s "checking for uuid_generate_time in -luuid... " >&6; }
+@@ -13696,8 +13703,9 @@ fi
+ printf "%s\n" "$ac_cv_lib_uuid_uuid_generate_time_safe" >&6; }
+ if test "x$ac_cv_lib_uuid_uuid_generate_time_safe" = xyes
+ then :
+- have_uuid=yes
+- printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
++
++ have_uuid=yes
++ ac_cv_have_uuid_generate_time_safe=yes
+
+ fi
+
+@@ -13727,11 +13735,25 @@ else
+ LIBUUID_LIBS=$pkg_cv_LIBUUID_LIBS
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+ printf "%s\n" "yes" >&6; }
++<<<<<<< HEAD
+ have_uuid=yes
+ printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
+
+ printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
+
++=======
++ have_uuid=yes
++ ac_cv_have_uuid_generate_time_safe=yes
++ # The uuid.h file to include may be *or* .
++ # Since pkg-config --cflags uuid may return -I/usr/include/uuid,
++ # it's possible to write '#include ' in _uuidmodule.c,
++ # assuming that the compiler flags are properly updated.
++ #
++ # Ideally, we should have defined HAVE_UUID_H if and only if
++ # #include can be written, *without* assuming extra
++ # include path.
++ ac_cv_have_uuid_h=yes
++>>>>>>> 3bffada4672 (gh-132710: only use stable `_uuid.generate_time_safe()` to deduce MAC address (#132901))
+
+ fi
+
+@@ -13752,6 +13774,7 @@ if test "x$ac_cv_func_uuid_generate_time" = xyes
+ then :
+
+ have_uuid=yes
++ ac_cv_have_uuid_uuid_h=yes
+ LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
+ LIBUUID_LIBS=${LIBUUID_LIBS-""}
+
+@@ -13764,11 +13787,198 @@ done
+
+ fi
+
++<<<<<<< HEAD
++=======
++if test "x$ac_cv_have_uuid_h" = xyes
++then :
++ printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
++
++fi
++if test "x$ac_cv_have_uuid_uuid_h" = xyes
++then :
++ printf "%s\n" "#define HAVE_UUID_UUID_H 1" >>confdefs.h
++
++fi
++if test "x$ac_cv_have_uuid_generate_time_safe" = xyes
++then :
++
++ printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
++
++
++fi
++
++# gh-124228: While the libuuid library is available on NetBSD, it supports only UUID version 4.
++# This restriction inhibits the proper generation of time-based UUIDs.
++if test "$ac_sys_system" = "NetBSD"; then
++ have_uuid=missing
++ printf "%s\n" "#define HAVE_UUID_H 0" >>confdefs.h
++
++fi
++
++>>>>>>> 3bffada4672 (gh-132710: only use stable `_uuid.generate_time_safe()` to deduce MAC address (#132901))
+ if test "x$have_uuid" = xmissing
+ then :
+ have_uuid=no
+ fi
+
++# gh-132710: The UUID node is fetched by using libuuid when possible
++# and cached. While the node is constant within the same process,
++# different interpreters may have different values as libuuid may
++# randomize the node value if the latter cannot be deduced.
++#
++# Consumers may define HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC
++# to indicate that libuuid is unstable and should not be relied
++# upon to deduce the MAC address.
++
++
++if test "$have_uuid" = "yes" -a "$HAVE_UUID_GENERATE_TIME_SAFE" = "1"
++then
++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if uuid_generate_time_safe() node value is stable" >&5
++printf %s "checking if uuid_generate_time_safe() node value is stable... " >&6; }
++ save_CFLAGS=$CFLAGS
++save_CPPFLAGS=$CPPFLAGS
++save_LDFLAGS=$LDFLAGS
++save_LIBS=$LIBS
++
++
++ # Be sure to add the extra include path if we used pkg-config
++ # as HAVE_UUID_H may be set even though is only reachable
++ # by adding extra -I flags.
++ #
++ # If the following script does not compile, we simply assume that
++ # libuuid is missing.
++ CFLAGS="$CFLAGS $LIBUUID_CFLAGS"
++ LIBS="$LIBS $LIBUUID_LIBS"
++ if test "$cross_compiling" = yes
++then :
++
++
++else case e in #(
++ e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++
++ #include // PRIu64
++ #include // uint64_t
++ #include // fopen(), fclose()
++
++ #ifdef HAVE_UUID_H
++ #include
++ #else
++ #include
++ #endif
++
++ #define ERR 1
++ int main(void) {
++ uuid_t uuid; // unsigned char[16]
++ (void)uuid_generate_time_safe(uuid);
++ uint64_t node = 0;
++ for (size_t i = 0; i < 6; i++) {
++ node |= (uint64_t)uuid[15 - i] << (8 * i);
++ }
++ FILE *fp = fopen("conftest.out", "w");
++ if (fp == NULL) {
++ return ERR;
++ }
++ int rc = fprintf(fp, "%" PRIu64 "\n", node) >= 0;
++ rc |= fclose(fp);
++ return rc == 0 ? 0 : ERR;
++ }
++_ACEOF
++if ac_fn_c_try_run "$LINENO"
++then :
++
++ py_cv_uuid_node1=`cat conftest.out`
++
++fi
++rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
++ conftest.$ac_objext conftest.beam conftest.$ac_ext ;;
++esac
++fi
++
++CFLAGS=$save_CFLAGS
++CPPFLAGS=$save_CPPFLAGS
++LDFLAGS=$save_LDFLAGS
++LIBS=$save_LIBS
++
++
++ save_CFLAGS=$CFLAGS
++save_CPPFLAGS=$CPPFLAGS
++save_LDFLAGS=$LDFLAGS
++save_LIBS=$LIBS
++
++
++ # Be sure to add the extra include path if we used pkg-config
++ # as HAVE_UUID_H may be set even though is only reachable
++ # by adding extra -I flags.
++ #
++ # If the following script does not compile, we simply assume that
++ # libuuid is missing.
++ CFLAGS="$CFLAGS $LIBUUID_CFLAGS"
++ LIBS="$LIBS $LIBUUID_LIBS"
++ if test "$cross_compiling" = yes
++then :
++
++
++else case e in #(
++ e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++
++ #include // PRIu64
++ #include // uint64_t
++ #include // fopen(), fclose()
++
++ #ifdef HAVE_UUID_H
++ #include
++ #else
++ #include
++ #endif
++
++ #define ERR 1
++ int main(void) {
++ uuid_t uuid; // unsigned char[16]
++ (void)uuid_generate_time_safe(uuid);
++ uint64_t node = 0;
++ for (size_t i = 0; i < 6; i++) {
++ node |= (uint64_t)uuid[15 - i] << (8 * i);
++ }
++ FILE *fp = fopen("conftest.out", "w");
++ if (fp == NULL) {
++ return ERR;
++ }
++ int rc = fprintf(fp, "%" PRIu64 "\n", node) >= 0;
++ rc |= fclose(fp);
++ return rc == 0 ? 0 : ERR;
++ }
++_ACEOF
++if ac_fn_c_try_run "$LINENO"
++then :
++
++ py_cv_uuid_node2=`cat conftest.out`
++
++fi
++rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
++ conftest.$ac_objext conftest.beam conftest.$ac_ext ;;
++esac
++fi
++
++CFLAGS=$save_CFLAGS
++CPPFLAGS=$save_CPPFLAGS
++LDFLAGS=$save_LDFLAGS
++LIBS=$save_LIBS
++
++
++ if test -n "$py_cv_uuid_node1" -a "$py_cv_uuid_node1" = "$py_cv_uuid_node2"
++ then
++ printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC 1" >>confdefs.h
++
++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: stable" >&5
++printf "%s\n" "stable" >&6; }
++ else
++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unstable" >&5
++printf "%s\n" "unstable" >&6; }
++ fi
++fi
++
+ # 'Real Time' functions on Solaris
+ # posix4 on Solaris 2.6
+ # pthread (first!) on Linux
+diff --git a/configure.ac b/configure.ac
+index 3fcb18922c5330..9898af7ffd5f25 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -3740,15 +3740,17 @@ dnl check for uuid dependencies
+ AH_TEMPLATE([HAVE_UUID_H], [Define to 1 if you have the header file.])
+ AH_TEMPLATE([HAVE_UUID_UUID_H], [Define to 1 if you have the header file.])
+ AH_TEMPLATE([HAVE_UUID_GENERATE_TIME_SAFE], [Define if uuid_generate_time_safe() exists.])
++AH_TEMPLATE([HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC], [Define if uuid_generate_time_safe() is able to deduce a MAC address.])
+ have_uuid=missing
+
+ dnl AIX provides support for RFC4122 (uuid) in libc.a starting with AIX 6.1
+ dnl (anno 2007). FreeBSD and OpenBSD provides support in libc as well.
+ dnl Little-endian FreeBSD, OpenBSD and NetBSD needs encoding into an octet
+ dnl stream in big-endian byte-order
+-AC_CHECK_HEADERS([uuid.h],
+- [AC_CHECK_FUNCS([uuid_create uuid_enc_be],
+- [have_uuid=yes
++AC_CHECK_HEADERS([uuid.h], [
++ AC_CHECK_FUNCS([uuid_create uuid_enc_be], [
++ have_uuid=yes
++ ac_cv_have_uuid_h=yes
+ LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
+ LIBUUID_LIBS=${LIBUUID_LIBS-""}
+ ])
+@@ -3758,19 +3760,29 @@ AS_VAR_IF([have_uuid], [missing], [
+ PKG_CHECK_MODULES(
+ [LIBUUID], [uuid >= 2.20],
+ [dnl linux-util's libuuid has uuid_generate_time_safe() since v2.20 (2011)
+- dnl and provides .
++ dnl and provides assuming specific include paths are given
+ have_uuid=yes
+- AC_DEFINE([HAVE_UUID_H], [1])
+- AC_DEFINE([HAVE_UUID_GENERATE_TIME_SAFE], [1])
++ ac_cv_have_uuid_generate_time_safe=yes
++ # The uuid.h file to include may be *or* .
++ # Since pkg-config --cflags uuid may return -I/usr/include/uuid,
++ # it's possible to write '#include ' in _uuidmodule.c,
++ # assuming that the compiler flags are properly updated.
++ #
++ # Ideally, we should have defined HAVE_UUID_H if and only if
++ # #include can be written, *without* assuming extra
++ # include path.
++ ac_cv_have_uuid_h=yes
+ ], [
+ WITH_SAVE_ENV([
+ CPPFLAGS="$CPPFLAGS $LIBUUID_CFLAGS"
+ LIBS="$LIBS $LIBUUID_LIBS"
+ AC_CHECK_HEADERS([uuid/uuid.h], [
++ ac_cv_have_uuid_uuid_h=yes
+ PY_CHECK_LIB([uuid], [uuid_generate_time], [have_uuid=yes])
+- PY_CHECK_LIB([uuid], [uuid_generate_time_safe],
+- [have_uuid=yes
+- AC_DEFINE([HAVE_UUID_GENERATE_TIME_SAFE], [1]) ]) ])
++ PY_CHECK_LIB([uuid], [uuid_generate_time_safe], [
++ have_uuid=yes
++ ac_cv_have_uuid_generate_time_safe=yes
++ ])])
+ AS_VAR_IF([have_uuid], [yes], [
+ LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
+ LIBUUID_LIBS=${LIBUUID_LIBS-"-luuid"}
+@@ -3785,14 +3797,90 @@ AS_VAR_IF([have_uuid], [missing], [
+ AC_CHECK_HEADERS([uuid/uuid.h], [
+ AC_CHECK_FUNC([uuid_generate_time], [
+ have_uuid=yes
++ ac_cv_have_uuid_uuid_h=yes
+ LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
+ LIBUUID_LIBS=${LIBUUID_LIBS-""}
+ ])
+ ])
+ ])
+
++AS_VAR_IF([ac_cv_have_uuid_h], [yes], [AC_DEFINE([HAVE_UUID_H], [1])])
++AS_VAR_IF([ac_cv_have_uuid_uuid_h], [yes], [AC_DEFINE([HAVE_UUID_UUID_H], [1])])
++AS_VAR_IF([ac_cv_have_uuid_generate_time_safe], [yes], [
++ AC_DEFINE([HAVE_UUID_GENERATE_TIME_SAFE], [1])
++])
++
++# gh-124228: While the libuuid library is available on NetBSD, it supports only UUID version 4.
++# This restriction inhibits the proper generation of time-based UUIDs.
++if test "$ac_sys_system" = "NetBSD"; then
++ have_uuid=missing
++ AC_DEFINE([HAVE_UUID_H], [0])
++fi
++
+ AS_VAR_IF([have_uuid], [missing], [have_uuid=no])
+
++# gh-132710: The UUID node is fetched by using libuuid when possible
++# and cached. While the node is constant within the same process,
++# different interpreters may have different values as libuuid may
++# randomize the node value if the latter cannot be deduced.
++#
++# Consumers may define HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC
++# to indicate that libuuid is unstable and should not be relied
++# upon to deduce the MAC address.
++AC_DEFUN([PY_EXTRACT_UUID_GENERATE_TIME_SAFE_MAC], [WITH_SAVE_ENV([
++ # Be sure to add the extra include path if we used pkg-config
++ # as HAVE_UUID_H may be set even though is only reachable
++ # by adding extra -I flags.
++ #
++ # If the following script does not compile, we simply assume that
++ # libuuid is missing.
++ CFLAGS="$CFLAGS $LIBUUID_CFLAGS"
++ LIBS="$LIBS $LIBUUID_LIBS"
++ AC_RUN_IFELSE([AC_LANG_SOURCE([[
++ #include // PRIu64
++ #include // uint64_t
++ #include // fopen(), fclose()
++
++ #ifdef HAVE_UUID_H
++ #include
++ #else
++ #include
++ #endif
++
++ #define ERR 1
++ int main(void) {
++ uuid_t uuid; // unsigned char[16]
++ (void)uuid_generate_time_safe(uuid);
++ uint64_t node = 0;
++ for (size_t i = 0; i < 6; i++) {
++ node |= (uint64_t)uuid[15 - i] << (8 * i);
++ }
++ FILE *fp = fopen("conftest.out", "w");
++ if (fp == NULL) {
++ return ERR;
++ }
++ int rc = fprintf(fp, "%" PRIu64 "\n", node) >= 0;
++ rc |= fclose(fp);
++ return rc == 0 ? 0 : ERR;
++ }]])], [
++ AS_VAR_SET([$1], [`cat conftest.out`])
++ ], [], []
++ )])])
++
++if test "$have_uuid" = "yes" -a "$HAVE_UUID_GENERATE_TIME_SAFE" = "1"
++then
++ AC_MSG_CHECKING([if uuid_generate_time_safe() node value is stable])
++ PY_EXTRACT_UUID_GENERATE_TIME_SAFE_MAC([py_cv_uuid_node1])
++ PY_EXTRACT_UUID_GENERATE_TIME_SAFE_MAC([py_cv_uuid_node2])
++ if test -n "$py_cv_uuid_node1" -a "$py_cv_uuid_node1" = "$py_cv_uuid_node2"
++ then
++ AC_DEFINE([HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC], [1])
++ AC_MSG_RESULT([stable])
++ else
++ AC_MSG_RESULT([unstable])
++ fi
++fi
++
+ # 'Real Time' functions on Solaris
+ # posix4 on Solaris 2.6
+ # pthread (first!) on Linux
+diff --git a/pyconfig.h.in b/pyconfig.h.in
+index 3c16c694c84599..73358a0f35ae82 100644
+--- a/pyconfig.h.in
++++ b/pyconfig.h.in
+@@ -1548,6 +1548,9 @@
+ /* Define if uuid_generate_time_safe() exists. */
+ #undef HAVE_UUID_GENERATE_TIME_SAFE
+
++/* Define if uuid_generate_time_safe() is able to deduce a MAC address. */
++#undef HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC
++
+ /* Define to 1 if you have the header file. */
+ #undef HAVE_UUID_H
+
+
+From cb0f32a7d64b6dc4a63c4a683bb52a97ebe1d78a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
+ <10796600+picnixz@users.noreply.github.com>
+Date: Mon, 26 May 2025 12:34:00 +0200
+Subject: [PATCH 2/2] rgen
+
+---
+ configure | 25 ++++++-------------------
+ 1 file changed, 6 insertions(+), 19 deletions(-)
+
+diff --git a/configure b/configure
+index cc976aafc09b34..47e4f29e23a7ac 100755
+--- a/configure
++++ b/configure
+@@ -13735,14 +13735,7 @@ else
+ LIBUUID_LIBS=$pkg_cv_LIBUUID_LIBS
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+ printf "%s\n" "yes" >&6; }
+-<<<<<<< HEAD
+ have_uuid=yes
+- printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
+-
+- printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
+-
+-=======
+- have_uuid=yes
+ ac_cv_have_uuid_generate_time_safe=yes
+ # The uuid.h file to include may be *or* .
+ # Since pkg-config --cflags uuid may return -I/usr/include/uuid,
+@@ -13753,7 +13746,6 @@ printf "%s\n" "yes" >&6; }
+ # #include can be written, *without* assuming extra
+ # include path.
+ ac_cv_have_uuid_h=yes
+->>>>>>> 3bffada4672 (gh-132710: only use stable `_uuid.generate_time_safe()` to deduce MAC address (#132901))
+
+ fi
+
+@@ -13787,8 +13779,6 @@ done
+
+ fi
+
+-<<<<<<< HEAD
+-=======
+ if test "x$ac_cv_have_uuid_h" = xyes
+ then :
+ printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
+@@ -13815,7 +13805,6 @@ if test "$ac_sys_system" = "NetBSD"; then
+
+ fi
+
+->>>>>>> 3bffada4672 (gh-132710: only use stable `_uuid.generate_time_safe()` to deduce MAC address (#132901))
+ if test "x$have_uuid" = xmissing
+ then :
+ have_uuid=no
+@@ -13853,8 +13842,8 @@ save_LIBS=$LIBS
+ then :
+
+
+-else case e in #(
+- e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++else $as_nop
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+
+ #include // PRIu64
+@@ -13891,8 +13880,7 @@ then :
+
+ fi
+ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+- conftest.$ac_objext conftest.beam conftest.$ac_ext ;;
+-esac
++ conftest.$ac_objext conftest.beam conftest.$ac_ext
+ fi
+
+ CFLAGS=$save_CFLAGS
+@@ -13919,8 +13907,8 @@ save_LIBS=$LIBS
+ then :
+
+
+-else case e in #(
+- e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++else $as_nop
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+
+ #include // PRIu64
+@@ -13957,8 +13945,7 @@ then :
+
+ fi
+ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+- conftest.$ac_objext conftest.beam conftest.$ac_ext ;;
+-esac
++ conftest.$ac_objext conftest.beam conftest.$ac_ext
+ fi
+
+ CFLAGS=$save_CFLAGS
From 9edbb9d744adbbcc576c75387d10984464c05b0c Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Mon, 9 Jun 2025 12:49:10 -0500
Subject: [PATCH 007/231] Do not apply getnode patch for 3.13 on 3.14 (#649)
---
cpython-unix/build-cpython.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index a77d67150..820b6a2de 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -79,7 +79,7 @@ fi
# `uuid.getnode()` is not stable on our libuuid, CPython should fallback to another method
# Cherry-pick https://github.com/python/cpython/pull/134704 until it is released
# We could backport this to more versions too, it won't be done by the upstream
-if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" && -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_14}" ]]; then
+if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" && -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_13}" ]]; then
patch -p1 -i ${ROOT}/patch-uuid-getnode-stable-3.13.patch
fi
From 3228db3b1394bd2665548e105706eddc4eb772ad Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 10 Jun 2025 13:48:54 -0500
Subject: [PATCH 008/231] Bump the python group across 1 directory with 4
updates (#650)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the python group with 4 updates in the / directory:
[requests](https://github.com/psf/requests),
[mypy](https://github.com/python/mypy),
[ruff](https://github.com/astral-sh/ruff) and
[types-jsonschema](https://github.com/typeshed-internal/stub_uploader).
Updates `requests` from 2.32.3 to 2.32.4
Release notes
Sourced from requests's
releases.
v2.32.4
2.32.4 (2025-06-10)
Security
- CVE-2024-47081 Fixed an issue where a maliciously crafted URL and
trusted
environment will retrieve credentials for the wrong hostname/machine
from a
netrc file. (#6965)
Improvements
- Numerous documentation improvements
Deprecations
- Added support for pypy 3.11 for Linux and macOS. (#6926)
- Dropped support for pypy 3.9 following its end of support. (#6926)
Changelog
Sourced from requests's
changelog.
2.32.4 (2025-06-10)
Security
- CVE-2024-47081 Fixed an issue where a maliciously crafted URL and
trusted
environment will retrieve credentials for the wrong hostname/machine
from a
netrc file.
Improvements
- Numerous documentation improvements
Deprecations
- Added support for pypy 3.11 for Linux and macOS.
- Dropped support for pypy 3.9 following its end of support.
Commits
021dc72
Polish up release tooling for last manual release
821770e
Bump version and add release notes for v2.32.4
59f8aa2
Add netrc file search information to authentication documentation (#6876)
5b4b64c
Add more tests to prevent regression of CVE 2024 47081
7bc4587
Add new test to check netrc auth leak (#6962)
96ba401
Only use hostname to do netrc lookup instead of netloc
7341690
Merge pull request #6951
from tswast/patch-1
6716d7c
remove links
a7e1c74
Update docs/conf.py
c799b81
docs: fix dead links to kenreitz.org
- Additional commits viewable in compare
view
Updates `mypy` from 1.15.0 to 1.16.0
Changelog
Sourced from mypy's
changelog.
Mypy Release Notes
Next Release
Remove Support for targeting Python 3.8
Mypy now requires --python-version 3.9 or greater.
Support for only Python 3.8 is
fully removed now. Given an unsupported version, mypy will default to
the oldest
supported one, currently 3.9.
This change is necessary because typeshed stopped supporting Python
3.8 after it
reached its End of Life in October 2024.
Contributed by Marc Mueller
(PR 19157, PR
19162).
Initial Support for Python 3.14
Mypy is now tested on 3.14 and mypyc works with 3.14.0b3 and later.
Mypyc compiled wheels of mypy itself will be available for new versions
after 3.14.0rc1 is released.
Note that not all new features might be supported just yet.
Contributed by Marc Mueller (PR 19164)
Deprecated Flag: --force-uppercase-builtins
Mypy only supports Python 3.9+. The --force-uppercase-builtins flag
is now deprecated and a no-op. It will be removed in a future
version.
Contributed by Marc Mueller (PR 19176)
Mypy 1.16
We’ve just uploaded mypy 1.16 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new
features and bug fixes.
You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.
Different Property Getter and Setter Types
Mypy now supports using different types for a property getter and
setter:
class A:
_value: int
@property
</tr></table>
... (truncated)
Commits
9e72e96
Update version to 1.16.0
8fe719f
Add changelog for 1.16 (#19138)
2a036e7
Revert "Infer correct types with overloads of Type[Guard |
Is] (#19161)
b6da4fc
Allow enum members to have type objects as values (#19160)
334469f
[mypyc] Improve documentation of native and non-native classes (#19154)
a499d9f
Document --allow-redefinition-new (#19153)
96525a2
Merge commit '9e45dadcf6d8dbab36f83d9df94a706c0b4f9207' into
release-1.16
9e45dad
Clear more data in TypeChecker.reset() instead of asserting (#19087)
772cd0c
Add --strict-bytes to --strict (#19049)
0b65f21
Admit that Final variables are never redefined (#19083)
- Additional commits viewable in compare
view
Updates `ruff` from 0.11.11 to 0.11.13
Release notes
Sourced from ruff's
releases.
0.11.13
Release Notes
Preview features
- [
airflow] Add unsafe fix for module moved cases
(AIR301,AIR311,AIR312,AIR302)
(#18367,#18366,#18363,#18093)
- [
refurb] Add coverage of set and
frozenset calls (FURB171) (#18035)
- [
refurb] Mark FURB180 fix unsafe when
class has bases (#18149)
Bug fixes
- [
perflint] Fix missing parentheses for lambda and
ternary conditions (PERF401, PERF403) (#18412)
- [
pyupgrade] Apply UP035 only on py313+ for
get_type_hints() (#18476)
- [
pyupgrade] Make fix unsafe if it deletes comments
(UP004,UP050) (#18393,
#18390)
Rule changes
- [
fastapi] Avoid false positive for class dependencies
(FAST003) (#18271)
Documentation
- Update editor setup docs for Neovim and Vim (#18324)
Other changes
- Support Python 3.14 template strings (t-strings) in formatter and
parser (#17851)
Contributors
... (truncated)
Changelog
Sourced from ruff's
changelog.
0.11.13
Preview features
- [
airflow] Add unsafe fix for module moved cases
(AIR301,AIR311,AIR312,AIR302)
(#18367,#18366,#18363,#18093)
- [
refurb] Add coverage of set and
frozenset calls (FURB171) (#18035)
- [
refurb] Mark FURB180 fix unsafe when
class has bases (#18149)
Bug fixes
- [
perflint] Fix missing parentheses for lambda and
ternary conditions (PERF401, PERF403) (#18412)
- [
pyupgrade] Apply UP035 only on py313+ for
get_type_hints() (#18476)
- [
pyupgrade] Make fix unsafe if it deletes comments
(UP004,UP050) (#18393,
#18390)
Rule changes
- [
fastapi] Avoid false positive for class dependencies
(FAST003) (#18271)
Documentation
- Update editor setup docs for Neovim and Vim (#18324)
Other changes
- Support Python 3.14 template strings (t-strings) in formatter and
parser (#17851)
0.11.12
Preview features
- [
airflow] Revise fix titles (AIR3) (#18215)
- [
pylint] Implement missing-maxsplit-arg
(PLC0207) (#17454)
- [
pyupgrade] New rule UP050
(useless-class-metaclass-type) (#18334)
- [
flake8-use-pathlib] Replace os.symlink
with Path.symlink_to (PTH211) (#18337)
Bug fixes
- [
flake8-bugbear] Ignore __debug__
attribute in B010 (#18357)
- [
flake8-async] Fix anyio.sleep argument
name (ASYNC115, ASYNC116) (#18262)
- [
refurb] Fix FURB129 autofix generating
invalid syntax (#18235)
Rule changes
- [
flake8-implicit-str-concat] Add autofix for
ISC003 (#18256)
- [
pycodestyle] Improve the diagnostic message for
E712 (#18328)
- [
flake8-2020] Fix diagnostic message for
!= comparisons (YTT201) (#18293)
- [
pyupgrade] Make fix unsafe if it deletes comments
(UP010) (#18291)
Documentation
... (truncated)
Commits
5faf72a
Bump 0.11.13 (#18484)
28dbc5c
[ty] Fix completion order in playground (#18480)
ce216c7
Remove Message::to_rule (#18447)
33468cc
[pyupgrade] Apply UP035 only on py313+ for
get_type_hints() (#18476)
8531f4b
[ty] Add infrastructure for AST garbage collection (#18445)
5510020
[ty] IDE: add support for object.\<CURSOR>
completions (#18468)
c0bb83b
[perflint] fix missing parentheses for lambda and ternary
conditions (PERF4...
74a4e9a
Combine lint and syntax error handling (#18471)
8485dbb
[ty] Fix --python argument for Windows, and improve error
messages for bad ...
0858896
[ty] type narrowing by attribute/subscript assignments (#18041)
- Additional commits viewable in compare
view
Updates `types-jsonschema` from 4.23.0.20250516 to 4.24.0.20250528
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
requirements.dev.txt | 114 ++++++++++++++++++++++---------------------
requirements.win.txt | 6 +--
2 files changed, 62 insertions(+), 58 deletions(-)
diff --git a/requirements.dev.txt b/requirements.dev.txt
index 9cb9cd6bd..68171eb5d 100644
--- a/requirements.dev.txt
+++ b/requirements.dev.txt
@@ -198,44 +198,48 @@ markupsafe==3.0.2 \
# via
# -r requirements.txt
# jinja2
-mypy==1.15.0 \
- --hash=sha256:1124a18bc11a6a62887e3e137f37f53fbae476dc36c185d549d4f837a2a6a14e \
- --hash=sha256:171a9ca9a40cd1843abeca0e405bc1940cd9b305eaeea2dda769ba096932bb22 \
- --hash=sha256:1905f494bfd7d85a23a88c5d97840888a7bd516545fc5aaedff0267e0bb54e2f \
- --hash=sha256:1fbb8da62dc352133d7d7ca90ed2fb0e9d42bb1a32724c287d3c76c58cbaa9c2 \
- --hash=sha256:2922d42e16d6de288022e5ca321cd0618b238cfc5570e0263e5ba0a77dbef56f \
- --hash=sha256:2e2c2e6d3593f6451b18588848e66260ff62ccca522dd231cd4dd59b0160668b \
- --hash=sha256:2ee2d57e01a7c35de00f4634ba1bbf015185b219e4dc5909e281016df43f5ee5 \
- --hash=sha256:2f2147ab812b75e5b5499b01ade1f4a81489a147c01585cda36019102538615f \
- --hash=sha256:404534629d51d3efea5c800ee7c42b72a6554d6c400e6a79eafe15d11341fd43 \
- --hash=sha256:5469affef548bd1895d86d3bf10ce2b44e33d86923c29e4d675b3e323437ea3e \
- --hash=sha256:5a95fb17c13e29d2d5195869262f8125dfdb5c134dc8d9a9d0aecf7525b10c2c \
- --hash=sha256:6983aae8b2f653e098edb77f893f7b6aca69f6cffb19b2cc7443f23cce5f4828 \
- --hash=sha256:712e962a6357634fef20412699a3655c610110e01cdaa6180acec7fc9f8513ba \
- --hash=sha256:8023ff13985661b50a5928fc7a5ca15f3d1affb41e5f0a9952cb68ef090b31ee \
- --hash=sha256:811aeccadfb730024c5d3e326b2fbe9249bb7413553f15499a4050f7c30e801d \
- --hash=sha256:8f8722560a14cde92fdb1e31597760dc35f9f5524cce17836c0d22841830fd5b \
- --hash=sha256:93faf3fdb04768d44bf28693293f3904bbb555d076b781ad2530214ee53e3445 \
- --hash=sha256:973500e0774b85d9689715feeffcc980193086551110fd678ebe1f4342fb7c5e \
- --hash=sha256:979e4e1a006511dacf628e36fadfecbcc0160a8af6ca7dad2f5025529e082c13 \
- --hash=sha256:98b7b9b9aedb65fe628c62a6dc57f6d5088ef2dfca37903a7d9ee374d03acca5 \
- --hash=sha256:aea39e0583d05124836ea645f412e88a5c7d0fd77a6d694b60d9b6b2d9f184fd \
- --hash=sha256:b9378e2c00146c44793c98b8d5a61039a048e31f429fb0eb546d93f4b000bedf \
- --hash=sha256:baefc32840a9f00babd83251560e0ae1573e2f9d1b067719479bfb0e987c6357 \
- --hash=sha256:be68172e9fd9ad8fb876c6389f16d1c1b5f100ffa779f77b1fb2176fcc9ab95b \
- --hash=sha256:c43a7682e24b4f576d93072216bf56eeff70d9140241f9edec0c104d0c515036 \
- --hash=sha256:c4bb0e1bd29f7d34efcccd71cf733580191e9a264a2202b0239da95984c5b559 \
- --hash=sha256:c7be1e46525adfa0d97681432ee9fcd61a3964c2446795714699a998d193f1a3 \
- --hash=sha256:c9817fa23833ff189db061e6d2eff49b2f3b6ed9856b4a0a73046e41932d744f \
- --hash=sha256:ce436f4c6d218a070048ed6a44c0bbb10cd2cc5e272b29e7845f6a2f57ee4464 \
- --hash=sha256:d10d994b41fb3497719bbf866f227b3489048ea4bbbb5015357db306249f7980 \
- --hash=sha256:e601a7fa172c2131bff456bb3ee08a88360760d0d2f8cbd7a75a65497e2df078 \
- --hash=sha256:f95579473af29ab73a10bada2f9722856792a36ec5af5399b653aa28360290a5
+mypy==1.16.0 \
+ --hash=sha256:021a68568082c5b36e977d54e8f1de978baf401a33884ffcea09bd8e88a98f4c \
+ --hash=sha256:089bedc02307c2548eb51f426e085546db1fa7dd87fbb7c9fa561575cf6eb1ff \
+ --hash=sha256:09a8da6a0ee9a9770b8ff61b39c0bb07971cda90e7297f4213741b48a0cc8d93 \
+ --hash=sha256:0b07e107affb9ee6ce1f342c07f51552d126c32cd62955f59a7db94a51ad12c0 \
+ --hash=sha256:15486beea80be24ff067d7d0ede673b001d0d684d0095803b3e6e17a886a2a92 \
+ --hash=sha256:29e1499864a3888bca5c1542f2d7232c6e586295183320caa95758fc84034031 \
+ --hash=sha256:2e7e0ad35275e02797323a5aa1be0b14a4d03ffdb2e5f2b0489fa07b89c67b21 \
+ --hash=sha256:4086883a73166631307fdd330c4a9080ce24913d4f4c5ec596c601b3a4bdd777 \
+ --hash=sha256:54066fed302d83bf5128632d05b4ec68412e1f03ef2c300434057d66866cea4b \
+ --hash=sha256:55f9076c6ce55dd3f8cd0c6fff26a008ca8e5131b89d5ba6d86bd3f47e736eeb \
+ --hash=sha256:6a2322896003ba66bbd1318c10d3afdfe24e78ef12ea10e2acd985e9d684a666 \
+ --hash=sha256:7909541fef256527e5ee9c0a7e2aeed78b6cda72ba44298d1334fe7881b05c5c \
+ --hash=sha256:82d056e6faa508501af333a6af192c700b33e15865bda49611e3d7d8358ebea2 \
+ --hash=sha256:84b94283f817e2aa6350a14b4a8fb2a35a53c286f97c9d30f53b63620e7af8ab \
+ --hash=sha256:936ccfdd749af4766be824268bfe22d1db9eb2f34a3ea1d00ffbe5b5265f5491 \
+ --hash=sha256:9f826aaa7ff8443bac6a494cf743f591488ea940dd360e7dd330e30dd772a5ab \
+ --hash=sha256:a5fcfdb7318c6a8dd127b14b1052743b83e97a970f0edb6c913211507a255e20 \
+ --hash=sha256:a7e32297a437cc915599e0578fa6bc68ae6a8dc059c9e009c628e1c47f91495d \
+ --hash=sha256:a9e056237c89f1587a3be1a3a70a06a698d25e2479b9a2f57325ddaaffc3567b \
+ --hash=sha256:afe420c9380ccec31e744e8baff0d406c846683681025db3531b32db56962d52 \
+ --hash=sha256:b4968f14f44c62e2ec4a038c8797a87315be8df7740dc3ee8d3bfe1c6bf5dba8 \
+ --hash=sha256:bd4e1ebe126152a7bbaa4daedd781c90c8f9643c79b9748caa270ad542f12bec \
+ --hash=sha256:c5436d11e89a3ad16ce8afe752f0f373ae9620841c50883dc96f8b8805620b13 \
+ --hash=sha256:c6fb60cbd85dc65d4d63d37cb5c86f4e3a301ec605f606ae3a9173e5cf34997b \
+ --hash=sha256:d045d33c284e10a038f5e29faca055b90eee87da3fc63b8889085744ebabb5a1 \
+ --hash=sha256:e71d6f0090c2256c713ed3d52711d01859c82608b5d68d4fa01a3fe30df95571 \
+ --hash=sha256:eb14a4a871bb8efb1e4a50360d4e3c8d6c601e7a31028a2c79f9bb659b63d730 \
+ --hash=sha256:eb5fbc8063cb4fde7787e4c0406aa63094a34a2daf4673f359a1fb64050e9cb2 \
+ --hash=sha256:f2622af30bf01d8fc36466231bdd203d120d7a599a6d88fb22bdcb9dbff84090 \
+ --hash=sha256:f2ed0e0847a80655afa2c121835b848ed101cc7b8d8d6ecc5205aedc732b1436 \
+ --hash=sha256:f56236114c425620875c7cf71700e3d60004858da856c6fc78998ffe767b73d3 \
+ --hash=sha256:feec38097f71797da0231997e0de3a58108c51845399669ebc532c815f93866b
# via -r requirements.dev.in
mypy-extensions==1.0.0 \
--hash=sha256:4392f6c0eb8a5668a69e23d168ffa70f0be9ccfd32b5cc2d26a34ae5b844552d \
--hash=sha256:75dbf8955dc00442a438fc4d0666508a9a97b6bd41aa2f0ffe9d2f2725af0782
# via mypy
+pathspec==0.12.1 \
+ --hash=sha256:a0d503e138a4c123b27490a4f7beda6a01c6f288df0e4a8b79c7eb0dc7b4cc08 \
+ --hash=sha256:a482d51503a1ab33b1c67a6c3813a26953dbdc71c31dacaef9a838c4e29f5712
+ # via mypy
pyyaml==6.0.2 \
--hash=sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff \
--hash=sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48 \
@@ -413,25 +417,25 @@ rpds-py==0.22.3 \
# -r requirements.txt
# jsonschema
# referencing
-ruff==0.11.11 \
- --hash=sha256:1adcb9a18802268aaa891ffb67b1c94cd70578f126637118e8099b8e4adcf112 \
- --hash=sha256:1b5ab797fcc09121ed82e9b12b6f27e34859e4227080a42d090881be888755d4 \
- --hash=sha256:6224076c344a7694c6fbbb70d4f2a7b730f6d47d2a9dc1e7f9d9bb583faf390b \
- --hash=sha256:64ac6f885e3ecb2fdbb71de2701d4e34526651f1e8503af8fb30d4915a3fe345 \
- --hash=sha256:6c51f136c0364ab1b774767aa8b86331bd8e9d414e2d107db7a2189f35ea1f7b \
- --hash=sha256:748b4bb245f11e91a04a4ff0f96e386711df0a30412b9fe0c74d5bdc0e4a531f \
- --hash=sha256:7774173cc7c1980e6bf67569ebb7085989a78a103922fb83ef3dfe230cd0687d \
- --hash=sha256:7885d9a5e4c77b24e8c88aba8c80be9255fa22ab326019dac2356cff42089fc6 \
- --hash=sha256:882821fcdf7ae8db7a951df1903d9cb032bbe838852e5fc3c2b6c3ab54e39875 \
- --hash=sha256:9263f9e5aa4ff1dec765e99810f1cc53f0c868c5329b69f13845f699fe74f639 \
- --hash=sha256:9924e5ae54125ed8958a4f7de320dab7380f6e9fa3195e3dc3b137c6842a0092 \
- --hash=sha256:99c28505ecbaeb6594701a74e395b187ee083ee26478c1a795d35084d53ebd81 \
- --hash=sha256:a97c9babe1d4081037a90289986925726b802d180cca784ac8da2bbbc335f709 \
- --hash=sha256:c8a93276393d91e952f790148eb226658dd275cddfde96c6ca304873f11d2ae4 \
- --hash=sha256:d6e333dbe2e6ae84cdedefa943dfd6434753ad321764fd937eef9d6b62022bcd \
- --hash=sha256:d8c4ddcbe8a19f59f57fd814b8b117d4fcea9bee7c0492e6cf5fdc22cfa563c8 \
- --hash=sha256:dcec2d50756463d9df075a26a85a6affbc1b0148873da3997286caf1ce03cae1 \
- --hash=sha256:e231ff3132c1119ece836487a02785f099a43992b95c2f62847d29bace3c75ac
+ruff==0.11.13 \
+ --hash=sha256:1808b3ed53e1a777c2ef733aca9051dc9bf7c99b26ece15cb59a0320fbdbd629 \
+ --hash=sha256:26816a218ca6ef02142343fd24c70f7cd8c5aa6c203bca284407adf675984432 \
+ --hash=sha256:26fa247dc68d1d4e72c179e08889a25ac0c7ba4d78aecfc835d49cbfd60bf514 \
+ --hash=sha256:29c3189895a8a6a657b7af4e97d330c8a3afd2c9c8f46c81e2fc5a31866517e3 \
+ --hash=sha256:4a9ddd3ec62a9a89578c85842b836e4ac832d4a2e0bfaad3b02243f930ceafcc \
+ --hash=sha256:4bdfbf1240533f40042ec00c9e09a3aade6f8c10b6414cf11b519488d2635d46 \
+ --hash=sha256:4ffbc82d70424b275b089166310448051afdc6e914fdab90e08df66c43bb5ca9 \
+ --hash=sha256:51c3f95abd9331dc5b87c47ac7f376db5616041173826dfd556cfe3d4977f492 \
+ --hash=sha256:53b15a9dfdce029c842e9a5aebc3855e9ab7771395979ff85b7c1dedb53ddc2b \
+ --hash=sha256:55e4bc3a77842da33c16d55b32c6cac1ec5fb0fbec9c8c513bdce76c4f922165 \
+ --hash=sha256:633bf2c6f35678c56ec73189ba6fa19ff1c5e4807a78bf60ef487b9dd272cc71 \
+ --hash=sha256:6c51f93029d54a910d3d24f7dd0bb909e31b6cd989a5e4ac513f4eb41629f0dc \
+ --hash=sha256:96c27935418e4e8e77a26bb05962817f28b8ef3843a6c6cc49d8783b5507f250 \
+ --hash=sha256:ab153241400789138d13f362c43f7edecc0edfffce2afa6a68434000ecd8f69a \
+ --hash=sha256:aef9c9ed1b5ca28bb15c7eac83b8670cf3b20b478195bd49c8d756ba0a36cf48 \
+ --hash=sha256:b4385285e9179d608ff1d2fb9922062663c658605819a6876d8beef0c30b7f3b \
+ --hash=sha256:d237a496e0778d719efb05058c64d28b757c77824e04ffe8796c7436e26712b7 \
+ --hash=sha256:d28ce58b5ecf0f43c1b71edffabe6ed7f245d5336b17805803312ec9bc665933
# via -r requirements.dev.in
six==1.17.0 \
--hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
@@ -477,9 +481,9 @@ types-jinja2==2.11.9 \
--hash=sha256:60a1e21e8296979db32f9374d8a239af4cb541ff66447bb915d8ad398f9c63b2 \
--hash=sha256:dbdc74a40aba7aed520b7e4d89e8f0fe4286518494208b35123bcf084d4b8c81
# via -r requirements.dev.in
-types-jsonschema==4.23.0.20250516 \
- --hash=sha256:9ace09d9d35c4390a7251ccd7d833b92ccc189d24d1b347f26212afce361117e \
- --hash=sha256:e7d0dd7db7e59e63c26e3230e26ffc64c4704cc5170dc21270b366a35ead1618
+types-jsonschema==4.24.0.20250528 \
+ --hash=sha256:6a906b5ff73ac11c8d1e0b6c30a9693e1e4e1ab56c56c932b3a7e081b86d187b \
+ --hash=sha256:7e28c64e0ae7980eeb158105b20663fc6a6b8f81d5f86ea6614aa0014417bd1e
# via -r requirements.dev.in
types-markupsafe==1.1.10 \
--hash=sha256:85b3a872683d02aea3a5ac2a8ef590193c344092032f58457287fbf8e06711b1 \
diff --git a/requirements.win.txt b/requirements.win.txt
index 222620eb8..d37a96ff4 100644
--- a/requirements.win.txt
+++ b/requirements.win.txt
@@ -264,9 +264,9 @@ referencing==0.36.2 \
# via
# jsonschema
# jsonschema-specifications
-requests==2.32.3 \
- --hash=sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760 \
- --hash=sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6
+requests==2.32.4 \
+ --hash=sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c \
+ --hash=sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422
# via docker
rpds-py==0.25.1 \
--hash=sha256:0317177b1e8691ab5879f4f33f4b6dc55ad3b344399e23df2e499de7b10a548d \
From 383aa562ca1e32a58811a104284e75db1d411870 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 10 Jun 2025 13:49:05 -0500
Subject: [PATCH 009/231] Bump requests from 2.32.3 to 2.32.4 (#651)
Bumps [requests](https://github.com/psf/requests) from 2.32.3 to 2.32.4.
Release notes
Sourced from requests's
releases.
v2.32.4
2.32.4 (2025-06-10)
Security
- CVE-2024-47081 Fixed an issue where a maliciously crafted URL and
trusted
environment will retrieve credentials for the wrong hostname/machine
from a
netrc file. (#6965)
Improvements
- Numerous documentation improvements
Deprecations
- Added support for pypy 3.11 for Linux and macOS. (#6926)
- Dropped support for pypy 3.9 following its end of support. (#6926)
Changelog
Sourced from requests's
changelog.
2.32.4 (2025-06-10)
Security
- CVE-2024-47081 Fixed an issue where a maliciously crafted URL and
trusted
environment will retrieve credentials for the wrong hostname/machine
from a
netrc file.
Improvements
- Numerous documentation improvements
Deprecations
- Added support for pypy 3.11 for Linux and macOS.
- Dropped support for pypy 3.9 following its end of support.
Commits
021dc72
Polish up release tooling for last manual release
821770e
Bump version and add release notes for v2.32.4
59f8aa2
Add netrc file search information to authentication documentation (#6876)
5b4b64c
Add more tests to prevent regression of CVE 2024 47081
7bc4587
Add new test to check netrc auth leak (#6962)
96ba401
Only use hostname to do netrc lookup instead of netloc
7341690
Merge pull request #6951
from tswast/patch-1
6716d7c
remove links
a7e1c74
Update docs/conf.py
c799b81
docs: fix dead links to kenreitz.org
- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/astral-sh/python-build-standalone/network/alerts).
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
From 5cc924bf04b73004c57bf438476255c1b5b63e9f Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Wed, 11 Jun 2025 14:08:37 -0500
Subject: [PATCH 010/231] Upgrade setuptools to 80.9.0 (#656)
Closes https://github.com/astral-sh/python-build-standalone/issues/654
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index d21bf9482..5c022775e 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -281,10 +281,10 @@
"license_file": "LICENSE.readline.txt",
},
"setuptools": {
- "url": "https://files.pythonhosted.org/packages/55/21/47d163f615df1d30c094f6c8bbb353619274edccf0327b185cc2493c2c33/setuptools-75.6.0-py3-none-any.whl",
- "size": 1224032,
- "sha256": "ce74b49e8f7110f9bf04883b730f4765b774ef3ef28f722cce7c273d253aaf7d",
- "version": "75.6.0",
+ "url": "https://files.pythonhosted.org/packages/a3/dc/17031897dae0efacfea57dfd3a82fdd2a2aeb58e0ff71b77b87e44edc772/setuptools-80.9.0-py3-none-any.whl",
+ "size": 1201486,
+ "sha256": "062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922",
+ "version": "80.9.0",
},
# Remember to update verify_distribution.py when version changed.
"sqlite": {
From bd92d957e9779badfc1b42e8e307a5b8353108db Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Thu, 12 Jun 2025 08:16:08 -0400
Subject: [PATCH 011/231] Upgrade CPython 3.13 to 3.13.5 (#657)
https://www.python.org/downloads/release/python-3135/
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 5c022775e..f59afd82c 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -73,10 +73,10 @@
"python_tag": "cp312",
},
"cpython-3.13": {
- "url": "https://www.python.org/ftp/python/3.13.4/Python-3.13.4.tar.xz",
- "size": 22672472,
- "sha256": "27b15a797562a2971dce3ffe31bb216042ce0b995b39d768cf15f784cc757365",
- "version": "3.13.4",
+ "url": "https://www.python.org/ftp/python/3.13.5/Python-3.13.5.tar.xz",
+ "size": 22856016,
+ "sha256": "93e583f243454e6e9e4588ca2c2662206ad961659863277afcdb96801647d640",
+ "version": "3.13.5",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp313",
From fe33e63812ce0758cf8c179afb8558a52d7d296c Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 12 Jun 2025 18:21:57 -0500
Subject: [PATCH 012/231] Use the latest patch for the CFLAGS JIT configuration
(#659)
---
cpython-unix/build-cpython.sh | 3 +-
cpython-unix/patch-jit-cflags-314.patch | 46 +++++++++++++++++--------
2 files changed, 33 insertions(+), 16 deletions(-)
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 820b6a2de..75f330d9f 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -653,7 +653,8 @@ fi
# We patched configure.ac above. Reflect those changes.
autoconf
-CFLAGS=$CFLAGS CPPFLAGS=$CFLAGS LDFLAGS=$LDFLAGS \
+# Ensure `CFLAGS` are propagated to JIT compilation for 3.13+
+CFLAGS=$CFLAGS CPPFLAGS=$CFLAGS JIT_CFLAGS=$CFLAGS LDFLAGS=$LDFLAGS \
./configure ${CONFIGURE_FLAGS}
# Supplement produced Makefile with our modifications.
diff --git a/cpython-unix/patch-jit-cflags-314.patch b/cpython-unix/patch-jit-cflags-314.patch
index 3a16fb5dd..a75563b47 100644
--- a/cpython-unix/patch-jit-cflags-314.patch
+++ b/cpython-unix/patch-jit-cflags-314.patch
@@ -1,5 +1,12 @@
+diff --git a/Misc/NEWS.d/next/Build/2025-05-19-18-09-20.gh-issue-134273.ZAliyy.rst b/Misc/NEWS.d/next/Build/2025-05-19-18-09-20.gh-issue-134273.ZAliyy.rst
+new file mode 100644
+index 00000000000..3eb13cefbe6
+--- /dev/null
++++ b/Misc/NEWS.d/next/Build/2025-05-19-18-09-20.gh-issue-134273.ZAliyy.rst
+@@ -0,0 +1 @@
++Add support for configuring compiler flags for the JIT with ``CFLAGS_JIT``
diff --git a/Tools/jit/_targets.py b/Tools/jit/_targets.py
-index d0a1c081ffe..deb83f275d2 100644
+index d0a1c081ffe..b383e39da19 100644
--- a/Tools/jit/_targets.py
+++ b/Tools/jit/_targets.py
@@ -10,6 +10,7 @@
@@ -18,16 +25,25 @@ index d0a1c081ffe..deb83f275d2 100644
known_symbols: dict[str, int] = dataclasses.field(default_factory=dict)
pyconfig_dir: pathlib.Path = pathlib.Path.cwd().resolve()
-@@ -120,6 +122,7 @@ async def _compile(
- ) -> _stencils.StencilGroup:
- o = tempdir / f"{opname}.o"
- args = [
+@@ -62,6 +64,7 @@ def _compute_digest(self) -> str:
+ hasher = hashlib.sha256()
+ hasher.update(self.triple.encode())
+ hasher.update(self.debug.to_bytes())
++ hasher.update(self.cflags.encode())
+ # These dependencies are also reflected in _JITSources in regen.targets:
+ hasher.update(PYTHON_EXECUTOR_CASES_C_H.read_bytes())
+ hasher.update((self.pyconfig_dir / "pyconfig.h").read_bytes())
+@@ -155,6 +158,8 @@ async def _compile(
+ f"{o}",
+ f"{c}",
+ *self.args,
++ # Allow user-provided CFLAGS to override any defaults
+ *shlex.split(self.cflags),
- f"--target={self.triple}",
- "-DPy_BUILD_CORE_MODULE",
- "-D_DEBUG" if self.debug else "-DNDEBUG",
+ ]
+ await _llvm.run("clang", args, echo=self.verbose)
+ return await self._parse(o)
diff --git a/Tools/jit/build.py b/Tools/jit/build.py
-index 1afd0c76bad..96c4cb07593 100644
+index 1afd0c76bad..a0733005929 100644
--- a/Tools/jit/build.py
+++ b/Tools/jit/build.py
@@ -39,11 +39,15 @@
@@ -35,19 +51,19 @@ index 1afd0c76bad..96c4cb07593 100644
"-v", "--verbose", action="store_true", help="echo commands as they are run"
)
+ parser.add_argument(
-+ "--with-cflags", help="additional flags to pass to the compiler", default=""
++ "--cflags", help="additional flags to pass to the compiler", default=""
+ )
args = parser.parse_args()
for target in args.target:
target.debug = args.debug
target.force = args.force
target.verbose = args.verbose
-+ target.cflags = args.with_cflags
++ target.cflags = args.cflags
target.pyconfig_dir = args.pyconfig_dir
target.build(
comment=comment,
diff --git a/configure b/configure
-index 884f8a4b068..2e6740c33d9 100755
+index 029bf527da4..fef9f2d7da9 100755
--- a/configure
+++ b/configure
@@ -10863,7 +10863,7 @@ then :
@@ -55,12 +71,12 @@ index 884f8a4b068..2e6740c33d9 100755
else case e in #(
e) as_fn_append CFLAGS_NODIST " $jit_flags"
- REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir ."
-+ REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir . --with-cflags=\"\$(CONFIGURE_CFLAGS)\""
++ REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir . --cflags=\"$CFLAGS_JIT\""
JIT_STENCILS_H="jit_stencils.h"
if test "x$Py_DEBUG" = xtrue
then :
diff --git a/configure.ac b/configure.ac
-index cf25148bad2..f8bfab7bf96 100644
+index 371b2e8ed73..cc37a636c52 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2776,7 +2776,7 @@ AS_VAR_IF([jit_flags],
@@ -68,7 +84,7 @@ index cf25148bad2..f8bfab7bf96 100644
[AS_VAR_APPEND([CFLAGS_NODIST], [" $jit_flags"])
AS_VAR_SET([REGEN_JIT_COMMAND],
- ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir ."])
-+ ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir . --with-cflags=\"\$(CONFIGURE_CFLAGS)\""])
++ ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir . --cflags=\"$CFLAGS_JIT\""])
AS_VAR_SET([JIT_STENCILS_H], ["jit_stencils.h"])
AS_VAR_IF([Py_DEBUG],
[true],
From cb5ec0b456d7b929119cd9a8ad3fdca0f55e0115 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Fri, 13 Jun 2025 09:14:45 -0500
Subject: [PATCH 013/231] Fix `CFLAGS_JIT` declaration (#660)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Silly typo in #659 — turns out macOS is where it fails with the wrong
flags, not Linux
---
cpython-unix/build-cpython.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 75f330d9f..2296f2bfd 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -654,7 +654,7 @@ fi
autoconf
# Ensure `CFLAGS` are propagated to JIT compilation for 3.13+
-CFLAGS=$CFLAGS CPPFLAGS=$CFLAGS JIT_CFLAGS=$CFLAGS LDFLAGS=$LDFLAGS \
+CFLAGS=$CFLAGS CPPFLAGS=$CFLAGS CFLAGS_JIT=$CFLAGS LDFLAGS=$LDFLAGS \
./configure ${CONFIGURE_FLAGS}
# Supplement produced Makefile with our modifications.
From 69f53e2028a75d4c1d26de0bc5476d86fcae8836 Mon Sep 17 00:00:00 2001
From: Jack O'Connor
Date: Tue, 10 Jun 2025 19:34:19 -0700
Subject: [PATCH 014/231] patch libedit to stop re-broadcasting signals
---
cpython-unix/build-libedit.sh | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/cpython-unix/build-libedit.sh b/cpython-unix/build-libedit.sh
index 08387ece2..612205936 100755
--- a/cpython-unix/build-libedit.sh
+++ b/cpython-unix/build-libedit.sh
@@ -82,6 +82,32 @@ index 614795f..4671f1b 100755
fi
EOF
+# When libedit receives a signal, it re-broadcasts it to its entire pgroup.
+# This seems intended to preserve normal ^C behavior in "raw" mode when the
+# terminal's ISIG flag is cleared? However, libedit does not in fact clear
+# ISIG. (And Jack can't find any evidence of any version that ever did.) This
+# sometimes results in the parent process receiving ^C twice back-to-back,
+# depending on the vagaries of signal coalescing. More pathologically, if the
+# parent tries to signal the child directly with e.g. `kill(pid, SIGTERM)`,
+# libedit *signals the parent right back* (not to mention any other pgroup
+# siblings or grandparents). This is just wild behavior, even though it's
+# probably rare that it matters in practice. Patch it out. See also:
+# https://github.com/astral-sh/uv/issues/13919#issuecomment-2960501229.
+patch -p1 << "EOF"
+diff --git i/src/sig.c w/src/sig.c
+index d2b77e7..884b2dd 100644
+--- i/src/sig.c
++++ w/src/sig.c
+@@ -107,7 +107,7 @@ sig_handler(int signo)
+ sel->el_signal->sig_action[i].sa_flags = 0;
+ sigemptyset(&sel->el_signal->sig_action[i].sa_mask);
+ (void) sigprocmask(SIG_SETMASK, &oset, NULL);
+- (void) kill(0, signo);
++ (void) raise(signo);
+ errno = save_errno;
+ }
+EOF
+
cflags="${EXTRA_TARGET_CFLAGS} -fPIC -I${TOOLS_PATH}/deps/include -I${TOOLS_PATH}/deps/include/ncursesw"
ldflags="${EXTRA_TARGET_LDFLAGS} -L${TOOLS_PATH}/deps/lib"
From 45f514c647b755d9d90f218b2bdbe6765cc5ecbd Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Wed, 18 Jun 2025 11:13:29 -0500
Subject: [PATCH 015/231] Use Depot runners for Windows builds (#664)
Goes from a range of 26-32m -> 15->23m
---
ci-runners.yaml | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/ci-runners.yaml b/ci-runners.yaml
index aeb0e5ca0..e8d9f5a08 100644
--- a/ci-runners.yaml
+++ b/ci-runners.yaml
@@ -26,6 +26,11 @@ macos-latest:
platform: darwin
free: true
+depot-windows-2022-8:
+ arch: x86_64
+ platform: windows
+ free: false
+
windows-latest-large:
arch: x86_64
platform: windows
From 4c3dfd82929a3dc199a1e93a62589598e8271631 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 26 Jun 2025 15:57:38 -0500
Subject: [PATCH 016/231] Bump to CPython 3.14.0b3 (#663)
---
cpython-unix/build-cpython.sh | 25 ++++++++++++-------
.../patch-static-remote-debug-3.14.patch | 22 ----------------
pythonbuild/downloads.py | 8 +++---
3 files changed, 20 insertions(+), 35 deletions(-)
delete mode 100644 cpython-unix/patch-static-remote-debug-3.14.patch
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 2296f2bfd..ce88e6c70 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -90,12 +90,6 @@ else
patch -p1 -i ${ROOT}/patch-xopen-source-ios-legacy.patch
fi
-# See https://github.com/python/cpython/pull/135146
-# TODO(zanieb): Drop in 3.14b3
-if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
- patch -p1 -i ${ROOT}/patch-static-remote-debug-3.14.patch
-fi
-
# LIBTOOL_CRUFT is unused and breaks cross-compiling on macOS. Nuke it.
# Submitted upstream at https://github.com/python/cpython/pull/101048.
if [ -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_11}" ]; then
@@ -485,7 +479,9 @@ if [ -n "${CPYTHON_OPTIMIZED}" ]; then
fi
# Respect CFLAGS during JIT compilation.
- # Backports https://github.com/python/cpython/pull/134276
+ #
+ # Backports https://github.com/python/cpython/pull/134276 which we're trying to get released
+ # in 3.14, but is currently only in 3.15+.
if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
patch -p1 -i ${ROOT}/patch-jit-cflags-314.patch
elif [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
@@ -653,8 +649,19 @@ fi
# We patched configure.ac above. Reflect those changes.
autoconf
-# Ensure `CFLAGS` are propagated to JIT compilation for 3.13+
-CFLAGS=$CFLAGS CPPFLAGS=$CFLAGS CFLAGS_JIT=$CFLAGS LDFLAGS=$LDFLAGS \
+# Ensure `CFLAGS` are propagated to JIT compilation for 3.13+ (note this variable has no effect on
+# 3.12 and earlier)
+CFLAGS_JIT="${CFLAGS}"
+
+# In 3.14+, the JIT compiler on x86-64 Linux uses a model that conflicts with `-fPIC`, so strip it
+# from the flags. See:
+# - https://github.com/python/cpython/issues/135690
+# - https://github.com/python/cpython/pull/130097
+if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" && "${TARGET_TRIPLE}" == x86_64* ]]; then
+ CFLAGS_JIT="${CFLAGS_JIT//-fPIC/}"
+fi
+
+CFLAGS=$CFLAGS CPPFLAGS=$CFLAGS CFLAGS_JIT=$CFLAGS_JIT LDFLAGS=$LDFLAGS \
./configure ${CONFIGURE_FLAGS}
# Supplement produced Makefile with our modifications.
diff --git a/cpython-unix/patch-static-remote-debug-3.14.patch b/cpython-unix/patch-static-remote-debug-3.14.patch
deleted file mode 100644
index 1c359c3dc..000000000
--- a/cpython-unix/patch-static-remote-debug-3.14.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/Python/remote_debug.h b/Python/remote_debug.h
-index 6cbf1c8deaa..ab494ea71da 100644
---- a/Python/remote_debug.h
-+++ b/Python/remote_debug.h
-@@ -131,7 +131,7 @@ _Py_RemoteDebug_FreePageCache(proc_handle_t *handle)
- }
- }
-
--void
-+static void
- _Py_RemoteDebug_ClearCache(proc_handle_t *handle)
- {
- for (int i = 0; i < MAX_PAGES; i++) {
-@@ -989,7 +989,7 @@ _Py_RemoteDebug_ReadRemoteMemory(proc_handle_t *handle, uintptr_t remote_address
- #endif
- }
-
--int
-+static int
- _Py_RemoteDebug_PagedReadRemoteMemory(proc_handle_t *handle,
- uintptr_t addr,
- size_t size,
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index f59afd82c..3e7adc828 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -82,10 +82,10 @@
"python_tag": "cp313",
},
"cpython-3.14": {
- "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0b2.tar.xz",
- "size": 23579860,
- "sha256": "7ac9e84844bbc0a5a8f1f79a37a68b3b8caf2a58b4aa5999c49227cb36e70ea6",
- "version": "3.14.0b2",
+ "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0b3.tar.xz",
+ "size": 23626928,
+ "sha256": "c6f48bf51f01f50d87007a445dd7afe4a4c7a87ab482570be924c1ddfd0d3682",
+ "version": "3.14.0b3",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp314",
From 97c36a3df31e7a9130f769992eb928f410605c11 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Fri, 27 Jun 2025 22:12:26 -0500
Subject: [PATCH 017/231] Add ARM64 Windows builds for Python 3.11+ (#387)
Picking up https://github.com/indygreg/python-build-standalone/pull/93
---------
Co-authored-by: Adrian Antkowiak
---
.github/workflows/windows.yml | 1 +
ci-runners.yaml | 5 ++
ci-targets.yaml | 18 +++++
cpython-windows/build.py | 129 ++++++++++++++++++++++++++--------
src/validation.rs | 26 +++++--
5 files changed, 143 insertions(+), 36 deletions(-)
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index a7535c686..ad8bbfe3d 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -92,6 +92,7 @@ jobs:
fi
build:
+ timeout-minutes: 60
needs:
- generate-matrix
- pythonbuild
diff --git a/ci-runners.yaml b/ci-runners.yaml
index e8d9f5a08..43ff9414f 100644
--- a/ci-runners.yaml
+++ b/ci-runners.yaml
@@ -40,3 +40,8 @@ windows-latest:
arch: x86_64
platform: windows
free: true
+
+windows-11-arm:
+ arch: aarch64
+ platform: windows
+ free: false
diff --git a/ci-targets.yaml b/ci-targets.yaml
index 70078e87c..c7b4bd12d 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -384,3 +384,21 @@ windows:
- options:
- freethreaded+pgo
minimum-python-version: "3.13"
+
+ aarch64-pc-windows-msvc:
+ arch: aarch64
+ vcvars: vcvarsamd64_arm64.bat
+ python_versions:
+ # On 3.9 / 3.10, `_tkinter` is failing to be included in the build
+ # - "3.9"
+ # - "3.10"
+ - "3.11"
+ - "3.12"
+ - "3.13"
+ - "3.14"
+ build_options:
+ - pgo
+ build_options_conditional:
+ - options:
+ - freethreaded+pgo
+ minimum-python-version: "3.13"
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index 15b0a44de..0df651e11 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -370,7 +370,7 @@ def hack_props(
mpdecimal_version = DOWNLOADS["mpdecimal"]["version"]
- if meets_python_minimum_version(python_version, "3.14"):
+ if meets_python_minimum_version(python_version, "3.14") or arch == "arm64":
tcltk_commit = DOWNLOADS["tk-windows-bin"]["git_commit"]
else:
tcltk_commit = DOWNLOADS["tk-windows-bin-8612"]["git_commit"]
@@ -464,6 +464,8 @@ def hack_props(
suffix = b"-x64"
elif arch == "win32":
suffix = b""
+ elif arch == "arm64":
+ suffix = b""
else:
raise Exception("unhandled architecture: %s" % arch)
@@ -505,6 +507,7 @@ def hack_project_files(
build_directory: str,
python_version: str,
zlib_entry: str,
+ arch: str,
):
"""Hacks Visual Studio project files to work with our build."""
@@ -518,6 +521,17 @@ def hack_project_files(
zlib_entry,
)
+ # `--include-tcltk` is forced off on arm64, undo that
+ # See https://github.com/python/cpython/pull/132650
+ try:
+ static_replace_in_file(
+ cpython_source_path / "PC" / "layout" / "main.py",
+ rb'if ns.arch in ("arm32", "arm64"):',
+ rb'if ns.arch == "arm32":',
+ )
+ except NoSearchStringError:
+ pass
+
# Our SQLite directory is named weirdly. This throws off version detection
# in the project file. Replace the parsing logic with a static string.
sqlite3_version = DOWNLOADS["sqlite"]["actual_version"].encode("ascii")
@@ -603,14 +617,18 @@ def hack_project_files(
# have a standalone zlib DLL, so we remove references to it. For Python
# 3.14+, we're using tk-windows-bin 8.6.14 which includes a prebuilt zlib
# DLL, so we skip this patch there.
- if meets_python_minimum_version(
- python_version, "3.12"
- ) and meets_python_maximum_version(python_version, "3.13"):
- static_replace_in_file(
- pcbuild_path / "_tkinter.vcxproj",
- rb'<_TclTkDLL Include="$(tcltkdir)\bin\$(tclZlibDllName)" />',
- rb"",
- )
+ # On arm64, we use the new version of tk-windows-bin for all versions.
+ if meets_python_minimum_version(python_version, "3.12") and (
+ meets_python_maximum_version(python_version, "3.13") or arch == "arm64"
+ ):
+ try:
+ static_replace_in_file(
+ pcbuild_path / "_tkinter.vcxproj",
+ rb'<_TclTkDLL Include="$(tcltkdir)\bin\$(tclZlibDllName)" />',
+ rb"",
+ )
+ except NoSearchStringError:
+ pass
# We don't need to produce python_uwp.exe and its *w variant. Or the
# python3.dll, pyshellext, or pylauncher.
@@ -730,9 +748,11 @@ def build_openssl_for_arch(
elif arch == "amd64":
configure = "VC-WIN64A"
prefix = "64"
+ elif arch == "arm64":
+ configure = "VC-WIN64-ARM"
+ prefix = "arm64"
else:
- print("invalid architecture: %s" % arch)
- sys.exit(1)
+ raise Exception("unhandled architecture: %s" % arch)
# The official CPython OpenSSL builds hack ms/uplink.c to change the
# ``GetModuleHandle(NULL)`` invocation to load things from _ssl.pyd
@@ -780,6 +800,12 @@ def build_openssl_for_arch(
log("copying %s to %s" % (source, dest))
shutil.copyfile(source, dest)
+ # Copy `applink.c` to the include directory.
+ source_applink = source_root / "ms" / "applink.c"
+ dest_applink = install_root / "include" / "openssl" / "applink.c"
+ log("copying %s to %s" % (source_applink, dest_applink))
+ shutil.copyfile(source_applink, dest_applink)
+
def build_openssl(
entry: str,
@@ -801,6 +827,7 @@ def build_openssl(
root_32 = td / "x86"
root_64 = td / "x64"
+ root_arm64 = td / "arm64"
if arch == "x86":
root_32.mkdir()
@@ -824,13 +851,28 @@ def build_openssl(
root_64,
jom_archive=jom_archive,
)
+ elif arch == "arm64":
+ root_arm64.mkdir()
+ build_openssl_for_arch(
+ perl_path,
+ "arm64",
+ openssl_archive,
+ openssl_version,
+ nasm_archive,
+ root_arm64,
+ jom_archive=jom_archive,
+ )
else:
- raise ValueError("unhandled arch: %s" % arch)
+ raise Exception("unhandled architecture: %s" % arch)
install = td / "out"
if arch == "x86":
shutil.copytree(root_32 / "install" / "32", install / "openssl" / "win32")
+ elif arch == "arm64":
+ shutil.copytree(
+ root_arm64 / "install" / "arm64", install / "openssl" / "arm64"
+ )
else:
shutil.copytree(root_64 / "install" / "64", install / "openssl" / "amd64")
@@ -901,9 +943,14 @@ def build_libffi(
if arch == "x86":
args.append("-x86")
artifacts_path = ffi_source_path / "i686-pc-cygwin"
- else:
+ elif arch == "arm64":
+ args.append("-arm64")
+ artifacts_path = ffi_source_path / "aarch64-w64-cygwin"
+ elif arch == "amd64":
args.append("-x64")
artifacts_path = ffi_source_path / "x86_64-w64-cygwin"
+ else:
+ raise Exception("unhandled architecture: %s" % arch)
subprocess.run(args, env=env, check=True)
@@ -1069,8 +1116,10 @@ def find_additional_dependencies(project: pathlib.Path):
abi_platform = "win_amd64"
elif arch == "win32":
abi_platform = "win32"
+ elif arch == "arm64":
+ abi_platform = "win_arm64"
else:
- raise ValueError("unhandled arch: %s" % arch)
+ raise Exception("unhandled architecture: %s" % arch)
if freethreaded:
abi_tag = ".cp%st-%s" % (python_majmin, abi_platform)
@@ -1171,8 +1220,8 @@ def find_additional_dependencies(project: pathlib.Path):
if name == "zlib":
name = zlib_entry
- # On 3.14+, we use the latest tcl/tk version
- if ext == "_tkinter" and python_majmin == "314":
+ # On 3.14+ and aarch64, we use the latest tcl/tk version
+ if ext == "_tkinter" and (python_majmin == "314" or arch == "arm64"):
name = name.replace("-8612", "")
download_entry = DOWNLOADS[name]
@@ -1258,16 +1307,18 @@ def build_cpython(
setuptools_wheel = download_entry("setuptools", BUILD)
pip_wheel = download_entry("pip", BUILD)
- # On CPython 3.14+, we use the latest tcl/tk version which has additional runtime
- # dependencies, so we are conservative and use the old version elsewhere.
- if meets_python_minimum_version(python_version, "3.14"):
- tk_bin_archive = download_entry(
- "tk-windows-bin", BUILD, local_name="tk-windows-bin.tar.gz"
- )
- else:
- tk_bin_archive = download_entry(
- "tk-windows-bin-8612", BUILD, local_name="tk-windows-bin.tar.gz"
- )
+ # On CPython 3.14+, we use the latest tcl/tk version which has additional
+ # runtime dependencies, so we are conservative and use the old version
+ # elsewhere. The old version isn't built for arm64, so we use the new
+ # version there too
+ tk_bin_entry = (
+ "tk-windows-bin"
+ if meets_python_minimum_version(python_version, "3.14") or arch == "arm64"
+ else "tk-windows-bin-8612"
+ )
+ tk_bin_archive = download_entry(
+ tk_bin_entry, BUILD, local_name="tk-windows-bin.tar.gz"
+ )
# On CPython 3.14+, zstd is included
if meets_python_minimum_version(python_version, "3.14"):
@@ -1297,8 +1348,11 @@ def build_cpython(
elif arch == "x86":
build_platform = "win32"
build_directory = "win32"
+ elif arch == "arm64":
+ build_platform = "arm64"
+ build_directory = "arm64"
else:
- raise ValueError("unhandled arch: %s" % arch)
+ raise Exception("unhandled architecture: %s" % arch)
tempdir_opts = (
{"ignore_cleanup_errors": True} if sys.version_info >= (3, 12) else {}
@@ -1332,7 +1386,7 @@ def build_cpython(
# We need all the OpenSSL library files in the same directory to appease
# install rules.
- openssl_arch = {"amd64": "amd64", "x86": "win32"}[arch]
+ openssl_arch = {"amd64": "amd64", "x86": "win32", "arm64": "arm64"}[arch]
openssl_root = td / "openssl" / openssl_arch
openssl_bin_path = openssl_root / "bin"
openssl_lib_path = openssl_root / "lib"
@@ -1346,6 +1400,17 @@ def build_cpython(
log("copying %s to %s" % (source, dest))
shutil.copyfile(source, dest)
+ # Delete the tk nmake helper, it's not needed and links msvc
+ tcltk_commit: str = DOWNLOADS[tk_bin_entry]["git_commit"]
+ tcltk_path = td / ("cpython-bin-deps-%s" % tcltk_commit)
+ (
+ tcltk_path
+ / build_directory
+ / "lib"
+ / "nmake"
+ / "x86_64-w64-mingw32-nmakehlp.exe"
+ ).unlink()
+
cpython_source_path = td / ("Python-%s" % python_version)
pcbuild_path = cpython_source_path / "PCbuild"
@@ -1368,6 +1433,7 @@ def build_cpython(
build_directory,
python_version=python_version,
zlib_entry=zlib_entry,
+ arch=arch,
)
if pgo:
@@ -1790,9 +1856,14 @@ def main() -> None:
if os.environ.get("Platform") == "x86":
target_triple = "i686-pc-windows-msvc"
arch = "x86"
- else:
+ elif os.environ.get("Platform") == "arm64":
+ target_triple = "aarch64-pc-windows-msvc"
+ arch = "arm64"
+ elif os.environ.get("Platform") == "x64":
target_triple = "x86_64-pc-windows-msvc"
arch = "amd64"
+ else:
+ raise Exception("unhandled architecture: %s" % os.environ.get("Platform"))
# TODO need better dependency checking.
diff --git a/src/validation.rs b/src/validation.rs
index 19aace00d..9084754b3 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -18,7 +18,7 @@ use {
macho::{LoadCommandVariant, MachHeader, Nlist},
pe::{ImageNtHeaders, PeFile, PeFile32, PeFile64},
},
- Endianness, FileKind, Object, SectionIndex, SymbolScope,
+ Architecture, Endianness, FileKind, Object, SectionIndex, SymbolScope,
},
once_cell::sync::Lazy,
std::{
@@ -33,6 +33,7 @@ use {
const RECOGNIZED_TRIPLES: &[&str] = &[
"aarch64-apple-darwin",
"aarch64-apple-ios",
+ "aarch64-pc-windows-msvc",
"aarch64-unknown-linux-gnu",
"armv7-unknown-linux-gnueabi",
"armv7-unknown-linux-gnueabihf",
@@ -117,11 +118,13 @@ const PE_ALLOWED_LIBRARIES: &[&str] = &[
"libcrypto-1_1.dll",
"libcrypto-1_1-x64.dll",
"libcrypto-3.dll",
+ "libcrypto-3-arm64.dll",
"libcrypto-3-x64.dll",
"libffi-8.dll",
"libssl-1_1.dll",
"libssl-1_1-x64.dll",
"libssl-3.dll",
+ "libssl-3-arm64.dll",
"libssl-3-x64.dll",
"python3.dll",
"python39.dll",
@@ -137,8 +140,14 @@ const PE_ALLOWED_LIBRARIES: &[&str] = &[
"tk86t.dll",
];
-// CPython 3.14 uses tcl/tk 8.6.14+ which includes a bundled zlib and dynamically links to msvcrt.
-const PE_ALLOWED_LIBRARIES_314: &[&str] = &["msvcrt.dll", "zlib1.dll"];
+// CPython 3.14 and ARM64 use a newer version of tcl/tk (8.6.14+) which includes a bundled zlib that
+// dynamically links some system libraries
+const PE_ALLOWED_LIBRARIES_314: &[&str] = &[
+ "zlib1.dll",
+ "api-ms-win-crt-private-l1-1-0.dll", // zlib loads this library on arm64, 3.14+
+ "msvcrt.dll", // zlib loads this library
+];
+const PE_ALLOWED_LIBRARIES_ARM64: &[&str] = &["msvcrt.dll", "zlib1.dll"];
static GLIBC_MAX_VERSION_BY_TRIPLE: Lazy>> =
Lazy::new(|| {
@@ -496,6 +505,7 @@ static PLATFORM_TAG_BY_TRIPLE: Lazy> = Lazy:
[
("aarch64-apple-darwin", "macosx-11.0-arm64"),
("aarch64-apple-ios", "iOS-aarch64"),
+ ("aarch64-pc-windows-msvc", "win-arm64"),
("aarch64-unknown-linux-gnu", "linux-aarch64"),
("armv7-unknown-linux-gnueabi", "linux-arm"),
("armv7-unknown-linux-gnueabihf", "linux-arm"),
@@ -1375,15 +1385,17 @@ fn validate_pe<'data, Pe: ImageNtHeaders>(
let lib = String::from_utf8(lib.to_vec())?;
match python_major_minor {
- "3.9" | "3.10" | "3.11" | "3.12" | "3.13" => {}
+ "3.11" | "3.12" | "3.13" if pe.architecture() == Architecture::Aarch64 => {
+ if PE_ALLOWED_LIBRARIES_ARM64.contains(&lib.as_str()) {
+ continue;
+ }
+ }
"3.14" => {
if PE_ALLOWED_LIBRARIES_314.contains(&lib.as_str()) {
continue;
}
}
- _ => {
- panic!("unhandled Python version: {}", python_major_minor);
- }
+ _ => {}
}
if !PE_ALLOWED_LIBRARIES.contains(&lib.as_str()) {
From 240b6392a544070b5e0ab3c4b8c5c620a880186e Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Sat, 28 Jun 2025 09:33:48 -0500
Subject: [PATCH 018/231] Gate `x86_64-w64-mingw32-nmakehlp.exe` removal to
builds where it is present (#671)
Fixes
https://github.com/astral-sh/python-build-standalone/actions/runs/15939854940/job/44966313482
---
cpython-windows/build.py | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index 0df651e11..3b0c3b414 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -1401,15 +1401,16 @@ def build_cpython(
shutil.copyfile(source, dest)
# Delete the tk nmake helper, it's not needed and links msvc
- tcltk_commit: str = DOWNLOADS[tk_bin_entry]["git_commit"]
- tcltk_path = td / ("cpython-bin-deps-%s" % tcltk_commit)
- (
- tcltk_path
- / build_directory
- / "lib"
- / "nmake"
- / "x86_64-w64-mingw32-nmakehlp.exe"
- ).unlink()
+ if tk_bin_entry == "tk-windows-bin":
+ tcltk_commit: str = DOWNLOADS[tk_bin_entry]["git_commit"]
+ tcltk_path = td / ("cpython-bin-deps-%s" % tcltk_commit)
+ (
+ tcltk_path
+ / build_directory
+ / "lib"
+ / "nmake"
+ / "x86_64-w64-mingw32-nmakehlp.exe"
+ ).unlink()
cpython_source_path = td / ("Python-%s" % python_version)
pcbuild_path = cpython_source_path / "PCbuild"
From 526189db29aac2ab097fbbb0b28b589a21247c2d Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Sat, 28 Jun 2025 11:22:07 -0500
Subject: [PATCH 019/231] Generate the Docker CI matrix (#672)
I think this will be a useful precursor to
https://github.com/astral-sh/python-build-standalone/pull/670
---
.github/workflows/linux.yml | 43 ++++++------
.github/workflows/macos.yml | 8 ++-
.github/workflows/windows.yml | 8 ++-
ci-matrix.py | 126 +++++++++++++++++++++++++---------
4 files changed, 126 insertions(+), 59 deletions(-)
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 3b70b5f83..6f73a9522 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -54,14 +54,9 @@ jobs:
- generate-matrix
strategy:
fail-fast: false
- matrix:
- image:
- - build
- - build.cross
- - build.cross-riscv64
- - gcc
- name: ${{ matrix.image }}
- runs-on: depot-ubuntu-22.04
+ matrix: ${{ fromJson(needs.generate-matrix.outputs.docker-build-matrix) }}
+ name: ${{ matrix.name }}
+ runs-on: ${{ matrix.runner }}
permissions:
packages: write
steps:
@@ -95,37 +90,38 @@ jobs:
uses: docker/build-push-action@v5
with:
context: .
- file: build/${{ matrix.image }}.Dockerfile
+ file: build/${{ matrix.name }}.Dockerfile
labels: org.opencontainers.image.source=https://github.com/${{ env.REPO_NAME }}
# Cache from/to the current branch of the current repo as the primary cache key.
# Cache from the default branch of the current repo so branches can have cache hits.
# Cache from the default branch of the canonical repo so forks can have cache hits.
# Ignore errors on cache writes so CI of forks works without a valid GHCR config.
cache-from: |
- type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.image }}-${{ env.GIT_REF_NAME }}
- type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.image }}-main
- type=registry,ref=ghcr.io/astral-sh/python-build-standalone:${{ matrix.image }}-main
+ type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.name }}-${{ env.GIT_REF_NAME }}
+ type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.name }}-main
+ type=registry,ref=ghcr.io/astral-sh/python-build-standalone:${{ matrix.name }}-main
cache-to: |
- type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.image }}-${{ env.GIT_REF_NAME }},ignore-error=true
+ type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.name }}-${{ env.GIT_REF_NAME }},ignore-error=true
outputs: |
- type=docker,dest=build/image-${{ matrix.image }}.tar
+ type=docker,dest=build/image-${{ matrix.name }}.tar
- name: Compress Image
run: |
- echo ${{ steps.build-image.outputs.imageid }} > build/image-${{ matrix.image }}
+ echo ${{ steps.build-image.outputs.imageid }} > build/image-${{ matrix.name }}
zstd -v -T0 -6 --rm build/image-*.tar
- name: Upload Docker Image
uses: actions/upload-artifact@v4
with:
- name: image-${{ matrix.image }}
+ name: image-${{ matrix.name }}
path: build/image-*
generate-matrix:
runs-on: ubuntu-latest
outputs:
- matrix-0: ${{ steps.set-matrix.outputs.matrix-0 }}
- matrix-1: ${{ steps.set-matrix.outputs.matrix-1 }}
+ python-build-matrix-0: ${{ steps.set-matrix.outputs.python-build-matrix-0 }}
+ python-build-matrix-1: ${{ steps.set-matrix.outputs.python-build-matrix-1 }}
+ docker-build-matrix: ${{ steps.set-matrix.outputs.docker-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
pythonbuild_changed: ${{ steps.check-pythonbuild.outputs.changed }}
steps:
@@ -152,13 +148,14 @@ jobs:
--max-shards 2 \
> matrix.json
- echo "matrix-0=$(jq -c '.["0"]' matrix.json)" >> $GITHUB_OUTPUT
- echo "matrix-1=$(jq -c '.["1"]' matrix.json)" >> $GITHUB_OUTPUT
+ echo "python-build-matrix-0=$(jq -c '."python-build"["0"]' matrix.json)" >> $GITHUB_OUTPUT
+ echo "python-build-matrix-1=$(jq -c '."python-build"["1"]' matrix.json)" >> $GITHUB_OUTPUT
+ echo "docker-build-matrix=$(jq -c '."docker-build"' matrix.json)" >> $GITHUB_OUTPUT
# Display the matrix for debugging too
cat matrix.json | jq
- if jq -e '.["0"].include | length > 0' matrix.json > /dev/null; then
+ if jq -e '."python-build"["0"].include | length > 0' matrix.json > /dev/null; then
# Build matrix has entries
echo "any_builds=true" >> $GITHUB_OUTPUT
else
@@ -189,7 +186,7 @@ jobs:
attestations: write
runs-on: ${{ matrix.runner }}
strategy:
- matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix-0) }}
+ matrix: ${{ fromJson(needs.generate-matrix.outputs.python-build-matrix-0) }}
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
@@ -289,7 +286,7 @@ jobs:
attestations: write
runs-on: ${{ matrix.runner }}
strategy:
- matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix-1) }}
+ matrix: ${{ fromJson(needs.generate-matrix.outputs.python-build-matrix-1) }}
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index af9a80f0d..918323d4b 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -67,11 +67,15 @@ jobs:
- name: Generate build matrix
id: set-matrix
run: |
- uv run ci-matrix.py --platform darwin --labels '${{ steps.get-labels.outputs.labels }}' > matrix.json && echo "matrix=$(cat matrix.json)" >> $GITHUB_OUTPUT
+ uv run ci-matrix.py --platform darwin --labels '${{ steps.get-labels.outputs.labels }}' > matrix.json
+
+ # Extract python-build matrix
+ echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
+
# Display the matrix for debugging too
cat matrix.json | jq
- if jq -e '.include | length > 0' matrix.json > /dev/null; then
+ if jq -e '."python-build".include | length > 0' matrix.json > /dev/null; then
# Build matrix has entries
echo "any_builds=true" >> $GITHUB_OUTPUT
else
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index ad8bbfe3d..0e03dbaff 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -67,11 +67,15 @@ jobs:
- name: Generate build matrix
id: set-matrix
run: |
- uv run ci-matrix.py --platform windows --labels '${{ steps.get-labels.outputs.labels }}' > matrix.json && echo "matrix=$(cat matrix.json)" >> $GITHUB_OUTPUT
+ uv run ci-matrix.py --platform windows --labels '${{ steps.get-labels.outputs.labels }}' > matrix.json
+
+ # Extract python-build matrix
+ echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
+
# Display the matrix for debugging too
cat matrix.json | jq
- if jq -e '.include | length > 0' matrix.json > /dev/null; then
+ if jq -e '."python-build".include | length > 0' matrix.json > /dev/null; then
# Build matrix has entries
echo "any_builds=true" >> $GITHUB_OUTPUT
else
diff --git a/ci-matrix.py b/ci-matrix.py
index c9bcccee0..8543a582b 100644
--- a/ci-matrix.py
+++ b/ci-matrix.py
@@ -19,6 +19,14 @@
CI_EXTRA_SKIP_LABELS = ["documentation"]
CI_MATRIX_SIZE_LIMIT = 256 # The maximum size of a matrix in GitHub Actions
+# Docker images for building toolchains and dependencies
+DOCKER_BUILD_IMAGES = [
+ {"name": "build", "arch": "x86_64"},
+ {"name": "build.cross", "arch": "x86_64"},
+ {"name": "build.cross-riscv64", "arch": "x86_64"},
+ {"name": "gcc", "arch": "x86_64"},
+]
+
def meets_conditional_version(version: str, min_version: str) -> bool:
return Version(version) >= Version(min_version)
@@ -89,12 +97,36 @@ def should_include_entry(entry: dict[str, str], filters: dict[str, set[str]]) ->
return True
-def generate_matrix_entries(
+def generate_docker_matrix_entries(
+ runners: dict[str, Any],
+ platform_filter: Optional[str] = None,
+) -> list[dict[str, str]]:
+ """Generate matrix entries for docker image builds."""
+ if platform_filter and platform_filter != "linux":
+ return []
+
+ matrix_entries = []
+ for image in DOCKER_BUILD_IMAGES:
+ # Find appropriate runner for Linux platform with the specified architecture
+ runner = find_runner(runners, "linux", image["arch"])
+
+ entry = {
+ "name": image["name"],
+ "arch": image["arch"],
+ "runner": runner,
+ }
+ matrix_entries.append(entry)
+
+ return matrix_entries
+
+
+def generate_python_build_matrix_entries(
config: dict[str, Any],
runners: dict[str, Any],
platform_filter: Optional[str] = None,
label_filters: Optional[dict[str, set[str]]] = None,
) -> list[dict[str, str]]:
+ """Generate matrix entries for python builds."""
matrix_entries = []
for platform, platform_config in config.items():
@@ -102,13 +134,13 @@ def generate_matrix_entries(
continue
for target_triple, target_config in platform_config.items():
- add_matrix_entries_for_config(
+ add_python_build_entries_for_config(
matrix_entries,
target_triple,
target_config,
platform,
runners,
- label_filters.get("directives", set()),
+ label_filters.get("directives", set()) if label_filters else set(),
)
# Apply label filters if present
@@ -144,7 +176,7 @@ def find_runner(runners: dict[str, Any], platform: str, arch: str) -> str:
raise RuntimeError(f"No runner found for platform {platform!r} and arch {arch!r}")
-def add_matrix_entries_for_config(
+def add_python_build_entries_for_config(
matrix_entries: list[dict[str, str]],
target_triple: str,
config: dict[str, Any],
@@ -152,6 +184,7 @@ def add_matrix_entries_for_config(
runners: dict[str, Any],
directives: set[str],
) -> None:
+ """Add python build matrix entries for a specific target configuration."""
python_versions = config["python_versions"]
build_options = config["build_options"]
arch = config["arch"]
@@ -233,6 +266,12 @@ def parse_args() -> argparse.Namespace:
action="store_true",
help="If only free runners should be used.",
)
+ parser.add_argument(
+ "--matrix-type",
+ choices=["python-build", "docker-build", "all"],
+ default="all",
+ help="Which matrix types to generate (default: all)",
+ )
return parser.parse_args()
@@ -254,36 +293,59 @@ def main() -> None:
if runner_config.get("free")
}
- entries = generate_matrix_entries(
- config,
- runners,
- args.platform,
- labels,
- )
-
- if args.max_shards:
- matrix = {}
- shards = (len(entries) // CI_MATRIX_SIZE_LIMIT) + 1
- if shards > args.max_shards:
- print(
- f"error: matrix of size {len(entries)} requires {shards} shards, but the maximum is {args.max_shards}; consider increasing `--max-shards`",
- file=sys.stderr,
- )
- sys.exit(1)
- for shard in range(args.max_shards):
- shard_entries = entries[
- shard * CI_MATRIX_SIZE_LIMIT : (shard + 1) * CI_MATRIX_SIZE_LIMIT
- ]
- matrix[str(shard)] = {"include": shard_entries}
- else:
- if len(entries) > CI_MATRIX_SIZE_LIMIT:
- print(
- f"warning: matrix of size {len(entries)} exceeds limit of {CI_MATRIX_SIZE_LIMIT} but sharding is not enabled; consider setting `--max-shards`",
- file=sys.stderr,
+ result = {}
+
+ # Generate python-build matrix if requested
+ python_entries = []
+ if args.matrix_type in ["python-build", "all"]:
+ python_entries = generate_python_build_matrix_entries(
+ config,
+ runners,
+ args.platform,
+ labels,
+ )
+
+ if args.max_shards:
+ python_build_matrix = {}
+ shards = (len(python_entries) // CI_MATRIX_SIZE_LIMIT) + 1
+ if shards > args.max_shards:
+ print(
+ f"error: python-build matrix of size {len(python_entries)} requires {shards} shards, but the maximum is {args.max_shards}; consider increasing `--max-shards`",
+ file=sys.stderr,
+ )
+ sys.exit(1)
+ for shard in range(args.max_shards):
+ shard_entries = python_entries[
+ shard * CI_MATRIX_SIZE_LIMIT : (shard + 1) * CI_MATRIX_SIZE_LIMIT
+ ]
+ python_build_matrix[str(shard)] = {"include": shard_entries}
+ result["python-build"] = python_build_matrix
+ else:
+ if len(python_entries) > CI_MATRIX_SIZE_LIMIT:
+ print(
+ f"warning: python-build matrix of size {len(python_entries)} exceeds limit of {CI_MATRIX_SIZE_LIMIT} but sharding is not enabled; consider setting `--max-shards`",
+ file=sys.stderr,
+ )
+ result["python-build"] = {"include": python_entries}
+
+ # Generate docker-build matrix if requested
+ # Only include docker builds if there are Linux python builds
+ if args.matrix_type in ["docker-build", "all"]:
+ # Check if we have any Linux python builds
+ has_linux_builds = any(
+ entry.get("platform") == "linux" for entry in python_entries
+ )
+
+ # If no platform filter or explicitly requesting docker-build only, include docker builds
+ # Otherwise, only include if there are Linux python builds
+ if args.matrix_type == "docker-build" or has_linux_builds:
+ docker_entries = generate_docker_matrix_entries(
+ runners,
+ args.platform,
)
- matrix = {"include": entries}
+ result["docker-build"] = {"include": docker_entries}
- print(json.dumps(matrix))
+ print(json.dumps(result))
if __name__ == "__main__":
From 449d3e7a2b03a311884b40ed90f98bfc90bee01e Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Sat, 28 Jun 2025 11:53:04 -0500
Subject: [PATCH 020/231] Generate the matrix for building the `pythonbuild`
crate (#673)
As in #672 this seems helpful for #670
---
.github/workflows/linux.yml | 49 ++++++++--------
.github/workflows/macos.yml | 44 ++++++++-------
.github/workflows/windows.yml | 44 ++++++++-------
ci-matrix.py | 102 +++++++++++++++++++++++++++++-----
4 files changed, 162 insertions(+), 77 deletions(-)
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 6f73a9522..8ae87e760 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -13,11 +13,14 @@ env:
FORCE_COLOR: 1
jobs:
- pythonbuild:
- if: ${{ needs.generate-matrix.outputs.pythonbuild_changed == 'true' || needs.generate-matrix.outputs.any_builds == 'true' || github.ref == 'refs/heads/main' }}
+ crate-build:
needs:
- generate-matrix
- runs-on: depot-ubuntu-22.04
+ runs-on: ${{ matrix.runner }}
+ strategy:
+ matrix: ${{ fromJson(needs.generate-matrix.outputs.crate-build-matrix) }}
+ fail-fast: false
+ name: crate / ${{ matrix.arch }}
steps:
- name: Install System Dependencies
run: |
@@ -45,7 +48,7 @@ jobs:
- name: Upload pythonbuild Executable
uses: actions/upload-artifact@v4
with:
- name: pythonbuild
+ name: ${{ matrix.crate_artifact_name }}
path: target/release/pythonbuild
image:
@@ -55,7 +58,7 @@ jobs:
strategy:
fail-fast: false
matrix: ${{ fromJson(needs.generate-matrix.outputs.docker-build-matrix) }}
- name: ${{ matrix.name }}
+ name: image / ${{ matrix.name }}
runs-on: ${{ matrix.runner }}
permissions:
packages: write
@@ -122,8 +125,8 @@ jobs:
python-build-matrix-0: ${{ steps.set-matrix.outputs.python-build-matrix-0 }}
python-build-matrix-1: ${{ steps.set-matrix.outputs.python-build-matrix-1 }}
docker-build-matrix: ${{ steps.set-matrix.outputs.docker-build-matrix }}
+ crate-build-matrix: ${{ steps.set-matrix.outputs.crate-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
- pythonbuild_changed: ${{ steps.check-pythonbuild.outputs.changed }}
steps:
- uses: actions/checkout@v4
with:
@@ -139,6 +142,18 @@ jobs:
LABELS=$(echo '${{ toJson(github.event.pull_request.labels.*.name) }}' | jq -r 'join(",")')
echo "labels=$LABELS" >> $GITHUB_OUTPUT
+ - name: Check if the `pythonbuild` crate changed
+ id: check-pythonbuild
+ env:
+ BASE_REF: ${{ github.event.pull_request.base.ref || 'main' }}
+ run: |
+ merge_base=$(git merge-base HEAD "origin/${BASE_REF}")
+ if git diff --quiet "${merge_base}...HEAD" -- ':src/*.rs'; then
+ echo "changed=false" >> "$GITHUB_OUTPUT"
+ else
+ echo "changed=true" >> "$GITHUB_OUTPUT"
+ fi
+
- name: Generate build matrix
id: set-matrix
run: |
@@ -146,11 +161,13 @@ jobs:
--platform linux \
--labels '${{ steps.get-labels.outputs.labels }}' \
--max-shards 2 \
+ ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} \
> matrix.json
echo "python-build-matrix-0=$(jq -c '."python-build"["0"]' matrix.json)" >> $GITHUB_OUTPUT
echo "python-build-matrix-1=$(jq -c '."python-build"["1"]' matrix.json)" >> $GITHUB_OUTPUT
echo "docker-build-matrix=$(jq -c '."docker-build"' matrix.json)" >> $GITHUB_OUTPUT
+ echo "crate-build-matrix=$(jq -c '."crate-build"' matrix.json)" >> $GITHUB_OUTPUT
# Display the matrix for debugging too
cat matrix.json | jq
@@ -163,22 +180,10 @@ jobs:
echo "any_builds=false" >> $GITHUB_OUTPUT
fi
- - name: Check if the `pythonbuild` crate changed
- id: check-pythonbuild
- env:
- BASE_REF: ${{ github.event.pull_request.base.ref || 'main' }}
- run: |
- merge_base=$(git merge-base HEAD "origin/${BASE_REF}")
- if git diff --quiet "${merge_base}...HEAD" -- ':src/*.rs'; then
- echo "changed=false" >> "$GITHUB_OUTPUT"
- else
- echo "changed=true" >> "$GITHUB_OUTPUT"
- fi
-
build-0:
needs:
- generate-matrix
- - pythonbuild
+ - crate-build
- image
# Permissions used for actions/attest-build-provenance
permissions:
@@ -202,7 +207,7 @@ jobs:
- name: Download pythonbuild
uses: actions/download-artifact@v4
with:
- name: pythonbuild
+ name: ${{ matrix.crate_artifact_name }}
path: build
- name: Download images
@@ -278,7 +283,7 @@ jobs:
build-1:
needs:
- generate-matrix
- - pythonbuild
+ - crate-build
- image
# Permissions used for actions/attest-build-provenance
permissions:
@@ -302,7 +307,7 @@ jobs:
- name: Download pythonbuild
uses: actions/download-artifact@v4
with:
- name: pythonbuild
+ name: ${{ matrix.crate_artifact_name }}
path: build
- name: Download images
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 918323d4b..1199b3985 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -13,11 +13,14 @@ env:
FORCE_COLOR: 1
jobs:
- pythonbuild:
- if: ${{ needs.generate-matrix.outputs.pythonbuild_changed == 'true' || needs.generate-matrix.outputs.any_builds == 'true' || github.ref == 'refs/heads/main' }}
+ crate-build:
needs:
- generate-matrix
- runs-on: depot-macos-latest
+ runs-on: ${{ matrix.runner }}
+ strategy:
+ matrix: ${{ fromJson(needs.generate-matrix.outputs.crate-build-matrix) }}
+ fail-fast: false
+ name: crate / ${{ matrix.arch }}
steps:
- uses: actions/checkout@v4
@@ -40,15 +43,15 @@ jobs:
- name: Upload pythonbuild Executable
uses: actions/upload-artifact@v4
with:
- name: pythonbuild
+ name: ${{ matrix.crate_artifact_name }}
path: target/release/pythonbuild
generate-matrix:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
+ crate-build-matrix: ${{ steps.set-matrix.outputs.crate-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
- pythonbuild_changed: ${{ steps.check-pythonbuild.outputs.changed }}
steps:
- uses: actions/checkout@v4
with:
@@ -64,13 +67,26 @@ jobs:
LABELS=$(echo '${{ toJson(github.event.pull_request.labels.*.name) }}' | jq -r 'join(",")')
echo "labels=$LABELS" >> $GITHUB_OUTPUT
+ - name: Check if the `pythonbuild` crate changed
+ id: check-pythonbuild
+ env:
+ BASE_REF: ${{ github.event.pull_request.base.ref || 'main' }}
+ run: |
+ merge_base=$(git merge-base HEAD "origin/${BASE_REF}")
+ if git diff --quiet "${merge_base}...HEAD" -- ':src/*.rs'; then
+ echo "changed=false" >> "$GITHUB_OUTPUT"
+ else
+ echo "changed=true" >> "$GITHUB_OUTPUT"
+ fi
+
- name: Generate build matrix
id: set-matrix
run: |
- uv run ci-matrix.py --platform darwin --labels '${{ steps.get-labels.outputs.labels }}' > matrix.json
+ uv run ci-matrix.py --platform darwin --labels '${{ steps.get-labels.outputs.labels }}' ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
# Extract python-build matrix
echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
+ echo "crate-build-matrix=$(jq -c '."crate-build"' matrix.json)" >> $GITHUB_OUTPUT
# Display the matrix for debugging too
cat matrix.json | jq
@@ -83,22 +99,10 @@ jobs:
echo "any_builds=false" >> $GITHUB_OUTPUT
fi
- - name: Check if the `pythonbuild` crate changed
- id: check-pythonbuild
- env:
- BASE_REF: ${{ github.event.pull_request.base.ref || 'main' }}
- run: |
- merge_base=$(git merge-base HEAD "origin/${BASE_REF}")
- if git diff --quiet "${merge_base}...HEAD" -- ':src/*.rs'; then
- echo "changed=false" >> "$GITHUB_OUTPUT"
- else
- echo "changed=true" >> "$GITHUB_OUTPUT"
- fi
-
build:
needs:
- generate-matrix
- - pythonbuild
+ - crate-build
# Permissions used for actions/attest-build-provenance
permissions:
id-token: write
@@ -121,7 +125,7 @@ jobs:
- name: Download pythonbuild
uses: actions/download-artifact@v4
with:
- name: pythonbuild
+ name: ${{ matrix.crate_artifact_name }}
path: build
- name: Build
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 0e03dbaff..e285fac3a 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -13,11 +13,14 @@ env:
FORCE_COLOR: 1
jobs:
- pythonbuild:
- if: ${{ needs.generate-matrix.outputs.pythonbuild_changed == 'true' || needs.generate-matrix.outputs.any_builds == 'true' || github.ref == 'refs/heads/main' }}
+ crate-build:
needs:
- generate-matrix
- runs-on: 'windows-2022'
+ runs-on: ${{ matrix.runner }}
+ strategy:
+ matrix: ${{ fromJson(needs.generate-matrix.outputs.crate-build-matrix) }}
+ fail-fast: false
+ name: crate / ${{ matrix.arch }}
steps:
- uses: actions/checkout@v4
@@ -40,15 +43,15 @@ jobs:
- name: Upload executable
uses: actions/upload-artifact@v4
with:
- name: pythonbuild
+ name: ${{ matrix.crate_artifact_name }}
path: target/release/pythonbuild.exe
generate-matrix:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
+ crate-build-matrix: ${{ steps.set-matrix.outputs.crate-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
- pythonbuild_changed: ${{ steps.check-pythonbuild.outputs.changed }}
steps:
- uses: actions/checkout@v4
with:
@@ -64,13 +67,26 @@ jobs:
LABELS=$(echo '${{ toJson(github.event.pull_request.labels.*.name) }}' | jq -r 'join(",")')
echo "labels=$LABELS" >> $GITHUB_OUTPUT
+ - name: Check if the `pythonbuild` crate changed
+ id: check-pythonbuild
+ env:
+ BASE_REF: ${{ github.event.pull_request.base.ref || 'main' }}
+ run: |
+ merge_base=$(git merge-base HEAD "origin/${BASE_REF}")
+ if git diff --quiet "${merge_base}...HEAD" -- ':src/*.rs'; then
+ echo "changed=false" >> "$GITHUB_OUTPUT"
+ else
+ echo "changed=true" >> "$GITHUB_OUTPUT"
+ fi
+
- name: Generate build matrix
id: set-matrix
run: |
- uv run ci-matrix.py --platform windows --labels '${{ steps.get-labels.outputs.labels }}' > matrix.json
+ uv run ci-matrix.py --platform windows --labels '${{ steps.get-labels.outputs.labels }}' ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
# Extract python-build matrix
echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
+ echo "crate-build-matrix=$(jq -c '."crate-build"' matrix.json)" >> $GITHUB_OUTPUT
# Display the matrix for debugging too
cat matrix.json | jq
@@ -83,23 +99,11 @@ jobs:
echo "any_builds=false" >> $GITHUB_OUTPUT
fi
- - name: Check if the `pythonbuild` crate changed
- id: check-pythonbuild
- env:
- BASE_REF: ${{ github.event.pull_request.base.ref || 'main' }}
- run: |
- merge_base=$(git merge-base HEAD "origin/${BASE_REF}")
- if git diff --quiet "${merge_base}...HEAD" -- ':src/*.rs'; then
- echo "changed=false" >> "$GITHUB_OUTPUT"
- else
- echo "changed=true" >> "$GITHUB_OUTPUT"
- fi
-
build:
timeout-minutes: 60
needs:
- generate-matrix
- - pythonbuild
+ - crate-build
# Permissions used for actions/attest-build-provenance
permissions:
id-token: write
@@ -127,7 +131,7 @@ jobs:
- name: Download pythonbuild Executable
uses: actions/download-artifact@v4
with:
- name: pythonbuild
+ name: ${{ matrix.crate_artifact_name }}
# We need to do this before we activate the VC++ environment or else binary packages
# don't get compiled properly.
diff --git a/ci-matrix.py b/ci-matrix.py
index 8543a582b..96059a961 100644
--- a/ci-matrix.py
+++ b/ci-matrix.py
@@ -19,6 +19,7 @@
CI_EXTRA_SKIP_LABELS = ["documentation"]
CI_MATRIX_SIZE_LIMIT = 256 # The maximum size of a matrix in GitHub Actions
+
# Docker images for building toolchains and dependencies
DOCKER_BUILD_IMAGES = [
{"name": "build", "arch": "x86_64"},
@@ -28,6 +29,10 @@
]
+def crate_artifact_name(platform: str, arch: str) -> str:
+ return f"crate-{platform}-{arch}"
+
+
def meets_conditional_version(version: str, min_version: str) -> bool:
return Version(version) >= Version(min_version)
@@ -108,7 +113,7 @@ def generate_docker_matrix_entries(
matrix_entries = []
for image in DOCKER_BUILD_IMAGES:
# Find appropriate runner for Linux platform with the specified architecture
- runner = find_runner(runners, "linux", image["arch"])
+ runner = find_runner(runners, "linux", image["arch"], False)
entry = {
"name": image["name"],
@@ -120,6 +125,51 @@ def generate_docker_matrix_entries(
return matrix_entries
+def generate_crate_build_matrix_entries(
+ python_entries: list[dict[str, str]],
+ runners: dict[str, Any],
+ config: dict[str, Any],
+ force_crate_build: bool = False,
+ platform_filter: Optional[str] = None,
+) -> list[dict[str, str]]:
+ """Generate matrix entries for crate builds based on python build matrix."""
+ needed_builds = set()
+ for entry in python_entries:
+ # The crate build will need to match the runner's architecture
+ runner = runners[entry["runner"]]
+ needed_builds.add((entry["platform"], runner["arch"]))
+
+ # If forcing crate build, also include all possible native builds
+ if force_crate_build:
+ for platform, platform_config in config.items():
+ # Filter by platform if specified
+ if platform_filter and platform != platform_filter:
+ continue
+
+ for target_config in platform_config.values():
+ # Only include if native (run: true means native)
+ if not target_config.get("run"):
+ continue
+
+ arch = target_config["arch"]
+ needed_builds.add((platform, arch))
+
+ # Create matrix entries for each needed build
+ return [
+ {
+ "platform": platform,
+ "arch": arch,
+ "runner": find_runner(runners, platform, arch, True),
+ "crate_artifact_name": crate_artifact_name(
+ platform,
+ arch,
+ ),
+ }
+ for platform, arch in needed_builds
+ if not platform_filter or platform == platform_filter
+ ]
+
+
def generate_python_build_matrix_entries(
config: dict[str, Any],
runners: dict[str, Any],
@@ -154,10 +204,12 @@ def generate_python_build_matrix_entries(
return matrix_entries
-def find_runner(runners: dict[str, Any], platform: str, arch: str) -> str:
+def find_runner(runners: dict[str, Any], platform: str, arch: str, free: bool) -> str:
# Find a matching platform first
match_platform = [
- runner for runner in runners if runners[runner]["platform"] == platform
+ runner
+ for runner in runners
+ if runners[runner]["platform"] == platform and runners[runner]["free"] == free
]
# Then, find a matching architecture
@@ -173,7 +225,9 @@ def find_runner(runners: dict[str, Any], platform: str, arch: str) -> str:
if match_platform:
return match_platform[0]
- raise RuntimeError(f"No runner found for platform {platform!r} and arch {arch!r}")
+ raise RuntimeError(
+ f"No runner found for platform {platform!r} and arch {arch!r} with free={free}"
+ )
def add_python_build_entries_for_config(
@@ -188,7 +242,7 @@ def add_python_build_entries_for_config(
python_versions = config["python_versions"]
build_options = config["build_options"]
arch = config["arch"]
- runner = find_runner(runners, platform, arch)
+ runner = find_runner(runners, platform, arch, False)
# Create base entry that will be used for all variants
base_entry = {
@@ -199,6 +253,8 @@ def add_python_build_entries_for_config(
# If `run` is in the config, use that — otherwise, default to if the
# runner architecture matches the build architecture
"run": str(config.get("run", runners[runner]["arch"] == arch)).lower(),
+ # Use the crate artifact built for the runner's architecture
+ "crate_artifact_name": crate_artifact_name(platform, runners[runner]["arch"]),
}
# Add optional fields if they exist
@@ -266,9 +322,14 @@ def parse_args() -> argparse.Namespace:
action="store_true",
help="If only free runners should be used.",
)
+ parser.add_argument(
+ "--force-crate-build",
+ action="store_true",
+ help="Force crate builds to be included even without python builds.",
+ )
parser.add_argument(
"--matrix-type",
- choices=["python-build", "docker-build", "all"],
+ choices=["python-build", "docker-build", "crate-build", "all"],
default="all",
help="Which matrix types to generate (default: all)",
)
@@ -295,16 +356,16 @@ def main() -> None:
result = {}
- # Generate python-build matrix if requested
- python_entries = []
- if args.matrix_type in ["python-build", "all"]:
- python_entries = generate_python_build_matrix_entries(
- config,
- runners,
- args.platform,
- labels,
- )
+ # Generate python build entries
+ python_entries = generate_python_build_matrix_entries(
+ config,
+ runners,
+ args.platform,
+ labels,
+ )
+ # Output python-build matrix if requested
+ if args.matrix_type in ["python-build", "all"]:
if args.max_shards:
python_build_matrix = {}
shards = (len(python_entries) // CI_MATRIX_SIZE_LIMIT) + 1
@@ -345,6 +406,17 @@ def main() -> None:
)
result["docker-build"] = {"include": docker_entries}
+ # Generate crate-build matrix if requested
+ if args.matrix_type in ["crate-build", "all"]:
+ crate_entries = generate_crate_build_matrix_entries(
+ python_entries,
+ runners,
+ config,
+ args.force_crate_build,
+ args.platform,
+ )
+ result["crate-build"] = {"include": crate_entries}
+
print(json.dumps(result))
From e17faa9e098156baeeca3ae0c2249c460fa37bb2 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Sat, 28 Jun 2025 14:04:24 -0500
Subject: [PATCH 021/231] Update the crate build runner logic (#674)
Using the free GitHub runners for Linux breaks those builds :)
---
ci-matrix.py | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/ci-matrix.py b/ci-matrix.py
index 96059a961..cfccdd5e9 100644
--- a/ci-matrix.py
+++ b/ci-matrix.py
@@ -159,7 +159,13 @@ def generate_crate_build_matrix_entries(
{
"platform": platform,
"arch": arch,
- "runner": find_runner(runners, platform, arch, True),
+ # Use the GitHub runner for Windows, because the Depot one is
+ # missing a Rust toolchain. On Linux, it's important that the the
+ # `python-build` runner matches the `crate-build` runner because of
+ # GLIBC version mismatches.
+ "runner": find_runner(
+ runners, platform, arch, True if platform == "windows" else False
+ ),
"crate_artifact_name": crate_artifact_name(
platform,
arch,
From b233563209eb92c9e93d284418ee8d7eefcef4a7 Mon Sep 17 00:00:00 2001
From: Dustin Rodrigues
Date: Sun, 29 Jun 2025 11:59:01 -0400
Subject: [PATCH 022/231] use raw string literal for regex (#675)
Uses a raw string literal for the regex to avoid
```
python-build-standalone/pythonbuild/cpython.py:675: SyntaxWarning: invalid escape sequence '\{'
RE_INITTAB_ENTRY = re.compile('\{"([^"]+)", ([^\}]+)\},')
```
---
pythonbuild/cpython.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pythonbuild/cpython.py b/pythonbuild/cpython.py
index f339037ce..c52f7ce60 100644
--- a/pythonbuild/cpython.py
+++ b/pythonbuild/cpython.py
@@ -672,7 +672,7 @@ def derive_setup_local(
}
-RE_INITTAB_ENTRY = re.compile('\{"([^"]+)", ([^\}]+)\},')
+RE_INITTAB_ENTRY = re.compile(r'\{"([^"]+)", ([^\}]+)\},')
def parse_config_c(s: str):
From 14f33e81921e8f2bf20a8e58212a8f81eed2f1ba Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Mon, 30 Jun 2025 15:43:24 -0500
Subject: [PATCH 023/231] Include aarch64 Window artifacts in releases (#679)
---
src/release.rs | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/release.rs b/src/release.rs
index 60e46c993..d4f890ee2 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -129,6 +129,18 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
}],
},
);
+ h.insert(
+ "aarch64-pc-windows-msvc",
+ TripleRelease {
+ suffixes: vec!["pgo"],
+ install_only_suffix: "pgo",
+ python_version_requirement: Some(VersionSpecifier::from_str(">=3.11").unwrap()),
+ conditional_suffixes: vec![ConditionalSuffixes {
+ python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
+ suffixes: vec!["freethreaded+pgo"],
+ }],
+ },
+ );
// Linux.
let linux_suffixes_pgo = vec!["debug", "pgo+lto"];
From c646c36b062051ebf5d211dc86763e5bd72599e2 Mon Sep 17 00:00:00 2001
From: Gregory Szorc
Date: Fri, 16 May 2025 19:13:29 -0700
Subject: [PATCH 024/231] xtrans 1.5.0 -> 1.6.0
This seems to "just work." Let's stay modern.
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 3e7adc828..0367faa8f 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -392,10 +392,10 @@
"version": "2019.1",
},
"xtrans": {
- "url": "https://www.x.org/archive/individual/lib/xtrans-1.5.0.tar.gz",
- "size": 230197,
- "sha256": "a806f8a92f879dcd0146f3f1153fdffe845f2fc0df9b1a26c19312b7b0a29c86",
- "version": "1.5.0",
+ "url": "https://www.x.org/archive/individual/lib/xtrans-1.6.0.tar.gz",
+ "size": 239113,
+ "sha256": "936b74c60b19c317c3f3cb1b114575032528dbdaf428740483200ea874c2ca0a",
+ "version": "1.6.0",
},
# IMPORTANT: xz 5.6 has a backdoor. Be extremely cautious before taking any xz
# upgrade since it isn't clear which versions are safe.
From dd0b436c269fc10f7b2781b699387d3f19bdd645 Mon Sep 17 00:00:00 2001
From: Gregory Szorc
Date: Fri, 16 May 2025 19:14:46 -0700
Subject: [PATCH 025/231] x11-util-macros 1.20.1 -> 1.20.2
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 0367faa8f..3d888e881 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -372,10 +372,10 @@
"license_file": "LICENSE.libuuid.txt",
},
"x11-util-macros": {
- "url": "https://www.x.org/archive/individual/util/util-macros-1.20.1.tar.gz",
- "size": 105481,
- "sha256": "b373f72887b1394ce2193180a60cb0d1fb8b17bc96ddd770cfd7a808cb489a15",
- "version": "1.20.1",
+ "url": "https://www.x.org/archive/individual/util/util-macros-1.20.2.tar.gz",
+ "size": 105410,
+ "sha256": "f642f8964d81acdf06653fdf9dbc210c43ce4bd308bd644a8d573148d0ced76b",
+ "version": "1.20.2",
},
"xcb-proto": {
"url": "https://xcb.freedesktop.org/dist/xcb-proto-1.17.0.tar.xz",
From d8ef90ad326e0e8b7074ba097df5a414288ff3c6 Mon Sep 17 00:00:00 2001
From: Gregory Szorc
Date: Fri, 16 May 2025 19:18:59 -0700
Subject: [PATCH 026/231] xorgproto 2019.1 -> 2024.1
I think deletion of the legacy proto packages a few commits ago fixed up
the build failures the deleted comment alluded to.
---
pythonbuild/downloads.py | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 3d888e881..c1cae140b 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -383,13 +383,11 @@
"sha256": "2c1bacd2110f4799f74de6ebb714b94cf6f80fb112316b1219480fd22562148c",
"version": "1.17.0",
},
- # Newer versions from at least 2023 have build failures for reasons we haven't
- # fully investigated.
"xorgproto": {
- "url": "https://www.x.org/archive/individual/proto/xorgproto-2019.1.tar.gz",
- "size": 1119813,
- "sha256": "38ad1d8316515785d53c5162b4b7022918e03c11d72a5bd9df0a176607f42bca",
- "version": "2019.1",
+ "url": "https://www.x.org/archive/individual/proto/xorgproto-2024.1.tar.gz",
+ "size": 1115486,
+ "sha256": "4f6b9b4faf91e5df8265b71843a91fc73dc895be6210c84117a996545df296ce",
+ "version": "2024.1",
},
"xtrans": {
"url": "https://www.x.org/archive/individual/lib/xtrans-1.6.0.tar.gz",
From 21cf744dda2d0e19329950a81a07d9067179f976 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Sat, 28 Jun 2025 14:04:53 -0500
Subject: [PATCH 027/231] Enable native builds on Linux aarch64
I just published an LLVM 20 toolchain for aarch64. The toolchain
has support for PGO and BOLT.
This commit switches the Linux aarch64 builds to be performed natively
on aarch64 machines. PGO and BOLT are enabled on the builds, hopefully
making them a bit faster.
---
.github/workflows/linux.yml | 18 +++----
ci-matrix.py | 2 +
ci-runners.yaml | 9 ++--
ci-targets.yaml | 6 +--
cpython-unix/Makefile | 12 ++---
cpython-unix/base.debian9.Dockerfile | 38 ++++++++++++++
cpython-unix/build-binutils.sh | 8 ++-
cpython-unix/build-main.py | 1 +
cpython-unix/build.debian9.Dockerfile | 16 ++++++
cpython-unix/build.py | 74 +++++++++++++++++----------
cpython-unix/gcc.debian9.Dockerfile | 14 +++++
cpython-unix/targets.yml | 21 ++++++--
pythonbuild/docker.py | 17 ++++--
pythonbuild/downloads.py | 7 +++
pythonbuild/utils.py | 14 +++++
15 files changed, 195 insertions(+), 62 deletions(-)
create mode 100644 cpython-unix/base.debian9.Dockerfile
create mode 100644 cpython-unix/build.debian9.Dockerfile
create mode 100644 cpython-unix/gcc.debian9.Dockerfile
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 8ae87e760..d4602fbe5 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -2,7 +2,7 @@ name: linux
on:
push:
- branches: [main]
+ branches: [ main ]
pull_request:
concurrency:
@@ -58,7 +58,7 @@ jobs:
strategy:
fail-fast: false
matrix: ${{ fromJson(needs.generate-matrix.outputs.docker-build-matrix) }}
- name: image / ${{ matrix.name }}
+ name: image / ${{ matrix.arch }} / ${{ matrix.name }}
runs-on: ${{ matrix.runner }}
permissions:
packages: write
@@ -100,23 +100,23 @@ jobs:
# Cache from the default branch of the canonical repo so forks can have cache hits.
# Ignore errors on cache writes so CI of forks works without a valid GHCR config.
cache-from: |
- type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.name }}-${{ env.GIT_REF_NAME }}
- type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.name }}-main
- type=registry,ref=ghcr.io/astral-sh/python-build-standalone:${{ matrix.name }}-main
+ type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.name }}-linux_${{ matrix.arch }}-${{ env.GIT_REF_NAME }}
+ type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.name }}-linux_${{ matrix.arch }}-main
+ type=registry,ref=ghcr.io/astral-sh/python-build-standalone:${{ matrix.name }}-linux_${{ matrix.arch }}-main
cache-to: |
- type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.name }}-${{ env.GIT_REF_NAME }},ignore-error=true
+ type=registry,ref=ghcr.io/${{ env.REPO_NAME }}:${{ matrix.name }}-linux_${{ matrix.arch }}-${{ env.GIT_REF_NAME }},ignore-error=true
outputs: |
- type=docker,dest=build/image-${{ matrix.name }}.tar
+ type=docker,dest=build/image-${{ matrix.name }}.linux_${{ matrix.arch }}.tar
- name: Compress Image
run: |
- echo ${{ steps.build-image.outputs.imageid }} > build/image-${{ matrix.name }}
+ echo ${{ steps.build-image.outputs.imageid }} > build/image-${{ matrix.name }}.linux_${{ matrix.arch }}
zstd -v -T0 -6 --rm build/image-*.tar
- name: Upload Docker Image
uses: actions/upload-artifact@v4
with:
- name: image-${{ matrix.name }}
+ name: image-${{ matrix.name }}-linux_${{ matrix.arch }}
path: build/image-*
generate-matrix:
diff --git a/ci-matrix.py b/ci-matrix.py
index cfccdd5e9..91cfa953b 100644
--- a/ci-matrix.py
+++ b/ci-matrix.py
@@ -25,7 +25,9 @@
{"name": "build", "arch": "x86_64"},
{"name": "build.cross", "arch": "x86_64"},
{"name": "build.cross-riscv64", "arch": "x86_64"},
+ {"name": "build.debian9", "arch": "aarch64"},
{"name": "gcc", "arch": "x86_64"},
+ {"name": "gcc.debian9", "arch": "aarch64"},
]
diff --git a/ci-runners.yaml b/ci-runners.yaml
index 43ff9414f..dae6aabc9 100644
--- a/ci-runners.yaml
+++ b/ci-runners.yaml
@@ -5,11 +5,10 @@ depot-ubuntu-22.04:
platform: linux
free: false
-# TODO: Enable this runner to perform native builds for aarch64
-# depot-ubuntu-22.04-arm:
-# arch: aarch64
-# platform: linux
-# free: false
+depot-ubuntu-22.04-arm:
+ arch: aarch64
+ platform: linux
+ free: false
depot-macos-latest:
arch: x86_64
diff --git a/ci-targets.yaml b/ci-targets.yaml
index c7b4bd12d..c59d5b7f5 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -50,13 +50,11 @@ linux:
- "3.14"
build_options:
- debug
- - noopt
- - lto
+ - pgo+lto
build_options_conditional:
- options:
- freethreaded+debug
- - freethreaded+noopt
- - freethreaded+lto
+ - freethreaded+pgo+lto
minimum-python-version: "3.13"
armv7-unknown-linux-gnueabi:
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
index 4cacaff3c..6e4b00700 100644
--- a/cpython-unix/Makefile
+++ b/cpython-unix/Makefile
@@ -66,7 +66,7 @@ TOOLCHAIN_DEPENDS := \
PYTHON_DEP_DEPENDS := \
$(OUTDIR)/targets/$(TARGET_TRIPLE) \
- $(if $(PYBUILD_NO_DOCKER),,$(OUTDIR)/image-$(DOCKER_IMAGE_BUILD).tar) \
+ $(if $(PYBUILD_NO_DOCKER),,$(OUTDIR)/image-$(DOCKER_IMAGE_BUILD).$(HOST_PLATFORM).tar) \
$(TOOLCHAIN_DEPENDS) \
$(NULL)
@@ -75,18 +75,18 @@ HOST_PYTHON_DEPENDS := $(OUTDIR)/cpython-$(PYTHON_MAJOR_VERSION)-$(CPYTHON_$(PYT
default: $(OUTDIR)/cpython-$(CPYTHON_$(PYTHON_MAJOR_VERSION)_VERSION)-$(PACKAGE_SUFFIX).tar
ifndef PYBUILD_NO_DOCKER
-$(OUTDIR)/image-%.tar: $(OUTDIR)/%.Dockerfile
+$(OUTDIR)/image-%.$(HOST_PLATFORM).tar: $(OUTDIR)/%.Dockerfile
$(RUN_BUILD) --toolchain image-$*
endif
-$(OUTDIR)/binutils-$(BINUTILS_VERSION)-$(HOST_PLATFORM).tar: $(OUTDIR)/image-gcc.tar $(HERE)/build-binutils.sh
- $(RUN_BUILD) --toolchain binutils
+$(OUTDIR)/binutils-$(BINUTILS_VERSION)-$(HOST_PLATFORM).tar: $(HERE)/build-binutils.sh
+ $(RUN_BUILD) --toolchain --docker-image $(DOCKER_IMAGE_GCC) binutils
$(OUTDIR)/$(CLANG_FILENAME):
$(RUN_BUILD) --toolchain clang --target-triple $(TARGET_TRIPLE)
$(OUTDIR)/musl-$(MUSL_VERSION)-$(HOST_PLATFORM).tar: $(BASE_TOOLCHAIN_DEPENDS) $(HERE)/build-musl.sh
- $(RUN_BUILD) --toolchain musl
+ $(RUN_BUILD) --toolchain musl --docker-image $(DOCKER_IMAGE_GCC)
ifeq ($(HOST_PLATFORM),linux_x86_64)
TOOLCHAIN_TARGET := $(OUTDIR)/musl-$(MUSL_VERSION)-$(HOST_PLATFORM).tar
@@ -125,7 +125,7 @@ $(OUTDIR)/libffi-3.3-$(LIBFFI_3.3_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_D
$(OUTDIR)/libffi-$(LIBFFI_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-libffi.sh
$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) libffi
-$(OUTDIR)/libpthread-stubs-$(LIBPTHREAD_STUBS_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-libpthread-stubs.sh $(OUTDIR)/image-$(DOCKER_IMAGE_BUILD).tar
+$(OUTDIR)/libpthread-stubs-$(LIBPTHREAD_STUBS_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-libpthread-stubs.sh $(OUTDIR)/image-$(DOCKER_IMAGE_BUILD).$(HOST_PLATFORM).tar
$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) libpthread-stubs
LIBX11_DEPENDS = \
diff --git a/cpython-unix/base.debian9.Dockerfile b/cpython-unix/base.debian9.Dockerfile
new file mode 100644
index 000000000..1b47b35a2
--- /dev/null
+++ b/cpython-unix/base.debian9.Dockerfile
@@ -0,0 +1,38 @@
+# Debian Stretch.
+FROM debian@sha256:c5c5200ff1e9c73ffbf188b4a67eb1c91531b644856b4aefe86a58d2f0cb05be
+MAINTAINER Gregory Szorc
+
+RUN groupadd -g 1000 build && \
+ useradd -u 1000 -g 1000 -d /build -s /bin/bash -m build && \
+ mkdir /tools && \
+ chown -R build:build /build /tools
+
+ENV HOME=/build \
+ SHELL=/bin/bash \
+ USER=build \
+ LOGNAME=build \
+ HOSTNAME=builder \
+ DEBIAN_FRONTEND=noninteractive
+
+CMD ["/bin/bash", "--login"]
+WORKDIR '/build'
+
+RUN for s in debian_stretch debian_stretch-updates debian-security_stretch/updates; do \
+ echo "deb http://snapshot.debian.org/archive/${s%_*}/20230423T032736Z/ ${s#*_} main"; \
+ done > /etc/apt/sources.list && \
+ ( echo 'quiet "true";'; \
+ echo 'APT::Get::Assume-Yes "true";'; \
+ echo 'APT::Install-Recommends "false";'; \
+ echo 'Acquire::Check-Valid-Until "false";'; \
+ echo 'Acquire::Retries "5";'; \
+ ) > /etc/apt/apt.conf.d/99cpython-portable
+
+# apt iterates all available file descriptors up to rlim_max and calls
+# fcntl(fd, F_SETFD, FD_CLOEXEC). This can result in millions of system calls
+# (we've seen 1B in the wild) and cause operations to take seconds to minutes.
+# Setting a fd limit mitigates.
+#
+# Attempts at enforcing the limit globally via /etc/security/limits.conf and
+# /root/.bashrc were not successful. Possibly because container image builds
+# don't perform a login or use a shell the way we expect.
+RUN ulimit -n 10000 && apt-get update
diff --git a/cpython-unix/build-binutils.sh b/cpython-unix/build-binutils.sh
index c52e8238b..2bb89364b 100755
--- a/cpython-unix/build-binutils.sh
+++ b/cpython-unix/build-binutils.sh
@@ -11,9 +11,15 @@ tar -xf binutils-${BINUTILS_VERSION}.tar.xz
mkdir binutils-objdir
pushd binutils-objdir
+if [ "$(uname -m)" = "x86_64" ]; then
+ triple="x86_64-unknown-linux-gnu"
+else
+ triple="aarch64-unknown-linux-gnu"
+fi
+
# gprofng requires a bison newer than what we have. So just disable it.
../binutils-${BINUTILS_VERSION}/configure \
- --build=x86_64-unknown-linux-gnu \
+ --build=${triple} \
--prefix=/tools/host \
--enable-plugins \
--enable-gprofng=no \
diff --git a/cpython-unix/build-main.py b/cpython-unix/build-main.py
index a353daf27..7a7d08b10 100755
--- a/cpython-unix/build-main.py
+++ b/cpython-unix/build-main.py
@@ -95,6 +95,7 @@ def main():
"toolchain-image-build",
"toolchain-image-build.cross",
"toolchain-image-build.cross-riscv64",
+ "toolchain-image-build.debian9",
"toolchain-image-gcc",
"toolchain-image-xcb",
"toolchain-image-xcb.cross",
diff --git a/cpython-unix/build.debian9.Dockerfile b/cpython-unix/build.debian9.Dockerfile
new file mode 100644
index 000000000..1f7c91b6c
--- /dev/null
+++ b/cpython-unix/build.debian9.Dockerfile
@@ -0,0 +1,16 @@
+{% include 'base.debian9.Dockerfile' %}
+
+RUN ulimit -n 10000 && apt-get install \
+ bzip2 \
+ file \
+ libc6-dev \
+ libffi-dev \
+ make \
+ patch \
+ perl \
+ pkg-config \
+ tar \
+ xz-utils \
+ unzip \
+ zip \
+ zlib1g-dev
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index 6f98e990f..01d39b2a9 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -88,14 +88,21 @@ def add_target_env(env, build_platform, target_triple, build_env):
extra_host_cflags = []
extra_host_ldflags = []
- if build_platform == "linux_x86_64":
- env["BUILD_TRIPLE"] = "x86_64-unknown-linux-gnu"
+ if build_platform.startswith("linux_"):
+ machine = platform.machine()
- env["TARGET_TRIPLE"] = (
- target_triple.replace("x86_64_v2-", "x86_64-")
- .replace("x86_64_v3-", "x86_64-")
- .replace("x86_64_v4-", "x86_64-")
- )
+ if machine == "aarch64":
+ env["BUILD_TRIPLE"] = "aarch64-unknown-linux-gnu"
+ env["TARGET_TRIPLE"] = target_triple
+ elif machine == "x86_64":
+ env["BUILD_TRIPLE"] = "x86_64-unknown-linux-gnu"
+ env["TARGET_TRIPLE"] = (
+ target_triple.replace("x86_64_v2-", "x86_64-")
+ .replace("x86_64_v3-", "x86_64-")
+ .replace("x86_64_v4-", "x86_64-")
+ )
+ else:
+ raise Exception("unhandled Linux machine value: %s" % machine)
# This will make x86_64_v2, etc count as cross-compiling. This is
# semantically correct, since the current machine may not support
@@ -105,7 +112,7 @@ def add_target_env(env, build_platform, target_triple, build_env):
):
env["CROSS_COMPILING"] = "1"
- if build_platform.startswith("macos_"):
+ elif build_platform.startswith("macos_"):
machine = platform.machine()
if machine == "arm64":
@@ -188,6 +195,8 @@ def add_target_env(env, build_platform, target_triple, build_env):
extra_host_cflags.extend(["-isysroot", host_sdk_path])
extra_host_ldflags.extend(["-isysroot", host_sdk_path])
+ else:
+ raise Exception("unhandled build platform: %s" % build_platform)
env["EXTRA_HOST_CFLAGS"] = " ".join(extra_host_cflags)
env["EXTRA_HOST_LDFLAGS"] = " ".join(extra_host_ldflags)
@@ -496,10 +505,14 @@ def python_build_info(
binary_suffix = ""
- if platform == "linux_x86_64":
+ if platform in ("linux_x86_64", "linux_aarch64"):
+ arch = platform.removeprefix("linux_")
+
bi["core"]["static_lib"] = (
- "install/lib/python{version}/config-{version}{binary_suffix}-x86_64-linux-gnu/libpython{version}{binary_suffix}.a".format(
- version=version, binary_suffix=binary_suffix
+ "install/lib/python{version}/config-{version}{binary_suffix}-{arch}-linux-gnu/libpython{version}{binary_suffix}.a".format(
+ version=version,
+ binary_suffix=binary_suffix,
+ arch=arch,
)
)
@@ -579,7 +592,10 @@ def python_build_info(
if lib.startswith("-l"):
lib = lib[2:]
- if platform == "linux_x86_64" and lib not in linux_allowed_system_libraries:
+ if (
+ platform in ("linux_x86_64", "linux_aarch64")
+ and lib not in linux_allowed_system_libraries
+ ):
raise Exception("unexpected library in LIBS (%s): %s" % (libs, lib))
elif (
platform.startswith("macos_")
@@ -851,7 +867,7 @@ def build_cpython(
extension_module_loading = ["builtin"]
crt_features = []
- if host_platform == "linux_x86_64":
+ if host_platform in ("linux_x86_64", "linux_aarch64"):
if "static" in parsed_build_options:
crt_features.append("static")
else:
@@ -1080,10 +1096,14 @@ def main():
with image_path.open("rb") as fh:
image_data = fh.read()
- build_docker_image(client, image_data, BUILD, image_name)
+ build_docker_image(client, image_data, BUILD, image_name, host_platform)
elif action == "binutils":
- build_binutils(client, get_image(client, ROOT, BUILD, "gcc"), host_platform)
+ build_binutils(
+ client,
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
+ host_platform,
+ )
elif action == "clang":
materialize_clang(host_platform, target_triple)
@@ -1091,7 +1111,7 @@ def main():
elif action == "musl":
build_musl(
client,
- get_image(client, ROOT, BUILD, "gcc"),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
host_platform,
target_triple,
build_options,
@@ -1101,7 +1121,7 @@ def main():
simple_build(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
action,
host_platform=host_platform,
target_triple=target_triple,
@@ -1115,7 +1135,7 @@ def main():
build_libedit(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
host_platform=host_platform,
target_triple=target_triple,
build_options=build_options,
@@ -1149,7 +1169,7 @@ def main():
simple_build(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
action,
host_platform=host_platform,
target_triple=target_triple,
@@ -1162,7 +1182,7 @@ def main():
simple_build(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
action,
host_platform=host_platform,
target_triple=target_triple,
@@ -1182,7 +1202,7 @@ def main():
simple_build(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
action,
host_platform=host_platform,
target_triple=target_triple,
@@ -1195,7 +1215,7 @@ def main():
simple_build(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
action,
host_platform=host_platform,
target_triple=target_triple,
@@ -1208,7 +1228,7 @@ def main():
simple_build(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
action,
host_platform=host_platform,
target_triple=target_triple,
@@ -1222,7 +1242,7 @@ def main():
build_tix(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
host_platform=host_platform,
target_triple=target_triple,
build_options=build_options,
@@ -1243,7 +1263,7 @@ def main():
simple_build(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
action,
host_platform=host_platform,
target_triple=target_triple,
@@ -1256,7 +1276,7 @@ def main():
elif action.startswith("cpython-") and action.endswith("-host"):
build_cpython_host(
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
action[:-5],
host_platform=host_platform,
target_triple=target_triple,
@@ -1275,7 +1295,7 @@ def main():
build_cpython(
settings,
client,
- get_image(client, ROOT, BUILD, docker_image),
+ get_image(client, ROOT, BUILD, docker_image, host_platform),
host_platform=host_platform,
target_triple=target_triple,
build_options=build_options,
diff --git a/cpython-unix/gcc.debian9.Dockerfile b/cpython-unix/gcc.debian9.Dockerfile
new file mode 100644
index 000000000..92d764e82
--- /dev/null
+++ b/cpython-unix/gcc.debian9.Dockerfile
@@ -0,0 +1,14 @@
+{% include 'base.debian9.Dockerfile' %}
+RUN ulimit -n 10000 && apt-get install \
+ autoconf \
+ automake \
+ bison \
+ build-essential \
+ gawk \
+ gcc \
+ libtool \
+ make \
+ tar \
+ texinfo \
+ xz-utils \
+ unzip
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index 1b47dba4b..95ef58b2d 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -156,6 +156,7 @@ aarch64-apple-ios:
aarch64-unknown-linux-gnu:
host_platforms:
- linux_x86_64
+ - linux_aarch64
pythons_supported:
- '3.9'
- '3.10'
@@ -163,11 +164,16 @@ aarch64-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
- docker_image_suffix: .cross
- host_cc: /usr/bin/x86_64-linux-gnu-gcc
- host_cxx: /usr/bin/x86_64-linux-gnu-g++
- target_cc: /usr/bin/aarch64-linux-gnu-gcc
- target_cxx: /usr/bin/aarch64-linux-gnu-g++
+ docker_image_suffix: .debian9
+ needs_toolchain: true
+ host_cc: clang
+ host_cxx: clang++
+ target_cc: clang
+ target_cxx: clang++
+ target_cflags:
+ - '-fvisibility=hidden'
+ # Needed to prevent BOLT from crashing.
+ - '-fdebug-default-version=4'
needs:
- autoconf
- bdb
@@ -193,6 +199,11 @@ aarch64-unknown-linux-gnu:
- xz
- zlib
openssl_target: linux-aarch64
+ # Blocked on:
+ # BOLT-ERROR: Cannot relax adr in non-simple function
+ # trampoline_code_table/1. Use --strict option to override
+ # See https://github.com/llvm/llvm-project/issues/146541
+ # bolt_capable: true
arm64-apple-tvos:
host_platforms:
diff --git a/pythonbuild/docker.py b/pythonbuild/docker.py
index 4269b2bdc..0be78e4f8 100644
--- a/pythonbuild/docker.py
+++ b/pythonbuild/docker.py
@@ -29,8 +29,10 @@ def write_dockerfiles(source_dir: pathlib.Path, dest_dir: pathlib.Path):
write_if_different(dest_dir / f, data.encode("utf-8"))
-def build_docker_image(client, image_data: bytes, image_dir: pathlib.Path, name):
- image_path = image_dir / ("image-%s" % name)
+def build_docker_image(
+ client, image_data: bytes, image_dir: pathlib.Path, name, host_platform
+):
+ image_path = image_dir / f"image-{name}.{host_platform}"
return ensure_docker_image(client, io.BytesIO(image_data), image_path=image_path)
@@ -66,11 +68,14 @@ def ensure_docker_image(client, fh, image_path=None):
return image
-def get_image(client, source_dir: pathlib.Path, image_dir: pathlib.Path, name):
+def get_image(
+ client, source_dir: pathlib.Path, image_dir: pathlib.Path, name, host_platform
+):
if client is None:
return None
- image_path = image_dir / ("image-%s" % name)
+ image_name = f"image-{name}.{host_platform}"
+ image_path = image_dir / image_name
tar_path = image_path.with_suffix(".tar")
with image_path.open("r") as fh:
@@ -88,7 +93,9 @@ def get_image(client, source_dir: pathlib.Path, image_dir: pathlib.Path, name):
return image_id
else:
- return build_docker_image(client, str(source_dir).encode(), image_dir, name)
+ return build_docker_image(
+ client, str(source_dir).encode(), image_dir, name, host_platform
+ )
def copy_file_to_container(path, container, container_path, archive_path=None):
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index c1cae140b..24a9917ea 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -172,6 +172,13 @@
"version": "14.0.3+20220508",
},
# Remember to update LLVM_URL in src/release.rs whenever upgrading.
+ "llvm-20-aarch64-linux": {
+ "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20250511/llvm-20.1.4+20250511-gnu_only-aarch64-unknown-linux-gnu.tar.zst",
+ "size": 255946687,
+ "sha256": "e70753f294b8f83fffbaf07af36857c27ceaef0291cb10f724ada6af11b0a5bc",
+ "version": "20.1.4+20250511",
+ },
+ # Remember to update LLVM_URL in src/release.rs whenever upgrading.
"llvm-20-x86_64-linux": {
"url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20250511/llvm-20.1.4+20250511-gnu_only-x86_64-unknown-linux-gnu.tar.zst",
"size": 299883811,
diff --git a/pythonbuild/utils.py b/pythonbuild/utils.py
index a8132ca83..0edc11d7f 100644
--- a/pythonbuild/utils.py
+++ b/pythonbuild/utils.py
@@ -39,6 +39,8 @@ def current_host_platform() -> str:
if sys.platform == "linux":
if machine == "x86_64":
return "linux_x86_64"
+ elif machine == "aarch64":
+ return "linux_aarch64"
else:
raise Exception(f"unsupported Linux host platform: {machine}")
elif sys.platform == "darwin":
@@ -57,6 +59,8 @@ def default_target_triple() -> str:
host = current_host_platform()
if host == "linux_x86_64":
return "x86_64-unknown-linux-gnu"
+ elif host == "linux_aarch64":
+ return "aarch64-unknown-linux-gnu"
elif host == "macos_arm64":
return "aarch64-apple-darwin"
elif host == "macos_x86_64":
@@ -84,6 +88,8 @@ def supported_targets(yaml_path: pathlib.Path):
for host_platform in settings["host_platforms"]:
if sys.platform == "linux" and host_platform == "linux_x86_64":
targets.add(target)
+ elif sys.platform == "linux" and host_platform == "linux_aarch64":
+ targets.add(target)
elif sys.platform == "darwin" and host_platform.startswith("macos_"):
targets.add(target)
@@ -194,7 +200,13 @@ def write_triples_makefiles(
image_suffix = settings.get("docker_image_suffix", "")
+ # On cross builds, we can just use the bare `gcc` image
+ gcc_image_suffix = (
+ image_suffix if not image_suffix.startswith(".cross") else ""
+ )
+
lines.append("DOCKER_IMAGE_BUILD := build%s\n" % image_suffix)
+ lines.append("DOCKER_IMAGE_GCC := gcc%s\n" % gcc_image_suffix)
entry = clang_toolchain(host_platform, triple)
lines.append(
@@ -470,6 +482,8 @@ def clang_toolchain(host_platform: str, target_triple: str) -> str:
return "llvm-14-x86_64-linux"
else:
return "llvm-20-x86_64-linux"
+ elif host_platform == "linux_aarch64":
+ return "llvm-20-aarch64-linux"
elif host_platform == "macos_arm64":
return "llvm-aarch64-macos"
elif host_platform == "macos_x86_64":
From 9bb8bcbeab73b8a962aba962c00f469cbe2cb9b3 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Wed, 2 Jul 2025 12:30:14 -0500
Subject: [PATCH 028/231] Update wanted release targets for
`aarch64-unknown-linux-gnu` (#681)
Following #670
---
src/release.rs | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/release.rs b/src/release.rs
index d4f890ee2..0b67888d5 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -168,12 +168,12 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
h.insert(
"aarch64-unknown-linux-gnu",
TripleRelease {
- suffixes: linux_suffixes_nopgo.clone(),
- install_only_suffix: "lto",
+ suffixes: linux_suffixes_pgo.clone(),
+ install_only_suffix: "pgo+lto",
python_version_requirement: None,
conditional_suffixes: vec![ConditionalSuffixes {
python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
- suffixes: linux_suffixes_nopgo_freethreaded.clone(),
+ suffixes: linux_suffixes_pgo_freethreaded.clone(),
}],
},
);
From aaf602236d4cf3e2bd207dfd8f9d45cd0870d58d Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Sat, 5 Jul 2025 11:23:20 -0500
Subject: [PATCH 029/231] Add zstd support for Python 3.14+ on Unix (#682)
This task was deferred from the initial Python 3.14 support. There's
already support on Windows.
---
cpython-unix/Makefile | 4 ++
cpython-unix/build-cpython.sh | 2 +-
cpython-unix/build-zstd.sh | 63 ++++++++++++++++++++++++++++++
cpython-unix/build.py | 1 +
cpython-unix/extension-modules.yml | 7 ++--
cpython-unix/targets.yml | 24 ++++++++++++
src/validation.rs | 4 +-
7 files changed, 98 insertions(+), 7 deletions(-)
create mode 100755 cpython-unix/build-zstd.sh
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
index 6e4b00700..dcb239aa8 100644
--- a/cpython-unix/Makefile
+++ b/cpython-unix/Makefile
@@ -236,6 +236,9 @@ $(OUTDIR)/xz-$(XZ_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/
$(OUTDIR)/zlib-$(ZLIB_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-zlib.sh
$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) zlib
+$(OUTDIR)/zstd-$(ZSTD_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-zstd.sh
+ $(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) zstd
+
PYTHON_HOST_DEPENDS := \
$(PYTHON_DEP_DEPENDS) \
$(HERE)/build-cpython-host.sh \
@@ -272,6 +275,7 @@ PYTHON_DEPENDS_$(1) := \
$$(if $$(NEED_UUID),$$(OUTDIR)/uuid-$$(UUID_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_XZ),$$(OUTDIR)/xz-$$(XZ_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_ZLIB),$$(OUTDIR)/zlib-$$(ZLIB_VERSION)-$$(PACKAGE_SUFFIX).tar) \
+ $$(if $$(NEED_ZSTD),$$(OUTDIR)/zstd-$$(ZSTD_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(NULL)
ALL_PYTHON_DEPENDS_$(1) = \
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index ce88e6c70..4a85ba73d 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -1213,7 +1213,7 @@ ${BUILD_PYTHON} ${ROOT}/fix_shebangs.py ${ROOT}/out/python/install
# downstream consumers.
OBJECT_DIRS="Objects Parser Parser/lexer Parser/pegen Parser/tokenizer Programs Python Python/deepfreeze"
OBJECT_DIRS="${OBJECT_DIRS} Modules"
-for ext in _blake2 cjkcodecs _ctypes _ctypes/darwin _decimal _expat _hacl _io _multiprocessing _sha3 _sqlite _sre _testinternalcapi _xxtestfuzz ; do
+for ext in _blake2 cjkcodecs _ctypes _ctypes/darwin _decimal _expat _hacl _io _multiprocessing _sha3 _sqlite _sre _testinternalcapi _xxtestfuzz _zstd; do
OBJECT_DIRS="${OBJECT_DIRS} Modules/${ext}"
done
diff --git a/cpython-unix/build-zstd.sh b/cpython-unix/build-zstd.sh
new file mode 100755
index 000000000..e81ef7817
--- /dev/null
+++ b/cpython-unix/build-zstd.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+set -ex
+
+ROOT=`pwd`
+
+export PATH=${TOOLS_PATH}/${TOOLCHAIN}/bin:${TOOLS_PATH}/host/bin:$PATH
+export PREFIX="/tools/deps"
+
+tar -xf zstd-${ZSTD_VERSION}.tar.gz
+
+pushd cpython-source-deps-zstd-${ZSTD_VERSION}/lib
+
+if [ "${CC}" = "musl-clang" ]; then
+ # In order to build the library with SSE2, BMI, and AVX2 intrinstics, we need musl-clang to find
+ # headers that provide access to the intrinsics, as they are not provided by musl. These are
+ # part of the include files that are part of clang. But musl-clang eliminates them from the
+ # default include path. So copy them into place.
+ for h in ${TOOLS_PATH}/${TOOLCHAIN}/lib/clang/*/include/*intrin.h ${TOOLS_PATH}/${TOOLCHAIN}/lib/clang/*/include/{__wmmintrin_aes.h,__wmmintrin_pclmul.h,emmintrin.h,immintrin.h,mm_malloc.h}; do
+ filename=$(basename "$h")
+ if [ -e "${TOOLS_PATH}/host/include/${filename}" ]; then
+ echo "warning: ${filename} already exists"
+ fi
+ cp "$h" ${TOOLS_PATH}/host/include/
+ done
+ EXTRA_TARGET_CFLAGS="${EXTRA_TARGET_CFLAGS} -I${TOOLS_PATH}/host/include/"
+
+ # `qsort_r` is only available in musl 1.2.3+ but we use 1.2.2. The zstd source provides a
+ # fallback implementation, but they do not have a `configure`-style detection of whether
+ # `qsort_r` is actually available so we patch it to include a check for glibc.
+ patch -p1 <suffix, ctx->suffixSize, sizeof(U32),
+ ctx,
+ (ctx->d <= 8 ? &COVER_strict_cmp8 : &COVER_strict_cmp));
+-#elif defined(_GNU_SOURCE)
++#elif defined(_GNU_SOURCE) && defined(__GLIBC__)
+ qsort_r(ctx->suffix, ctx->suffixSize, sizeof(U32),
+ (ctx->d <= 8 ? &COVER_strict_cmp8 : &COVER_strict_cmp),
+ ctx);
+EOF
+fi
+
+CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" make -j ${NUM_CPUS} libzstd.a
+make -j ${NUM_CPUS} install-static DESTDIR=${ROOT}/out
+make -j ${NUM_CPUS} install-includes DESTDIR=${ROOT}/out
+make -j ${NUM_CPUS} install-pc DESTDIR=${ROOT}/out
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index 01d39b2a9..b35d17211 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -1163,6 +1163,7 @@ def main():
"xtrans",
"xz",
"zlib",
+ "zstd",
):
tools_path = "host" if action in ("m4", "patchelf") else "deps"
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index 3d69f049b..4b8345630 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -772,15 +772,14 @@ _xxtestfuzz:
- _xxtestfuzz/fuzzer.c
_zstd:
- # Disable on all targets until we add a zstd library
- disabled-targets:
- - .*
minimum-python-version: '3.14'
sources:
- _zstd/_zstdmodule.c
- - _zstd/zdict.c
+ - _zstd/zstddict.c
- _zstd/compressor.c
- _zstd/decompressor.c
+ links:
+ - zstd
_zoneinfo:
minimum-python-version: "3.9"
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index 95ef58b2d..33db80c8a 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -108,6 +108,7 @@ aarch64-apple-darwin:
- tk
- uuid
- xz
+ - zstd
openssl_target: darwin64-arm64-cc
aarch64-apple-ios:
@@ -151,6 +152,7 @@ aarch64-apple-ios:
- openssl-3.0
- sqlite
- xz
+ - zstd
openssl_target: ios64-cross
aarch64-unknown-linux-gnu:
@@ -198,6 +200,7 @@ aarch64-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-aarch64
# Blocked on:
# BOLT-ERROR: Cannot relax adr in non-simple function
@@ -245,6 +248,7 @@ arm64-apple-tvos:
- openssl-3.0
- sqlite
- xz
+ - zstd
openssl_target: todo
armv7-unknown-linux-gnueabi:
@@ -286,6 +290,7 @@ armv7-unknown-linux-gnueabi:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-armv4
armv7-unknown-linux-gnueabihf:
@@ -327,6 +332,7 @@ armv7-unknown-linux-gnueabihf:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-armv4
mips-unknown-linux-gnu:
@@ -368,6 +374,7 @@ mips-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-mips32
mipsel-unknown-linux-gnu:
@@ -409,6 +416,7 @@ mipsel-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-mips32
ppc64le-unknown-linux-gnu:
@@ -450,6 +458,7 @@ ppc64le-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-ppc64le
riscv64-unknown-linux-gnu:
@@ -491,6 +500,7 @@ riscv64-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux64-riscv64
s390x-unknown-linux-gnu:
@@ -532,6 +542,7 @@ s390x-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux64-s390x
thumb7k-apple-watchos:
@@ -574,6 +585,7 @@ thumb7k-apple-watchos:
- openssl-3.0
- sqlite
- xz
+ - zstd
openssl_target: todo
# Intel macOS.
@@ -629,6 +641,7 @@ x86_64-apple-darwin:
- tk
- uuid
- xz
+ - zstd
openssl_target: darwin64-x86_64-cc
x86_64-apple-ios:
@@ -672,6 +685,7 @@ x86_64-apple-ios:
- openssl-3.0
- sqlite
- xz
+ - zstd
openssl_target: darwin64-x86_64-cc
x86_64-apple-tvos:
@@ -714,6 +728,7 @@ x86_64-apple-tvos:
- openssl-3.0
- sqlite
- xz
+ - zstd
openssl_target: todo
x86_64-apple-watchos:
@@ -756,6 +771,7 @@ x86_64-apple-watchos:
- openssl-3.0
- sqlite
- xz
+ - zstd
openssl_target: todo
x86_64-unknown-linux-gnu:
@@ -801,6 +817,7 @@ x86_64-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-x86_64
bolt_capable: true
@@ -848,6 +865,7 @@ x86_64_v2-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-x86_64
bolt_capable: true
@@ -895,6 +913,7 @@ x86_64_v3-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-x86_64
bolt_capable: true
@@ -942,6 +961,7 @@ x86_64_v4-unknown-linux-gnu:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-x86_64
bolt_capable: true
@@ -987,6 +1007,7 @@ x86_64-unknown-linux-musl:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-x86_64
x86_64_v2-unknown-linux-musl:
@@ -1032,6 +1053,7 @@ x86_64_v2-unknown-linux-musl:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-x86_64
x86_64_v3-unknown-linux-musl:
@@ -1077,6 +1099,7 @@ x86_64_v3-unknown-linux-musl:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-x86_64
x86_64_v4-unknown-linux-musl:
@@ -1122,4 +1145,5 @@ x86_64_v4-unknown-linux-musl:
- xorgproto
- xz
- zlib
+ - zstd
openssl_target: linux-x86_64
diff --git a/src/validation.rs b/src/validation.rs
index 9084754b3..5ab717086 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -778,6 +778,7 @@ const GLOBAL_EXTENSIONS_PYTHON_3_14: &[&str] = &[
"_zoneinfo",
"_hmac",
"_types",
+ "_zstd",
];
const GLOBAL_EXTENSIONS_MACOS: &[&str] = &["_scproxy"];
@@ -813,8 +814,7 @@ const GLOBAL_EXTENSIONS_WINDOWS: &[&str] = &[
"winsound",
];
-// TODO(zanieb): Move `_zstd` to non-Windows specific once we add support on Unix.
-const GLOBAL_EXTENSIONS_WINDOWS_3_14: &[&str] = &["_wmi", "_zstd"];
+const GLOBAL_EXTENSIONS_WINDOWS_3_14: &[&str] = &["_wmi"];
const GLOBAL_EXTENSIONS_WINDOWS_PRE_3_13: &[&str] = &["_msi"];
From ec8ee638adb2f1c579a0b4f7a87e73a2949cb204 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 6 Jul 2025 11:06:27 -0500
Subject: [PATCH 030/231] Bump urllib3 from 2.4.0 to 2.5.0 (#665)
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/astral-sh/python-build-standalone/network/alerts).
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
requirements.win.txt | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/requirements.win.txt b/requirements.win.txt
index d37a96ff4..b9b9a8148 100644
--- a/requirements.win.txt
+++ b/requirements.win.txt
@@ -431,9 +431,9 @@ typing-extensions==4.13.2 \
--hash=sha256:a439e7c04b49fec3e5d3e2beaa21755cadbbdc391694e28ccdd36ca4a1408f8c \
--hash=sha256:e6c81219bd689f51865d9e372991c540bda33a0379d5573cddb9a3a23f7caaef
# via -r requirements.in
-urllib3==2.4.0 \
- --hash=sha256:414bc6535b787febd7567804cc015fee39daab8ad86268f1310a9250697de466 \
- --hash=sha256:4e16665048960a0900c702d4a66415956a584919c03361cac9f1df5c5dd7e813
+urllib3==2.5.0 \
+ --hash=sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760 \
+ --hash=sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc
# via
# docker
# requests
From 9b796d4a5ca2af49761c8e5156fc110b9a70fb53 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Mon, 7 Jul 2025 15:19:14 -0500
Subject: [PATCH 031/231] Bump SQLite to `3.49.1.0` (#667)
Closes https://github.com/astral-sh/python-build-standalone/issues/666
---
cpython-unix/build-sqlite.sh | 15 +++++++++++----
pythonbuild/downloads.py | 10 +++++-----
src/verify_distribution.py | 2 +-
3 files changed, 17 insertions(+), 10 deletions(-)
diff --git a/cpython-unix/build-sqlite.sh b/cpython-unix/build-sqlite.sh
index b045bb881..e01e3077d 100755
--- a/cpython-unix/build-sqlite.sh
+++ b/cpython-unix/build-sqlite.sh
@@ -14,7 +14,7 @@ pushd sqlite-autoconf-${SQLITE_VERSION}
CONFIGURE_FLAGS="--build=${BUILD_TRIPLE} --host=${TARGET_TRIPLE}"
-CONFIGURE_FLAGS="${CONFIGURE_FLAGS} --prefix /tools/deps --disable-shared"
+CONFIGURE_FLAGS="${CONFIGURE_FLAGS} --prefix=/tools/deps --disable-shared"
if [ "${TARGET_TRIPLE}" = "aarch64-apple-ios" ]; then
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_search_system=no"
@@ -22,7 +22,14 @@ elif [ "${TARGET_TRIPLE}" = "x86_64-apple-ios" ]; then
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_search_system=no"
fi
-CFLAGS="${EXTRA_TARGET_CFLAGS} -DSQLITE_ENABLE_DBSTAT_VTAB -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS3_TOKENIZER -fPIC" CPPFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" ./configure ${CONFIGURE_FLAGS}
+# The SQLite autosetup looks for the C++ compiler if the variable is set and will fail if it's not
+# found, even if it's not needed. We don't actually have a C++ compiler in some builds, so ensure
+# it's not looked for.
+unset CXX
-make -j ${NUM_CPUS}
-make -j ${NUM_CPUS} install DESTDIR=${ROOT}/out
+CC_FOR_BUILD="${HOST_CC}" CFLAGS="${EXTRA_TARGET_CFLAGS} -DSQLITE_ENABLE_DBSTAT_VTAB -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS3_TOKENIZER -fPIC" CPPFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" ./configure ${CONFIGURE_FLAGS}
+
+make -j ${NUM_CPUS} libsqlite3.a
+make install-lib DESTDIR=${ROOT}/out
+make install-headers DESTDIR=${ROOT}/out
+make install-pc DESTDIR=${ROOT}/out
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 24a9917ea..a208ce568 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -295,11 +295,11 @@
},
# Remember to update verify_distribution.py when version changed.
"sqlite": {
- "url": "https://www.sqlite.org/2024/sqlite-autoconf-3470100.tar.gz",
- "size": 3328564,
- "sha256": "416a6f45bf2cacd494b208fdee1beda509abda951d5f47bc4f2792126f01b452",
- "version": "3470100",
- "actual_version": "3.47.1.0",
+ "url": "https://www.sqlite.org/2025/sqlite-autoconf-3490100.tar.gz",
+ "size": 3226385,
+ "sha256": "106642d8ccb36c5f7323b64e4152e9b719f7c0215acf5bfeac3d5e7f97b59254",
+ "version": "3490100",
+ "actual_version": "3.49.1.0",
"library_names": ["sqlite3"],
"licenses": [],
"license_file": "LICENSE.sqlite.txt",
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 2131d7aa9..1ac2381f4 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -114,7 +114,7 @@ def test_hashlib(self):
def test_sqlite(self):
import sqlite3
- self.assertEqual(sqlite3.sqlite_version_info, (3, 47, 1))
+ self.assertEqual(sqlite3.sqlite_version_info, (3, 49, 1))
# Optional SQLite3 features are enabled.
conn = sqlite3.connect(":memory:")
From 625ad3072a441c1dec616b23cc0d8ea95db04e79 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 7 Jul 2025 15:19:24 -0500
Subject: [PATCH 032/231] Bump the python group across 1 directory with 6
updates (#688)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the python group with 6 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [certifi](https://github.com/certifi/python-certifi) | `2025.4.26` |
`2025.6.15` |
| [pyyaml](https://github.com/yaml/pyyaml) | `6.0.1` | `6.0.2` |
| [rpds-py](https://github.com/crate-py/rpds) | `0.25.1` | `0.26.0` |
| [typing-extensions](https://github.com/python/typing_extensions) |
`4.13.2` | `4.14.1` |
| [mypy](https://github.com/python/mypy) | `1.16.0` | `1.16.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.11.13` | `0.12.2` |
Updates `certifi` from 2025.4.26 to 2025.6.15
Commits
e767d59
2025.06.15 (#357)
3e70765
Bump actions/setup-python from 5.5.0 to 5.6.0
9afd2ff
Bump actions/download-artifact from 4.2.1 to 4.3.0
d7c816c
remove code that's no longer required that 3.7 is our minimum (#351)
1899613
Declare setuptools as the build backend in pyproject.toml (#350)
c874142
update CI for ubuntu 20.04 deprecation (#348)
- See full diff in compare
view
Updates `pyyaml` from 6.0.1 to 6.0.2
Release notes
Sourced from pyyaml's
releases.
6.0.2
What's Changed
- Support for Cython 3.x and Python 3.13.
Full Changelog: https://github.com/yaml/pyyaml/compare/6.0.1...6.0.2
6.0.2rc1
- Support for extension build with Cython 3.x
- Support for Python 3.13
- Added PyPI wheels for musllinux on aarch64
Changelog
Sourced from pyyaml's
changelog.
6.0.2 (2024-08-06)
Commits
Updates `rpds-py` from 0.25.1 to 0.26.0
Release notes
Sourced from rpds-py's
releases.
v0.26.0
What's Changed
Full Changelog: https://github.com/crate-py/rpds/compare/v0.25.1...v0.26.0
Commits
ff9278f
Tag a release.
d2f69ef
Update requirements.
58ee607
Merge pull request #146
from edgarrmondragon/136-require-maturin-1.9-pep639
5433ab6
Require maturin>=1.9.0 to ensure support for PEP 639
7557e53
Merge pull request #144
from crate-py/dependabot/github_actions/github/codeql...
d0963ae
Merge pull request #145
from crate-py/dependabot/github_actions/astral-sh/set...
513ec22
Bump astral-sh/setup-uv from 6.3.0 to 6.3.1
cbb4277
Bump github/codeql-action from 3.29.0 to 3.29.2
25123e9
Merge pull request #143
from crate-py/dependabot/github_actions/PyO3/maturin-...
7a59bb7
Merge pull request #142
from crate-py/dependabot/github_actions/astral-sh/set...
- Additional commits viewable in compare
view
Updates `typing-extensions` from 4.13.2 to 4.14.1
Release notes
Sourced from typing-extensions's
releases.
4.14.1
Release 4.14.1 (July 4, 2025)
- Fix usage of
typing_extensions.TypedDict nested inside
other types
(e.g., typing.Type[typing_extensions.TypedDict]). This is
not allowed by the
type system but worked on older versions, so we maintain support.
4.14.0
This release adds several new features, including experimental
support for inline typed dictionaries (PEP 764) and sentinels (PEP 661), and support for
changes in Python 3.14. In addition, Python 3.8 is no longer
supported.
Changes since 4.14.0rc1:
- Remove
__or__ and __ror__ methods from
typing_extensions.Sentinel
on Python versions <3.10. PEP 604 was introduced in Python 3.10, and
typing_extensions does not generally attempt to backport
PEP-604 methods
to prior versions.
- Further update
typing_extensions.evaluate_forward_ref
with changes in Python 3.14.
Changes included in 4.14.0rc1:
- Drop support for Python 3.8 (including PyPy-3.8). Patch by Victorien Plot.
- Do not attempt to re-export names that have been removed from
typing,
anticipating the removal of typing.no_type_check_decorator
in Python 3.15.
Patch by Jelle Zijlstra.
- Update
typing_extensions.Format,
typing_extensions.evaluate_forward_ref, and
typing_extensions.TypedDict to align
with changes in Python 3.14. Patches by Jelle Zijlstra.
- Fix tests for Python 3.14 and 3.15. Patches by Jelle Zijlstra.
New features:
- Add support for inline typed dictionaries (PEP 764).
Patch by Victorien Plot.
- Add
typing_extensions.Reader and
typing_extensions.Writer. Patch by
Sebastian Rittau.
- Add support for sentinels (PEP 661). Patch by
Victorien Plot.
4.14.0rc1
Major changes:
- Drop support for Python 3.8 (including PyPy-3.8). Patch by Victorien Plot.
- Do not attempt to re-export names that have been removed from
typing,
anticipating the removal of typing.no_type_check_decorator
in Python 3.15.
Patch by Jelle Zijlstra.
- Update
typing_extensions.Format,
typing_extensions.evaluate_forward_ref, and
typing_extensions.TypedDict to align
with changes in Python 3.14. Patches by Jelle Zijlstra.
- Fix tests for Python 3.14 and 3.15. Patches by Jelle Zijlstra.
... (truncated)
Changelog
Sourced from typing-extensions's
changelog.
Release 4.14.1 (July 4, 2025)
- Fix usage of
typing_extensions.TypedDict nested inside
other types
(e.g., typing.Type[typing_extensions.TypedDict]). This is
not allowed by the
type system but worked on older versions, so we maintain support.
Release 4.14.0 (June 2, 2025)
Changes since 4.14.0rc1:
- Remove
__or__ and __ror__ methods from
typing_extensions.Sentinel
on Python versions <3.10. PEP 604 was introduced in Python 3.10, and
typing_extensions does not generally attempt to backport
PEP-604 methods
to prior versions.
- Further update
typing_extensions.evaluate_forward_ref
with changes in Python 3.14.
Release 4.14.0rc1 (May 24, 2025)
- Drop support for Python 3.8 (including PyPy-3.8). Patch by Victorien Plot.
- Do not attempt to re-export names that have been removed from
typing,
anticipating the removal of typing.no_type_check_decorator
in Python 3.15.
Patch by Jelle Zijlstra.
- Update
typing_extensions.Format,
typing_extensions.evaluate_forward_ref, and
typing_extensions.TypedDict to align
with changes in Python 3.14. Patches by Jelle Zijlstra.
- Fix tests for Python 3.14 and 3.15. Patches by Jelle Zijlstra.
New features:
- Add support for inline typed dictionaries (PEP 764).
Patch by Victorien Plot.
- Add
typing_extensions.Reader and
typing_extensions.Writer. Patch by
Sebastian Rittau.
- Add support for sentinels (PEP 661). Patch by
Victorien Plot.
Commits
Updates `mypy` from 1.16.0 to 1.16.1
Commits
Updates `ruff` from 0.11.13 to 0.12.2
Release notes
Sourced from ruff's
releases.
0.12.2
Release Notes
Preview features
- [
flake8-pyi] Expand Optional[A] to A
| None (PYI016) (#18572)
- [
pyupgrade] Mark UP008 fix safe if no
comments are in range (#18683)
Bug fixes
- [
flake8-comprehensions] Fix C420 to
prepend whitespace when needed (#18616)
- [
perflint] Fix PERF403 panic on attribute
or subscription loop variable (#19042)
- [
pydocstyle] Fix D413 infinite loop for
parenthesized docstring (#18930)
- [
pylint] Fix PLW0108 autofix introducing a
syntax error when the lambda's body contains an assignment expression
(#18678)
- [
refurb] Fix false positive on empty tuples
(FURB168) (#19058)
- [
ruff] Allow more field calls from
attrs (RUF009) (#19021)
- [
ruff] Fix syntax error introduced for an empty string
followed by a u-prefixed string (UP025) (#18899)
Rule changes
- [
flake8-executable] Allow uvx in shebang
line (EXE003) (#18967)
- [
pandas] Avoid flagging PD002 if
pandas is not imported (#18963)
- [
pyupgrade] Avoid PEP-604 unions with
typing.NamedTuple (UP007, UP045)
(#18682)
Documentation
- Document link between
import-outside-top-level
(PLC0415) and
lint.flake8-tidy-imports.banned-module-level-imports (#18733)
- Fix description of the
format.skip-magic-trailing-comma
example (#19095)
- [
airflow] Make AIR302 example error
out-of-the-box (#18988)
- [
airflow] Make AIR312 example error
out-of-the-box (#18989)
- [
flake8-annotations] Make ANN401 example
error out-of-the-box (#18974)
- [
flake8-async] Make ASYNC100 example error
out-of-the-box (#18993)
- [
flake8-async] Make ASYNC105 example error
out-of-the-box (#19002)
- [
flake8-async] Make ASYNC110 example error
out-of-the-box (#18975)
- [
flake8-async] Make ASYNC210 example error
out-of-the-box (#18977)
- [
flake8-async] Make ASYNC220,
ASYNC221, and ASYNC222 examples error
out-of-the-box (#18978)
- [
flake8-async] Make ASYNC251 example error
out-of-the-box (#18990)
- [
flake8-bandit] Make S201 example error
out-of-the-box (#19017)
- [
flake8-bandit] Make S604 and
S609 examples error out-of-the-box (#19049)
- [
flake8-bugbear] Make B028 example error
out-of-the-box (#19054)
- [
flake8-bugbear] Make B911 example error
out-of-the-box (#19051)
- [
flake8-datetimez] Make DTZ011 example
error out-of-the-box (#19055)
- [
flake8-datetimez] Make DTZ901 example
error out-of-the-box (#19056)
- [
flake8-pyi] Make PYI032 example error
out-of-the-box (#19061)
- [
flake8-pyi] Make example error out-of-the-box
(PYI014, PYI015) (#19097)
- [
flake8-pyi] Make example error out-of-the-box
(PYI042) (#19101)
- [
flake8-pyi] Make example error out-of-the-box
(PYI059) (#19080)
- [
flake8-pyi] Make example error out-of-the-box
(PYI062) (#19079)
- [
flake8-pytest-style] Make example error out-of-the-box
(PT023) (#19104)
- [
flake8-pytest-style] Make example error out-of-the-box
(PT030) (#19105)
... (truncated)
Changelog
Sourced from ruff's
changelog.
0.12.2
Preview features
- [
flake8-pyi] Expand Optional[A] to A
| None (PYI016) (#18572)
- [
pyupgrade] Mark UP008 fix safe if no
comments are in range (#18683)
Bug fixes
- [
flake8-comprehensions] Fix C420 to
prepend whitespace when needed (#18616)
- [
perflint] Fix PERF403 panic on attribute
or subscription loop variable (#19042)
- [
pydocstyle] Fix D413 infinite loop for
parenthesized docstring (#18930)
- [
pylint] Fix PLW0108 autofix introducing a
syntax error when the lambda's body contains an assignment expression
(#18678)
- [
refurb] Fix false positive on empty tuples
(FURB168) (#19058)
- [
ruff] Allow more field calls from
attrs (RUF009) (#19021)
- [
ruff] Fix syntax error introduced for an empty string
followed by a u-prefixed string (UP025) (#18899)
Rule changes
- [
flake8-executable] Allow uvx in shebang
line (EXE003) (#18967)
- [
pandas] Avoid flagging PD002 if
pandas is not imported (#18963)
- [
pyupgrade] Avoid PEP-604 unions with
typing.NamedTuple (UP007, UP045)
(#18682)
Documentation
- Document link between
import-outside-top-level
(PLC0415) and
lint.flake8-tidy-imports.banned-module-level-imports (#18733)
- Fix description of the
format.skip-magic-trailing-comma
example (#19095)
- [
airflow] Make AIR302 example error
out-of-the-box (#18988)
- [
airflow] Make AIR312 example error
out-of-the-box (#18989)
- [
flake8-annotations] Make ANN401 example
error out-of-the-box (#18974)
- [
flake8-async] Make ASYNC100 example error
out-of-the-box (#18993)
- [
flake8-async] Make ASYNC105 example error
out-of-the-box (#19002)
- [
flake8-async] Make ASYNC110 example error
out-of-the-box (#18975)
- [
flake8-async] Make ASYNC210 example error
out-of-the-box (#18977)
- [
flake8-async] Make ASYNC220,
ASYNC221, and ASYNC222 examples error
out-of-the-box (#18978)
- [
flake8-async] Make ASYNC251 example error
out-of-the-box (#18990)
- [
flake8-bandit] Make S201 example error
out-of-the-box (#19017)
- [
flake8-bandit] Make S604 and
S609 examples error out-of-the-box (#19049)
- [
flake8-bugbear] Make B028 example error
out-of-the-box (#19054)
- [
flake8-bugbear] Make B911 example error
out-of-the-box (#19051)
- [
flake8-datetimez] Make DTZ011 example
error out-of-the-box (#19055)
- [
flake8-datetimez] Make DTZ901 example
error out-of-the-box (#19056)
- [
flake8-pyi] Make PYI032 example error
out-of-the-box (#19061)
- [
flake8-pyi] Make example error out-of-the-box
(PYI014, PYI015) (#19097)
- [
flake8-pyi] Make example error out-of-the-box
(PYI042) (#19101)
- [
flake8-pyi] Make example error out-of-the-box
(PYI059) (#19080)
- [
flake8-pyi] Make example error out-of-the-box
(PYI062) (#19079)
- [
flake8-pytest-style] Make example error out-of-the-box
(PT023) (#19104)
- [
flake8-pytest-style] Make example error out-of-the-box
(PT030) (#19105)
- [
flake8-quotes] Make example error out-of-the-box
(Q003) (#19106)
... (truncated)
Commits
9bee837
Bump 0.12.2 (#19126)
1c6717b
Filter private symbols from stubs if they are internal types (#19121)
1b813cd
Fix description of the format.skip-magic-trailing-comma
example (#19095)
b00f68a
[ruff] Allow more field calls from
attrs (RUF009) (#19021)
710c60f
[flake8-pytest-style] Make example error out-of-the-box
(PT023) (#19104)
811e25d
[flake8-pytest-style] Make example error out-of-the-box
(PT030) (#19105)
b78af2d
[flake8-quotes] Make example error out-of-the-box
(Q003) (#19106)
4f36f06
Document link between import-outside-top-level (PLC0415)
and `lint.flake8-t...
2589a29
[flake8-simplify] Make example error out-of-the-box
(SIM113) (#19109)
26bb8f7
[flake8-simplify] Make example error out-of-the-box
(SIM401) (#19110)
- Additional commits viewable in compare
view
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
requirements.dev.txt | 104 ++++++------
requirements.win.txt | 381 +++++++++++++++++++++++--------------------
2 files changed, 257 insertions(+), 228 deletions(-)
diff --git a/requirements.dev.txt b/requirements.dev.txt
index 68171eb5d..0876769e3 100644
--- a/requirements.dev.txt
+++ b/requirements.dev.txt
@@ -198,39 +198,39 @@ markupsafe==3.0.2 \
# via
# -r requirements.txt
# jinja2
-mypy==1.16.0 \
- --hash=sha256:021a68568082c5b36e977d54e8f1de978baf401a33884ffcea09bd8e88a98f4c \
- --hash=sha256:089bedc02307c2548eb51f426e085546db1fa7dd87fbb7c9fa561575cf6eb1ff \
- --hash=sha256:09a8da6a0ee9a9770b8ff61b39c0bb07971cda90e7297f4213741b48a0cc8d93 \
- --hash=sha256:0b07e107affb9ee6ce1f342c07f51552d126c32cd62955f59a7db94a51ad12c0 \
- --hash=sha256:15486beea80be24ff067d7d0ede673b001d0d684d0095803b3e6e17a886a2a92 \
- --hash=sha256:29e1499864a3888bca5c1542f2d7232c6e586295183320caa95758fc84034031 \
- --hash=sha256:2e7e0ad35275e02797323a5aa1be0b14a4d03ffdb2e5f2b0489fa07b89c67b21 \
- --hash=sha256:4086883a73166631307fdd330c4a9080ce24913d4f4c5ec596c601b3a4bdd777 \
- --hash=sha256:54066fed302d83bf5128632d05b4ec68412e1f03ef2c300434057d66866cea4b \
- --hash=sha256:55f9076c6ce55dd3f8cd0c6fff26a008ca8e5131b89d5ba6d86bd3f47e736eeb \
- --hash=sha256:6a2322896003ba66bbd1318c10d3afdfe24e78ef12ea10e2acd985e9d684a666 \
- --hash=sha256:7909541fef256527e5ee9c0a7e2aeed78b6cda72ba44298d1334fe7881b05c5c \
- --hash=sha256:82d056e6faa508501af333a6af192c700b33e15865bda49611e3d7d8358ebea2 \
- --hash=sha256:84b94283f817e2aa6350a14b4a8fb2a35a53c286f97c9d30f53b63620e7af8ab \
- --hash=sha256:936ccfdd749af4766be824268bfe22d1db9eb2f34a3ea1d00ffbe5b5265f5491 \
- --hash=sha256:9f826aaa7ff8443bac6a494cf743f591488ea940dd360e7dd330e30dd772a5ab \
- --hash=sha256:a5fcfdb7318c6a8dd127b14b1052743b83e97a970f0edb6c913211507a255e20 \
- --hash=sha256:a7e32297a437cc915599e0578fa6bc68ae6a8dc059c9e009c628e1c47f91495d \
- --hash=sha256:a9e056237c89f1587a3be1a3a70a06a698d25e2479b9a2f57325ddaaffc3567b \
- --hash=sha256:afe420c9380ccec31e744e8baff0d406c846683681025db3531b32db56962d52 \
- --hash=sha256:b4968f14f44c62e2ec4a038c8797a87315be8df7740dc3ee8d3bfe1c6bf5dba8 \
- --hash=sha256:bd4e1ebe126152a7bbaa4daedd781c90c8f9643c79b9748caa270ad542f12bec \
- --hash=sha256:c5436d11e89a3ad16ce8afe752f0f373ae9620841c50883dc96f8b8805620b13 \
- --hash=sha256:c6fb60cbd85dc65d4d63d37cb5c86f4e3a301ec605f606ae3a9173e5cf34997b \
- --hash=sha256:d045d33c284e10a038f5e29faca055b90eee87da3fc63b8889085744ebabb5a1 \
- --hash=sha256:e71d6f0090c2256c713ed3d52711d01859c82608b5d68d4fa01a3fe30df95571 \
- --hash=sha256:eb14a4a871bb8efb1e4a50360d4e3c8d6c601e7a31028a2c79f9bb659b63d730 \
- --hash=sha256:eb5fbc8063cb4fde7787e4c0406aa63094a34a2daf4673f359a1fb64050e9cb2 \
- --hash=sha256:f2622af30bf01d8fc36466231bdd203d120d7a599a6d88fb22bdcb9dbff84090 \
- --hash=sha256:f2ed0e0847a80655afa2c121835b848ed101cc7b8d8d6ecc5205aedc732b1436 \
- --hash=sha256:f56236114c425620875c7cf71700e3d60004858da856c6fc78998ffe767b73d3 \
- --hash=sha256:feec38097f71797da0231997e0de3a58108c51845399669ebc532c815f93866b
+mypy==1.16.1 \
+ --hash=sha256:051e1677689c9d9578b9c7f4d206d763f9bbd95723cd1416fad50db49d52f359 \
+ --hash=sha256:08e850ea22adc4d8a4014651575567b0318ede51e8e9fe7a68f25391af699507 \
+ --hash=sha256:09aa4f91ada245f0a45dbc47e548fd94e0dd5a8433e0114917dc3b526912a30c \
+ --hash=sha256:0a7cfb0fe29fe5a9841b7c8ee6dffb52382c45acdf68f032145b75620acfbd6f \
+ --hash=sha256:0ab5eca37b50188163fa7c1b73c685ac66c4e9bdee4a85c9adac0e91d8895e15 \
+ --hash=sha256:1256688e284632382f8f3b9e2123df7d279f603c561f099758e66dd6ed4e8bd6 \
+ --hash=sha256:13c7cd5b1cb2909aa318a90fd1b7e31f17c50b242953e7dd58345b2a814f6383 \
+ --hash=sha256:1f0435cf920e287ff68af3d10a118a73f212deb2ce087619eb4e648116d1fe9b \
+ --hash=sha256:211287e98e05352a2e1d4e8759c5490925a7c784ddc84207f4714822f8cf99b6 \
+ --hash=sha256:22d76a63a42619bfb90122889b903519149879ddbf2ba4251834727944c8baca \
+ --hash=sha256:2c7ce0662b6b9dc8f4ed86eb7a5d505ee3298c04b40ec13b30e572c0e5ae17c4 \
+ --hash=sha256:352025753ef6a83cb9e7f2427319bb7875d1fdda8439d1e23de12ab164179574 \
+ --hash=sha256:44e7acddb3c48bd2713994d098729494117803616e116032af192871aed80b79 \
+ --hash=sha256:472e4e4c100062488ec643f6162dd0d5208e33e2f34544e1fc931372e806c0cc \
+ --hash=sha256:4f58ac32771341e38a853c5d0ec0dfe27e18e27da9cdb8bbc882d2249c71a3ee \
+ --hash=sha256:58e07fb958bc5d752a280da0e890c538f1515b79a65757bbdc54252ba82e0b40 \
+ --hash=sha256:5e198ab3f55924c03ead626ff424cad1732d0d391478dfbf7bb97b34602395da \
+ --hash=sha256:5fc2ac4027d0ef28d6ba69a0343737a23c4d1b83672bf38d1fe237bdc0643b37 \
+ --hash=sha256:66df38405fd8466ce3517eda1f6640611a0b8e70895e2a9462d1d4323c5eb4b9 \
+ --hash=sha256:6bd00a0a2094841c5e47e7374bb42b83d64c527a502e3334e1173a0c24437bab \
+ --hash=sha256:7fc688329af6a287567f45cc1cefb9db662defeb14625213a5b7da6e692e2069 \
+ --hash=sha256:86042bbf9f5a05ea000d3203cf87aa9d0ccf9a01f73f71c58979eb9249f46d72 \
+ --hash=sha256:87ff2c13d58bdc4bbe7dc0dedfe622c0f04e2cb2a492269f3b418df2de05c536 \
+ --hash=sha256:af4792433f09575d9eeca5c63d7d90ca4aeceda9d8355e136f80f8967639183d \
+ --hash=sha256:b4f0fed1022a63c6fec38f28b7fc77fca47fd490445c69d0a66266c59dd0b88a \
+ --hash=sha256:d5d2309511cc56c021b4b4e462907c2b12f669b2dbeb68300110ec27723971be \
+ --hash=sha256:ddc91eb318c8751c69ddb200a5937f1232ee8efb4e64e9f4bc475a33719de438 \
+ --hash=sha256:dedb6229b2c9086247e21a83c309754b9058b438704ad2f6807f0d8227f6ebdd \
+ --hash=sha256:ea16e2a7d2714277e349e24d19a782a663a34ed60864006e8585db08f8ad1782 \
+ --hash=sha256:ea7469ee5902c95542bea7ee545f7006508c65c8c54b06dc2c92676ce526f3ea \
+ --hash=sha256:f895078594d918f93337a505f8add9bd654d1a24962b4c6ed9390e12531eb31b \
+ --hash=sha256:ff9fa5b16e4c1364eb89a4d16bcda9987f05d39604e1e6c35378a2987c1aac2d
# via -r requirements.dev.in
mypy-extensions==1.0.0 \
--hash=sha256:4392f6c0eb8a5668a69e23d168ffa70f0be9ccfd32b5cc2d26a34ae5b844552d \
@@ -417,25 +417,25 @@ rpds-py==0.22.3 \
# -r requirements.txt
# jsonschema
# referencing
-ruff==0.11.13 \
- --hash=sha256:1808b3ed53e1a777c2ef733aca9051dc9bf7c99b26ece15cb59a0320fbdbd629 \
- --hash=sha256:26816a218ca6ef02142343fd24c70f7cd8c5aa6c203bca284407adf675984432 \
- --hash=sha256:26fa247dc68d1d4e72c179e08889a25ac0c7ba4d78aecfc835d49cbfd60bf514 \
- --hash=sha256:29c3189895a8a6a657b7af4e97d330c8a3afd2c9c8f46c81e2fc5a31866517e3 \
- --hash=sha256:4a9ddd3ec62a9a89578c85842b836e4ac832d4a2e0bfaad3b02243f930ceafcc \
- --hash=sha256:4bdfbf1240533f40042ec00c9e09a3aade6f8c10b6414cf11b519488d2635d46 \
- --hash=sha256:4ffbc82d70424b275b089166310448051afdc6e914fdab90e08df66c43bb5ca9 \
- --hash=sha256:51c3f95abd9331dc5b87c47ac7f376db5616041173826dfd556cfe3d4977f492 \
- --hash=sha256:53b15a9dfdce029c842e9a5aebc3855e9ab7771395979ff85b7c1dedb53ddc2b \
- --hash=sha256:55e4bc3a77842da33c16d55b32c6cac1ec5fb0fbec9c8c513bdce76c4f922165 \
- --hash=sha256:633bf2c6f35678c56ec73189ba6fa19ff1c5e4807a78bf60ef487b9dd272cc71 \
- --hash=sha256:6c51f93029d54a910d3d24f7dd0bb909e31b6cd989a5e4ac513f4eb41629f0dc \
- --hash=sha256:96c27935418e4e8e77a26bb05962817f28b8ef3843a6c6cc49d8783b5507f250 \
- --hash=sha256:ab153241400789138d13f362c43f7edecc0edfffce2afa6a68434000ecd8f69a \
- --hash=sha256:aef9c9ed1b5ca28bb15c7eac83b8670cf3b20b478195bd49c8d756ba0a36cf48 \
- --hash=sha256:b4385285e9179d608ff1d2fb9922062663c658605819a6876d8beef0c30b7f3b \
- --hash=sha256:d237a496e0778d719efb05058c64d28b757c77824e04ffe8796c7436e26712b7 \
- --hash=sha256:d28ce58b5ecf0f43c1b71edffabe6ed7f245d5336b17805803312ec9bc665933
+ruff==0.12.2 \
+ --hash=sha256:093ea2b221df1d2b8e7ad92fc6ffdca40a2cb10d8564477a987b44fd4008a7be \
+ --hash=sha256:09e4cf27cc10f96b1708100fa851e0daf21767e9709e1649175355280e0d950e \
+ --hash=sha256:2a4a20aeed74671b2def096bdf2eac610c7d8ffcbf4fb0e627c06947a1d7078d \
+ --hash=sha256:369ffb69b70cd55b6c3fc453b9492d98aed98062db9fec828cdfd069555f5f1a \
+ --hash=sha256:3b8b94317cbc2ae4a2771af641739f933934b03555e51515e6e021c64441532d \
+ --hash=sha256:3eb3a6b2db4d6e2c77e682f0b988d4d61aff06860158fdb413118ca133d57922 \
+ --hash=sha256:45fc42c3bf1d30d2008023a0a9a0cfb06bf9835b147f11fe0679f21ae86d34b1 \
+ --hash=sha256:48d6c6bfb4761df68bc05ae630e24f506755e702d4fb08f08460be778c7ccb12 \
+ --hash=sha256:4987b8f4ceadf597c927beee65a5eaf994c6e2b631df963f86d8ad1bdea99342 \
+ --hash=sha256:6932323db80484dda89153da3d8e58164d01d6da86857c79f1961934354992da \
+ --hash=sha256:6aa7e623a3a11538108f61e859ebf016c4f14a7e6e4eba1980190cacb57714ce \
+ --hash=sha256:71a4c550195612f486c9d1f2b045a600aeba851b298c667807ae933478fcef04 \
+ --hash=sha256:73448de992d05517170fc37169cbca857dfeaeaa8c2b9be494d7bcb0d36c8f4b \
+ --hash=sha256:793d8859445ea47591272021a81391350205a4af65a9392401f418a95dfb75c9 \
+ --hash=sha256:8ae64755b22f4ff85e9c52d1f82644abd0b6b6b6deedceb74bd71f35c24044cc \
+ --hash=sha256:ce48f675c394c37e958bf229fb5c1e843e20945a6d962cf3ea20b7a107dcd9f4 \
+ --hash=sha256:d7b4f55cd6f325cb7621244f19c873c565a08aff5a4ba9c69aa7355f3f7afd3e \
+ --hash=sha256:dca8a3b6d6dc9810ed8f328d406516bf4d660c00caeaef36eb831cf4871b0639
# via -r requirements.dev.in
six==1.17.0 \
--hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
diff --git a/requirements.win.txt b/requirements.win.txt
index b9b9a8148..faa013574 100644
--- a/requirements.win.txt
+++ b/requirements.win.txt
@@ -6,9 +6,9 @@ attrs==25.3.0 \
# via
# jsonschema
# referencing
-certifi==2025.4.26 \
- --hash=sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6 \
- --hash=sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3
+certifi==2025.6.15 \
+ --hash=sha256:2e0c7ce7cb5d8f8634ca55d2ba7e6ec2689a2fd6537d8dec1296a477a4910057 \
+ --hash=sha256:d747aa5a8b9bbbb1bb8c22bb13e22bd1f18e9796defa16bab421f7f7a317323b
# via requests
charset-normalizer==3.4.2 \
--hash=sha256:005fa3432484527f9732ebd315da8da8001593e2cf46a3d817669f062c3d9ed4 \
@@ -205,58 +205,60 @@ pywin32==310 \
--hash=sha256:c3e78706e4229b915a0821941a84e7ef420bf2b77e08c9dae3c76fd03fd2ae3d \
--hash=sha256:e308f831de771482b7cf692a1f308f8fca701b2d8f9dde6cc440c7da17e47b33
# via docker
-pyyaml==6.0.1 \
- --hash=sha256:04ac92ad1925b2cff1db0cfebffb6ffc43457495c9b3c39d3fcae417d7125dc5 \
- --hash=sha256:062582fca9fabdd2c8b54a3ef1c978d786e0f6b3a1510e0ac93ef59e0ddae2bc \
- --hash=sha256:0d3304d8c0adc42be59c5f8a4d9e3d7379e6955ad754aa9d6ab7a398b59dd1df \
- --hash=sha256:1635fd110e8d85d55237ab316b5b011de701ea0f29d07611174a1b42f1444741 \
- --hash=sha256:184c5108a2aca3c5b3d3bf9395d50893a7ab82a38004c8f61c258d4428e80206 \
- --hash=sha256:18aeb1bf9a78867dc38b259769503436b7c72f7a1f1f4c93ff9a17de54319b27 \
- --hash=sha256:1d4c7e777c441b20e32f52bd377e0c409713e8bb1386e1099c2415f26e479595 \
- --hash=sha256:1e2722cc9fbb45d9b87631ac70924c11d3a401b2d7f410cc0e3bbf249f2dca62 \
- --hash=sha256:1fe35611261b29bd1de0070f0b2f47cb6ff71fa6595c077e42bd0c419fa27b98 \
- --hash=sha256:28c119d996beec18c05208a8bd78cbe4007878c6dd15091efb73a30e90539696 \
- --hash=sha256:326c013efe8048858a6d312ddd31d56e468118ad4cdeda36c719bf5bb6192290 \
- --hash=sha256:40df9b996c2b73138957fe23a16a4f0ba614f4c0efce1e9406a184b6d07fa3a9 \
- --hash=sha256:42f8152b8dbc4fe7d96729ec2b99c7097d656dc1213a3229ca5383f973a5ed6d \
- --hash=sha256:49a183be227561de579b4a36efbb21b3eab9651dd81b1858589f796549873dd6 \
- --hash=sha256:4fb147e7a67ef577a588a0e2c17b6db51dda102c71de36f8549b6816a96e1867 \
- --hash=sha256:50550eb667afee136e9a77d6dc71ae76a44df8b3e51e41b77f6de2932bfe0f47 \
- --hash=sha256:510c9deebc5c0225e8c96813043e62b680ba2f9c50a08d3724c7f28a747d1486 \
- --hash=sha256:5773183b6446b2c99bb77e77595dd486303b4faab2b086e7b17bc6bef28865f6 \
- --hash=sha256:596106435fa6ad000c2991a98fa58eeb8656ef2325d7e158344fb33864ed87e3 \
- --hash=sha256:6965a7bc3cf88e5a1c3bd2e0b5c22f8d677dc88a455344035f03399034eb3007 \
- --hash=sha256:69b023b2b4daa7548bcfbd4aa3da05b3a74b772db9e23b982788168117739938 \
- --hash=sha256:6c22bec3fbe2524cde73d7ada88f6566758a8f7227bfbf93a408a9d86bcc12a0 \
- --hash=sha256:704219a11b772aea0d8ecd7058d0082713c3562b4e271b849ad7dc4a5c90c13c \
- --hash=sha256:7e07cbde391ba96ab58e532ff4803f79c4129397514e1413a7dc761ccd755735 \
- --hash=sha256:81e0b275a9ecc9c0c0c07b4b90ba548307583c125f54d5b6946cfee6360c733d \
- --hash=sha256:855fb52b0dc35af121542a76b9a84f8d1cd886ea97c84703eaa6d88e37a2ad28 \
- --hash=sha256:8d4e9c88387b0f5c7d5f281e55304de64cf7f9c0021a3525bd3b1c542da3b0e4 \
- --hash=sha256:9046c58c4395dff28dd494285c82ba00b546adfc7ef001486fbf0324bc174fba \
- --hash=sha256:9eb6caa9a297fc2c2fb8862bc5370d0303ddba53ba97e71f08023b6cd73d16a8 \
- --hash=sha256:a08c6f0fe150303c1c6b71ebcd7213c2858041a7e01975da3a99aed1e7a378ef \
- --hash=sha256:a0cd17c15d3bb3fa06978b4e8958dcdc6e0174ccea823003a106c7d4d7899ac5 \
- --hash=sha256:afd7e57eddb1a54f0f1a974bc4391af8bcce0b444685d936840f125cf046d5bd \
- --hash=sha256:b1275ad35a5d18c62a7220633c913e1b42d44b46ee12554e5fd39c70a243d6a3 \
- --hash=sha256:b786eecbdf8499b9ca1d697215862083bd6d2a99965554781d0d8d1ad31e13a0 \
- --hash=sha256:ba336e390cd8e4d1739f42dfe9bb83a3cc2e80f567d8805e11b46f4a943f5515 \
- --hash=sha256:baa90d3f661d43131ca170712d903e6295d1f7a0f595074f151c0aed377c9b9c \
- --hash=sha256:bc1bf2925a1ecd43da378f4db9e4f799775d6367bdb94671027b73b393a7c42c \
- --hash=sha256:bd4af7373a854424dabd882decdc5579653d7868b8fb26dc7d0e99f823aa5924 \
- --hash=sha256:bf07ee2fef7014951eeb99f56f39c9bb4af143d8aa3c21b1677805985307da34 \
- --hash=sha256:bfdf460b1736c775f2ba9f6a92bca30bc2095067b8a9d77876d1fad6cc3b4a43 \
- --hash=sha256:c8098ddcc2a85b61647b2590f825f3db38891662cfc2fc776415143f599bb859 \
- --hash=sha256:d2b04aac4d386b172d5b9692e2d2da8de7bfb6c387fa4f801fbf6fb2e6ba4673 \
- --hash=sha256:d483d2cdf104e7c9fa60c544d92981f12ad66a457afae824d146093b8c294c54 \
- --hash=sha256:d858aa552c999bc8a8d57426ed01e40bef403cd8ccdd0fc5f6f04a00414cac2a \
- --hash=sha256:e7d73685e87afe9f3b36c799222440d6cf362062f78be1013661b00c5c6f678b \
- --hash=sha256:f003ed9ad21d6a4713f0a9b5a7a0a79e08dd0f221aff4525a2be4c346ee60aab \
- --hash=sha256:f22ac1c3cac4dbc50079e965eba2c1058622631e526bd9afd45fedd49ba781fa \
- --hash=sha256:faca3bdcf85b2fc05d06ff3fbc1f83e1391b3e724afa3feba7d13eeab355484c \
- --hash=sha256:fca0e3a251908a499833aa292323f32437106001d436eca0e6e7833256674585 \
- --hash=sha256:fd1592b3fdf65fff2ad0004b5e363300ef59ced41c2e6b3a99d4089fa8c5435d \
- --hash=sha256:fd66fc5d0da6d9815ba2cebeb4205f95818ff4b79c3ebe268e75d961704af52f
+pyyaml==6.0.2 \
+ --hash=sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff \
+ --hash=sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48 \
+ --hash=sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086 \
+ --hash=sha256:0b69e4ce7a131fe56b7e4d770c67429700908fc0752af059838b1cfb41960e4e \
+ --hash=sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133 \
+ --hash=sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5 \
+ --hash=sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484 \
+ --hash=sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee \
+ --hash=sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5 \
+ --hash=sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68 \
+ --hash=sha256:24471b829b3bf607e04e88d79542a9d48bb037c2267d7927a874e6c205ca7e9a \
+ --hash=sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf \
+ --hash=sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99 \
+ --hash=sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8 \
+ --hash=sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85 \
+ --hash=sha256:3b1fdb9dc17f5a7677423d508ab4f243a726dea51fa5e70992e59a7411c89d19 \
+ --hash=sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc \
+ --hash=sha256:43fa96a3ca0d6b1812e01ced1044a003533c47f6ee8aca31724f78e93ccc089a \
+ --hash=sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1 \
+ --hash=sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317 \
+ --hash=sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c \
+ --hash=sha256:6395c297d42274772abc367baaa79683958044e5d3835486c16da75d2a694631 \
+ --hash=sha256:688ba32a1cffef67fd2e9398a2efebaea461578b0923624778664cc1c914db5d \
+ --hash=sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652 \
+ --hash=sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5 \
+ --hash=sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e \
+ --hash=sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b \
+ --hash=sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8 \
+ --hash=sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476 \
+ --hash=sha256:82d09873e40955485746739bcb8b4586983670466c23382c19cffecbf1fd8706 \
+ --hash=sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563 \
+ --hash=sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237 \
+ --hash=sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b \
+ --hash=sha256:9056c1ecd25795207ad294bcf39f2db3d845767be0ea6e6a34d856f006006083 \
+ --hash=sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180 \
+ --hash=sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425 \
+ --hash=sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e \
+ --hash=sha256:a8786accb172bd8afb8be14490a16625cbc387036876ab6ba70912730faf8e1f \
+ --hash=sha256:a9f8c2e67970f13b16084e04f134610fd1d374bf477b17ec1599185cf611d725 \
+ --hash=sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183 \
+ --hash=sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab \
+ --hash=sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774 \
+ --hash=sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725 \
+ --hash=sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e \
+ --hash=sha256:d7fded462629cfa4b685c5416b949ebad6cec74af5e2d42905d41e257e0869f5 \
+ --hash=sha256:d84a1718ee396f54f3a086ea0a66d8e552b2ab2017ef8b420e92edbc841c352d \
+ --hash=sha256:d8e03406cac8513435335dbab54c0d385e4a49e4945d2909a581c83647ca0290 \
+ --hash=sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44 \
+ --hash=sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed \
+ --hash=sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4 \
+ --hash=sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba \
+ --hash=sha256:f753120cb8181e736c57ef7636e83f31b9c0d1722c516f7e86cf15b7aa57ff12 \
+ --hash=sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4
# via -r requirements.in
referencing==0.36.2 \
--hash=sha256:df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa \
@@ -268,124 +270,151 @@ requests==2.32.4 \
--hash=sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c \
--hash=sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422
# via docker
-rpds-py==0.25.1 \
- --hash=sha256:0317177b1e8691ab5879f4f33f4b6dc55ad3b344399e23df2e499de7b10a548d \
- --hash=sha256:036ded36bedb727beeabc16dc1dad7cb154b3fa444e936a03b67a86dc6a5066e \
- --hash=sha256:048893e902132fd6548a2e661fb38bf4896a89eea95ac5816cf443524a85556f \
- --hash=sha256:0701942049095741a8aeb298a31b203e735d1c61f4423511d2b1a41dcd8a16da \
- --hash=sha256:083a9513a33e0b92cf6e7a6366036c6bb43ea595332c1ab5c8ae329e4bcc0a9c \
- --hash=sha256:09eab132f41bf792c7a0ea1578e55df3f3e7f61888e340779b06050a9a3f16e9 \
- --hash=sha256:0e6a327af8ebf6baba1c10fadd04964c1965d375d318f4435d5f3f9651550f4a \
- --hash=sha256:0eb90e94f43e5085623932b68840b6f379f26db7b5c2e6bcef3179bd83c9330f \
- --hash=sha256:114a07e85f32b125404f28f2ed0ba431685151c037a26032b213c882f26eb908 \
- --hash=sha256:115874ae5e2fdcfc16b2aedc95b5eef4aebe91b28e7e21951eda8a5dc0d3461b \
- --hash=sha256:140f61d9bed7839446bdd44852e30195c8e520f81329b4201ceead4d64eb3a9f \
- --hash=sha256:1521031351865e0181bc585147624d66b3b00a84109b57fcb7a779c3ec3772cd \
- --hash=sha256:1c0c434a53714358532d13539272db75a5ed9df75a4a090a753ac7173ec14e11 \
- --hash=sha256:1d1fadd539298e70cac2f2cb36f5b8a65f742b9b9f1014dd4ea1f7785e2470bf \
- --hash=sha256:1de336a4b164c9188cb23f3703adb74a7623ab32d20090d0e9bf499a2203ad65 \
- --hash=sha256:1ee3e26eb83d39b886d2cb6e06ea701bba82ef30a0de044d34626ede51ec98b0 \
- --hash=sha256:245550f5a1ac98504147cba96ffec8fabc22b610742e9150138e5d60774686d7 \
- --hash=sha256:2a40046a529cc15cef88ac5ab589f83f739e2d332cb4d7399072242400ed68c9 \
- --hash=sha256:2c2cd1a4b0c2b8c5e31ffff50d09f39906fe351389ba143c195566056c13a7ea \
- --hash=sha256:2cb9e5b5e26fc02c8a4345048cd9998c2aca7c2712bd1b36da0c72ee969a3523 \
- --hash=sha256:33358883a4490287e67a2c391dfaea4d9359860281db3292b6886bf0be3d8692 \
- --hash=sha256:35634369325906bcd01577da4c19e3b9541a15e99f31e91a02d010816b49bfda \
- --hash=sha256:35a8d1a24b5936b35c5003313bc177403d8bdef0f8b24f28b1c4a255f94ea992 \
- --hash=sha256:3af5b4cc10fa41e5bc64e5c198a1b2d2864337f8fcbb9a67e747e34002ce812b \
- --hash=sha256:3bcce0edc1488906c2d4c75c94c70a0417e83920dd4c88fec1078c94843a6ce9 \
- --hash=sha256:3c5b317ecbd8226887994852e85de562f7177add602514d4ac40f87de3ae45a8 \
- --hash=sha256:3c6564c0947a7f52e4792983f8e6cf9bac140438ebf81f527a21d944f2fd0a40 \
- --hash=sha256:3ebd879ab996537fc510a2be58c59915b5dd63bccb06d1ef514fee787e05984a \
- --hash=sha256:3f0b1798cae2bbbc9b9db44ee068c556d4737911ad53a4e5093d09d04b3bbc24 \
- --hash=sha256:401ca1c4a20cc0510d3435d89c069fe0a9ae2ee6495135ac46bdd49ec0495763 \
- --hash=sha256:454601988aab2c6e8fd49e7634c65476b2b919647626208e376afcd22019eeb8 \
- --hash=sha256:4593c4eae9b27d22df41cde518b4b9e4464d139e4322e2127daa9b5b981b76be \
- --hash=sha256:45e484db65e5380804afbec784522de84fa95e6bb92ef1bd3325d33d13efaebd \
- --hash=sha256:48d64155d02127c249695abb87d39f0faf410733428d499867606be138161d65 \
- --hash=sha256:4fbb0dbba559959fcb5d0735a0f87cdbca9e95dac87982e9b95c0f8f7ad10255 \
- --hash=sha256:4fd52d3455a0aa997734f3835cbc4c9f32571345143960e7d7ebfe7b5fbfa3b2 \
- --hash=sha256:50f2c501a89c9a5f4e454b126193c5495b9fb441a75b298c60591d8a2eb92e1b \
- --hash=sha256:58f77c60956501a4a627749a6dcb78dac522f249dd96b5c9f1c6af29bfacfb66 \
- --hash=sha256:5a3ddb74b0985c4387719fc536faced33cadf2172769540c62e2a94b7b9be1c4 \
- --hash=sha256:5c4a128527fe415d73cf1f70a9a688d06130d5810be69f3b553bf7b45e8acf79 \
- --hash=sha256:5d473be2b13600b93a5675d78f59e63b51b1ba2d0476893415dfbb5477e65b31 \
- --hash=sha256:5d9e40f32745db28c1ef7aad23f6fc458dc1e29945bd6781060f0d15628b8ddf \
- --hash=sha256:5f048bbf18b1f9120685c6d6bb70cc1a52c8cc11bdd04e643d28d3be0baf666d \
- --hash=sha256:605ffe7769e24b1800b4d024d24034405d9404f0bc2f55b6db3362cd34145a6f \
- --hash=sha256:6099263f526efff9cf3883dfef505518730f7a7a93049b1d90d42e50a22b4793 \
- --hash=sha256:659d87430a8c8c704d52d094f5ba6fa72ef13b4d385b7e542a08fc240cb4a559 \
- --hash=sha256:666fa7b1bd0a3810a7f18f6d3a25ccd8866291fbbc3c9b912b917a6715874bb9 \
- --hash=sha256:68f6f060f0bbdfb0245267da014d3a6da9be127fe3e8cc4a68c6f833f8a23bb1 \
- --hash=sha256:6d273f136e912aa101a9274c3145dcbddbe4bac560e77e6d5b3c9f6e0ed06d34 \
- --hash=sha256:6d50841c425d16faf3206ddbba44c21aa3310a0cebc3c1cdfc3e3f4f9f6f5728 \
- --hash=sha256:771c16060ff4e79584dc48902a91ba79fd93eade3aa3a12d6d2a4aadaf7d542b \
- --hash=sha256:785ffacd0ee61c3e60bdfde93baa6d7c10d86f15655bd706c89da08068dc5038 \
- --hash=sha256:796ad874c89127c91970652a4ee8b00d56368b7e00d3477f4415fe78164c8000 \
- --hash=sha256:79dc317a5f1c51fd9c6a0c4f48209c6b8526d0524a6904fc1076476e79b00f98 \
- --hash=sha256:7c9409b47ba0650544b0bb3c188243b83654dfe55dcc173a86832314e1a6a35d \
- --hash=sha256:7d779b325cc8238227c47fbc53964c8cc9a941d5dbae87aa007a1f08f2f77b23 \
- --hash=sha256:816568614ecb22b18a010c7a12559c19f6fe993526af88e95a76d5a60b8b75fb \
- --hash=sha256:8378fa4a940f3fb509c081e06cb7f7f2adae8cf46ef258b0e0ed7519facd573e \
- --hash=sha256:85608eb70a659bf4c1142b2781083d4b7c0c4e2c90eff11856a9754e965b2540 \
- --hash=sha256:85fc223d9c76cabe5d0bff82214459189720dc135db45f9f66aa7cffbf9ff6c1 \
- --hash=sha256:88ec04afe0c59fa64e2f6ea0dd9657e04fc83e38de90f6de201954b4d4eb59bd \
- --hash=sha256:8960b6dac09b62dac26e75d7e2c4a22efb835d827a7278c34f72b2b84fa160e3 \
- --hash=sha256:89706d0683c73a26f76a5315d893c051324d771196ae8b13e6ffa1ffaf5e574f \
- --hash=sha256:89c24300cd4a8e4a51e55c31a8ff3918e6651b241ee8876a42cc2b2a078533ba \
- --hash=sha256:8c742af695f7525e559c16f1562cf2323db0e3f0fbdcabdf6865b095256b2d40 \
- --hash=sha256:8dbd586bfa270c1103ece2109314dd423df1fa3d9719928b5d09e4840cec0d72 \
- --hash=sha256:8eb8c84ecea987a2523e057c0d950bcb3f789696c0499290b8d7b3107a719d78 \
- --hash=sha256:921954d7fbf3fccc7de8f717799304b14b6d9a45bbeec5a8d7408ccbf531faf5 \
- --hash=sha256:9a46c2fb2545e21181445515960006e85d22025bd2fe6db23e76daec6eb689fe \
- --hash=sha256:9c006f3aadeda131b438c3092124bd196b66312f0caa5823ef09585a669cf449 \
- --hash=sha256:9ceca1cf097ed77e1a51f1dbc8d174d10cb5931c188a4505ff9f3e119dfe519b \
- --hash=sha256:9e5fc7484fa7dce57e25063b0ec9638ff02a908304f861d81ea49273e43838c1 \
- --hash=sha256:9f2f48ab00181600ee266a095fe815134eb456163f7d6699f525dee471f312cf \
- --hash=sha256:9fca84a15333e925dd59ce01da0ffe2ffe0d6e5d29a9eeba2148916d1824948c \
- --hash=sha256:a49e1d7a4978ed554f095430b89ecc23f42014a50ac385eb0c4d163ce213c325 \
- --hash=sha256:a58d1ed49a94d4183483a3ce0af22f20318d4a1434acee255d683ad90bf78129 \
- --hash=sha256:a61d0b2c7c9a0ae45732a77844917b427ff16ad5464b4d4f5e4adb955f582890 \
- --hash=sha256:a714bf6e5e81b0e570d01f56e0c89c6375101b8463999ead3a93a5d2a4af91fa \
- --hash=sha256:a7b74e92a3b212390bdce1d93da9f6488c3878c1d434c5e751cbc202c5e09500 \
- --hash=sha256:a8bd2f19e312ce3e1d2c635618e8a8d8132892bb746a7cf74780a489f0f6cdcb \
- --hash=sha256:b0be9965f93c222fb9b4cc254235b3b2b215796c03ef5ee64f995b1b69af0762 \
- --hash=sha256:b24bf3cd93d5b6ecfbedec73b15f143596c88ee249fa98cefa9a9dc9d92c6f28 \
- --hash=sha256:b5ffe453cde61f73fea9430223c81d29e2fbf412a6073951102146c84e19e34c \
- --hash=sha256:bc120d1132cff853ff617754196d0ac0ae63befe7c8498bd67731ba368abe451 \
- --hash=sha256:bd035756830c712b64725a76327ce80e82ed12ebab361d3a1cdc0f51ea21acb0 \
- --hash=sha256:bffcf57826d77a4151962bf1701374e0fc87f536e56ec46f1abdd6a903354042 \
- --hash=sha256:c2013ee878c76269c7b557a9a9c042335d732e89d482606990b70a839635feb7 \
- --hash=sha256:c4feb9211d15d9160bc85fa72fed46432cdc143eb9cf6d5ca377335a921ac37b \
- --hash=sha256:c8980cde3bb8575e7c956a530f2c217c1d6aac453474bf3ea0f9c89868b531b6 \
- --hash=sha256:c98f126c4fc697b84c423e387337d5b07e4a61e9feac494362a59fd7a2d9ed80 \
- --hash=sha256:ccc6f3ddef93243538be76f8e47045b4aad7a66a212cd3a0f23e34469473d36b \
- --hash=sha256:ccfa689b9246c48947d31dd9d8b16d89a0ecc8e0e26ea5253068efb6c542b76e \
- --hash=sha256:cda776f1967cb304816173b30994faaf2fd5bcb37e73118a47964a02c348e1bc \
- --hash=sha256:ce4c8e485a3c59593f1a6f683cf0ea5ab1c1dc94d11eea5619e4fb5228b40fbd \
- --hash=sha256:d3c10228d6cf6fe2b63d2e7985e94f6916fa46940df46b70449e9ff9297bd3d1 \
- --hash=sha256:d4ca54b9cf9d80b4016a67a0193ebe0bcf29f6b0a96f09db942087e294d3d4c2 \
- --hash=sha256:d4cb2b3ddc16710548801c6fcc0cfcdeeff9dafbc983f77265877793f2660309 \
- --hash=sha256:d50e4864498a9ab639d6d8854b25e80642bd362ff104312d9770b05d66e5fb13 \
- --hash=sha256:d74ec9bc0e2feb81d3f16946b005748119c0f52a153f6db6a29e8cd68636f295 \
- --hash=sha256:d8222acdb51a22929c3b2ddb236b69c59c72af4019d2cba961e2f9add9b6e634 \
- --hash=sha256:db58483f71c5db67d643857404da360dce3573031586034b7d59f245144cc192 \
- --hash=sha256:dc3c1ff0abc91444cd20ec643d0f805df9a3661fcacf9c95000329f3ddf268a4 \
- --hash=sha256:dd326a81afe332ede08eb39ab75b301d5676802cdffd3a8f287a5f0b694dc3f5 \
- --hash=sha256:dec21e02e6cc932538b5203d3a8bd6aa1480c98c4914cb88eea064ecdbc6396a \
- --hash=sha256:e1dafef8df605fdb46edcc0bf1573dea0d6d7b01ba87f85cd04dc855b2b4479e \
- --hash=sha256:e2f6a2347d3440ae789505693a02836383426249d5293541cd712e07e7aecf54 \
- --hash=sha256:e37caa8cdb3b7cf24786451a0bdb853f6347b8b92005eeb64225ae1db54d1c2b \
- --hash=sha256:e43a005671a9ed5a650f3bc39e4dbccd6d4326b24fb5ea8be5f3a43a6f576c72 \
- --hash=sha256:e5e2f7280d8d0d3ef06f3ec1b4fd598d386cc6f0721e54f09109a8132182fbfe \
- --hash=sha256:e87798852ae0b37c88babb7f7bbbb3e3fecc562a1c340195b44c7e24d403e380 \
- --hash=sha256:ee86d81551ec68a5c25373c5643d343150cc54672b5e9a0cafc93c1870a53954 \
- --hash=sha256:f251bf23deb8332823aef1da169d5d89fa84c89f67bdfb566c49dea1fccfd50d \
- --hash=sha256:f3d86373ff19ca0441ebeb696ef64cb58b8b5cbacffcda5a0ec2f3911732a194 \
- --hash=sha256:f4ad628b5174d5315761b67f212774a32f5bad5e61396d38108bd801c0a8f5d9 \
- --hash=sha256:f70316f760174ca04492b5ab01be631a8ae30cadab1d1081035136ba12738cfa \
- --hash=sha256:f73ce1512e04fbe2bc97836e89830d6b4314c171587a99688082d090f934d20a \
- --hash=sha256:ff7c23ba0a88cb7b104281a99476cccadf29de2a0ef5ce864959a52675b1ca83
+rpds-py==0.26.0 \
+ --hash=sha256:0919f38f5542c0a87e7b4afcafab6fd2c15386632d249e9a087498571250abe3 \
+ --hash=sha256:093d63b4b0f52d98ebae33b8c50900d3d67e0666094b1be7a12fffd7f65de74b \
+ --hash=sha256:0a0b60701f2300c81b2ac88a5fb893ccfa408e1c4a555a77f908a2596eb875a5 \
+ --hash=sha256:0c71c2f6bf36e61ee5c47b2b9b5d47e4d1baad6426bfed9eea3e858fc6ee8806 \
+ --hash=sha256:0dc23bbb3e06ec1ea72d515fb572c1fea59695aefbffb106501138762e1e915e \
+ --hash=sha256:0dfa6115c6def37905344d56fb54c03afc49104e2ca473d5dedec0f6606913b4 \
+ --hash=sha256:12bff2ad9447188377f1b2794772f91fe68bb4bbfa5a39d7941fbebdbf8c500f \
+ --hash=sha256:1533b7eb683fb5f38c1d68a3c78f5fdd8f1412fa6b9bf03b40f450785a0ab915 \
+ --hash=sha256:1766b5724c3f779317d5321664a343c07773c8c5fd1532e4039e6cc7d1a815be \
+ --hash=sha256:181ef9b6bbf9845a264f9aa45c31836e9f3c1f13be565d0d010e964c661d1e2b \
+ --hash=sha256:183f857a53bcf4b1b42ef0f57ca553ab56bdd170e49d8091e96c51c3d69ca696 \
+ --hash=sha256:191aa858f7d4902e975d4cf2f2d9243816c91e9605070aeb09c0a800d187e323 \
+ --hash=sha256:1a8b0dd8648709b62d9372fc00a57466f5fdeefed666afe3fea5a6c9539a0331 \
+ --hash=sha256:1c962145c7473723df9722ba4c058de12eb5ebedcb4e27e7d902920aa3831ee8 \
+ --hash=sha256:1cc81d14ddfa53d7f3906694d35d54d9d3f850ef8e4e99ee68bc0d1e5fed9a9c \
+ --hash=sha256:1d815d48b1804ed7867b539236b6dd62997850ca1c91cad187f2ddb1b7bbef19 \
+ --hash=sha256:1e6c15d2080a63aaed876e228efe4f814bc7889c63b1e112ad46fdc8b368b9e1 \
+ --hash=sha256:20ab1ae4fa534f73647aad289003f1104092890849e0266271351922ed5574f8 \
+ --hash=sha256:20dae58a859b0906f0685642e591056f1e787f3a8b39c8e8749a45dc7d26bdb0 \
+ --hash=sha256:238e8c8610cb7c29460e37184f6799547f7e09e6a9bdbdab4e8edb90986a2318 \
+ --hash=sha256:24a4146ccb15be237fdef10f331c568e1b0e505f8c8c9ed5d67759dac58ac246 \
+ --hash=sha256:257d011919f133a4746958257f2c75238e3ff54255acd5e3e11f3ff41fd14256 \
+ --hash=sha256:2a343f91b17097c546b93f7999976fd6c9d5900617aa848c81d794e062ab302b \
+ --hash=sha256:2abe21d8ba64cded53a2a677e149ceb76dcf44284202d737178afe7ba540c1eb \
+ --hash=sha256:2c03c9b0c64afd0320ae57de4c982801271c0c211aa2d37f3003ff5feb75bb04 \
+ --hash=sha256:2c9c1b92b774b2e68d11193dc39620d62fd8ab33f0a3c77ecdabe19c179cdbc1 \
+ --hash=sha256:3021933c2cb7def39d927b9862292e0f4c75a13d7de70eb0ab06efed4c508c19 \
+ --hash=sha256:3100b3090269f3a7ea727b06a6080d4eb7439dca4c0e91a07c5d133bb1727ea7 \
+ --hash=sha256:313cfcd6af1a55a286a3c9a25f64af6d0e46cf60bc5798f1db152d97a216ff6f \
+ --hash=sha256:35e9a70a0f335371275cdcd08bc5b8051ac494dd58bff3bbfb421038220dc871 \
+ --hash=sha256:38721d4c9edd3eb6670437d8d5e2070063f305bfa2d5aa4278c51cedcd508a84 \
+ --hash=sha256:390e3170babf42462739a93321e657444f0862c6d722a291accc46f9d21ed04e \
+ --hash=sha256:39bfea47c375f379d8e87ab4bb9eb2c836e4f2069f0f65731d85e55d74666387 \
+ --hash=sha256:3ac51b65e8dc76cf4949419c54c5528adb24fc721df722fd452e5fbc236f5c40 \
+ --hash=sha256:3c0909c5234543ada2515c05dc08595b08d621ba919629e94427e8e03539c958 \
+ --hash=sha256:3da5852aad63fa0c6f836f3359647870e21ea96cf433eb393ffa45263a170d44 \
+ --hash=sha256:3e1157659470aa42a75448b6e943c895be8c70531c43cb78b9ba990778955582 \
+ --hash=sha256:4019a9d473c708cf2f16415688ef0b4639e07abaa569d72f74745bbeffafa2c7 \
+ --hash=sha256:43f10b007033f359bc3fa9cd5e6c1e76723f056ffa9a6b5c117cc35720a80292 \
+ --hash=sha256:49028aa684c144ea502a8e847d23aed5e4c2ef7cadfa7d5eaafcb40864844b7a \
+ --hash=sha256:4916dc96489616a6f9667e7526af8fa693c0fdb4f3acb0e5d9f4400eb06a47ba \
+ --hash=sha256:4a59e5bc386de021f56337f757301b337d7ab58baa40174fb150accd480bc953 \
+ --hash=sha256:4b1f66eb81eab2e0ff5775a3a312e5e2e16bf758f7b06be82fb0d04078c7ac51 \
+ --hash=sha256:4c5fe114a6dd480a510b6d3661d09d67d1622c4bf20660a474507aaee7eeeee9 \
+ --hash=sha256:4c70c70f9169692b36307a95f3d8c0a9fcd79f7b4a383aad5eaa0e9718b79b37 \
+ --hash=sha256:4d11382bcaf12f80b51d790dee295c56a159633a8e81e6323b16e55d81ae37e9 \
+ --hash=sha256:4f01a5d6444a3258b00dc07b6ea4733e26f8072b788bef750baa37b370266137 \
+ --hash=sha256:4f789e32fa1fb6a7bf890e0124e7b42d1e60d28ebff57fe806719abb75f0e9a3 \
+ --hash=sha256:4feb7511c29f8442cbbc28149a92093d32e815a28aa2c50d333826ad2a20fdf0 \
+ --hash=sha256:511d15193cbe013619dd05414c35a7dedf2088fcee93c6bbb7c77859765bd4e8 \
+ --hash=sha256:519067e29f67b5c90e64fb1a6b6e9d2ec0ba28705c51956637bac23a2f4ddae1 \
+ --hash=sha256:521ccf56f45bb3a791182dc6b88ae5f8fa079dd705ee42138c76deb1238e554e \
+ --hash=sha256:529c8156d7506fba5740e05da8795688f87119cce330c244519cf706a4a3d618 \
+ --hash=sha256:582462833ba7cee52e968b0341b85e392ae53d44c0f9af6a5927c80e539a8b67 \
+ --hash=sha256:5963b72ccd199ade6ee493723d18a3f21ba7d5b957017607f815788cef50eaf1 \
+ --hash=sha256:59b2093224a18c6508d95cfdeba8db9cbfd6f3494e94793b58972933fcee4c6d \
+ --hash=sha256:5afaddaa8e8c7f1f7b4c5c725c0070b6eed0228f705b90a1732a48e84350f4e9 \
+ --hash=sha256:5afea17ab3a126006dc2f293b14ffc7ef3c85336cf451564a0515ed7648033da \
+ --hash=sha256:5e09330b21d98adc8ccb2dbb9fc6cb434e8908d4c119aeaa772cb1caab5440a0 \
+ --hash=sha256:6188de70e190847bb6db3dc3981cbadff87d27d6fe9b4f0e18726d55795cee9b \
+ --hash=sha256:68ffcf982715f5b5b7686bdd349ff75d422e8f22551000c24b30eaa1b7f7ae84 \
+ --hash=sha256:696764a5be111b036256c0b18cd29783fab22154690fc698062fc1b0084b511d \
+ --hash=sha256:69a607203441e07e9a8a529cff1d5b73f6a160f22db1097211e6212a68567d11 \
+ --hash=sha256:69b312fecc1d017b5327afa81d4da1480f51c68810963a7336d92203dbb3d4f1 \
+ --hash=sha256:69f0c0a3df7fd3a7eec50a00396104bb9a843ea6d45fcc31c2d5243446ffd7a7 \
+ --hash=sha256:6a1cb5d6ce81379401bbb7f6dbe3d56de537fb8235979843f0d53bc2e9815a79 \
+ --hash=sha256:6d3498ad0df07d81112aa6ec6c95a7e7b1ae00929fb73e7ebee0f3faaeabad2f \
+ --hash=sha256:72a8d9564a717ee291f554eeb4bfeafe2309d5ec0aa6c475170bdab0f9ee8e88 \
+ --hash=sha256:777c62479d12395bfb932944e61e915741e364c843afc3196b694db3d669fcd0 \
+ --hash=sha256:77a7711fa562ba2da1aa757e11024ad6d93bad6ad7ede5afb9af144623e5f76a \
+ --hash=sha256:79061ba1a11b6a12743a2b0f72a46aa2758613d454aa6ba4f5a265cc48850158 \
+ --hash=sha256:7a48af25d9b3c15684059d0d1fc0bc30e8eee5ca521030e2bffddcab5be40226 \
+ --hash=sha256:7ab504c4d654e4a29558eaa5bb8cea5fdc1703ea60a8099ffd9c758472cf913f \
+ --hash=sha256:7bdb17009696214c3b66bb3590c6d62e14ac5935e53e929bcdbc5a495987a84f \
+ --hash=sha256:7da84c2c74c0f5bc97d853d9e17bb83e2dcafcff0dc48286916001cc114379a1 \
+ --hash=sha256:801a71f70f9813e82d2513c9a96532551fce1e278ec0c64610992c49c04c2dad \
+ --hash=sha256:824e6d3503ab990d7090768e4dfd9e840837bae057f212ff9f4f05ec6d1975e7 \
+ --hash=sha256:82b165b07f416bdccf5c84546a484cc8f15137ca38325403864bfdf2b5b72f6a \
+ --hash=sha256:84cfbd4d4d2cdeb2be61a057a258d26b22877266dd905809e94172dff01a42ae \
+ --hash=sha256:84d142d2d6cf9b31c12aa4878d82ed3b2324226270b89b676ac62ccd7df52d08 \
+ --hash=sha256:87a5531de9f71aceb8af041d72fc4cab4943648d91875ed56d2e629bef6d4c03 \
+ --hash=sha256:893b022bfbdf26d7bedb083efeea624e8550ca6eb98bf7fea30211ce95b9201a \
+ --hash=sha256:894514d47e012e794f1350f076c427d2347ebf82f9b958d554d12819849a369d \
+ --hash=sha256:8a7898b6ca3b7d6659e55cdac825a2e58c638cbf335cde41f4619e290dd0ad11 \
+ --hash=sha256:8ad7fd2258228bf288f2331f0a6148ad0186b2e3643055ed0db30990e59817a6 \
+ --hash=sha256:92c8db839367ef16a662478f0a2fe13e15f2227da3c1430a782ad0f6ee009ec9 \
+ --hash=sha256:941c1cfdf4799d623cf3aa1d326a6b4fdb7a5799ee2687f3516738216d2262fb \
+ --hash=sha256:9bc596b30f86dc6f0929499c9e574601679d0341a0108c25b9b358a042f51bca \
+ --hash=sha256:9c55b0a669976cf258afd718de3d9ad1b7d1fe0a91cd1ab36f38b03d4d4aeaaf \
+ --hash=sha256:9da4e873860ad5bab3291438525cae80169daecbfafe5657f7f5fb4d6b3f96b9 \
+ --hash=sha256:9def736773fd56b305c0eef698be5192c77bfa30d55a0e5885f80126c4831a15 \
+ --hash=sha256:9dfbe56b299cf5875b68eb6f0ebaadc9cac520a1989cac0db0765abfb3709c19 \
+ --hash=sha256:9e851920caab2dbcae311fd28f4313c6953993893eb5c1bb367ec69d9a39e7ed \
+ --hash=sha256:9e8cb77286025bdb21be2941d64ac6ca016130bfdcd228739e8ab137eb4406ed \
+ --hash=sha256:a547e21c5610b7e9093d870be50682a6a6cf180d6da0f42c47c306073bfdbbf6 \
+ --hash=sha256:a90a13408a7a856b87be8a9f008fff53c5080eea4e4180f6c2e546e4a972fb5d \
+ --hash=sha256:a9a63785467b2d73635957d32a4f6e73d5e4df497a16a6392fa066b753e87387 \
+ --hash=sha256:aa81873e2c8c5aa616ab8e017a481a96742fdf9313c40f14338ca7dbf50cb55f \
+ --hash=sha256:ac64f4b2bdb4ea622175c9ab7cf09444e412e22c0e02e906978b3b488af5fde8 \
+ --hash=sha256:aea1f9741b603a8d8fedb0ed5502c2bc0accbc51f43e2ad1337fe7259c2b77a5 \
+ --hash=sha256:b0afb8cdd034150d4d9f53926226ed27ad15b7f465e93d7468caaf5eafae0d37 \
+ --hash=sha256:b37a04d9f52cb76b6b78f35109b513f6519efb481d8ca4c321f6a3b9580b3f45 \
+ --hash=sha256:b5f7a446ddaf6ca0fad9a5535b56fbfc29998bf0e0b450d174bbec0d600e1d72 \
+ --hash=sha256:b6d9e5a2ed9c4988c8f9b28b3bc0e3e5b1aaa10c28d210a594ff3a8c02742daf \
+ --hash=sha256:b6e2c12160c72aeda9d1283e612f68804621f448145a210f1bf1d79151c47090 \
+ --hash=sha256:b818a592bd69bfe437ee8368603d4a2d928c34cffcdf77c2e761a759ffd17d20 \
+ --hash=sha256:c1851f429b822831bd2edcbe0cfd12ee9ea77868f8d3daf267b189371671c80e \
+ --hash=sha256:c1fb0cda2abcc0ac62f64e2ea4b4e64c57dfd6b885e693095460c61bde7bb18e \
+ --hash=sha256:c5ab0ee51f560d179b057555b4f601b7df909ed31312d301b99f8b9fc6028284 \
+ --hash=sha256:c70d9ec912802ecfd6cd390dadb34a9578b04f9bcb8e863d0a7598ba5e9e7ccc \
+ --hash=sha256:c741107203954f6fc34d3066d213d0a0c40f7bb5aafd698fb39888af277c70d8 \
+ --hash=sha256:ca3f059f4ba485d90c8dc75cb5ca897e15325e4e609812ce57f896607c1c0867 \
+ --hash=sha256:caf51943715b12af827696ec395bfa68f090a4c1a1d2509eb4e2cb69abbbdb33 \
+ --hash=sha256:cb28c1f569f8d33b2b5dcd05d0e6ef7005d8639c54c2f0be824f05aedf715255 \
+ --hash=sha256:cdad4ea3b4513b475e027be79e5a0ceac8ee1c113a1a11e5edc3c30c29f964d8 \
+ --hash=sha256:cf47cfdabc2194a669dcf7a8dbba62e37a04c5041d2125fae0233b720da6f05c \
+ --hash=sha256:d04cab0a54b9dba4d278fe955a1390da3cf71f57feb78ddc7cb67cbe0bd30323 \
+ --hash=sha256:d422b945683e409000c888e384546dbab9009bb92f7c0b456e217988cf316107 \
+ --hash=sha256:d80bf832ac7b1920ee29a426cdca335f96a2b5caa839811803e999b41ba9030d \
+ --hash=sha256:da619979df60a940cd434084355c514c25cf8eb4cf9a508510682f6c851a4f7a \
+ --hash=sha256:dafd4c44b74aa4bed4b250f1aed165b8ef5de743bcca3b88fc9619b6087093d2 \
+ --hash=sha256:dca83c498b4650a91efcf7b88d669b170256bf8017a5db6f3e06c2bf031f57e0 \
+ --hash=sha256:de2713f48c1ad57f89ac25b3cb7daed2156d8e822cf0eca9b96a6f990718cc41 \
+ --hash=sha256:de4ed93a8c91debfd5a047be327b7cc8b0cc6afe32a716bbbc4aedca9e2a83af \
+ --hash=sha256:df52098cde6d5e02fa75c1f6244f07971773adb4a26625edd5c18fee906fa84d \
+ --hash=sha256:dfbf280da5f876d0b00c81f26bedce274e72a678c28845453885a9b3c22ae632 \
+ --hash=sha256:e3730a48e5622e598293eee0762b09cff34dd3f271530f47b0894891281f051d \
+ --hash=sha256:e5162afc9e0d1f9cae3b577d9c29ddbab3505ab39012cb794d94a005825bde21 \
+ --hash=sha256:e5d524d68a474a9688336045bbf76cb0def88549c1b2ad9dbfec1fb7cfbe9170 \
+ --hash=sha256:e99685fc95d386da368013e7fb4269dd39c30d99f812a8372d62f244f662709c \
+ --hash=sha256:ea89a2458a1a75f87caabefe789c87539ea4e43b40f18cff526052e35bbb4fdf \
+ --hash=sha256:ec671691e72dff75817386aa02d81e708b5a7ec0dec6669ec05213ff6b77e1bd \
+ --hash=sha256:eed5ac260dd545fbc20da5f4f15e7efe36a55e0e7cf706e4ec005b491a9546a0 \
+ --hash=sha256:f14440b9573a6f76b4ee4770c13f0b5921f71dde3b6fcb8dabbefd13b7fe05d7 \
+ --hash=sha256:f405c93675d8d4c5ac87364bb38d06c988e11028a64b52a47158a355079661f3 \
+ --hash=sha256:f53ec51f9d24e9638a40cabb95078ade8c99251945dad8d57bf4aabe86ecee35 \
+ --hash=sha256:f61a9326f80ca59214d1cceb0a09bb2ece5b2563d4e0cd37bfd5515c28510674 \
+ --hash=sha256:f7bf2496fa563c046d05e4d232d7b7fd61346e2402052064b773e5c378bf6f73 \
+ --hash=sha256:fbaa70553ca116c77717f513e08815aec458e6b69a028d4028d403b3bc84ff37 \
+ --hash=sha256:fc3e55a7db08dc9a6ed5fb7103019d2c1a38a349ac41901f9f66d7f95750942f \
+ --hash=sha256:fc921b96fa95a097add244da36a1d9e4f3039160d1d30f1b35837bf108c21136 \
+ --hash=sha256:fd0641abca296bc1a00183fe44f7fced8807ed49d501f188faa642d0e4975b83 \
+ --hash=sha256:feac1045b3327a45944e7dcbeb57530339f6b17baff154df51ef8b0da34c8c12 \
+ --hash=sha256:ff110acded3c22c033e637dd8896e411c7d3a11289b2edf041f86663dbc791e9
# via
# jsonschema
# referencing
@@ -427,9 +456,9 @@ tomli==2.2.1 \
--hash=sha256:ece47d672db52ac607a3d9599a9d48dcb2f2f735c6c2d1f34130085bb12b112a \
--hash=sha256:f4039b9cbc3048b2416cc57ab3bda989a6fcf9b36cf8937f01a6e731b64f80d7
# via -r requirements.in
-typing-extensions==4.13.2 \
- --hash=sha256:a439e7c04b49fec3e5d3e2beaa21755cadbbdc391694e28ccdd36ca4a1408f8c \
- --hash=sha256:e6c81219bd689f51865d9e372991c540bda33a0379d5573cddb9a3a23f7caaef
+typing-extensions==4.14.1 \
+ --hash=sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36 \
+ --hash=sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76
# via -r requirements.in
urllib3==2.5.0 \
--hash=sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760 \
From f39d4ebe840c05036ed6d2e01a346abc80dfd642 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Tue, 8 Jul 2025 15:36:07 -0500
Subject: [PATCH 033/231] Bump to 3.14.0b4 (#689)
---
cpython-unix/build-cpython.sh | 7 +-
cpython-unix/patch-jit-cflags-314.patch | 90 -------------------------
pythonbuild/downloads.py | 8 +--
3 files changed, 6 insertions(+), 99 deletions(-)
delete mode 100644 cpython-unix/patch-jit-cflags-314.patch
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 4a85ba73d..cc93f0ad2 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -480,11 +480,8 @@ if [ -n "${CPYTHON_OPTIMIZED}" ]; then
# Respect CFLAGS during JIT compilation.
#
- # Backports https://github.com/python/cpython/pull/134276 which we're trying to get released
- # in 3.14, but is currently only in 3.15+.
- if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
- patch -p1 -i ${ROOT}/patch-jit-cflags-314.patch
- elif [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
+ # Backports https://github.com/python/cpython/pull/134276
+ if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" && -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_13}" ]]; then
patch -p1 -i ${ROOT}/patch-jit-cflags-313.patch
fi
diff --git a/cpython-unix/patch-jit-cflags-314.patch b/cpython-unix/patch-jit-cflags-314.patch
deleted file mode 100644
index a75563b47..000000000
--- a/cpython-unix/patch-jit-cflags-314.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-diff --git a/Misc/NEWS.d/next/Build/2025-05-19-18-09-20.gh-issue-134273.ZAliyy.rst b/Misc/NEWS.d/next/Build/2025-05-19-18-09-20.gh-issue-134273.ZAliyy.rst
-new file mode 100644
-index 00000000000..3eb13cefbe6
---- /dev/null
-+++ b/Misc/NEWS.d/next/Build/2025-05-19-18-09-20.gh-issue-134273.ZAliyy.rst
-@@ -0,0 +1 @@
-+Add support for configuring compiler flags for the JIT with ``CFLAGS_JIT``
-diff --git a/Tools/jit/_targets.py b/Tools/jit/_targets.py
-index d0a1c081ffe..b383e39da19 100644
---- a/Tools/jit/_targets.py
-+++ b/Tools/jit/_targets.py
-@@ -10,6 +10,7 @@
- import sys
- import tempfile
- import typing
-+import shlex
-
- import _llvm
- import _schema
-@@ -46,6 +47,7 @@ class _Target(typing.Generic[_S, _R]):
- stable: bool = False
- debug: bool = False
- verbose: bool = False
-+ cflags: str = ""
- known_symbols: dict[str, int] = dataclasses.field(default_factory=dict)
- pyconfig_dir: pathlib.Path = pathlib.Path.cwd().resolve()
-
-@@ -62,6 +64,7 @@ def _compute_digest(self) -> str:
- hasher = hashlib.sha256()
- hasher.update(self.triple.encode())
- hasher.update(self.debug.to_bytes())
-+ hasher.update(self.cflags.encode())
- # These dependencies are also reflected in _JITSources in regen.targets:
- hasher.update(PYTHON_EXECUTOR_CASES_C_H.read_bytes())
- hasher.update((self.pyconfig_dir / "pyconfig.h").read_bytes())
-@@ -155,6 +158,8 @@ async def _compile(
- f"{o}",
- f"{c}",
- *self.args,
-+ # Allow user-provided CFLAGS to override any defaults
-+ *shlex.split(self.cflags),
- ]
- await _llvm.run("clang", args, echo=self.verbose)
- return await self._parse(o)
-diff --git a/Tools/jit/build.py b/Tools/jit/build.py
-index 1afd0c76bad..a0733005929 100644
---- a/Tools/jit/build.py
-+++ b/Tools/jit/build.py
-@@ -39,11 +39,15 @@
- parser.add_argument(
- "-v", "--verbose", action="store_true", help="echo commands as they are run"
- )
-+ parser.add_argument(
-+ "--cflags", help="additional flags to pass to the compiler", default=""
-+ )
- args = parser.parse_args()
- for target in args.target:
- target.debug = args.debug
- target.force = args.force
- target.verbose = args.verbose
-+ target.cflags = args.cflags
- target.pyconfig_dir = args.pyconfig_dir
- target.build(
- comment=comment,
-diff --git a/configure b/configure
-index 029bf527da4..fef9f2d7da9 100755
---- a/configure
-+++ b/configure
-@@ -10863,7 +10863,7 @@ then :
-
- else case e in #(
- e) as_fn_append CFLAGS_NODIST " $jit_flags"
-- REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir ."
-+ REGEN_JIT_COMMAND="\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir . --cflags=\"$CFLAGS_JIT\""
- JIT_STENCILS_H="jit_stencils.h"
- if test "x$Py_DEBUG" = xtrue
- then :
-diff --git a/configure.ac b/configure.ac
-index 371b2e8ed73..cc37a636c52 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -2776,7 +2776,7 @@ AS_VAR_IF([jit_flags],
- [],
- [AS_VAR_APPEND([CFLAGS_NODIST], [" $jit_flags"])
- AS_VAR_SET([REGEN_JIT_COMMAND],
-- ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir ."])
-+ ["\$(PYTHON_FOR_REGEN) \$(srcdir)/Tools/jit/build.py ${ARCH_TRIPLES:-$host} --output-dir . --pyconfig-dir . --cflags=\"$CFLAGS_JIT\""])
- AS_VAR_SET([JIT_STENCILS_H], ["jit_stencils.h"])
- AS_VAR_IF([Py_DEBUG],
- [true],
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index a208ce568..20d5c98a3 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -82,10 +82,10 @@
"python_tag": "cp313",
},
"cpython-3.14": {
- "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0b3.tar.xz",
- "size": 23626928,
- "sha256": "c6f48bf51f01f50d87007a445dd7afe4a4c7a87ab482570be924c1ddfd0d3682",
- "version": "3.14.0b3",
+ "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0b4.tar.xz",
+ "size": 23641472,
+ "sha256": "15e123e056abebba6de5e73cfa304459a8c82cafa85d4fc7fc6de80e6a3e1b39",
+ "version": "3.14.0b4",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp314",
From e996271b4ac836282d9f7d997b0ef8ecfca34336 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Wed, 9 Jul 2025 07:24:56 -0500
Subject: [PATCH 034/231] Drop `.sha256` files from releases (#691)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
GitHub has started enforcing a 1000 file limit, which breaks us.
I first encountered it in CI during the release:
https://github.com/astral-sh/python-build-standalone/actions/runs/16156480423
Then got to an actual error message via the CLI:
```
❯ gh release upload 20250708 dist/cpython-3.14.0b4-riscv64-unknown-linux-gnu-freethreaded+lto-20250708T1536.tar.zst
HTTP 422: Validation Failed (https://uploads.github.com/repos/astral-sh/python-build-standalone/releases/230978017/assets?label=&name=cpython-3.14.0b4-riscv64-unknown-linux-gnu-freethreaded%2Blto-20250708T1536.tar.zst)
file_count limited to 1000 assets per release
```
You can see they documented a limit recently:
https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases#storage-and-bandwidth-quotas
https://web.archive.org/web/20250629152715/https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases
---
src/github.rs | 8 --------
1 file changed, 8 deletions(-)
diff --git a/src/github.rs b/src/github.rs
index 0d3bc9715..2dfbba58e 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -505,14 +505,6 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
file_data,
dry_run,
));
- fs.push(upload_release_artifact(
- &raw_client,
- token.clone(),
- &release,
- format!("{}.sha256", dest),
- Bytes::copy_from_slice(format!("{}\n", digest).as_bytes()),
- dry_run,
- ));
}
let mut buffered = futures::stream::iter(fs).buffer_unordered(16);
From 62461bd628e8e6d0b406f4486222e388ba9d2724 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Thu, 10 Jul 2025 17:24:39 -0400
Subject: [PATCH 035/231] Add missing Makefile dependency for binutils -> gcc
image (#692)
This was unintentionally removed in 21cf744dda2d0e19329950a81a07d9067179f976.
---
cpython-unix/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
index dcb239aa8..40c34a27b 100644
--- a/cpython-unix/Makefile
+++ b/cpython-unix/Makefile
@@ -79,7 +79,7 @@ $(OUTDIR)/image-%.$(HOST_PLATFORM).tar: $(OUTDIR)/%.Dockerfile
$(RUN_BUILD) --toolchain image-$*
endif
-$(OUTDIR)/binutils-$(BINUTILS_VERSION)-$(HOST_PLATFORM).tar: $(HERE)/build-binutils.sh
+$(OUTDIR)/binutils-$(BINUTILS_VERSION)-$(HOST_PLATFORM).tar: $(OUTDIR)/image-$(DOCKER_IMAGE_GCC).$(HOST_PLATFORM).tar $(HERE)/build-binutils.sh
$(RUN_BUILD) --toolchain --docker-image $(DOCKER_IMAGE_GCC) binutils
$(OUTDIR)/$(CLANG_FILENAME):
From 7797c3898aa2cc03f6b92dc1370f6e8fd0797345 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Fri, 11 Jul 2025 10:39:07 -0500
Subject: [PATCH 036/231] Enable fts4, fts5, rtree, and geopoly in SQLite
(#694)
And add some regression tests.
Co-authored-by: Geoffrey Thomas
---
cpython-unix/build-sqlite.sh | 14 +++++++++++++-
src/verify_distribution.py | 9 +++++++++
2 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/cpython-unix/build-sqlite.sh b/cpython-unix/build-sqlite.sh
index e01e3077d..ef7c6a631 100755
--- a/cpython-unix/build-sqlite.sh
+++ b/cpython-unix/build-sqlite.sh
@@ -27,7 +27,19 @@ fi
# it's not looked for.
unset CXX
-CC_FOR_BUILD="${HOST_CC}" CFLAGS="${EXTRA_TARGET_CFLAGS} -DSQLITE_ENABLE_DBSTAT_VTAB -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS3_TOKENIZER -fPIC" CPPFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" ./configure ${CONFIGURE_FLAGS}
+CC_FOR_BUILD="${HOST_CC}" \
+CFLAGS="${EXTRA_TARGET_CFLAGS} \
+ -DSQLITE_ENABLE_DBSTAT_VTAB \
+ -DSQLITE_ENABLE_FTS3 \
+ -DSQLITE_ENABLE_FTS3_PARENTHESIS \
+ -DSQLITE_ENABLE_FTS3_TOKENIZER \
+ -DSQLITE_ENABLE_FTS4 \
+ -DSQLITE_ENABLE_FTS5 \
+ -DSQLITE_ENABLE_GEOPOLY \
+ -DSQLITE_ENABLE_RTREE \
+ -fPIC" \
+CPPFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" \
+LDFLAGS="${EXTRA_TARGET_LDFLAGS}" ./configure ${CONFIGURE_FLAGS}
make -j ${NUM_CPUS} libsqlite3.a
make install-lib DESTDIR=${ROOT}/out
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 1ac2381f4..d516f3a49 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -122,6 +122,15 @@ def test_sqlite(self):
self.assertTrue(hasattr(conn, "enable_load_extension"))
# Backup feature requires modern SQLite, which we always have.
self.assertTrue(hasattr(conn, "backup"))
+ # Ensure that various extensions are present. These will raise
+ # if they are not.
+ cursor = conn.cursor()
+ cursor.execute("CREATE VIRTUAL TABLE fts3 USING fts3(sender, title, body);")
+ cursor.execute("CREATE VIRTUAL TABLE fts4 USING fts4(sender, title, body);")
+ cursor.execute("CREATE VIRTUAL TABLE fts5 USING fts5(sender, title, body);")
+ cursor.execute("CREATE VIRTUAL TABLE geopoly USING geopoly();")
+ cursor.execute("CREATE VIRTUAL TABLE rtree USING rtree(id, minX, maxX);")
+ conn.close()
def test_ssl(self):
import ssl
From 69c7662d877e7bc899ad46658662a5320ac3f93a Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Sun, 29 Jun 2025 13:31:54 -0400
Subject: [PATCH 037/231] For non-release CI, upload before validating
This allows downloading and poking at build artifacts that fail validation.
Now the order of tasks for all platforms is the same: build, upload
attestations, upload artifacts, validate. (This was already the order for
macos.)
---
.github/workflows/linux.yml | 52 +++++++++++++++++------------------
.github/workflows/windows.yml | 12 ++++----
2 files changed, 32 insertions(+), 32 deletions(-)
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index d4602fbe5..39bc8733d 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -249,6 +249,19 @@ jobs:
./build-linux.py --target-triple ${{ matrix.target_triple }} --python cpython-${{ matrix.python }} --options ${{ matrix.build_options }}
+ - name: Generate attestations
+ uses: actions/attest-build-provenance@v2
+ if: ${{ github.ref == 'refs/heads/main' }}
+ with:
+ subject-path: dist/*
+
+ - name: Upload Distribution
+ if: ${{ ! matrix.dry-run }}
+ uses: actions/upload-artifact@v4
+ with:
+ name: cpython-${{ matrix.python }}-${{ matrix.target_triple }}-${{ matrix.build_options }}
+ path: dist/*
+
- name: Validate Distribution
if: ${{ ! matrix.dry-run }}
run: |
@@ -267,19 +280,6 @@ jobs:
build/pythonbuild validate-distribution ${EXTRA_ARGS} dist/*.tar.zst
- - name: Generate attestations
- uses: actions/attest-build-provenance@v2
- if: ${{ github.ref == 'refs/heads/main' }}
- with:
- subject-path: dist/*
-
- - name: Upload Distribution
- if: ${{ ! matrix.dry-run }}
- uses: actions/upload-artifact@v4
- with:
- name: cpython-${{ matrix.python }}-${{ matrix.target_triple }}-${{ matrix.build_options }}
- path: dist/*
-
build-1:
needs:
- generate-matrix
@@ -349,6 +349,19 @@ jobs:
./build-linux.py --target-triple ${{ matrix.target_triple }} --python cpython-${{ matrix.python }} --options ${{ matrix.build_options }}
+ - name: Generate attestations
+ uses: actions/attest-build-provenance@v2
+ if: ${{ github.ref == 'refs/heads/main' }}
+ with:
+ subject-path: dist/*
+
+ - name: Upload Distribution
+ if: ${{ ! matrix.dry-run }}
+ uses: actions/upload-artifact@v4
+ with:
+ name: cpython-${{ matrix.python }}-${{ matrix.target_triple }}-${{ matrix.build_options }}
+ path: dist/*
+
- name: Validate Distribution
if: ${{ ! matrix.dry-run }}
run: |
@@ -366,16 +379,3 @@ jobs:
fi
build/pythonbuild validate-distribution ${EXTRA_ARGS} dist/*.tar.zst
-
- - name: Generate attestations
- uses: actions/attest-build-provenance@v2
- if: ${{ github.ref == 'refs/heads/main' }}
- with:
- subject-path: dist/*
-
- - name: Upload Distribution
- if: ${{ ! matrix.dry-run }}
- uses: actions/upload-artifact@v4
- with:
- name: cpython-${{ matrix.python }}-${{ matrix.target_triple }}-${{ matrix.build_options }}
- path: dist/*
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index e285fac3a..165ff2617 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -146,12 +146,6 @@ jobs:
call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\${{ matrix.vcvars }}"
py.exe -3.12 build-windows.py --python cpython-${{ matrix.python }} --sh c:\cygwin\bin\sh.exe --options ${{ matrix.build_options }}
- - name: Validate Distribution
- if: ${{ ! matrix.dry-run }}
- run: |
- $Dists = Resolve-Path -Path "dist/*.tar.zst" -Relative
- .\pythonbuild.exe validate-distribution --run $Dists
-
- name: Generate attestations
uses: actions/attest-build-provenance@v2
if: ${{ github.ref == 'refs/heads/main' }}
@@ -163,3 +157,9 @@ jobs:
with:
name: cpython-${{ matrix.python }}-${{ matrix.vcvars }}-${{ matrix.build_options }}
path: dist/*
+
+ - name: Validate Distribution
+ if: ${{ ! matrix.dry-run }}
+ run: |
+ $Dists = Resolve-Path -Path "dist/*.tar.zst" -Relative
+ .\pythonbuild.exe validate-distribution --run $Dists
From 6fd593c4b55c3e5e7dc3831bf97b8538aad8a815 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Fri, 11 Jul 2025 12:39:06 -0400
Subject: [PATCH 038/231] Skip sqlite3 geopoly test on Windows
---
src/verify_distribution.py | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index d516f3a49..9773471b7 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -128,8 +128,12 @@ def test_sqlite(self):
cursor.execute("CREATE VIRTUAL TABLE fts3 USING fts3(sender, title, body);")
cursor.execute("CREATE VIRTUAL TABLE fts4 USING fts4(sender, title, body);")
cursor.execute("CREATE VIRTUAL TABLE fts5 USING fts5(sender, title, body);")
- cursor.execute("CREATE VIRTUAL TABLE geopoly USING geopoly();")
cursor.execute("CREATE VIRTUAL TABLE rtree USING rtree(id, minX, maxX);")
+ if os.name != "nt":
+ # TODO(geofft): not sure why this isn't present in the prebuilt
+ # sqlite3 Windows library from CPython upstream, it seems weird to
+ # be inconsistent across platforms, but that's the status quo
+ cursor.execute("CREATE VIRTUAL TABLE geopoly USING geopoly();")
conn.close()
def test_ssl(self):
From ffffa3d94592dda8a10fd59bbbbf5e1576d6558b Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Fri, 11 Jul 2025 16:12:21 -0400
Subject: [PATCH 039/231] Further fix sqlite test cases (#701)
---
src/verify_distribution.py | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 9773471b7..65cd084aa 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -122,18 +122,21 @@ def test_sqlite(self):
self.assertTrue(hasattr(conn, "enable_load_extension"))
# Backup feature requires modern SQLite, which we always have.
self.assertTrue(hasattr(conn, "backup"))
- # Ensure that various extensions are present. These will raise
- # if they are not.
- cursor = conn.cursor()
- cursor.execute("CREATE VIRTUAL TABLE fts3 USING fts3(sender, title, body);")
- cursor.execute("CREATE VIRTUAL TABLE fts4 USING fts4(sender, title, body);")
- cursor.execute("CREATE VIRTUAL TABLE fts5 USING fts5(sender, title, body);")
- cursor.execute("CREATE VIRTUAL TABLE rtree USING rtree(id, minX, maxX);")
+ # Ensure that various extensions are present. These will raise if they are not. Note that
+ # CPython upstream carries configuration flags for the Windows build, so geopoly is missing
+ # on all versions and rtree is missing in 3.9. On non-Windows platforms, we configure
+ # SQLite ourselves. We might want to patch the build to enable these on Windows, see #666.
+ extensions = ["fts3", "fts4", "fts5"]
if os.name != "nt":
- # TODO(geofft): not sure why this isn't present in the prebuilt
- # sqlite3 Windows library from CPython upstream, it seems weird to
- # be inconsistent across platforms, but that's the status quo
- cursor.execute("CREATE VIRTUAL TABLE geopoly USING geopoly();")
+ extensions.append("geopoly")
+ if os.name == "nt" and sys.version_info[0:2] >= (3, 9):
+ extensions.append("rtree")
+ cursor = conn.cursor()
+ for extension in extensions:
+ with self.subTest(extension=extension):
+ cursor.execute(
+ f"CREATE VIRTUAL TABLE test{extension} USING {extension}(a, b, c);"
+ )
conn.close()
def test_ssl(self):
From 6857d7f7c20b89f02b5581caf778b047f5f4be41 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Fri, 11 Jul 2025 16:17:11 -0400
Subject: [PATCH 040/231] typo (#702)
---
src/verify_distribution.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 65cd084aa..9dc27400e 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -129,7 +129,7 @@ def test_sqlite(self):
extensions = ["fts3", "fts4", "fts5"]
if os.name != "nt":
extensions.append("geopoly")
- if os.name == "nt" and sys.version_info[0:2] >= (3, 9):
+ if os.name != "nt" or sys.version_info[0:2] >= (3, 9):
extensions.append("rtree")
cursor = conn.cursor()
for extension in extensions:
From 684cb94f5c4dd22e1591832532c041110b7f6f90 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Fri, 11 Jul 2025 18:20:15 -0400
Subject: [PATCH 041/231] typo (#703)
---
src/verify_distribution.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 9dc27400e..d6e428d6d 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -129,7 +129,7 @@ def test_sqlite(self):
extensions = ["fts3", "fts4", "fts5"]
if os.name != "nt":
extensions.append("geopoly")
- if os.name != "nt" or sys.version_info[0:2] >= (3, 9):
+ if os.name != "nt" or sys.version_info[0:2] > (3, 9):
extensions.append("rtree")
cursor = conn.cursor()
for extension in extensions:
From 174daa6f039587d2e9488eeccc8d0d7e4573e45a Mon Sep 17 00:00:00 2001
From: Simon Lamon <32477463+silamon@users.noreply.github.com>
Date: Tue, 22 Jul 2025 02:11:47 +0200
Subject: [PATCH 042/231] Update rust dependencies (octocrab & object) (#705)
There are some dependencies with breaking or deprecated changes.
These have been upgraded in this PR applying the breaking changes.
It should unlock
https://github.com/astral-sh/python-build-standalone/pull/633
---
Cargo.lock | 188 +++++++++++++++++-----------------------------
Cargo.toml | 4 +-
src/github.rs | 4 +-
src/validation.rs | 2 +-
4 files changed, 72 insertions(+), 126 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index b0db1676e..dcb95c776 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -263,8 +263,10 @@ checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
dependencies = [
"android-tzdata",
"iana-time-zone",
+ "js-sys",
"num-traits",
"serde",
+ "wasm-bindgen",
"windows-targets",
]
@@ -327,6 +329,16 @@ dependencies = [
"libc",
]
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
[[package]]
name = "core-foundation-sys"
version = "0.8.7"
@@ -395,17 +407,6 @@ dependencies = [
"powerfmt",
]
-[[package]]
-name = "derive_more"
-version = "0.99.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3da29a38df43d6f156149c9b43ded5e018ddff2a855cf2cfd62e8cd7d079c69f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
[[package]]
name = "digest"
version = "0.10.7"
@@ -782,25 +783,6 @@ dependencies = [
"want",
]
-[[package]]
-name = "hyper-rustls"
-version = "0.26.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
-dependencies = [
- "futures-util",
- "http",
- "hyper",
- "hyper-util",
- "log",
- "rustls 0.22.4",
- "rustls-native-certs",
- "rustls-pki-types",
- "tokio",
- "tokio-rustls 0.25.0",
- "tower-service",
-]
-
[[package]]
name = "hyper-rustls"
version = "0.27.5"
@@ -811,10 +793,12 @@ dependencies = [
"http",
"hyper",
"hyper-util",
- "rustls 0.23.22",
+ "log",
+ "rustls",
+ "rustls-native-certs",
"rustls-pki-types",
"tokio",
- "tokio-rustls 0.26.1",
+ "tokio-rustls",
"tower-service",
"webpki-roots",
]
@@ -1217,7 +1201,7 @@ dependencies = [
"openssl-probe",
"openssl-sys",
"schannel",
- "security-framework",
+ "security-framework 2.11.1",
"security-framework-sys",
"tempfile",
]
@@ -1264,29 +1248,29 @@ dependencies = [
[[package]]
name = "object"
-version = "0.32.2"
+version = "0.36.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
dependencies = [
- "flate2",
"memchr",
- "ruzstd",
]
[[package]]
name = "object"
-version = "0.36.7"
+version = "0.37.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+checksum = "03fd943161069e1768b4b3d050890ba48730e590f57e56d4aa04e7e090e61b4a"
dependencies = [
+ "flate2",
"memchr",
+ "ruzstd",
]
[[package]]
name = "octocrab"
-version = "0.34.3"
+version = "0.44.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c4e00a4268539fda6c431a0fd01d016d4b44c361f9c283d0eb8f1ab7408a517"
+checksum = "86996964f8b721067b6ed238aa0ccee56ecad6ee5e714468aa567992d05d2b91"
dependencies = [
"arc-swap",
"async-trait",
@@ -1302,7 +1286,7 @@ dependencies = [
"http-body",
"http-body-util",
"hyper",
- "hyper-rustls 0.26.0",
+ "hyper-rustls",
"hyper-timeout",
"hyper-util",
"jsonwebtoken",
@@ -1316,10 +1300,11 @@ dependencies = [
"serde_urlencoded",
"snafu",
"tokio",
- "tower 0.4.13",
+ "tower",
"tower-http",
"tracing",
"url",
+ "web-time",
]
[[package]]
@@ -1567,7 +1552,7 @@ dependencies = [
"hyper",
"hyper-util",
"normalize-path",
- "object 0.32.2",
+ "object 0.37.1",
"octocrab",
"once_cell",
"pdb",
@@ -1611,7 +1596,7 @@ dependencies = [
"quinn-proto",
"quinn-udp",
"rustc-hash",
- "rustls 0.23.22",
+ "rustls",
"socket2",
"thiserror 2.0.11",
"tokio",
@@ -1629,7 +1614,7 @@ dependencies = [
"rand",
"ring",
"rustc-hash",
- "rustls 0.23.22",
+ "rustls",
"rustls-pki-types",
"slab",
"thiserror 2.0.11",
@@ -1745,7 +1730,7 @@ dependencies = [
"http-body",
"http-body-util",
"hyper",
- "hyper-rustls 0.27.5",
+ "hyper-rustls",
"hyper-tls",
"hyper-util",
"ipnet",
@@ -1757,7 +1742,7 @@ dependencies = [
"percent-encoding",
"pin-project-lite",
"quinn",
- "rustls 0.23.22",
+ "rustls",
"rustls-pemfile",
"rustls-pki-types",
"serde",
@@ -1767,9 +1752,9 @@ dependencies = [
"system-configuration",
"tokio",
"tokio-native-tls",
- "tokio-rustls 0.26.1",
+ "tokio-rustls",
"tokio-util",
- "tower 0.5.2",
+ "tower",
"tower-service",
"url",
"wasm-bindgen",
@@ -1865,26 +1850,13 @@ dependencies = [
"windows-sys 0.59.0",
]
-[[package]]
-name = "rustls"
-version = "0.22.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
-dependencies = [
- "log",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
[[package]]
name = "rustls"
version = "0.23.22"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9fb9263ab4eb695e42321db096e3b8fbd715a59b154d5c88d82db2175b681ba7"
dependencies = [
+ "log",
"once_cell",
"ring",
"rustls-pki-types",
@@ -1895,15 +1867,14 @@ dependencies = [
[[package]]
name = "rustls-native-certs"
-version = "0.7.3"
+version = "0.8.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
+checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3"
dependencies = [
"openssl-probe",
- "rustls-pemfile",
"rustls-pki-types",
"schannel",
- "security-framework",
+ "security-framework 3.2.0",
]
[[package]]
@@ -1943,12 +1914,10 @@ checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
[[package]]
name = "ruzstd"
-version = "0.5.0"
+version = "0.8.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58c4eb8a81997cf040a091d1f7e1938aeab6749d3a0dfa73af43cdc32393483d"
+checksum = "3640bec8aad418d7d03c72ea2de10d5c646a598f9883c7babc160d91e3c1b26c"
dependencies = [
- "byteorder",
- "derive_more",
"twox-hash",
]
@@ -2001,9 +1970,9 @@ dependencies = [
[[package]]
name = "secrecy"
-version = "0.8.0"
+version = "0.10.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bd1c54ea06cfd2f6b63219704de0b9b4f72dcc2b8fdef820be6cd799780e91e"
+checksum = "e891af845473308773346dc847b2c23ee78fe442e0472ac50e22a18a93d3ae5a"
dependencies = [
"zeroize",
]
@@ -2015,7 +1984,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
dependencies = [
"bitflags 2.8.0",
- "core-foundation",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271720403f46ca04f7ba6f55d438f8bd878d6b8ca0a1046e8228c4145bcbb316"
+dependencies = [
+ "bitflags 2.8.0",
+ "core-foundation 0.10.1",
"core-foundation-sys",
"libc",
"security-framework-sys",
@@ -2206,12 +2188,6 @@ version = "1.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
-[[package]]
-name = "static_assertions"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
-
[[package]]
name = "strsim"
version = "0.11.1"
@@ -2262,7 +2238,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
dependencies = [
"bitflags 2.8.0",
- "core-foundation",
+ "core-foundation 0.9.4",
"system-configuration-sys",
]
@@ -2433,24 +2409,13 @@ dependencies = [
"tokio",
]
-[[package]]
-name = "tokio-rustls"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
-dependencies = [
- "rustls 0.22.4",
- "rustls-pki-types",
- "tokio",
-]
-
[[package]]
name = "tokio-rustls"
version = "0.26.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37"
dependencies = [
- "rustls 0.23.22",
+ "rustls",
"tokio",
]
@@ -2467,23 +2432,6 @@ dependencies = [
"tokio",
]
-[[package]]
-name = "tower"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
-dependencies = [
- "futures-core",
- "futures-util",
- "pin-project",
- "pin-project-lite",
- "tokio",
- "tokio-util",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
[[package]]
name = "tower"
version = "0.5.2"
@@ -2495,25 +2443,26 @@ dependencies = [
"pin-project-lite",
"sync_wrapper",
"tokio",
+ "tokio-util",
"tower-layer",
"tower-service",
+ "tracing",
]
[[package]]
name = "tower-http"
-version = "0.5.2"
+version = "0.6.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
+checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
dependencies = [
"bitflags 2.8.0",
"bytes",
"futures-util",
"http",
"http-body",
- "http-body-util",
"iri-string",
"pin-project-lite",
- "tower 0.4.13",
+ "tower",
"tower-layer",
"tower-service",
"tracing",
@@ -2571,13 +2520,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
[[package]]
name = "twox-hash"
-version = "1.6.3"
+version = "2.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
-dependencies = [
- "cfg-if",
- "static_assertions",
-]
+checksum = "8b907da542cbced5261bd3256de1b3a1bf340a3d37f93425a07362a1d687de56"
[[package]]
name = "typenum"
@@ -2809,6 +2754,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
dependencies = [
"js-sys",
+ "serde",
"wasm-bindgen",
]
diff --git a/Cargo.toml b/Cargo.toml
index 82f029828..9b4af3a7c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,8 +19,8 @@ http-body-util = "0.1.0"
hyper = { version = "1.2.0", features = ["client"] }
hyper-util = { version = "0.1.3" }
normalize-path = "0.2.1"
-object = "0.32.2"
-octocrab = { version = "0.34.1", features = ["rustls", "stream"] }
+object = "0.37.1"
+octocrab = { version = "0.44.1", features = ["rustls", "stream"] }
once_cell = "1.19.0"
pdb = "0.8.0"
pep440_rs = "0.6.6"
diff --git a/src/github.rs b/src/github.rs
index 2dfbba58e..70342008a 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -551,8 +551,8 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
let mut stream = client
.repos(organization, repo)
- .releases()
- .stream_asset(shasums_asset.id)
+ .release_assets()
+ .stream(shasums_asset.id.into_inner())
.await?;
let mut asset_bytes = Vec::::new();
diff --git a/src/validation.rs b/src/validation.rs
index 5ab717086..b0ffb5304 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -1051,7 +1051,7 @@ fn validate_elf>(
{
let strings = symbols.strings();
- for (symbol_index, symbol) in symbols.iter().enumerate() {
+ for (symbol_index, symbol) in symbols.enumerate() {
let name = String::from_utf8_lossy(symbol.name(endian, strings)?);
// If symbol versions are defined and we're in the .dynsym section, there should
From 50a2c25e1f1cba1c3bc39af31505e0e3ffe68e97 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 21 Jul 2025 19:11:56 -0500
Subject: [PATCH 043/231] Bump the python group across 1 directory with 6
updates (#708)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the python group with 6 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [certifi](https://github.com/certifi/python-certifi) | `2025.6.15` |
`2025.7.14` |
| [jsonschema](https://github.com/python-jsonschema/jsonschema) |
`4.24.0` | `4.25.0` |
| [pywin32](https://github.com/mhammond/pywin32) | `310` | `311` |
| [mypy](https://github.com/python/mypy) | `1.16.1` | `1.17.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.12.2` | `0.12.4` |
| [types-jsonschema](https://github.com/typeshed-internal/stub_uploader)
| `4.24.0.20250528` | `4.25.0.20250720` |
Updates `certifi` from 2025.6.15 to 2025.7.14
Commits
Updates `jsonschema` from 4.24.0 to 4.25.0
Release notes
Sourced from jsonschema's
releases.
v4.25.0
What's Changed
New Contributors
Full Changelog: https://github.com/python-jsonschema/jsonschema/compare/v4.24.1...v4.25.0
v4.24.1
What's Changed
New Contributors
Full Changelog: https://github.com/python-jsonschema/jsonschema/compare/v4.24.0...v4.24.1
Changelog
Sourced from jsonschema's
changelog.
v4.25.0
- Add support for the
iri and iri-reference
formats to the format-nongpl extra via the MIT-licensed
rfc3987-syntax.
They were alread supported by the format extra. (#1388).
v4.24.1
- Properly escape segments in
ValidationError.json_path
(#139).
Commits
9889f69
Add the new functionality to the CHANGELOG.
18855d0
Merge pull request #1388
from jkowalleck/feat/validate_rfc3987_non-gpl/rfc398...
1a6067f
adjust rfc3987-syntax min-version
6aadb8b
Add the fix to the CHANGELOG.
785741e
Add a dependency group for our new test dependency.
dc54734
Add a uv.lock.
b5572c9
Merge pull request #1390
from kurtmckee/fix-json_path-str-rendering
4cf45b9
Feedback: Use jsonpath-ng to re-parse the rendered JSON path
2680f6a
Feedback: Make a compiled regex pattern private
9a957d7
Unambiguously quote and escape properties in JSON path rendering
- Additional commits viewable in compare
view
Updates `pywin32` from 310 to 311
Release notes
Sourced from pywin32's
releases.
Build 311
A release with a
number of incremental improvements
Install via pip:
pip install pywin32 --upgrade
More details in
the README
Changelog
Sourced from pywin32's
changelog.
Build 311, released 2025/07/14
- Fix use-after-free in CertDeleteCertificateFromStore (#2637)
- Better support for COM identifiers with non-ascii characters (#2632)
- pywin32's own warnings will now refer to the caller, rather than to
the internal source of warning itself (#2594,
@Avasam)
- Fixed a regression that broke special dunder
methods with CoClass. (#1870,
#2493,
@Avasam, @geppi)
- Fixed
TypeError: cannot unpack non-iterable NoneType
object when registering an axscript client ScriptItem (#2513,
@Avasam)
- Fixed a memory leak when SafeArrays are used as out parameters (
@the-snork)
- Fixed dispatch handling for properties (
@the-snork)
- Resolved a handful of deprecation warnings (#2567,
#2576,
@Avasam)
- The following classes now produce a valid
eval string
representation when calling repr: (#2573,
@Avasam)
pywin.tools.browser.HLIPythonObject
win32com.server.exception.COMException
win32comext.axscript.client.error.AXScriptException
win32comext.axscript.client.pyscript.NamedScriptAttribute
- Added initial
DECIMAL/VT_DECIMAL support (#1501,
@gesslerpd)
Commits
Updates `mypy` from 1.16.1 to 1.17.0
Changelog
Sourced from mypy's
changelog.
Mypy Release Notes
Next Release
Mypy 1.17
We’ve just uploaded mypy 1.17 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new
features and bug fixes.
You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.
Optionally Check That Match Is Exhaustive
Mypy can now optionally generate an error if a match statement does
not
match exhaustively, without having to use
assert_never(...). Enable
this by using --enable-error-code exhaustive-match.
Example:
# mypy: enable-error-code=exhaustive-match
import enum
class Color(enum.Enum):
RED = 1
BLUE = 2
def show_color(val: Color) -> None:
# error: Unhandled case for values of type
"Literal[Color.BLUE]"
match val:
case Color.RED:
print("red")
This feature was contributed by Donal Burns (PR 19144).
Further Improvements to Attribute Resolution
This release includes additional improvements to how attribute types
and kinds are resolved. These fix many bugs and overall improve
consistency.
- Handle corner case: protocol/class variable/descriptor (Ivan
Levkivskyi, PR 19277)
- Fix a few inconsistencies in protocol/type object interactions (Ivan
Levkivskyi, PR 19267)
- Refactor/unify access to static attributes (Ivan Levkivskyi, PR 19254)
- Remove inconsistencies in operator handling (Ivan Levkivskyi, PR 19250)
- Make protocol subtyping more consistent (Ivan Levkivskyi, PR 18943)
... (truncated)
Commits
0260991
Update version string
3901aa2
Updates to 1.17 changelog (#19436)
7d13396
Initial changelog for 1.17 release (#19427)
a182dec
Combine the revealed types of multiple iteration steps in a more robust
manne...
ab4fd57
Improve the handling of "iteration dependent" errors and notes
in finally cla...
09ba1f6
[mypyc] Fix exception swallowing in async try/finally blocks with await
(#19353)
5c65e33
[mypyc] Fix AttributeError in async try/finally with mixed return paths
(#19361)
934ec50
Lessen dmypy suggest path limitations for Windows machines (#19337)
a4801f9
Type ignore comments erroneously marked as unused by dmypy (#15043)
c3bfa0d
Handle corner case: protocol vs classvar vs descriptor (#19277)
- Additional commits viewable in compare
view
Updates `ruff` from 0.12.2 to 0.12.4
Release notes
Sourced from ruff's
releases.
0.12.4
Release Notes
Preview features
- [
flake8-type-checking, pyupgrade,
ruff] Add from __future__ import annotations
when it would allow new fixes (TC001, TC002,
TC003, UP037, RUF013) (#19100)
- [
flake8-use-pathlib] Add autofix for
PTH109 (#19245)
- [
pylint] Detect indirect pathlib.Path
usages for unspecified-encoding (PLW1514) (#19304)
Bug fixes
- [
flake8-bugbear] Fix B017 false negatives
for keyword exception arguments (#19217)
- [
flake8-use-pathlib] Fix false negative on direct
Path() instantiation (PTH210) (#19388)
- [
flake8-django] Fix DJ008 false positive
for abstract models with type-annotated abstract field (#19221)
- [
isort] Fix I002 import insertion after
docstring with multiple string statements (#19222)
- [
isort] Treat form feed as valid whitespace before a
semicolon (#19343)
- [
pydoclint] Fix SyntaxError from fixes
with line continuations (D201, D202) (#19246)
- [
refurb] FURB164 fix should validate
arguments and should usually be marked unsafe (#19136)
Rule changes
- [
flake8-use-pathlib] Skip single dots for
invalid-pathlib-with-suffix (PTH210) on
versions >= 3.14 (#19331)
- [
pep8_naming] Avoid false positives on standard library
functions with uppercase names (N802) (#18907)
- [
pycodestyle] Handle brace escapes for t-strings in
logical lines (#19358)
- [
pylint] Extend invalid string character rules to
include t-strings (#19355)
- [
ruff] Allow strict kwarg when checking
for starmap-zip (RUF058) in Python 3.14+ (#19333)
Documentation
Contributors
... (truncated)
Changelog
Sourced from ruff's
changelog.
0.12.4
Preview features
- [
flake8-type-checking, pyupgrade,
ruff] Add from __future__ import annotations
when it would allow new fixes (TC001, TC002,
TC003, UP037, RUF013) (#19100)
- [
flake8-use-pathlib] Add autofix for
PTH109 (#19245)
- [
pylint] Detect indirect pathlib.Path
usages for unspecified-encoding (PLW1514) (#19304)
Bug fixes
- [
flake8-bugbear] Fix B017 false negatives
for keyword exception arguments (#19217)
- [
flake8-use-pathlib] Fix false negative on direct
Path() instantiation (PTH210) (#19388)
- [
flake8-django] Fix DJ008 false positive
for abstract models with type-annotated abstract field (#19221)
- [
isort] Fix I002 import insertion after
docstring with multiple string statements (#19222)
- [
isort] Treat form feed as valid whitespace before a
semicolon (#19343)
- [
pydoclint] Fix SyntaxError from fixes
with line continuations (D201, D202) (#19246)
- [
refurb] FURB164 fix should validate
arguments and should usually be marked unsafe (#19136)
Rule changes
- [
flake8-use-pathlib] Skip single dots for
invalid-pathlib-with-suffix (PTH210) on
versions >= 3.14 (#19331)
- [
pep8_naming] Avoid false positives on standard library
functions with uppercase names (N802) (#18907)
- [
pycodestyle] Handle brace escapes for t-strings in
logical lines (#19358)
- [
pylint] Extend invalid string character rules to
include t-strings (#19355)
- [
ruff] Allow strict kwarg when checking
for starmap-zip (RUF058) in Python 3.14+ (#19333)
Documentation
0.12.3
Preview features
- [
flake8-bugbear] Support non-context-manager calls in
B017 (#19063)
- [
flake8-use-pathlib] Add autofixes for
PTH100, PTH106, PTH107,
PTH108, PTH110, PTH111,
PTH112, PTH113, PTH114,
PTH115, PTH117, PTH119,
PTH120 (#19213)
- [
flake8-use-pathlib] Add autofixes for
PTH203, PTH204, PTH205 (#18922)
Bug fixes
- [
flake8-return] Fix false-positive for variables used
inside nested functions in RET504 (#18433)
- Treat form feed as valid whitespace before a line continuation (#19220)
- [
flake8-type-checking] Fix syntax error introduced by
fix (TC008) (#19150)
- [
pyupgrade] Keyword arguments in super
should suppress the UP008 fix (#19131)
Documentation
- [
flake8-pyi] Make example error out-of-the-box
(PYI007, PYI008) (#19103)
- [
flake8-simplify] Make example error out-of-the-box
(SIM116) (#19111)
... (truncated)
Commits
ee2759b
Bump 0.12.4 (#19406)
35f33d9
[ty] publish settings diagnostics (#19335)
5d78b31
[flake8-use-pathlib] Add autofix for PTH109
(#19245)
c2a05b4
[ty] Use bitflags for resolved client capabilities (#19393)
fae0b5c
[ty] Initial implementation of declaration and definition providers. (#19371)
cbe94b0
[ty] Support empty function bodies in if TYPE_CHECKING
blocks (#19372)
029de78
[flake8-use-pathlib] Fix false negative on direct
Path() instantiation (`...
ff94fe7
Treat form feed as valid whitespace before a semicolon (#19343)
b2501b4
[pylint] Detect indirect pathlib.Path usages
for unspecified-encoding (...
291699b
[refurb] FURB164 fix should validate arguments
and should usually be mark...
- Additional commits viewable in compare
view
Updates `types-jsonschema` from 4.24.0.20250528 to 4.25.0.20250720
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
requirements.dev.txt | 110 +++++++++++++++++++++----------------------
requirements.win.txt | 50 +++++++++++---------
2 files changed, 82 insertions(+), 78 deletions(-)
diff --git a/requirements.dev.txt b/requirements.dev.txt
index 0876769e3..b45edbc3c 100644
--- a/requirements.dev.txt
+++ b/requirements.dev.txt
@@ -198,39 +198,39 @@ markupsafe==3.0.2 \
# via
# -r requirements.txt
# jinja2
-mypy==1.16.1 \
- --hash=sha256:051e1677689c9d9578b9c7f4d206d763f9bbd95723cd1416fad50db49d52f359 \
- --hash=sha256:08e850ea22adc4d8a4014651575567b0318ede51e8e9fe7a68f25391af699507 \
- --hash=sha256:09aa4f91ada245f0a45dbc47e548fd94e0dd5a8433e0114917dc3b526912a30c \
- --hash=sha256:0a7cfb0fe29fe5a9841b7c8ee6dffb52382c45acdf68f032145b75620acfbd6f \
- --hash=sha256:0ab5eca37b50188163fa7c1b73c685ac66c4e9bdee4a85c9adac0e91d8895e15 \
- --hash=sha256:1256688e284632382f8f3b9e2123df7d279f603c561f099758e66dd6ed4e8bd6 \
- --hash=sha256:13c7cd5b1cb2909aa318a90fd1b7e31f17c50b242953e7dd58345b2a814f6383 \
- --hash=sha256:1f0435cf920e287ff68af3d10a118a73f212deb2ce087619eb4e648116d1fe9b \
- --hash=sha256:211287e98e05352a2e1d4e8759c5490925a7c784ddc84207f4714822f8cf99b6 \
- --hash=sha256:22d76a63a42619bfb90122889b903519149879ddbf2ba4251834727944c8baca \
- --hash=sha256:2c7ce0662b6b9dc8f4ed86eb7a5d505ee3298c04b40ec13b30e572c0e5ae17c4 \
- --hash=sha256:352025753ef6a83cb9e7f2427319bb7875d1fdda8439d1e23de12ab164179574 \
- --hash=sha256:44e7acddb3c48bd2713994d098729494117803616e116032af192871aed80b79 \
- --hash=sha256:472e4e4c100062488ec643f6162dd0d5208e33e2f34544e1fc931372e806c0cc \
- --hash=sha256:4f58ac32771341e38a853c5d0ec0dfe27e18e27da9cdb8bbc882d2249c71a3ee \
- --hash=sha256:58e07fb958bc5d752a280da0e890c538f1515b79a65757bbdc54252ba82e0b40 \
- --hash=sha256:5e198ab3f55924c03ead626ff424cad1732d0d391478dfbf7bb97b34602395da \
- --hash=sha256:5fc2ac4027d0ef28d6ba69a0343737a23c4d1b83672bf38d1fe237bdc0643b37 \
- --hash=sha256:66df38405fd8466ce3517eda1f6640611a0b8e70895e2a9462d1d4323c5eb4b9 \
- --hash=sha256:6bd00a0a2094841c5e47e7374bb42b83d64c527a502e3334e1173a0c24437bab \
- --hash=sha256:7fc688329af6a287567f45cc1cefb9db662defeb14625213a5b7da6e692e2069 \
- --hash=sha256:86042bbf9f5a05ea000d3203cf87aa9d0ccf9a01f73f71c58979eb9249f46d72 \
- --hash=sha256:87ff2c13d58bdc4bbe7dc0dedfe622c0f04e2cb2a492269f3b418df2de05c536 \
- --hash=sha256:af4792433f09575d9eeca5c63d7d90ca4aeceda9d8355e136f80f8967639183d \
- --hash=sha256:b4f0fed1022a63c6fec38f28b7fc77fca47fd490445c69d0a66266c59dd0b88a \
- --hash=sha256:d5d2309511cc56c021b4b4e462907c2b12f669b2dbeb68300110ec27723971be \
- --hash=sha256:ddc91eb318c8751c69ddb200a5937f1232ee8efb4e64e9f4bc475a33719de438 \
- --hash=sha256:dedb6229b2c9086247e21a83c309754b9058b438704ad2f6807f0d8227f6ebdd \
- --hash=sha256:ea16e2a7d2714277e349e24d19a782a663a34ed60864006e8585db08f8ad1782 \
- --hash=sha256:ea7469ee5902c95542bea7ee545f7006508c65c8c54b06dc2c92676ce526f3ea \
- --hash=sha256:f895078594d918f93337a505f8add9bd654d1a24962b4c6ed9390e12531eb31b \
- --hash=sha256:ff9fa5b16e4c1364eb89a4d16bcda9987f05d39604e1e6c35378a2987c1aac2d
+mypy==1.17.0 \
+ --hash=sha256:037bc0f0b124ce46bfde955c647f3e395c6174476a968c0f22c95a8d2f589bba \
+ --hash=sha256:03ba330b76710f83d6ac500053f7727270b6b8553b0423348ffb3af6f2f7b889 \
+ --hash=sha256:0e69db1fb65b3114f98c753e3930a00514f5b68794ba80590eb02090d54a5d4a \
+ --hash=sha256:1051df7ec0886fa246a530ae917c473491e9a0ba6938cfd0ec2abc1076495c3e \
+ --hash=sha256:15d9d0018237ab058e5de3d8fce61b6fa72cc59cc78fd91f1b474bce12abf496 \
+ --hash=sha256:1619a485fd0e9c959b943c7b519ed26b712de3002d7de43154a489a2d0fd817d \
+ --hash=sha256:24cfcc1179c4447854e9e406d3af0f77736d631ec87d31c6281ecd5025df625d \
+ --hash=sha256:2c41aa59211e49d717d92b3bb1238c06d387c9325d3122085113c79118bebb06 \
+ --hash=sha256:3204d773bab5ff4ebbd1f8efa11b498027cd57017c003ae970f310e5b96be8d8 \
+ --hash=sha256:3c56f180ff6430e6373db7a1d569317675b0a451caf5fef6ce4ab365f5f2f6c3 \
+ --hash=sha256:434ad499ad8dde8b2f6391ddfa982f41cb07ccda8e3c67781b1bfd4e5f9450a8 \
+ --hash=sha256:51e455a54d199dd6e931cd7ea987d061c2afbaf0960f7f66deef47c90d1b304d \
+ --hash=sha256:63e751f1b5ab51d6f3d219fe3a2fe4523eaa387d854ad06906c63883fde5b1ab \
+ --hash=sha256:6ff25d151cc057fdddb1cb1881ef36e9c41fa2a5e78d8dd71bee6e4dcd2bc05b \
+ --hash=sha256:73a0ff2dd10337ceb521c080d4147755ee302dcde6e1a913babd59473904615f \
+ --hash=sha256:93468cf29aa9a132bceb103bd8475f78cacde2b1b9a94fd978d50d4bdf616c9a \
+ --hash=sha256:98189382b310f16343151f65dd7e6867386d3e35f7878c45cfa11383d175d91f \
+ --hash=sha256:9d4fe5c72fd262d9c2c91c1117d16aac555e05f5beb2bae6a755274c6eec42be \
+ --hash=sha256:b72c34ce05ac3a1361ae2ebb50757fb6e3624032d91488d93544e9f82db0ed6c \
+ --hash=sha256:ba06254a5a22729853209550d80f94e28690d5530c661f9416a68ac097b13fc4 \
+ --hash=sha256:c004135a300ab06a045c1c0d8e3f10215e71d7b4f5bb9a42ab80236364429937 \
+ --hash=sha256:c38876106cb6132259683632b287238858bd58de267d80defb6f418e9ee50658 \
+ --hash=sha256:ce4a17920ec144647d448fc43725b5873548b1aae6c603225626747ededf582d \
+ --hash=sha256:d30ba01c0f151998f367506fab31c2ac4527e6a7b2690107c7a7f9e3cb419a9c \
+ --hash=sha256:d96b196e5c16f41b4f7736840e8455958e832871990c7ba26bf58175e357ed61 \
+ --hash=sha256:e5d7ccc08ba089c06e2f5629c660388ef1fee708444f1dee0b9203fa031dee03 \
+ --hash=sha256:eafaf8b9252734400f9b77df98b4eee3d2eecab16104680d51341c75702cad70 \
+ --hash=sha256:f105f61a5eff52e137fd73bee32958b2add9d9f0a856f17314018646af838e97 \
+ --hash=sha256:f773c6d14dcc108a5b141b4456b0871df638eb411a89cd1c0c001fc4a9d08fc8 \
+ --hash=sha256:f7fb09d05e0f1c329a36dcd30e27564a3555717cde87301fae4fb542402ddfad \
+ --hash=sha256:f8e08de6138043108b3b18f09d3f817a4783912e48828ab397ecf183135d84d6 \
+ --hash=sha256:f986f1cab8dbec39ba6e0eaa42d4d3ac6686516a5d3dccd64be095db05ebc6bb
# via -r requirements.dev.in
mypy-extensions==1.0.0 \
--hash=sha256:4392f6c0eb8a5668a69e23d168ffa70f0be9ccfd32b5cc2d26a34ae5b844552d \
@@ -417,25 +417,25 @@ rpds-py==0.22.3 \
# -r requirements.txt
# jsonschema
# referencing
-ruff==0.12.2 \
- --hash=sha256:093ea2b221df1d2b8e7ad92fc6ffdca40a2cb10d8564477a987b44fd4008a7be \
- --hash=sha256:09e4cf27cc10f96b1708100fa851e0daf21767e9709e1649175355280e0d950e \
- --hash=sha256:2a4a20aeed74671b2def096bdf2eac610c7d8ffcbf4fb0e627c06947a1d7078d \
- --hash=sha256:369ffb69b70cd55b6c3fc453b9492d98aed98062db9fec828cdfd069555f5f1a \
- --hash=sha256:3b8b94317cbc2ae4a2771af641739f933934b03555e51515e6e021c64441532d \
- --hash=sha256:3eb3a6b2db4d6e2c77e682f0b988d4d61aff06860158fdb413118ca133d57922 \
- --hash=sha256:45fc42c3bf1d30d2008023a0a9a0cfb06bf9835b147f11fe0679f21ae86d34b1 \
- --hash=sha256:48d6c6bfb4761df68bc05ae630e24f506755e702d4fb08f08460be778c7ccb12 \
- --hash=sha256:4987b8f4ceadf597c927beee65a5eaf994c6e2b631df963f86d8ad1bdea99342 \
- --hash=sha256:6932323db80484dda89153da3d8e58164d01d6da86857c79f1961934354992da \
- --hash=sha256:6aa7e623a3a11538108f61e859ebf016c4f14a7e6e4eba1980190cacb57714ce \
- --hash=sha256:71a4c550195612f486c9d1f2b045a600aeba851b298c667807ae933478fcef04 \
- --hash=sha256:73448de992d05517170fc37169cbca857dfeaeaa8c2b9be494d7bcb0d36c8f4b \
- --hash=sha256:793d8859445ea47591272021a81391350205a4af65a9392401f418a95dfb75c9 \
- --hash=sha256:8ae64755b22f4ff85e9c52d1f82644abd0b6b6b6deedceb74bd71f35c24044cc \
- --hash=sha256:ce48f675c394c37e958bf229fb5c1e843e20945a6d962cf3ea20b7a107dcd9f4 \
- --hash=sha256:d7b4f55cd6f325cb7621244f19c873c565a08aff5a4ba9c69aa7355f3f7afd3e \
- --hash=sha256:dca8a3b6d6dc9810ed8f328d406516bf4d660c00caeaef36eb831cf4871b0639
+ruff==0.12.4 \
+ --hash=sha256:0618ec4442a83ab545e5b71202a5c0ed7791e8471435b94e655b570a5031a98e \
+ --hash=sha256:0fc426bec2e4e5f4c4f182b9d2ce6a75c85ba9bcdbe5c6f2a74fcb8df437df4b \
+ --hash=sha256:13efa16df6c6eeb7d0f091abae50f58e9522f3843edb40d56ad52a5a4a4b6873 \
+ --hash=sha256:2abc48f3d9667fdc74022380b5c745873499ff827393a636f7a59da1515e7c57 \
+ --hash=sha256:2b2449dc0c138d877d629bea151bee8c0ae3b8e9c43f5fcaafcd0c0d0726b184 \
+ --hash=sha256:478fccdb82ca148a98a9ff43658944f7ab5ec41c3c49d77cd99d44da019371a1 \
+ --hash=sha256:4de27977827893cdfb1211d42d84bc180fceb7b72471104671c59be37041cf93 \
+ --hash=sha256:55c0f4ca9769408d9b9bac530c30d3e66490bd2beb2d3dae3e4128a1f05c7442 \
+ --hash=sha256:56e45bb11f625db55f9b70477062e6a1a04d53628eda7784dce6e0f55fd549eb \
+ --hash=sha256:a7dea966bcb55d4ecc4cc3270bccb6f87a337326c9dcd3c07d5b97000dbff41c \
+ --hash=sha256:a8224cc3722c9ad9044da7f89c4c1ec452aef2cfe3904365025dd2f51daeae0e \
+ --hash=sha256:afcfa3ab5ab5dd0e1c39bf286d829e042a15e966b3726eea79528e2e24d8371a \
+ --hash=sha256:be0593c69df9ad1465e8a2d10e3defd111fdb62dcd5be23ae2c06da77e8fcffb \
+ --hash=sha256:c057ce464b1413c926cdb203a0f858cd52f3e73dcb3270a3318d1630f6395bb3 \
+ --hash=sha256:cb0d261dac457ab939aeb247e804125a5d521b21adf27e721895b0d3f83a0d0a \
+ --hash=sha256:e64b90d1122dc2713330350626b10d60818930819623abbb56535c6466cce045 \
+ --hash=sha256:e9949d01d64fa3672449a51ddb5d7548b33e130240ad418884ee6efa7a229586 \
+ --hash=sha256:fe0b9e9eb23736b453143d72d2ceca5db323963330d5b7859d60d101147d461a
# via -r requirements.dev.in
six==1.17.0 \
--hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
@@ -481,9 +481,9 @@ types-jinja2==2.11.9 \
--hash=sha256:60a1e21e8296979db32f9374d8a239af4cb541ff66447bb915d8ad398f9c63b2 \
--hash=sha256:dbdc74a40aba7aed520b7e4d89e8f0fe4286518494208b35123bcf084d4b8c81
# via -r requirements.dev.in
-types-jsonschema==4.24.0.20250528 \
- --hash=sha256:6a906b5ff73ac11c8d1e0b6c30a9693e1e4e1ab56c56c932b3a7e081b86d187b \
- --hash=sha256:7e28c64e0ae7980eeb158105b20663fc6a6b8f81d5f86ea6614aa0014417bd1e
+types-jsonschema==4.25.0.20250720 \
+ --hash=sha256:765a3b6144798fe3161fd8cbe570a756ed3e8c0e5adb7c09693eb49faad39dbd \
+ --hash=sha256:7d7897c715310d8bf9ae27a2cedba78bbb09e4cad83ce06d2aa79b73a88941df
# via -r requirements.dev.in
types-markupsafe==1.1.10 \
--hash=sha256:85b3a872683d02aea3a5ac2a8ef590193c344092032f58457287fbf8e06711b1 \
diff --git a/requirements.win.txt b/requirements.win.txt
index faa013574..a9132ab39 100644
--- a/requirements.win.txt
+++ b/requirements.win.txt
@@ -6,9 +6,9 @@ attrs==25.3.0 \
# via
# jsonschema
# referencing
-certifi==2025.6.15 \
- --hash=sha256:2e0c7ce7cb5d8f8634ca55d2ba7e6ec2689a2fd6537d8dec1296a477a4910057 \
- --hash=sha256:d747aa5a8b9bbbb1bb8c22bb13e22bd1f18e9796defa16bab421f7f7a317323b
+certifi==2025.7.14 \
+ --hash=sha256:6b31f564a415d79ee77df69d757bb49a5bb53bd9f756cbbe24394ffd6fc1f4b2 \
+ --hash=sha256:8ea99dbdfaaf2ba2f9bac77b9249ef62ec5218e7c2b2e903378ed5fccf765995
# via requests
charset-normalizer==3.4.2 \
--hash=sha256:005fa3432484527f9732ebd315da8da8001593e2cf46a3d817669f062c3d9ed4 \
@@ -116,9 +116,9 @@ jinja2==3.1.6 \
--hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
--hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
# via -r requirements.in
-jsonschema==4.24.0 \
- --hash=sha256:0b4e8069eb12aedfa881333004bccaec24ecef5a8a6a4b6df142b2cc9599d196 \
- --hash=sha256:a462455f19f5faf404a7902952b6f0e3ce868f3ee09a359b05eca6673bd8412d
+jsonschema==4.25.0 \
+ --hash=sha256:24c2e8da302de79c8b9382fee3e76b355e44d2a4364bb207159ce10b517bd716 \
+ --hash=sha256:e63acf5c11762c0e6672ffb61482bdf57f0876684d8d249c0fe2d730d48bc55f
# via -r requirements.in
jsonschema-specifications==2025.4.1 \
--hash=sha256:4653bffbd6584f7de83a67e0d620ef16900b390ddc7939d56684d6c81e33f1af \
@@ -187,23 +187,27 @@ markupsafe==3.0.2 \
--hash=sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430 \
--hash=sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50
# via jinja2
-pywin32==310 \
- --hash=sha256:0867beb8addefa2e3979d4084352e4ac6e991ca45373390775f7084cc0209b9c \
- --hash=sha256:126298077a9d7c95c53823934f000599f66ec9296b09167810eb24875f32689c \
- --hash=sha256:19ec5fc9b1d51c4350be7bb00760ffce46e6c95eaf2f0b2f1150657b1a43c582 \
- --hash=sha256:1e765f9564e83011a63321bb9d27ec456a0ed90d3732c4b2e312b855365ed8bd \
- --hash=sha256:2349cc906eae872d0663d4d6290d13b90621eaf78964bb1578632ff20e152966 \
- --hash=sha256:30f0a9b3138fb5e07eb4973b7077e1883f558e40c578c6925acc7a94c34eaa36 \
- --hash=sha256:33babed0cf0c92a6f94cc6cc13546ab24ee13e3e800e61ed87609ab91e4c8213 \
- --hash=sha256:5d241a659c496ada3253cd01cfaa779b048e90ce4b2b38cd44168ad555ce74ab \
- --hash=sha256:667827eb3a90208ddbdcc9e860c81bde63a135710e21e4cb3348968e4bd5249e \
- --hash=sha256:6dd97011efc8bf51d6793a82292419eba2c71cf8e7250cfac03bba284454abc1 \
- --hash=sha256:851c8d927af0d879221e616ae1f66145253537bbdd321a77e8ef701b443a9a1a \
- --hash=sha256:8a75a5cc3893e83a108c05d82198880704c44bbaee4d06e442e471d3c9ea4f3d \
- --hash=sha256:96867217335559ac619f00ad70e513c0fcf84b8a3af9fc2bba3b59b97da70475 \
- --hash=sha256:bf5c397c9a9a19a6f62f3fb821fbf36cac08f03770056711f765ec1503972060 \
- --hash=sha256:c3e78706e4229b915a0821941a84e7ef420bf2b77e08c9dae3c76fd03fd2ae3d \
- --hash=sha256:e308f831de771482b7cf692a1f308f8fca701b2d8f9dde6cc440c7da17e47b33
+pywin32==311 \
+ --hash=sha256:0502d1facf1fed4839a9a51ccbcc63d952cf318f78ffc00a7e78528ac27d7a2b \
+ --hash=sha256:184eb5e436dea364dcd3d2316d577d625c0351bf237c4e9a5fabbcfa5a58b151 \
+ --hash=sha256:3aca44c046bd2ed8c90de9cb8427f581c479e594e99b5c0bb19b29c10fd6cb87 \
+ --hash=sha256:3ce80b34b22b17ccbd937a6e78e7225d80c52f5ab9940fe0506a1a16f3dab503 \
+ --hash=sha256:62ea666235135fee79bb154e695f3ff67370afefd71bd7fea7512fc70ef31e3d \
+ --hash=sha256:6c6f2969607b5023b0d9ce2541f8d2cbb01c4f46bc87456017cf63b73f1e2d8c \
+ --hash=sha256:718a38f7e5b058e76aee1c56ddd06908116d35147e133427e59a3983f703a20d \
+ --hash=sha256:750ec6e621af2b948540032557b10a2d43b0cee2ae9758c54154d711cc852d31 \
+ --hash=sha256:797c2772017851984b97180b0bebe4b620bb86328e8a884bb626156295a63b3b \
+ --hash=sha256:7b4075d959648406202d92a2310cb990fea19b535c7f4a78d3f5e10b926eeb8a \
+ --hash=sha256:a508e2d9025764a8270f93111a970e1d0fbfc33f4153b388bb649b7eec4f9b42 \
+ --hash=sha256:a733f1388e1a842abb67ffa8e7aad0e70ac519e09b0f6a784e65a136ec7cefd2 \
+ --hash=sha256:aba8f82d551a942cb20d4a83413ccbac30790b50efb89a75e4f586ac0bb8056b \
+ --hash=sha256:b7a2c10b93f8986666d0c803ee19b5990885872a7de910fc460f9b0c2fbf92ee \
+ --hash=sha256:b8c095edad5c211ff31c05223658e71bf7116daa0ecf3ad85f3201ea3190d067 \
+ --hash=sha256:c8015b09fb9a5e188f83b7b04de91ddca4658cee2ae6f3bc483f0b21a77ef6cd \
+ --hash=sha256:d03ff496d2a0cd4a5893504789d4a15399133fe82517455e78bad62efbb7f0a3 \
+ --hash=sha256:e0c4cfb0621281fe40387df582097fd796e80430597cb9944f0ae70447bacd91 \
+ --hash=sha256:e286f46a9a39c4a18b319c28f59b61de793654af2f395c102b4f819e584b5852 \
+ --hash=sha256:f95ba5a847cba10dd8c4d8fefa9f2a6cf283b8b88ed6178fa8a6c1ab16054d0d
# via docker
pyyaml==6.0.2 \
--hash=sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff \
From cf3c7eaf4e668e064e3260b09e366231075cfc8c Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Mon, 21 Jul 2025 19:18:45 -0500
Subject: [PATCH 044/231] Run dependabot monthly instead of weekly (#709)
The CI is expensive and there is ~no benefit to end users from a faster
update cadence
---
.github/dependabot.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7a9774338..a79e311f9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,7 +3,7 @@ updates:
- package-ecosystem: "pip"
directory: "/"
schedule:
- interval: "weekly"
+ interval: "monthly"
groups:
python:
patterns:
@@ -11,7 +11,7 @@ updates:
- package-ecosystem: "cargo"
directory: "/"
schedule:
- interval: "weekly"
+ interval: "monthly"
groups:
rust:
patterns:
From 0ca55fec9f0f20edf1907f7e2b2824d4b54ea03b Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Tue, 22 Jul 2025 20:12:07 -0400
Subject: [PATCH 045/231] Bump CPython to 3.14.0rc1 (#710)
---
cpython-unix/extension-modules.yml | 3 +++
pythonbuild/downloads.py | 8 ++++----
2 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index 4b8345630..c069ca1b6 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -206,6 +206,9 @@ _curses_panel:
_datetime:
sources:
- _datetimemodule.c
+ setup-enabled-conditional:
+ - enabled: true
+ minimum-python-version: "3.14"
_dbm:
sources:
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 20d5c98a3..78a24011f 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -82,10 +82,10 @@
"python_tag": "cp313",
},
"cpython-3.14": {
- "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0b4.tar.xz",
- "size": 23641472,
- "sha256": "15e123e056abebba6de5e73cfa304459a8c82cafa85d4fc7fc6de80e6a3e1b39",
- "version": "3.14.0b4",
+ "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0rc1.tar.xz",
+ "size": 23661916,
+ "sha256": "8707780ae9f19c5bf5b9f27827181ba11cdad7bb292ea49cad5424331e40ee8b",
+ "version": "3.14.0rc1",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp314",
From 32b1e3038310a9e6333f65fc49d27e164174998c Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Tue, 1 Jul 2025 16:02:59 -0400
Subject: [PATCH 046/231] Allow using a custom GitHub API endpoint for
releasing
This lets me test the release scripts against a custom, fault-injected
Python server, but I suppose it might also be useful for downstream
users who have GHES, maybe. Patches welcome if anyone is using this and
it doesn't quite work right!
---
src/github.rs | 30 ++++++++++++++++--------------
src/main.rs | 12 ++++++++++++
2 files changed, 28 insertions(+), 14 deletions(-)
diff --git a/src/github.rs b/src/github.rs
index 70342008a..f42d99959 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -112,6 +112,20 @@ async fn upload_release_artifact(
Ok(())
}
+fn new_github_client(args: &ArgMatches) -> Result<(Octocrab, String)> {
+ let token = args
+ .get_one::("token")
+ .expect("token should be specified")
+ .to_string();
+ let github_uri = args.get_one::("github-uri");
+
+ let mut builder = OctocrabBuilder::new().personal_token(token.clone());
+ if let Some(github_uri) = github_uri {
+ builder = builder.base_uri(github_uri.clone())?;
+ }
+ Ok((builder.build()?, token))
+}
+
pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()> {
let dest_dir = args
.get_one::("dest")
@@ -121,13 +135,7 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
.expect("organization should be set");
let repo = args.get_one::("repo").expect("repo should be set");
- let client = OctocrabBuilder::new()
- .personal_token(
- args.get_one::("token")
- .expect("token should be required argument")
- .to_string(),
- )
- .build()?;
+ let (client, _) = new_github_client(args)?;
let release_version_range = pep440_rs::VersionSpecifier::from_str(">=3.9")?;
@@ -358,10 +366,6 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
.get_one::("tag")
.expect("tag should be specified");
let ignore_missing = args.get_flag("ignore_missing");
- let token = args
- .get_one::("token")
- .expect("token should be specified")
- .to_string();
let organization = args
.get_one::("organization")
.expect("organization should be specified");
@@ -451,9 +455,7 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
return Err(anyhow!("missing {} release artifacts", missing.len()));
}
- let client = OctocrabBuilder::new()
- .personal_token(token.clone())
- .build()?;
+ let (client, token) = new_github_client(args)?;
let repo_handler = client.repos(organization, repo);
let releases = repo_handler.releases();
diff --git a/src/main.rs b/src/main.rs
index df441e132..c8d422e82 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -70,6 +70,12 @@ fn main_impl() -> Result<()> {
.action(ArgAction::Set)
.default_value("python-build-standalone")
.help("GitHub repository name"),
+ )
+ .arg(
+ Arg::new("github-uri")
+ .long("github-uri")
+ .action(ArgAction::Set)
+ .help("Alternative GitHub URI"),
),
);
@@ -154,6 +160,12 @@ fn main_impl() -> Result<()> {
.action(ArgAction::Set)
.default_value("python-build-standalone")
.help("GitHub repository name"),
+ )
+ .arg(
+ Arg::new("github-uri")
+ .long("github-uri")
+ .action(ArgAction::Set)
+ .help("Alternative GitHub URI"),
),
);
From abac59fdd834e9a84aa2a3a6954232ddce772c66 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Sun, 29 Jun 2025 16:34:13 -0400
Subject: [PATCH 047/231] Do not load the entire artifact in memory when
uploading (#618)
---
Cargo.lock | 1 +
Cargo.toml | 1 +
src/github.rs | 119 +++++++++-----
src/github_api_tester.py | 340 +++++++++++++++++++++++++++++++++++++++
4 files changed, 424 insertions(+), 37 deletions(-)
create mode 100755 src/github_api_tester.py
diff --git a/Cargo.lock b/Cargo.lock
index dcb95c776..6a2f0890f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1570,6 +1570,7 @@ dependencies = [
"tempfile",
"text-stub-library",
"tokio",
+ "tokio-util",
"url",
"version-compare",
"zip",
diff --git a/Cargo.toml b/Cargo.toml
index 9b4af3a7c..b74eeb6e9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -37,6 +37,7 @@ tar = "0.4.40"
tempfile = "3.10.0"
text-stub-library = "0.9.0"
tokio = "1.43.1"
+tokio-util = "0.7.13"
url = "2.5.0"
version-compare = "0.1.1"
zip = "0.6.6"
diff --git a/src/github.rs b/src/github.rs
index f42d99959..676104f9d 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -17,10 +17,9 @@ use {
},
rayon::prelude::*,
reqwest::{Client, StatusCode},
- reqwest_middleware::{self, ClientWithMiddleware},
reqwest_retry::{
- default_on_request_failure, policies::ExponentialBackoff, RetryTransientMiddleware,
- Retryable, RetryableStrategy,
+ default_on_request_failure, policies::ExponentialBackoff, RetryPolicy, Retryable,
+ RetryableStrategy,
},
sha2::{Digest, Sha256},
std::{
@@ -28,6 +27,7 @@ use {
io::Read,
path::PathBuf,
str::FromStr,
+ time::{Duration, SystemTime},
},
url::Url,
zip::ZipArchive,
@@ -65,12 +65,19 @@ async fn fetch_artifact(
Ok(res)
}
+enum UploadSource {
+ Filename(PathBuf),
+ Data(Bytes),
+}
+
async fn upload_release_artifact(
- client: &ClientWithMiddleware,
+ client: &Client,
+ retry_policy: &impl RetryPolicy,
+ retryable_strategy: &impl RetryableStrategy,
auth_token: String,
release: &Release,
filename: String,
- data: Bytes,
+ body: UploadSource,
dry_run: bool,
) -> Result<()> {
if release.assets.iter().any(|asset| asset.name == filename) {
@@ -93,17 +100,52 @@ async fn upload_release_artifact(
return Ok(());
}
- // Octocrab doesn't yet support release artifact upload. And the low-level HTTP API
- // forces the use of strings on us. So we have to make our own HTTP client.
-
- let response = client
- .put(url)
- .header("Authorization", format!("Bearer {auth_token}"))
- .header("Content-Length", data.len())
- .header("Content-Type", "application/x-tar")
- .body(data)
- .send()
- .await?;
+ // Octocrab's high-level API for uploading release artifacts doesn't yet support streaming
+ // bodies, and their low-level API isn't more helpful than using our own HTTP client.
+ //
+ // Because we are streaming the body, we can't use the standard retry middleware for reqwest
+ // (see e.g. https://github.com/seanmonstar/reqwest/issues/2416), so we have to recreate the
+ // request on each retry and handle the retry logic ourself. This logic is inspired by
+ // uv/crates/uv-publish/src/lib.rs (which has the same problem), which in turn is inspired by
+ // reqwest-middleware/reqwest-retry/src/middleware.rs.
+ //
+ // (While Octocrab's API would work fine for the non-streaming case, we just use this function
+ // for both cases so that we can make a homogeneous Vec later in the file.)
+
+ let mut n_past_retries = 0;
+ let start_time = SystemTime::now();
+ let response = loop {
+ let request = client
+ .put(url.clone())
+ .timeout(Duration::from_secs(60))
+ .header("Authorization", format!("Bearer {auth_token}"))
+ .header("Content-Type", "application/octet-stream");
+ let request = match body {
+ UploadSource::Filename(ref path) => {
+ let file = tokio::fs::File::open(&path).await?;
+ let len = file.metadata().await?.len();
+ request.header("Content-Length", len).body(file)
+ }
+ UploadSource::Data(ref bytes) => request
+ .header("Content-Length", bytes.len())
+ .body(bytes.clone()),
+ };
+ let result = request.send().await.map_err(|e| e.into());
+
+ if retryable_strategy.handle(&result) == Some(Retryable::Transient) {
+ let retry_decision = retry_policy.should_retry(start_time, n_past_retries);
+ if let reqwest_retry::RetryDecision::Retry { execute_after } = retry_decision {
+ println!("retrying upload to {url} after {result:?}");
+ let duration = execute_after
+ .duration_since(SystemTime::now())
+ .unwrap_or_else(|_| Duration::default());
+ tokio::time::sleep(duration).await;
+ n_past_retries += 1;
+ continue;
+ }
+ }
+ break result?;
+ };
if !response.status().is_success() {
return Err(anyhow!("HTTP {}", response.status()));
@@ -215,10 +257,8 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
.await?;
for artifact in artifacts {
- if matches!(
- artifact.name.as_str(),
- "pythonbuild" | "toolchain"
- ) || artifact.name.contains("install-only")
+ if matches!(artifact.name.as_str(), "pythonbuild" | "toolchain")
+ || artifact.name.contains("install-only")
{
continue;
}
@@ -475,12 +515,7 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
let mut digests = BTreeMap::new();
let retry_policy = ExponentialBackoff::builder().build_with_max_retries(5);
- let raw_client = reqwest_middleware::ClientBuilder::new(Client::new())
- .with(RetryTransientMiddleware::new_with_policy_and_strategy(
- retry_policy,
- GitHubUploadRetryStrategy,
- ))
- .build();
+ let raw_client = Client::new();
{
let mut fs = vec![];
@@ -490,23 +525,31 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
continue;
}
- let file_data = Bytes::copy_from_slice(&std::fs::read(dist_dir.join(&source))?);
-
- let mut digest = Sha256::new();
- digest.update(&file_data);
-
- let digest = hex::encode(digest.finalize());
-
- digests.insert(dest.clone(), digest.clone());
-
+ let local_filename = dist_dir.join(&source);
fs.push(upload_release_artifact(
&raw_client,
+ &retry_policy,
+ &GitHubUploadRetryStrategy,
token.clone(),
&release,
dest.clone(),
- file_data,
+ UploadSource::Filename(local_filename.clone()),
dry_run,
));
+
+ // reqwest wants to take ownership of the body, so it's hard for us to do anything
+ // clever with reading the file once and calculating the sha256sum while we read.
+ // So we open and read the file again.
+ let digest = {
+ let file = tokio::fs::File::open(local_filename).await?;
+ let mut stream = tokio_util::io::ReaderStream::with_capacity(file, 1048576);
+ let mut hasher = Sha256::new();
+ while let Some(chunk) = stream.next().await {
+ hasher.update(&chunk?);
+ }
+ hex::encode(hasher.finalize())
+ };
+ digests.insert(dest.clone(), digest.clone());
}
let mut buffered = futures::stream::iter(fs).buffer_unordered(16);
@@ -526,10 +569,12 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
upload_release_artifact(
&raw_client,
+ &retry_policy,
+ &GitHubUploadRetryStrategy,
token.clone(),
&release,
"SHA256SUMS".to_string(),
- Bytes::copy_from_slice(shasums.as_bytes()),
+ UploadSource::Data(Bytes::copy_from_slice(shasums.as_bytes())),
dry_run,
)
.await?;
diff --git a/src/github_api_tester.py b/src/github_api_tester.py
new file mode 100755
index 000000000..9ff4bc07a
--- /dev/null
+++ b/src/github_api_tester.py
@@ -0,0 +1,340 @@
+#!/usr/bin/env -S uv run
+#
+# A fake GitHub API server for testing upload-release-distributions's
+# behavior in the presence of API failures.
+#
+# Call with no arguments or with pytest CLI arguments to run the tests
+# at the bottom which invoke `cargo run`.
+#
+# Call with one argument "serve" to start an HTTP server on 0.0.0.0.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# /// script
+# requires-python = ">=3.13"
+# dependencies = [
+# "quart>=0.20.0",
+# "quart-trio>=0.12.0",
+# # Pinned because we mess with hypercorn internals, see below.
+# "hypercorn==0.17.3",
+# "pytest",
+# "pytest-trio",
+# ]
+# ///
+
+import dataclasses
+import hashlib
+import logging
+import os
+import sys
+from collections.abc import Callable
+
+import hypercorn
+import pytest
+import quart
+import trio
+from quart import request
+from quart_trio import QuartTrio
+
+app = QuartTrio(__name__)
+app.config["MAX_CONTENT_LENGTH"] = None
+
+
+async def drop_connection():
+ """Drop the (HTTP/1.1) connection belonging to the current Quart request."""
+ # We need to do two things:
+ # - Convince hypercorn (specifically, around HTTPStream.app_send())
+ # that it doesn't need to send a 500 and can just close the socket.
+ # - Convince h11's state machine that it's okay to close the socket
+ # without sending a response.
+ # We can't do this at the ASGI layer: hypercorn will insert the 500
+ # for protocol compliance if the ASGI app doesn't provide a
+ # response. We need to modify the actual HTTP server, either with a
+ # pull request or by digging into its internals as follows:
+ # - Grab the HTTPStream whose bound method app_send was passed into
+ # the Quart request
+ # - Grab the H11Protocol whose bound method stream_send was passed
+ # into the HTTPStream's constructor
+ # - Tell the H11Protocol's underlying h11 state machine to act as if
+ # the remote side errored, so it thinks dropping the connection is
+ # the appropriate next step and not misbehavior on our end
+ # - Tell the HTTPStream to move the state machine forward with no
+ # further send on our side, which will drop the connection (and
+ # not consider it for keepalive)
+ import hypercorn.protocol as hp
+
+ http_stream: hp.http_stream.HTTPStream = request._send_push_promise.args[0].__self__
+ protocol: hp.h11.H11Protocol = http_stream.send.__self__
+ protocol.connection._process_error(protocol.connection.their_role)
+ await http_stream.send(hp.events.EndBody(stream_id=http_stream.stream_id))
+ await http_stream.app_send(None)
+
+ # Some other things I tried, kept for reference:
+ # http_stream.state = hypercorn.protocol.http_stream.ASGIHTTPState.RESPONSE
+ # await http_stream._send_closed()
+ # http_stream.state = hypercorn.protocol.http_stream.ASGIHTTPState.CLOSED
+
+
+# The following GitHub API datatypes are complete enough to satisfy
+# octocrab's deserialization.
+
+
+@dataclasses.dataclass
+class Asset:
+ name: str
+ label: str | None
+ sha256: str
+ contents: bytes | None
+
+ _ASSETS = []
+
+ def __post_init__(self):
+ self.id = len(self._ASSETS)
+ self._ASSETS.append(self)
+
+ def render(self) -> dict:
+ return {
+ "url": quart.url_for("get_asset", id=self.id, _external=True),
+ "browser_download_url": "https://github.invalid/unneeded",
+ "id": self.id,
+ "node_id": "fakenode",
+ "name": self.name,
+ "label": self.label,
+ "state": "uploaded",
+ "content_type": "application/octet-stream",
+ "size": 1000,
+ "download_count": 1000,
+ "created_at": "2020-01-01T00:00:00Z",
+ "updated_at": "2020-01-01T00:00:00Z",
+ "uploader": None,
+ }
+
+
+@dataclasses.dataclass
+class Upload:
+ name: str
+ label: str | None
+
+ def __post_init__(self):
+ self.hasher = hashlib.sha256()
+ if self.name == "SHA256SUMS":
+ self.contents = b""
+ else:
+ self.contents = None
+
+ def update(self, chunk: bytes) -> None:
+ self.hasher.update(chunk)
+ if self.contents is not None:
+ self.contents += chunk
+
+ def to_asset(self) -> Asset:
+ return Asset(self.name, self.label, self.hasher.hexdigest(), self.contents)
+
+
+@dataclasses.dataclass
+class Release:
+ release_id: int
+ tag_name: str
+ assets: list = dataclasses.field(default_factory=list)
+ # fault0 and fault1 are called before and after receiving the first
+ # chunk of a PUT request, respectively. Each is called once per
+ # release - the first upload that hits it will disarm it.
+ fault0: Callable[[], None] | None = None
+ fault1: Callable[[], None] | None = None
+
+ def render(self) -> dict:
+ upload_asset = quart.url_for(
+ "upload_asset", release=self.release_id, _external=True
+ )
+ return {
+ "url": request.url,
+ "html_url": "https://github.invalid/unneeded",
+ "assets_url": "https://github.invalid/unneeded",
+ "upload_url": upload_asset + "{?name,label}",
+ "id": self.release_id,
+ "node_id": "fakenode",
+ "tag_name": self.tag_name,
+ "target_commitish": "main",
+ "draft": False,
+ "prerelease": True,
+ "assets": [i.render() for i in self.assets],
+ }
+
+
+releases = [
+ Release(1, "basic"),
+ Release(11, "early-drop", fault0=drop_connection),
+ Release(12, "late-drop", fault1=drop_connection),
+ Release(4011, "early-401", fault0=lambda: quart.abort(401)),
+ Release(4012, "late-401", fault1=lambda: quart.abort(401)),
+ Release(4031, "early-403", fault0=lambda: quart.abort(403)),
+ Release(4032, "late-403", fault1=lambda: quart.abort(403)),
+ Release(5001, "early-500", fault0=lambda: quart.abort(500)),
+ Release(5002, "late-500", fault1=lambda: quart.abort(500)),
+]
+
+
+def get_release(*, tag=None, release=None) -> Release:
+ if tag is not None:
+ condition = lambda r: r.tag_name == tag
+ elif release is not None:
+ condition = lambda r: r.release_id == release
+ else:
+ raise TypeError("tag or release must be set")
+
+ for r in releases:
+ if condition(r):
+ return r
+ quart.abort(404, response=quart.jsonify({"message": "Not Found", "status": "404"}))
+
+
+# GitHub API functions
+
+
+@app.route("/repos///releases/tags/")
+async def get_release_by_tag(org, repo, tag):
+ return get_release(tag=tag).render()
+
+
+@app.route("/repos///releases/")
+async def get_release_by_id(org, repo, release):
+ return get_release(release=release).render()
+
+
+@app.put("/upload//assets")
+async def upload_asset(release):
+ filename = request.args["name"]
+ release = get_release(release=release)
+
+ if (fault := release.fault0) is not None:
+ logging.info(f"{filename}: injecting fault0")
+ release.fault0 = None
+ return await fault()
+
+ logging.info(f"{filename}: upload begin")
+ upload = Upload(filename, request.args.get("label"))
+ async for chunk in request.body:
+ logging.debug(f"{filename}: {len(chunk)=}")
+ upload.update(chunk)
+ if (fault := release.fault1) is not None:
+ if "SHA256" not in filename:
+ logging.info(f"{filename}: injecting fault1")
+ release.fault1 = None
+ return await fault()
+
+ asset = upload.to_asset()
+ logging.info(f"{filename}: upload complete, {asset.sha256=}")
+ release.assets.append(asset)
+ return asset.render()
+
+
+@app.route("/get_asset/")
+@app.route("/repos///releases/assets/")
+async def get_asset(id, org=None, repo=None):
+ try:
+ asset = Asset._ASSETS[id]
+ except IndexError:
+ quart.abort(
+ 404, response=quart.jsonify({"message": "Not Found", "status": "404"})
+ )
+
+ if "application/octet-stream" in request.accept_mimetypes:
+ if asset.contents is None:
+ print(
+ f"USAGE ERROR: Received request for contents of {asset.filename=} which was not stored"
+ )
+ return "Did not store contents", 410
+ return asset.contents
+ else:
+ return asset.render()
+
+
+# Generic upload function, useful for testing clients in isolation
+
+
+@app.put("/file/")
+async def upload_file(path):
+ logging.info(f"{path}: upload begin")
+ s = hashlib.sha256()
+ async for chunk in request.body:
+ logging.debug(f"{path}: {len(chunk)=}")
+ if "drop" in request.args:
+ await drop_connection()
+ s.update(chunk)
+ digest = s.hexdigest()
+ logging.info(f"{path}: {digest=}")
+ return f"{digest} {path}\n", 500
+
+
+# Test cases
+
+
+@pytest.fixture
+async def server(nursery):
+ await nursery.start(app.run_task)
+
+
+FILENAME = "cpython-3.0.0-x86_64-unknown-linux-gnu-install_only-19700101T1234.tar.gz"
+SHA256_20MEG = "9e21c61969cd3e077a1b2b58ddb583b175e13c6479d2d83912eaddc23c0cdd52"
+
+
+@pytest.fixture(scope="session")
+def upload_release_distributions(tmp_path_factory):
+ dist = tmp_path_factory.mktemp("dist")
+ filename = dist / FILENAME
+ filename.touch()
+ os.truncate(filename, 20_000_000)
+
+ async def upload_release_distributions(*args):
+ return await trio.run_process(
+ [
+ "cargo",
+ "run",
+ "--",
+ "upload-release-distributions",
+ "--github-uri",
+ "http://localhost:5000",
+ "--token",
+ "no-token-needed",
+ "--dist",
+ dist,
+ "--datetime",
+ "19700101T1234",
+ "--ignore-missing",
+ ]
+ + list(args)
+ )
+
+ return upload_release_distributions
+
+
+# TODO: test all of [r.tag_name for r in releases]
+TAGS_TO_TEST = ["basic", "early-drop", "late-drop", "early-403", "late-403"]
+
+
+@pytest.mark.parametrize("tag", TAGS_TO_TEST)
+async def test_upload(server, upload_release_distributions, tag):
+ with trio.fail_after(300):
+ await upload_release_distributions("--tag", tag)
+ release = get_release(tag=tag)
+ assets = sorted(release.assets, key=lambda a: a.name)
+ assert len(assets) == 2
+ assert assets[0].name == "SHA256SUMS"
+ filename = FILENAME.replace("3.0.0", f"3.0.0+{tag}").replace("-19700101T1234", "")
+ assert assets[1].name == filename
+ assert assets[1].sha256 == SHA256_20MEG
+ assert assets[0].contents == f"{SHA256_20MEG} {filename}\n".encode()
+
+
+# Work around https://github.com/pgjones/hypercorn/issues/238 not being in a release
+# Without it, test failures are unnecessarily noisy
+hypercorn.trio.lifespan.LifespanFailureError = trio.Cancelled
+
+if __name__ == "__main__":
+ if len(sys.argv) > 1 and sys.argv[1] == "serve":
+ logging.basicConfig(level=logging.INFO)
+ app.run("0.0.0.0")
+ else:
+ pytest.main(["-o", "trio_mode=true", __file__] + sys.argv[1:])
From a376f32981a4e690963fe29a6ae31203afb440ae Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Wed, 23 Jul 2025 10:51:58 -0400
Subject: [PATCH 048/231] Go back to the normal runner for the releease process
Now that we're not loading every artifact in memory, hopefully the
normal runner will work.
---
.github/workflows/release.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6381b3e52..a81dc2f91 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
release:
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- runs-on: github-ubuntu-24.04-x86_64-16
+ runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
From 98ed87173db339948c7a666937ceed396ec519ec Mon Sep 17 00:00:00 2001
From: William Woodruff
Date: Fri, 1 Aug 2025 10:25:32 -0400
Subject: [PATCH 049/231] chore(ci): apply security fixes, add zizmor workflow
(#716)
---
.github/dependabot.yml | 46 +++++++++++++++++---------
.github/workflows/check.yml | 4 +++
.github/workflows/linux.yml | 62 ++++++++++++++++++++++++++---------
.github/workflows/macos.yml | 38 ++++++++++++++-------
.github/workflows/release.yml | 50 ++++++++++++++++++----------
.github/workflows/windows.yml | 31 +++++++++++++-----
.github/workflows/zizmor.yml | 24 ++++++++++++++
.github/zizmor.yml | 7 ++++
8 files changed, 194 insertions(+), 68 deletions(-)
create mode 100644 .github/workflows/zizmor.yml
create mode 100644 .github/zizmor.yml
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a79e311f9..b29942065 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,18 +1,32 @@
version: 2
updates:
-- package-ecosystem: "pip"
- directory: "/"
- schedule:
- interval: "monthly"
- groups:
- python:
- patterns:
- - "*"
-- package-ecosystem: "cargo"
- directory: "/"
- schedule:
- interval: "monthly"
- groups:
- rust:
- patterns:
- - "*"
+ - package-ecosystem: "pip"
+ directory: "/"
+ schedule:
+ interval: "monthly"
+ cooldown:
+ default-days: 14
+ groups:
+ python:
+ patterns:
+ - "*"
+ - package-ecosystem: "cargo"
+ directory: "/"
+ schedule:
+ interval: "monthly"
+ cooldown:
+ default-days: 14
+ groups:
+ rust:
+ patterns:
+ - "*"
+ - package-ecosystem: "github-actions"
+ directory: ".github/workflows"
+ schedule:
+ interval: "monthly"
+ cooldown:
+ default-days: 14
+ groups:
+ actions:
+ patterns:
+ - "*"
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 5630ba460..c7874e743 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -12,12 +12,16 @@ concurrency:
env:
FORCE_COLOR: 1
+permissions: {}
+
jobs:
check:
runs-on: "ubuntu-latest"
name: "check"
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- uses: actions/setup-python@v5
with:
python-version: "3.12"
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 39bc8733d..2ed390b74 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -2,7 +2,7 @@ name: linux
on:
push:
- branches: [ main ]
+ branches: [main]
pull_request:
concurrency:
@@ -12,6 +12,8 @@ concurrency:
env:
FORCE_COLOR: 1
+permissions: {}
+
jobs:
crate-build:
needs:
@@ -28,6 +30,8 @@ jobs:
sudo apt install -y --no-install-recommends libssl-dev pkg-config
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Emit rustc version
run: |
@@ -64,11 +68,13 @@ jobs:
packages: write
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Install Python
uses: actions/setup-python@v5
with:
- python-version: '3.11'
+ python-version: "3.11"
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
@@ -90,7 +96,7 @@ jobs:
- name: Build Image
id: build-image
- uses: docker/build-push-action@v5
+ uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
with:
context: .
file: build/${{ matrix.name }}.Dockerfile
@@ -110,8 +116,12 @@ jobs:
- name: Compress Image
run: |
- echo ${{ steps.build-image.outputs.imageid }} > build/image-${{ matrix.name }}.linux_${{ matrix.arch }}
+ echo ${STEPS_BUILD_IMAGE_OUTPUTS_IMAGEID} > build/image-${MATRIX_NAME}.linux_${MATRIX_ARCH}
zstd -v -T0 -6 --rm build/image-*.tar
+ env:
+ STEPS_BUILD_IMAGE_OUTPUTS_IMAGEID: ${{ steps.build-image.outputs.imageid }}
+ MATRIX_NAME: ${{ matrix.name }}
+ MATRIX_ARCH: ${{ matrix.arch }}
- name: Upload Docker Image
uses: actions/upload-artifact@v4
@@ -120,6 +130,7 @@ jobs:
path: build/image-*
generate-matrix:
+ name: Generate build matrix
runs-on: ubuntu-latest
outputs:
python-build-matrix-0: ${{ steps.set-matrix.outputs.python-build-matrix-0 }}
@@ -130,16 +141,19 @@ jobs:
steps:
- uses: actions/checkout@v4
with:
- fetch-depth: 0 # fetch history for subsequent `git diff`
+ fetch-depth: 0
+ persist-credentials: false
- name: Set up Python
uses: astral-sh/setup-uv@v4
- name: Get pull request labels
id: get-labels
+ env:
+ PULL_REQUEST_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
run: |
# Convert GitHub labels array to comma-separated string
- LABELS=$(echo '${{ toJson(github.event.pull_request.labels.*.name) }}' | jq -r 'join(",")')
+ LABELS=$(echo "${PULL_REQUEST_LABELS}" | jq -r 'join(",")')
echo "labels=$LABELS" >> $GITHUB_OUTPUT
- name: Check if the `pythonbuild` crate changed
@@ -159,7 +173,7 @@ jobs:
run: |
uv run ci-matrix.py \
--platform linux \
- --labels '${{ steps.get-labels.outputs.labels }}' \
+ --labels '${STEPS_GET_LABELS_OUTPUTS_LABELS}' \
--max-shards 2 \
${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} \
> matrix.json
@@ -179,6 +193,8 @@ jobs:
# Build matrix is empty
echo "any_builds=false" >> $GITHUB_OUTPUT
fi
+ env:
+ STEPS_GET_LABELS_OUTPUTS_LABELS: ${{ steps.get-labels.outputs.labels }}
build-0:
needs:
@@ -198,11 +214,12 @@ jobs:
- uses: actions/checkout@v4
with:
fetch-depth: 0
+ persist-credentials: false
- name: Install Python
uses: actions/setup-python@v5
with:
- python-version: '3.11'
+ python-version: "3.11"
- name: Download pythonbuild
uses: actions/download-artifact@v4
@@ -247,7 +264,11 @@ jobs:
# Touch mtimes of all images so they are newer than autogenerated files above.
touch build/image-*
- ./build-linux.py --target-triple ${{ matrix.target_triple }} --python cpython-${{ matrix.python }} --options ${{ matrix.build_options }}
+ ./build-linux.py --target-triple ${MATRIX_TARGET_TRIPLE} --python cpython-${MATRIX_PYTHON} --options ${MATRIX_BUILD_OPTIONS}
+ env:
+ MATRIX_TARGET_TRIPLE: ${{ matrix.target_triple }}
+ MATRIX_PYTHON: ${{ matrix.python }}
+ MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
uses: actions/attest-build-provenance@v2
@@ -267,8 +288,8 @@ jobs:
run: |
chmod +x build/pythonbuild
- if [ "${{ matrix.run }}" == "true" ]; then
- if [ "${{ matrix.libc }}" == "musl" ]; then
+ if [ "${MATRIX_RUN}" == "true" ]; then
+ if [ "${MATRIX_LIBC}" == "musl" ]; then
sudo apt install musl-dev
# GitHub's setup-python action sets `LD_LIBRARY_PATH` which overrides `RPATH`
@@ -279,6 +300,9 @@ jobs:
fi
build/pythonbuild validate-distribution ${EXTRA_ARGS} dist/*.tar.zst
+ env:
+ MATRIX_RUN: ${{ matrix.run }}
+ MATRIX_LIBC: ${{ matrix.libc }}
build-1:
needs:
@@ -298,11 +322,12 @@ jobs:
- uses: actions/checkout@v4
with:
fetch-depth: 0
+ persist-credentials: false
- name: Install Python
uses: actions/setup-python@v5
with:
- python-version: '3.11'
+ python-version: "3.11"
- name: Download pythonbuild
uses: actions/download-artifact@v4
@@ -347,7 +372,11 @@ jobs:
# Touch mtimes of all images so they are newer than autogenerated files above.
touch build/image-*
- ./build-linux.py --target-triple ${{ matrix.target_triple }} --python cpython-${{ matrix.python }} --options ${{ matrix.build_options }}
+ ./build-linux.py --target-triple ${MATRIX_TARGET_TRIPLE} --python cpython-${MATRIX_PYTHON} --options ${MATRIX_BUILD_OPTIONS}
+ env:
+ MATRIX_TARGET_TRIPLE: ${{ matrix.target_triple }}
+ MATRIX_PYTHON: ${{ matrix.python }}
+ MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
uses: actions/attest-build-provenance@v2
@@ -367,8 +396,8 @@ jobs:
run: |
chmod +x build/pythonbuild
- if [ "${{ matrix.run }}" == "true" ]; then
- if [ "${{ matrix.libc }}" == "musl" ]; then
+ if [ "${MATRIX_RUN}" == "true" ]; then
+ if [ "${MATRIX_LIBC}" == "musl" ]; then
sudo apt install musl-dev
# GitHub's setup-python action sets `LD_LIBRARY_PATH` which overrides `RPATH`
@@ -379,3 +408,6 @@ jobs:
fi
build/pythonbuild validate-distribution ${EXTRA_ARGS} dist/*.tar.zst
+ env:
+ MATRIX_RUN: ${{ matrix.run }}
+ MATRIX_LIBC: ${{ matrix.libc }}
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 1199b3985..0bc73b136 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -12,6 +12,8 @@ concurrency:
env:
FORCE_COLOR: 1
+permissions: {}
+
jobs:
crate-build:
needs:
@@ -23,6 +25,8 @@ jobs:
name: crate / ${{ matrix.arch }}
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Emit rustc version
run: |
@@ -47,6 +51,7 @@ jobs:
path: target/release/pythonbuild
generate-matrix:
+ name: Generate build matrix
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
@@ -55,16 +60,19 @@ jobs:
steps:
- uses: actions/checkout@v4
with:
- fetch-depth: 0 # fetch history for subsequent `git diff`
+ fetch-depth: 0
+ persist-credentials: false
- name: Set up Python
uses: astral-sh/setup-uv@v4
- name: Get pull request labels
id: get-labels
+ env:
+ PULL_REQUEST_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
run: |
# Convert GitHub labels array to comma-separated string
- LABELS=$(echo '${{ toJson(github.event.pull_request.labels.*.name) }}' | jq -r 'join(",")')
+ LABELS=$(echo "${PULL_REQUEST_LABELS}" | jq -r 'join(",")')
echo "labels=$LABELS" >> $GITHUB_OUTPUT
- name: Check if the `pythonbuild` crate changed
@@ -82,12 +90,12 @@ jobs:
- name: Generate build matrix
id: set-matrix
run: |
- uv run ci-matrix.py --platform darwin --labels '${{ steps.get-labels.outputs.labels }}' ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
-
+ uv run ci-matrix.py --platform darwin --labels '${STEPS_GET_LABELS_OUTPUTS_LABELS}' ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
+
# Extract python-build matrix
echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
echo "crate-build-matrix=$(jq -c '."crate-build"' matrix.json)" >> $GITHUB_OUTPUT
-
+
# Display the matrix for debugging too
cat matrix.json | jq
@@ -98,6 +106,8 @@ jobs:
# Build matrix is empty
echo "any_builds=false" >> $GITHUB_OUTPUT
fi
+ env:
+ STEPS_GET_LABELS_OUTPUTS_LABELS: ${{ steps.get-labels.outputs.labels }}
build:
needs:
@@ -116,11 +126,12 @@ jobs:
- uses: actions/checkout@v4
with:
fetch-depth: 0
+ persist-credentials: false
- name: Install Python
uses: actions/setup-python@v5
with:
- python-version: '3.11'
+ python-version: "3.11"
- name: Download pythonbuild
uses: actions/download-artifact@v4
@@ -131,16 +142,20 @@ jobs:
- name: Build
if: ${{ ! matrix.dry-run }}
run: |
- if [ "${{ matrix.target_triple }}" = "aarch64-apple-darwin" ]; then
+ if [ "${MATRIX_TARGET_TRIPLE}" = "aarch64-apple-darwin" ]; then
export APPLE_SDK_PATH=/Applications/Xcode_15.2.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.2.sdk
- elif [ "${{ matrix.target_triple }}" = "x86_64-apple-darwin" ]; then
+ elif [ "${MATRIX_TARGET_TRIPLE}" = "x86_64-apple-darwin" ]; then
export APPLE_SDK_PATH=/Applications/Xcode_15.2.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.2.sdk
else
- echo "unhandled target triple: ${{ matrix.target_triple }}"
+ echo "unhandled target triple: ${MATRIX_TARGET_TRIPLE}"
exit 1
fi
- ./build-macos.py --target-triple ${{ matrix.target_triple }} --python cpython-${{ matrix.python }} --options ${{ matrix.build_options }}
+ ./build-macos.py --target-triple ${MATRIX_TARGET_TRIPLE} --python cpython-${MATRIX_PYTHON} --options ${MATRIX_BUILD_OPTIONS}
+ env:
+ MATRIX_TARGET_TRIPLE: ${{ matrix.target_triple }}
+ MATRIX_PYTHON: ${{ matrix.python }}
+ MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
uses: actions/attest-build-provenance@v2
@@ -159,9 +174,10 @@ jobs:
if: ${{ ! matrix.dry-run }}
uses: actions/checkout@v4
with:
- repository: 'phracker/MacOSX-SDKs'
+ repository: phracker/MacOSX-SDKs
ref: master
path: macosx-sdks
+ persist-credentials: false
- name: Validate Distribution
if: ${{ ! matrix.dry-run }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a81dc2f91..be1c85e28 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,30 +18,36 @@ on:
env:
FORCE_COLOR: 1
-permissions:
- contents: write
- packages: write
- # Permissions used for actions/attest-build-provenance
- id-token: write
- attestations: write
+permissions: {}
jobs:
release:
+ name: Release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
runs-on: ubuntu-latest
+
+ permissions:
+ contents: write
+ packages: write
+ # Permissions used for actions/attest-build-provenance
+ id-token: write
+ attestations: write
+
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
+ persist-credentials: false
- uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2
# Perform a release in dry-run mode.
- - run: just release-dry-run ${{ secrets.GITHUB_TOKEN }} ${{ github.event.inputs.sha }} ${{ github.event.inputs.tag }}
+ - run: just release-dry-run ${GH_TOKEN} ${GITHUB_EVENT_INPUTS_SHA} ${GITHUB_EVENT_INPUTS_TAG}
if: ${{ github.event.inputs.dry-run == 'true' }}
-
- # Set our identity for git operations (on the latest-release branch).
+ env:
+ GITHUB_EVENT_INPUTS_SHA: ${{ github.event.inputs.sha }}
+ GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
- name: Configure Git identity
if: ${{ github.event.inputs.dry-run == 'false' }}
run: |
@@ -51,28 +57,36 @@ jobs:
# Fetch the commit so that it exists locally.
- name: Fetch commit
if: ${{ github.event.inputs.dry-run == 'false' }}
- run: git fetch origin ${{ github.event.inputs.sha }}
+ run: git fetch origin ${GITHUB_EVENT_INPUTS_SHA}
+ env:
+ GITHUB_EVENT_INPUTS_SHA: ${{ github.event.inputs.sha }}
# Associate the commit with the tag.
- name: Create tag
if: ${{ github.event.inputs.dry-run == 'false' }}
- run: git tag ${{ github.event.inputs.tag }} ${{ github.event.inputs.sha }}
-
- # Push the tag to GitHub.
+ run: git tag ${GITHUB_EVENT_INPUTS_TAG} ${GITHUB_EVENT_INPUTS_SHA}
+ env:
+ GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
+ GITHUB_EVENT_INPUTS_SHA: ${{ github.event.inputs.sha }}
- name: Push tag
if: ${{ github.event.inputs.dry-run == 'false' }}
- run: git push origin ${{ github.event.inputs.tag }}
+ run: git push origin ${GITHUB_EVENT_INPUTS_TAG}
+ env:
+ GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
# Create a GitHub release.
- name: Create GitHub Release
if: ${{ github.event.inputs.dry-run == 'false' }}
- run: just release-create ${{ github.event.inputs.tag }}
+ run: just release-create ${GITHUB_EVENT_INPUTS_TAG}
+ env:
+ GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
# Uploading the relevant artifact to the GitHub release.
- - run: just release-run ${{ secrets.GITHUB_TOKEN }} ${{ github.event.inputs.sha }} ${{ github.event.inputs.tag }}
+ - run: just release-run ${GH_TOKEN} ${GITHUB_EVENT_INPUTS_SHA} ${GITHUB_EVENT_INPUTS_TAG}
if: ${{ github.event.inputs.dry-run == 'false' }}
-
- # We filter by *.tar.@(zst|gz) since actions/attest-build-provenance only supports up to 1024 subjects
+ env:
+ GITHUB_EVENT_INPUTS_SHA: ${{ github.event.inputs.sha }}
+ GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
- name: Generate attestations
uses: actions/attest-build-provenance@v2
if: ${{ github.event.inputs.dry-run == 'false' }}
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 165ff2617..e1fea4139 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -12,6 +12,8 @@ concurrency:
env:
FORCE_COLOR: 1
+permissions: {}
+
jobs:
crate-build:
needs:
@@ -23,6 +25,8 @@ jobs:
name: crate / ${{ matrix.arch }}
steps:
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false
- name: Emit rustc version
run: |
@@ -47,6 +51,7 @@ jobs:
path: target/release/pythonbuild.exe
generate-matrix:
+ name: Generate build matrix
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
@@ -55,16 +60,19 @@ jobs:
steps:
- uses: actions/checkout@v4
with:
- fetch-depth: 0 # fetch history for subsequent `git diff`
+ fetch-depth: 0
+ persist-credentials: false
- name: Set up Python
uses: astral-sh/setup-uv@v4
- name: Get pull request labels
id: get-labels
+ env:
+ PULL_REQUEST_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
run: |
# Convert GitHub labels array to comma-separated string
- LABELS=$(echo '${{ toJson(github.event.pull_request.labels.*.name) }}' | jq -r 'join(",")')
+ LABELS=$(echo "${PULL_REQUEST_LABELS}" | jq -r 'join(",")')
echo "labels=$LABELS" >> $GITHUB_OUTPUT
- name: Check if the `pythonbuild` crate changed
@@ -82,12 +90,12 @@ jobs:
- name: Generate build matrix
id: set-matrix
run: |
- uv run ci-matrix.py --platform windows --labels '${{ steps.get-labels.outputs.labels }}' ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
-
+ uv run ci-matrix.py --platform windows --labels '${STEPS_GET_LABELS_OUTPUTS_LABELS}' ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
+
# Extract python-build matrix
echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
echo "crate-build-matrix=$(jq -c '."crate-build"' matrix.json)" >> $GITHUB_OUTPUT
-
+
# Display the matrix for debugging too
cat matrix.json | jq
@@ -98,6 +106,8 @@ jobs:
# Build matrix is empty
echo "any_builds=false" >> $GITHUB_OUTPUT
fi
+ env:
+ STEPS_GET_LABELS_OUTPUTS_LABELS: ${{ steps.get-labels.outputs.labels }}
build:
timeout-minutes: 60
@@ -117,6 +127,7 @@ jobs:
- uses: actions/checkout@v4
with:
fetch-depth: 0
+ persist-credentials: false
- name: Install Cygwin Environment
uses: cygwin/cygwin-install-action@49f298a7ebb00d4b3ddf58000c3e78eff5fbd6b9 # v2
@@ -126,7 +137,7 @@ jobs:
- name: Install Python
uses: actions/setup-python@v5
with:
- python-version: '3.12'
+ python-version: "3.12"
- name: Download pythonbuild Executable
uses: actions/download-artifact@v4
@@ -143,8 +154,12 @@ jobs:
if: ${{ ! matrix.dry-run }}
shell: cmd
run: |
- call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\${{ matrix.vcvars }}"
- py.exe -3.12 build-windows.py --python cpython-${{ matrix.python }} --sh c:\cygwin\bin\sh.exe --options ${{ matrix.build_options }}
+ call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\%MATRIX_VCVARS%"
+ py.exe -3.12 build-windows.py --python cpython-%MATRIX_PYTHON% --sh c:\cygwin\bin\sh.exe --options %MATRIX_BUILD_OPTIONS%
+ env:
+ MATRIX_VCVARS: ${{ matrix.vcvars }}
+ MATRIX_PYTHON: ${{ matrix.python }}
+ MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
uses: actions/attest-build-provenance@v2
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 000000000..a60e28654
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,24 @@
+name: zizmor
+
+on:
+ push:
+ branches: ["main"]
+ pull_request:
+ branches: ["**"]
+
+permissions: {}
+
+jobs:
+ zizmor:
+ name: Run zizmor
+ runs-on: ubuntu-latest
+ permissions:
+ security-events: write
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ with:
+ persist-credentials: false
+
+ - name: Run zizmor
+ uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000..c3db96869
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,7 @@
+rules:
+ unpinned-uses:
+ config:
+ policies:
+ actions/*: ref-pin
+ astral-sh/*: ref-pin
+ "*": hash-pin
From 55f3d50aee9743ea48afaa18d43ff7a96af7b056 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 4 Aug 2025 16:19:36 -0500
Subject: [PATCH 050/231] Bump the actions group in /.github/workflows with 3
updates (#718)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the actions group in /.github/workflows with 3 updates:
[docker/setup-buildx-action](https://github.com/docker/setup-buildx-action),
[extractions/setup-just](https://github.com/extractions/setup-just) and
[cygwin/cygwin-install-action](https://github.com/cygwin/cygwin-install-action).
Updates `docker/setup-buildx-action` from 3.10.0 to 3.11.1
Release notes
Sourced from docker/setup-buildx-action's
releases.
v3.11.1
Full Changelog: https://github.com/docker/setup-buildx-action/compare/v3.11.0...v3.11.1
v3.11.0
Full Changelog: https://github.com/docker/setup-buildx-action/compare/v3.10.0...v3.11.0
Commits
e468171
Merge pull request #429
from crazy-max/fix-keep-state
a3e7502
chore: update generated content
b145473
fix keep-state not being respected
18ce135
Merge pull request #425
from docker/dependabot/npm_and_yarn/docker/actions-to...
0e198e9
chore: update generated content
05f3f3a
build(deps): bump @docker/actions-toolkit from 0.61.0 to
0.62.1
6229134
Merge pull request #427
from crazy-max/keep-state
c6f6a07
chore: update generated content
6c5e29d
skip builder creation if one already exists with the same name
548b297
ci: keep-state check
- Additional commits viewable in compare
view
Updates `extractions/setup-just` from 2.0.0 to 3.0.0
Commits
Updates `cygwin/cygwin-install-action` from 2 to 6
Release notes
Sourced from cygwin/cygwin-install-action's
releases.
v6
What's Changed
New Contributors
Full Changelog: https://github.com/cygwin/cygwin-install-action/compare/v5...v6
v5
What's Changed
New Contributors
Full Changelog: https://github.com/cygwin/cygwin-install-action/compare/v4...v5
v4
No release notes provided.
v3
No release notes provided.
Commits
f200932
Give the action some outputs
52b4c10
Check Authenticode signature on setup
e67b1f4
Factor out download retry as a function, to use on sha512.sum file
also
8381d6d
Add a retry mechanism for fetching setup executable
354b337
Consistently use throw to terminate with an error
f623c57
Add a test of work-vol option
d3a7464
Use D: drive as default work-vol
1c9eb7c
Add work-vol option to target different setup volume
d6a07e1
Tweak wording about SHELLOPTS and line-endings
63d1e75
Add warning about using SHELLOPTS to set igncr
- Additional commits viewable in compare
view
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/linux.yml | 2 +-
.github/workflows/release.yml | 2 +-
.github/workflows/windows.yml | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 2ed390b74..2d8c8a151 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -77,7 +77,7 @@ jobs:
python-version: "3.11"
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
+ uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
- name: Login to GitHub Container Registry
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index be1c85e28..f4036a026 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ jobs:
submodules: recursive
persist-credentials: false
- - uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2
+ - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v2
# Perform a release in dry-run mode.
- run: just release-dry-run ${GH_TOKEN} ${GITHUB_EVENT_INPUTS_SHA} ${GITHUB_EVENT_INPUTS_TAG}
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index e1fea4139..14840f46d 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -130,7 +130,7 @@ jobs:
persist-credentials: false
- name: Install Cygwin Environment
- uses: cygwin/cygwin-install-action@49f298a7ebb00d4b3ddf58000c3e78eff5fbd6b9 # v2
+ uses: cygwin/cygwin-install-action@f2009323764960f80959895c7bc3bb30210afe4d # v6
with:
packages: autoconf automake libtool
From b670cd8b835d206c521a70863080762b98455b09 Mon Sep 17 00:00:00 2001
From: Nathan Cain <13713501+nathanscain@users.noreply.github.com>
Date: Wed, 6 Aug 2025 16:04:21 -0500
Subject: [PATCH 051/231] apply disable-multiarch patch to all musl builds
(#725)
Potential solve for #724
---
cpython-unix/build-cpython.sh | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index cc93f0ad2..3c252a5d4 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -116,17 +116,12 @@ fi
# Clang 13 actually prints something with --print-multiarch, confusing CPython's
# configure. This is reported as https://bugs.python.org/issue45405. We nerf the
# check since we know what we're doing.
-if [ "${CC}" = "clang" ]; then
+if [[ "${CC}" = "clang" || "${CC}" = "musl-clang" ]]; then
if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
patch -p1 -i ${ROOT}/patch-disable-multiarch-13.patch
else
patch -p1 -i ${ROOT}/patch-disable-multiarch.patch
fi
-elif [ "${CC}" = "musl-clang" ]; then
- # Similarly, this is a problem for musl Clang on Python 3.13+
- if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
- patch -p1 -i ${ROOT}/patch-disable-multiarch-13.patch
- fi
fi
# Python 3.11 supports using a provided Python to use during bootstrapping
From be22cba141e263d56d40f78c7fb910ef8916d86b Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Wed, 6 Aug 2025 17:34:36 -0500
Subject: [PATCH 052/231] Bump CPython 3.13 version to 3.13.6 (#726)
---
cpython-unix/build-cpython.sh | 7 -
.../patch-uuid-getnode-stable-3.13.patch | 708 ------------------
pythonbuild/downloads.py | 8 +-
3 files changed, 4 insertions(+), 719 deletions(-)
delete mode 100644 cpython-unix/patch-uuid-getnode-stable-3.13.patch
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 3c252a5d4..04dab671b 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -76,13 +76,6 @@ if [ -n "${CROSS_COMPILING}" ]; then
fi
fi
-# `uuid.getnode()` is not stable on our libuuid, CPython should fallback to another method
-# Cherry-pick https://github.com/python/cpython/pull/134704 until it is released
-# We could backport this to more versions too, it won't be done by the upstream
-if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" && -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_13}" ]]; then
- patch -p1 -i ${ROOT}/patch-uuid-getnode-stable-3.13.patch
-fi
-
# This patch is slightly different on Python 3.10+.
if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_10}" ]; then
patch -p1 -i ${ROOT}/patch-xopen-source-ios.patch
diff --git a/cpython-unix/patch-uuid-getnode-stable-3.13.patch b/cpython-unix/patch-uuid-getnode-stable-3.13.patch
deleted file mode 100644
index 11bdf83a0..000000000
--- a/cpython-unix/patch-uuid-getnode-stable-3.13.patch
+++ /dev/null
@@ -1,708 +0,0 @@
-diff --git a/Lib/test/test_uuid.py b/Lib/test/test_uuid.py
-index e7e44c6413c2e2..ce396aa942b6ed 100755
---- a/Lib/test/test_uuid.py
-+++ b/Lib/test/test_uuid.py
-@@ -1,6 +1,7 @@
- import unittest
- from test import support
- from test.support import import_helper
-+from test.support.script_helper import assert_python_ok
- import builtins
- import contextlib
- import copy
-@@ -773,10 +774,37 @@ def test_cli_uuid5_ouputted_with_valid_namespace_and_name(self):
- class TestUUIDWithoutExtModule(BaseTestUUID, unittest.TestCase):
- uuid = py_uuid
-
-+
- @unittest.skipUnless(c_uuid, 'requires the C _uuid module')
- class TestUUIDWithExtModule(BaseTestUUID, unittest.TestCase):
- uuid = c_uuid
-
-+ def check_has_stable_libuuid_extractable_node(self):
-+ if not self.uuid._has_stable_extractable_node:
-+ self.skipTest("libuuid cannot deduce MAC address")
-+
-+ @unittest.skipUnless(os.name == 'posix', 'POSIX only')
-+ def test_unix_getnode_from_libuuid(self):
-+ self.check_has_stable_libuuid_extractable_node()
-+ script = 'import uuid; print(uuid._unix_getnode())'
-+ _, n_a, _ = assert_python_ok('-c', script)
-+ _, n_b, _ = assert_python_ok('-c', script)
-+ n_a, n_b = n_a.decode().strip(), n_b.decode().strip()
-+ self.assertTrue(n_a.isdigit())
-+ self.assertTrue(n_b.isdigit())
-+ self.assertEqual(n_a, n_b)
-+
-+ @unittest.skipUnless(os.name == 'nt', 'Windows only')
-+ def test_windows_getnode_from_libuuid(self):
-+ self.check_has_stable_libuuid_extractable_node()
-+ script = 'import uuid; print(uuid._windll_getnode())'
-+ _, n_a, _ = assert_python_ok('-c', script)
-+ _, n_b, _ = assert_python_ok('-c', script)
-+ n_a, n_b = n_a.decode().strip(), n_b.decode().strip()
-+ self.assertTrue(n_a.isdigit())
-+ self.assertTrue(n_b.isdigit())
-+ self.assertEqual(n_a, n_b)
-+
-
- class BaseTestInternals:
- _uuid = py_uuid
-diff --git a/Lib/uuid.py b/Lib/uuid.py
-index c286eac38e1ef4..6ab1658cc5249a 100644
---- a/Lib/uuid.py
-+++ b/Lib/uuid.py
-@@ -572,22 +572,24 @@ def _netstat_getnode():
- try:
- import _uuid
- _generate_time_safe = getattr(_uuid, "generate_time_safe", None)
-+ _has_stable_extractable_node = getattr(_uuid, "has_stable_extractable_node", False)
- _UuidCreate = getattr(_uuid, "UuidCreate", None)
- except ImportError:
- _uuid = None
- _generate_time_safe = None
-+ _has_stable_extractable_node = False
- _UuidCreate = None
-
-
- def _unix_getnode():
- """Get the hardware address on Unix using the _uuid extension module."""
-- if _generate_time_safe:
-+ if _generate_time_safe and _has_stable_extractable_node:
- uuid_time, _ = _generate_time_safe()
- return UUID(bytes=uuid_time).node
-
- def _windll_getnode():
- """Get the hardware address on Windows using the _uuid extension module."""
-- if _UuidCreate:
-+ if _UuidCreate and _has_stable_extractable_node:
- uuid_bytes = _UuidCreate()
- return UUID(bytes_le=uuid_bytes).node
-
-diff --git a/Modules/_uuidmodule.c b/Modules/_uuidmodule.c
-index c5e78b1510b5e3..c31a7e8fea5608 100644
---- a/Modules/_uuidmodule.c
-+++ b/Modules/_uuidmodule.c
-@@ -78,23 +78,47 @@ py_UuidCreate(PyObject *Py_UNUSED(context),
- return NULL;
- }
-
-+static int
-+py_windows_has_stable_node(void)
-+{
-+ UUID uuid;
-+ RPC_STATUS res;
-+ Py_BEGIN_ALLOW_THREADS
-+ res = UuidCreateSequential(&uuid);
-+ Py_END_ALLOW_THREADS
-+ return res == RPC_S_OK;
-+}
- #endif /* MS_WINDOWS */
-
-
- static int
--uuid_exec(PyObject *module) {
-+uuid_exec(PyObject *module)
-+{
-+#define ADD_INT(NAME, VALUE) \
-+ do { \
-+ if (PyModule_AddIntConstant(module, (NAME), (VALUE)) < 0) { \
-+ return -1; \
-+ } \
-+ } while (0)
-+
- assert(sizeof(uuid_t) == 16);
- #if defined(MS_WINDOWS)
-- int has_uuid_generate_time_safe = 0;
-+ ADD_INT("has_uuid_generate_time_safe", 0);
- #elif defined(HAVE_UUID_GENERATE_TIME_SAFE)
-- int has_uuid_generate_time_safe = 1;
-+ ADD_INT("has_uuid_generate_time_safe", 1);
- #else
-- int has_uuid_generate_time_safe = 0;
-+ ADD_INT("has_uuid_generate_time_safe", 0);
- #endif
-- if (PyModule_AddIntConstant(module, "has_uuid_generate_time_safe",
-- has_uuid_generate_time_safe) < 0) {
-- return -1;
-- }
-+
-+#if defined(MS_WINDOWS)
-+ ADD_INT("has_stable_extractable_node", py_windows_has_stable_node());
-+#elif defined(HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC)
-+ ADD_INT("has_stable_extractable_node", 1);
-+#else
-+ ADD_INT("has_stable_extractable_node", 0);
-+#endif
-+
-+#undef ADD_INT
- return 0;
- }
-
-diff --git a/configure b/configure
-index 1cd1f690f7b9c1..cc976aafc09b34 100755
---- a/configure
-+++ b/configure
-@@ -13381,6 +13381,7 @@ fi
-
-
-
-+
- have_uuid=missing
-
- for ac_header in uuid.h
-@@ -13390,6 +13391,7 @@ if test "x$ac_cv_header_uuid_h" = xyes
- then :
- printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
-
-+
- for ac_func in uuid_create uuid_enc_be
- do :
- as_ac_var=`printf "%s\n" "ac_cv_func_$ac_func" | $as_tr_sh`
-@@ -13399,7 +13401,9 @@ then :
- cat >>confdefs.h <<_ACEOF
- #define `printf "%s\n" "HAVE_$ac_func" | $as_tr_cpp` 1
- _ACEOF
-- have_uuid=yes
-+
-+ have_uuid=yes
-+ ac_cv_have_uuid_h=yes
- LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
- LIBUUID_LIBS=${LIBUUID_LIBS-""}
-
-@@ -13489,6 +13493,7 @@ if test "x$ac_cv_header_uuid_uuid_h" = xyes
- then :
- printf "%s\n" "#define HAVE_UUID_UUID_H 1" >>confdefs.h
-
-+ ac_cv_have_uuid_uuid_h=yes
- py_check_lib_save_LIBS=$LIBS
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uuid_generate_time in -luuid" >&5
- printf %s "checking for uuid_generate_time in -luuid... " >&6; }
-@@ -13570,8 +13575,9 @@ fi
- printf "%s\n" "$ac_cv_lib_uuid_uuid_generate_time_safe" >&6; }
- if test "x$ac_cv_lib_uuid_uuid_generate_time_safe" = xyes
- then :
-- have_uuid=yes
-- printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
-+
-+ have_uuid=yes
-+ ac_cv_have_uuid_generate_time_safe=yes
-
- fi
-
-@@ -13615,6 +13621,7 @@ if test "x$ac_cv_header_uuid_uuid_h" = xyes
- then :
- printf "%s\n" "#define HAVE_UUID_UUID_H 1" >>confdefs.h
-
-+ ac_cv_have_uuid_uuid_h=yes
- py_check_lib_save_LIBS=$LIBS
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uuid_generate_time in -luuid" >&5
- printf %s "checking for uuid_generate_time in -luuid... " >&6; }
-@@ -13696,8 +13703,9 @@ fi
- printf "%s\n" "$ac_cv_lib_uuid_uuid_generate_time_safe" >&6; }
- if test "x$ac_cv_lib_uuid_uuid_generate_time_safe" = xyes
- then :
-- have_uuid=yes
-- printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
-+
-+ have_uuid=yes
-+ ac_cv_have_uuid_generate_time_safe=yes
-
- fi
-
-@@ -13727,11 +13735,25 @@ else
- LIBUUID_LIBS=$pkg_cv_LIBUUID_LIBS
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
- printf "%s\n" "yes" >&6; }
-+<<<<<<< HEAD
- have_uuid=yes
- printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
-
- printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
-
-+=======
-+ have_uuid=yes
-+ ac_cv_have_uuid_generate_time_safe=yes
-+ # The uuid.h file to include may be *or* .
-+ # Since pkg-config --cflags uuid may return -I/usr/include/uuid,
-+ # it's possible to write '#include ' in _uuidmodule.c,
-+ # assuming that the compiler flags are properly updated.
-+ #
-+ # Ideally, we should have defined HAVE_UUID_H if and only if
-+ # #include can be written, *without* assuming extra
-+ # include path.
-+ ac_cv_have_uuid_h=yes
-+>>>>>>> 3bffada4672 (gh-132710: only use stable `_uuid.generate_time_safe()` to deduce MAC address (#132901))
-
- fi
-
-@@ -13752,6 +13774,7 @@ if test "x$ac_cv_func_uuid_generate_time" = xyes
- then :
-
- have_uuid=yes
-+ ac_cv_have_uuid_uuid_h=yes
- LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
- LIBUUID_LIBS=${LIBUUID_LIBS-""}
-
-@@ -13764,11 +13787,198 @@ done
-
- fi
-
-+<<<<<<< HEAD
-+=======
-+if test "x$ac_cv_have_uuid_h" = xyes
-+then :
-+ printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
-+
-+fi
-+if test "x$ac_cv_have_uuid_uuid_h" = xyes
-+then :
-+ printf "%s\n" "#define HAVE_UUID_UUID_H 1" >>confdefs.h
-+
-+fi
-+if test "x$ac_cv_have_uuid_generate_time_safe" = xyes
-+then :
-+
-+ printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
-+
-+
-+fi
-+
-+# gh-124228: While the libuuid library is available on NetBSD, it supports only UUID version 4.
-+# This restriction inhibits the proper generation of time-based UUIDs.
-+if test "$ac_sys_system" = "NetBSD"; then
-+ have_uuid=missing
-+ printf "%s\n" "#define HAVE_UUID_H 0" >>confdefs.h
-+
-+fi
-+
-+>>>>>>> 3bffada4672 (gh-132710: only use stable `_uuid.generate_time_safe()` to deduce MAC address (#132901))
- if test "x$have_uuid" = xmissing
- then :
- have_uuid=no
- fi
-
-+# gh-132710: The UUID node is fetched by using libuuid when possible
-+# and cached. While the node is constant within the same process,
-+# different interpreters may have different values as libuuid may
-+# randomize the node value if the latter cannot be deduced.
-+#
-+# Consumers may define HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC
-+# to indicate that libuuid is unstable and should not be relied
-+# upon to deduce the MAC address.
-+
-+
-+if test "$have_uuid" = "yes" -a "$HAVE_UUID_GENERATE_TIME_SAFE" = "1"
-+then
-+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if uuid_generate_time_safe() node value is stable" >&5
-+printf %s "checking if uuid_generate_time_safe() node value is stable... " >&6; }
-+ save_CFLAGS=$CFLAGS
-+save_CPPFLAGS=$CPPFLAGS
-+save_LDFLAGS=$LDFLAGS
-+save_LIBS=$LIBS
-+
-+
-+ # Be sure to add the extra include path if we used pkg-config
-+ # as HAVE_UUID_H may be set even though is only reachable
-+ # by adding extra -I flags.
-+ #
-+ # If the following script does not compile, we simply assume that
-+ # libuuid is missing.
-+ CFLAGS="$CFLAGS $LIBUUID_CFLAGS"
-+ LIBS="$LIBS $LIBUUID_LIBS"
-+ if test "$cross_compiling" = yes
-+then :
-+
-+
-+else case e in #(
-+ e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+/* end confdefs.h. */
-+
-+ #include // PRIu64
-+ #include // uint64_t
-+ #include // fopen(), fclose()
-+
-+ #ifdef HAVE_UUID_H
-+ #include
-+ #else
-+ #include
-+ #endif
-+
-+ #define ERR 1
-+ int main(void) {
-+ uuid_t uuid; // unsigned char[16]
-+ (void)uuid_generate_time_safe(uuid);
-+ uint64_t node = 0;
-+ for (size_t i = 0; i < 6; i++) {
-+ node |= (uint64_t)uuid[15 - i] << (8 * i);
-+ }
-+ FILE *fp = fopen("conftest.out", "w");
-+ if (fp == NULL) {
-+ return ERR;
-+ }
-+ int rc = fprintf(fp, "%" PRIu64 "\n", node) >= 0;
-+ rc |= fclose(fp);
-+ return rc == 0 ? 0 : ERR;
-+ }
-+_ACEOF
-+if ac_fn_c_try_run "$LINENO"
-+then :
-+
-+ py_cv_uuid_node1=`cat conftest.out`
-+
-+fi
-+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-+ conftest.$ac_objext conftest.beam conftest.$ac_ext ;;
-+esac
-+fi
-+
-+CFLAGS=$save_CFLAGS
-+CPPFLAGS=$save_CPPFLAGS
-+LDFLAGS=$save_LDFLAGS
-+LIBS=$save_LIBS
-+
-+
-+ save_CFLAGS=$CFLAGS
-+save_CPPFLAGS=$CPPFLAGS
-+save_LDFLAGS=$LDFLAGS
-+save_LIBS=$LIBS
-+
-+
-+ # Be sure to add the extra include path if we used pkg-config
-+ # as HAVE_UUID_H may be set even though is only reachable
-+ # by adding extra -I flags.
-+ #
-+ # If the following script does not compile, we simply assume that
-+ # libuuid is missing.
-+ CFLAGS="$CFLAGS $LIBUUID_CFLAGS"
-+ LIBS="$LIBS $LIBUUID_LIBS"
-+ if test "$cross_compiling" = yes
-+then :
-+
-+
-+else case e in #(
-+ e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+/* end confdefs.h. */
-+
-+ #include // PRIu64
-+ #include // uint64_t
-+ #include // fopen(), fclose()
-+
-+ #ifdef HAVE_UUID_H
-+ #include
-+ #else
-+ #include
-+ #endif
-+
-+ #define ERR 1
-+ int main(void) {
-+ uuid_t uuid; // unsigned char[16]
-+ (void)uuid_generate_time_safe(uuid);
-+ uint64_t node = 0;
-+ for (size_t i = 0; i < 6; i++) {
-+ node |= (uint64_t)uuid[15 - i] << (8 * i);
-+ }
-+ FILE *fp = fopen("conftest.out", "w");
-+ if (fp == NULL) {
-+ return ERR;
-+ }
-+ int rc = fprintf(fp, "%" PRIu64 "\n", node) >= 0;
-+ rc |= fclose(fp);
-+ return rc == 0 ? 0 : ERR;
-+ }
-+_ACEOF
-+if ac_fn_c_try_run "$LINENO"
-+then :
-+
-+ py_cv_uuid_node2=`cat conftest.out`
-+
-+fi
-+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-+ conftest.$ac_objext conftest.beam conftest.$ac_ext ;;
-+esac
-+fi
-+
-+CFLAGS=$save_CFLAGS
-+CPPFLAGS=$save_CPPFLAGS
-+LDFLAGS=$save_LDFLAGS
-+LIBS=$save_LIBS
-+
-+
-+ if test -n "$py_cv_uuid_node1" -a "$py_cv_uuid_node1" = "$py_cv_uuid_node2"
-+ then
-+ printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC 1" >>confdefs.h
-+
-+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: stable" >&5
-+printf "%s\n" "stable" >&6; }
-+ else
-+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unstable" >&5
-+printf "%s\n" "unstable" >&6; }
-+ fi
-+fi
-+
- # 'Real Time' functions on Solaris
- # posix4 on Solaris 2.6
- # pthread (first!) on Linux
-diff --git a/configure.ac b/configure.ac
-index 3fcb18922c5330..9898af7ffd5f25 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -3740,15 +3740,17 @@ dnl check for uuid dependencies
- AH_TEMPLATE([HAVE_UUID_H], [Define to 1 if you have the header file.])
- AH_TEMPLATE([HAVE_UUID_UUID_H], [Define to 1 if you have the header file.])
- AH_TEMPLATE([HAVE_UUID_GENERATE_TIME_SAFE], [Define if uuid_generate_time_safe() exists.])
-+AH_TEMPLATE([HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC], [Define if uuid_generate_time_safe() is able to deduce a MAC address.])
- have_uuid=missing
-
- dnl AIX provides support for RFC4122 (uuid) in libc.a starting with AIX 6.1
- dnl (anno 2007). FreeBSD and OpenBSD provides support in libc as well.
- dnl Little-endian FreeBSD, OpenBSD and NetBSD needs encoding into an octet
- dnl stream in big-endian byte-order
--AC_CHECK_HEADERS([uuid.h],
-- [AC_CHECK_FUNCS([uuid_create uuid_enc_be],
-- [have_uuid=yes
-+AC_CHECK_HEADERS([uuid.h], [
-+ AC_CHECK_FUNCS([uuid_create uuid_enc_be], [
-+ have_uuid=yes
-+ ac_cv_have_uuid_h=yes
- LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
- LIBUUID_LIBS=${LIBUUID_LIBS-""}
- ])
-@@ -3758,19 +3760,29 @@ AS_VAR_IF([have_uuid], [missing], [
- PKG_CHECK_MODULES(
- [LIBUUID], [uuid >= 2.20],
- [dnl linux-util's libuuid has uuid_generate_time_safe() since v2.20 (2011)
-- dnl and provides .
-+ dnl and provides assuming specific include paths are given
- have_uuid=yes
-- AC_DEFINE([HAVE_UUID_H], [1])
-- AC_DEFINE([HAVE_UUID_GENERATE_TIME_SAFE], [1])
-+ ac_cv_have_uuid_generate_time_safe=yes
-+ # The uuid.h file to include may be *or* .
-+ # Since pkg-config --cflags uuid may return -I/usr/include/uuid,
-+ # it's possible to write '#include ' in _uuidmodule.c,
-+ # assuming that the compiler flags are properly updated.
-+ #
-+ # Ideally, we should have defined HAVE_UUID_H if and only if
-+ # #include can be written, *without* assuming extra
-+ # include path.
-+ ac_cv_have_uuid_h=yes
- ], [
- WITH_SAVE_ENV([
- CPPFLAGS="$CPPFLAGS $LIBUUID_CFLAGS"
- LIBS="$LIBS $LIBUUID_LIBS"
- AC_CHECK_HEADERS([uuid/uuid.h], [
-+ ac_cv_have_uuid_uuid_h=yes
- PY_CHECK_LIB([uuid], [uuid_generate_time], [have_uuid=yes])
-- PY_CHECK_LIB([uuid], [uuid_generate_time_safe],
-- [have_uuid=yes
-- AC_DEFINE([HAVE_UUID_GENERATE_TIME_SAFE], [1]) ]) ])
-+ PY_CHECK_LIB([uuid], [uuid_generate_time_safe], [
-+ have_uuid=yes
-+ ac_cv_have_uuid_generate_time_safe=yes
-+ ])])
- AS_VAR_IF([have_uuid], [yes], [
- LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
- LIBUUID_LIBS=${LIBUUID_LIBS-"-luuid"}
-@@ -3785,14 +3797,90 @@ AS_VAR_IF([have_uuid], [missing], [
- AC_CHECK_HEADERS([uuid/uuid.h], [
- AC_CHECK_FUNC([uuid_generate_time], [
- have_uuid=yes
-+ ac_cv_have_uuid_uuid_h=yes
- LIBUUID_CFLAGS=${LIBUUID_CFLAGS-""}
- LIBUUID_LIBS=${LIBUUID_LIBS-""}
- ])
- ])
- ])
-
-+AS_VAR_IF([ac_cv_have_uuid_h], [yes], [AC_DEFINE([HAVE_UUID_H], [1])])
-+AS_VAR_IF([ac_cv_have_uuid_uuid_h], [yes], [AC_DEFINE([HAVE_UUID_UUID_H], [1])])
-+AS_VAR_IF([ac_cv_have_uuid_generate_time_safe], [yes], [
-+ AC_DEFINE([HAVE_UUID_GENERATE_TIME_SAFE], [1])
-+])
-+
-+# gh-124228: While the libuuid library is available on NetBSD, it supports only UUID version 4.
-+# This restriction inhibits the proper generation of time-based UUIDs.
-+if test "$ac_sys_system" = "NetBSD"; then
-+ have_uuid=missing
-+ AC_DEFINE([HAVE_UUID_H], [0])
-+fi
-+
- AS_VAR_IF([have_uuid], [missing], [have_uuid=no])
-
-+# gh-132710: The UUID node is fetched by using libuuid when possible
-+# and cached. While the node is constant within the same process,
-+# different interpreters may have different values as libuuid may
-+# randomize the node value if the latter cannot be deduced.
-+#
-+# Consumers may define HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC
-+# to indicate that libuuid is unstable and should not be relied
-+# upon to deduce the MAC address.
-+AC_DEFUN([PY_EXTRACT_UUID_GENERATE_TIME_SAFE_MAC], [WITH_SAVE_ENV([
-+ # Be sure to add the extra include path if we used pkg-config
-+ # as HAVE_UUID_H may be set even though is only reachable
-+ # by adding extra -I flags.
-+ #
-+ # If the following script does not compile, we simply assume that
-+ # libuuid is missing.
-+ CFLAGS="$CFLAGS $LIBUUID_CFLAGS"
-+ LIBS="$LIBS $LIBUUID_LIBS"
-+ AC_RUN_IFELSE([AC_LANG_SOURCE([[
-+ #include // PRIu64
-+ #include // uint64_t
-+ #include // fopen(), fclose()
-+
-+ #ifdef HAVE_UUID_H
-+ #include
-+ #else
-+ #include
-+ #endif
-+
-+ #define ERR 1
-+ int main(void) {
-+ uuid_t uuid; // unsigned char[16]
-+ (void)uuid_generate_time_safe(uuid);
-+ uint64_t node = 0;
-+ for (size_t i = 0; i < 6; i++) {
-+ node |= (uint64_t)uuid[15 - i] << (8 * i);
-+ }
-+ FILE *fp = fopen("conftest.out", "w");
-+ if (fp == NULL) {
-+ return ERR;
-+ }
-+ int rc = fprintf(fp, "%" PRIu64 "\n", node) >= 0;
-+ rc |= fclose(fp);
-+ return rc == 0 ? 0 : ERR;
-+ }]])], [
-+ AS_VAR_SET([$1], [`cat conftest.out`])
-+ ], [], []
-+ )])])
-+
-+if test "$have_uuid" = "yes" -a "$HAVE_UUID_GENERATE_TIME_SAFE" = "1"
-+then
-+ AC_MSG_CHECKING([if uuid_generate_time_safe() node value is stable])
-+ PY_EXTRACT_UUID_GENERATE_TIME_SAFE_MAC([py_cv_uuid_node1])
-+ PY_EXTRACT_UUID_GENERATE_TIME_SAFE_MAC([py_cv_uuid_node2])
-+ if test -n "$py_cv_uuid_node1" -a "$py_cv_uuid_node1" = "$py_cv_uuid_node2"
-+ then
-+ AC_DEFINE([HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC], [1])
-+ AC_MSG_RESULT([stable])
-+ else
-+ AC_MSG_RESULT([unstable])
-+ fi
-+fi
-+
- # 'Real Time' functions on Solaris
- # posix4 on Solaris 2.6
- # pthread (first!) on Linux
-diff --git a/pyconfig.h.in b/pyconfig.h.in
-index 3c16c694c84599..73358a0f35ae82 100644
---- a/pyconfig.h.in
-+++ b/pyconfig.h.in
-@@ -1548,6 +1548,9 @@
- /* Define if uuid_generate_time_safe() exists. */
- #undef HAVE_UUID_GENERATE_TIME_SAFE
-
-+/* Define if uuid_generate_time_safe() is able to deduce a MAC address. */
-+#undef HAVE_UUID_GENERATE_TIME_SAFE_STABLE_MAC
-+
- /* Define to 1 if you have the header file. */
- #undef HAVE_UUID_H
-
-
-From cb0f32a7d64b6dc4a63c4a683bb52a97ebe1d78a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
- <10796600+picnixz@users.noreply.github.com>
-Date: Mon, 26 May 2025 12:34:00 +0200
-Subject: [PATCH 2/2] rgen
-
----
- configure | 25 ++++++-------------------
- 1 file changed, 6 insertions(+), 19 deletions(-)
-
-diff --git a/configure b/configure
-index cc976aafc09b34..47e4f29e23a7ac 100755
---- a/configure
-+++ b/configure
-@@ -13735,14 +13735,7 @@ else
- LIBUUID_LIBS=$pkg_cv_LIBUUID_LIBS
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
- printf "%s\n" "yes" >&6; }
--<<<<<<< HEAD
- have_uuid=yes
-- printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
--
-- printf "%s\n" "#define HAVE_UUID_GENERATE_TIME_SAFE 1" >>confdefs.h
--
--=======
-- have_uuid=yes
- ac_cv_have_uuid_generate_time_safe=yes
- # The uuid.h file to include may be *or* .
- # Since pkg-config --cflags uuid may return -I/usr/include/uuid,
-@@ -13753,7 +13746,6 @@ printf "%s\n" "yes" >&6; }
- # #include can be written, *without* assuming extra
- # include path.
- ac_cv_have_uuid_h=yes
-->>>>>>> 3bffada4672 (gh-132710: only use stable `_uuid.generate_time_safe()` to deduce MAC address (#132901))
-
- fi
-
-@@ -13787,8 +13779,6 @@ done
-
- fi
-
--<<<<<<< HEAD
--=======
- if test "x$ac_cv_have_uuid_h" = xyes
- then :
- printf "%s\n" "#define HAVE_UUID_H 1" >>confdefs.h
-@@ -13815,7 +13805,6 @@ if test "$ac_sys_system" = "NetBSD"; then
-
- fi
-
-->>>>>>> 3bffada4672 (gh-132710: only use stable `_uuid.generate_time_safe()` to deduce MAC address (#132901))
- if test "x$have_uuid" = xmissing
- then :
- have_uuid=no
-@@ -13853,8 +13842,8 @@ save_LIBS=$LIBS
- then :
-
-
--else case e in #(
-- e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+else $as_nop
-+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h. */
-
- #include // PRIu64
-@@ -13891,8 +13880,7 @@ then :
-
- fi
- rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-- conftest.$ac_objext conftest.beam conftest.$ac_ext ;;
--esac
-+ conftest.$ac_objext conftest.beam conftest.$ac_ext
- fi
-
- CFLAGS=$save_CFLAGS
-@@ -13919,8 +13907,8 @@ save_LIBS=$LIBS
- then :
-
-
--else case e in #(
-- e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+else $as_nop
-+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h. */
-
- #include // PRIu64
-@@ -13957,8 +13945,7 @@ then :
-
- fi
- rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-- conftest.$ac_objext conftest.beam conftest.$ac_ext ;;
--esac
-+ conftest.$ac_objext conftest.beam conftest.$ac_ext
- fi
-
- CFLAGS=$save_CFLAGS
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 78a24011f..7d80e348d 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -73,10 +73,10 @@
"python_tag": "cp312",
},
"cpython-3.13": {
- "url": "https://www.python.org/ftp/python/3.13.5/Python-3.13.5.tar.xz",
- "size": 22856016,
- "sha256": "93e583f243454e6e9e4588ca2c2662206ad961659863277afcdb96801647d640",
- "version": "3.13.5",
+ "url": "https://www.python.org/ftp/python/3.13.6/Python-3.13.6.tar.xz",
+ "size": 22761268,
+ "sha256": "17ba5508819d8736a14fbfc47d36e184946a877851b2e9c4b6c43acb44a3b104",
+ "version": "3.13.6",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp313",
From 4cfefb552ebbe0f935cecc9669714f02568347d4 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 7 Aug 2025 08:03:34 -0500
Subject: [PATCH 053/231] Fix label subsetting (#731)
Regressed in #716
---
.github/workflows/linux.yml | 2 +-
.github/workflows/macos.yml | 2 +-
.github/workflows/windows.yml | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 2d8c8a151..edd5acbd7 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -173,7 +173,7 @@ jobs:
run: |
uv run ci-matrix.py \
--platform linux \
- --labels '${STEPS_GET_LABELS_OUTPUTS_LABELS}' \
+ --labels "${STEPS_GET_LABELS_OUTPUTS_LABELS}" \
--max-shards 2 \
${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} \
> matrix.json
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 0bc73b136..02ce471dd 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -90,7 +90,7 @@ jobs:
- name: Generate build matrix
id: set-matrix
run: |
- uv run ci-matrix.py --platform darwin --labels '${STEPS_GET_LABELS_OUTPUTS_LABELS}' ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
+ uv run ci-matrix.py --platform darwin --labels "${STEPS_GET_LABELS_OUTPUTS_LABELS}" ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
# Extract python-build matrix
echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 14840f46d..847a82e82 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -90,7 +90,7 @@ jobs:
- name: Generate build matrix
id: set-matrix
run: |
- uv run ci-matrix.py --platform windows --labels '${STEPS_GET_LABELS_OUTPUTS_LABELS}' ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
+ uv run ci-matrix.py --platform windows --labels "${STEPS_GET_LABELS_OUTPUTS_LABELS}" ${{ (steps.check-pythonbuild.outputs.changed == 'true' || github.ref == 'refs/heads/main') && '--force-crate-build' || '' }} > matrix.json
# Extract python-build matrix
echo "matrix=$(jq -c '."python-build"' matrix.json)" >> $GITHUB_OUTPUT
From 281d11620539c54ad3dd9d35b727109d36c644f6 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 7 Aug 2025 13:41:48 -0500
Subject: [PATCH 054/231] Persist credentials in the release workflow (#729)
Co-authored-by: William Woodruff
---
.github/workflows/release.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f4036a026..37edc1ba9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ jobs:
- uses: actions/checkout@v4
with:
submodules: recursive
- persist-credentials: false
+ persist-credentials: true # needed for git operations below
- uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v2
From cb554c8f75d2cd9e4828c753c1977b7c4d3a72e6 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 7 Aug 2025 13:47:53 -0500
Subject: [PATCH 055/231] Use a larger runner again for the release (#733)
We need more disk space.
Partially reverts
https://github.com/astral-sh/python-build-standalone/commit/a376f32981a4e690963fe29a6ae31203afb440ae
though I'm using an 8-core instead of 16-core runner and Depot instead
of GitHub.
---
.github/workflows/release.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 37edc1ba9..9c256ee7e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
name: Release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- runs-on: ubuntu-latest
+ runs-on: depot-ubuntu-24.04-8
permissions:
contents: write
From 7c96f41400198c589039c6e08b12af2340f7a13c Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 7 Aug 2025 13:48:03 -0500
Subject: [PATCH 056/231] Add more artifacts to the skip list (#732)
I noticed we were fetching these but... we shouldn't be :)
---
src/github.rs | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/github.rs b/src/github.rs
index 676104f9d..5db224723 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -259,6 +259,9 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
for artifact in artifacts {
if matches!(artifact.name.as_str(), "pythonbuild" | "toolchain")
|| artifact.name.contains("install-only")
+ || artifact.name.contains("dockerbuild")
+ || artifact.name.contains("crate-")
+ || artifact.name.contains("image-")
{
continue;
}
From 51d355fb9d71999eb9ba5269bf1e9718d57c857a Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Fri, 8 Aug 2025 12:44:20 -0400
Subject: [PATCH 057/231] Build libtcl, libtk, and _tkinter as shared objects,
and remove Tix (#676)
Several important third-party packages, including matplotlib in its
tkagg backend and Pillow, use tkinter as a way of locating libtcl and
libtk and making direct C API calls to those libraries. For more
details, see the analysis in
https://github.com/astral-sh/python-build-standalone/issues/129#issuecomment-3016267363
To make these packages work, we need to expose the full libtcl and
libtk dynamic symbol ABI; we can't just statically link them into our
own binary. It seems most robust to also expose these as separate
libraries under their usual filenames to match the behavior of other
Python distributions.
Build shared libraries for the _tkinter module and for libtcl and libtk,
and set up rpaths so we find our copies of them. libX11 continues to be
statically linked, but it's linked into libtk. Just as with the build of
Python itself, use --exclude-libs=ALL to prevent the dependencies'
symbols from being exported.
Stop building Tix because it's broken (#723) and it would need to be
changed to dynamic linking.
Configure libX11 with --disable-loadable-xcursor to fix #146, which I
ran into while running tests.
Add zlib as a build-dep of Tcl/Tk so that they can statically link
libz.a. I think we were previously picking up the zlib headers from the
OS, which wasn't a problem when libtcl and libtk were static libraries -
they got linked into CPython itself which also linked zlib.a. But now
libtcl.so and libtk.so need zlib.a.
Fixes #129
Fixes #533
---
Cargo.toml | 2 +-
cpython-unix/Makefile | 17 +++---
cpython-unix/build-cpython.sh | 23 +++++++--
cpython-unix/build-libX11.sh | 5 ++
cpython-unix/build-main.py | 2 +-
cpython-unix/build-tcl.sh | 28 +++++++---
cpython-unix/build-tk.sh | 40 +++++++++-----
cpython-unix/build.py | 62 ++--------------------
cpython-unix/extension-modules.yml | 26 ++--------
cpython-unix/targets.yml | 16 ------
docs/distributions.rst | 4 +-
docs/quirks.rst | 23 +++++----
docs/status.rst | 2 +-
pythonbuild/cpython.py | 13 ++++-
src/validation.rs | 83 ++++++++++++++++++++++++++----
15 files changed, 189 insertions(+), 157 deletions(-)
diff --git a/Cargo.toml b/Cargo.toml
index b74eeb6e9..beca9e807 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,7 +2,7 @@
name = "pythonbuild"
version = "0.1.0"
authors = ["Gregory Szorc "]
-edition = "2021"
+edition = "2024"
[dependencies]
anyhow = "1.0.80"
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
index 40c34a27b..7e5641458 100644
--- a/cpython-unix/Makefile
+++ b/cpython-unix/Makefile
@@ -192,18 +192,14 @@ $(OUTDIR)/patchelf-$(PATCHELF_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPEN
$(OUTDIR)/sqlite-$(SQLITE_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-sqlite.sh
$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) sqlite
-$(OUTDIR)/tcl-$(TCL_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-tcl.sh
- $(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) tcl
-
-TIX_DEPENDS = \
- $(HERE)/build-tix.sh \
- $(OUTDIR)/tcl-$(TCL_VERSION)-$(PACKAGE_SUFFIX).tar \
- $(OUTDIR)/tk-$(TK_VERSION)-$(PACKAGE_SUFFIX).tar \
- $(if $(NEED_LIBX11),$(OUTDIR)/libX11-$(LIBX11_VERSION)-$(PACKAGE_SUFFIX).tar) \
+TCL_DEPENDS = \
+ $(PYTHON_DEP_DEPENDS) \
+ $(HERE)/build-tcl.sh \
+ $(OUTDIR)/zlib-$(ZLIB_VERSION)-$(PACKAGE_SUFFIX).tar \
$(NULL)
-$(OUTDIR)/tix-$(TIX_VERSION)-$(PACKAGE_SUFFIX).tar: $(TIX_DEPENDS)
- $(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) tix
+$(OUTDIR)/tcl-$(TCL_VERSION)-$(PACKAGE_SUFFIX).tar: $(TCL_DEPENDS)
+ $(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) tcl
TK_DEPENDS = \
$(HOST_PYTHON_DEPENDS) \
@@ -271,7 +267,6 @@ PYTHON_DEPENDS_$(1) := \
$$(if $$(NEED_SQLITE),$$(OUTDIR)/sqlite-$$(SQLITE_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_TCL),$$(OUTDIR)/tcl-$$(TCL_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_TK),$$(OUTDIR)/tk-$$(TK_VERSION)-$$(PACKAGE_SUFFIX).tar) \
- $$(if $$(NEED_TIX),$$(OUTDIR)/tix-$$(TIX_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_UUID),$$(OUTDIR)/uuid-$$(UUID_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_XZ),$$(OUTDIR)/xz-$$(XZ_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_ZLIB),$$(OUTDIR)/zlib-$$(ZLIB_VERSION)-$$(PACKAGE_SUFFIX).tar) \
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 04dab671b..658395a98 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -44,7 +44,7 @@ sed "${sed_args[@]}" "s|/tools/host|${TOOLS_PATH}/host|g" ${TOOLS_PATH}/host/sha
# We force linking of external static libraries by removing the shared
# libraries. This is hacky. But we're building in a temporary container
# and it gets the job done.
-find ${TOOLS_PATH}/deps -name '*.so*' -exec rm {} \;
+find ${TOOLS_PATH}/deps -name '*.so*' -a \! \( -name 'libtcl*.so*' -or -name 'libtk*.so*' \) -exec rm {} \;
tar -xf Python-${PYTHON_VERSION}.tar.xz
@@ -693,6 +693,8 @@ if [ "${PYBUILD_SHARED}" = "1" ]; then
${ROOT}/out/python/install/bin/python${PYTHON_MAJMIN_VERSION}
# Python's build system doesn't make this file writable.
+ # TODO(geofft): @executable_path/ is a weird choice here, who is
+ # relying on it? Should probably be @loader_path.
chmod 755 ${ROOT}/out/python/install/lib/${LIBPYTHON_SHARED_LIBRARY_BASENAME}
install_name_tool \
-change /install/lib/${LIBPYTHON_SHARED_LIBRARY_BASENAME} @executable_path/${LIBPYTHON_SHARED_LIBRARY_BASENAME} \
@@ -711,6 +713,13 @@ if [ "${PYBUILD_SHARED}" = "1" ]; then
-change /install/lib/${LIBPYTHON_SHARED_LIBRARY_BASENAME} @executable_path/../lib/${LIBPYTHON_SHARED_LIBRARY_BASENAME} \
${ROOT}/out/python/install/bin/python${PYTHON_MAJMIN_VERSION}${PYTHON_BINARY_SUFFIX}
fi
+
+ # At the moment, python3 and libpython don't have shared-library
+ # dependencies, but at some point we will want to run this for
+ # them too.
+ for module in ${ROOT}/out/python/install/lib/python*/lib-dynload/*.so; do
+ install_name_tool -add_rpath @loader_path/../.. "$module"
+ done
else # (not macos)
LIBPYTHON_SHARED_LIBRARY_BASENAME=libpython${PYTHON_MAJMIN_VERSION}${PYTHON_BINARY_SUFFIX}.so.1.0
LIBPYTHON_SHARED_LIBRARY=${ROOT}/out/python/install/lib/${LIBPYTHON_SHARED_LIBRARY_BASENAME}
@@ -1232,16 +1241,20 @@ fi
rm -f ${ROOT}/out/python/build/lib/{libdb-6.0,libxcb-*,libX11-xcb}.a
if [ -d "${TOOLS_PATH}/deps/lib/tcl8" ]; then
- # Copy tcl/tk/tix resources needed by tkinter.
+ # Copy tcl/tk resources needed by tkinter.
mkdir ${ROOT}/out/python/install/lib/tcl
# Keep this list in sync with tcl_library_paths.
for source in ${TOOLS_PATH}/deps/lib/{itcl4.2.4,tcl8,tcl8.6,thread2.8.9,tk8.6}; do
cp -av $source ${ROOT}/out/python/install/lib/
done
- if [[ "${PYBUILD_PLATFORM}" != macos* ]]; then
- cp -av ${TOOLS_PATH}/deps/lib/Tix8.4.3 ${ROOT}/out/python/install/lib/
- fi
+ (
+ shopt -s nullglob
+ dylibs=(${TOOLS_PATH}/deps/lib/lib*.dylib ${TOOLS_PATH}/deps/lib/lib*.so)
+ if [ "${#dylibs[@]}" -gt 0 ]; then
+ cp -av "${dylibs[@]}" ${ROOT}/out/python/install/lib/
+ fi
+ )
fi
# Copy the terminfo database if present.
diff --git a/cpython-unix/build-libX11.sh b/cpython-unix/build-libX11.sh
index bb45028bb..9be17eea9 100755
--- a/cpython-unix/build-libX11.sh
+++ b/cpython-unix/build-libX11.sh
@@ -99,6 +99,11 @@ if [ -n "${CROSS_COMPILING}" ]; then
esac
fi
+# Avoid dlopen("libXcursor.so.1") from the OS, which can go horribly wrong. We
+# might not need to avoid this if we switch to shipping X11 as shared
+# libraries, and ideally if we ship libXcursor ourselves.
+EXTRA_FLAGS="${EXTRA_FLAGS} --disable-loadable-xcursor"
+
# CC_FOR_BUILD is here because configure doesn't look for `clang` when
# cross-compiling. So we force it.
CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC -I/tools/deps/include" \
diff --git a/cpython-unix/build-main.py b/cpython-unix/build-main.py
index 7a7d08b10..23d473ef1 100755
--- a/cpython-unix/build-main.py
+++ b/cpython-unix/build-main.py
@@ -182,7 +182,7 @@ def main():
# because we can get some speedup from parallel operations. But we also don't
# share a make job server with each build. So if we didn't limit the
# parallelism we could easily oversaturate the CPU. Higher levels of
- # parallelism don't result in meaningful build speedups because tk/tix has
+ # parallelism don't result in meaningful build speedups because tk has
# a long, serial dependency chain that can't be built in parallel.
parallelism = min(1 if args.serial else 4, multiprocessing.cpu_count())
diff --git a/cpython-unix/build-tcl.sh b/cpython-unix/build-tcl.sh
index 43a4a6ad4..bfbc22fa8 100755
--- a/cpython-unix/build-tcl.sh
+++ b/cpython-unix/build-tcl.sh
@@ -7,6 +7,12 @@ set -ex
ROOT=`pwd`
+# Force linking to static libraries from our dependencies.
+# TODO(geofft): This is copied from build-cpython.sh. Really this should
+# be done at the end of the build of each dependency, rather than before
+# the build of each consumer.
+find ${TOOLS_PATH}/deps -name '*.so*' -exec rm {} \;
+
export PATH=${TOOLS_PATH}/${TOOLCHAIN}/bin:${TOOLS_PATH}/host/bin:$PATH
export PKG_CONFIG_PATH=${TOOLS_PATH}/deps/share/pkgconfig:${TOOLS_PATH}/deps/lib/pkgconfig
@@ -20,9 +26,8 @@ if [ -n "${STATIC}" ]; then
# `checking whether musl-clang accepts -g...` fails with a duplicate definition error
TARGET_TRIPLE="$(echo "${TARGET_TRIPLE}" | sed -e 's/-unknown-linux-musl/-unknown-linux-gnu/g')"
fi
-fi
-patch -p1 << 'EOF'
+ patch -p1 << 'EOF'
diff --git a/unix/Makefile.in b/unix/Makefile.in
--- a/unix/Makefile.in
+++ b/unix/Makefile.in
@@ -36,6 +41,7 @@ diff --git a/unix/Makefile.in b/unix/Makefile.in
fi; \
fi; \
EOF
+fi
# Remove packages we don't care about and can pull in unwanted symbols.
rm -rf pkgs/sqlite* pkgs/tdbc*
@@ -43,17 +49,23 @@ rm -rf pkgs/sqlite* pkgs/tdbc*
pushd unix
CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC -I${TOOLS_PATH}/deps/include"
+LDFLAGS="${EXTRA_TARGET_CFLAGS} -L${TOOLS_PATH}/deps/lib"
+if [[ "${PYBUILD_PLATFORM}" != macos* ]]; then
+ LDFLAGS="${LDFLAGS} -Wl,--exclude-libs,ALL"
+fi
-CFLAGS="${CFLAGS}" CPPFLAGS="${CFLAGS}" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" ./configure \
+CFLAGS="${CFLAGS}" CPPFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" ./configure \
--build=${BUILD_TRIPLE} \
--host=${TARGET_TRIPLE} \
--prefix=/tools/deps \
- --enable-shared=no \
+ --enable-shared"${STATIC:+=no}" \
--enable-threads
-make -j ${NUM_CPUS}
-make -j ${NUM_CPUS} install DESTDIR=${ROOT}/out
+make -j ${NUM_CPUS} DYLIB_INSTALL_DIR=@rpath
+make -j ${NUM_CPUS} install DESTDIR=${ROOT}/out DYLIB_INSTALL_DIR=@rpath
make -j ${NUM_CPUS} install-private-headers DESTDIR=${ROOT}/out
-# For some reason libtcl*.a have weird permissions. Fix that.
-chmod 644 ${ROOT}/out/tools/deps/lib/libtcl*.a
+if [ -n "${STATIC}" ]; then
+ # For some reason libtcl*.a have weird permissions. Fix that.
+ chmod 644 ${ROOT}/out/tools/deps/lib/libtcl*.a
+fi
diff --git a/cpython-unix/build-tk.sh b/cpython-unix/build-tk.sh
index 2769a631d..bd936c8e7 100755
--- a/cpython-unix/build-tk.sh
+++ b/cpython-unix/build-tk.sh
@@ -7,6 +7,12 @@ set -ex
ROOT=`pwd`
+# Force linking to static libraries from our dependencies.
+# TODO(geofft): This is copied from build-cpython.sh. Really this should
+# be done at the end of the build of each dependency, rather than before
+# the build of each consumer.
+find ${TOOLS_PATH}/deps -name '*.so*' -exec rm {} \;
+
export PATH=${TOOLS_PATH}/deps/bin:${TOOLS_PATH}/${TOOLCHAIN}/bin:${TOOLS_PATH}/host/bin:$PATH
export PKG_CONFIG_PATH=${TOOLS_PATH}/deps/share/pkgconfig:${TOOLS_PATH}/deps/lib/pkgconfig
@@ -23,6 +29,7 @@ if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
LDFLAGS="-L${TOOLS_PATH}/deps/lib"
EXTRA_CONFIGURE_FLAGS="--enable-aqua=yes --without-x"
else
+ LDFLAGS="${LDFLAGS} -Wl,--exclude-libs,ALL"
EXTRA_CONFIGURE_FLAGS="--x-includes=${TOOLS_PATH}/deps/include --x-libraries=${TOOLS_PATH}/deps/lib"
fi
@@ -31,29 +38,38 @@ CFLAGS="${CFLAGS}" CPPFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" ./configure \
--host=${TARGET_TRIPLE} \
--prefix=/tools/deps \
--with-tcl=${TOOLS_PATH}/deps/lib \
- --enable-shared=no \
+ --enable-shared"${STATIC:+=no}" \
--enable-threads \
${EXTRA_CONFIGURE_FLAGS}
# Remove wish, since we don't need it.
-if [[ "${PYBUILD_PLATFORM}" != macos* ]]; then
- sed -i 's/all: binaries libraries doc/all: libraries/' Makefile
- sed -i 's/install-binaries: $(TK_STUB_LIB_FILE) $(TK_LIB_FILE) ${WISH_EXE}/install-binaries: $(TK_STUB_LIB_FILE) $(TK_LIB_FILE)/' Makefile
+if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
+ sed_args=(-i '' -e)
+else
+ sed_args=(-i)
fi
+sed "${sed_args[@]}" 's/all: binaries libraries doc/all: libraries/' Makefile
+sed "${sed_args[@]}" 's/install-binaries: $(TK_STUB_LIB_FILE) $(TK_LIB_FILE) ${WISH_EXE}/install-binaries: $(TK_STUB_LIB_FILE) $(TK_LIB_FILE)/' Makefile
-# For some reason musl isn't link libXau and libxcb. So we hack the Makefile
-# to do what we want.
-if [ "${CC}" = "musl-clang" ]; then
- sed -i 's/-ldl -lpthread /-ldl -lpthread -lXau -lxcb/' tkConfig.sh
- sed -i 's/-lpthread $(X11_LIB_SWITCHES) -ldl -lpthread/-lpthread $(X11_LIB_SWITCHES) -ldl -lpthread -lXau -lxcb/' Makefile
+# We are statically linking libX11, and static libraries do not carry
+# information about dependencies. pkg-config --static does, but Tcl/Tk's
+# build system apparently is too old for that. So we need to manually
+# inform the build process that libX11.a needs libxcb.a and libXau.a.
+# Note that the order is significant, for static libraries: X11 requires
+# xcb, which requires Xau.
+MAKE_VARS=(DYLIB_INSTALL_DIR=@rpath)
+if [[ "${PYBUILD_PLATFORM}" != macos* ]]; then
+ MAKE_VARS+=(X11_LIB_SWITCHES="-lX11 -lxcb -lXau")
fi
-make -j ${NUM_CPUS}
+make -j ${NUM_CPUS} "${MAKE_VARS[@]}"
touch wish
-make -j ${NUM_CPUS} install DESTDIR=${ROOT}/out
+make -j ${NUM_CPUS} install DESTDIR=${ROOT}/out "${MAKE_VARS[@]}"
make -j ${NUM_CPUS} install-private-headers DESTDIR=${ROOT}/out
# For some reason libtk*.a have weird permissions. Fix that.
-chmod 644 /${ROOT}/out/tools/deps/lib/libtk*.a
+if [ -n "${STATIC}" ]; then
+ chmod 644 /${ROOT}/out/tools/deps/lib/libtk*.a
+fi
rm ${ROOT}/out/tools/deps/bin/wish*
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index b35d17211..ea44c2949 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -379,48 +379,6 @@ def build_libedit(
build_env.get_tools_archive(dest_archive, "deps")
-def build_tix(
- settings, client, image, host_platform, target_triple, build_options, dest_archive
-):
- tcl_archive = download_entry("tcl", DOWNLOADS_PATH)
- tk_archive = download_entry("tk", DOWNLOADS_PATH)
- tix_archive = download_entry("tix", DOWNLOADS_PATH)
-
- with build_environment(client, image) as build_env:
- if settings.get("needs_toolchain"):
- build_env.install_toolchain(
- BUILD,
- host_platform,
- target_triple,
- binutils=install_binutils(host_platform),
- clang=True,
- musl="musl" in target_triple,
- static="static" in build_options,
- )
-
- depends = {"tcl", "tk"}
- if not host_platform.startswith("macos_"):
- depends |= {"libX11", "xorgproto"}
-
- for p in sorted(depends):
- build_env.install_artifact_archive(BUILD, p, target_triple, build_options)
-
- for p in (tcl_archive, tk_archive, tix_archive, SUPPORT / "build-tix.sh"):
- build_env.copy_file(p)
-
- env = {
- "TOOLCHAIN": "clang-%s" % host_platform,
- "TCL_VERSION": DOWNLOADS["tcl"]["version"],
- "TIX_VERSION": DOWNLOADS["tix"]["version"],
- "TK_VERSION": DOWNLOADS["tk"]["version"],
- }
-
- add_target_env(env, host_platform, target_triple, build_env)
-
- build_env.run("build-tix.sh", environment=env)
- build_env.get_tools_archive(dest_archive, "deps")
-
-
def build_cpython_host(
client,
image,
@@ -946,9 +904,6 @@ def build_cpython(
"tk8.6",
]
- if "-apple" not in target_triple:
- python_info["tcl_library_paths"].append("Tix8.4.3")
-
if "-apple" in target_triple:
python_info["apple_sdk_platform"] = env["APPLE_SDK_PLATFORM"]
python_info["apple_sdk_version"] = env["APPLE_SDK_VERSION"]
@@ -1166,6 +1121,9 @@ def main():
"zstd",
):
tools_path = "host" if action in ("m4", "patchelf") else "deps"
+ extra_archives = {
+ "tcl": {"zlib"},
+ }.get(action)
simple_build(
settings,
@@ -1176,6 +1134,7 @@ def main():
target_triple=target_triple,
build_options=build_options,
dest_archive=dest_archive,
+ extra_archives=extra_archives,
tools_path=tools_path,
)
@@ -1239,19 +1198,8 @@ def main():
python_host_version=python_host_version,
)
- elif action == "tix":
- build_tix(
- settings,
- client,
- get_image(client, ROOT, BUILD, docker_image, host_platform),
- host_platform=host_platform,
- target_triple=target_triple,
- build_options=build_options,
- dest_archive=dest_archive,
- )
-
elif action == "tk":
- extra_archives = {"tcl"}
+ extra_archives = {"tcl", "zlib"}
if not host_platform.startswith("macos_"):
extra_archives |= {
"libX11",
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index c069ca1b6..a3b750df3 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -673,45 +673,27 @@ _tkinter:
sources:
- _tkinter.c
- tkappinit.c
- # TODO consider adding WITH_TIX, as Modules/Setup seems to recommend it. This also
- # initializes tix at init time, which seems desirable.
defines:
- WITH_APPINIT
includes-deps:
- include/X11
+ build-mode: shared
links:
- tcl8.6
- tk8.6
-
- # Without -ObjC, we get a crash: -[TKApplication tkProcessEvent:]: unrecognized selector sent to instance.
- # See also https://core.tcl-lang.org/tk/tktview/85f316beb15108ac43b03fa6c8608e31f3ae5f92.
- # This is apparently an issue with static linking Objective-C binaries.
- linker-args:
- - args: ["-ObjC"]
- targets:
- - .*-apple-darwin
links-conditional:
- name: X11
targets:
- .*-unknown-linux-.*
+ build-mode: static
- name: xcb
targets:
- .*-unknown-linux-.*
+ build-mode: static
- name: Xau
targets:
- .*-unknown-linux-.*
- # Many of these are dependencies of libtcl and libtk.
- frameworks:
- - AppKit
- - ApplicationServices
- - Carbon
- - Cocoa
- - CoreFoundation
- - CoreServices
- - CoreGraphics
- - IOKit
- - QuartzCore
- - UniformTypeIdentifiers
+ build-mode: static
_tokenize:
minimum-python-version: "3.11"
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index 33db80c8a..d0ef4a788 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -195,7 +195,6 @@ aarch64-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -285,7 +284,6 @@ armv7-unknown-linux-gnueabi:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -327,7 +325,6 @@ armv7-unknown-linux-gnueabihf:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -369,7 +366,6 @@ mips-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -411,7 +407,6 @@ mipsel-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -453,7 +448,6 @@ ppc64le-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -495,7 +489,6 @@ riscv64-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -537,7 +530,6 @@ s390x-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -812,7 +804,6 @@ x86_64-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -860,7 +851,6 @@ x86_64_v2-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -908,7 +898,6 @@ x86_64_v3-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -956,7 +945,6 @@ x86_64_v4-unknown-linux-gnu:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -1002,7 +990,6 @@ x86_64-unknown-linux-musl:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -1048,7 +1035,6 @@ x86_64_v2-unknown-linux-musl:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -1094,7 +1080,6 @@ x86_64_v3-unknown-linux-musl:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
@@ -1140,7 +1125,6 @@ x86_64_v4-unknown-linux-musl:
- sqlite
- tcl
- tk
- - tix
- uuid
- xorgproto
- xz
diff --git a/docs/distributions.rst b/docs/distributions.rst
index 3dd6125a1..9e4cf8305 100644
--- a/docs/distributions.rst
+++ b/docs/distributions.rst
@@ -388,8 +388,8 @@ license_path
tcl_library_path
Relative path to location of tcl library files. The path should be a
directory tree containing tcl files to support the tkinter extension.
- This will include a subset of the library files provided by the tcl, tk,
- and tix packages.
+ This will include a subset of the library files provided by the tcl
+ and tk packages.
This points to the root directory containing tcl resources. Actual
tcl resources are in sub-directories underneath, as identified by
diff --git a/docs/quirks.rst b/docs/quirks.rst
index 8900cd6ab..f24886a1a 100644
--- a/docs/quirks.rst
+++ b/docs/quirks.rst
@@ -71,18 +71,21 @@ ncurses/libedit/readline are loaded.
.. _quirk_macos_no_tix:
-No tix on macOS
-===============
+No tix on UNIX
+==============
+
+Tix is an old widget library for Tcl/Tk. Python previously had a wrapper
+for it in ``tkinter.tix``, but it was deprecated in Python 3.6 (the
+recommendation is to use ``tkinter.ttk``) and removed in Python 3.13.
-macOS distributions do not contain tix tcl support files. This means that
-``tkinter.tix`` module functionality will likely break at run-time. The
-module will import fine. But attempting to instantiate a ``tkinter.tix.Tk``
-instance or otherwise attempt to run tix tcl files will result in a run-time
-error.
+The macOS and Linux distributions from this project do not build and
+ship Tix, even for Python versions 3.12 and below.
-``tkinter.tix`` has been deprecated since Python 3.6 and the official Python
-macOS installers do not ship the tix support files. So this project behaves
-similarly to the official CPython distributions.
+We had previously attempted to ship Tix support on Linux, but it was
+broken and nobody reported an issue about it. The macOS distributions
+from this project never shipped support for Tix. The official Python.org
+macOS installers and Apple's build of Python do not ship support for
+Tix, either, so this project behaves similarly to those distributions.
.. _quirk_windows_no_pip:
diff --git a/docs/status.rst b/docs/status.rst
index ef172e04a..cd50e078d 100644
--- a/docs/status.rst
+++ b/docs/status.rst
@@ -285,7 +285,7 @@ test_spwd
test_startfile
object has no attribute 'startfile'
test_tix
- cannot run without OS X gui process
+ tix is not built by this project
test_tk
cannot run without OS X gui process
test_ttk_guionly
diff --git a/pythonbuild/cpython.py b/pythonbuild/cpython.py
index c52f7ce60..bd7213b67 100644
--- a/pythonbuild/cpython.py
+++ b/pythonbuild/cpython.py
@@ -69,6 +69,7 @@
"properties": {
"name": {"type": "string"},
"targets": {"type": "array", "items": {"type": "string"}},
+ "build-mode": {"type": "string"},
},
"additionalProperties": False,
},
@@ -535,7 +536,17 @@ def derive_setup_local(
python_version, entry.get("maximum-python-version", "100.0")
)
- if target_match and (python_min_match and python_max_match):
+ if build_mode := entry.get("build-mode"):
+ build_mode_match = section == build_mode
+ else:
+ build_mode_match = True
+
+ if (
+ target_match
+ and python_min_match
+ and python_max_match
+ and build_mode_match
+ ):
if source := entry.get("source"):
line += f" {source}"
for source in entry.get("sources", []):
diff --git a/src/validation.rs b/src/validation.rs
index b0ffb5304..3b1ef5c80 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -9,7 +9,7 @@ use {
normalize_path::NormalizePath,
object::{
elf::{
- FileHeader32, FileHeader64, ET_DYN, ET_EXEC, STB_GLOBAL, STB_WEAK, STV_DEFAULT,
+ FileHeader32, FileHeader64, ET_DYN, ET_EXEC, SHN_UNDEF, STB_GLOBAL, STB_WEAK, STV_DEFAULT,
STV_HIDDEN,
},
macho::{MachHeader32, MachHeader64, MH_OBJECT, MH_TWOLEVEL},
@@ -265,6 +265,25 @@ static ELF_ALLOWED_LIBRARIES_BY_TRIPLE: Lazy>> =
+ Lazy::new(|| {
+ [
+ (
+ // libcrypt is provided by the system, but only on older distros.
+ "_crypt",
+ vec!["libcrypt.so.1"],
+ ),
+ (
+ // libtcl and libtk are shipped in our distribution.
+ "_tkinter",
+ vec!["libtcl8.6.so", "libtk8.6.so"],
+ ),
+ ]
+ .iter()
+ .cloned()
+ .collect()
+ });
+
static DARWIN_ALLOWED_DYLIBS: Lazy> = Lazy::new(|| {
[
MachOAllowedDylib {
@@ -501,6 +520,29 @@ static IOS_ALLOWED_DYLIBS: Lazy> = Lazy::new(|| {
.to_vec()
});
+static ALLOWED_DYLIBS_BY_MODULE: Lazy>> =
+ Lazy::new(|| {
+ [(
+ // libtcl and libtk are shipped in our distribution.
+ "_tkinter",
+ vec![
+ MachOAllowedDylib {
+ name: "@rpath/libtcl8.6.dylib".to_string(),
+ max_compatibility_version: "8.6.0".try_into().unwrap(),
+ required: true,
+ },
+ MachOAllowedDylib {
+ name: "@rpath/libtk8.6.dylib".to_string(),
+ max_compatibility_version: "8.6.0".try_into().unwrap(),
+ required: true,
+ },
+ ],
+ )]
+ .iter()
+ .cloned()
+ .collect()
+ });
+
static PLATFORM_TAG_BY_TRIPLE: Lazy> = Lazy::new(|| {
[
("aarch64-apple-darwin", "macosx-11.0-arm64"),
@@ -544,9 +586,12 @@ const ELF_BANNED_SYMBOLS: &[&str] = &[
/// We use this list to spot test behavior of symbols belonging to dependency packages.
/// The list is obviously not complete.
const DEPENDENCY_PACKAGE_SYMBOLS: &[&str] = &[
- // libX11
- "XClearWindow",
- "XFlush",
+ /* TODO(geofft): Tk provides these as no-op stubs on macOS, make it
+ * stop doing that so we can reenable the check
+ * // libX11
+ * "XClearWindow",
+ * "XFlush",
+ */
// OpenSSL
"BIO_ADDR_new",
"BN_new",
@@ -591,6 +636,11 @@ const DEPENDENCY_PACKAGE_SYMBOLS: &[&str] = &[
// liblzma
"lzma_index_init",
"lzma_stream_encoder",
+];
+
+// TODO(geofft): Conditionally prohibit these exported symbols
+// everywhere except libtcl and libtk. This should be a hashmap
+const _DEPENDENCY_PACKAGE_SYMBOLS_BUNDLED: &[&str] = &[
// tcl
"Tcl_Alloc",
"Tcl_ChannelName",
@@ -822,7 +872,7 @@ const GLOBAL_EXTENSIONS_WINDOWS_PRE_3_13: &[&str] = &["_msi"];
const GLOBAL_EXTENSIONS_WINDOWS_NO_STATIC: &[&str] = &["_testinternalcapi", "_tkinter"];
/// Extension modules that should be built as shared libraries.
-const SHARED_LIBRARY_EXTENSIONS: &[&str] = &["_crypt"];
+const SHARED_LIBRARY_EXTENSIONS: &[&str] = &["_crypt", "_tkinter"];
const PYTHON_VERIFICATIONS: &str = include_str!("verify_distribution.py");
@@ -967,11 +1017,13 @@ fn validate_elf>(
allowed_libraries.push("libc.so".to_string());
}
- // Allow the _crypt extension module - and only it - to link against libcrypt,
- // which is no longer universally present in Linux distros.
+ // Allow certain extension modules to link against shared libraries
+ // (either from the system or from our distribution).
if let Some(filename) = path.file_name() {
- if filename.to_string_lossy().starts_with("_crypt") {
- allowed_libraries.push("libcrypt.so.1".to_string());
+ if let Some((module, _)) = filename.to_string_lossy().split_once(".cpython-") {
+ if let Some(extra) = ELF_ALLOWED_LIBRARIES_BY_MODULE.get(module) {
+ allowed_libraries.extend(extra.iter().map(|x| x.to_string()));
+ }
}
}
@@ -1109,6 +1161,7 @@ fn validate_elf>(
// to prevent them from being exported.
if DEPENDENCY_PACKAGE_SYMBOLS.contains(&name.as_ref())
&& matches!(symbol.st_bind(), STB_GLOBAL | STB_WEAK)
+ && symbol.st_shndx(endian) != SHN_UNDEF
&& symbol.st_visibility() != STV_HIDDEN
{
context.errors.push(format!(
@@ -1124,6 +1177,7 @@ fn validate_elf>(
if filename.starts_with("libpython")
&& filename.ends_with(".so.1.0")
&& matches!(symbol.st_bind(), STB_GLOBAL | STB_WEAK)
+ && symbol.st_shndx(endian) != SHN_UNDEF
&& symbol.st_visibility() == STV_DEFAULT
{
context.libpython_exported_symbols.insert(name.to_string());
@@ -1225,7 +1279,16 @@ fn validate_macho>(
dylib_names.push(lib.clone());
- let allowed = allowed_dylibs_for_triple(target_triple);
+ let mut allowed = allowed_dylibs_for_triple(target_triple);
+ // Allow certain extension modules to link against shared libraries
+ // (either from the system or from our distribution).
+ if let Some(filename) = path.file_name() {
+ if let Some((module, _)) = filename.to_string_lossy().split_once(".cpython-") {
+ if let Some(extra) = ALLOWED_DYLIBS_BY_MODULE.get(module) {
+ allowed.extend(extra.clone());
+ }
+ }
+ }
if let Some(entry) = allowed.iter().find(|l| l.name == lib) {
let load_version =
From 277c82e81b43930c0fa75ead052a39bbe465b2a0 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Thu, 14 Aug 2025 07:31:34 -0700
Subject: [PATCH 058/231] Build _ctypes_test as a shared module (fixes #721)
(#747)
---
cpython-unix/extension-modules.yml | 1 +
src/validation.rs | 6 +++++-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index a3b750df3..4f9acc064 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -145,6 +145,7 @@ _ctypes:
- dl
_ctypes_test:
+ build-mode: shared
sources:
- _ctypes/_ctypes_test.c
links:
diff --git a/src/validation.rs b/src/validation.rs
index 3b1ef5c80..6d9b5dbf0 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -649,6 +649,10 @@ const _DEPENDENCY_PACKAGE_SYMBOLS_BUNDLED: &[&str] = &[
"TkBindInit",
"TkCreateFrame",
"Tk_FreeGC",
+ // _ctypes_test module
+ "my_free",
+ "mystrdup",
+ "top",
];
const PYTHON_EXPORTED_SYMBOLS: &[&str] = &[
@@ -872,7 +876,7 @@ const GLOBAL_EXTENSIONS_WINDOWS_PRE_3_13: &[&str] = &["_msi"];
const GLOBAL_EXTENSIONS_WINDOWS_NO_STATIC: &[&str] = &["_testinternalcapi", "_tkinter"];
/// Extension modules that should be built as shared libraries.
-const SHARED_LIBRARY_EXTENSIONS: &[&str] = &["_crypt", "_tkinter"];
+const SHARED_LIBRARY_EXTENSIONS: &[&str] = &["_crypt", "_ctypes_test", "_tkinter"];
const PYTHON_VERIFICATIONS: &str = include_str!("verify_distribution.py");
From d231d773f03a3ce756a987fddab40a5d90036f65 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 14 Aug 2025 10:58:42 -0500
Subject: [PATCH 059/231] Upgrade to 3.14.0rc2 (and temporarily use GitHub's
runners on Windows) (#754)
- **Bump CPython to 3.14.0rc2**
- **Drop the Depot Windows runner**
---
ci-runners.yaml | 5 -----
pythonbuild/downloads.py | 8 ++++----
2 files changed, 4 insertions(+), 9 deletions(-)
diff --git a/ci-runners.yaml b/ci-runners.yaml
index dae6aabc9..849a25439 100644
--- a/ci-runners.yaml
+++ b/ci-runners.yaml
@@ -25,11 +25,6 @@ macos-latest:
platform: darwin
free: true
-depot-windows-2022-8:
- arch: x86_64
- platform: windows
- free: false
-
windows-latest-large:
arch: x86_64
platform: windows
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 7d80e348d..d369d1b12 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -82,10 +82,10 @@
"python_tag": "cp313",
},
"cpython-3.14": {
- "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0rc1.tar.xz",
- "size": 23661916,
- "sha256": "8707780ae9f19c5bf5b9f27827181ba11cdad7bb292ea49cad5424331e40ee8b",
- "version": "3.14.0rc1",
+ "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0rc2.tar.xz",
+ "size": 23566140,
+ "sha256": "bc62854cf232345bd22c9091a68464e01e056c6473a3fffa84572c8a342da656",
+ "version": "3.14.0rc2",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp314",
From 24fa3ddba3d0561de3ca5c64e1659c430b3fc779 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 14 Aug 2025 13:39:14 -0500
Subject: [PATCH 060/231] Bump Windows SDK to 10.0.26100.0 (#756)
The previous version is being dropped
- https://github.com/actions/runner-images/pull/12708
-
https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes?tabs=allfeatures#17.14.11
---
cpython-windows/build.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index 3b0c3b414..8f8cc43d5 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -1842,7 +1842,7 @@ def main() -> None:
)
parser.add_argument(
"--windows-sdk-version",
- default="10.0.20348.0",
+ default="10.0.26100.0",
help="Windows SDK version to build with",
)
From 1260d902fa132a2aa6c0652b51056cdd168a8a41 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Fri, 15 Aug 2025 09:00:08 -0500
Subject: [PATCH 061/231] Restore the Depot Windows runners (#757)
This reverts commit 6228086c4523ca1d3e77b5215cf5f280c4d3c21b following
#756
---
ci-runners.yaml | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/ci-runners.yaml b/ci-runners.yaml
index 849a25439..dae6aabc9 100644
--- a/ci-runners.yaml
+++ b/ci-runners.yaml
@@ -25,6 +25,11 @@ macos-latest:
platform: darwin
free: true
+depot-windows-2022-8:
+ arch: x86_64
+ platform: windows
+ free: false
+
windows-latest-large:
arch: x86_64
platform: windows
From c0537632433ff4d5d7d8bfc1b4b6bc5d72970b7f Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Fri, 15 Aug 2025 19:00:34 -0500
Subject: [PATCH 062/231] Bump CPython to 3.13.7 (#759)
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index d369d1b12..4332d6806 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -73,10 +73,10 @@
"python_tag": "cp312",
},
"cpython-3.13": {
- "url": "https://www.python.org/ftp/python/3.13.6/Python-3.13.6.tar.xz",
- "size": 22761268,
- "sha256": "17ba5508819d8736a14fbfc47d36e184946a877851b2e9c4b6c43acb44a3b104",
- "version": "3.13.6",
+ "url": "https://www.python.org/ftp/python/3.13.7/Python-3.13.7.tar.xz",
+ "size": 22769492,
+ "sha256": "5462f9099dfd30e238def83c71d91897d8caa5ff6ebc7a50f14d4802cdaaa79a",
+ "version": "3.13.7",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp313",
From ce0f50af1b88bd897fcab922d87a204656a879bc Mon Sep 17 00:00:00 2001
From: Gregory Szorc
Date: Fri, 15 Aug 2025 17:21:09 -0700
Subject: [PATCH 063/231] Fix download statistics (#706)
`just download-stats*` are failing with an HTTP 504 Gateway Timeout on
GitHub's servers.
We can work around this by reducing the requested number of releases per
page.
As part of this, we adopt a 3rd party package for querying the GitHub
API because I was too lazy to implement pagination manually. Also, since
pagination is enabled, the counts reported by these commands are now
accurate and don't implicitly truncate at the most recent 10 releases.
Co-authored-by: Zanie Blue
---
pythonbuild/utils.py | 20 ++--
requirements.dev.in | 1 +
requirements.dev.txt | 251 ++++++++++++++++++++++++++++++++++++++--
requirements.in | 1 +
requirements.txt | 230 ++++++++++++++++++++++++++++++++++++-
requirements.win.txt | 266 +++++++++++++++++++++++++++++++++++++++----
6 files changed, 728 insertions(+), 41 deletions(-)
diff --git a/pythonbuild/utils.py b/pythonbuild/utils.py
index 0edc11d7f..f784dc182 100644
--- a/pythonbuild/utils.py
+++ b/pythonbuild/utils.py
@@ -23,6 +23,7 @@
import urllib.request
import zipfile
+import github
import yaml
import zstandard
@@ -653,21 +654,20 @@ def validate_python_json(info, extension_modules):
def release_download_statistics(mode="by_asset"):
- with urllib.request.urlopen(
- "https://api.github.com/repos/astral-sh/python-build-standalone/releases"
- ) as fh:
- data = json.load(fh)
-
by_tag = collections.Counter()
by_build = collections.Counter()
by_build_install_only = collections.Counter()
- for release in data:
- tag = release["tag_name"]
+ # Default paging settings time out. Reduce page size as a workaround.
+ gh = github.Github(per_page=5)
+
+ repo = gh.get_repo("astral-sh/python-build-standalone")
+ for release in repo.get_releases():
+ tag = release.tag_name
- for asset in release["assets"]:
- name = asset["name"]
- count = asset["download_count"]
+ for asset in release.assets:
+ name = asset.name
+ count = asset.download_count
by_tag[tag] += count
diff --git a/requirements.dev.in b/requirements.dev.in
index 2f64d57f3..b06a90a5d 100644
--- a/requirements.dev.in
+++ b/requirements.dev.in
@@ -2,6 +2,7 @@
ruff
mypy
+PyGithub
types-jsonschema
types-PyYAML
types-jinja2
diff --git a/requirements.dev.txt b/requirements.dev.txt
index b45edbc3c..3ab114673 100644
--- a/requirements.dev.txt
+++ b/requirements.dev.txt
@@ -13,6 +13,78 @@ certifi==2024.12.14 \
# via
# -r requirements.txt
# requests
+cffi==1.17.1 \
+ --hash=sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8 \
+ --hash=sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2 \
+ --hash=sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1 \
+ --hash=sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15 \
+ --hash=sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36 \
+ --hash=sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824 \
+ --hash=sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8 \
+ --hash=sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36 \
+ --hash=sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17 \
+ --hash=sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf \
+ --hash=sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc \
+ --hash=sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3 \
+ --hash=sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed \
+ --hash=sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702 \
+ --hash=sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1 \
+ --hash=sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8 \
+ --hash=sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903 \
+ --hash=sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6 \
+ --hash=sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d \
+ --hash=sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b \
+ --hash=sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e \
+ --hash=sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be \
+ --hash=sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c \
+ --hash=sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683 \
+ --hash=sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9 \
+ --hash=sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c \
+ --hash=sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8 \
+ --hash=sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1 \
+ --hash=sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4 \
+ --hash=sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655 \
+ --hash=sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67 \
+ --hash=sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595 \
+ --hash=sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0 \
+ --hash=sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65 \
+ --hash=sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41 \
+ --hash=sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6 \
+ --hash=sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401 \
+ --hash=sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6 \
+ --hash=sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3 \
+ --hash=sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16 \
+ --hash=sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93 \
+ --hash=sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e \
+ --hash=sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4 \
+ --hash=sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964 \
+ --hash=sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c \
+ --hash=sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576 \
+ --hash=sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0 \
+ --hash=sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3 \
+ --hash=sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662 \
+ --hash=sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3 \
+ --hash=sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff \
+ --hash=sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5 \
+ --hash=sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd \
+ --hash=sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f \
+ --hash=sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5 \
+ --hash=sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14 \
+ --hash=sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d \
+ --hash=sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9 \
+ --hash=sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7 \
+ --hash=sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382 \
+ --hash=sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a \
+ --hash=sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e \
+ --hash=sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a \
+ --hash=sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4 \
+ --hash=sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99 \
+ --hash=sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87 \
+ --hash=sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b
+ # via
+ # -r requirements.txt
+ # cryptography
+ # pynacl
charset-normalizer==3.4.1 \
--hash=sha256:0167ddc8ab6508fe81860a57dd472b2ef4060e8d378f0cc555707126830f2537 \
--hash=sha256:01732659ba9b5b873fc117534143e4feefecf3b2078b0a6a2e925271bb6f4cfa \
@@ -109,6 +181,53 @@ charset-normalizer==3.4.1 \
# via
# -r requirements.txt
# requests
+cryptography==45.0.5 \
+ --hash=sha256:0027d566d65a38497bc37e0dd7c2f8ceda73597d2ac9ba93810204f56f52ebc7 \
+ --hash=sha256:101ee65078f6dd3e5a028d4f19c07ffa4dd22cce6a20eaa160f8b5219911e7d8 \
+ --hash=sha256:12e55281d993a793b0e883066f590c1ae1e802e3acb67f8b442e721e475e6463 \
+ --hash=sha256:14d96584701a887763384f3c47f0ca7c1cce322aa1c31172680eb596b890ec30 \
+ --hash=sha256:1e1da5accc0c750056c556a93c3e9cb828970206c68867712ca5805e46dc806f \
+ --hash=sha256:206210d03c1193f4e1ff681d22885181d47efa1ab3018766a7b32a7b3d6e6afd \
+ --hash=sha256:2089cc8f70a6e454601525e5bf2779e665d7865af002a5dec8d14e561002e135 \
+ --hash=sha256:3a264aae5f7fbb089dbc01e0242d3b67dffe3e6292e1f5182122bdf58e65215d \
+ --hash=sha256:3af26738f2db354aafe492fb3869e955b12b2ef2e16908c8b9cb928128d42c57 \
+ --hash=sha256:3fcfbefc4a7f332dece7272a88e410f611e79458fab97b5efe14e54fe476f4fd \
+ --hash=sha256:460f8c39ba66af7db0545a8c6f2eabcbc5a5528fc1cf6c3fa9a1e44cec33385e \
+ --hash=sha256:57c816dfbd1659a367831baca4b775b2a5b43c003daf52e9d57e1d30bc2e1b0e \
+ --hash=sha256:5aa1e32983d4443e310f726ee4b071ab7569f58eedfdd65e9675484a4eb67bd1 \
+ --hash=sha256:6ff8728d8d890b3dda5765276d1bc6fb099252915a2cd3aff960c4c195745dd0 \
+ --hash=sha256:7259038202a47fdecee7e62e0fd0b0738b6daa335354396c6ddebdbe1206af2a \
+ --hash=sha256:72e76caa004ab63accdf26023fccd1d087f6d90ec6048ff33ad0445abf7f605a \
+ --hash=sha256:7760c1c2e1a7084153a0f68fab76e754083b126a47d0117c9ed15e69e2103492 \
+ --hash=sha256:8c4a6ff8a30e9e3d38ac0539e9a9e02540ab3f827a3394f8852432f6b0ea152e \
+ --hash=sha256:9024beb59aca9d31d36fcdc1604dd9bbeed0a55bface9f1908df19178e2f116e \
+ --hash=sha256:90cb0a7bb35959f37e23303b7eed0a32280510030daba3f7fdfbb65defde6a97 \
+ --hash=sha256:91098f02ca81579c85f66df8a588c78f331ca19089763d733e34ad359f474174 \
+ --hash=sha256:926c3ea71a6043921050eaa639137e13dbe7b4ab25800932a8498364fc1abec9 \
+ --hash=sha256:982518cd64c54fcada9d7e5cf28eabd3ee76bd03ab18e08a48cad7e8b6f31b18 \
+ --hash=sha256:9b4cf6318915dccfe218e69bbec417fdd7c7185aa7aab139a2c0beb7468c89f0 \
+ --hash=sha256:ad0caded895a00261a5b4aa9af828baede54638754b51955a0ac75576b831b27 \
+ --hash=sha256:b85980d1e345fe769cfc57c57db2b59cff5464ee0c045d52c0df087e926fbe63 \
+ --hash=sha256:b8fa8b0a35a9982a3c60ec79905ba5bb090fc0b9addcfd3dc2dd04267e45f25e \
+ --hash=sha256:b9e38e0a83cd51e07f5a48ff9691cae95a79bea28fe4ded168a8e5c6c77e819d \
+ --hash=sha256:bd4c45986472694e5121084c6ebbd112aa919a25e783b87eb95953c9573906d6 \
+ --hash=sha256:be97d3a19c16a9be00edf79dca949c8fa7eff621763666a145f9f9535a5d7f42 \
+ --hash=sha256:c648025b6840fe62e57107e0a25f604db740e728bd67da4f6f060f03017d5097 \
+ --hash=sha256:d05a38884db2ba215218745f0781775806bde4f32e07b135348355fe8e4991d9 \
+ --hash=sha256:dd420e577921c8c2d31289536c386aaa30140b473835e97f83bc71ea9d2baf2d \
+ --hash=sha256:e357286c1b76403dd384d938f93c46b2b058ed4dfcdce64a770f0537ed3feb6f \
+ --hash=sha256:e6c00130ed423201c5bc5544c23359141660b07999ad82e34e7bb8f882bb78e0 \
+ --hash=sha256:e74d30ec9c7cb2f404af331d5b4099a9b322a8a6b25c4632755c8757345baac5 \
+ --hash=sha256:f3562c2f23c612f2e4a6964a61d942f891d29ee320edb62ff48ffb99f3de9ae8
+ # via
+ # -r requirements.txt
+ # pyjwt
+deprecated==1.2.18 \
+ --hash=sha256:422b6f6d859da6f2ef57857761bfb392480502a64c3028ca9bbe86085d72115d \
+ --hash=sha256:bd5011788200372a32418f888e326a09ff80d0214bd961147cfed01b5c018eec
+ # via
+ # -r requirements.txt
+ # pygithub
docker==7.1.0 \
--hash=sha256:ad8c70e6e3f8926cb8a92619b832b4ea5299e2831c14284663184e200546fa6c \
--hash=sha256:c96b93b7f0a746f9e77d325bcfb87422a3d8bd4f03136ae8a85b37f1898d5fc0
@@ -240,6 +359,38 @@ pathspec==0.12.1 \
--hash=sha256:a0d503e138a4c123b27490a4f7beda6a01c6f288df0e4a8b79c7eb0dc7b4cc08 \
--hash=sha256:a482d51503a1ab33b1c67a6c3813a26953dbdc71c31dacaef9a838c4e29f5712
# via mypy
+pycparser==2.22 \
+ --hash=sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6 \
+ --hash=sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc
+ # via
+ # -r requirements.txt
+ # cffi
+pygithub==2.6.1 \
+ --hash=sha256:6f2fa6d076ccae475f9fc392cc6cdbd54db985d4f69b8833a28397de75ed6ca3 \
+ --hash=sha256:b5c035392991cca63959e9453286b41b54d83bf2de2daa7d7ff7e4312cebf3bf
+ # via
+ # -r requirements.dev.in
+ # -r requirements.txt
+pyjwt==2.10.1 \
+ --hash=sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953 \
+ --hash=sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb
+ # via
+ # -r requirements.txt
+ # pygithub
+pynacl==1.5.0 \
+ --hash=sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858 \
+ --hash=sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d \
+ --hash=sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93 \
+ --hash=sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1 \
+ --hash=sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92 \
+ --hash=sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff \
+ --hash=sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba \
+ --hash=sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394 \
+ --hash=sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b \
+ --hash=sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543
+ # via
+ # -r requirements.txt
+ # pygithub
pyyaml==6.0.2 \
--hash=sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff \
--hash=sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48 \
@@ -309,6 +460,7 @@ requests==2.32.3 \
# via
# -r requirements.txt
# docker
+ # pygithub
rpds-py==0.22.3 \
--hash=sha256:009de23c9c9ee54bf11303a966edf4d9087cd43a6003672e6aa7def643d06518 \
--hash=sha256:02fbb9c288ae08bcb34fb41d516d5eeb0455ac35b5512d03181d755d80810059 \
@@ -474,9 +626,7 @@ tomli==2.2.1 \
--hash=sha256:e85e99945e688e32d5a35c1ff38ed0b3f41f43fad8df0bdf79f72b2ba7bc5272 \
--hash=sha256:ece47d672db52ac607a3d9599a9d48dcb2f2f735c6c2d1f34130085bb12b112a \
--hash=sha256:f4039b9cbc3048b2416cc57ab3bda989a6fcf9b36cf8937f01a6e731b64f80d7
- # via
- # -r requirements.txt
- # mypy
+ # via -r requirements.txt
types-jinja2==2.11.9 \
--hash=sha256:60a1e21e8296979db32f9374d8a239af4cb541ff66447bb915d8ad398f9c63b2 \
--hash=sha256:dbdc74a40aba7aed520b7e4d89e8f0fe4286518494208b35123bcf084d4b8c81
@@ -493,17 +643,104 @@ types-pyyaml==6.0.12.20250516 \
--hash=sha256:8478208feaeb53a34cb5d970c56a7cd76b72659442e733e268a94dc72b2d0530 \
--hash=sha256:9f21a70216fc0fa1b216a8176db5f9e0af6eb35d2f2932acb87689d03a5bf6ba
# via -r requirements.dev.in
-typing-extensions==4.9.0 \
- --hash=sha256:23478f88c37f27d76ac8aee6c905017a143b0b1b886c3c9f66bc2fd94f9f5783 \
- --hash=sha256:af72aea155e91adfc61c3ae9e0e342dbc0cba726d6cba4b6c72c1f34e47291cd
- # via mypy
+typing-extensions==4.14.1 \
+ --hash=sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36 \
+ --hash=sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76
+ # via
+ # -r requirements.txt
+ # mypy
+ # pygithub
urllib3==2.3.0 \
--hash=sha256:1cee9ad369867bfdbbb48b7dd50374c0967a0bb7710050facf0dd6911440e3df \
--hash=sha256:f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d
# via
# -r requirements.txt
# docker
+ # pygithub
# requests
+wrapt==1.17.2 \
+ --hash=sha256:08e7ce672e35efa54c5024936e559469436f8b8096253404faeb54d2a878416f \
+ --hash=sha256:0a6e821770cf99cc586d33833b2ff32faebdbe886bd6322395606cf55153246c \
+ --hash=sha256:0b929ac182f5ace000d459c59c2c9c33047e20e935f8e39371fa6e3b85d56f4a \
+ --hash=sha256:129a150f5c445165ff941fc02ee27df65940fcb8a22a61828b1853c98763a64b \
+ --hash=sha256:13e6afb7fe71fe7485a4550a8844cc9ffbe263c0f1a1eea569bc7091d4898555 \
+ --hash=sha256:1473400e5b2733e58b396a04eb7f35f541e1fb976d0c0724d0223dd607e0f74c \
+ --hash=sha256:18983c537e04d11cf027fbb60a1e8dfd5190e2b60cc27bc0808e653e7b218d1b \
+ --hash=sha256:1a7ed2d9d039bd41e889f6fb9364554052ca21ce823580f6a07c4ec245c1f5d6 \
+ --hash=sha256:1e1fe0e6ab7775fd842bc39e86f6dcfc4507ab0ffe206093e76d61cde37225c8 \
+ --hash=sha256:1fb5699e4464afe5c7e65fa51d4f99e0b2eadcc176e4aa33600a3df7801d6662 \
+ --hash=sha256:2696993ee1eebd20b8e4ee4356483c4cb696066ddc24bd70bcbb80fa56ff9061 \
+ --hash=sha256:35621ae4c00e056adb0009f8e86e28eb4a41a4bfa8f9bfa9fca7d343fe94f998 \
+ --hash=sha256:36ccae62f64235cf8ddb682073a60519426fdd4725524ae38874adf72b5f2aeb \
+ --hash=sha256:3cedbfa9c940fdad3e6e941db7138e26ce8aad38ab5fe9dcfadfed9db7a54e62 \
+ --hash=sha256:3d57c572081fed831ad2d26fd430d565b76aa277ed1d30ff4d40670b1c0dd984 \
+ --hash=sha256:3fc7cb4c1c744f8c05cd5f9438a3caa6ab94ce8344e952d7c45a8ed59dd88392 \
+ --hash=sha256:4011d137b9955791f9084749cba9a367c68d50ab8d11d64c50ba1688c9b457f2 \
+ --hash=sha256:40d615e4fe22f4ad3528448c193b218e077656ca9ccb22ce2cb20db730f8d306 \
+ --hash=sha256:410a92fefd2e0e10d26210e1dfb4a876ddaf8439ef60d6434f21ef8d87efc5b7 \
+ --hash=sha256:41388e9d4d1522446fe79d3213196bd9e3b301a336965b9e27ca2788ebd122f3 \
+ --hash=sha256:468090021f391fe0056ad3e807e3d9034e0fd01adcd3bdfba977b6fdf4213ea9 \
+ --hash=sha256:49703ce2ddc220df165bd2962f8e03b84c89fee2d65e1c24a7defff6f988f4d6 \
+ --hash=sha256:4a721d3c943dae44f8e243b380cb645a709ba5bd35d3ad27bc2ed947e9c68192 \
+ --hash=sha256:4afd5814270fdf6380616b321fd31435a462019d834f83c8611a0ce7484c7317 \
+ --hash=sha256:4c82b8785d98cdd9fed4cac84d765d234ed3251bd6afe34cb7ac523cb93e8b4f \
+ --hash=sha256:4db983e7bca53819efdbd64590ee96c9213894272c776966ca6306b73e4affda \
+ --hash=sha256:582530701bff1dec6779efa00c516496968edd851fba224fbd86e46cc6b73563 \
+ --hash=sha256:58455b79ec2661c3600e65c0a716955adc2410f7383755d537584b0de41b1d8a \
+ --hash=sha256:58705da316756681ad3c9c73fd15499aa4d8c69f9fd38dc8a35e06c12468582f \
+ --hash=sha256:5bb1d0dbf99411f3d871deb6faa9aabb9d4e744d67dcaaa05399af89d847a91d \
+ --hash=sha256:5c803c401ea1c1c18de70a06a6f79fcc9c5acfc79133e9869e730ad7f8ad8ef9 \
+ --hash=sha256:5cbabee4f083b6b4cd282f5b817a867cf0b1028c54d445b7ec7cfe6505057cf8 \
+ --hash=sha256:612dff5db80beef9e649c6d803a8d50c409082f1fedc9dbcdfde2983b2025b82 \
+ --hash=sha256:62c2caa1585c82b3f7a7ab56afef7b3602021d6da34fbc1cf234ff139fed3cd9 \
+ --hash=sha256:69606d7bb691b50a4240ce6b22ebb319c1cfb164e5f6569835058196e0f3a845 \
+ --hash=sha256:6d9187b01bebc3875bac9b087948a2bccefe464a7d8f627cf6e48b1bbae30f82 \
+ --hash=sha256:6ed6ffac43aecfe6d86ec5b74b06a5be33d5bb9243d055141e8cabb12aa08125 \
+ --hash=sha256:703919b1633412ab54bcf920ab388735832fdcb9f9a00ae49387f0fe67dad504 \
+ --hash=sha256:766d8bbefcb9e00c3ac3b000d9acc51f1b399513f44d77dfe0eb026ad7c9a19b \
+ --hash=sha256:80dd7db6a7cb57ffbc279c4394246414ec99537ae81ffd702443335a61dbf3a7 \
+ --hash=sha256:8112e52c5822fc4253f3901b676c55ddf288614dc7011634e2719718eaa187dc \
+ --hash=sha256:8c8b293cd65ad716d13d8dd3624e42e5a19cc2a2f1acc74b30c2c13f15cb61a6 \
+ --hash=sha256:8fdbdb757d5390f7c675e558fd3186d590973244fab0c5fe63d373ade3e99d40 \
+ --hash=sha256:91bd7d1773e64019f9288b7a5101f3ae50d3d8e6b1de7edee9c2ccc1d32f0c0a \
+ --hash=sha256:95c658736ec15602da0ed73f312d410117723914a5c91a14ee4cdd72f1d790b3 \
+ --hash=sha256:99039fa9e6306880572915728d7f6c24a86ec57b0a83f6b2491e1d8ab0235b9a \
+ --hash=sha256:9a2bce789a5ea90e51a02dfcc39e31b7f1e662bc3317979aa7e5538e3a034f72 \
+ --hash=sha256:9a7d15bbd2bc99e92e39f49a04653062ee6085c0e18b3b7512a4f2fe91f2d681 \
+ --hash=sha256:9abc77a4ce4c6f2a3168ff34b1da9b0f311a8f1cfd694ec96b0603dff1c79438 \
+ --hash=sha256:9e8659775f1adf02eb1e6f109751268e493c73716ca5761f8acb695e52a756ae \
+ --hash=sha256:9fee687dce376205d9a494e9c121e27183b2a3df18037f89d69bd7b35bcf59e2 \
+ --hash=sha256:a5aaeff38654462bc4b09023918b7f21790efb807f54c000a39d41d69cf552cb \
+ --hash=sha256:a604bf7a053f8362d27eb9fefd2097f82600b856d5abe996d623babd067b1ab5 \
+ --hash=sha256:abbb9e76177c35d4e8568e58650aa6926040d6a9f6f03435b7a522bf1c487f9a \
+ --hash=sha256:acc130bc0375999da18e3d19e5a86403667ac0c4042a094fefb7eec8ebac7cf3 \
+ --hash=sha256:b18f2d1533a71f069c7f82d524a52599053d4c7166e9dd374ae2136b7f40f7c8 \
+ --hash=sha256:b4e42a40a5e164cbfdb7b386c966a588b1047558a990981ace551ed7e12ca9c2 \
+ --hash=sha256:b5e251054542ae57ac7f3fba5d10bfff615b6c2fb09abeb37d2f1463f841ae22 \
+ --hash=sha256:b60fb58b90c6d63779cb0c0c54eeb38941bae3ecf7a73c764c52c88c2dcb9d72 \
+ --hash=sha256:b870b5df5b71d8c3359d21be8f0d6c485fa0ebdb6477dda51a1ea54a9b558061 \
+ --hash=sha256:ba0f0eb61ef00ea10e00eb53a9129501f52385c44853dbd6c4ad3f403603083f \
+ --hash=sha256:bb87745b2e6dc56361bfde481d5a378dc314b252a98d7dd19a651a3fa58f24a9 \
+ --hash=sha256:bb90fb8bda722a1b9d48ac1e6c38f923ea757b3baf8ebd0c82e09c5c1a0e7a04 \
+ --hash=sha256:bc570b5f14a79734437cb7b0500376b6b791153314986074486e0b0fa8d71d98 \
+ --hash=sha256:c86563182421896d73858e08e1db93afdd2b947a70064b813d515d66549e15f9 \
+ --hash=sha256:c958bcfd59bacc2d0249dcfe575e71da54f9dcf4a8bdf89c4cb9a68a1170d73f \
+ --hash=sha256:d18a4865f46b8579d44e4fe1e2bcbc6472ad83d98e22a26c963d46e4c125ef0b \
+ --hash=sha256:d5e2439eecc762cd85e7bd37161d4714aa03a33c5ba884e26c81559817ca0925 \
+ --hash=sha256:e3890b508a23299083e065f435a492b5435eba6e304a7114d2f919d400888cc6 \
+ --hash=sha256:e496a8ce2c256da1eb98bd15803a79bee00fc351f5dfb9ea82594a3f058309e0 \
+ --hash=sha256:e8b2816ebef96d83657b56306152a93909a83f23994f4b30ad4573b00bd11bb9 \
+ --hash=sha256:eaf675418ed6b3b31c7a989fd007fa7c3be66ce14e5c3b27336383604c9da85c \
+ --hash=sha256:ec89ed91f2fa8e3f52ae53cd3cf640d6feff92ba90d62236a81e4e563ac0e991 \
+ --hash=sha256:ecc840861360ba9d176d413a5489b9a0aff6d6303d7e733e2c4623cfa26904a6 \
+ --hash=sha256:f09b286faeff3c750a879d336fb6d8713206fc97af3adc14def0cdd349df6000 \
+ --hash=sha256:f393cda562f79828f38a819f4788641ac7c4085f30f1ce1a68672baa686482bb \
+ --hash=sha256:f917c1180fdb8623c2b75a99192f4025e412597c50b2ac870f156de8fb101119 \
+ --hash=sha256:fc78a84e2dfbc27afe4b2bd7c80c8db9bca75cc5b85df52bfe634596a1da846b \
+ --hash=sha256:ff04ef6eec3eee8a5efef2401495967a916feaa353643defcc03fc74fe213b58
+ # via
+ # -r requirements.txt
+ # deprecated
zstandard==0.23.0 \
--hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
--hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \
diff --git a/requirements.in b/requirements.in
index 0e9ae39ab..552e62d98 100644
--- a/requirements.in
+++ b/requirements.in
@@ -1,6 +1,7 @@
docker
jinja2
jsonschema
+PyGithub
PyYAML
# Undeclared dependency in docker 5.0 package.
six
diff --git a/requirements.txt b/requirements.txt
index 2baa34447..9ad29ed07 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -10,6 +10,77 @@ certifi==2024.12.14 \
--hash=sha256:1275f7a45be9464efc1173084eaa30f866fe2e47d389406136d332ed4967ec56 \
--hash=sha256:b650d30f370c2b724812bee08008be0c4163b163ddaec3f2546c1caf65f191db
# via requests
+cffi==1.17.1 \
+ --hash=sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8 \
+ --hash=sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2 \
+ --hash=sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1 \
+ --hash=sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15 \
+ --hash=sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36 \
+ --hash=sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824 \
+ --hash=sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8 \
+ --hash=sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36 \
+ --hash=sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17 \
+ --hash=sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf \
+ --hash=sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc \
+ --hash=sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3 \
+ --hash=sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed \
+ --hash=sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702 \
+ --hash=sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1 \
+ --hash=sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8 \
+ --hash=sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903 \
+ --hash=sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6 \
+ --hash=sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d \
+ --hash=sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b \
+ --hash=sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e \
+ --hash=sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be \
+ --hash=sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c \
+ --hash=sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683 \
+ --hash=sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9 \
+ --hash=sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c \
+ --hash=sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8 \
+ --hash=sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1 \
+ --hash=sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4 \
+ --hash=sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655 \
+ --hash=sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67 \
+ --hash=sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595 \
+ --hash=sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0 \
+ --hash=sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65 \
+ --hash=sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41 \
+ --hash=sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6 \
+ --hash=sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401 \
+ --hash=sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6 \
+ --hash=sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3 \
+ --hash=sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16 \
+ --hash=sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93 \
+ --hash=sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e \
+ --hash=sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4 \
+ --hash=sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964 \
+ --hash=sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c \
+ --hash=sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576 \
+ --hash=sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0 \
+ --hash=sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3 \
+ --hash=sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662 \
+ --hash=sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3 \
+ --hash=sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff \
+ --hash=sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5 \
+ --hash=sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd \
+ --hash=sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f \
+ --hash=sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5 \
+ --hash=sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14 \
+ --hash=sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d \
+ --hash=sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9 \
+ --hash=sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7 \
+ --hash=sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382 \
+ --hash=sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a \
+ --hash=sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e \
+ --hash=sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a \
+ --hash=sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4 \
+ --hash=sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99 \
+ --hash=sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87 \
+ --hash=sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b
+ # via
+ # cryptography
+ # pynacl
charset-normalizer==3.4.1 \
--hash=sha256:0167ddc8ab6508fe81860a57dd472b2ef4060e8d378f0cc555707126830f2537 \
--hash=sha256:01732659ba9b5b873fc117534143e4feefecf3b2078b0a6a2e925271bb6f4cfa \
@@ -104,6 +175,49 @@ charset-normalizer==3.4.1 \
--hash=sha256:fd4ec41f914fa74ad1b8304bbc634b3de73d2a0889bd32076342a573e0779e00 \
--hash=sha256:ffc9202a29ab3920fa812879e95a9e78b2465fd10be7fcbd042899695d75e616
# via requests
+cryptography==45.0.5 \
+ --hash=sha256:0027d566d65a38497bc37e0dd7c2f8ceda73597d2ac9ba93810204f56f52ebc7 \
+ --hash=sha256:101ee65078f6dd3e5a028d4f19c07ffa4dd22cce6a20eaa160f8b5219911e7d8 \
+ --hash=sha256:12e55281d993a793b0e883066f590c1ae1e802e3acb67f8b442e721e475e6463 \
+ --hash=sha256:14d96584701a887763384f3c47f0ca7c1cce322aa1c31172680eb596b890ec30 \
+ --hash=sha256:1e1da5accc0c750056c556a93c3e9cb828970206c68867712ca5805e46dc806f \
+ --hash=sha256:206210d03c1193f4e1ff681d22885181d47efa1ab3018766a7b32a7b3d6e6afd \
+ --hash=sha256:2089cc8f70a6e454601525e5bf2779e665d7865af002a5dec8d14e561002e135 \
+ --hash=sha256:3a264aae5f7fbb089dbc01e0242d3b67dffe3e6292e1f5182122bdf58e65215d \
+ --hash=sha256:3af26738f2db354aafe492fb3869e955b12b2ef2e16908c8b9cb928128d42c57 \
+ --hash=sha256:3fcfbefc4a7f332dece7272a88e410f611e79458fab97b5efe14e54fe476f4fd \
+ --hash=sha256:460f8c39ba66af7db0545a8c6f2eabcbc5a5528fc1cf6c3fa9a1e44cec33385e \
+ --hash=sha256:57c816dfbd1659a367831baca4b775b2a5b43c003daf52e9d57e1d30bc2e1b0e \
+ --hash=sha256:5aa1e32983d4443e310f726ee4b071ab7569f58eedfdd65e9675484a4eb67bd1 \
+ --hash=sha256:6ff8728d8d890b3dda5765276d1bc6fb099252915a2cd3aff960c4c195745dd0 \
+ --hash=sha256:7259038202a47fdecee7e62e0fd0b0738b6daa335354396c6ddebdbe1206af2a \
+ --hash=sha256:72e76caa004ab63accdf26023fccd1d087f6d90ec6048ff33ad0445abf7f605a \
+ --hash=sha256:7760c1c2e1a7084153a0f68fab76e754083b126a47d0117c9ed15e69e2103492 \
+ --hash=sha256:8c4a6ff8a30e9e3d38ac0539e9a9e02540ab3f827a3394f8852432f6b0ea152e \
+ --hash=sha256:9024beb59aca9d31d36fcdc1604dd9bbeed0a55bface9f1908df19178e2f116e \
+ --hash=sha256:90cb0a7bb35959f37e23303b7eed0a32280510030daba3f7fdfbb65defde6a97 \
+ --hash=sha256:91098f02ca81579c85f66df8a588c78f331ca19089763d733e34ad359f474174 \
+ --hash=sha256:926c3ea71a6043921050eaa639137e13dbe7b4ab25800932a8498364fc1abec9 \
+ --hash=sha256:982518cd64c54fcada9d7e5cf28eabd3ee76bd03ab18e08a48cad7e8b6f31b18 \
+ --hash=sha256:9b4cf6318915dccfe218e69bbec417fdd7c7185aa7aab139a2c0beb7468c89f0 \
+ --hash=sha256:ad0caded895a00261a5b4aa9af828baede54638754b51955a0ac75576b831b27 \
+ --hash=sha256:b85980d1e345fe769cfc57c57db2b59cff5464ee0c045d52c0df087e926fbe63 \
+ --hash=sha256:b8fa8b0a35a9982a3c60ec79905ba5bb090fc0b9addcfd3dc2dd04267e45f25e \
+ --hash=sha256:b9e38e0a83cd51e07f5a48ff9691cae95a79bea28fe4ded168a8e5c6c77e819d \
+ --hash=sha256:bd4c45986472694e5121084c6ebbd112aa919a25e783b87eb95953c9573906d6 \
+ --hash=sha256:be97d3a19c16a9be00edf79dca949c8fa7eff621763666a145f9f9535a5d7f42 \
+ --hash=sha256:c648025b6840fe62e57107e0a25f604db740e728bd67da4f6f060f03017d5097 \
+ --hash=sha256:d05a38884db2ba215218745f0781775806bde4f32e07b135348355fe8e4991d9 \
+ --hash=sha256:dd420e577921c8c2d31289536c386aaa30140b473835e97f83bc71ea9d2baf2d \
+ --hash=sha256:e357286c1b76403dd384d938f93c46b2b058ed4dfcdce64a770f0537ed3feb6f \
+ --hash=sha256:e6c00130ed423201c5bc5544c23359141660b07999ad82e34e7bb8f882bb78e0 \
+ --hash=sha256:e74d30ec9c7cb2f404af331d5b4099a9b322a8a6b25c4632755c8757345baac5 \
+ --hash=sha256:f3562c2f23c612f2e4a6964a61d942f891d29ee320edb62ff48ffb99f3de9ae8
+ # via pyjwt
+deprecated==1.2.18 \
+ --hash=sha256:422b6f6d859da6f2ef57857761bfb392480502a64c3028ca9bbe86085d72115d \
+ --hash=sha256:bd5011788200372a32418f888e326a09ff80d0214bd961147cfed01b5c018eec
+ # via pygithub
docker==7.1.0 \
--hash=sha256:ad8c70e6e3f8926cb8a92619b832b4ea5299e2831c14284663184e200546fa6c \
--hash=sha256:c96b93b7f0a746f9e77d325bcfb87422a3d8bd4f03136ae8a85b37f1898d5fc0
@@ -187,6 +301,30 @@ markupsafe==3.0.2 \
--hash=sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430 \
--hash=sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50
# via jinja2
+pycparser==2.22 \
+ --hash=sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6 \
+ --hash=sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc
+ # via cffi
+pygithub==2.6.1 \
+ --hash=sha256:6f2fa6d076ccae475f9fc392cc6cdbd54db985d4f69b8833a28397de75ed6ca3 \
+ --hash=sha256:b5c035392991cca63959e9453286b41b54d83bf2de2daa7d7ff7e4312cebf3bf
+ # via -r requirements.in
+pyjwt==2.10.1 \
+ --hash=sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953 \
+ --hash=sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb
+ # via pygithub
+pynacl==1.5.0 \
+ --hash=sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858 \
+ --hash=sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d \
+ --hash=sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93 \
+ --hash=sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1 \
+ --hash=sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92 \
+ --hash=sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff \
+ --hash=sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba \
+ --hash=sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394 \
+ --hash=sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b \
+ --hash=sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543
+ # via pygithub
pyyaml==6.0.2 \
--hash=sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff \
--hash=sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48 \
@@ -251,7 +389,9 @@ referencing==0.35.1 \
requests==2.32.3 \
--hash=sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760 \
--hash=sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6
- # via docker
+ # via
+ # docker
+ # pygithub
rpds-py==0.22.3 \
--hash=sha256:009de23c9c9ee54bf11303a966edf4d9087cd43a6003672e6aa7def643d06518 \
--hash=sha256:02fbb9c288ae08bcb34fb41d516d5eeb0455ac35b5512d03181d755d80810059 \
@@ -397,12 +537,100 @@ tomli==2.2.1 \
--hash=sha256:ece47d672db52ac607a3d9599a9d48dcb2f2f735c6c2d1f34130085bb12b112a \
--hash=sha256:f4039b9cbc3048b2416cc57ab3bda989a6fcf9b36cf8937f01a6e731b64f80d7
# via -r requirements.in
+typing-extensions==4.14.1 \
+ --hash=sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36 \
+ --hash=sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76
+ # via
+ # -r requirements.in
+ # pygithub
urllib3==2.3.0 \
--hash=sha256:1cee9ad369867bfdbbb48b7dd50374c0967a0bb7710050facf0dd6911440e3df \
--hash=sha256:f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d
# via
# docker
+ # pygithub
# requests
+wrapt==1.17.2 \
+ --hash=sha256:08e7ce672e35efa54c5024936e559469436f8b8096253404faeb54d2a878416f \
+ --hash=sha256:0a6e821770cf99cc586d33833b2ff32faebdbe886bd6322395606cf55153246c \
+ --hash=sha256:0b929ac182f5ace000d459c59c2c9c33047e20e935f8e39371fa6e3b85d56f4a \
+ --hash=sha256:129a150f5c445165ff941fc02ee27df65940fcb8a22a61828b1853c98763a64b \
+ --hash=sha256:13e6afb7fe71fe7485a4550a8844cc9ffbe263c0f1a1eea569bc7091d4898555 \
+ --hash=sha256:1473400e5b2733e58b396a04eb7f35f541e1fb976d0c0724d0223dd607e0f74c \
+ --hash=sha256:18983c537e04d11cf027fbb60a1e8dfd5190e2b60cc27bc0808e653e7b218d1b \
+ --hash=sha256:1a7ed2d9d039bd41e889f6fb9364554052ca21ce823580f6a07c4ec245c1f5d6 \
+ --hash=sha256:1e1fe0e6ab7775fd842bc39e86f6dcfc4507ab0ffe206093e76d61cde37225c8 \
+ --hash=sha256:1fb5699e4464afe5c7e65fa51d4f99e0b2eadcc176e4aa33600a3df7801d6662 \
+ --hash=sha256:2696993ee1eebd20b8e4ee4356483c4cb696066ddc24bd70bcbb80fa56ff9061 \
+ --hash=sha256:35621ae4c00e056adb0009f8e86e28eb4a41a4bfa8f9bfa9fca7d343fe94f998 \
+ --hash=sha256:36ccae62f64235cf8ddb682073a60519426fdd4725524ae38874adf72b5f2aeb \
+ --hash=sha256:3cedbfa9c940fdad3e6e941db7138e26ce8aad38ab5fe9dcfadfed9db7a54e62 \
+ --hash=sha256:3d57c572081fed831ad2d26fd430d565b76aa277ed1d30ff4d40670b1c0dd984 \
+ --hash=sha256:3fc7cb4c1c744f8c05cd5f9438a3caa6ab94ce8344e952d7c45a8ed59dd88392 \
+ --hash=sha256:4011d137b9955791f9084749cba9a367c68d50ab8d11d64c50ba1688c9b457f2 \
+ --hash=sha256:40d615e4fe22f4ad3528448c193b218e077656ca9ccb22ce2cb20db730f8d306 \
+ --hash=sha256:410a92fefd2e0e10d26210e1dfb4a876ddaf8439ef60d6434f21ef8d87efc5b7 \
+ --hash=sha256:41388e9d4d1522446fe79d3213196bd9e3b301a336965b9e27ca2788ebd122f3 \
+ --hash=sha256:468090021f391fe0056ad3e807e3d9034e0fd01adcd3bdfba977b6fdf4213ea9 \
+ --hash=sha256:49703ce2ddc220df165bd2962f8e03b84c89fee2d65e1c24a7defff6f988f4d6 \
+ --hash=sha256:4a721d3c943dae44f8e243b380cb645a709ba5bd35d3ad27bc2ed947e9c68192 \
+ --hash=sha256:4afd5814270fdf6380616b321fd31435a462019d834f83c8611a0ce7484c7317 \
+ --hash=sha256:4c82b8785d98cdd9fed4cac84d765d234ed3251bd6afe34cb7ac523cb93e8b4f \
+ --hash=sha256:4db983e7bca53819efdbd64590ee96c9213894272c776966ca6306b73e4affda \
+ --hash=sha256:582530701bff1dec6779efa00c516496968edd851fba224fbd86e46cc6b73563 \
+ --hash=sha256:58455b79ec2661c3600e65c0a716955adc2410f7383755d537584b0de41b1d8a \
+ --hash=sha256:58705da316756681ad3c9c73fd15499aa4d8c69f9fd38dc8a35e06c12468582f \
+ --hash=sha256:5bb1d0dbf99411f3d871deb6faa9aabb9d4e744d67dcaaa05399af89d847a91d \
+ --hash=sha256:5c803c401ea1c1c18de70a06a6f79fcc9c5acfc79133e9869e730ad7f8ad8ef9 \
+ --hash=sha256:5cbabee4f083b6b4cd282f5b817a867cf0b1028c54d445b7ec7cfe6505057cf8 \
+ --hash=sha256:612dff5db80beef9e649c6d803a8d50c409082f1fedc9dbcdfde2983b2025b82 \
+ --hash=sha256:62c2caa1585c82b3f7a7ab56afef7b3602021d6da34fbc1cf234ff139fed3cd9 \
+ --hash=sha256:69606d7bb691b50a4240ce6b22ebb319c1cfb164e5f6569835058196e0f3a845 \
+ --hash=sha256:6d9187b01bebc3875bac9b087948a2bccefe464a7d8f627cf6e48b1bbae30f82 \
+ --hash=sha256:6ed6ffac43aecfe6d86ec5b74b06a5be33d5bb9243d055141e8cabb12aa08125 \
+ --hash=sha256:703919b1633412ab54bcf920ab388735832fdcb9f9a00ae49387f0fe67dad504 \
+ --hash=sha256:766d8bbefcb9e00c3ac3b000d9acc51f1b399513f44d77dfe0eb026ad7c9a19b \
+ --hash=sha256:80dd7db6a7cb57ffbc279c4394246414ec99537ae81ffd702443335a61dbf3a7 \
+ --hash=sha256:8112e52c5822fc4253f3901b676c55ddf288614dc7011634e2719718eaa187dc \
+ --hash=sha256:8c8b293cd65ad716d13d8dd3624e42e5a19cc2a2f1acc74b30c2c13f15cb61a6 \
+ --hash=sha256:8fdbdb757d5390f7c675e558fd3186d590973244fab0c5fe63d373ade3e99d40 \
+ --hash=sha256:91bd7d1773e64019f9288b7a5101f3ae50d3d8e6b1de7edee9c2ccc1d32f0c0a \
+ --hash=sha256:95c658736ec15602da0ed73f312d410117723914a5c91a14ee4cdd72f1d790b3 \
+ --hash=sha256:99039fa9e6306880572915728d7f6c24a86ec57b0a83f6b2491e1d8ab0235b9a \
+ --hash=sha256:9a2bce789a5ea90e51a02dfcc39e31b7f1e662bc3317979aa7e5538e3a034f72 \
+ --hash=sha256:9a7d15bbd2bc99e92e39f49a04653062ee6085c0e18b3b7512a4f2fe91f2d681 \
+ --hash=sha256:9abc77a4ce4c6f2a3168ff34b1da9b0f311a8f1cfd694ec96b0603dff1c79438 \
+ --hash=sha256:9e8659775f1adf02eb1e6f109751268e493c73716ca5761f8acb695e52a756ae \
+ --hash=sha256:9fee687dce376205d9a494e9c121e27183b2a3df18037f89d69bd7b35bcf59e2 \
+ --hash=sha256:a5aaeff38654462bc4b09023918b7f21790efb807f54c000a39d41d69cf552cb \
+ --hash=sha256:a604bf7a053f8362d27eb9fefd2097f82600b856d5abe996d623babd067b1ab5 \
+ --hash=sha256:abbb9e76177c35d4e8568e58650aa6926040d6a9f6f03435b7a522bf1c487f9a \
+ --hash=sha256:acc130bc0375999da18e3d19e5a86403667ac0c4042a094fefb7eec8ebac7cf3 \
+ --hash=sha256:b18f2d1533a71f069c7f82d524a52599053d4c7166e9dd374ae2136b7f40f7c8 \
+ --hash=sha256:b4e42a40a5e164cbfdb7b386c966a588b1047558a990981ace551ed7e12ca9c2 \
+ --hash=sha256:b5e251054542ae57ac7f3fba5d10bfff615b6c2fb09abeb37d2f1463f841ae22 \
+ --hash=sha256:b60fb58b90c6d63779cb0c0c54eeb38941bae3ecf7a73c764c52c88c2dcb9d72 \
+ --hash=sha256:b870b5df5b71d8c3359d21be8f0d6c485fa0ebdb6477dda51a1ea54a9b558061 \
+ --hash=sha256:ba0f0eb61ef00ea10e00eb53a9129501f52385c44853dbd6c4ad3f403603083f \
+ --hash=sha256:bb87745b2e6dc56361bfde481d5a378dc314b252a98d7dd19a651a3fa58f24a9 \
+ --hash=sha256:bb90fb8bda722a1b9d48ac1e6c38f923ea757b3baf8ebd0c82e09c5c1a0e7a04 \
+ --hash=sha256:bc570b5f14a79734437cb7b0500376b6b791153314986074486e0b0fa8d71d98 \
+ --hash=sha256:c86563182421896d73858e08e1db93afdd2b947a70064b813d515d66549e15f9 \
+ --hash=sha256:c958bcfd59bacc2d0249dcfe575e71da54f9dcf4a8bdf89c4cb9a68a1170d73f \
+ --hash=sha256:d18a4865f46b8579d44e4fe1e2bcbc6472ad83d98e22a26c963d46e4c125ef0b \
+ --hash=sha256:d5e2439eecc762cd85e7bd37161d4714aa03a33c5ba884e26c81559817ca0925 \
+ --hash=sha256:e3890b508a23299083e065f435a492b5435eba6e304a7114d2f919d400888cc6 \
+ --hash=sha256:e496a8ce2c256da1eb98bd15803a79bee00fc351f5dfb9ea82594a3f058309e0 \
+ --hash=sha256:e8b2816ebef96d83657b56306152a93909a83f23994f4b30ad4573b00bd11bb9 \
+ --hash=sha256:eaf675418ed6b3b31c7a989fd007fa7c3be66ce14e5c3b27336383604c9da85c \
+ --hash=sha256:ec89ed91f2fa8e3f52ae53cd3cf640d6feff92ba90d62236a81e4e563ac0e991 \
+ --hash=sha256:ecc840861360ba9d176d413a5489b9a0aff6d6303d7e733e2c4623cfa26904a6 \
+ --hash=sha256:f09b286faeff3c750a879d336fb6d8713206fc97af3adc14def0cdd349df6000 \
+ --hash=sha256:f393cda562f79828f38a819f4788641ac7c4085f30f1ce1a68672baa686482bb \
+ --hash=sha256:f917c1180fdb8623c2b75a99192f4025e412597c50b2ac870f156de8fb101119 \
+ --hash=sha256:fc78a84e2dfbc27afe4b2bd7c80c8db9bca75cc5b85df52bfe634596a1da846b \
+ --hash=sha256:ff04ef6eec3eee8a5efef2401495967a916feaa353643defcc03fc74fe213b58
+ # via deprecated
zstandard==0.23.0 \
--hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
--hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \
diff --git a/requirements.win.txt b/requirements.win.txt
index a9132ab39..899a4c5d7 100644
--- a/requirements.win.txt
+++ b/requirements.win.txt
@@ -10,6 +10,77 @@ certifi==2025.7.14 \
--hash=sha256:6b31f564a415d79ee77df69d757bb49a5bb53bd9f756cbbe24394ffd6fc1f4b2 \
--hash=sha256:8ea99dbdfaaf2ba2f9bac77b9249ef62ec5218e7c2b2e903378ed5fccf765995
# via requests
+cffi==1.17.1 \
+ --hash=sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8 \
+ --hash=sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2 \
+ --hash=sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1 \
+ --hash=sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15 \
+ --hash=sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36 \
+ --hash=sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824 \
+ --hash=sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8 \
+ --hash=sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36 \
+ --hash=sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17 \
+ --hash=sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf \
+ --hash=sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc \
+ --hash=sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3 \
+ --hash=sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed \
+ --hash=sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702 \
+ --hash=sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1 \
+ --hash=sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8 \
+ --hash=sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903 \
+ --hash=sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6 \
+ --hash=sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d \
+ --hash=sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b \
+ --hash=sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e \
+ --hash=sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be \
+ --hash=sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c \
+ --hash=sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683 \
+ --hash=sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9 \
+ --hash=sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c \
+ --hash=sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8 \
+ --hash=sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1 \
+ --hash=sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4 \
+ --hash=sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655 \
+ --hash=sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67 \
+ --hash=sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595 \
+ --hash=sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0 \
+ --hash=sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65 \
+ --hash=sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41 \
+ --hash=sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6 \
+ --hash=sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401 \
+ --hash=sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6 \
+ --hash=sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3 \
+ --hash=sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16 \
+ --hash=sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93 \
+ --hash=sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e \
+ --hash=sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4 \
+ --hash=sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964 \
+ --hash=sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c \
+ --hash=sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576 \
+ --hash=sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0 \
+ --hash=sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3 \
+ --hash=sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662 \
+ --hash=sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3 \
+ --hash=sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff \
+ --hash=sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5 \
+ --hash=sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd \
+ --hash=sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f \
+ --hash=sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5 \
+ --hash=sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14 \
+ --hash=sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d \
+ --hash=sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9 \
+ --hash=sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7 \
+ --hash=sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382 \
+ --hash=sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a \
+ --hash=sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e \
+ --hash=sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a \
+ --hash=sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4 \
+ --hash=sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99 \
+ --hash=sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87 \
+ --hash=sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b
+ # via
+ # cryptography
+ # pynacl
charset-normalizer==3.4.2 \
--hash=sha256:005fa3432484527f9732ebd315da8da8001593e2cf46a3d817669f062c3d9ed4 \
--hash=sha256:046595208aae0120559a67693ecc65dd75d46f7bf687f159127046628178dc45 \
@@ -104,6 +175,49 @@ charset-normalizer==3.4.2 \
--hash=sha256:fcbe676a55d7445b22c10967bceaaf0ee69407fbe0ece4d032b6eb8d4565982a \
--hash=sha256:fdb20a30fe1175ecabed17cbf7812f7b804b8a315a25f24678bcdf120a90077f
# via requests
+cryptography==45.0.5 \
+ --hash=sha256:0027d566d65a38497bc37e0dd7c2f8ceda73597d2ac9ba93810204f56f52ebc7 \
+ --hash=sha256:101ee65078f6dd3e5a028d4f19c07ffa4dd22cce6a20eaa160f8b5219911e7d8 \
+ --hash=sha256:12e55281d993a793b0e883066f590c1ae1e802e3acb67f8b442e721e475e6463 \
+ --hash=sha256:14d96584701a887763384f3c47f0ca7c1cce322aa1c31172680eb596b890ec30 \
+ --hash=sha256:1e1da5accc0c750056c556a93c3e9cb828970206c68867712ca5805e46dc806f \
+ --hash=sha256:206210d03c1193f4e1ff681d22885181d47efa1ab3018766a7b32a7b3d6e6afd \
+ --hash=sha256:2089cc8f70a6e454601525e5bf2779e665d7865af002a5dec8d14e561002e135 \
+ --hash=sha256:3a264aae5f7fbb089dbc01e0242d3b67dffe3e6292e1f5182122bdf58e65215d \
+ --hash=sha256:3af26738f2db354aafe492fb3869e955b12b2ef2e16908c8b9cb928128d42c57 \
+ --hash=sha256:3fcfbefc4a7f332dece7272a88e410f611e79458fab97b5efe14e54fe476f4fd \
+ --hash=sha256:460f8c39ba66af7db0545a8c6f2eabcbc5a5528fc1cf6c3fa9a1e44cec33385e \
+ --hash=sha256:57c816dfbd1659a367831baca4b775b2a5b43c003daf52e9d57e1d30bc2e1b0e \
+ --hash=sha256:5aa1e32983d4443e310f726ee4b071ab7569f58eedfdd65e9675484a4eb67bd1 \
+ --hash=sha256:6ff8728d8d890b3dda5765276d1bc6fb099252915a2cd3aff960c4c195745dd0 \
+ --hash=sha256:7259038202a47fdecee7e62e0fd0b0738b6daa335354396c6ddebdbe1206af2a \
+ --hash=sha256:72e76caa004ab63accdf26023fccd1d087f6d90ec6048ff33ad0445abf7f605a \
+ --hash=sha256:7760c1c2e1a7084153a0f68fab76e754083b126a47d0117c9ed15e69e2103492 \
+ --hash=sha256:8c4a6ff8a30e9e3d38ac0539e9a9e02540ab3f827a3394f8852432f6b0ea152e \
+ --hash=sha256:9024beb59aca9d31d36fcdc1604dd9bbeed0a55bface9f1908df19178e2f116e \
+ --hash=sha256:90cb0a7bb35959f37e23303b7eed0a32280510030daba3f7fdfbb65defde6a97 \
+ --hash=sha256:91098f02ca81579c85f66df8a588c78f331ca19089763d733e34ad359f474174 \
+ --hash=sha256:926c3ea71a6043921050eaa639137e13dbe7b4ab25800932a8498364fc1abec9 \
+ --hash=sha256:982518cd64c54fcada9d7e5cf28eabd3ee76bd03ab18e08a48cad7e8b6f31b18 \
+ --hash=sha256:9b4cf6318915dccfe218e69bbec417fdd7c7185aa7aab139a2c0beb7468c89f0 \
+ --hash=sha256:ad0caded895a00261a5b4aa9af828baede54638754b51955a0ac75576b831b27 \
+ --hash=sha256:b85980d1e345fe769cfc57c57db2b59cff5464ee0c045d52c0df087e926fbe63 \
+ --hash=sha256:b8fa8b0a35a9982a3c60ec79905ba5bb090fc0b9addcfd3dc2dd04267e45f25e \
+ --hash=sha256:b9e38e0a83cd51e07f5a48ff9691cae95a79bea28fe4ded168a8e5c6c77e819d \
+ --hash=sha256:bd4c45986472694e5121084c6ebbd112aa919a25e783b87eb95953c9573906d6 \
+ --hash=sha256:be97d3a19c16a9be00edf79dca949c8fa7eff621763666a145f9f9535a5d7f42 \
+ --hash=sha256:c648025b6840fe62e57107e0a25f604db740e728bd67da4f6f060f03017d5097 \
+ --hash=sha256:d05a38884db2ba215218745f0781775806bde4f32e07b135348355fe8e4991d9 \
+ --hash=sha256:dd420e577921c8c2d31289536c386aaa30140b473835e97f83bc71ea9d2baf2d \
+ --hash=sha256:e357286c1b76403dd384d938f93c46b2b058ed4dfcdce64a770f0537ed3feb6f \
+ --hash=sha256:e6c00130ed423201c5bc5544c23359141660b07999ad82e34e7bb8f882bb78e0 \
+ --hash=sha256:e74d30ec9c7cb2f404af331d5b4099a9b322a8a6b25c4632755c8757345baac5 \
+ --hash=sha256:f3562c2f23c612f2e4a6964a61d942f891d29ee320edb62ff48ffb99f3de9ae8
+ # via pyjwt
+deprecated==1.2.18 \
+ --hash=sha256:422b6f6d859da6f2ef57857761bfb392480502a64c3028ca9bbe86085d72115d \
+ --hash=sha256:bd5011788200372a32418f888e326a09ff80d0214bd961147cfed01b5c018eec
+ # via pygithub
docker==7.1.0 \
--hash=sha256:ad8c70e6e3f8926cb8a92619b832b4ea5299e2831c14284663184e200546fa6c \
--hash=sha256:c96b93b7f0a746f9e77d325bcfb87422a3d8bd4f03136ae8a85b37f1898d5fc0
@@ -187,27 +301,47 @@ markupsafe==3.0.2 \
--hash=sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430 \
--hash=sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50
# via jinja2
-pywin32==311 \
- --hash=sha256:0502d1facf1fed4839a9a51ccbcc63d952cf318f78ffc00a7e78528ac27d7a2b \
- --hash=sha256:184eb5e436dea364dcd3d2316d577d625c0351bf237c4e9a5fabbcfa5a58b151 \
- --hash=sha256:3aca44c046bd2ed8c90de9cb8427f581c479e594e99b5c0bb19b29c10fd6cb87 \
- --hash=sha256:3ce80b34b22b17ccbd937a6e78e7225d80c52f5ab9940fe0506a1a16f3dab503 \
- --hash=sha256:62ea666235135fee79bb154e695f3ff67370afefd71bd7fea7512fc70ef31e3d \
- --hash=sha256:6c6f2969607b5023b0d9ce2541f8d2cbb01c4f46bc87456017cf63b73f1e2d8c \
- --hash=sha256:718a38f7e5b058e76aee1c56ddd06908116d35147e133427e59a3983f703a20d \
- --hash=sha256:750ec6e621af2b948540032557b10a2d43b0cee2ae9758c54154d711cc852d31 \
- --hash=sha256:797c2772017851984b97180b0bebe4b620bb86328e8a884bb626156295a63b3b \
- --hash=sha256:7b4075d959648406202d92a2310cb990fea19b535c7f4a78d3f5e10b926eeb8a \
- --hash=sha256:a508e2d9025764a8270f93111a970e1d0fbfc33f4153b388bb649b7eec4f9b42 \
- --hash=sha256:a733f1388e1a842abb67ffa8e7aad0e70ac519e09b0f6a784e65a136ec7cefd2 \
- --hash=sha256:aba8f82d551a942cb20d4a83413ccbac30790b50efb89a75e4f586ac0bb8056b \
- --hash=sha256:b7a2c10b93f8986666d0c803ee19b5990885872a7de910fc460f9b0c2fbf92ee \
- --hash=sha256:b8c095edad5c211ff31c05223658e71bf7116daa0ecf3ad85f3201ea3190d067 \
- --hash=sha256:c8015b09fb9a5e188f83b7b04de91ddca4658cee2ae6f3bc483f0b21a77ef6cd \
- --hash=sha256:d03ff496d2a0cd4a5893504789d4a15399133fe82517455e78bad62efbb7f0a3 \
- --hash=sha256:e0c4cfb0621281fe40387df582097fd796e80430597cb9944f0ae70447bacd91 \
- --hash=sha256:e286f46a9a39c4a18b319c28f59b61de793654af2f395c102b4f819e584b5852 \
- --hash=sha256:f95ba5a847cba10dd8c4d8fefa9f2a6cf283b8b88ed6178fa8a6c1ab16054d0d
+pycparser==2.22 \
+ --hash=sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6 \
+ --hash=sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc
+ # via cffi
+pygithub==2.6.1 \
+ --hash=sha256:6f2fa6d076ccae475f9fc392cc6cdbd54db985d4f69b8833a28397de75ed6ca3 \
+ --hash=sha256:b5c035392991cca63959e9453286b41b54d83bf2de2daa7d7ff7e4312cebf3bf
+ # via -r requirements.in
+pyjwt==2.10.1 \
+ --hash=sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953 \
+ --hash=sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb
+ # via pygithub
+pynacl==1.5.0 \
+ --hash=sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858 \
+ --hash=sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d \
+ --hash=sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93 \
+ --hash=sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1 \
+ --hash=sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92 \
+ --hash=sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff \
+ --hash=sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba \
+ --hash=sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394 \
+ --hash=sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b \
+ --hash=sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543
+ # via pygithub
+pywin32==310 \
+ --hash=sha256:0867beb8addefa2e3979d4084352e4ac6e991ca45373390775f7084cc0209b9c \
+ --hash=sha256:126298077a9d7c95c53823934f000599f66ec9296b09167810eb24875f32689c \
+ --hash=sha256:19ec5fc9b1d51c4350be7bb00760ffce46e6c95eaf2f0b2f1150657b1a43c582 \
+ --hash=sha256:1e765f9564e83011a63321bb9d27ec456a0ed90d3732c4b2e312b855365ed8bd \
+ --hash=sha256:2349cc906eae872d0663d4d6290d13b90621eaf78964bb1578632ff20e152966 \
+ --hash=sha256:30f0a9b3138fb5e07eb4973b7077e1883f558e40c578c6925acc7a94c34eaa36 \
+ --hash=sha256:33babed0cf0c92a6f94cc6cc13546ab24ee13e3e800e61ed87609ab91e4c8213 \
+ --hash=sha256:5d241a659c496ada3253cd01cfaa779b048e90ce4b2b38cd44168ad555ce74ab \
+ --hash=sha256:667827eb3a90208ddbdcc9e860c81bde63a135710e21e4cb3348968e4bd5249e \
+ --hash=sha256:6dd97011efc8bf51d6793a82292419eba2c71cf8e7250cfac03bba284454abc1 \
+ --hash=sha256:851c8d927af0d879221e616ae1f66145253537bbdd321a77e8ef701b443a9a1a \
+ --hash=sha256:8a75a5cc3893e83a108c05d82198880704c44bbaee4d06e442e471d3c9ea4f3d \
+ --hash=sha256:96867217335559ac619f00ad70e513c0fcf84b8a3af9fc2bba3b59b97da70475 \
+ --hash=sha256:bf5c397c9a9a19a6f62f3fb821fbf36cac08f03770056711f765ec1503972060 \
+ --hash=sha256:c3e78706e4229b915a0821941a84e7ef420bf2b77e08c9dae3c76fd03fd2ae3d \
+ --hash=sha256:e308f831de771482b7cf692a1f308f8fca701b2d8f9dde6cc440c7da17e47b33
# via docker
pyyaml==6.0.2 \
--hash=sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff \
@@ -273,7 +407,9 @@ referencing==0.36.2 \
requests==2.32.4 \
--hash=sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c \
--hash=sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422
- # via docker
+ # via
+ # docker
+ # pygithub
rpds-py==0.26.0 \
--hash=sha256:0919f38f5542c0a87e7b4afcafab6fd2c15386632d249e9a087498571250abe3 \
--hash=sha256:093d63b4b0f52d98ebae33b8c50900d3d67e0666094b1be7a12fffd7f65de74b \
@@ -463,13 +599,97 @@ tomli==2.2.1 \
typing-extensions==4.14.1 \
--hash=sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36 \
--hash=sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76
- # via -r requirements.in
+ # via
+ # -r requirements.in
+ # pygithub
urllib3==2.5.0 \
--hash=sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760 \
--hash=sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc
# via
# docker
+ # pygithub
# requests
+wrapt==1.17.2 \
+ --hash=sha256:08e7ce672e35efa54c5024936e559469436f8b8096253404faeb54d2a878416f \
+ --hash=sha256:0a6e821770cf99cc586d33833b2ff32faebdbe886bd6322395606cf55153246c \
+ --hash=sha256:0b929ac182f5ace000d459c59c2c9c33047e20e935f8e39371fa6e3b85d56f4a \
+ --hash=sha256:129a150f5c445165ff941fc02ee27df65940fcb8a22a61828b1853c98763a64b \
+ --hash=sha256:13e6afb7fe71fe7485a4550a8844cc9ffbe263c0f1a1eea569bc7091d4898555 \
+ --hash=sha256:1473400e5b2733e58b396a04eb7f35f541e1fb976d0c0724d0223dd607e0f74c \
+ --hash=sha256:18983c537e04d11cf027fbb60a1e8dfd5190e2b60cc27bc0808e653e7b218d1b \
+ --hash=sha256:1a7ed2d9d039bd41e889f6fb9364554052ca21ce823580f6a07c4ec245c1f5d6 \
+ --hash=sha256:1e1fe0e6ab7775fd842bc39e86f6dcfc4507ab0ffe206093e76d61cde37225c8 \
+ --hash=sha256:1fb5699e4464afe5c7e65fa51d4f99e0b2eadcc176e4aa33600a3df7801d6662 \
+ --hash=sha256:2696993ee1eebd20b8e4ee4356483c4cb696066ddc24bd70bcbb80fa56ff9061 \
+ --hash=sha256:35621ae4c00e056adb0009f8e86e28eb4a41a4bfa8f9bfa9fca7d343fe94f998 \
+ --hash=sha256:36ccae62f64235cf8ddb682073a60519426fdd4725524ae38874adf72b5f2aeb \
+ --hash=sha256:3cedbfa9c940fdad3e6e941db7138e26ce8aad38ab5fe9dcfadfed9db7a54e62 \
+ --hash=sha256:3d57c572081fed831ad2d26fd430d565b76aa277ed1d30ff4d40670b1c0dd984 \
+ --hash=sha256:3fc7cb4c1c744f8c05cd5f9438a3caa6ab94ce8344e952d7c45a8ed59dd88392 \
+ --hash=sha256:4011d137b9955791f9084749cba9a367c68d50ab8d11d64c50ba1688c9b457f2 \
+ --hash=sha256:40d615e4fe22f4ad3528448c193b218e077656ca9ccb22ce2cb20db730f8d306 \
+ --hash=sha256:410a92fefd2e0e10d26210e1dfb4a876ddaf8439ef60d6434f21ef8d87efc5b7 \
+ --hash=sha256:41388e9d4d1522446fe79d3213196bd9e3b301a336965b9e27ca2788ebd122f3 \
+ --hash=sha256:468090021f391fe0056ad3e807e3d9034e0fd01adcd3bdfba977b6fdf4213ea9 \
+ --hash=sha256:49703ce2ddc220df165bd2962f8e03b84c89fee2d65e1c24a7defff6f988f4d6 \
+ --hash=sha256:4a721d3c943dae44f8e243b380cb645a709ba5bd35d3ad27bc2ed947e9c68192 \
+ --hash=sha256:4afd5814270fdf6380616b321fd31435a462019d834f83c8611a0ce7484c7317 \
+ --hash=sha256:4c82b8785d98cdd9fed4cac84d765d234ed3251bd6afe34cb7ac523cb93e8b4f \
+ --hash=sha256:4db983e7bca53819efdbd64590ee96c9213894272c776966ca6306b73e4affda \
+ --hash=sha256:582530701bff1dec6779efa00c516496968edd851fba224fbd86e46cc6b73563 \
+ --hash=sha256:58455b79ec2661c3600e65c0a716955adc2410f7383755d537584b0de41b1d8a \
+ --hash=sha256:58705da316756681ad3c9c73fd15499aa4d8c69f9fd38dc8a35e06c12468582f \
+ --hash=sha256:5bb1d0dbf99411f3d871deb6faa9aabb9d4e744d67dcaaa05399af89d847a91d \
+ --hash=sha256:5c803c401ea1c1c18de70a06a6f79fcc9c5acfc79133e9869e730ad7f8ad8ef9 \
+ --hash=sha256:5cbabee4f083b6b4cd282f5b817a867cf0b1028c54d445b7ec7cfe6505057cf8 \
+ --hash=sha256:612dff5db80beef9e649c6d803a8d50c409082f1fedc9dbcdfde2983b2025b82 \
+ --hash=sha256:62c2caa1585c82b3f7a7ab56afef7b3602021d6da34fbc1cf234ff139fed3cd9 \
+ --hash=sha256:69606d7bb691b50a4240ce6b22ebb319c1cfb164e5f6569835058196e0f3a845 \
+ --hash=sha256:6d9187b01bebc3875bac9b087948a2bccefe464a7d8f627cf6e48b1bbae30f82 \
+ --hash=sha256:6ed6ffac43aecfe6d86ec5b74b06a5be33d5bb9243d055141e8cabb12aa08125 \
+ --hash=sha256:703919b1633412ab54bcf920ab388735832fdcb9f9a00ae49387f0fe67dad504 \
+ --hash=sha256:766d8bbefcb9e00c3ac3b000d9acc51f1b399513f44d77dfe0eb026ad7c9a19b \
+ --hash=sha256:80dd7db6a7cb57ffbc279c4394246414ec99537ae81ffd702443335a61dbf3a7 \
+ --hash=sha256:8112e52c5822fc4253f3901b676c55ddf288614dc7011634e2719718eaa187dc \
+ --hash=sha256:8c8b293cd65ad716d13d8dd3624e42e5a19cc2a2f1acc74b30c2c13f15cb61a6 \
+ --hash=sha256:8fdbdb757d5390f7c675e558fd3186d590973244fab0c5fe63d373ade3e99d40 \
+ --hash=sha256:91bd7d1773e64019f9288b7a5101f3ae50d3d8e6b1de7edee9c2ccc1d32f0c0a \
+ --hash=sha256:95c658736ec15602da0ed73f312d410117723914a5c91a14ee4cdd72f1d790b3 \
+ --hash=sha256:99039fa9e6306880572915728d7f6c24a86ec57b0a83f6b2491e1d8ab0235b9a \
+ --hash=sha256:9a2bce789a5ea90e51a02dfcc39e31b7f1e662bc3317979aa7e5538e3a034f72 \
+ --hash=sha256:9a7d15bbd2bc99e92e39f49a04653062ee6085c0e18b3b7512a4f2fe91f2d681 \
+ --hash=sha256:9abc77a4ce4c6f2a3168ff34b1da9b0f311a8f1cfd694ec96b0603dff1c79438 \
+ --hash=sha256:9e8659775f1adf02eb1e6f109751268e493c73716ca5761f8acb695e52a756ae \
+ --hash=sha256:9fee687dce376205d9a494e9c121e27183b2a3df18037f89d69bd7b35bcf59e2 \
+ --hash=sha256:a5aaeff38654462bc4b09023918b7f21790efb807f54c000a39d41d69cf552cb \
+ --hash=sha256:a604bf7a053f8362d27eb9fefd2097f82600b856d5abe996d623babd067b1ab5 \
+ --hash=sha256:abbb9e76177c35d4e8568e58650aa6926040d6a9f6f03435b7a522bf1c487f9a \
+ --hash=sha256:acc130bc0375999da18e3d19e5a86403667ac0c4042a094fefb7eec8ebac7cf3 \
+ --hash=sha256:b18f2d1533a71f069c7f82d524a52599053d4c7166e9dd374ae2136b7f40f7c8 \
+ --hash=sha256:b4e42a40a5e164cbfdb7b386c966a588b1047558a990981ace551ed7e12ca9c2 \
+ --hash=sha256:b5e251054542ae57ac7f3fba5d10bfff615b6c2fb09abeb37d2f1463f841ae22 \
+ --hash=sha256:b60fb58b90c6d63779cb0c0c54eeb38941bae3ecf7a73c764c52c88c2dcb9d72 \
+ --hash=sha256:b870b5df5b71d8c3359d21be8f0d6c485fa0ebdb6477dda51a1ea54a9b558061 \
+ --hash=sha256:ba0f0eb61ef00ea10e00eb53a9129501f52385c44853dbd6c4ad3f403603083f \
+ --hash=sha256:bb87745b2e6dc56361bfde481d5a378dc314b252a98d7dd19a651a3fa58f24a9 \
+ --hash=sha256:bb90fb8bda722a1b9d48ac1e6c38f923ea757b3baf8ebd0c82e09c5c1a0e7a04 \
+ --hash=sha256:bc570b5f14a79734437cb7b0500376b6b791153314986074486e0b0fa8d71d98 \
+ --hash=sha256:c86563182421896d73858e08e1db93afdd2b947a70064b813d515d66549e15f9 \
+ --hash=sha256:c958bcfd59bacc2d0249dcfe575e71da54f9dcf4a8bdf89c4cb9a68a1170d73f \
+ --hash=sha256:d18a4865f46b8579d44e4fe1e2bcbc6472ad83d98e22a26c963d46e4c125ef0b \
+ --hash=sha256:d5e2439eecc762cd85e7bd37161d4714aa03a33c5ba884e26c81559817ca0925 \
+ --hash=sha256:e3890b508a23299083e065f435a492b5435eba6e304a7114d2f919d400888cc6 \
+ --hash=sha256:e496a8ce2c256da1eb98bd15803a79bee00fc351f5dfb9ea82594a3f058309e0 \
+ --hash=sha256:e8b2816ebef96d83657b56306152a93909a83f23994f4b30ad4573b00bd11bb9 \
+ --hash=sha256:eaf675418ed6b3b31c7a989fd007fa7c3be66ce14e5c3b27336383604c9da85c \
+ --hash=sha256:ec89ed91f2fa8e3f52ae53cd3cf640d6feff92ba90d62236a81e4e563ac0e991 \
+ --hash=sha256:ecc840861360ba9d176d413a5489b9a0aff6d6303d7e733e2c4623cfa26904a6 \
+ --hash=sha256:f09b286faeff3c750a879d336fb6d8713206fc97af3adc14def0cdd349df6000 \
+ --hash=sha256:f393cda562f79828f38a819f4788641ac7c4085f30f1ce1a68672baa686482bb \
+ --hash=sha256:f917c1180fdb8623c2b75a99192f4025e412597c50b2ac870f156de8fb101119 \
+ --hash=sha256:fc78a84e2dfbc27afe4b2bd7c80c8db9bca75cc5b85df52bfe634596a1da846b \
+ --hash=sha256:ff04ef6eec3eee8a5efef2401495967a916feaa353643defcc03fc74fe213b58
+ # via deprecated
zstandard==0.23.0 \
--hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
--hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \
From 680590fc5d3f697c0e68bc46800f075f911ca264 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Sat, 16 Aug 2025 08:13:02 -0500
Subject: [PATCH 064/231] Pin all of the actions (#763)
Closes https://github.com/astral-sh/python-build-standalone/issues/760
---
.github/workflows/check.yml | 4 +--
.github/workflows/linux.yml | 48 +++++++++++++++++------------------
.github/workflows/macos.yml | 22 ++++++++--------
.github/workflows/release.yml | 4 +--
.github/workflows/windows.yml | 20 +++++++--------
5 files changed, 49 insertions(+), 49 deletions(-)
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index c7874e743..0b06a31a0 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -19,10 +19,10 @@ jobs:
runs-on: "ubuntu-latest"
name: "check"
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- - uses: actions/setup-python@v5
+ - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.12"
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index edd5acbd7..911f05c0a 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -29,7 +29,7 @@ jobs:
sudo apt update
sudo apt install -y --no-install-recommends libssl-dev pkg-config
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
@@ -37,7 +37,7 @@ jobs:
run: |
rustc --version > .rustc-version
- - uses: actions/cache@v4
+ - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
with:
path: |
~/.cargo/registry
@@ -50,7 +50,7 @@ jobs:
cargo build --release
- name: Upload pythonbuild Executable
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: ${{ matrix.crate_artifact_name }}
path: target/release/pythonbuild
@@ -67,20 +67,20 @@ jobs:
permissions:
packages: write
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- name: Install Python
- uses: actions/setup-python@v5
+ uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.11"
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+ uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
- name: Login to GitHub Container Registry
- uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+ uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
with:
registry: ghcr.io
username: ${{ github.actor }}
@@ -124,7 +124,7 @@ jobs:
MATRIX_ARCH: ${{ matrix.arch }}
- name: Upload Docker Image
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: image-${{ matrix.name }}-linux_${{ matrix.arch }}
path: build/image-*
@@ -139,13 +139,13 @@ jobs:
crate-build-matrix: ${{ steps.set-matrix.outputs.crate-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
- name: Set up Python
- uses: astral-sh/setup-uv@v4
+ uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
- name: Get pull request labels
id: get-labels
@@ -211,31 +211,31 @@ jobs:
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
- name: Install Python
- uses: actions/setup-python@v5
+ uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.11"
- name: Download pythonbuild
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
name: ${{ matrix.crate_artifact_name }}
path: build
- name: Download images
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
pattern: image-*
path: build
merge-multiple: true
- name: Cache downloads
- uses: actions/cache@v4
+ uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
with:
path: build/downloads
key: ${{ matrix.target_triple }}-${{ hashFiles('pythonbuild/downloads.py')}}
@@ -271,14 +271,14 @@ jobs:
MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
- uses: actions/attest-build-provenance@v2
+ uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
if: ${{ github.ref == 'refs/heads/main' }}
with:
subject-path: dist/*
- name: Upload Distribution
if: ${{ ! matrix.dry-run }}
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: cpython-${{ matrix.python }}-${{ matrix.target_triple }}-${{ matrix.build_options }}
path: dist/*
@@ -319,31 +319,31 @@ jobs:
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
- name: Install Python
- uses: actions/setup-python@v5
+ uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.11"
- name: Download pythonbuild
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
name: ${{ matrix.crate_artifact_name }}
path: build
- name: Download images
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
pattern: image-*
path: build
merge-multiple: true
- name: Cache downloads
- uses: actions/cache@v4
+ uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
with:
path: build/downloads
key: ${{ matrix.target_triple }}-${{ hashFiles('pythonbuild/downloads.py')}}
@@ -379,14 +379,14 @@ jobs:
MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
- uses: actions/attest-build-provenance@v2
+ uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
if: ${{ github.ref == 'refs/heads/main' }}
with:
subject-path: dist/*
- name: Upload Distribution
if: ${{ ! matrix.dry-run }}
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: cpython-${{ matrix.python }}-${{ matrix.target_triple }}-${{ matrix.build_options }}
path: dist/*
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 02ce471dd..b746a9670 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -24,7 +24,7 @@ jobs:
fail-fast: false
name: crate / ${{ matrix.arch }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
@@ -32,7 +32,7 @@ jobs:
run: |
rustc --version > .rustc-version
- - uses: actions/cache@v4
+ - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
with:
path: |
~/.cargo/registry
@@ -45,7 +45,7 @@ jobs:
cargo build --release
- name: Upload pythonbuild Executable
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: ${{ matrix.crate_artifact_name }}
path: target/release/pythonbuild
@@ -58,13 +58,13 @@ jobs:
crate-build-matrix: ${{ steps.set-matrix.outputs.crate-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
- name: Set up Python
- uses: astral-sh/setup-uv@v4
+ uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
- name: Get pull request labels
id: get-labels
@@ -123,18 +123,18 @@ jobs:
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
- name: Install Python
- uses: actions/setup-python@v5
+ uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.11"
- name: Download pythonbuild
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
name: ${{ matrix.crate_artifact_name }}
path: build
@@ -158,21 +158,21 @@ jobs:
MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
- uses: actions/attest-build-provenance@v2
+ uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
if: ${{ github.ref == 'refs/heads/main' }}
with:
subject-path: dist/*
- name: Upload Distributions
if: ${{ ! matrix.dry-run }}
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: cpython-${{ matrix.python }}-${{ matrix.target_triple }}-${{ matrix.build_options }}
path: dist/*
- name: Checkout macOS SDKs for validation
if: ${{ ! matrix.dry-run }}
- uses: actions/checkout@v4
+ uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
repository: phracker/MacOSX-SDKs
ref: master
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9c256ee7e..0a77d11c9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
attestations: write
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
submodules: recursive
persist-credentials: true # needed for git operations below
@@ -88,7 +88,7 @@ jobs:
GITHUB_EVENT_INPUTS_SHA: ${{ github.event.inputs.sha }}
GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
- name: Generate attestations
- uses: actions/attest-build-provenance@v2
+ uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
if: ${{ github.event.inputs.dry-run == 'false' }}
with:
subject-path: |
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 847a82e82..94bdc0488 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -24,7 +24,7 @@ jobs:
fail-fast: false
name: crate / ${{ matrix.arch }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
@@ -32,7 +32,7 @@ jobs:
run: |
rustc --version > .rustc-version
- - uses: actions/cache@v4
+ - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
with:
path: |
C:/Rust/.cargo/registry
@@ -45,7 +45,7 @@ jobs:
cargo build --release
- name: Upload executable
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: ${{ matrix.crate_artifact_name }}
path: target/release/pythonbuild.exe
@@ -58,13 +58,13 @@ jobs:
crate-build-matrix: ${{ steps.set-matrix.outputs.crate-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
- name: Set up Python
- uses: astral-sh/setup-uv@v4
+ uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
- name: Get pull request labels
id: get-labels
@@ -124,7 +124,7 @@ jobs:
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
@@ -135,12 +135,12 @@ jobs:
packages: autoconf automake libtool
- name: Install Python
- uses: actions/setup-python@v5
+ uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.12"
- name: Download pythonbuild Executable
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
name: ${{ matrix.crate_artifact_name }}
@@ -162,13 +162,13 @@ jobs:
MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
- uses: actions/attest-build-provenance@v2
+ uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
if: ${{ github.ref == 'refs/heads/main' }}
with:
subject-path: dist/*
- name: Upload Distributions
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: cpython-${{ matrix.python }}-${{ matrix.vcvars }}-${{ matrix.build_options }}
path: dist/*
From e2508053e9455b0845f56f0f0a04b2b1864059a5 Mon Sep 17 00:00:00 2001
From: William Woodruff
Date: Sun, 17 Aug 2025 14:30:50 -0400
Subject: [PATCH 065/231] chore(ci): drop ref-pin exceptions in zizmor (#765)
---
.github/zizmor.yml | 2 --
1 file changed, 2 deletions(-)
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index c3db96869..e7920e8cf 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -2,6 +2,4 @@ rules:
unpinned-uses:
config:
policies:
- actions/*: ref-pin
- astral-sh/*: ref-pin
"*": hash-pin
From 38904395690730fb5c7ecaf414e8f48508014480 Mon Sep 17 00:00:00 2001
From: Dustin Rodrigues
Date: Mon, 18 Aug 2025 09:33:22 -0400
Subject: [PATCH 066/231] only define MODULE_NAME for sqlite on python <= 3.9
(#767)
Starting in Python 3.10, -DMODULE_NAME="sqlite3" is no longer needed
when building _sqlite3.
https://github.com/python/cpython/issues/87610 /
https://github.com/python/cpython/pull/24801
---
cpython-unix/extension-modules.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index 4f9acc064..214d90afd 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -533,8 +533,6 @@ _sqlite3:
- include
includes:
- Modules/_sqlite
- defines:
- - "MODULE_NAME=\\\"sqlite3\\\""
defines-conditional:
# Require dynamic binaries to load extensions. Cannot load on iOS.
# 3.11+ uses opt in. <3.11 uses opt out.
@@ -548,6 +546,8 @@ _sqlite3:
- define: SQLITE_OMIT_LOAD_EXTENSION=1
targets:
- .*-ios
+ - define: "MODULE_NAME=\\\"sqlite3\\\""
+ maximum-python-version: "3.9"
links:
- sqlite3
From 947a810a8402399af117054e236dfe2ecf7caf26 Mon Sep 17 00:00:00 2001
From: Chowder <16789070+chowder@users.noreply.github.com>
Date: Mon, 18 Aug 2025 14:35:59 +0100
Subject: [PATCH 067/231] Reproducible artifact hashes for base builder images
(#766)
I was looking at the build pipeline for the distributions, and was
surprised to find the builder image artifacts having different SHA256
hashes across runs.
e.g. compare the output of the "Upload Docker Image" step of two jobs:
https://github.com/chowder/python-build-standalone/actions/runs/17012490960/job/48230404008
https://github.com/chowder/python-build-standalone/actions/runs/17012490960/job/48230532790
For the same image:
```
SHA256 digest of uploaded artifact zip is d47e11cc1c0e648bed6ec64a3613fa166c317981d252085c241c05745604973b
Finalizing artifact upload
Artifact image-build-linux_x86_64.zip successfully finalized. Artifact ID 3780654566
Artifact image-build-linux_x86_64 has been successfully uploaded! Final size is 80890477 bytes. Artifact ID is 3780654566
```
```
SHA256 digest of uploaded artifact zip is 3341d64b1d7efb680db3e4d62ae3dab9bf24e22e384f585aaf3a5b551aee5e7b
Finalizing artifact upload
Artifact image-build-linux_x86_64.zip successfully finalized. Artifact ID 3780667100
Artifact image-build-linux_x86_64 has been successfully uploaded! Final size is 80890477 bytes. Artifact ID is 3780667100
```
Turns out this is because the `upload-artifact` step applies a layer of
compression to the specified files, but doesn't reset/zero out the
mtime, thus making these artifacts non-reproducible.
Given that the docker images are already compressed [in a prior
step](https://github.com/astral-sh/python-build-standalone/blob/main/.github/workflows/linux.yml#L117-L120):
```yaml
- name: Compress Image
run: |
echo ${STEPS_BUILD_IMAGE_OUTPUTS_IMAGEID} > build/image-${MATRIX_NAME}.linux_${MATRIX_ARCH}
zstd -v -T0 -6 --rm build/image-*.tar
```
We can skip the compression in the `upload-artifact` step, and get
reproducible artifacts each time.
#### Test Evidence
See these two runs that include the proposed changes:
https://github.com/chowder/python-build-standalone/actions/runs/17012517183/job/48230459046
https://github.com/chowder/python-build-standalone/actions/runs/17012517183/job/48230772691
Both generate the same digest:
```
Finished uploading artifact content to blob storage!
SHA256 digest of uploaded artifact zip is c73f01690d74c103f92bd8113ff158e8b8d2d4de19dca96d36b3d6fbc688fe16
Finalizing artifact upload
Artifact image-build-linux_x86_64.zip successfully finalized. Artifact ID 3780661038
Artifact image-build-linux_x86_64 has been successfully uploaded! Final size is 81208314 bytes. Artifact ID is 3780661038
```
```
SHA256 digest of uploaded artifact zip is c73f01690d74c103f92bd8113ff158e8b8d2d4de19dca96d36b3d6fbc688fe16
Finalizing artifact upload
Artifact image-build-linux_x86_64.zip successfully finalized. Artifact ID 3780693018
Artifact image-build-linux_x86_64 has been successfully uploaded! Final size is 81208314 bytes. Artifact ID is 3780693018
```
---
.github/workflows/linux.yml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 911f05c0a..68eef0e52 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -97,6 +97,8 @@ jobs:
- name: Build Image
id: build-image
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+ env:
+ SOURCE_DATE_EPOCH: 0
with:
context: .
file: build/${{ matrix.name }}.Dockerfile
@@ -118,6 +120,7 @@ jobs:
run: |
echo ${STEPS_BUILD_IMAGE_OUTPUTS_IMAGEID} > build/image-${MATRIX_NAME}.linux_${MATRIX_ARCH}
zstd -v -T0 -6 --rm build/image-*.tar
+ touch -t 197001010000 build/image-*
env:
STEPS_BUILD_IMAGE_OUTPUTS_IMAGEID: ${{ steps.build-image.outputs.imageid }}
MATRIX_NAME: ${{ matrix.name }}
@@ -128,6 +131,7 @@ jobs:
with:
name: image-${{ matrix.name }}-linux_${{ matrix.arch }}
path: build/image-*
+ compression-level: '0'
generate-matrix:
name: Generate build matrix
From c744db99c53b6ed609455eb8aaf08eebc05f20a7 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Mon, 18 Aug 2025 08:42:40 -0500
Subject: [PATCH 068/231] Build zstd with multithreading enabled (#762)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
I verified this on macOS
```
❯ python -c "from compression import zstd; print(zstd.CompressionParameter.nb_workers.bounds())"
(0, 256)
```
See #761
I'm not sure if this is all of the performance difference, but using
threads should make a significant difference.
https://github.com/astral-sh/python-build-standalone/issues/761#issuecomment-3193682600
notes that threads are not used by default, so I think there's more
going on — but we should enable this at build time regardless. See also
#768.
---
cpython-unix/build-zstd.sh | 4 ++--
src/verify_distribution.py | 9 +++++++++
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/cpython-unix/build-zstd.sh b/cpython-unix/build-zstd.sh
index e81ef7817..e9b830c36 100755
--- a/cpython-unix/build-zstd.sh
+++ b/cpython-unix/build-zstd.sh
@@ -57,7 +57,7 @@ index 5e6e8bc..6ca72a1 100644
EOF
fi
-CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" make -j ${NUM_CPUS} libzstd.a
+CFLAGS="${EXTRA_TARGET_CFLAGS} -DZSTD_MULTITHREAD -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" make -j ${NUM_CPUS} libzstd.a
make -j ${NUM_CPUS} install-static DESTDIR=${ROOT}/out
make -j ${NUM_CPUS} install-includes DESTDIR=${ROOT}/out
-make -j ${NUM_CPUS} install-pc DESTDIR=${ROOT}/out
+MT=1 make -j ${NUM_CPUS} install-pc DESTDIR=${ROOT}/out
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index d6e428d6d..62e787b06 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -172,6 +172,15 @@ def test_gil_disabled(self):
self.assertEqual(sysconfig.get_config_var("Py_GIL_DISABLED"), wanted)
+ @unittest.skipIf(
+ sys.version_info[:2] < (3, 14),
+ "zstd is only available in 3.14+",
+ )
+ def test_zstd_multithreaded(self):
+ from compression import zstd
+
+ assert zstd.CompressionParameter.nb_workers.bounds() == (0, 256)
+
@unittest.skipIf("TCL_LIBRARY" not in os.environ, "TCL_LIBRARY not set")
@unittest.skipIf("DISPLAY" not in os.environ, "DISPLAY not set")
def test_tkinter(self):
From 5884554a15d1cd0c7a13e78580c1a2ab514dd695 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Mon, 18 Aug 2025 08:44:14 -0500
Subject: [PATCH 069/231] Build zstd with optimizations enabled (#768)
Also, enable verbose output in the build system because it is otherwise
too quiet to be helpful.
See
https://github.com/astral-sh/python-build-standalone/issues/761#issuecomment-3194589916
---
cpython-unix/build-zstd.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpython-unix/build-zstd.sh b/cpython-unix/build-zstd.sh
index e9b830c36..5a889da5e 100755
--- a/cpython-unix/build-zstd.sh
+++ b/cpython-unix/build-zstd.sh
@@ -57,7 +57,7 @@ index 5e6e8bc..6ca72a1 100644
EOF
fi
-CFLAGS="${EXTRA_TARGET_CFLAGS} -DZSTD_MULTITHREAD -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" make -j ${NUM_CPUS} libzstd.a
+CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC -DZSTD_MULTITHREAD -O3" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" make -j ${NUM_CPUS} VERBOSE=1 libzstd.a
make -j ${NUM_CPUS} install-static DESTDIR=${ROOT}/out
make -j ${NUM_CPUS} install-includes DESTDIR=${ROOT}/out
MT=1 make -j ${NUM_CPUS} install-pc DESTDIR=${ROOT}/out
From 01aa80641edfca8efa1a8f7c3b9bb0405bde1512 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Mon, 18 Aug 2025 08:54:08 -0500
Subject: [PATCH 070/231] Exclude pygithub on arm64 Windows (#769)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Addressing the environment bootstrap regression from #706 — we can't
build `cryptography` and `pynacl` from source and we don't need download
statistics in CI.
---
build-windows.py | 4 +-
pythonbuild/utils.py | 3 +-
requirements.in | 4 +-
requirements.win-arm64.txt | 571 +++++++++++++++++++++++++++++++++++++
4 files changed, 579 insertions(+), 3 deletions(-)
create mode 100644 requirements.win-arm64.txt
diff --git a/build-windows.py b/build-windows.py
index df836b66b..4a8c89737 100644
--- a/build-windows.py
+++ b/build-windows.py
@@ -5,6 +5,7 @@
import os
import pathlib
+import platform
import subprocess
import sys
import venv
@@ -15,7 +16,8 @@
VENV = BUILD / "venv"
PIP = VENV / "Scripts" / "pip.exe"
PYTHON = VENV / "Scripts" / "python.exe"
-REQUIREMENTS = ROOT / "requirements.win.txt"
+ARCH = "-arm64" if platform.machine() == "ARM64" else ""
+REQUIREMENTS = ROOT / f"requirements.win{ARCH}.txt"
WINDOWS_DIR = ROOT / "cpython-windows"
diff --git a/pythonbuild/utils.py b/pythonbuild/utils.py
index f784dc182..9e581c5b6 100644
--- a/pythonbuild/utils.py
+++ b/pythonbuild/utils.py
@@ -23,7 +23,6 @@
import urllib.request
import zipfile
-import github
import yaml
import zstandard
@@ -654,6 +653,8 @@ def validate_python_json(info, extension_modules):
def release_download_statistics(mode="by_asset"):
+ import github
+
by_tag = collections.Counter()
by_build = collections.Counter()
by_build_install_only = collections.Counter()
diff --git a/requirements.in b/requirements.in
index 552e62d98..e9159b67b 100644
--- a/requirements.in
+++ b/requirements.in
@@ -1,7 +1,9 @@
docker
jinja2
jsonschema
-PyGithub
+# This does not built on the aarch64-windows runners yet, and is only needed for
+# development so we'll just skip it for now.
+PyGithub; sys_platform != "win32" or platform_machine != "aarch64"
PyYAML
# Undeclared dependency in docker 5.0 package.
six
diff --git a/requirements.win-arm64.txt b/requirements.win-arm64.txt
new file mode 100644
index 000000000..11b05021c
--- /dev/null
+++ b/requirements.win-arm64.txt
@@ -0,0 +1,571 @@
+# This file was autogenerated by uv via the following command:
+# uv pip compile --python-platform aarch64-pc-windows-msvc --generate-hashes requirements.in -o requirements.win-arm64.txt
+attrs==25.3.0 \
+ --hash=sha256:427318ce031701fea540783410126f03899a97ffc6f61596ad581ac2e40e3bc3 \
+ --hash=sha256:75d7cefc7fb576747b2c81b4442d4d4a1ce0900973527c011d1030fd3bf4af1b
+ # via
+ # jsonschema
+ # referencing
+certifi==2025.8.3 \
+ --hash=sha256:e564105f78ded564e3ae7c923924435e1daa7463faeab5bb932bc53ffae63407 \
+ --hash=sha256:f6c12493cfb1b06ba2ff328595af9350c65d6644968e5d3a2ffd78699af217a5
+ # via requests
+charset-normalizer==3.4.3 \
+ --hash=sha256:00237675befef519d9af72169d8604a067d92755e84fe76492fef5441db05b91 \
+ --hash=sha256:02425242e96bcf29a49711b0ca9f37e451da7c70562bc10e8ed992a5a7a25cc0 \
+ --hash=sha256:027b776c26d38b7f15b26a5da1044f376455fb3766df8fc38563b4efbc515154 \
+ --hash=sha256:07a0eae9e2787b586e129fdcbe1af6997f8d0e5abaa0bc98c0e20e124d67e601 \
+ --hash=sha256:0cacf8f7297b0c4fcb74227692ca46b4a5852f8f4f24b3c766dd94a1075c4884 \
+ --hash=sha256:0e78314bdc32fa80696f72fa16dc61168fda4d6a0c014e0380f9d02f0e5d8a07 \
+ --hash=sha256:0f2be7e0cf7754b9a30eb01f4295cc3d4358a479843b31f328afd210e2c7598c \
+ --hash=sha256:13faeacfe61784e2559e690fc53fa4c5ae97c6fcedb8eb6fb8d0a15b475d2c64 \
+ --hash=sha256:14c2a87c65b351109f6abfc424cab3927b3bdece6f706e4d12faaf3d52ee5efe \
+ --hash=sha256:1606f4a55c0fd363d754049cdf400175ee96c992b1f8018b993941f221221c5f \
+ --hash=sha256:16a8770207946ac75703458e2c743631c79c59c5890c80011d536248f8eaa432 \
+ --hash=sha256:18343b2d246dc6761a249ba1fb13f9ee9a2bcd95decc767319506056ea4ad4dc \
+ --hash=sha256:18b97b8404387b96cdbd30ad660f6407799126d26a39ca65729162fd810a99aa \
+ --hash=sha256:1bb60174149316da1c35fa5233681f7c0f9f514509b8e399ab70fea5f17e45c9 \
+ --hash=sha256:1e8ac75d72fa3775e0b7cb7e4629cec13b7514d928d15ef8ea06bca03ef01cae \
+ --hash=sha256:1ef99f0456d3d46a50945c98de1774da86f8e992ab5c77865ea8b8195341fc19 \
+ --hash=sha256:2001a39612b241dae17b4687898843f254f8748b796a2e16f1051a17078d991d \
+ --hash=sha256:23b6b24d74478dc833444cbd927c338349d6ae852ba53a0d02a2de1fce45b96e \
+ --hash=sha256:252098c8c7a873e17dd696ed98bbe91dbacd571da4b87df3736768efa7a792e4 \
+ --hash=sha256:257f26fed7d7ff59921b78244f3cd93ed2af1800ff048c33f624c87475819dd7 \
+ --hash=sha256:2c322db9c8c89009a990ef07c3bcc9f011a3269bc06782f916cd3d9eed7c9312 \
+ --hash=sha256:30a96e1e1f865f78b030d65241c1ee850cdf422d869e9028e2fc1d5e4db73b92 \
+ --hash=sha256:30d006f98569de3459c2fc1f2acde170b7b2bd265dc1943e87e1a4efe1b67c31 \
+ --hash=sha256:31a9a6f775f9bcd865d88ee350f0ffb0e25936a7f930ca98995c05abf1faf21c \
+ --hash=sha256:320e8e66157cc4e247d9ddca8e21f427efc7a04bbd0ac8a9faf56583fa543f9f \
+ --hash=sha256:34a7f768e3f985abdb42841e20e17b330ad3aaf4bb7e7aeeb73db2e70f077b99 \
+ --hash=sha256:3653fad4fe3ed447a596ae8638b437f827234f01a8cd801842e43f3d0a6b281b \
+ --hash=sha256:3cd35b7e8aedeb9e34c41385fda4f73ba609e561faedfae0a9e75e44ac558a15 \
+ --hash=sha256:3cfb2aad70f2c6debfbcb717f23b7eb55febc0bb23dcffc0f076009da10c6392 \
+ --hash=sha256:416175faf02e4b0810f1f38bcb54682878a4af94059a1cd63b8747244420801f \
+ --hash=sha256:41d1fc408ff5fdfb910200ec0e74abc40387bccb3252f3f27c0676731df2b2c8 \
+ --hash=sha256:42e5088973e56e31e4fa58eb6bd709e42fc03799c11c42929592889a2e54c491 \
+ --hash=sha256:4ca4c094de7771a98d7fbd67d9e5dbf1eb73efa4f744a730437d8a3a5cf994f0 \
+ --hash=sha256:511729f456829ef86ac41ca78c63a5cb55240ed23b4b737faca0eb1abb1c41bc \
+ --hash=sha256:53cd68b185d98dde4ad8990e56a58dea83a4162161b1ea9272e5c9182ce415e0 \
+ --hash=sha256:585f3b2a80fbd26b048a0be90c5aae8f06605d3c92615911c3a2b03a8a3b796f \
+ --hash=sha256:5b413b0b1bfd94dbf4023ad6945889f374cd24e3f62de58d6bb102c4d9ae534a \
+ --hash=sha256:5d8d01eac18c423815ed4f4a2ec3b439d654e55ee4ad610e153cf02faf67ea40 \
+ --hash=sha256:6aab0f181c486f973bc7262a97f5aca3ee7e1437011ef0c2ec04b5a11d16c927 \
+ --hash=sha256:6cf8fd4c04756b6b60146d98cd8a77d0cdae0e1ca20329da2ac85eed779b6849 \
+ --hash=sha256:6fb70de56f1859a3f71261cbe41005f56a7842cc348d3aeb26237560bfa5e0ce \
+ --hash=sha256:6fce4b8500244f6fcb71465d4a4930d132ba9ab8e71a7859e6a5d59851068d14 \
+ --hash=sha256:70bfc5f2c318afece2f5838ea5e4c3febada0be750fcf4775641052bbba14d05 \
+ --hash=sha256:73dc19b562516fc9bcf6e5d6e596df0b4eb98d87e4f79f3ae71840e6ed21361c \
+ --hash=sha256:74d77e25adda8581ffc1c720f1c81ca082921329452eba58b16233ab1842141c \
+ --hash=sha256:78deba4d8f9590fe4dae384aeff04082510a709957e968753ff3c48399f6f92a \
+ --hash=sha256:86df271bf921c2ee3818f0522e9a5b8092ca2ad8b065ece5d7d9d0e9f4849bcc \
+ --hash=sha256:88ab34806dea0671532d3f82d82b85e8fc23d7b2dd12fa837978dad9bb392a34 \
+ --hash=sha256:8999f965f922ae054125286faf9f11bc6932184b93011d138925a1773830bbe9 \
+ --hash=sha256:8dcfc373f888e4fb39a7bc57e93e3b845e7f462dacc008d9749568b1c4ece096 \
+ --hash=sha256:939578d9d8fd4299220161fdd76e86c6a251987476f5243e8864a7844476ba14 \
+ --hash=sha256:96b2b3d1a83ad55310de8c7b4a2d04d9277d5591f40761274856635acc5fcb30 \
+ --hash=sha256:a2d08ac246bb48479170408d6c19f6385fa743e7157d716e144cad849b2dd94b \
+ --hash=sha256:b256ee2e749283ef3ddcff51a675ff43798d92d746d1a6e4631bf8c707d22d0b \
+ --hash=sha256:b5e3b2d152e74e100a9e9573837aba24aab611d39428ded46f4e4022ea7d1942 \
+ --hash=sha256:b89bc04de1d83006373429975f8ef9e7932534b8cc9ca582e4db7d20d91816db \
+ --hash=sha256:bd28b817ea8c70215401f657edef3a8aa83c29d447fb0b622c35403780ba11d5 \
+ --hash=sha256:c60e092517a73c632ec38e290eba714e9627abe9d301c8c8a12ec32c314a2a4b \
+ --hash=sha256:c6dbd0ccdda3a2ba7c2ecd9d77b37f3b5831687d8dc1b6ca5f56a4880cc7b7ce \
+ --hash=sha256:c6e490913a46fa054e03699c70019ab869e990270597018cef1d8562132c2669 \
+ --hash=sha256:c6f162aabe9a91a309510d74eeb6507fab5fff92337a15acbe77753d88d9dcf0 \
+ --hash=sha256:c6fd51128a41297f5409deab284fecbe5305ebd7e5a1f959bee1c054622b7018 \
+ --hash=sha256:cc34f233c9e71701040d772aa7490318673aa7164a0efe3172b2981218c26d93 \
+ --hash=sha256:cc9370a2da1ac13f0153780040f465839e6cccb4a1e44810124b4e22483c93fe \
+ --hash=sha256:ccf600859c183d70eb47e05a44cd80a4ce77394d1ac0f79dbd2dd90a69a3a049 \
+ --hash=sha256:ce571ab16d890d23b5c278547ba694193a45011ff86a9162a71307ed9f86759a \
+ --hash=sha256:cf1ebb7d78e1ad8ec2a8c4732c7be2e736f6e5123a4146c5b89c9d1f585f8cef \
+ --hash=sha256:d0e909868420b7049dafd3a31d45125b31143eec59235311fc4c57ea26a4acd2 \
+ --hash=sha256:d22dbedd33326a4a5190dd4fe9e9e693ef12160c77382d9e87919bce54f3d4ca \
+ --hash=sha256:d716a916938e03231e86e43782ca7878fb602a125a91e7acb8b5112e2e96ac16 \
+ --hash=sha256:d79c198e27580c8e958906f803e63cddb77653731be08851c7df0b1a14a8fc0f \
+ --hash=sha256:d95bfb53c211b57198bb91c46dd5a2d8018b3af446583aab40074bf7988401cb \
+ --hash=sha256:e28e334d3ff134e88989d90ba04b47d84382a828c061d0d1027b1b12a62b39b1 \
+ --hash=sha256:ec557499516fc90fd374bf2e32349a2887a876fbf162c160e3c01b6849eaf557 \
+ --hash=sha256:fb6fecfd65564f208cbf0fba07f107fb661bcd1a7c389edbced3f7a493f70e37 \
+ --hash=sha256:fb731e5deb0c7ef82d698b0f4c5bb724633ee2a489401594c5c88b02e6cb15f7 \
+ --hash=sha256:fb7f67a1bfa6e40b438170ebdc8158b78dc465a5a67b6dde178a46987b244a72 \
+ --hash=sha256:fd10de089bcdcd1be95a2f73dbe6254798ec1bda9f450d5828c96f93e2536b9c \
+ --hash=sha256:fdabf8315679312cfa71302f9bd509ded4f2f263fb5b765cf1433b39106c3cc9
+ # via requests
+docker==7.1.0 \
+ --hash=sha256:ad8c70e6e3f8926cb8a92619b832b4ea5299e2831c14284663184e200546fa6c \
+ --hash=sha256:c96b93b7f0a746f9e77d325bcfb87422a3d8bd4f03136ae8a85b37f1898d5fc0
+ # via -r requirements.in
+idna==3.10 \
+ --hash=sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9 \
+ --hash=sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3
+ # via requests
+jinja2==3.1.6 \
+ --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
+ --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
+ # via -r requirements.in
+jsonschema==4.25.0 \
+ --hash=sha256:24c2e8da302de79c8b9382fee3e76b355e44d2a4364bb207159ce10b517bd716 \
+ --hash=sha256:e63acf5c11762c0e6672ffb61482bdf57f0876684d8d249c0fe2d730d48bc55f
+ # via -r requirements.in
+jsonschema-specifications==2025.4.1 \
+ --hash=sha256:4653bffbd6584f7de83a67e0d620ef16900b390ddc7939d56684d6c81e33f1af \
+ --hash=sha256:630159c9f4dbea161a6a2205c3011cc4f18ff381b189fff48bb39b9bf26ae608
+ # via jsonschema
+markupsafe==3.0.2 \
+ --hash=sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4 \
+ --hash=sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30 \
+ --hash=sha256:1225beacc926f536dc82e45f8a4d68502949dc67eea90eab715dea3a21c1b5f0 \
+ --hash=sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9 \
+ --hash=sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396 \
+ --hash=sha256:1a9d3f5f0901fdec14d8d2f66ef7d035f2157240a433441719ac9a3fba440b13 \
+ --hash=sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028 \
+ --hash=sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca \
+ --hash=sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557 \
+ --hash=sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832 \
+ --hash=sha256:3169b1eefae027567d1ce6ee7cae382c57fe26e82775f460f0b2778beaad66c0 \
+ --hash=sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b \
+ --hash=sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579 \
+ --hash=sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a \
+ --hash=sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c \
+ --hash=sha256:48032821bbdf20f5799ff537c7ac3d1fba0ba032cfc06194faffa8cda8b560ff \
+ --hash=sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c \
+ --hash=sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22 \
+ --hash=sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094 \
+ --hash=sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb \
+ --hash=sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e \
+ --hash=sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5 \
+ --hash=sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a \
+ --hash=sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d \
+ --hash=sha256:6e296a513ca3d94054c2c881cc913116e90fd030ad1c656b3869762b754f5f8a \
+ --hash=sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b \
+ --hash=sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8 \
+ --hash=sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225 \
+ --hash=sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c \
+ --hash=sha256:88b49a3b9ff31e19998750c38e030fc7bb937398b1f78cfa599aaef92d693144 \
+ --hash=sha256:8c4e8c3ce11e1f92f6536ff07154f9d49677ebaaafc32db9db4620bc11ed480f \
+ --hash=sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87 \
+ --hash=sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d \
+ --hash=sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93 \
+ --hash=sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf \
+ --hash=sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158 \
+ --hash=sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84 \
+ --hash=sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb \
+ --hash=sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48 \
+ --hash=sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171 \
+ --hash=sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c \
+ --hash=sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6 \
+ --hash=sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd \
+ --hash=sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d \
+ --hash=sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1 \
+ --hash=sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d \
+ --hash=sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca \
+ --hash=sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a \
+ --hash=sha256:cfad01eed2c2e0c01fd0ecd2ef42c492f7f93902e39a42fc9ee1692961443a29 \
+ --hash=sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe \
+ --hash=sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798 \
+ --hash=sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c \
+ --hash=sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8 \
+ --hash=sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f \
+ --hash=sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f \
+ --hash=sha256:eaa0a10b7f72326f1372a713e73c3f739b524b3af41feb43e4921cb529f5929a \
+ --hash=sha256:eb7972a85c54febfb25b5c4b4f3af4dcc731994c7da0d8a0b4a6eb0640e1d178 \
+ --hash=sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0 \
+ --hash=sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79 \
+ --hash=sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430 \
+ --hash=sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50
+ # via jinja2
+pywin32==311 \
+ --hash=sha256:0502d1facf1fed4839a9a51ccbcc63d952cf318f78ffc00a7e78528ac27d7a2b \
+ --hash=sha256:184eb5e436dea364dcd3d2316d577d625c0351bf237c4e9a5fabbcfa5a58b151 \
+ --hash=sha256:3aca44c046bd2ed8c90de9cb8427f581c479e594e99b5c0bb19b29c10fd6cb87 \
+ --hash=sha256:3ce80b34b22b17ccbd937a6e78e7225d80c52f5ab9940fe0506a1a16f3dab503 \
+ --hash=sha256:62ea666235135fee79bb154e695f3ff67370afefd71bd7fea7512fc70ef31e3d \
+ --hash=sha256:6c6f2969607b5023b0d9ce2541f8d2cbb01c4f46bc87456017cf63b73f1e2d8c \
+ --hash=sha256:718a38f7e5b058e76aee1c56ddd06908116d35147e133427e59a3983f703a20d \
+ --hash=sha256:750ec6e621af2b948540032557b10a2d43b0cee2ae9758c54154d711cc852d31 \
+ --hash=sha256:797c2772017851984b97180b0bebe4b620bb86328e8a884bb626156295a63b3b \
+ --hash=sha256:7b4075d959648406202d92a2310cb990fea19b535c7f4a78d3f5e10b926eeb8a \
+ --hash=sha256:a508e2d9025764a8270f93111a970e1d0fbfc33f4153b388bb649b7eec4f9b42 \
+ --hash=sha256:a733f1388e1a842abb67ffa8e7aad0e70ac519e09b0f6a784e65a136ec7cefd2 \
+ --hash=sha256:aba8f82d551a942cb20d4a83413ccbac30790b50efb89a75e4f586ac0bb8056b \
+ --hash=sha256:b7a2c10b93f8986666d0c803ee19b5990885872a7de910fc460f9b0c2fbf92ee \
+ --hash=sha256:b8c095edad5c211ff31c05223658e71bf7116daa0ecf3ad85f3201ea3190d067 \
+ --hash=sha256:c8015b09fb9a5e188f83b7b04de91ddca4658cee2ae6f3bc483f0b21a77ef6cd \
+ --hash=sha256:d03ff496d2a0cd4a5893504789d4a15399133fe82517455e78bad62efbb7f0a3 \
+ --hash=sha256:e0c4cfb0621281fe40387df582097fd796e80430597cb9944f0ae70447bacd91 \
+ --hash=sha256:e286f46a9a39c4a18b319c28f59b61de793654af2f395c102b4f819e584b5852 \
+ --hash=sha256:f95ba5a847cba10dd8c4d8fefa9f2a6cf283b8b88ed6178fa8a6c1ab16054d0d
+ # via docker
+pyyaml==6.0.2 \
+ --hash=sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff \
+ --hash=sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48 \
+ --hash=sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086 \
+ --hash=sha256:0b69e4ce7a131fe56b7e4d770c67429700908fc0752af059838b1cfb41960e4e \
+ --hash=sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133 \
+ --hash=sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5 \
+ --hash=sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484 \
+ --hash=sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee \
+ --hash=sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5 \
+ --hash=sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68 \
+ --hash=sha256:24471b829b3bf607e04e88d79542a9d48bb037c2267d7927a874e6c205ca7e9a \
+ --hash=sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf \
+ --hash=sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99 \
+ --hash=sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8 \
+ --hash=sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85 \
+ --hash=sha256:3b1fdb9dc17f5a7677423d508ab4f243a726dea51fa5e70992e59a7411c89d19 \
+ --hash=sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc \
+ --hash=sha256:43fa96a3ca0d6b1812e01ced1044a003533c47f6ee8aca31724f78e93ccc089a \
+ --hash=sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1 \
+ --hash=sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317 \
+ --hash=sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c \
+ --hash=sha256:6395c297d42274772abc367baaa79683958044e5d3835486c16da75d2a694631 \
+ --hash=sha256:688ba32a1cffef67fd2e9398a2efebaea461578b0923624778664cc1c914db5d \
+ --hash=sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652 \
+ --hash=sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5 \
+ --hash=sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e \
+ --hash=sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b \
+ --hash=sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8 \
+ --hash=sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476 \
+ --hash=sha256:82d09873e40955485746739bcb8b4586983670466c23382c19cffecbf1fd8706 \
+ --hash=sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563 \
+ --hash=sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237 \
+ --hash=sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b \
+ --hash=sha256:9056c1ecd25795207ad294bcf39f2db3d845767be0ea6e6a34d856f006006083 \
+ --hash=sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180 \
+ --hash=sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425 \
+ --hash=sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e \
+ --hash=sha256:a8786accb172bd8afb8be14490a16625cbc387036876ab6ba70912730faf8e1f \
+ --hash=sha256:a9f8c2e67970f13b16084e04f134610fd1d374bf477b17ec1599185cf611d725 \
+ --hash=sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183 \
+ --hash=sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab \
+ --hash=sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774 \
+ --hash=sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725 \
+ --hash=sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e \
+ --hash=sha256:d7fded462629cfa4b685c5416b949ebad6cec74af5e2d42905d41e257e0869f5 \
+ --hash=sha256:d84a1718ee396f54f3a086ea0a66d8e552b2ab2017ef8b420e92edbc841c352d \
+ --hash=sha256:d8e03406cac8513435335dbab54c0d385e4a49e4945d2909a581c83647ca0290 \
+ --hash=sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44 \
+ --hash=sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed \
+ --hash=sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4 \
+ --hash=sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba \
+ --hash=sha256:f753120cb8181e736c57ef7636e83f31b9c0d1722c516f7e86cf15b7aa57ff12 \
+ --hash=sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4
+ # via -r requirements.in
+referencing==0.36.2 \
+ --hash=sha256:df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa \
+ --hash=sha256:e8699adbbf8b5c7de96d8ffa0eb5c158b3beafce084968e2ea8bb08c6794dcd0
+ # via
+ # jsonschema
+ # jsonschema-specifications
+requests==2.32.4 \
+ --hash=sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c \
+ --hash=sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422
+ # via docker
+rpds-py==0.27.0 \
+ --hash=sha256:010c4843a3b92b54373e3d2291a7447d6c3fc29f591772cc2ea0e9f5c1da434b \
+ --hash=sha256:05284439ebe7d9f5f5a668d4d8a0a1d851d16f7d47c78e1fab968c8ad30cab04 \
+ --hash=sha256:0665be515767dc727ffa5f74bd2ef60b0ff85dad6bb8f50d91eaa6b5fb226f51 \
+ --hash=sha256:069e0384a54f427bd65d7fda83b68a90606a3835901aaff42185fcd94f5a9295 \
+ --hash=sha256:08680820d23df1df0a0260f714d12966bc6c42d02e8055a91d61e03f0c47dda0 \
+ --hash=sha256:0954e3a92e1d62e83a54ea7b3fdc9efa5d61acef8488a8a3d31fdafbfb00460d \
+ --hash=sha256:09965b314091829b378b60607022048953e25f0b396c2b70e7c4c81bcecf932e \
+ --hash=sha256:0c431bfb91478d7cbe368d0a699978050d3b112d7f1d440a41e90faa325557fd \
+ --hash=sha256:0f401c369186a5743694dd9fc08cba66cf70908757552e1f714bfc5219c655b5 \
+ --hash=sha256:0f4f69d7a4300fbf91efb1fb4916421bd57804c01ab938ab50ac9c4aa2212f03 \
+ --hash=sha256:11e8e28c0ba0373d052818b600474cfee2fafa6c9f36c8587d217b13ee28ca7d \
+ --hash=sha256:130c1ffa5039a333f5926b09e346ab335f0d4ec393b030a18549a7c7e7c2cea4 \
+ --hash=sha256:1321bce595ad70e80f97f998db37356b2e22cf98094eba6fe91782e626da2f71 \
+ --hash=sha256:13bbc4846ae4c993f07c93feb21a24d8ec637573d567a924b1001e81c8ae80f9 \
+ --hash=sha256:14f028eb47f59e9169bfdf9f7ceafd29dd64902141840633683d0bad5b04ff34 \
+ --hash=sha256:15ea4d2e182345dd1b4286593601d766411b43f868924afe297570658c31a62b \
+ --hash=sha256:181bc29e59e5e5e6e9d63b143ff4d5191224d355e246b5a48c88ce6b35c4e466 \
+ --hash=sha256:183f5e221ba3e283cd36fdfbe311d95cd87699a083330b4f792543987167eff1 \
+ --hash=sha256:184f0d7b342967f6cda94a07d0e1fae177d11d0b8f17d73e06e36ac02889f303 \
+ --hash=sha256:190d7285cd3bb6d31d37a0534d7359c1ee191eb194c511c301f32a4afa5a1dd4 \
+ --hash=sha256:19c990fdf5acecbf0623e906ae2e09ce1c58947197f9bced6bbd7482662231c4 \
+ --hash=sha256:1d66f45b9399036e890fb9c04e9f70c33857fd8f58ac8db9f3278cfa835440c3 \
+ --hash=sha256:203f581accef67300a942e49a37d74c12ceeef4514874c7cede21b012613ca2c \
+ --hash=sha256:20e222a44ae9f507d0f2678ee3dd0c45ec1e930f6875d99b8459631c24058aec \
+ --hash=sha256:2406d034635d1497c596c40c85f86ecf2bf9611c1df73d14078af8444fe48031 \
+ --hash=sha256:249ab91ceaa6b41abc5f19513cb95b45c6f956f6b89f1fe3d99c81255a849f9e \
+ --hash=sha256:25a4aebf8ca02bbb90a9b3e7a463bbf3bee02ab1c446840ca07b1695a68ce424 \
+ --hash=sha256:27bac29bbbf39601b2aab474daf99dbc8e7176ca3389237a23944b17f8913d97 \
+ --hash=sha256:299a245537e697f28a7511d01038c310ac74e8ea213c0019e1fc65f52c0dcb23 \
+ --hash=sha256:2cff9bdd6c7b906cc562a505c04a57d92e82d37200027e8d362518df427f96cd \
+ --hash=sha256:2e307cb5f66c59ede95c00e93cd84190a5b7f3533d7953690b2036780622ba81 \
+ --hash=sha256:2e39169ac6aae06dd79c07c8a69d9da867cef6a6d7883a0186b46bb46ccfb0c3 \
+ --hash=sha256:2fe6e18e5c8581f0361b35ae575043c7029d0a92cb3429e6e596c2cdde251432 \
+ --hash=sha256:3001013dae10f806380ba739d40dee11db1ecb91684febb8406a87c2ded23dae \
+ --hash=sha256:32196b5a99821476537b3f7732432d64d93a58d680a52c5e12a190ee0135d8b5 \
+ --hash=sha256:33ba649a6e55ae3808e4c39e01580dc9a9b0d5b02e77b66bb86ef117922b1264 \
+ --hash=sha256:341d8acb6724c0c17bdf714319c393bb27f6d23d39bc74f94221b3e59fc31828 \
+ --hash=sha256:343cf24de9ed6c728abefc5d5c851d5de06497caa7ac37e5e65dd572921ed1b5 \
+ --hash=sha256:36184b44bf60a480863e51021c26aca3dfe8dd2f5eeabb33622b132b9d8b8b54 \
+ --hash=sha256:3841f66c1ffdc6cebce8aed64e36db71466f1dc23c0d9a5592e2a782a3042c79 \
+ --hash=sha256:4045e2fc4b37ec4b48e8907a5819bdd3380708c139d7cc358f03a3653abedb89 \
+ --hash=sha256:419dd9c98bcc9fb0242be89e0c6e922df333b975d4268faa90d58499fd9c9ebe \
+ --hash=sha256:42894616da0fc0dcb2ec08a77896c3f56e9cb2f4b66acd76fc8992c3557ceb1c \
+ --hash=sha256:42ccc57ff99166a55a59d8c7d14f1a357b7749f9ed3584df74053fd098243451 \
+ --hash=sha256:4300e15e7d03660f04be84a125d1bdd0e6b2f674bc0723bc0fd0122f1a4585dc \
+ --hash=sha256:443d239d02d9ae55b74015234f2cd8eb09e59fbba30bf60baeb3123ad4c6d5ff \
+ --hash=sha256:44524b96481a4c9b8e6c46d6afe43fa1fb485c261e359fbe32b63ff60e3884d8 \
+ --hash=sha256:45d04a73c54b6a5fd2bab91a4b5bc8b426949586e61340e212a8484919183859 \
+ --hash=sha256:46f48482c1a4748ab2773f75fffbdd1951eb59794e32788834b945da857c47a8 \
+ --hash=sha256:4790c9d5dd565ddb3e9f656092f57268951398cef52e364c405ed3112dc7c7c1 \
+ --hash=sha256:4bc262ace5a1a7dc3e2eac2fa97b8257ae795389f688b5adf22c5db1e2431c43 \
+ --hash=sha256:4c3f8a0d4802df34fcdbeb3dfe3a4d8c9a530baea8fafdf80816fcaac5379d83 \
+ --hash=sha256:5355527adaa713ab693cbce7c1e0ec71682f599f61b128cf19d07e5c13c9b1f1 \
+ --hash=sha256:555ed147cbe8c8f76e72a4c6cd3b7b761cbf9987891b9448808148204aed74a5 \
+ --hash=sha256:55d42a0ef2bdf6bc81e1cc2d49d12460f63c6ae1423c4f4851b828e454ccf6f1 \
+ --hash=sha256:59195dc244fc183209cf8a93406889cadde47dfd2f0a6b137783aa9c56d67c85 \
+ --hash=sha256:59714ab0a5af25d723d8e9816638faf7f4254234decb7d212715c1aa71eee7be \
+ --hash=sha256:5b3a5c8089eed498a3af23ce87a80805ff98f6ef8f7bdb70bd1b7dae5105f6ac \
+ --hash=sha256:5d6790ff400254137b81b8053b34417e2c46921e302d655181d55ea46df58cf7 \
+ --hash=sha256:5df559e9e7644d9042f626f2c3997b555f347d7a855a15f170b253f6c5bfe358 \
+ --hash=sha256:5fa01b3d5e3b7d97efab65bd3d88f164e289ec323a8c033c5c38e53ee25c007e \
+ --hash=sha256:61490d57e82e23b45c66f96184237994bfafa914433b8cd1a9bb57fecfced59d \
+ --hash=sha256:6168af0be75bba990a39f9431cdfae5f0ad501f4af32ae62e8856307200517b8 \
+ --hash=sha256:64a0fe3f334a40b989812de70160de6b0ec7e3c9e4a04c0bbc48d97c5d3600ae \
+ --hash=sha256:64f689ab822f9b5eb6dfc69893b4b9366db1d2420f7db1f6a2adf2a9ca15ad64 \
+ --hash=sha256:699c346abc73993962cac7bb4f02f58e438840fa5458a048d3a178a7a670ba86 \
+ --hash=sha256:6b96b0b784fe5fd03beffff2b1533dc0d85e92bab8d1b2c24ef3a5dc8fac5669 \
+ --hash=sha256:6bde37765564cd22a676dd8101b657839a1854cfaa9c382c5abf6ff7accfd4ae \
+ --hash=sha256:6c135708e987f46053e0a1246a206f53717f9fadfba27174a9769ad4befba5c3 \
+ --hash=sha256:6c27a7054b5224710fcfb1a626ec3ff4f28bcb89b899148c72873b18210e446b \
+ --hash=sha256:6de6a7f622860af0146cb9ee148682ff4d0cea0b8fd3ad51ce4d40efb2f061d0 \
+ --hash=sha256:737005088449ddd3b3df5a95476ee1c2c5c669f5c30eed909548a92939c0e12d \
+ --hash=sha256:7451ede3560086abe1aa27dcdcf55cd15c96b56f543fb12e5826eee6f721f858 \
+ --hash=sha256:7873b65686a6471c0037139aa000d23fe94628e0daaa27b6e40607c90e3f5ec4 \
+ --hash=sha256:79af163a4b40bbd8cfd7ca86ec8b54b81121d3b213b4435ea27d6568bcba3e9d \
+ --hash=sha256:7aed8118ae20515974650d08eb724150dc2e20c2814bcc307089569995e88a14 \
+ --hash=sha256:7cf9bc4508efb18d8dff6934b602324eb9f8c6644749627ce001d6f38a490889 \
+ --hash=sha256:7e57906e38583a2cba67046a09c2637e23297618dc1f3caddbc493f2be97c93f \
+ --hash=sha256:7ec85994f96a58cf7ed288caa344b7fe31fd1d503bdf13d7331ead5f70ab60d5 \
+ --hash=sha256:81f81bbd7cdb4bdc418c09a73809abeda8f263a6bf8f9c7f93ed98b5597af39d \
+ --hash=sha256:86aca1616922b40d8ac1b3073a1ead4255a2f13405e5700c01f7c8d29a03972d \
+ --hash=sha256:88051c3b7d5325409f433c5a40328fcb0685fc04e5db49ff936e910901d10114 \
+ --hash=sha256:887ab1f12b0d227e9260558a4a2320024b20102207ada65c43e1ffc4546df72e \
+ --hash=sha256:8a06aa1197ec0281eb1d7daf6073e199eb832fe591ffa329b88bae28f25f5fe5 \
+ --hash=sha256:8a1dca5507fa1337f75dcd5070218b20bc68cf8844271c923c1b79dfcbc20391 \
+ --hash=sha256:8b23cf252f180cda89220b378d917180f29d313cd6a07b2431c0d3b776aae86f \
+ --hash=sha256:8d0e09cf4863c74106b5265c2c310f36146e2b445ff7b3018a56799f28f39f6f \
+ --hash=sha256:8de567dec6d451649a781633d36f5c7501711adee329d76c095be2178855b042 \
+ --hash=sha256:90fb790138c1a89a2e58c9282fe1089638401f2f3b8dddd758499041bc6e0774 \
+ --hash=sha256:92f3b3ec3e6008a1fe00b7c0946a170f161ac00645cde35e3c9a68c2475e8156 \
+ --hash=sha256:935afcdea4751b0ac918047a2df3f720212892347767aea28f5b3bf7be4f27c0 \
+ --hash=sha256:9a0ff7ee28583ab30a52f371b40f54e7138c52ca67f8ca17ccb7ccf0b383cb5f \
+ --hash=sha256:9ad08547995a57e74fea6abaf5940d399447935faebbd2612b3b0ca6f987946b \
+ --hash=sha256:9b2a4e17bfd68536c3b801800941c95a1d4a06e3cada11c146093ba939d9638d \
+ --hash=sha256:9b78430703cfcf5f5e86eb74027a1ed03a93509273d7c705babb547f03e60016 \
+ --hash=sha256:9d0f92b78cfc3b74a42239fdd8c1266f4715b573204c234d2f9fc3fc7a24f185 \
+ --hash=sha256:9da162b718b12c4219eeeeb68a5b7552fbc7aadedf2efee440f88b9c0e54b45d \
+ --hash=sha256:a00c91104c173c9043bc46f7b30ee5e6d2f6b1149f11f545580f5d6fdff42c0b \
+ --hash=sha256:a029be818059870664157194e46ce0e995082ac49926f1423c1f058534d2aaa9 \
+ --hash=sha256:a1b3db5fae5cbce2131b7420a3f83553d4d89514c03d67804ced36161fe8b6b2 \
+ --hash=sha256:a4cf32a26fa744101b67bfd28c55d992cd19438aff611a46cac7f066afca8fd4 \
+ --hash=sha256:aa0bf113d15e8abdfee92aa4db86761b709a09954083afcb5bf0f952d6065fdb \
+ --hash=sha256:ab47fe727c13c09d0e6f508e3a49e545008e23bf762a245b020391b621f5b726 \
+ --hash=sha256:af22763a0a1eff106426a6e1f13c4582e0d0ad89c1493ab6c058236174cd6c6a \
+ --hash=sha256:af9d4fd79ee1cc8e7caf693ee02737daabfc0fcf2773ca0a4735b356c8ad6f7c \
+ --hash=sha256:b1fef1f13c842a39a03409e30ca0bf87b39a1e2a305a9924deadb75a43105d23 \
+ --hash=sha256:b2eff8ee57c5996b0d2a07c3601fb4ce5fbc37547344a26945dd9e5cbd1ed27a \
+ --hash=sha256:b4c4fbbcff474e1e5f38be1bf04511c03d492d42eec0babda5d03af3b5589374 \
+ --hash=sha256:b8a4131698b6992b2a56015f51646711ec5d893a0b314a4b985477868e240c87 \
+ --hash=sha256:b8a7acf04fda1f30f1007f3cc96d29d8cf0a53e626e4e1655fdf4eabc082d367 \
+ --hash=sha256:ba783541be46f27c8faea5a6645e193943c17ea2f0ffe593639d906a327a9bcc \
+ --hash=sha256:be0744661afbc4099fef7f4e604e7f1ea1be1dd7284f357924af12a705cc7d5c \
+ --hash=sha256:be3964f7312ea05ed283b20f87cb533fdc555b2e428cc7be64612c0b2124f08c \
+ --hash=sha256:be806e2961cd390a89d6c3ce8c2ae34271cfcd05660f716257838bb560f1c3b6 \
+ --hash=sha256:bec77545d188f8bdd29d42bccb9191682a46fb2e655e3d1fb446d47c55ac3b8d \
+ --hash=sha256:c10d92fb6d7fd827e44055fcd932ad93dac6a11e832d51534d77b97d1d85400f \
+ --hash=sha256:c3782fb753aa825b4ccabc04292e07897e2fd941448eabf666856c5530277626 \
+ --hash=sha256:c9ce7a9e967afc0a2af7caa0d15a3e9c1054815f73d6a8cb9225b61921b419bd \
+ --hash=sha256:cb0702c12983be3b2fab98ead349ac63a98216d28dda6f518f52da5498a27a1b \
+ --hash=sha256:cbc619e84a5e3ab2d452de831c88bdcad824414e9c2d28cd101f94dbdf26329c \
+ --hash=sha256:ce4ed8e0c7dbc5b19352b9c2c6131dd23b95fa8698b5cdd076307a33626b72dc \
+ --hash=sha256:ce96ab0bdfcef1b8c371ada2100767ace6804ea35aacce0aef3aeb4f3f499ca8 \
+ --hash=sha256:cf824aceaeffff029ccfba0da637d432ca71ab21f13e7f6f5179cd88ebc77a8a \
+ --hash=sha256:d2a81bdcfde4245468f7030a75a37d50400ac2455c3a4819d9d550c937f90ab5 \
+ --hash=sha256:d2cc2b34f9e1d31ce255174da82902ad75bd7c0d88a33df54a77a22f2ef421ee \
+ --hash=sha256:d2f184336bc1d6abfaaa1262ed42739c3789b1e3a65a29916a615307d22ffd2e \
+ --hash=sha256:d3c622c39f04d5751408f5b801ecb527e6e0a471b367f420a877f7a660d583f6 \
+ --hash=sha256:d7cf5e726b6fa977e428a61880fb108a62f28b6d0c7ef675b117eaff7076df49 \
+ --hash=sha256:d85d784c619370d9329bbd670f41ff5f2ae62ea4519761b679d0f57f0f0ee267 \
+ --hash=sha256:d93ebdb82363d2e7bec64eecdc3632b59e84bd270d74fe5be1659f7787052f9b \
+ --hash=sha256:db8a6313dbac934193fc17fe7610f70cd8181c542a91382531bef5ed785e5615 \
+ --hash=sha256:dbc2ab5d10544eb485baa76c63c501303b716a5c405ff2469a1d8ceffaabf622 \
+ --hash=sha256:dbd749cff1defbde270ca346b69b3baf5f1297213ef322254bf2a28537f0b046 \
+ --hash=sha256:dc662bc9375a6a394b62dfd331874c434819f10ee3902123200dbcf116963f89 \
+ --hash=sha256:dc6b0d5a1ea0318ef2def2b6a55dccf1dcaf77d605672347271ed7b829860765 \
+ --hash=sha256:dc79d192fb76fc0c84f2c58672c17bbbc383fd26c3cdc29daae16ce3d927e8b2 \
+ --hash=sha256:dd2c1d27ebfe6a015cfa2005b7fe8c52d5019f7bbdd801bc6f7499aab9ae739e \
+ --hash=sha256:dea0808153f1fbbad772669d906cddd92100277533a03845de6893cadeffc8be \
+ --hash=sha256:e0d7151a1bd5d0a203a5008fc4ae51a159a610cb82ab0a9b2c4d80241745582e \
+ --hash=sha256:e14aab02258cb776a108107bd15f5b5e4a1bbaa61ef33b36693dfab6f89d54f9 \
+ --hash=sha256:e24d8031a2c62f34853756d9208eeafa6b940a1efcbfe36e8f57d99d52bb7261 \
+ --hash=sha256:e36c80c49853b3ffda7aa1831bf175c13356b210c73128c861f3aa93c3cc4015 \
+ --hash=sha256:e377e4cf8795cdbdff75b8f0223d7b6c68ff4fef36799d88ccf3a995a91c0112 \
+ --hash=sha256:e3acb9c16530362aeaef4e84d57db357002dc5cbfac9a23414c3e73c08301ab2 \
+ --hash=sha256:e3dc8d4ede2dbae6c0fc2b6c958bf51ce9fd7e9b40c0f5b8835c3fde44f5807d \
+ --hash=sha256:e6491658dd2569f05860bad645569145c8626ac231877b0fb2d5f9bcb7054089 \
+ --hash=sha256:eb91d252b35004a84670dfeafadb042528b19842a0080d8b53e5ec1128e8f433 \
+ --hash=sha256:f0396e894bd1e66c74ecbc08b4f6a03dc331140942c4b1d345dd131b68574a60 \
+ --hash=sha256:f09c9d4c26fa79c1bad927efb05aca2391350b8e61c38cbc0d7d3c814e463124 \
+ --hash=sha256:f3cd110e02c5bf17d8fb562f6c9df5c20e73029d587cf8602a2da6c5ef1e32cb \
+ --hash=sha256:f7a37dd208f0d658e0487522078b1ed68cd6bce20ef4b5a915d2809b9094b410 \
+ --hash=sha256:fae4a01ef8c4cb2bbe92ef2063149596907dc4a881a8d26743b3f6b304713171 \
+ --hash=sha256:fc327f4497b7087d06204235199daf208fd01c82d80465dc5efa4ec9df1c5b4e \
+ --hash=sha256:fcc01c57ce6e70b728af02b2401c5bc853a9e14eb07deda30624374f0aebfe42 \
+ --hash=sha256:fde355b02934cc6b07200cc3b27ab0c15870a757d1a72fd401aa92e2ea3c6bfe
+ # via
+ # jsonschema
+ # referencing
+six==1.17.0 \
+ --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
+ --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
+ # via -r requirements.in
+tomli==2.2.1 \
+ --hash=sha256:023aa114dd824ade0100497eb2318602af309e5a55595f76b626d6d9f3b7b0a6 \
+ --hash=sha256:02abe224de6ae62c19f090f68da4e27b10af2b93213d36cf44e6e1c5abd19fdd \
+ --hash=sha256:286f0ca2ffeeb5b9bd4fcc8d6c330534323ec51b2f52da063b11c502da16f30c \
+ --hash=sha256:2d0f2fdd22b02c6d81637a3c95f8cd77f995846af7414c5c4b8d0545afa1bc4b \
+ --hash=sha256:33580bccab0338d00994d7f16f4c4ec25b776af3ffaac1ed74e0b3fc95e885a8 \
+ --hash=sha256:400e720fe168c0f8521520190686ef8ef033fb19fc493da09779e592861b78c6 \
+ --hash=sha256:40741994320b232529c802f8bc86da4e1aa9f413db394617b9a256ae0f9a7f77 \
+ --hash=sha256:465af0e0875402f1d226519c9904f37254b3045fc5084697cefb9bdde1ff99ff \
+ --hash=sha256:4a8f6e44de52d5e6c657c9fe83b562f5f4256d8ebbfe4ff922c495620a7f6cea \
+ --hash=sha256:4e340144ad7ae1533cb897d406382b4b6fede8890a03738ff1683af800d54192 \
+ --hash=sha256:678e4fa69e4575eb77d103de3df8a895e1591b48e740211bd1067378c69e8249 \
+ --hash=sha256:6972ca9c9cc9f0acaa56a8ca1ff51e7af152a9f87fb64623e31d5c83700080ee \
+ --hash=sha256:7fc04e92e1d624a4a63c76474610238576942d6b8950a2d7f908a340494e67e4 \
+ --hash=sha256:889f80ef92701b9dbb224e49ec87c645ce5df3fa2cc548664eb8a25e03127a98 \
+ --hash=sha256:8d57ca8095a641b8237d5b079147646153d22552f1c637fd3ba7f4b0b29167a8 \
+ --hash=sha256:8dd28b3e155b80f4d54beb40a441d366adcfe740969820caf156c019fb5c7ec4 \
+ --hash=sha256:9316dc65bed1684c9a98ee68759ceaed29d229e985297003e494aa825ebb0281 \
+ --hash=sha256:a198f10c4d1b1375d7687bc25294306e551bf1abfa4eace6650070a5c1ae2744 \
+ --hash=sha256:a38aa0308e754b0e3c67e344754dff64999ff9b513e691d0e786265c93583c69 \
+ --hash=sha256:a92ef1a44547e894e2a17d24e7557a5e85a9e1d0048b0b5e7541f76c5032cb13 \
+ --hash=sha256:ac065718db92ca818f8d6141b5f66369833d4a80a9d74435a268c52bdfa73140 \
+ --hash=sha256:b82ebccc8c8a36f2094e969560a1b836758481f3dc360ce9a3277c65f374285e \
+ --hash=sha256:c954d2250168d28797dd4e3ac5cf812a406cd5a92674ee4c8f123c889786aa8e \
+ --hash=sha256:cb55c73c5f4408779d0cf3eef9f762b9c9f147a77de7b258bef0a5628adc85cc \
+ --hash=sha256:cd45e1dc79c835ce60f7404ec8119f2eb06d38b1deba146f07ced3bbc44505ff \
+ --hash=sha256:d3f5614314d758649ab2ab3a62d4f2004c825922f9e370b29416484086b264ec \
+ --hash=sha256:d920f33822747519673ee656a4b6ac33e382eca9d331c87770faa3eef562aeb2 \
+ --hash=sha256:db2b95f9de79181805df90bedc5a5ab4c165e6ec3fe99f970d0e302f384ad222 \
+ --hash=sha256:e59e304978767a54663af13c07b3d1af22ddee3bb2fb0618ca1593e4f593a106 \
+ --hash=sha256:e85e99945e688e32d5a35c1ff38ed0b3f41f43fad8df0bdf79f72b2ba7bc5272 \
+ --hash=sha256:ece47d672db52ac607a3d9599a9d48dcb2f2f735c6c2d1f34130085bb12b112a \
+ --hash=sha256:f4039b9cbc3048b2416cc57ab3bda989a6fcf9b36cf8937f01a6e731b64f80d7
+ # via -r requirements.in
+typing-extensions==4.14.1 \
+ --hash=sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36 \
+ --hash=sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76
+ # via -r requirements.in
+urllib3==2.5.0 \
+ --hash=sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760 \
+ --hash=sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc
+ # via
+ # docker
+ # requests
+zstandard==0.24.0 \
+ --hash=sha256:0101f835da7de08375f380192ff75135527e46e3f79bef224e3c49cb640fef6a \
+ --hash=sha256:010302face38c9a909b8934e3bf6038266d6afc69523f3efa023c5cb5d38271b \
+ --hash=sha256:05d27c953f2e0a3ecc8edbe91d6827736acc4c04d0479672e0400ccdb23d818c \
+ --hash=sha256:09887301001e7a81a3618156bc1759e48588de24bddfdd5b7a4364da9a8fbc20 \
+ --hash=sha256:0a416814608610abf5488889c74e43ffa0343ca6cf43957c6b6ec526212422da \
+ --hash=sha256:0a9e95ceb180ccd12a8b3437bac7e8a8a089c9094e39522900a8917745542184 \
+ --hash=sha256:0c9c3cba57f5792532a3df3f895980d47d78eda94b0e5b800651b53e96e0b604 \
+ --hash=sha256:0d66da2649bb0af4471699aeb7a83d6f59ae30236fb9f6b5d20fb618ef6c6777 \
+ --hash=sha256:0dc5654586613aebe5405c1ba180e67b3f29e7d98cf3187c79efdcc172f39457 \
+ --hash=sha256:0ed8345b504df1cab280af923ef69ec0d7d52f7b22f78ec7982fde7c33a43c4f \
+ --hash=sha256:0f6d9a146e07458cb41423ca2d783aefe3a3a97fe72838973c13b8f1ecc7343a \
+ --hash=sha256:10e284748a7e7fbe2815ca62a9d6e84497d34cfdd0143fa9e8e208efa808d7c4 \
+ --hash=sha256:13fc548e214df08d896ee5f29e1f91ee35db14f733fef8eabea8dca6e451d1e2 \
+ --hash=sha256:1b14bc92af065d0534856bf1b30fc48753163ea673da98857ea4932be62079b1 \
+ --hash=sha256:1bda8a85e5b9d5e73af2e61b23609a8cc1598c1b3b2473969912979205a1ff25 \
+ --hash=sha256:1e133a9dd51ac0bcd5fd547ba7da45a58346dbc63def883f999857b0d0c003c4 \
+ --hash=sha256:1f578fab202f4df67a955145c3e3ca60ccaaaf66c97808545b2625efeecdef10 \
+ --hash=sha256:27b6fa72b57824a3f7901fc9cc4ce1c1c834b28f3a43d1d4254c64c8f11149d4 \
+ --hash=sha256:2825a3951f945fb2613ded0f517d402b1e5a68e87e0ee65f5bd224a8333a9a46 \
+ --hash=sha256:2fc67eb15ed573950bc6436a04b3faea6c36c7db98d2db030d48391c6736a0dc \
+ --hash=sha256:337572a7340e1d92fd7fb5248c8300d0e91071002d92e0b8cabe8d9ae7b58159 \
+ --hash=sha256:35f13501a8accf834457d8e40e744568287a215818778bc4d79337af2f3f0d97 \
+ --hash=sha256:388aad2d693707f4a0f6cc687eb457b33303d6b57ecf212c8ff4468c34426892 \
+ --hash=sha256:3aa3b4344b206941385a425ea25e6dd63e5cb0f535a4b88d56e3f8902086be9e \
+ --hash=sha256:3adb4b5414febf074800d264ddf69ecade8c658837a83a19e8ab820e924c9933 \
+ --hash=sha256:3b95fc06489aa9388400d1aab01a83652bc040c9c087bd732eb214909d7fb0dd \
+ --hash=sha256:3f2fe35ec84908dddf0fbf66b35d7c2878dbe349552dd52e005c755d3493d61c \
+ --hash=sha256:3f96a9130171e01dbb6c3d4d9925d604e2131a97f540e223b88ba45daf56d6fb \
+ --hash=sha256:444633b487a711e34f4bccc46a0c5dfbe1aee82c1a511e58cdc16f6bd66f187c \
+ --hash=sha256:498f88f5109666c19531f0243a90d2fdd2252839cd6c8cc6e9213a3446670fa8 \
+ --hash=sha256:51a86bd963de3f36688553926a84e550d45d7f9745bd1947d79472eca27fcc75 \
+ --hash=sha256:52788e7c489069e317fde641de41b757fa0ddc150e06488f153dd5daebac7192 \
+ --hash=sha256:52cd7d9fa0a115c9446abb79b06a47171b7d916c35c10e0c3aa6f01d57561382 \
+ --hash=sha256:55872e818598319f065e8192ebefecd6ac05f62a43f055ed71884b0a26218f41 \
+ --hash=sha256:561123d05681197c0e24eb8ab3cfdaf299e2b59c293d19dad96e1610ccd8fbc6 \
+ --hash=sha256:57be3abb4313e0dd625596376bbb607f40059d801d51c1a1da94d7477e63b255 \
+ --hash=sha256:5e941654cef13a1d53634ec30933722eda11f44f99e1d0bc62bbce3387580d50 \
+ --hash=sha256:622e1e04bd8a085994e02313ba06fbcf4f9ed9a488c6a77a8dbc0692abab6a38 \
+ --hash=sha256:6324fde5cf5120fbf6541d5ff3c86011ec056e8d0f915d8e7822926a5377193a \
+ --hash=sha256:6374feaf347e6b83ec13cc5dcfa70076f06d8f7ecd46cc71d58fac798ff08b76 \
+ --hash=sha256:63d39b161000aeeaa06a1cb77c9806e939bfe460dfd593e4cbf24e6bc717ae94 \
+ --hash=sha256:656ed895b28c7e42dd5b40dfcea3217cfc166b6b7eef88c3da2f5fc62484035b \
+ --hash=sha256:663848a8bac4fdbba27feea2926049fdf7b55ec545d5b9aea096ef21e7f0b079 \
+ --hash=sha256:6885ae4b33aee8835dbdb4249d3dfec09af55e705d74d9b660bfb9da51baaa8b \
+ --hash=sha256:6b005bcee4be9c3984b355336283afe77b2defa76ed6b89332eced7b6fa68b68 \
+ --hash=sha256:76cdfe7f920738ea871f035568f82bad3328cbc8d98f1f6988264096b5264efd \
+ --hash=sha256:77b8b7b98893eaf47da03d262816f01f251c2aa059c063ed8a45c50eada123a5 \
+ --hash=sha256:7ac6e4d727521d86d20ec291a3f4e64a478e8a73eaee80af8f38ec403e77a409 \
+ --hash=sha256:7de5869e616d426b56809be7dc6dba4d37b95b90411ccd3de47f421a42d4d42c \
+ --hash=sha256:869bf13f66b124b13be37dd6e08e4b728948ff9735308694e0b0479119e08ea7 \
+ --hash=sha256:87ae1684bc3c02d5c35884b3726525eda85307073dbefe68c3c779e104a59036 \
+ --hash=sha256:8ecd3b1f7a601f79e0cd20c26057d770219c0dc2f572ea07390248da2def79a4 \
+ --hash=sha256:92be52ca4e6e604f03d5daa079caec9e04ab4cbf6972b995aaebb877d3d24e13 \
+ --hash=sha256:92ea7855d5bcfb386c34557516c73753435fb2d4a014e2c9343b5f5ba148b5d8 \
+ --hash=sha256:962ea3aecedcc944f8034812e23d7200d52c6e32765b8da396eeb8b8ffca71ce \
+ --hash=sha256:98ca91dc9602cf351497d5600aa66e6d011a38c085a8237b370433fcb53e3409 \
+ --hash=sha256:9b84c6c210684286e504022d11ec294d2b7922d66c823e87575d8b23eba7c81f \
+ --hash=sha256:a0f6fc2ea6e07e20df48752e7700e02e1892c61f9a6bfbacaf2c5b24d5ad504b \
+ --hash=sha256:a2bda8f2790add22773ee7a4e43c90ea05598bffc94c21c40ae0a9000b0133c3 \
+ --hash=sha256:aa705beb74ab116563f4ce784fa94771f230c05d09ab5de9c397793e725bb1db \
+ --hash=sha256:aadf32c389bb7f02b8ec5c243c38302b92c006da565e120dfcb7bf0378f4f848 \
+ --hash=sha256:ab2357353894a5ec084bb8508ff892aa43fb7fe8a69ad310eac58221ee7f72aa \
+ --hash=sha256:ad9fd176ff6800a0cf52bcf59c71e5de4fa25bf3ba62b58800e0f84885344d34 \
+ --hash=sha256:addfc23e3bd5f4b6787b9ca95b2d09a1a67ad5a3c318daaa783ff90b2d3a366e \
+ --hash=sha256:af1394c2c5febc44e0bbf0fc6428263fa928b50d1b1982ce1d870dc793a8e5f4 \
+ --hash=sha256:b04c94718f7a8ed7cdd01b162b6caa1954b3c9d486f00ecbbd300f149d2b2606 \
+ --hash=sha256:b4f20417a4f511c656762b001ec827500cbee54d1810253c6ca2df2c0a307a5f \
+ --hash=sha256:b7a8c30d9bf4bd5e4dcfe26900bef0fcd9749acde45cdf0b3c89e2052fda9a13 \
+ --hash=sha256:b7fa260dd2731afd0dfa47881c30239f422d00faee4b8b341d3e597cface1483 \
+ --hash=sha256:b91380aefa9c7ac831b011368daf378d3277e0bdeb6bad9535e21251e26dd55a \
+ --hash=sha256:bb2446a55b3a0fd8aa02aa7194bd64740015464a2daaf160d2025204e1d7c282 \
+ --hash=sha256:bc05f8a875eb651d1cc62e12a4a0e6afa5cd0cc231381adb830d2e9c196ea895 \
+ --hash=sha256:bcf69e0bcddbf2adcfafc1a7e864edcc204dd8171756d3a8f3340f6f6cc87b7b \
+ --hash=sha256:bf02f915fa7934ea5dfc8d96757729c99a8868b7c340b97704795d6413cf5fe6 \
+ --hash=sha256:c39d2b6161f3c5c5d12e9207ecf1006bb661a647a97a6573656b09aaea3f00ef \
+ --hash=sha256:c59740682a686bf835a1a4d8d0ed1eefe31ac07f1c5a7ed5f2e72cf577692b00 \
+ --hash=sha256:cc76de75300f65b8eb574d855c12518dc25a075dadb41dd18f6322bda3fe15d5 \
+ --hash=sha256:cd0d3d16e63873253bad22b413ec679cf6586e51b5772eb10733899832efec42 \
+ --hash=sha256:cda61c46343809ecda43dc620d1333dd7433a25d0a252f2dcc7667f6331c7b61 \
+ --hash=sha256:cf7fbb4e54136e9a03c7ed7691843c4df6d2ecc854a2541f840665f4f2bb2edd \
+ --hash=sha256:d2b3b4bda1a025b10fe0269369475f420177f2cb06e0f9d32c95b4873c9f80b8 \
+ --hash=sha256:d5e3b9310fd7f0d12edc75532cd9a56da6293840c84da90070d692e0bb15f186 \
+ --hash=sha256:d64899cc0f33a8f446f1e60bffc21fa88b99f0e8208750d9144ea717610a80ce \
+ --hash=sha256:d6975f2d903bc354916a17b91a7aaac7299603f9ecdb788145060dde6e573a16 \
+ --hash=sha256:d82ac87017b734f2fb70ff93818c66f0ad2c3810f61040f077ed38d924e19980 \
+ --hash=sha256:dd91b0134a32dfcd8be504e8e46de44ad0045a569efc25101f2a12ccd41b5759 \
+ --hash=sha256:df4be1cf6e8f0f2bbe2a3eabfff163ef592c84a40e1a20a8d7db7f27cfe08fc2 \
+ --hash=sha256:e05d66239d14a04b4717998b736a25494372b1b2409339b04bf42aa4663bf251 \
+ --hash=sha256:e40cd0fc734aa1d4bd0e7ad102fd2a1aefa50ce9ef570005ffc2273c5442ddc3 \
+ --hash=sha256:e46eb6702691b24ddb3e31e88b4a499e31506991db3d3724a85bd1c5fc3cfe4e \
+ --hash=sha256:e4ebb000c0fe24a6d0f3534b6256844d9dbf042fdf003efe5cf40690cf4e0f3e \
+ --hash=sha256:e69f8e534b4e254f523e2f9d4732cf9c169c327ca1ce0922682aac9a5ee01155 \
+ --hash=sha256:e91a4e5d62da7cb3f53e04fe254f1aa41009af578801ee6477fe56e7bef74ee2 \
+ --hash=sha256:ec194197e90ca063f5ecb935d6c10063d84208cac5423c07d0f1a09d1c2ea42b \
+ --hash=sha256:f6ae9fc67e636fc0fa9adee39db87dfbdeabfa8420bc0e678a1ac8441e01b22b \
+ --hash=sha256:f7d3fe9e1483171e9183ffdb1fab07c5fef80a9c3840374a38ec2ab869ebae20 \
+ --hash=sha256:fdc7a52a4cdaf7293e10813fd6a3abc0c7753660db12a3b864ab1fb5a0c60c16 \
+ --hash=sha256:fe3198b81c00032326342d973e526803f183f97aa9e9a98e3f897ebafe21178f \
+ --hash=sha256:ff19efaa33e7f136fe95f9bbcc90ab7fb60648453b03f95d1de3ab6997de0f32
+ # via -r requirements.in
From 049bef042e3a4ac38588314426a4185fcba8deca Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Mon, 18 Aug 2025 06:54:38 -0700
Subject: [PATCH 071/231] docs: Move libX11 / PyQt stuff to "former quirks"
(#739)
This has been working fine since May 2022....
---
docs/quirks.rst | 68 ++++++++-----------------------------------------
1 file changed, 10 insertions(+), 58 deletions(-)
diff --git a/docs/quirks.rst b/docs/quirks.rst
index f24886a1a..84b2e1edc 100644
--- a/docs/quirks.rst
+++ b/docs/quirks.rst
@@ -142,64 +142,6 @@ Some functionality may behave subtly differently as a result of our choice
to link ``libedit`` by default. (We choose ``libedit`` by default to
avoid GPL licensing requirements of ``readline``.)
-.. _quirk_linux_libx11:
-
-Static Linking of ``libX11`` / Incompatibility with PyQt on Linux
-=================================================================
-
-The ``_tkinter`` Python extension module in the Python standard library
-statically links against ``libX11``, ``libxcb``, and ``libXau`` on Linux.
-In addition, the ``_tkinter`` extension module is statically linked into
-``libpython`` and isn't a standalone shared library file. This effectively
-means that all these X11 libraries are statically linked into the main
-Python interpreter.
-
-On typical builds of Python on Linux, ``_tkinter`` will link against
-external shared libraries. e.g.::
-
- $ ldd /usr/lib/python3.9/lib-dynload/_tkinter.cpython-39-x86_64-linux-gnu.so
- linux-vdso.so.1 (0x00007fff3be9d000)
- libBLT.2.5.so.8.6 => /lib/libBLT.2.5.so.8.6 (0x00007fdb6a6f8000)
- libtk8.6.so => /lib/x86_64-linux-gnu/libtk8.6.so (0x00007fdb6a584000)
- libtcl8.6.so => /lib/x86_64-linux-gnu/libtcl8.6.so (0x00007fdb6a3c1000)
- libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fdb6a1d5000)
- libX11.so.6 => /lib/x86_64-linux-gnu/libX11.so.6 (0x00007fdb6a097000)
- libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fdb69f49000)
- libXft.so.2 => /lib/x86_64-linux-gnu/libXft.so.2 (0x00007fdb69f2e000)
- libfontconfig.so.1 => /lib/x86_64-linux-gnu/libfontconfig.so.1 (0x00007fdb69ee6000)
- libXss.so.1 => /lib/x86_64-linux-gnu/libXss.so.1 (0x00007fdb69ee1000)
- libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fdb69eda000)
- libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fdb69ebe000)
- libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fdb69e9c000)
- /lib64/ld-linux-x86-64.so.2 (0x00007fdb6a892000)
- libxcb.so.1 => /lib/x86_64-linux-gnu/libxcb.so.1 (0x00007fdb69e70000)
- libfreetype.so.6 => /lib/x86_64-linux-gnu/libfreetype.so.6 (0x00007fdb69dad000)
- libXrender.so.1 => /lib/x86_64-linux-gnu/libXrender.so.1 (0x00007fdb69da0000)
- libexpat.so.1 => /lib/x86_64-linux-gnu/libexpat.so.1 (0x00007fdb69d71000)
- libuuid.so.1 => /lib/x86_64-linux-gnu/libuuid.so.1 (0x00007fdb69d68000)
- libXext.so.6 => /lib/x86_64-linux-gnu/libXext.so.6 (0x00007fdb69d53000)
- libXau.so.6 => /lib/x86_64-linux-gnu/libXau.so.6 (0x00007fdb69d4b000)
- libXdmcp.so.6 => /lib/x86_64-linux-gnu/libXdmcp.so.6 (0x00007fdb69d43000)
- libpng16.so.16 => /lib/x86_64-linux-gnu/libpng16.so.16 (0x00007fdb69d08000)
- libbrotlidec.so.1 => /lib/x86_64-linux-gnu/libbrotlidec.so.1 (0x00007fdb69cfa000)
- libbsd.so.0 => /lib/x86_64-linux-gnu/libbsd.so.0 (0x00007fdb69ce2000)
- libbrotlicommon.so.1 => /lib/x86_64-linux-gnu/libbrotlicommon.so.1 (0x00007fdb69cbd000)
- libmd.so.0 => /lib/x86_64-linux-gnu/libmd.so.0 (0x00007fdb69cb0000)
-
-The static linking of ``libX11`` and other libraries can cause problems when
-3rd party Python extension modules also loading similar libraries are also
-loaded into the process. For example, extension modules associated with ``PyQt``
-are known to link against a shared ``libX11.so.6``. If multiple versions of
-``libX11`` are loaded into the same process, run-time crashes / segfaults can
-occur. See e.g. https://github.com/astral-sh/python-build-standalone/issues/95.
-
-The conceptual workaround is to not statically link ``libX11`` and similar
-libraries into ``libpython``. However, this requires re-linking a custom
-``libpython`` without ``_tkinter``. It is possible to do this with the object
-files included in the distributions. But there isn't a turnkey way to do this.
-And you can't easily remove ``_tkinter`` and its symbols from the pre-built
-and ready-to-use Python install included in this project's distribution
-artifacts.
.. _quirk_references_to_build_paths:
@@ -254,6 +196,7 @@ make distributions more portable, please file a GitHub issue.
.. _quirk_former:
.. _quirk_missing_libcrypt:
+.. _quirk_linux_libx11:
Former quirks
=============
@@ -283,4 +226,13 @@ been resolved.
New in Python 3.13`_ about third-party replacements for the ``crypt``
module.
+* "Static Linking of ``libX11`` / Incompatibility with PyQt on Linux":
+ The 20220318 release and earlier exported dynamic symbols for the
+ internal, statically-linked build of ``libX11`` and other libraries.
+ These would cause conflicts and potential crashes when using
+ third-party extension modules such as PyQt that load an actual shared
+ ``libX11`` library (usually provided by your OS). Starting with the
+ 20220502 release, symbols from internal dependencies are no longer
+ exported.
+
.. _What's New in Python 3.13: https://docs.python.org/3/whatsnew/3.13.html#whatsnew313-pep594
From 6e9f3165c8a720cfc61232460ed5b62a583c3900 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Mon, 18 Aug 2025 13:56:36 -0500
Subject: [PATCH 072/231] Display zstd threading bounds on failure and fix
assert for 32-bin Windows (#770)
---
src/verify_distribution.py | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 62e787b06..2a9abda1d 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -179,7 +179,10 @@ def test_gil_disabled(self):
def test_zstd_multithreaded(self):
from compression import zstd
- assert zstd.CompressionParameter.nb_workers.bounds() == (0, 256)
+ max_threads = zstd.CompressionParameter.nb_workers.bounds()[1]
+ assert max_threads > 0, (
+ "Expected multithreading to be enabled but max threads is zero"
+ )
@unittest.skipIf("TCL_LIBRARY" not in os.environ, "TCL_LIBRARY not set")
@unittest.skipIf("DISPLAY" not in os.environ, "DISPLAY not set")
From 735ded8fb99f9b5bebd397a88c57d030e924b63e Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Mon, 18 Aug 2025 16:23:35 -0500
Subject: [PATCH 073/231] Replace `setup-just` with `setup-crate` (#771)
The former is just a composite of a latter, but does not pin to a commit
so it violates our policy. I do not think `setup-crate` supports pinning
a just commit, so I think we will want to just drop the whole action in
the future.
See
- https://github.com/astral-sh/python-build-standalone/issues/760
- https://github.com/extractions/setup-just/issues/20
- https://github.com/extractions/setup-just/issues/23
See failure at
https://github.com/astral-sh/python-build-standalone/actions/runs/17052072811/attempts/1
---
.github/workflows/release.yml | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0a77d11c9..c3b322590 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,10 @@ jobs:
submodules: recursive
persist-credentials: true # needed for git operations below
- - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v2
+ - uses: extractions/setup-crate@4993624604c307fbca528d28a3c8b60fa5ecc859 # v1.4.0
+ with:
+ repo: casey/just
+ version: 1.42.4
# Perform a release in dry-run mode.
- run: just release-dry-run ${GH_TOKEN} ${GITHUB_EVENT_INPUTS_SHA} ${GITHUB_EVENT_INPUTS_TAG}
From fd9784e6b0e8a18c883fa46a5d177a7888a03132 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 28 Aug 2025 07:53:22 -0500
Subject: [PATCH 074/231] Add support for aarch64 musl (#569)
Closes #87
Does not include the `+static` variant as I was having a hard time
getting the bzip2 build passing. I'll open a new issue to track that.
Related https://github.com/astral-sh/python-build-standalone/pull/484
---
ci-targets.yaml | 20 +++++++++++++
cpython-unix/build-cpython-host.sh | 5 ++++
cpython-unix/build-cpython.sh | 10 +++++--
cpython-unix/build-zstd.sh | 34 +++++++++++++++++----
cpython-unix/build.py | 5 ++++
cpython-unix/targets.yml | 47 ++++++++++++++++++++++++++++++
src/release.rs | 12 ++++++++
src/validation.rs | 7 +++++
8 files changed, 132 insertions(+), 8 deletions(-)
diff --git a/ci-targets.yaml b/ci-targets.yaml
index c59d5b7f5..492b815c7 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -348,6 +348,26 @@ linux:
minimum-python-version: "3.13"
run: true
+ aarch64-unknown-linux-musl:
+ arch: aarch64
+ libc: musl
+ python_versions:
+ - "3.9"
+ - "3.10"
+ - "3.11"
+ - "3.12"
+ - "3.13"
+ - "3.14"
+ build_options:
+ # TODO: Static support is current blocked by some compiler-rt linking issues
+ # - debug+static
+ # - noopt+static
+ # - lto+static
+ - debug
+ - noopt
+ - lto
+ run: true
+
windows:
i686-pc-windows-msvc:
arch: x86
diff --git a/cpython-unix/build-cpython-host.sh b/cpython-unix/build-cpython-host.sh
index 99b021d77..ff7c3a45c 100755
--- a/cpython-unix/build-cpython-host.sh
+++ b/cpython-unix/build-cpython-host.sh
@@ -70,6 +70,11 @@ case "${BUILD_TRIPLE}" in
EXTRA_HOST_CPPFLAGS="${EXTRA_HOST_CPPFLAGS} -I/usr/include/x86_64-linux-gnu"
EXTRA_HOST_LDFLAGS="${EXTRA_HOST_LDFLAGS} -L/usr/lib/x86_64-linux-gnu"
;;
+ aarch64-unknown-linux-gnu)
+ EXTRA_HOST_CFLAGS="${EXTRA_HOST_CFLAGS} -I/usr/include/aarch64-linux-gnu"
+ EXTRA_HOST_CPPFLAGS="${EXTRA_HOST_CPPFLAGS} -I/usr/include/aarch64-linux-gnu"
+ EXTRA_HOST_LDFLAGS="${EXTRA_HOST_LDFLAGS} -L/usr/lib/aarch64-linux-gnu"
+ ;;
*)
;;
esac
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 658395a98..30b0d2b2f 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -1077,8 +1077,14 @@ touch "${LIB_DYNLOAD}/.empty"
# Symlink libpython so we don't have 2 copies.
case "${TARGET_TRIPLE}" in
-aarch64-unknown-linux-gnu)
- PYTHON_ARCH="aarch64-linux-gnu"
+aarch64-unknown-linux-*)
+ # In Python 3.13+, the musl target is identified in cross compiles and the output directory
+ # is named accordingly.
+ if [[ "${CC}" = "musl-clang" && -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]]; then
+ PYTHON_ARCH="aarch64-linux-musl"
+ else
+ PYTHON_ARCH="aarch64-linux-gnu"
+ fi
;;
# This is too aggressive. But we don't have patches in place for
# setting the platform name properly on non-Darwin.
diff --git a/cpython-unix/build-zstd.sh b/cpython-unix/build-zstd.sh
index 5a889da5e..bcce804b4 100755
--- a/cpython-unix/build-zstd.sh
+++ b/cpython-unix/build-zstd.sh
@@ -15,16 +15,20 @@ tar -xf zstd-${ZSTD_VERSION}.tar.gz
pushd cpython-source-deps-zstd-${ZSTD_VERSION}/lib
if [ "${CC}" = "musl-clang" ]; then
- # In order to build the library with SSE2, BMI, and AVX2 intrinstics, we need musl-clang to find
+ # In order to build the library with intrinsics, we need musl-clang to find
# headers that provide access to the intrinsics, as they are not provided by musl. These are
# part of the include files that are part of clang. But musl-clang eliminates them from the
# default include path. So copy them into place.
- for h in ${TOOLS_PATH}/${TOOLCHAIN}/lib/clang/*/include/*intrin.h ${TOOLS_PATH}/${TOOLCHAIN}/lib/clang/*/include/{__wmmintrin_aes.h,__wmmintrin_pclmul.h,emmintrin.h,immintrin.h,mm_malloc.h}; do
+ for h in ${TOOLS_PATH}/${TOOLCHAIN}/lib/clang/*/include/*intrin.h ${TOOLS_PATH}/${TOOLCHAIN}/lib/clang/*/include/{__wmmintrin_aes.h,__wmmintrin_pclmul.h,emmintrin.h,immintrin.h,mm_malloc.h,arm_neon.h,arm_neon_sve_bridge.h,arm_bf16.h,arm_fp16.h,arm_acle.h,arm_vector_types.h}; do
filename=$(basename "$h")
- if [ -e "${TOOLS_PATH}/host/include/${filename}" ]; then
- echo "warning: ${filename} already exists"
+ if [ -f "$h" ]; then
+ if [ -e "${TOOLS_PATH}/host/include/${filename}" ]; then
+ echo "warning: ${filename} already exists"
+ fi
+ cp "$h" ${TOOLS_PATH}/host/include/
+ else
+ echo "warning: ${filename} not found (skipping)"
fi
- cp "$h" ${TOOLS_PATH}/host/include/
done
EXTRA_TARGET_CFLAGS="${EXTRA_TARGET_CFLAGS} -I${TOOLS_PATH}/host/include/"
@@ -33,7 +37,7 @@ if [ "${CC}" = "musl-clang" ]; then
# `qsort_r` is actually available so we patch it to include a check for glibc.
patch -p1 <suffix, ctx->suffixSize, sizeof(U32),
ctx,
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index ea44c2949..138a9c9b2 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -88,6 +88,11 @@ def add_target_env(env, build_platform, target_triple, build_env):
extra_host_cflags = []
extra_host_ldflags = []
+ # Add compiler-rt for aarch64-musl to resolve missing builtins
+ if target_triple == "aarch64-unknown-linux-musl":
+ extra_target_cflags.append("--rtlib=compiler-rt")
+ extra_target_ldflags.append("--rtlib=compiler-rt")
+
if build_platform.startswith("linux_"):
machine = platform.machine()
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index d0ef4a788..451b9840b 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -1131,3 +1131,50 @@ x86_64_v4-unknown-linux-musl:
- zlib
- zstd
openssl_target: linux-x86_64
+
+aarch64-unknown-linux-musl:
+ host_platforms:
+ - linux_x86_64
+ - linux_aarch64
+ pythons_supported:
+ - '3.9'
+ - '3.10'
+ - '3.11'
+ - '3.12'
+ - '3.13'
+ - '3.14'
+ needs_toolchain: true
+ docker_image_suffix: .debian9
+ needs_toolchain: true
+ host_cc: clang
+ host_cxx: clang++
+ target_cc: musl-clang
+ target_cxx: clang++
+ target_cflags:
+ - '-fvisibility=hidden'
+ needs:
+ - autoconf
+ - bdb
+ - binutils
+ - bzip2
+ - expat
+ - libedit
+ - libffi-3.3
+ - libX11
+ - libXau
+ - libxcb
+ - m4
+ - mpdecimal
+ - musl
+ - ncurses
+ - openssl-3.0
+ - patchelf
+ - sqlite
+ - tcl
+ - tk
+ - uuid
+ - xorgproto
+ - xz
+ - zlib
+ - zstd
+ openssl_target: linux-aarch64
diff --git a/src/release.rs b/src/release.rs
index 0b67888d5..4c123f618 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -339,6 +339,18 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
}],
},
);
+ h.insert(
+ "aarch64-unknown-linux-musl",
+ TripleRelease {
+ suffixes: vec!["debug", "lto", "noopt"],
+ install_only_suffix: "lto",
+ python_version_requirement: None,
+ conditional_suffixes: vec![ConditionalSuffixes {
+ python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
+ suffixes: linux_suffixes_musl_freethreaded.clone(),
+ }],
+ },
+ );
h
});
diff --git a/src/validation.rs b/src/validation.rs
index 6d9b5dbf0..163e7b015 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -35,6 +35,7 @@ const RECOGNIZED_TRIPLES: &[&str] = &[
"aarch64-apple-ios",
"aarch64-pc-windows-msvc",
"aarch64-unknown-linux-gnu",
+ "aarch64-unknown-linux-musl",
"armv7-unknown-linux-gnueabi",
"armv7-unknown-linux-gnueabihf",
"arm64-apple-tvos",
@@ -211,6 +212,10 @@ static GLIBC_MAX_VERSION_BY_TRIPLE: Lazy> = Lazy:
("aarch64-apple-ios", "iOS-aarch64"),
("aarch64-pc-windows-msvc", "win-arm64"),
("aarch64-unknown-linux-gnu", "linux-aarch64"),
+ ("aarch64-unknown-linux-musl", "linux-aarch64"),
("armv7-unknown-linux-gnueabi", "linux-arm"),
("armv7-unknown-linux-gnueabihf", "linux-arm"),
("i686-pc-windows-msvc", "win32"),
@@ -949,6 +955,7 @@ fn validate_elf>(
let wanted_cpu_type = match target_triple {
"aarch64-unknown-linux-gnu" => object::elf::EM_AARCH64,
+ "aarch64-unknown-linux-musl" => object::elf::EM_AARCH64,
"armv7-unknown-linux-gnueabi" => object::elf::EM_ARM,
"armv7-unknown-linux-gnueabihf" => object::elf::EM_ARM,
"i686-unknown-linux-gnu" => object::elf::EM_386,
From aa32d4a419f6c5d1c5c341d1610464f4f651835c Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 28 Aug 2025 11:44:26 -0500
Subject: [PATCH 075/231] Include freethreaded variants of `aarch64-*-musl`
(#778)
---
ci-targets.yaml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/ci-targets.yaml b/ci-targets.yaml
index 492b815c7..0662bbee9 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -366,6 +366,12 @@ linux:
- debug
- noopt
- lto
+ build_options_conditional:
+ - options:
+ - freethreaded+debug
+ - freethreaded+noopt
+ - freethreaded+lto
+ minimum-python-version: "3.13"
run: true
windows:
From 4ec8e29e90d5e42df6b745e5827d7f44f0af17f9 Mon Sep 17 00:00:00 2001
From: Christian Clauss
Date: Thu, 28 Aug 2025 23:31:19 +0200
Subject: [PATCH 076/231] Fix typos discovered by codespell (#779)
% `codespell --ignore-words-list=inout
--skip="LICENSE.*,python-licenses.rst" --write-changes`
* https://pypi.org/project/codespell
---
cpython-unix/build-cpython.sh | 2 +-
cpython-unix/build-libffi.sh | 4 ++--
cpython-unix/build.py | 2 +-
cpython-windows/build.py | 2 +-
docs/building.rst | 2 +-
docs/distributions.rst | 4 ++--
src/validation.rs | 2 +-
7 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 30b0d2b2f..e3188aa23 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -460,7 +460,7 @@ if [ -n "${CPYTHON_OPTIMIZED}" ]; then
if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]]; then
# Do not enable on x86-64 macOS because the JIT requires macOS 11+ and we are currently
- # using 10.15 as a miniumum version.
+ # using 10.15 as a minimum version.
# Do not enable when free-threading, because they're not compatible yet.
if [[ ! ( "${TARGET_TRIPLE}" == "x86_64-apple-darwin" || -n "${CPYTHON_FREETHREADED}" ) ]]; then
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} --enable-experimental-jit=yes-off"
diff --git a/cpython-unix/build-libffi.sh b/cpython-unix/build-libffi.sh
index 9b1880240..562d4d5a6 100755
--- a/cpython-unix/build-libffi.sh
+++ b/cpython-unix/build-libffi.sh
@@ -225,7 +225,7 @@ index 60cfa50..6a9a561 100644
BTI_C
- /* Sign the lr with x1 since that is where it will be stored */
+ PAC_CFI_WINDOW_SAVE
-+ /* Sign the lr with x1 since that is the CFA which is the modifer used in auth instructions */
++ /* Sign the lr with x1 since that is the CFA which is the modifier used in auth instructions */
SIGN_LR_WITH_REG(x1)
- /* Use a stack frame allocated by our caller. */
@@ -352,7 +352,7 @@ index 6a9a561..e83bc65 100644
+ cfi_startproc
BTI_C
PAC_CFI_WINDOW_SAVE
- /* Sign the lr with x1 since that is the CFA which is the modifer used in auth instructions */
+ /* Sign the lr with x1 since that is the CFA which is the modifier used in auth instructions */
@@ -348,8 +348,8 @@ CNAME(ffi_closure_SYSV_V):
#endif
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index 138a9c9b2..c5d73a1c0 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -517,7 +517,7 @@ def python_build_info(
bi["object_file_format"] = object_file_format
- # Determine allowed libaries on Linux
+ # Determine allowed libraries on Linux
libs = extra_metadata["python_config_vars"].get("LIBS", "").split()
mips = target_triple.split("-")[0] in {"mips", "mipsel"}
linux_allowed_system_libraries = LINUX_ALLOW_SYSTEM_LIBRARIES.copy()
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index 8f8cc43d5..5fce1abfb 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -1576,7 +1576,7 @@ def build_cpython(
# import their contents. According to
# https://github.com/pypa/pip/issues/11146 running pip from a wheel is not
# supported. But it has historically worked and is simple. So do this until
- # it stops working and we need to switch to running pip from the filesytem.
+ # it stops working and we need to switch to running pip from the filesystem.
pip_env = dict(os.environ)
pip_env["PYTHONPATH"] = str(pip_wheel)
diff --git a/docs/building.rst b/docs/building.rst
index c6a07e254..605f5f038 100644
--- a/docs/building.rst
+++ b/docs/building.rst
@@ -87,7 +87,7 @@ Visual Studio 2017 (or later) is required. A compatible Windows SDK is required
(10.0.17763.0 as per CPython 3.7.2).
* A ``git.exe`` on ``PATH`` (to clone ``libffi`` from source).
-* An installation of Cywgin with the ``autoconf``, ``automake``, ``libtool``,
+* An installation of Cygwin with the ``autoconf``, ``automake``, ``libtool``,
and ``make`` packages installed. (``libffi`` build dependency.)
To build a dynamically linked Python distribution for Windows x64::
diff --git a/docs/distributions.rst b/docs/distributions.rst
index 9e4cf8305..16fb23809 100644
--- a/docs/distributions.rst
+++ b/docs/distributions.rst
@@ -112,7 +112,7 @@ python_implementation_cache_tag
(Version 5 or above only.)
python_implementation_hex_version
- Hexidecimal expression of implementation version.
+ Hexadecimal expression of implementation version.
This is the value exposed by ``sys.implementation.hexversion``.
@@ -237,7 +237,7 @@ python_suffixes
(Version 5 or above only.)
python_bytecode_magic_number
- Magic number to use for bytecode files, expressed as a hexidecimal
+ Magic number to use for bytecode files, expressed as a hexadecimal
string.
(Version 5 or above only.)
diff --git a/src/validation.rs b/src/validation.rs
index 163e7b015..2fd47867d 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -593,7 +593,7 @@ const ELF_BANNED_SYMBOLS: &[&str] = &[
/// The list is obviously not complete.
const DEPENDENCY_PACKAGE_SYMBOLS: &[&str] = &[
/* TODO(geofft): Tk provides these as no-op stubs on macOS, make it
- * stop doing that so we can reenable the check
+ * stop doing that so we can re-enable the check
* // libX11
* "XClearWindow",
* "XFlush",
From 1b4757c766e6182868a3745c2e776be03c5707e2 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Tue, 2 Sep 2025 08:21:56 -0400
Subject: [PATCH 077/231] On macOS, add 64 bytes of headerpad to accommodate
code signatures (#780)
Closes #749.
---
cpython-unix/build-cpython.sh | 10 ++++++++++
src/validation.rs | 34 ++++++++++++++++++++++++++++++++--
2 files changed, 42 insertions(+), 2 deletions(-)
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index e3188aa23..d21533a89 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -365,6 +365,16 @@ if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_12}" && "${TARGET_TRIPLE}" = "ppc64le
LDFLAGS="${LDFLAGS} -Wl,--no-tls-get-addr-optimize"
fi
+# We're calling install_name_tool -add_rpath on extension modules, which
+# eats up 0x20 bytes of space in the Mach-O header, and we need to make
+# sure there's still enough room to add a code signature (0x10 bytes) on
+# non-arm64 where there's no automatic ad-hoc signature. We are somehow
+# on a toolchain that doesn't make sure there's enough space by default
+# so give it plenty of space.
+if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
+ LDFLAGS="${LDFLAGS} -Wl,-headerpad,40"
+fi
+
CPPFLAGS=$CFLAGS
CONFIGURE_FLAGS="
diff --git a/src/validation.rs b/src/validation.rs
index 2fd47867d..33e61e2e9 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -12,10 +12,10 @@ use {
FileHeader32, FileHeader64, ET_DYN, ET_EXEC, SHN_UNDEF, STB_GLOBAL, STB_WEAK, STV_DEFAULT,
STV_HIDDEN,
},
- macho::{MachHeader32, MachHeader64, MH_OBJECT, MH_TWOLEVEL},
+ macho::{LC_CODE_SIGNATURE, MH_OBJECT, MH_TWOLEVEL, MachHeader32, MachHeader64},
read::{
elf::{Dyn, FileHeader, SectionHeader, Sym},
- macho::{LoadCommandVariant, MachHeader, Nlist},
+ macho::{LoadCommandVariant, MachHeader, Nlist, Section, Segment},
pe::{ImageNtHeaders, PeFile, PeFile32, PeFile64},
},
Architecture, Endianness, FileKind, Object, SectionIndex, SymbolScope,
@@ -1264,6 +1264,8 @@ fn validate_macho>(
let mut undefined_symbols = vec![];
let mut target_version = None;
let mut sdk_version = None;
+ let mut has_code_signature = false;
+ let mut lowest_file_offset = u64::MAX;
while let Some(load_command) = load_commands.next()? {
match load_command.variant()? {
@@ -1386,10 +1388,38 @@ fn validate_macho>(
}
}
}
+ LoadCommandVariant::Segment32(segment, segment_data) => {
+ for section in segment.sections(endian, segment_data)? {
+ if let Some((offset, _)) = section.file_range(endian) {
+ lowest_file_offset = lowest_file_offset.min(offset);
+ }
+ }
+ }
+ LoadCommandVariant::Segment64(segment, segment_data) => {
+ for section in segment.sections(endian, segment_data)? {
+ if let Some((offset, _)) = section.file_range(endian) {
+ lowest_file_offset = lowest_file_offset.min(offset);
+ }
+ }
+ }
+ LoadCommandVariant::LinkeditData(c) if c.cmd.get(endian) == LC_CODE_SIGNATURE => {
+ has_code_signature = true;
+ }
_ => {}
}
}
+ let end_of_load_commands =
+ std::mem::size_of_val(header) as u64 + header.sizeofcmds(endian) as u64;
+ if header.filetype(endian) != MH_OBJECT
+ && end_of_load_commands + if has_code_signature { 0 } else { 16 } > lowest_file_offset
+ {
+ context.errors.push(format!(
+ "{}: Insufficient headerpad between end of load commands {end_of_load_commands:#x} and beginning of code {lowest_file_offset:#x}",
+ path.display(),
+ ));
+ }
+
if let Some(actual_target_version) = target_version {
if actual_target_version != advertised_target_version {
context.errors.push(format!(
From bcf094340b9647387b0bb795104117b68e931409 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Tue, 2 Sep 2025 09:57:52 -0400
Subject: [PATCH 078/231] Update SQLite to 3.50.4 (#786)
Fixes #784.
---
pythonbuild/downloads.py | 10 +++++-----
src/verify_distribution.py | 2 +-
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 4332d6806..e1562c04d 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -295,11 +295,11 @@
},
# Remember to update verify_distribution.py when version changed.
"sqlite": {
- "url": "https://www.sqlite.org/2025/sqlite-autoconf-3490100.tar.gz",
- "size": 3226385,
- "sha256": "106642d8ccb36c5f7323b64e4152e9b719f7c0215acf5bfeac3d5e7f97b59254",
- "version": "3490100",
- "actual_version": "3.49.1.0",
+ "url": "https://www.sqlite.org/2025/sqlite-autoconf-3500400.tar.gz",
+ "size": 3173050,
+ "sha256": "a3db587a1b92ee5ddac2f66b3edb41b26f9c867275782d46c3a088977d6a5b18",
+ "version": "3500400",
+ "actual_version": "3.50.4.0",
"library_names": ["sqlite3"],
"licenses": [],
"license_file": "LICENSE.sqlite.txt",
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 2a9abda1d..62d58f978 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -114,7 +114,7 @@ def test_hashlib(self):
def test_sqlite(self):
import sqlite3
- self.assertEqual(sqlite3.sqlite_version_info, (3, 49, 1))
+ self.assertEqual(sqlite3.sqlite_version_info, (3, 50, 4))
# Optional SQLite3 features are enabled.
conn = sqlite3.connect(":memory:")
From b35ba9ce9a090d670a2a4d30debb539b74f2eed8 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Tue, 2 Sep 2025 13:29:49 -0500
Subject: [PATCH 079/231] Bump Windows build timeout to 90m (#790)
See https://github.com/astral-sh/python-build-standalone/issues/789
---
.github/workflows/windows.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 94bdc0488..d287c3446 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -110,7 +110,7 @@ jobs:
STEPS_GET_LABELS_OUTPUTS_LABELS: ${{ steps.get-labels.outputs.labels }}
build:
- timeout-minutes: 60
+ timeout-minutes: 90
needs:
- generate-matrix
- crate-build
From f2a6c9898b0366b10cd91514263fe7d4425f0e90 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Sep 2025 14:35:55 -0500
Subject: [PATCH 080/231] Bump the actions group in /.github/workflows with 4
updates (#787)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the actions group in /.github/workflows with 4 updates:
[actions/checkout](https://github.com/actions/checkout),
[docker/login-action](https://github.com/docker/login-action),
[actions/download-artifact](https://github.com/actions/download-artifact)
and
[zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).
Updates `actions/checkout` from 4.2.2 to 5.0.0
Release notes
Sourced from actions/checkout's
releases.
v5.0.0
What's Changed
⚠️ Minimum Compatible Runner Version
v2.327.1
Release
Notes
Make sure your runner is updated to this version or newer to use this
release.
Full Changelog: https://github.com/actions/checkout/compare/v4...v5.0.0
v4.3.0
What's Changed
New Contributors
Full Changelog: https://github.com/actions/checkout/compare/v4...v4.3.0
Changelog
Sourced from actions/checkout's
changelog.
Changelog
V5.0.0
V4.3.0
v4.2.2
v4.2.1
v4.2.0
v4.1.7
v4.1.6
v4.1.5
v4.1.4
v4.1.3
... (truncated)
Commits
Updates `docker/login-action` from 3.4.0 to 3.5.0
Release notes
Sourced from docker/login-action's
releases.
v3.5.0
Full Changelog: https://github.com/docker/login-action/compare/v3.4.0...v3.5.0
Commits
184bdaa
Merge pull request #878
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
5c6bc94
chore: update generated content
caf4058
build(deps): bump the aws-sdk-dependencies group with 2 updates
ef38ec3
Merge pull request #860
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
d52e8ef
chore: update generated content
9644ab7
build(deps): bump the aws-sdk-dependencies group with 2 updates
7abd1d5
Merge pull request #875
from docker/dependabot/npm_and_yarn/form-data-2.5.5
1a81202
Merge pull request #876
from crazy-max/aws-public-dual-stack
d1ab30d
chore: update generated content
f25ff28
support dual-stack for aws public ecr
- Additional commits viewable in compare
view
Updates `actions/download-artifact` from 4.3.0 to 5.0.0
Release notes
Sourced from actions/download-artifact's
releases.
v5.0.0
What's Changed
v5.0.0
🚨 Breaking Change
This release fixes an inconsistency in path behavior for single
artifact downloads by ID. If you're downloading single artifacts
by ID, the output path may change.
What Changed
Previously, single artifact downloads behaved
differently depending on how you specified the artifact:
- By name:
name: my-artifact → extracted
to path/ (direct)
- By ID:
artifact-ids: 12345 → extracted
to path/my-artifact/ (nested)
Now both methods are consistent:
- By name:
name: my-artifact → extracted
to path/ (unchanged)
- By ID:
artifact-ids: 12345 → extracted
to path/ (fixed - now direct)
Migration Guide
✅ No Action Needed If:
- You download artifacts by name
- You download multiple artifacts by ID
- You already use
merge-multiple: true as a
workaround
⚠️ Action Required If:
You download single artifacts by ID and your
workflows expect the nested directory structure.
Before v5 (nested structure):
- uses: actions/download-artifact@v4
with:
artifact-ids: 12345
path: dist
# Files were in: dist/my-artifact/
Where my-artifact is the name of the artifact you
previously uploaded
To maintain old behavior (if needed):
</tr></table>
... (truncated)
Commits
634f93c
Merge pull request #416
from actions/single-artifact-id-download-path
b19ff43
refactor: resolve download path correctly in artifact download tests
(mainly ...
e262cbe
bundle dist
bff23f9
update docs
fff8c14
fix download path logic when downloading a single artifact by id
448e3f8
Merge pull request #407
from actions/nebuk89-patch-1
47225c4
Update README.md
- See full diff in compare
view
Updates `zizmorcore/zizmor-action` from 0.1.1 to 0.1.2
Release notes
Sourced from zizmorcore/zizmor-action's
releases.
v0.1.2
What's Changed
New Contributors
Full Changelog: https://github.com/zizmorcore/zizmor-action/compare/v0.1.1...v0.1.2
Commits
5ca5fc7
README: add note about v prefix (#32)
9c58446
fix: allow version prefix of v (#31)
c17832b
chore(deps): bump github/codeql-action in the github-actions group (#30)
383d31d
chore(deps): bump github/codeql-action in the github-actions group (#27)
87e3375
chore(deps): bump github/codeql-action in the github-actions group (#26)
0f0557a
chore(deps): bump github/codeql-action in the github-actions group (#25)
1c71060
chore(deps): bump github/codeql-action in the github-actions group (#24)
5ed208d
chore(deps): bump github/codeql-action in the github-actions group (#22)
77053b0
chore(deps): bump the github-actions group with 2 updates (#21)
ff52d5a
README: bump action versions (#20)
- See full diff in compare
view
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/check.yml | 2 +-
.github/workflows/linux.yml | 20 ++++++++++----------
.github/workflows/macos.yml | 10 +++++-----
.github/workflows/release.yml | 2 +-
.github/workflows/windows.yml | 8 ++++----
.github/workflows/zizmor.yml | 4 ++--
6 files changed, 23 insertions(+), 23 deletions(-)
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 0b06a31a0..ccf2ab865 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -19,7 +19,7 @@ jobs:
runs-on: "ubuntu-latest"
name: "check"
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 68eef0e52..3abc7bcfa 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -29,7 +29,7 @@ jobs:
sudo apt update
sudo apt install -y --no-install-recommends libssl-dev pkg-config
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
@@ -67,7 +67,7 @@ jobs:
permissions:
packages: write
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
@@ -80,7 +80,7 @@ jobs:
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
- name: Login to GitHub Container Registry
- uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+ uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
with:
registry: ghcr.io
username: ${{ github.actor }}
@@ -143,7 +143,7 @@ jobs:
crate-build-matrix: ${{ steps.set-matrix.outputs.crate-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
fetch-depth: 0
persist-credentials: false
@@ -215,7 +215,7 @@ jobs:
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
fetch-depth: 0
persist-credentials: false
@@ -226,13 +226,13 @@ jobs:
python-version: "3.11"
- name: Download pythonbuild
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: ${{ matrix.crate_artifact_name }}
path: build
- name: Download images
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
pattern: image-*
path: build
@@ -323,7 +323,7 @@ jobs:
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
fetch-depth: 0
persist-credentials: false
@@ -334,13 +334,13 @@ jobs:
python-version: "3.11"
- name: Download pythonbuild
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: ${{ matrix.crate_artifact_name }}
path: build
- name: Download images
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
pattern: image-*
path: build
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index b746a9670..cadaf4c47 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -24,7 +24,7 @@ jobs:
fail-fast: false
name: crate / ${{ matrix.arch }}
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
@@ -58,7 +58,7 @@ jobs:
crate-build-matrix: ${{ steps.set-matrix.outputs.crate-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
fetch-depth: 0
persist-credentials: false
@@ -123,7 +123,7 @@ jobs:
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
fetch-depth: 0
persist-credentials: false
@@ -134,7 +134,7 @@ jobs:
python-version: "3.11"
- name: Download pythonbuild
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: ${{ matrix.crate_artifact_name }}
path: build
@@ -172,7 +172,7 @@ jobs:
- name: Checkout macOS SDKs for validation
if: ${{ ! matrix.dry-run }}
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
repository: phracker/MacOSX-SDKs
ref: master
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c3b322590..be9c3d111 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
attestations: write
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: true # needed for git operations below
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index d287c3446..fc8c9886b 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -24,7 +24,7 @@ jobs:
fail-fast: false
name: crate / ${{ matrix.arch }}
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
@@ -58,7 +58,7 @@ jobs:
crate-build-matrix: ${{ steps.set-matrix.outputs.crate-build-matrix }}
any_builds: ${{ steps.set-matrix.outputs.any_builds }}
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
fetch-depth: 0
persist-credentials: false
@@ -124,7 +124,7 @@ jobs:
fail-fast: false
name: ${{ matrix.target_triple }} / ${{ matrix.python }} / ${{ matrix.build_options }}
steps:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
fetch-depth: 0
persist-credentials: false
@@ -140,7 +140,7 @@ jobs:
python-version: "3.12"
- name: Download pythonbuild Executable
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: ${{ matrix.crate_artifact_name }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index a60e28654..860113426 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -16,9 +16,9 @@ jobs:
security-events: write
steps:
- name: Checkout repository
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- name: Run zizmor
- uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1
+ uses: zizmorcore/zizmor-action@5ca5fc7a4779c5263a3ffa0e1f693009994446d1 # v0.1.2
From ba747294c1fe81dd4512346af14abaefbbb03b38 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 3 Sep 2025 09:16:24 -0500
Subject: [PATCH 081/231] Bump the python group with 14 updates (#785)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the python group with 14 updates:
| Package | From | To |
| --- | --- | --- |
| [certifi](https://github.com/certifi/python-certifi) | `2025.7.14` |
`2025.8.3` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) |
`3.4.2` | `3.4.3` |
| [cryptography](https://github.com/pyca/cryptography) | `45.0.5` |
`45.0.6` |
| [jsonschema](https://github.com/python-jsonschema/jsonschema) |
`4.25.0` | `4.25.1` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.6.1` | `2.7.0` |
| [requests](https://github.com/psf/requests) | `2.32.4` | `2.32.5` |
| [rpds-py](https://github.com/crate-py/rpds) | `0.26.0` | `0.27.0` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `1.17.2` |
`1.17.3` |
| [zstandard](https://github.com/indygreg/python-zstandard) | `0.23.0` |
`0.24.0` |
| [pywin32](https://github.com/mhammond/pywin32) | `310` | `311` |
| [mypy](https://github.com/python/mypy) | `1.17.0` | `1.17.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.12.4` | `0.12.9` |
| [types-jsonschema](https://github.com/typeshed-internal/stub_uploader)
| `4.25.0.20250720` | `4.25.0.20250809` |
| [types-pyyaml](https://github.com/typeshed-internal/stub_uploader) |
`6.0.12.20250516` | `6.0.12.20250809` |
Updates `certifi` from 2025.7.14 to 2025.8.3
Commits
Updates `charset-normalizer` from 3.4.2 to 3.4.3
Release notes
Sourced from charset-normalizer's
releases.
Version 3.4.3
3.4.3
(2025-08-09)
Changed
- mypy(c) is no longer a required dependency at build time if
CHARSET_NORMALIZER_USE_MYPYC isn't set to 1.
(#595)
(#583)
- automatically lower confidence on small bytes samples that are not
Unicode in
detect output legacy function. (#391)
Added
- Custom build backend to overcome inability to mark mypy as an
optional dependency in the build phase.
- Support for Python 3.14
Fixed
- sdist archive contained useless directories.
- automatically fallback on valid UTF-16 or UTF-32 even if the md says
it's noisy. (#633)
Misc
- SBOM are automatically published to the relevant GitHub release to
comply with regulatory changes.
Each published wheel comes with its SBOM. We choose CycloneDX as the
format.
- Prebuilt optimized wheel are no longer distributed by default for
CPython 3.7 due to a change in cibuildwheel.
Changelog
Sourced from charset-normalizer's
changelog.
3.4.3
(2025-08-09)
Changed
- mypy(c) is no longer a required dependency at build time if
CHARSET_NORMALIZER_USE_MYPYC isn't set to 1.
(#595)
(#583)
- automatically lower confidence on small bytes samples that are not
Unicode in
detect output legacy function. (#391)
Added
- Custom build backend to overcome inability to mark mypy as an
optional dependency in the build phase.
- Support for Python 3.14
Fixed
- sdist archive contained useless directories.
- automatically fallback on valid UTF-16 or UTF-32 even if the md says
it's noisy. (#633)
Misc
- SBOM are automatically published to the relevant GitHub release to
comply with regulatory changes.
Each published wheel comes with its SBOM. We choose CycloneDX as the
format.
- Prebuilt optimized wheel are no longer distributed by default for
CPython 3.7 due to a change in cibuildwheel.
Commits
46f662d
Release 3.4.3 (#638)
1a059b2
:wrench: skip building on freethreaded as we're not confident it is
stable
2275e3d
:pencil: final note in CHANGELOG.md
c96acdf
:pencil: update release date on CHANGELOG.md
43e5460
:pencil: update README.md
f277074
:wrench: automatically lower confidence on small bytes str on non
Unicode res...
15ae241
:bug: automatically fallback on valid UTF-16 or UTF-32 even if the md
says it...
37397c1
:wrench: enable 3.14 in nox test_mypyc session
cb82537
:rewind: revert license due to compat python 3.7 issue setuptools
6a2efeb
:art: fix linter errors
- Additional commits viewable in compare
view
Updates `cryptography` from 45.0.5 to 45.0.6
Changelog
Sourced from cryptography's
changelog.
45.0.6 - 2025-08-05
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL
3.5.2.
.. _v45-0-5:
Commits
Updates `jsonschema` from 4.25.0 to 4.25.1
Release notes
Sourced from jsonschema's
releases.
v4.25.1
What's Changed
Full Changelog: https://github.com/python-jsonschema/jsonschema/compare/v4.25.0...v4.25.1
Changelog
Sourced from jsonschema's
changelog.
v4.25.1
- Fix an incorrect required argument in the
Validator
protocol's type annotations (#1396).
Commits
331c384
Add the fix to the changelog.
c1ec0a6
Merge pull request #1398
from python-jsonschema/dependabot/github_actions/ast...
8e7d594
Merge pull request #1399
from python-jsonschema/dependabot/github_actions/act...
460f4fa
Merge pull request #1396
from sirosen/improve-protocol-init-signature
1e58409
[pre-commit.ci] auto fixes from pre-commit.com hooks
64bc217
Add a typing test for the Validator protocol
6c25741
Bump actions/checkout from 4 to 5
bf603d5
Bump astral-sh/setup-uv from 6.4.3 to 6.5.0
a916d8f
Fix Validator protocol init to match runtime
de60f18
Merge pull request #1397
from python-jsonschema/pre-commit-ci-update-config
- Additional commits viewable in compare
view
Updates `pygithub` from 2.6.1 to 2.7.0
Release notes
Sourced from pygithub's
releases.
v2.7.0
What's Changed
Breaking Changes
Code like
gh.get_rate_limit().core.remaining
should be replaced with
gh.get_rate_limit().resources.core.remaining
- Method
GitTag.verification now returns
GitCommitVerification rather than dict[str,
Any] (PyGithub/PyGithub#3226).
Code like
tag.verification["reason"]
tag.verification.get("reason")
should be replaced with
tag.verification.reason
New Features
Improvements
... (truncated)
Changelog
Sourced from pygithub's
changelog.
Version 2.7.0 (July 31, 2025)
Breaking Changes
^^^^^^^^^^^^^^^^
-
Method Github.get_rate_limit() now returns
RateLimitOverview rather than RateLimit
([#3205](https://github.com/pygithub/pygithub/issues/3205)
<https://github.com/PyGithub/PyGithub/pull/3205>)
(56ee057a
<https://github.com/PyGithub/PyGithub/commit/56ee057a>).
Code like
.. code-block:: python
gh.get_rate_limit().core.remaining
should be replaced with
.. code-block:: python
gh.get_rate_limit().resources.core.remaining
-
Method GitTag.verification now returns
GitCommitVerification rather than dict[str,
Any]
([#3226](https://github.com/pygithub/pygithub/issues/3226)
<https://github.com/PyGithub/PyGithub/pull/3226>)
(850932cc
<https://github.com/PyGithub/PyGithub/commit/850932cc>).
Code like
.. code-block:: python
tag.verification["reason"]
tag.verification.get("reason")
should be replaced with
.. code-block:: python
tag.verification.reason
Deprecations
^^^^^^^^^^^^
- Methods
dismissal_users and
dismissal_teams of RequiredPullRequestReviews
are deprecated,
use dismissal_restrictions.users and
dismissal_restrictions.teams instead.
New Features
^^^^^^^^^^^^
- Add getting list of self-hosted runners of organization
(
[#3190](https://github.com/pygithub/pygithub/issues/3190)
<https://github.com/PyGithub/PyGithub/pull/3190>)
(b4092b5d
<https://github.com/PyGithub/PyGithub/commit/b4092b5d>)
- Apply OpenAPI spec
(
[#3317](https://github.com/pygithub/pygithub/issues/3317)
<https://github.com/PyGithub/PyGithub/pull/3317>)
(858b9e5b
<https://github.com/PyGithub/PyGithub/commit/858b9e5b>)
- Add support for Sub-Issues
(
[#3258](https://github.com/pygithub/pygithub/issues/3258)
<https://github.com/PyGithub/PyGithub/pull/3258>)
(c7858c85
<https://github.com/PyGithub/PyGithub/commit/c7858c85>)
Improvement
^^^^^^^^^^^
- Refactor search results into separate classes
(
[#3204](https://github.com/pygithub/pygithub/issues/3204)
<https://github.com/PyGithub/PyGithub/pull/3204>)
(938f80b1
<https://github.com/PyGithub/PyGithub/commit/938f80b1>)
... (truncated)
Commits
bccc5aa
Release 2.7.0 (#3323)
cb42815
Add delete_self_hosted_runner to Organization
(#3306)
01196d6
Normalize App ID to String & Enhance JWT Issuer Verification (#3272)
c7858c8
Add support for Sub-Issues (#3258)
131949b
Make TimingData.run_duration_ms optional (#3268)
0378cce
Fix side-effect when removing Authorization key from headers (#3313)
da73fc8
Fix url encoding of strings with slashes in URLs (#3263)
f51a3f4
Adds multi_select and true_false options to
CustomProperty.value_type (...
e7110bf
Relax 404 condition in Requester exception handling (#3299)
95f015c
Support built-in reversed() on PaginatedList
(#3260)
- Additional commits viewable in compare
view
Updates `requests` from 2.32.4 to 2.32.5
Release notes
Sourced from requests's
releases.
v2.32.5
2.32.5 (2025-08-18)
Bugfixes
- The SSLContext caching feature originally introduced in 2.32.0 has
created
a new class of issues in Requests that have had negative impact across a
number
of use cases. The Requests team has decided to revert this feature as
long term
maintenance of it is proving to be unsustainable in its current
iteration.
Deprecations
- Added support for Python 3.14.
- Dropped support for Python 3.8 following its end of support.
Changelog
Sourced from requests's
changelog.
2.32.5 (2025-08-18)
Bugfixes
- The SSLContext caching feature originally introduced in 2.32.0 has
created
a new class of issues in Requests that have had negative impact across a
number
of use cases. The Requests team has decided to revert this feature as
long term
maintenance of it is proving to be unsustainable in its current
iteration.
Deprecations
- Added support for Python 3.14.
- Dropped support for Python 3.8 following its end of support.
Commits
b25c87d
v2.32.5
131e506
Merge pull request #7010
from psf/dependabot/github_actions/actions/checkout-...
b336cb2
Bump actions/checkout from 4.2.0 to 5.0.0
46e939b
Update publish workflow to use artifact-id instead of
name
4b9c546
Merge pull request #6999
from psf/dependabot/github_actions/step-security/har...
7618dbe
Bump step-security/harden-runner from 2.12.0 to 2.13.0
2edca11
Add support for Python 3.14 and drop support for Python 3.8 (#6993)
fec96cd
Update Makefile rules (#6996)
d58d8aa
docs: clarify timeout parameter uses seconds in Session.request (#6994)
91a3eab
Bump github/codeql-action from 3.28.5 to 3.29.0
- Additional commits viewable in compare
view
Updates `rpds-py` from 0.26.0 to 0.27.0
Release notes
Sourced from rpds-py's
releases.
v0.27.0
What's Changed
New Contributors
Full Changelog: https://github.com/crate-py/rpds/compare/v0.26.0...v0.27.0
Commits
c7cd37d
Tag a release for RISC
7adac99
Merge pull request #150
from ffgan/feature/allow_riscv_package
439ad44
fix format error
2091f27
downgrade riscv64 manylinux version
29a539f
Merge branch 'crate-py:main' into feature/allow_riscv_package
7546f2d
Allow packaging of wheels for riscv64 architecture
8ede3f4
Merge pull request #149
from crate-py/dependabot/github_actions/github/codeql...
0840694
Merge pull request #148
from crate-py/dependabot/github_actions/astral-sh/set...
725aabe
Bump github/codeql-action from 3.29.2 to 3.29.3
db4a842
Bump astral-sh/setup-uv from 6.3.1 to 6.4.1
- See full diff in compare
view
Updates `wrapt` from 1.17.2 to 1.17.3
Release notes
Sourced from wrapt's
releases.
wrapt-1.17.3
See the project page on the Python Package Index at https://pypi.org/project/wrapt/1.17.3/
for more information.
Changelog
Sourced from wrapt's
changelog.
Version 1.17.3
Bugs Fixed
- Reference count was not being incremented on type object for C
implementation
of the partial callable object proxy when module was initialized. If
wrapt was
being used in Python sub interpreters which were deleted it could lead
to the
process crashing.
Commits
99130c0
Build for Windows 11 ARM.
26f5344
Build for Python 3.14.
43dbbe0
Modify artifact upload pattern.
e90bd88
Update cibuildwheel version.
58efb76
Update to ubuntu-latest.
800a204
Increment release version.
33b8840
Update obsolete GitHub action.
1c755a1
Rename GitHub workflow file so can build package.
ff4981b
Fix crash due to lack of reference count.
ecbaaa1
Revert "Remove the dependency on pkg_resources and
hence setuptools on py...
- Additional commits viewable in compare
view
Updates `zstandard` from 0.23.0 to 0.24.0
Release notes
Sourced from zstandard's
releases.
0.24.0
Backwards Compatibility Notes
- Support for Python 3.8 has been dropped because it reached end of
life. Python 3.9 is the minimum supported Python version. The code
should still be compatible with Python 3.8 and removing of version
checks from
setup.py will likely yield a working install.
However, this is not officially supported.
Changes
- Bundled zstd library upgraded from 1.5.6 to 1.5.7. (#255)
- We now use and require cffi 1.17.0 or newer. Previously, the
constraint was >=1.11.0 on Python <3.13.
- The
pyproject.toml file now defines a
[project] section.
- We now use GitHub's native ARM Linux runners to build wheels and run
tests. Previously, Linux ARM wheels were built inside a QEMU virtualized
environment and we didn't run tests on this platform.
- We now use GitHub's native ARM Windows runners to build wheels and
run tests. Previously, Windows ARM wheels were cross compiled from an
x86-64 runner and we never ran tests for the Windows ARM platform.
- We now
collections.abs.Buffer on Python 3.12+ instead
of typing.ByteString, as typing.ByteString was
deprecated and later removed. (#238,
#262)
- PyO3 Rust crate upgraded from 0.21 to 0.22 (#257)
and later to 0.24.
- Removed CI coverage for PyPy 3.9.
- Added CI coverage for PyPy 3.11.
- Anaconda Windows CI builds have been disabled because we're running
into an apparent conda bug.
- Added CI coverage for Anaconda 3.12 and 3.13 on Linux and Windows
x86-64 (but the Windows builds no-op due to above issue).
get_frame_parameters() now accepts an optional
format argument defining the zstandard frame type. You can
pass e.g. zstandard.FORMAT_ZSTD1_MAGICLESS to decode frames
without header magic. (#217)
- Initial Python 3.14 support. We build wheels and have CI test
coverage.
Source Archive Publishing Error
During the release process of this version, we uploaded the source
archive to PyPI after some wheels. PyPI rejected the source archive
because of presence of a license-file entry while using
metadata version 2.4. We manually generated the source distribution
locally. The source distribution on PyPI therefore does not match what
GitHub Actions produced.
Changelog
Sourced from zstandard's
changelog.
0.24.0 (released 2025-08-17)
Changes
- Bundled zstd library upgraded from 1.5.6 to 1.5.7. (#255)
- We now use and require cffi 1.17.0 or newer. Previously, the
constraint
was >=1.11.0 on Python <3.13.
- The
pyproject.toml file now defines a
[project] section.
- We now use GitHub's native ARM Linux runners to build wheels and run
tests.
Previously, Linux ARM wheels were built inside a QEMU virtualized
environment
and we didn't run tests on this platform.
- We now use GitHub's native ARM Windows runners to build wheels and
run tests.
Previously, Windows ARM wheels were cross-compiled from an x86-64 runner
and
we never ran tests for the Windows ARM platform.
- We now
collections.abs.Buffer on Python 3.12+ instead
of typing.ByteString,
as typing.ByteString was deprecated and later removed. (#238,
#262)
- PyO3 Rust crate upgraded from 0.21 to 0.22 (#257)
and later to 0.24.
- Removed CI coverage for PyPy 3.9.
- Added CI coverage for PyPy 3.11.
- Anaconda Windows CI builds have been disabled because we're running
into
an apparant conda bug.
- Added CI coverage for Anaconda 3.12 and 3.13 on Linux and Windows
x86-64
(but the Windows builds no-op due to above issue).
get_frame_parameters() now accepts an optional
format argument
defining the zstandard frame type. You can pass e.g.
zstandard.FORMAT_ZSTD1_MAGICLESS to decode frames without
header magic.
(#217)
- Initial Python 3.14 support. We build wheels and have CI test
coverage.
Backwards Compatibility Notes
- Support for Python 3.8 has been dropped because it reached end of
life.
Python 3.9 is the minimum supported Python version. The code should
still be
compatible with Python 3.7 and removing of version checks from
setup.py
will likely yield a working install. However, this is not officially
supported.
Commits
9223924
global: release 0.24.0
b63f21e
ci: remove cibuildwheel from requirements.txt
724df3d
build: require cffi 1.17.0
58fca18
build: use static dependency metadata
fd95536
docs: move the potential 1.0 feature list from news.rst to
`missing_feature...
a32e7a6
docs: fix incorrect dict_id() reference
4110f71
ci: add Python 3.14 wheels and test coverage
c950bbf
ci: upgrade macOS wheel environment to Python 3.13
075f8ca
docs: add top-level docs section for One-Shot APIs
7312fae
frameparams: support defining frame format for
get_frame_parameters()
- Additional commits viewable in compare
view
Updates `pywin32` from 310 to 311
Release notes
Sourced from pywin32's
releases.
Build 311
A release with a
number of incremental improvements
Install via pip:
pip install pywin32 --upgrade
More details in
the README
Changelog
Sourced from pywin32's
changelog.
Build 311, released 2025/07/14
- Fix use-after-free in CertDeleteCertificateFromStore
(mhammond#2637)
- Better support for COM identifiers with non-ascii characters
(mhammond#2632)
- pywin32's own warnings will now refer to the caller, rather than to
the internal source of warning itself (mhammond#2594, [
@Avasam][Avasam])
- Fixed a regression that broke special
__dunder__
methods with CoClass. (mhammond#1870, mhammond#2493, [@Avasam][Avasam], [@geppi][geppi])
- Fixed
TypeError: cannot unpack non-iterable NoneType
object when registering an axscript client
ScriptItem (mhammond#2513, [@Avasam][Avasam])
- Fixed a memory leak when SafeArrays are used as out parameters ([
@the-snork][the-snork])
- Fixed dispatch handling for properties ([
@the-snork][the-snork])
- Resolved a handful of deprecation warnings (mhammond#2567,
mhammond#2576, [
@Avasam][Avasam])
- The following classes now produce a valid
eval string
representation when calling repr: (mhammond#2573, [@Avasam][Avasam])
pywin.tools.browser.HLIPythonObject
win32com.server.exception.COMException
win32comext.axscript.client.error.AXScriptException
win32comext.axscript.client.pyscript.NamedScriptAttribute
- Added initial
DECIMAL/VT_DECIMAL support
(mhammond#1501, [@gesslerpd][gesslerpd])
Commits
Updates `mypy` from 1.17.0 to 1.17.1
Changelog
Sourced from mypy's
changelog.
Mypy 1.17.1
- Retain
None as constraints bottom if no bottoms were
provided (Stanislav Terliakov, PR 19485)
- Fix "ignored exception in
hasattr" in dmypy
(Stanislav Terliakov, PR 19428)
- Prevent a crash when InitVar is redefined with a method in a
subclass (Stanislav Terliakov, PR 19453)
Acknowledgements
Thanks to all mypy contributors who contributed to this release:
- Alexey Makridenko
- Brian Schubert
- Chad Dombrova
- Chainfire
- Charlie Denton
- Charulata
- Christoph Tyralla
- CoolCat467
- Donal Burns
- Guy Wilson
- Ivan Levkivskyi
- johnthagen
- Jukka Lehtosalo
- Łukasz Kwieciński
- Marc Mueller
- Michael J. Sullivan
- Mikhail Golubev
- Sebastian Rittau
- Shantanu
- Stanislav Terliakov
- wyattscarpenter
I’d also like to thank my employer, Dropbox, for supporting mypy
development.
Mypy 1.16
We’ve just uploaded mypy 1.16 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new
features and bug fixes.
You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.
Different Property Getter and Setter Types
Mypy now supports using different types for a property getter and
setter:
class A:
_value: int
</tr></table>
... (truncated)
Commits
Updates `ruff` from 0.12.4 to 0.12.9
Release notes
Sourced from ruff's
releases.
0.12.9
Release Notes
Preview features
- [
airflow] Add check for
airflow.secrets.cache.SecretCache (AIR301) (#17707)
- [
ruff] Offer a safe fix for multi-digit zeros
(RUF064) (#19847)
Bug fixes
- [
flake8-blind-except] Fix BLE001
false-positive on raise ... from None (#19755)
- [
flake8-comprehensions] Fix false positive for
C420 with attribute, subscript, or slice assignment targets
(#19513)
- [
flake8-simplify] Fix handling of U+001C..U+001F
whitespace (SIM905) (#19849)
Rule changes
- [
pylint] Use lowercase hex characters to match the
formatter (PLE2513) (#19808)
Documentation
- Fix
lint.future-annotations link (#19876)
Other changes
-
Build riscv64 binaries for release (#19819)
-
Add rule code to error description in GitLab output (#19896)
-
Improve rendering of the full output format (#19415)
Below is an example diff for F401:
-unused.py:8:19: F401 [*] `pathlib` imported but
unused
+F401 [*] `pathlib` imported but unused
+ --> unused.py:8:19
|
7 | # Unused, _not_ marked as required (due to the alias).
8 | import pathlib as non_alias
- | ^^^^^^^^^ F401
+ | ^^^^^^^^^
9 |
10 | # Unused, marked as required.
|
- = help: Remove unused import: `pathlib`
+help: Remove unused import: `pathlib`
For now, the primary difference is the movement of the filename, line
number, and column information to a second line in the header. This new
representation will allow us to make further additions to Ruff's
diagnostics, such as adding sub-diagnostics and multiple annotations to
the same snippet.
... (truncated)
Changelog
Sourced from ruff's
changelog.
0.12.9
Preview features
- [
airflow] Add check for
airflow.secrets.cache.SecretCache (AIR301) (#17707)
- [
ruff] Offer a safe fix for multi-digit zeros
(RUF064) (#19847)
Bug fixes
- [
flake8-blind-except] Fix BLE001
false-positive on raise ... from None (#19755)
- [
flake8-comprehensions] Fix false positive for
C420 with attribute, subscript, or slice assignment targets
(#19513)
- [
flake8-simplify] Fix handling of U+001C..U+001F
whitespace (SIM905) (#19849)
Rule changes
- [
pylint] Use lowercase hex characters to match the
formatter (PLE2513) (#19808)
Documentation
- Fix
lint.future-annotations link (#19876)
Other changes
-
Build riscv64 binaries for release (#19819)
-
Add rule code to error description in GitLab output (#19896)
-
Improve rendering of the full output format (#19415)
Below is an example diff for F401:
-unused.py:8:19: F401 [*] `pathlib` imported but
unused
+F401 [*] `pathlib` imported but unused
+ --> unused.py:8:19
|
7 | # Unused, _not_ marked as required (due to the alias).
8 | import pathlib as non_alias
- | ^^^^^^^^^ F401
+ | ^^^^^^^^^
9 |
10 | # Unused, marked as required.
|
- = help: Remove unused import: `pathlib`
+help: Remove unused import: `pathlib`
For now, the primary difference is the movement of the filename, line
number, and column information to a second line in the header. This new
representation will allow us to make further additions to Ruff's
diagnostics, such as adding sub-diagnostics and multiple annotations to
the same snippet.
0.12.8
... (truncated)
Commits
ef42246
Bump 0.12.9 (#19917)
dc2e8ab
[ty] support kw_only=True for dataclass() and
field() (#19677)
9aaa82d
Feature/build riscv64 bin (#19819)
3288ac2
[ty] Add caching to CodeGeneratorKind::matches() (#19912)
1167ed6
[ty] Rename functionArgumentNames to
callArgumentNames inlay hint setting...
2ee47d8
[ty] Default ty.inlayHints.* server settings to true (#19910)
d324ced
[ty] Remove py-fuzzer skips for seeds that are no longer slow (#19906)
5a570c8
[ty] fix deferred name loading in PEP695 generic classes/functions (#19888)
baadb5a
[ty] Add some additional type safety to CycleDetector (#19903)
df0648a
[flake8-blind-except] Fix BLE001
false-positive on raise ... from None ...
- Additional commits viewable in compare
view
Updates `types-jsonschema` from 4.25.0.20250720 to 4.25.0.20250809
Commits
Updates `types-pyyaml` from 6.0.12.20250516 to 6.0.12.20250809
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
requirements.dev.txt | 129 ++---
requirements.win-arm64.txt | 12 +-
requirements.win.txt | 972 +++++++++++++++++++------------------
3 files changed, 564 insertions(+), 549 deletions(-)
diff --git a/requirements.dev.txt b/requirements.dev.txt
index 3ab114673..d050fe1a7 100644
--- a/requirements.dev.txt
+++ b/requirements.dev.txt
@@ -317,39 +317,45 @@ markupsafe==3.0.2 \
# via
# -r requirements.txt
# jinja2
-mypy==1.17.0 \
- --hash=sha256:037bc0f0b124ce46bfde955c647f3e395c6174476a968c0f22c95a8d2f589bba \
- --hash=sha256:03ba330b76710f83d6ac500053f7727270b6b8553b0423348ffb3af6f2f7b889 \
- --hash=sha256:0e69db1fb65b3114f98c753e3930a00514f5b68794ba80590eb02090d54a5d4a \
- --hash=sha256:1051df7ec0886fa246a530ae917c473491e9a0ba6938cfd0ec2abc1076495c3e \
- --hash=sha256:15d9d0018237ab058e5de3d8fce61b6fa72cc59cc78fd91f1b474bce12abf496 \
- --hash=sha256:1619a485fd0e9c959b943c7b519ed26b712de3002d7de43154a489a2d0fd817d \
- --hash=sha256:24cfcc1179c4447854e9e406d3af0f77736d631ec87d31c6281ecd5025df625d \
- --hash=sha256:2c41aa59211e49d717d92b3bb1238c06d387c9325d3122085113c79118bebb06 \
- --hash=sha256:3204d773bab5ff4ebbd1f8efa11b498027cd57017c003ae970f310e5b96be8d8 \
- --hash=sha256:3c56f180ff6430e6373db7a1d569317675b0a451caf5fef6ce4ab365f5f2f6c3 \
- --hash=sha256:434ad499ad8dde8b2f6391ddfa982f41cb07ccda8e3c67781b1bfd4e5f9450a8 \
- --hash=sha256:51e455a54d199dd6e931cd7ea987d061c2afbaf0960f7f66deef47c90d1b304d \
- --hash=sha256:63e751f1b5ab51d6f3d219fe3a2fe4523eaa387d854ad06906c63883fde5b1ab \
- --hash=sha256:6ff25d151cc057fdddb1cb1881ef36e9c41fa2a5e78d8dd71bee6e4dcd2bc05b \
- --hash=sha256:73a0ff2dd10337ceb521c080d4147755ee302dcde6e1a913babd59473904615f \
- --hash=sha256:93468cf29aa9a132bceb103bd8475f78cacde2b1b9a94fd978d50d4bdf616c9a \
- --hash=sha256:98189382b310f16343151f65dd7e6867386d3e35f7878c45cfa11383d175d91f \
- --hash=sha256:9d4fe5c72fd262d9c2c91c1117d16aac555e05f5beb2bae6a755274c6eec42be \
- --hash=sha256:b72c34ce05ac3a1361ae2ebb50757fb6e3624032d91488d93544e9f82db0ed6c \
- --hash=sha256:ba06254a5a22729853209550d80f94e28690d5530c661f9416a68ac097b13fc4 \
- --hash=sha256:c004135a300ab06a045c1c0d8e3f10215e71d7b4f5bb9a42ab80236364429937 \
- --hash=sha256:c38876106cb6132259683632b287238858bd58de267d80defb6f418e9ee50658 \
- --hash=sha256:ce4a17920ec144647d448fc43725b5873548b1aae6c603225626747ededf582d \
- --hash=sha256:d30ba01c0f151998f367506fab31c2ac4527e6a7b2690107c7a7f9e3cb419a9c \
- --hash=sha256:d96b196e5c16f41b4f7736840e8455958e832871990c7ba26bf58175e357ed61 \
- --hash=sha256:e5d7ccc08ba089c06e2f5629c660388ef1fee708444f1dee0b9203fa031dee03 \
- --hash=sha256:eafaf8b9252734400f9b77df98b4eee3d2eecab16104680d51341c75702cad70 \
- --hash=sha256:f105f61a5eff52e137fd73bee32958b2add9d9f0a856f17314018646af838e97 \
- --hash=sha256:f773c6d14dcc108a5b141b4456b0871df638eb411a89cd1c0c001fc4a9d08fc8 \
- --hash=sha256:f7fb09d05e0f1c329a36dcd30e27564a3555717cde87301fae4fb542402ddfad \
- --hash=sha256:f8e08de6138043108b3b18f09d3f817a4783912e48828ab397ecf183135d84d6 \
- --hash=sha256:f986f1cab8dbec39ba6e0eaa42d4d3ac6686516a5d3dccd64be095db05ebc6bb
+mypy==1.17.1 \
+ --hash=sha256:03b6d0ed2b188e35ee6d5c36b5580cffd6da23319991c49ab5556c023ccf1341 \
+ --hash=sha256:064e2ff508e5464b4bd807a7c1625bc5047c5022b85c70f030680e18f37273a5 \
+ --hash=sha256:099b9a5da47de9e2cb5165e581f158e854d9e19d2e96b6698c0d64de911dd849 \
+ --hash=sha256:15a83369400454c41ed3a118e0cc58bd8123921a602f385cb6d6ea5df050c733 \
+ --hash=sha256:15d54056f7fe7a826d897789f53dd6377ec2ea8ba6f776dc83c2902b899fee81 \
+ --hash=sha256:1b16708a66d38abb1e6b5702f5c2c87e133289da36f6a1d15f6a5221085c6403 \
+ --hash=sha256:209a58fed9987eccc20f2ca94afe7257a8f46eb5df1fb69958650973230f91e6 \
+ --hash=sha256:25e01ec741ab5bb3eec8ba9cdb0f769230368a22c959c4937360efb89b7e9f01 \
+ --hash=sha256:397fba5d7616a5bc60b45c7ed204717eaddc38f826e3645402c426057ead9a91 \
+ --hash=sha256:3fbe6d5555bf608c47203baa3e72dbc6ec9965b3d7c318aa9a4ca76f465bd972 \
+ --hash=sha256:43808d9476c36b927fbcd0b0255ce75efe1b68a080154a38ae68a7e62de8f0f8 \
+ --hash=sha256:55b918670f692fc9fba55c3298d8a3beae295c5cded0a55dccdc5bbead814acd \
+ --hash=sha256:5d1092694f166a7e56c805caaf794e0585cabdbf1df36911c414e4e9abb62ae9 \
+ --hash=sha256:62761474061feef6f720149d7ba876122007ddc64adff5ba6f374fda35a018a0 \
+ --hash=sha256:665afab0963a4b39dff7c1fa563cc8b11ecff7910206db4b2e64dd1ba25aed19 \
+ --hash=sha256:69e83ea6553a3ba79c08c6e15dbd9bfa912ec1e493bf75489ef93beb65209aeb \
+ --hash=sha256:70401bbabd2fa1aa7c43bb358f54037baf0586f41e83b0ae67dd0534fc64edfd \
+ --hash=sha256:79d44f9bfb004941ebb0abe8eff6504223a9c1ac51ef967d1263c6572bbebc99 \
+ --hash=sha256:80ef5c058b7bce08c83cac668158cb7edea692e458d21098c7d3bce35a5d43e7 \
+ --hash=sha256:89e972c0035e9e05823907ad5398c5a73b9f47a002b22359b177d40bdaee7056 \
+ --hash=sha256:93378d3203a5c0800c6b6d850ad2f19f7a3cdf1a3701d3416dbf128805c6a6a7 \
+ --hash=sha256:9a2b7d9180aed171f033c9f2fc6c204c1245cf60b0cb61cf2e7acc24eea78e0a \
+ --hash=sha256:9d6b20b97d373f41617bd0708fd46aa656059af57f2ef72aa8c7d6a2b73b74ed \
+ --hash=sha256:a76906f26bd8d51ea9504966a9c25419f2e668f012e0bdf3da4ea1526c534d94 \
+ --hash=sha256:a9f52c0351c21fe24c21d8c0eb1f62967b262d6729393397b6f443c3b773c3b9 \
+ --hash=sha256:ad37544be07c5d7fba814eb370e006df58fed8ad1ef33ed1649cb1889ba6ff58 \
+ --hash=sha256:b01586eed696ec905e61bd2568f48740f7ac4a45b3a468e6423a03d3788a51a8 \
+ --hash=sha256:c1fdf4abb29ed1cb091cf432979e162c208a5ac676ce35010373ff29247bcad5 \
+ --hash=sha256:c49562d3d908fd49ed0938e5423daed8d407774a479b595b143a3d7f87cdae6a \
+ --hash=sha256:c4a580f8a70c69e4a75587bd925d298434057fe2a428faaf927ffe6e4b9a98df \
+ --hash=sha256:c837b896b37cd103570d776bda106eabb8737aa6dd4f248451aecf53030cdbeb \
+ --hash=sha256:d7598cf74c3e16539d4e2f0b8d8c318e00041553d83d4861f87c7a72e95ac24d \
+ --hash=sha256:dd86bb649299f09d987a2eebb4d52d10603224500792e1bee18303bbcc1ce390 \
+ --hash=sha256:e79311f2d904ccb59787477b7bd5d26f3347789c06fcd7656fa500875290264b \
+ --hash=sha256:e92bdc656b7757c438660f775f872a669b8ff374edc4d18277d86b63edba6b8b \
+ --hash=sha256:fa6ffadfbe6994d724c5a1bb6123a7d27dd68fc9c059561cd33b664a79578e14 \
+ --hash=sha256:feb8cc32d319edd5859da2cc084493b3e2ce5e49a946377663cc90f6c15fb259 \
+ --hash=sha256:ff2933428516ab63f961644bc49bc4cbe42bbffb2cd3b71cc7277c07d16b1a8b
# via -r requirements.dev.in
mypy-extensions==1.0.0 \
--hash=sha256:4392f6c0eb8a5668a69e23d168ffa70f0be9ccfd32b5cc2d26a34ae5b844552d \
@@ -371,7 +377,7 @@ pygithub==2.6.1 \
# via
# -r requirements.dev.in
# -r requirements.txt
-pyjwt==2.10.1 \
+pyjwt[crypto]==2.10.1 \
--hash=sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953 \
--hash=sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb
# via
@@ -569,25 +575,26 @@ rpds-py==0.22.3 \
# -r requirements.txt
# jsonschema
# referencing
-ruff==0.12.4 \
- --hash=sha256:0618ec4442a83ab545e5b71202a5c0ed7791e8471435b94e655b570a5031a98e \
- --hash=sha256:0fc426bec2e4e5f4c4f182b9d2ce6a75c85ba9bcdbe5c6f2a74fcb8df437df4b \
- --hash=sha256:13efa16df6c6eeb7d0f091abae50f58e9522f3843edb40d56ad52a5a4a4b6873 \
- --hash=sha256:2abc48f3d9667fdc74022380b5c745873499ff827393a636f7a59da1515e7c57 \
- --hash=sha256:2b2449dc0c138d877d629bea151bee8c0ae3b8e9c43f5fcaafcd0c0d0726b184 \
- --hash=sha256:478fccdb82ca148a98a9ff43658944f7ab5ec41c3c49d77cd99d44da019371a1 \
- --hash=sha256:4de27977827893cdfb1211d42d84bc180fceb7b72471104671c59be37041cf93 \
- --hash=sha256:55c0f4ca9769408d9b9bac530c30d3e66490bd2beb2d3dae3e4128a1f05c7442 \
- --hash=sha256:56e45bb11f625db55f9b70477062e6a1a04d53628eda7784dce6e0f55fd549eb \
- --hash=sha256:a7dea966bcb55d4ecc4cc3270bccb6f87a337326c9dcd3c07d5b97000dbff41c \
- --hash=sha256:a8224cc3722c9ad9044da7f89c4c1ec452aef2cfe3904365025dd2f51daeae0e \
- --hash=sha256:afcfa3ab5ab5dd0e1c39bf286d829e042a15e966b3726eea79528e2e24d8371a \
- --hash=sha256:be0593c69df9ad1465e8a2d10e3defd111fdb62dcd5be23ae2c06da77e8fcffb \
- --hash=sha256:c057ce464b1413c926cdb203a0f858cd52f3e73dcb3270a3318d1630f6395bb3 \
- --hash=sha256:cb0d261dac457ab939aeb247e804125a5d521b21adf27e721895b0d3f83a0d0a \
- --hash=sha256:e64b90d1122dc2713330350626b10d60818930819623abbb56535c6466cce045 \
- --hash=sha256:e9949d01d64fa3672449a51ddb5d7548b33e130240ad418884ee6efa7a229586 \
- --hash=sha256:fe0b9e9eb23736b453143d72d2ceca5db323963330d5b7859d60d101147d461a
+ruff==0.12.9 \
+ --hash=sha256:07adb221c54b6bba24387911e5734357f042e5669fa5718920ee728aba3cbadc \
+ --hash=sha256:17d5b6b0b3a25259b69ebcba87908496e6830e03acfb929ef9fd4c58675fa2ea \
+ --hash=sha256:1b15599931a1a7a03c388b9c5df1bfa62be7ede6eb7ef753b272381f39c3d0ff \
+ --hash=sha256:3d02faa2977fb6f3f32ddb7828e212b7dd499c59eb896ae6c03ea5c303575756 \
+ --hash=sha256:43f07a3ccfc62cdb4d3a3348bf0588358a66da756aa113e071b8ca8c3b9826af \
+ --hash=sha256:5b15ea354c6ff0d7423814ba6d44be2807644d0c05e9ed60caca87e963e93f70 \
+ --hash=sha256:63c8c819739d86b96d500cce885956a1a48ab056bbcbc61b747ad494b2485089 \
+ --hash=sha256:6fb15b1977309741d7d098c8a3cb7a30bc112760a00fb6efb7abc85f00ba5908 \
+ --hash=sha256:72db7521860e246adbb43f6ef464dd2a532ef2ef1f5dd0d470455b8d9f1773e0 \
+ --hash=sha256:881465ed56ba4dd26a691954650de6ad389a2d1fdb130fe51ff18a25639fe4bb \
+ --hash=sha256:9fc83e4e9751e6c13b5046d7162f205d0a7bac5840183c5beebf824b08a27340 \
+ --hash=sha256:a03242c1522b4e0885af63320ad754d53983c9599157ee33e77d748363c561ce \
+ --hash=sha256:aed9d15f8c5755c0e74467731a007fcad41f19bcce41cd75f768bbd687f8535f \
+ --hash=sha256:cc7a37bd2509974379d0115cc5608a1a4a6c4bff1b452ea69db83c8855d53f93 \
+ --hash=sha256:d596c2d0393c2502eaabfef723bd74ca35348a8dac4267d18a94910087807c53 \
+ --hash=sha256:f5cd34fabfdea3933ab85d72359f118035882a01bff15bd1d2b15261d85d5f66 \
+ --hash=sha256:f6be1d2ca0686c54564da8e7ee9e25f93bdd6868263805f8c0b8fc6a449db6d7 \
+ --hash=sha256:fbd94b2e3c623f659962934e52c2bea6fc6da11f667a427a368adaf3af2c866a \
+ --hash=sha256:fcebc6c79fcae3f220d05585229463621f5dbf24d79fdc4936d9302e177cfa3e
# via -r requirements.dev.in
six==1.17.0 \
--hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
@@ -626,22 +633,24 @@ tomli==2.2.1 \
--hash=sha256:e85e99945e688e32d5a35c1ff38ed0b3f41f43fad8df0bdf79f72b2ba7bc5272 \
--hash=sha256:ece47d672db52ac607a3d9599a9d48dcb2f2f735c6c2d1f34130085bb12b112a \
--hash=sha256:f4039b9cbc3048b2416cc57ab3bda989a6fcf9b36cf8937f01a6e731b64f80d7
- # via -r requirements.txt
+ # via
+ # -r requirements.txt
+ # mypy
types-jinja2==2.11.9 \
--hash=sha256:60a1e21e8296979db32f9374d8a239af4cb541ff66447bb915d8ad398f9c63b2 \
--hash=sha256:dbdc74a40aba7aed520b7e4d89e8f0fe4286518494208b35123bcf084d4b8c81
# via -r requirements.dev.in
-types-jsonschema==4.25.0.20250720 \
- --hash=sha256:765a3b6144798fe3161fd8cbe570a756ed3e8c0e5adb7c09693eb49faad39dbd \
- --hash=sha256:7d7897c715310d8bf9ae27a2cedba78bbb09e4cad83ce06d2aa79b73a88941df
+types-jsonschema==4.25.0.20250809 \
+ --hash=sha256:83c2a0ed5365c731a68d6e815e2063ea22ccf4547a74b1d5ed0ac234dd3de86e \
+ --hash=sha256:dcd0fee69feb0f0763555c0307f0c5d58cc0c1a55984e66a04f4ef4ae1efb507
# via -r requirements.dev.in
types-markupsafe==1.1.10 \
--hash=sha256:85b3a872683d02aea3a5ac2a8ef590193c344092032f58457287fbf8e06711b1 \
--hash=sha256:ca2bee0f4faafc45250602567ef38d533e877d2ddca13003b319c551ff5b3cc5
# via types-jinja2
-types-pyyaml==6.0.12.20250516 \
- --hash=sha256:8478208feaeb53a34cb5d970c56a7cd76b72659442e733e268a94dc72b2d0530 \
- --hash=sha256:9f21a70216fc0fa1b216a8176db5f9e0af6eb35d2f2932acb87689d03a5bf6ba
+types-pyyaml==6.0.12.20250809 \
+ --hash=sha256:032b6003b798e7de1a1ddfeefee32fac6486bdfe4845e0ae0e7fb3ee4512b52f \
+ --hash=sha256:af4a1aca028f18e75297da2ee0da465f799627370d74073e96fee876524f61b5
# via -r requirements.dev.in
typing-extensions==4.14.1 \
--hash=sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36 \
diff --git a/requirements.win-arm64.txt b/requirements.win-arm64.txt
index 11b05021c..3a4172674 100644
--- a/requirements.win-arm64.txt
+++ b/requirements.win-arm64.txt
@@ -103,9 +103,9 @@ jinja2==3.1.6 \
--hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
--hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
# via -r requirements.in
-jsonschema==4.25.0 \
- --hash=sha256:24c2e8da302de79c8b9382fee3e76b355e44d2a4364bb207159ce10b517bd716 \
- --hash=sha256:e63acf5c11762c0e6672ffb61482bdf57f0876684d8d249c0fe2d730d48bc55f
+jsonschema==4.25.1 \
+ --hash=sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63 \
+ --hash=sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85
# via -r requirements.in
jsonschema-specifications==2025.4.1 \
--hash=sha256:4653bffbd6584f7de83a67e0d620ef16900b390ddc7939d56684d6c81e33f1af \
@@ -257,9 +257,9 @@ referencing==0.36.2 \
# via
# jsonschema
# jsonschema-specifications
-requests==2.32.4 \
- --hash=sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c \
- --hash=sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422
+requests==2.32.5 \
+ --hash=sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6 \
+ --hash=sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf
# via docker
rpds-py==0.27.0 \
--hash=sha256:010c4843a3b92b54373e3d2291a7447d6c3fc29f591772cc2ea0e9f5c1da434b \
diff --git a/requirements.win.txt b/requirements.win.txt
index 899a4c5d7..39aa17325 100644
--- a/requirements.win.txt
+++ b/requirements.win.txt
@@ -6,9 +6,9 @@ attrs==25.3.0 \
# via
# jsonschema
# referencing
-certifi==2025.7.14 \
- --hash=sha256:6b31f564a415d79ee77df69d757bb49a5bb53bd9f756cbbe24394ffd6fc1f4b2 \
- --hash=sha256:8ea99dbdfaaf2ba2f9bac77b9249ef62ec5218e7c2b2e903378ed5fccf765995
+certifi==2025.8.3 \
+ --hash=sha256:e564105f78ded564e3ae7c923924435e1daa7463faeab5bb932bc53ffae63407 \
+ --hash=sha256:f6c12493cfb1b06ba2ff328595af9350c65d6644968e5d3a2ffd78699af217a5
# via requests
cffi==1.17.1 \
--hash=sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8 \
@@ -81,138 +81,125 @@ cffi==1.17.1 \
# via
# cryptography
# pynacl
-charset-normalizer==3.4.2 \
- --hash=sha256:005fa3432484527f9732ebd315da8da8001593e2cf46a3d817669f062c3d9ed4 \
- --hash=sha256:046595208aae0120559a67693ecc65dd75d46f7bf687f159127046628178dc45 \
- --hash=sha256:0c29de6a1a95f24b9a1aa7aefd27d2487263f00dfd55a77719b530788f75cff7 \
- --hash=sha256:0c8c57f84ccfc871a48a47321cfa49ae1df56cd1d965a09abe84066f6853b9c0 \
- --hash=sha256:0f5d9ed7f254402c9e7d35d2f5972c9bbea9040e99cd2861bd77dc68263277c7 \
- --hash=sha256:18dd2e350387c87dabe711b86f83c9c78af772c748904d372ade190b5c7c9d4d \
- --hash=sha256:1b1bde144d98e446b056ef98e59c256e9294f6b74d7af6846bf5ffdafd687a7d \
- --hash=sha256:1c95a1e2902a8b722868587c0e1184ad5c55631de5afc0eb96bc4b0d738092c0 \
- --hash=sha256:1cad5f45b3146325bb38d6855642f6fd609c3f7cad4dbaf75549bf3b904d3184 \
- --hash=sha256:21b2899062867b0e1fde9b724f8aecb1af14f2778d69aacd1a5a1853a597a5db \
- --hash=sha256:24498ba8ed6c2e0b56d4acbf83f2d989720a93b41d712ebd4f4979660db4417b \
- --hash=sha256:25a23ea5c7edc53e0f29bae2c44fcb5a1aa10591aae107f2a2b2583a9c5cbc64 \
- --hash=sha256:289200a18fa698949d2b39c671c2cc7a24d44096784e76614899a7ccf2574b7b \
- --hash=sha256:28a1005facc94196e1fb3e82a3d442a9d9110b8434fc1ded7a24a2983c9888d8 \
- --hash=sha256:32fc0341d72e0f73f80acb0a2c94216bd704f4f0bce10aedea38f30502b271ff \
- --hash=sha256:36b31da18b8890a76ec181c3cf44326bf2c48e36d393ca1b72b3f484113ea344 \
- --hash=sha256:3c21d4fca343c805a52c0c78edc01e3477f6dd1ad7c47653241cf2a206d4fc58 \
- --hash=sha256:3fddb7e2c84ac87ac3a947cb4e66d143ca5863ef48e4a5ecb83bd48619e4634e \
- --hash=sha256:43e0933a0eff183ee85833f341ec567c0980dae57c464d8a508e1b2ceb336471 \
- --hash=sha256:4a476b06fbcf359ad25d34a057b7219281286ae2477cc5ff5e3f70a246971148 \
- --hash=sha256:4e594135de17ab3866138f496755f302b72157d115086d100c3f19370839dd3a \
- --hash=sha256:50bf98d5e563b83cc29471fa114366e6806bc06bc7a25fd59641e41445327836 \
- --hash=sha256:5a9979887252a82fefd3d3ed2a8e3b937a7a809f65dcb1e068b090e165bbe99e \
- --hash=sha256:5baececa9ecba31eff645232d59845c07aa030f0c81ee70184a90d35099a0e63 \
- --hash=sha256:5bf4545e3b962767e5c06fe1738f951f77d27967cb2caa64c28be7c4563e162c \
- --hash=sha256:6333b3aa5a12c26b2a4d4e7335a28f1475e0e5e17d69d55141ee3cab736f66d1 \
- --hash=sha256:65c981bdbd3f57670af8b59777cbfae75364b483fa8a9f420f08094531d54a01 \
- --hash=sha256:68a328e5f55ec37c57f19ebb1fdc56a248db2e3e9ad769919a58672958e8f366 \
- --hash=sha256:6a0289e4589e8bdfef02a80478f1dfcb14f0ab696b5a00e1f4b8a14a307a3c58 \
- --hash=sha256:6b66f92b17849b85cad91259efc341dce9c1af48e2173bf38a85c6329f1033e5 \
- --hash=sha256:6c9379d65defcab82d07b2a9dfbfc2e95bc8fe0ebb1b176a3190230a3ef0e07c \
- --hash=sha256:6fc1f5b51fa4cecaa18f2bd7a003f3dd039dd615cd69a2afd6d3b19aed6775f2 \
- --hash=sha256:70f7172939fdf8790425ba31915bfbe8335030f05b9913d7ae00a87d4395620a \
- --hash=sha256:721c76e84fe669be19c5791da68232ca2e05ba5185575086e384352e2c309597 \
- --hash=sha256:7222ffd5e4de8e57e03ce2cef95a4c43c98fcb72ad86909abdfc2c17d227fc1b \
- --hash=sha256:75d10d37a47afee94919c4fab4c22b9bc2a8bf7d4f46f87363bcf0573f3ff4f5 \
- --hash=sha256:76af085e67e56c8816c3ccf256ebd136def2ed9654525348cfa744b6802b69eb \
- --hash=sha256:770cab594ecf99ae64c236bc9ee3439c3f46be49796e265ce0cc8bc17b10294f \
- --hash=sha256:7a6ab32f7210554a96cd9e33abe3ddd86732beeafc7a28e9955cdf22ffadbab0 \
- --hash=sha256:7c48ed483eb946e6c04ccbe02c6b4d1d48e51944b6db70f697e089c193404941 \
- --hash=sha256:7f56930ab0abd1c45cd15be65cc741c28b1c9a34876ce8c17a2fa107810c0af0 \
- --hash=sha256:8075c35cd58273fee266c58c0c9b670947c19df5fb98e7b66710e04ad4e9ff86 \
- --hash=sha256:8272b73e1c5603666618805fe821edba66892e2870058c94c53147602eab29c7 \
- --hash=sha256:82d8fd25b7f4675d0c47cf95b594d4e7b158aca33b76aa63d07186e13c0e0ab7 \
- --hash=sha256:844da2b5728b5ce0e32d863af26f32b5ce61bc4273a9c720a9f3aa9df73b1455 \
- --hash=sha256:8755483f3c00d6c9a77f490c17e6ab0c8729e39e6390328e42521ef175380ae6 \
- --hash=sha256:915f3849a011c1f593ab99092f3cecfcb4d65d8feb4a64cf1bf2d22074dc0ec4 \
- --hash=sha256:926ca93accd5d36ccdabd803392ddc3e03e6d4cd1cf17deff3b989ab8e9dbcf0 \
- --hash=sha256:982bb1e8b4ffda883b3d0a521e23abcd6fd17418f6d2c4118d257a10199c0ce3 \
- --hash=sha256:98f862da73774290f251b9df8d11161b6cf25b599a66baf087c1ffe340e9bfd1 \
- --hash=sha256:9cbfacf36cb0ec2897ce0ebc5d08ca44213af24265bd56eca54bee7923c48fd6 \
- --hash=sha256:a370b3e078e418187da8c3674eddb9d983ec09445c99a3a263c2011993522981 \
- --hash=sha256:a955b438e62efdf7e0b7b52a64dc5c3396e2634baa62471768a64bc2adb73d5c \
- --hash=sha256:aa6af9e7d59f9c12b33ae4e9450619cf2488e2bbe9b44030905877f0b2324980 \
- --hash=sha256:aa88ca0b1932e93f2d961bf3addbb2db902198dca337d88c89e1559e066e7645 \
- --hash=sha256:aaeeb6a479c7667fbe1099af9617c83aaca22182d6cf8c53966491a0f1b7ffb7 \
- --hash=sha256:aaf27faa992bfee0264dc1f03f4c75e9fcdda66a519db6b957a3f826e285cf12 \
- --hash=sha256:b2680962a4848b3c4f155dc2ee64505a9c57186d0d56b43123b17ca3de18f0fa \
- --hash=sha256:b2d318c11350e10662026ad0eb71bb51c7812fc8590825304ae0bdd4ac283acd \
- --hash=sha256:b33de11b92e9f75a2b545d6e9b6f37e398d86c3e9e9653c4864eb7e89c5773ef \
- --hash=sha256:b3daeac64d5b371dea99714f08ffc2c208522ec6b06fbc7866a450dd446f5c0f \
- --hash=sha256:be1e352acbe3c78727a16a455126d9ff83ea2dfdcbc83148d2982305a04714c2 \
- --hash=sha256:bee093bf902e1d8fc0ac143c88902c3dfc8941f7ea1d6a8dd2bcb786d33db03d \
- --hash=sha256:c72fbbe68c6f32f251bdc08b8611c7b3060612236e960ef848e0a517ddbe76c5 \
- --hash=sha256:c9e36a97bee9b86ef9a1cf7bb96747eb7a15c2f22bdb5b516434b00f2a599f02 \
- --hash=sha256:cddf7bd982eaa998934a91f69d182aec997c6c468898efe6679af88283b498d3 \
- --hash=sha256:cf713fe9a71ef6fd5adf7a79670135081cd4431c2943864757f0fa3a65b1fafd \
- --hash=sha256:d11b54acf878eef558599658b0ffca78138c8c3655cf4f3a4a673c437e67732e \
- --hash=sha256:d41c4d287cfc69060fa91cae9683eacffad989f1a10811995fa309df656ec214 \
- --hash=sha256:d524ba3f1581b35c03cb42beebab4a13e6cdad7b36246bd22541fa585a56cccd \
- --hash=sha256:daac4765328a919a805fa5e2720f3e94767abd632ae410a9062dff5412bae65a \
- --hash=sha256:db4c7bf0e07fc3b7d89ac2a5880a6a8062056801b83ff56d8464b70f65482b6c \
- --hash=sha256:dc7039885fa1baf9be153a0626e337aa7ec8bf96b0128605fb0d77788ddc1681 \
- --hash=sha256:dccab8d5fa1ef9bfba0590ecf4d46df048d18ffe3eec01eeb73a42e0d9e7a8ba \
- --hash=sha256:dedb8adb91d11846ee08bec4c8236c8549ac721c245678282dcb06b221aab59f \
- --hash=sha256:e45ba65510e2647721e35323d6ef54c7974959f6081b58d4ef5d87c60c84919a \
- --hash=sha256:e53efc7c7cee4c1e70661e2e112ca46a575f90ed9ae3fef200f2a25e954f4b28 \
- --hash=sha256:e635b87f01ebc977342e2697d05b56632f5f879a4f15955dfe8cef2448b51691 \
- --hash=sha256:e70e990b2137b29dc5564715de1e12701815dacc1d056308e2b17e9095372a82 \
- --hash=sha256:e8082b26888e2f8b36a042a58307d5b917ef2b1cacab921ad3323ef91901c71a \
- --hash=sha256:e8323a9b031aa0393768b87f04b4164a40037fb2a3c11ac06a03ffecd3618027 \
- --hash=sha256:e92fca20c46e9f5e1bb485887d074918b13543b1c2a1185e69bb8d17ab6236a7 \
- --hash=sha256:eb30abc20df9ab0814b5a2524f23d75dcf83cde762c161917a2b4b7b55b1e518 \
- --hash=sha256:eba9904b0f38a143592d9fc0e19e2df0fa2e41c3c3745554761c5f6447eedabf \
- --hash=sha256:ef8de666d6179b009dce7bcb2ad4c4a779f113f12caf8dc77f0162c29d20490b \
- --hash=sha256:efd387a49825780ff861998cd959767800d54f8308936b21025326de4b5a42b9 \
- --hash=sha256:f0aa37f3c979cf2546b73e8222bbfa3dc07a641585340179d768068e3455e544 \
- --hash=sha256:f4074c5a429281bf056ddd4c5d3b740ebca4d43ffffe2ef4bf4d2d05114299da \
- --hash=sha256:f69a27e45c43520f5487f27627059b64aaf160415589230992cec34c5e18a509 \
- --hash=sha256:fb707f3e15060adf5b7ada797624a6c6e0138e2a26baa089df64c68ee98e040f \
- --hash=sha256:fcbe676a55d7445b22c10967bceaaf0ee69407fbe0ece4d032b6eb8d4565982a \
- --hash=sha256:fdb20a30fe1175ecabed17cbf7812f7b804b8a315a25f24678bcdf120a90077f
+charset-normalizer==3.4.3 \
+ --hash=sha256:00237675befef519d9af72169d8604a067d92755e84fe76492fef5441db05b91 \
+ --hash=sha256:02425242e96bcf29a49711b0ca9f37e451da7c70562bc10e8ed992a5a7a25cc0 \
+ --hash=sha256:027b776c26d38b7f15b26a5da1044f376455fb3766df8fc38563b4efbc515154 \
+ --hash=sha256:07a0eae9e2787b586e129fdcbe1af6997f8d0e5abaa0bc98c0e20e124d67e601 \
+ --hash=sha256:0cacf8f7297b0c4fcb74227692ca46b4a5852f8f4f24b3c766dd94a1075c4884 \
+ --hash=sha256:0e78314bdc32fa80696f72fa16dc61168fda4d6a0c014e0380f9d02f0e5d8a07 \
+ --hash=sha256:0f2be7e0cf7754b9a30eb01f4295cc3d4358a479843b31f328afd210e2c7598c \
+ --hash=sha256:13faeacfe61784e2559e690fc53fa4c5ae97c6fcedb8eb6fb8d0a15b475d2c64 \
+ --hash=sha256:14c2a87c65b351109f6abfc424cab3927b3bdece6f706e4d12faaf3d52ee5efe \
+ --hash=sha256:1606f4a55c0fd363d754049cdf400175ee96c992b1f8018b993941f221221c5f \
+ --hash=sha256:16a8770207946ac75703458e2c743631c79c59c5890c80011d536248f8eaa432 \
+ --hash=sha256:18343b2d246dc6761a249ba1fb13f9ee9a2bcd95decc767319506056ea4ad4dc \
+ --hash=sha256:18b97b8404387b96cdbd30ad660f6407799126d26a39ca65729162fd810a99aa \
+ --hash=sha256:1bb60174149316da1c35fa5233681f7c0f9f514509b8e399ab70fea5f17e45c9 \
+ --hash=sha256:1e8ac75d72fa3775e0b7cb7e4629cec13b7514d928d15ef8ea06bca03ef01cae \
+ --hash=sha256:1ef99f0456d3d46a50945c98de1774da86f8e992ab5c77865ea8b8195341fc19 \
+ --hash=sha256:2001a39612b241dae17b4687898843f254f8748b796a2e16f1051a17078d991d \
+ --hash=sha256:23b6b24d74478dc833444cbd927c338349d6ae852ba53a0d02a2de1fce45b96e \
+ --hash=sha256:252098c8c7a873e17dd696ed98bbe91dbacd571da4b87df3736768efa7a792e4 \
+ --hash=sha256:257f26fed7d7ff59921b78244f3cd93ed2af1800ff048c33f624c87475819dd7 \
+ --hash=sha256:2c322db9c8c89009a990ef07c3bcc9f011a3269bc06782f916cd3d9eed7c9312 \
+ --hash=sha256:30a96e1e1f865f78b030d65241c1ee850cdf422d869e9028e2fc1d5e4db73b92 \
+ --hash=sha256:30d006f98569de3459c2fc1f2acde170b7b2bd265dc1943e87e1a4efe1b67c31 \
+ --hash=sha256:31a9a6f775f9bcd865d88ee350f0ffb0e25936a7f930ca98995c05abf1faf21c \
+ --hash=sha256:320e8e66157cc4e247d9ddca8e21f427efc7a04bbd0ac8a9faf56583fa543f9f \
+ --hash=sha256:34a7f768e3f985abdb42841e20e17b330ad3aaf4bb7e7aeeb73db2e70f077b99 \
+ --hash=sha256:3653fad4fe3ed447a596ae8638b437f827234f01a8cd801842e43f3d0a6b281b \
+ --hash=sha256:3cd35b7e8aedeb9e34c41385fda4f73ba609e561faedfae0a9e75e44ac558a15 \
+ --hash=sha256:3cfb2aad70f2c6debfbcb717f23b7eb55febc0bb23dcffc0f076009da10c6392 \
+ --hash=sha256:416175faf02e4b0810f1f38bcb54682878a4af94059a1cd63b8747244420801f \
+ --hash=sha256:41d1fc408ff5fdfb910200ec0e74abc40387bccb3252f3f27c0676731df2b2c8 \
+ --hash=sha256:42e5088973e56e31e4fa58eb6bd709e42fc03799c11c42929592889a2e54c491 \
+ --hash=sha256:4ca4c094de7771a98d7fbd67d9e5dbf1eb73efa4f744a730437d8a3a5cf994f0 \
+ --hash=sha256:511729f456829ef86ac41ca78c63a5cb55240ed23b4b737faca0eb1abb1c41bc \
+ --hash=sha256:53cd68b185d98dde4ad8990e56a58dea83a4162161b1ea9272e5c9182ce415e0 \
+ --hash=sha256:585f3b2a80fbd26b048a0be90c5aae8f06605d3c92615911c3a2b03a8a3b796f \
+ --hash=sha256:5b413b0b1bfd94dbf4023ad6945889f374cd24e3f62de58d6bb102c4d9ae534a \
+ --hash=sha256:5d8d01eac18c423815ed4f4a2ec3b439d654e55ee4ad610e153cf02faf67ea40 \
+ --hash=sha256:6aab0f181c486f973bc7262a97f5aca3ee7e1437011ef0c2ec04b5a11d16c927 \
+ --hash=sha256:6cf8fd4c04756b6b60146d98cd8a77d0cdae0e1ca20329da2ac85eed779b6849 \
+ --hash=sha256:6fb70de56f1859a3f71261cbe41005f56a7842cc348d3aeb26237560bfa5e0ce \
+ --hash=sha256:6fce4b8500244f6fcb71465d4a4930d132ba9ab8e71a7859e6a5d59851068d14 \
+ --hash=sha256:70bfc5f2c318afece2f5838ea5e4c3febada0be750fcf4775641052bbba14d05 \
+ --hash=sha256:73dc19b562516fc9bcf6e5d6e596df0b4eb98d87e4f79f3ae71840e6ed21361c \
+ --hash=sha256:74d77e25adda8581ffc1c720f1c81ca082921329452eba58b16233ab1842141c \
+ --hash=sha256:78deba4d8f9590fe4dae384aeff04082510a709957e968753ff3c48399f6f92a \
+ --hash=sha256:86df271bf921c2ee3818f0522e9a5b8092ca2ad8b065ece5d7d9d0e9f4849bcc \
+ --hash=sha256:88ab34806dea0671532d3f82d82b85e8fc23d7b2dd12fa837978dad9bb392a34 \
+ --hash=sha256:8999f965f922ae054125286faf9f11bc6932184b93011d138925a1773830bbe9 \
+ --hash=sha256:8dcfc373f888e4fb39a7bc57e93e3b845e7f462dacc008d9749568b1c4ece096 \
+ --hash=sha256:939578d9d8fd4299220161fdd76e86c6a251987476f5243e8864a7844476ba14 \
+ --hash=sha256:96b2b3d1a83ad55310de8c7b4a2d04d9277d5591f40761274856635acc5fcb30 \
+ --hash=sha256:a2d08ac246bb48479170408d6c19f6385fa743e7157d716e144cad849b2dd94b \
+ --hash=sha256:b256ee2e749283ef3ddcff51a675ff43798d92d746d1a6e4631bf8c707d22d0b \
+ --hash=sha256:b5e3b2d152e74e100a9e9573837aba24aab611d39428ded46f4e4022ea7d1942 \
+ --hash=sha256:b89bc04de1d83006373429975f8ef9e7932534b8cc9ca582e4db7d20d91816db \
+ --hash=sha256:bd28b817ea8c70215401f657edef3a8aa83c29d447fb0b622c35403780ba11d5 \
+ --hash=sha256:c60e092517a73c632ec38e290eba714e9627abe9d301c8c8a12ec32c314a2a4b \
+ --hash=sha256:c6dbd0ccdda3a2ba7c2ecd9d77b37f3b5831687d8dc1b6ca5f56a4880cc7b7ce \
+ --hash=sha256:c6e490913a46fa054e03699c70019ab869e990270597018cef1d8562132c2669 \
+ --hash=sha256:c6f162aabe9a91a309510d74eeb6507fab5fff92337a15acbe77753d88d9dcf0 \
+ --hash=sha256:c6fd51128a41297f5409deab284fecbe5305ebd7e5a1f959bee1c054622b7018 \
+ --hash=sha256:cc34f233c9e71701040d772aa7490318673aa7164a0efe3172b2981218c26d93 \
+ --hash=sha256:cc9370a2da1ac13f0153780040f465839e6cccb4a1e44810124b4e22483c93fe \
+ --hash=sha256:ccf600859c183d70eb47e05a44cd80a4ce77394d1ac0f79dbd2dd90a69a3a049 \
+ --hash=sha256:ce571ab16d890d23b5c278547ba694193a45011ff86a9162a71307ed9f86759a \
+ --hash=sha256:cf1ebb7d78e1ad8ec2a8c4732c7be2e736f6e5123a4146c5b89c9d1f585f8cef \
+ --hash=sha256:d0e909868420b7049dafd3a31d45125b31143eec59235311fc4c57ea26a4acd2 \
+ --hash=sha256:d22dbedd33326a4a5190dd4fe9e9e693ef12160c77382d9e87919bce54f3d4ca \
+ --hash=sha256:d716a916938e03231e86e43782ca7878fb602a125a91e7acb8b5112e2e96ac16 \
+ --hash=sha256:d79c198e27580c8e958906f803e63cddb77653731be08851c7df0b1a14a8fc0f \
+ --hash=sha256:d95bfb53c211b57198bb91c46dd5a2d8018b3af446583aab40074bf7988401cb \
+ --hash=sha256:e28e334d3ff134e88989d90ba04b47d84382a828c061d0d1027b1b12a62b39b1 \
+ --hash=sha256:ec557499516fc90fd374bf2e32349a2887a876fbf162c160e3c01b6849eaf557 \
+ --hash=sha256:fb6fecfd65564f208cbf0fba07f107fb661bcd1a7c389edbced3f7a493f70e37 \
+ --hash=sha256:fb731e5deb0c7ef82d698b0f4c5bb724633ee2a489401594c5c88b02e6cb15f7 \
+ --hash=sha256:fb7f67a1bfa6e40b438170ebdc8158b78dc465a5a67b6dde178a46987b244a72 \
+ --hash=sha256:fd10de089bcdcd1be95a2f73dbe6254798ec1bda9f450d5828c96f93e2536b9c \
+ --hash=sha256:fdabf8315679312cfa71302f9bd509ded4f2f263fb5b765cf1433b39106c3cc9
# via requests
-cryptography==45.0.5 \
- --hash=sha256:0027d566d65a38497bc37e0dd7c2f8ceda73597d2ac9ba93810204f56f52ebc7 \
- --hash=sha256:101ee65078f6dd3e5a028d4f19c07ffa4dd22cce6a20eaa160f8b5219911e7d8 \
- --hash=sha256:12e55281d993a793b0e883066f590c1ae1e802e3acb67f8b442e721e475e6463 \
- --hash=sha256:14d96584701a887763384f3c47f0ca7c1cce322aa1c31172680eb596b890ec30 \
- --hash=sha256:1e1da5accc0c750056c556a93c3e9cb828970206c68867712ca5805e46dc806f \
- --hash=sha256:206210d03c1193f4e1ff681d22885181d47efa1ab3018766a7b32a7b3d6e6afd \
- --hash=sha256:2089cc8f70a6e454601525e5bf2779e665d7865af002a5dec8d14e561002e135 \
- --hash=sha256:3a264aae5f7fbb089dbc01e0242d3b67dffe3e6292e1f5182122bdf58e65215d \
- --hash=sha256:3af26738f2db354aafe492fb3869e955b12b2ef2e16908c8b9cb928128d42c57 \
- --hash=sha256:3fcfbefc4a7f332dece7272a88e410f611e79458fab97b5efe14e54fe476f4fd \
- --hash=sha256:460f8c39ba66af7db0545a8c6f2eabcbc5a5528fc1cf6c3fa9a1e44cec33385e \
- --hash=sha256:57c816dfbd1659a367831baca4b775b2a5b43c003daf52e9d57e1d30bc2e1b0e \
- --hash=sha256:5aa1e32983d4443e310f726ee4b071ab7569f58eedfdd65e9675484a4eb67bd1 \
- --hash=sha256:6ff8728d8d890b3dda5765276d1bc6fb099252915a2cd3aff960c4c195745dd0 \
- --hash=sha256:7259038202a47fdecee7e62e0fd0b0738b6daa335354396c6ddebdbe1206af2a \
- --hash=sha256:72e76caa004ab63accdf26023fccd1d087f6d90ec6048ff33ad0445abf7f605a \
- --hash=sha256:7760c1c2e1a7084153a0f68fab76e754083b126a47d0117c9ed15e69e2103492 \
- --hash=sha256:8c4a6ff8a30e9e3d38ac0539e9a9e02540ab3f827a3394f8852432f6b0ea152e \
- --hash=sha256:9024beb59aca9d31d36fcdc1604dd9bbeed0a55bface9f1908df19178e2f116e \
- --hash=sha256:90cb0a7bb35959f37e23303b7eed0a32280510030daba3f7fdfbb65defde6a97 \
- --hash=sha256:91098f02ca81579c85f66df8a588c78f331ca19089763d733e34ad359f474174 \
- --hash=sha256:926c3ea71a6043921050eaa639137e13dbe7b4ab25800932a8498364fc1abec9 \
- --hash=sha256:982518cd64c54fcada9d7e5cf28eabd3ee76bd03ab18e08a48cad7e8b6f31b18 \
- --hash=sha256:9b4cf6318915dccfe218e69bbec417fdd7c7185aa7aab139a2c0beb7468c89f0 \
- --hash=sha256:ad0caded895a00261a5b4aa9af828baede54638754b51955a0ac75576b831b27 \
- --hash=sha256:b85980d1e345fe769cfc57c57db2b59cff5464ee0c045d52c0df087e926fbe63 \
- --hash=sha256:b8fa8b0a35a9982a3c60ec79905ba5bb090fc0b9addcfd3dc2dd04267e45f25e \
- --hash=sha256:b9e38e0a83cd51e07f5a48ff9691cae95a79bea28fe4ded168a8e5c6c77e819d \
- --hash=sha256:bd4c45986472694e5121084c6ebbd112aa919a25e783b87eb95953c9573906d6 \
- --hash=sha256:be97d3a19c16a9be00edf79dca949c8fa7eff621763666a145f9f9535a5d7f42 \
- --hash=sha256:c648025b6840fe62e57107e0a25f604db740e728bd67da4f6f060f03017d5097 \
- --hash=sha256:d05a38884db2ba215218745f0781775806bde4f32e07b135348355fe8e4991d9 \
- --hash=sha256:dd420e577921c8c2d31289536c386aaa30140b473835e97f83bc71ea9d2baf2d \
- --hash=sha256:e357286c1b76403dd384d938f93c46b2b058ed4dfcdce64a770f0537ed3feb6f \
- --hash=sha256:e6c00130ed423201c5bc5544c23359141660b07999ad82e34e7bb8f882bb78e0 \
- --hash=sha256:e74d30ec9c7cb2f404af331d5b4099a9b322a8a6b25c4632755c8757345baac5 \
- --hash=sha256:f3562c2f23c612f2e4a6964a61d942f891d29ee320edb62ff48ffb99f3de9ae8
+cryptography==45.0.6 \
+ --hash=sha256:00e8724bdad672d75e6f069b27970883179bd472cd24a63f6e620ca7e41cc0c5 \
+ --hash=sha256:048e7ad9e08cf4c0ab07ff7f36cc3115924e22e2266e034450a890d9e312dd74 \
+ --hash=sha256:0d9ef57b6768d9fa58e92f4947cea96ade1233c0e236db22ba44748ffedca394 \
+ --hash=sha256:18f878a34b90d688982e43f4b700408b478102dd58b3e39de21b5ebf6509c301 \
+ --hash=sha256:1b7fa6a1c1188c7ee32e47590d16a5a0646270921f8020efc9a511648e1b2e08 \
+ --hash=sha256:20ae4906a13716139d6d762ceb3e0e7e110f7955f3bc3876e3a07f5daadec5f3 \
+ --hash=sha256:20d15aed3ee522faac1a39fbfdfee25d17b1284bafd808e1640a74846d7c4d1b \
+ --hash=sha256:2384f2ab18d9be88a6e4f8972923405e2dbb8d3e16c6b43f15ca491d7831bd18 \
+ --hash=sha256:275ba5cc0d9e320cd70f8e7b96d9e59903c815ca579ab96c1e37278d231fc402 \
+ --hash=sha256:2dac5ec199038b8e131365e2324c03d20e97fe214af051d20c49db129844e8b3 \
+ --hash=sha256:31a2b9a10530a1cb04ffd6aa1cd4d3be9ed49f7d77a4dafe198f3b382f41545c \
+ --hash=sha256:3436128a60a5e5490603ab2adbabc8763613f638513ffa7d311c900a8349a2a0 \
+ --hash=sha256:3b5bf5267e98661b9b888a9250d05b063220dfa917a8203744454573c7eb79db \
+ --hash=sha256:3de77e4df42ac8d4e4d6cdb342d989803ad37707cf8f3fbf7b088c9cbdd46427 \
+ --hash=sha256:44647c5d796f5fc042bbc6d61307d04bf29bccb74d188f18051b635f20a9c75f \
+ --hash=sha256:550ae02148206beb722cfe4ef0933f9352bab26b087af00e48fdfb9ade35c5b3 \
+ --hash=sha256:599c8d7df950aa68baa7e98f7b73f4f414c9f02d0e8104a30c0182a07732638b \
+ --hash=sha256:5b64e668fc3528e77efa51ca70fadcd6610e8ab231e3e06ae2bab3b31c2b8ed9 \
+ --hash=sha256:5bd6020c80c5b2b2242d6c48487d7b85700f5e0038e67b29d706f98440d66eb5 \
+ --hash=sha256:5c966c732cf6e4a276ce83b6e4c729edda2df6929083a952cc7da973c539c719 \
+ --hash=sha256:629127cfdcdc6806dfe234734d7cb8ac54edaf572148274fa377a7d3405b0043 \
+ --hash=sha256:705bb7c7ecc3d79a50f236adda12ca331c8e7ecfbea51edd931ce5a7a7c4f012 \
+ --hash=sha256:780c40fb751c7d2b0c6786ceee6b6f871e86e8718a8ff4bc35073ac353c7cd02 \
+ --hash=sha256:7a3085d1b319d35296176af31c90338eeb2ddac8104661df79f80e1d9787b8b2 \
+ --hash=sha256:826b46dae41a1155a0c0e66fafba43d0ede1dc16570b95e40c4d83bfcf0a451d \
+ --hash=sha256:833dc32dfc1e39b7376a87b9a6a4288a10aae234631268486558920029b086ec \
+ --hash=sha256:cc4d66f5dc4dc37b89cfef1bd5044387f7a1f6f0abb490815628501909332d5d \
+ --hash=sha256:d063341378d7ee9c91f9d23b431a3502fc8bfacd54ef0a27baa72a0843b29159 \
+ --hash=sha256:e2a21a8eda2d86bb604934b6b37691585bd095c1f788530c1fcefc53a82b3453 \
+ --hash=sha256:e40b80ecf35ec265c452eea0ba94c9587ca763e739b8e559c128d23bff7ebbbf \
+ --hash=sha256:e5b3dda1b00fb41da3af4c5ef3f922a200e33ee5ba0f0bc9ecf0b0c173958385 \
+ --hash=sha256:ea3c42f2016a5bbf71825537c2ad753f2870191134933196bee408aac397b3d9 \
+ --hash=sha256:eccddbd986e43014263eda489abbddfbc287af5cddfd690477993dbb31e31016 \
+ --hash=sha256:ee411a1b977f40bd075392c80c10b58025ee5c6b47a822a33c1198598a7a5f05 \
+ --hash=sha256:f4028f29a9f38a2025abedb2e409973709c660d44319c61762202206ed577c42 \
+ --hash=sha256:f68f833a9d445cc49f01097d95c83a850795921b3f7cc6488731e69bde3288da \
+ --hash=sha256:fc022c1fa5acff6def2fc6d7819bbbd31ccddfe67d075331a65d9cfb28a20983
# via pyjwt
deprecated==1.2.18 \
--hash=sha256:422b6f6d859da6f2ef57857761bfb392480502a64c3028ca9bbe86085d72115d \
@@ -230,9 +217,9 @@ jinja2==3.1.6 \
--hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
--hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
# via -r requirements.in
-jsonschema==4.25.0 \
- --hash=sha256:24c2e8da302de79c8b9382fee3e76b355e44d2a4364bb207159ce10b517bd716 \
- --hash=sha256:e63acf5c11762c0e6672ffb61482bdf57f0876684d8d249c0fe2d730d48bc55f
+jsonschema==4.25.1 \
+ --hash=sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63 \
+ --hash=sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85
# via -r requirements.in
jsonschema-specifications==2025.4.1 \
--hash=sha256:4653bffbd6584f7de83a67e0d620ef16900b390ddc7939d56684d6c81e33f1af \
@@ -305,9 +292,9 @@ pycparser==2.22 \
--hash=sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6 \
--hash=sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc
# via cffi
-pygithub==2.6.1 \
- --hash=sha256:6f2fa6d076ccae475f9fc392cc6cdbd54db985d4f69b8833a28397de75ed6ca3 \
- --hash=sha256:b5c035392991cca63959e9453286b41b54d83bf2de2daa7d7ff7e4312cebf3bf
+pygithub==2.7.0 \
+ --hash=sha256:40ecbfe26dc55cc34ab4b0ffa1d455e6f816ef9a2bc8d6f5ad18ce572f163700 \
+ --hash=sha256:7cd6eafabb09b5369afba3586d86b1f1ad6f1326d2ff01bc47bb26615dce4cbb
# via -r requirements.in
pyjwt==2.10.1 \
--hash=sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953 \
@@ -325,23 +312,27 @@ pynacl==1.5.0 \
--hash=sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b \
--hash=sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543
# via pygithub
-pywin32==310 \
- --hash=sha256:0867beb8addefa2e3979d4084352e4ac6e991ca45373390775f7084cc0209b9c \
- --hash=sha256:126298077a9d7c95c53823934f000599f66ec9296b09167810eb24875f32689c \
- --hash=sha256:19ec5fc9b1d51c4350be7bb00760ffce46e6c95eaf2f0b2f1150657b1a43c582 \
- --hash=sha256:1e765f9564e83011a63321bb9d27ec456a0ed90d3732c4b2e312b855365ed8bd \
- --hash=sha256:2349cc906eae872d0663d4d6290d13b90621eaf78964bb1578632ff20e152966 \
- --hash=sha256:30f0a9b3138fb5e07eb4973b7077e1883f558e40c578c6925acc7a94c34eaa36 \
- --hash=sha256:33babed0cf0c92a6f94cc6cc13546ab24ee13e3e800e61ed87609ab91e4c8213 \
- --hash=sha256:5d241a659c496ada3253cd01cfaa779b048e90ce4b2b38cd44168ad555ce74ab \
- --hash=sha256:667827eb3a90208ddbdcc9e860c81bde63a135710e21e4cb3348968e4bd5249e \
- --hash=sha256:6dd97011efc8bf51d6793a82292419eba2c71cf8e7250cfac03bba284454abc1 \
- --hash=sha256:851c8d927af0d879221e616ae1f66145253537bbdd321a77e8ef701b443a9a1a \
- --hash=sha256:8a75a5cc3893e83a108c05d82198880704c44bbaee4d06e442e471d3c9ea4f3d \
- --hash=sha256:96867217335559ac619f00ad70e513c0fcf84b8a3af9fc2bba3b59b97da70475 \
- --hash=sha256:bf5c397c9a9a19a6f62f3fb821fbf36cac08f03770056711f765ec1503972060 \
- --hash=sha256:c3e78706e4229b915a0821941a84e7ef420bf2b77e08c9dae3c76fd03fd2ae3d \
- --hash=sha256:e308f831de771482b7cf692a1f308f8fca701b2d8f9dde6cc440c7da17e47b33
+pywin32==311 \
+ --hash=sha256:0502d1facf1fed4839a9a51ccbcc63d952cf318f78ffc00a7e78528ac27d7a2b \
+ --hash=sha256:184eb5e436dea364dcd3d2316d577d625c0351bf237c4e9a5fabbcfa5a58b151 \
+ --hash=sha256:3aca44c046bd2ed8c90de9cb8427f581c479e594e99b5c0bb19b29c10fd6cb87 \
+ --hash=sha256:3ce80b34b22b17ccbd937a6e78e7225d80c52f5ab9940fe0506a1a16f3dab503 \
+ --hash=sha256:62ea666235135fee79bb154e695f3ff67370afefd71bd7fea7512fc70ef31e3d \
+ --hash=sha256:6c6f2969607b5023b0d9ce2541f8d2cbb01c4f46bc87456017cf63b73f1e2d8c \
+ --hash=sha256:718a38f7e5b058e76aee1c56ddd06908116d35147e133427e59a3983f703a20d \
+ --hash=sha256:750ec6e621af2b948540032557b10a2d43b0cee2ae9758c54154d711cc852d31 \
+ --hash=sha256:797c2772017851984b97180b0bebe4b620bb86328e8a884bb626156295a63b3b \
+ --hash=sha256:7b4075d959648406202d92a2310cb990fea19b535c7f4a78d3f5e10b926eeb8a \
+ --hash=sha256:a508e2d9025764a8270f93111a970e1d0fbfc33f4153b388bb649b7eec4f9b42 \
+ --hash=sha256:a733f1388e1a842abb67ffa8e7aad0e70ac519e09b0f6a784e65a136ec7cefd2 \
+ --hash=sha256:aba8f82d551a942cb20d4a83413ccbac30790b50efb89a75e4f586ac0bb8056b \
+ --hash=sha256:b7a2c10b93f8986666d0c803ee19b5990885872a7de910fc460f9b0c2fbf92ee \
+ --hash=sha256:b8c095edad5c211ff31c05223658e71bf7116daa0ecf3ad85f3201ea3190d067 \
+ --hash=sha256:c8015b09fb9a5e188f83b7b04de91ddca4658cee2ae6f3bc483f0b21a77ef6cd \
+ --hash=sha256:d03ff496d2a0cd4a5893504789d4a15399133fe82517455e78bad62efbb7f0a3 \
+ --hash=sha256:e0c4cfb0621281fe40387df582097fd796e80430597cb9944f0ae70447bacd91 \
+ --hash=sha256:e286f46a9a39c4a18b319c28f59b61de793654af2f395c102b4f819e584b5852 \
+ --hash=sha256:f95ba5a847cba10dd8c4d8fefa9f2a6cf283b8b88ed6178fa8a6c1ab16054d0d
# via docker
pyyaml==6.0.2 \
--hash=sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff \
@@ -404,157 +395,168 @@ referencing==0.36.2 \
# via
# jsonschema
# jsonschema-specifications
-requests==2.32.4 \
- --hash=sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c \
- --hash=sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422
+requests==2.32.5 \
+ --hash=sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6 \
+ --hash=sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf
# via
# docker
# pygithub
-rpds-py==0.26.0 \
- --hash=sha256:0919f38f5542c0a87e7b4afcafab6fd2c15386632d249e9a087498571250abe3 \
- --hash=sha256:093d63b4b0f52d98ebae33b8c50900d3d67e0666094b1be7a12fffd7f65de74b \
- --hash=sha256:0a0b60701f2300c81b2ac88a5fb893ccfa408e1c4a555a77f908a2596eb875a5 \
- --hash=sha256:0c71c2f6bf36e61ee5c47b2b9b5d47e4d1baad6426bfed9eea3e858fc6ee8806 \
- --hash=sha256:0dc23bbb3e06ec1ea72d515fb572c1fea59695aefbffb106501138762e1e915e \
- --hash=sha256:0dfa6115c6def37905344d56fb54c03afc49104e2ca473d5dedec0f6606913b4 \
- --hash=sha256:12bff2ad9447188377f1b2794772f91fe68bb4bbfa5a39d7941fbebdbf8c500f \
- --hash=sha256:1533b7eb683fb5f38c1d68a3c78f5fdd8f1412fa6b9bf03b40f450785a0ab915 \
- --hash=sha256:1766b5724c3f779317d5321664a343c07773c8c5fd1532e4039e6cc7d1a815be \
- --hash=sha256:181ef9b6bbf9845a264f9aa45c31836e9f3c1f13be565d0d010e964c661d1e2b \
- --hash=sha256:183f857a53bcf4b1b42ef0f57ca553ab56bdd170e49d8091e96c51c3d69ca696 \
- --hash=sha256:191aa858f7d4902e975d4cf2f2d9243816c91e9605070aeb09c0a800d187e323 \
- --hash=sha256:1a8b0dd8648709b62d9372fc00a57466f5fdeefed666afe3fea5a6c9539a0331 \
- --hash=sha256:1c962145c7473723df9722ba4c058de12eb5ebedcb4e27e7d902920aa3831ee8 \
- --hash=sha256:1cc81d14ddfa53d7f3906694d35d54d9d3f850ef8e4e99ee68bc0d1e5fed9a9c \
- --hash=sha256:1d815d48b1804ed7867b539236b6dd62997850ca1c91cad187f2ddb1b7bbef19 \
- --hash=sha256:1e6c15d2080a63aaed876e228efe4f814bc7889c63b1e112ad46fdc8b368b9e1 \
- --hash=sha256:20ab1ae4fa534f73647aad289003f1104092890849e0266271351922ed5574f8 \
- --hash=sha256:20dae58a859b0906f0685642e591056f1e787f3a8b39c8e8749a45dc7d26bdb0 \
- --hash=sha256:238e8c8610cb7c29460e37184f6799547f7e09e6a9bdbdab4e8edb90986a2318 \
- --hash=sha256:24a4146ccb15be237fdef10f331c568e1b0e505f8c8c9ed5d67759dac58ac246 \
- --hash=sha256:257d011919f133a4746958257f2c75238e3ff54255acd5e3e11f3ff41fd14256 \
- --hash=sha256:2a343f91b17097c546b93f7999976fd6c9d5900617aa848c81d794e062ab302b \
- --hash=sha256:2abe21d8ba64cded53a2a677e149ceb76dcf44284202d737178afe7ba540c1eb \
- --hash=sha256:2c03c9b0c64afd0320ae57de4c982801271c0c211aa2d37f3003ff5feb75bb04 \
- --hash=sha256:2c9c1b92b774b2e68d11193dc39620d62fd8ab33f0a3c77ecdabe19c179cdbc1 \
- --hash=sha256:3021933c2cb7def39d927b9862292e0f4c75a13d7de70eb0ab06efed4c508c19 \
- --hash=sha256:3100b3090269f3a7ea727b06a6080d4eb7439dca4c0e91a07c5d133bb1727ea7 \
- --hash=sha256:313cfcd6af1a55a286a3c9a25f64af6d0e46cf60bc5798f1db152d97a216ff6f \
- --hash=sha256:35e9a70a0f335371275cdcd08bc5b8051ac494dd58bff3bbfb421038220dc871 \
- --hash=sha256:38721d4c9edd3eb6670437d8d5e2070063f305bfa2d5aa4278c51cedcd508a84 \
- --hash=sha256:390e3170babf42462739a93321e657444f0862c6d722a291accc46f9d21ed04e \
- --hash=sha256:39bfea47c375f379d8e87ab4bb9eb2c836e4f2069f0f65731d85e55d74666387 \
- --hash=sha256:3ac51b65e8dc76cf4949419c54c5528adb24fc721df722fd452e5fbc236f5c40 \
- --hash=sha256:3c0909c5234543ada2515c05dc08595b08d621ba919629e94427e8e03539c958 \
- --hash=sha256:3da5852aad63fa0c6f836f3359647870e21ea96cf433eb393ffa45263a170d44 \
- --hash=sha256:3e1157659470aa42a75448b6e943c895be8c70531c43cb78b9ba990778955582 \
- --hash=sha256:4019a9d473c708cf2f16415688ef0b4639e07abaa569d72f74745bbeffafa2c7 \
- --hash=sha256:43f10b007033f359bc3fa9cd5e6c1e76723f056ffa9a6b5c117cc35720a80292 \
- --hash=sha256:49028aa684c144ea502a8e847d23aed5e4c2ef7cadfa7d5eaafcb40864844b7a \
- --hash=sha256:4916dc96489616a6f9667e7526af8fa693c0fdb4f3acb0e5d9f4400eb06a47ba \
- --hash=sha256:4a59e5bc386de021f56337f757301b337d7ab58baa40174fb150accd480bc953 \
- --hash=sha256:4b1f66eb81eab2e0ff5775a3a312e5e2e16bf758f7b06be82fb0d04078c7ac51 \
- --hash=sha256:4c5fe114a6dd480a510b6d3661d09d67d1622c4bf20660a474507aaee7eeeee9 \
- --hash=sha256:4c70c70f9169692b36307a95f3d8c0a9fcd79f7b4a383aad5eaa0e9718b79b37 \
- --hash=sha256:4d11382bcaf12f80b51d790dee295c56a159633a8e81e6323b16e55d81ae37e9 \
- --hash=sha256:4f01a5d6444a3258b00dc07b6ea4733e26f8072b788bef750baa37b370266137 \
- --hash=sha256:4f789e32fa1fb6a7bf890e0124e7b42d1e60d28ebff57fe806719abb75f0e9a3 \
- --hash=sha256:4feb7511c29f8442cbbc28149a92093d32e815a28aa2c50d333826ad2a20fdf0 \
- --hash=sha256:511d15193cbe013619dd05414c35a7dedf2088fcee93c6bbb7c77859765bd4e8 \
- --hash=sha256:519067e29f67b5c90e64fb1a6b6e9d2ec0ba28705c51956637bac23a2f4ddae1 \
- --hash=sha256:521ccf56f45bb3a791182dc6b88ae5f8fa079dd705ee42138c76deb1238e554e \
- --hash=sha256:529c8156d7506fba5740e05da8795688f87119cce330c244519cf706a4a3d618 \
- --hash=sha256:582462833ba7cee52e968b0341b85e392ae53d44c0f9af6a5927c80e539a8b67 \
- --hash=sha256:5963b72ccd199ade6ee493723d18a3f21ba7d5b957017607f815788cef50eaf1 \
- --hash=sha256:59b2093224a18c6508d95cfdeba8db9cbfd6f3494e94793b58972933fcee4c6d \
- --hash=sha256:5afaddaa8e8c7f1f7b4c5c725c0070b6eed0228f705b90a1732a48e84350f4e9 \
- --hash=sha256:5afea17ab3a126006dc2f293b14ffc7ef3c85336cf451564a0515ed7648033da \
- --hash=sha256:5e09330b21d98adc8ccb2dbb9fc6cb434e8908d4c119aeaa772cb1caab5440a0 \
- --hash=sha256:6188de70e190847bb6db3dc3981cbadff87d27d6fe9b4f0e18726d55795cee9b \
- --hash=sha256:68ffcf982715f5b5b7686bdd349ff75d422e8f22551000c24b30eaa1b7f7ae84 \
- --hash=sha256:696764a5be111b036256c0b18cd29783fab22154690fc698062fc1b0084b511d \
- --hash=sha256:69a607203441e07e9a8a529cff1d5b73f6a160f22db1097211e6212a68567d11 \
- --hash=sha256:69b312fecc1d017b5327afa81d4da1480f51c68810963a7336d92203dbb3d4f1 \
- --hash=sha256:69f0c0a3df7fd3a7eec50a00396104bb9a843ea6d45fcc31c2d5243446ffd7a7 \
- --hash=sha256:6a1cb5d6ce81379401bbb7f6dbe3d56de537fb8235979843f0d53bc2e9815a79 \
- --hash=sha256:6d3498ad0df07d81112aa6ec6c95a7e7b1ae00929fb73e7ebee0f3faaeabad2f \
- --hash=sha256:72a8d9564a717ee291f554eeb4bfeafe2309d5ec0aa6c475170bdab0f9ee8e88 \
- --hash=sha256:777c62479d12395bfb932944e61e915741e364c843afc3196b694db3d669fcd0 \
- --hash=sha256:77a7711fa562ba2da1aa757e11024ad6d93bad6ad7ede5afb9af144623e5f76a \
- --hash=sha256:79061ba1a11b6a12743a2b0f72a46aa2758613d454aa6ba4f5a265cc48850158 \
- --hash=sha256:7a48af25d9b3c15684059d0d1fc0bc30e8eee5ca521030e2bffddcab5be40226 \
- --hash=sha256:7ab504c4d654e4a29558eaa5bb8cea5fdc1703ea60a8099ffd9c758472cf913f \
- --hash=sha256:7bdb17009696214c3b66bb3590c6d62e14ac5935e53e929bcdbc5a495987a84f \
- --hash=sha256:7da84c2c74c0f5bc97d853d9e17bb83e2dcafcff0dc48286916001cc114379a1 \
- --hash=sha256:801a71f70f9813e82d2513c9a96532551fce1e278ec0c64610992c49c04c2dad \
- --hash=sha256:824e6d3503ab990d7090768e4dfd9e840837bae057f212ff9f4f05ec6d1975e7 \
- --hash=sha256:82b165b07f416bdccf5c84546a484cc8f15137ca38325403864bfdf2b5b72f6a \
- --hash=sha256:84cfbd4d4d2cdeb2be61a057a258d26b22877266dd905809e94172dff01a42ae \
- --hash=sha256:84d142d2d6cf9b31c12aa4878d82ed3b2324226270b89b676ac62ccd7df52d08 \
- --hash=sha256:87a5531de9f71aceb8af041d72fc4cab4943648d91875ed56d2e629bef6d4c03 \
- --hash=sha256:893b022bfbdf26d7bedb083efeea624e8550ca6eb98bf7fea30211ce95b9201a \
- --hash=sha256:894514d47e012e794f1350f076c427d2347ebf82f9b958d554d12819849a369d \
- --hash=sha256:8a7898b6ca3b7d6659e55cdac825a2e58c638cbf335cde41f4619e290dd0ad11 \
- --hash=sha256:8ad7fd2258228bf288f2331f0a6148ad0186b2e3643055ed0db30990e59817a6 \
- --hash=sha256:92c8db839367ef16a662478f0a2fe13e15f2227da3c1430a782ad0f6ee009ec9 \
- --hash=sha256:941c1cfdf4799d623cf3aa1d326a6b4fdb7a5799ee2687f3516738216d2262fb \
- --hash=sha256:9bc596b30f86dc6f0929499c9e574601679d0341a0108c25b9b358a042f51bca \
- --hash=sha256:9c55b0a669976cf258afd718de3d9ad1b7d1fe0a91cd1ab36f38b03d4d4aeaaf \
- --hash=sha256:9da4e873860ad5bab3291438525cae80169daecbfafe5657f7f5fb4d6b3f96b9 \
- --hash=sha256:9def736773fd56b305c0eef698be5192c77bfa30d55a0e5885f80126c4831a15 \
- --hash=sha256:9dfbe56b299cf5875b68eb6f0ebaadc9cac520a1989cac0db0765abfb3709c19 \
- --hash=sha256:9e851920caab2dbcae311fd28f4313c6953993893eb5c1bb367ec69d9a39e7ed \
- --hash=sha256:9e8cb77286025bdb21be2941d64ac6ca016130bfdcd228739e8ab137eb4406ed \
- --hash=sha256:a547e21c5610b7e9093d870be50682a6a6cf180d6da0f42c47c306073bfdbbf6 \
- --hash=sha256:a90a13408a7a856b87be8a9f008fff53c5080eea4e4180f6c2e546e4a972fb5d \
- --hash=sha256:a9a63785467b2d73635957d32a4f6e73d5e4df497a16a6392fa066b753e87387 \
- --hash=sha256:aa81873e2c8c5aa616ab8e017a481a96742fdf9313c40f14338ca7dbf50cb55f \
- --hash=sha256:ac64f4b2bdb4ea622175c9ab7cf09444e412e22c0e02e906978b3b488af5fde8 \
- --hash=sha256:aea1f9741b603a8d8fedb0ed5502c2bc0accbc51f43e2ad1337fe7259c2b77a5 \
- --hash=sha256:b0afb8cdd034150d4d9f53926226ed27ad15b7f465e93d7468caaf5eafae0d37 \
- --hash=sha256:b37a04d9f52cb76b6b78f35109b513f6519efb481d8ca4c321f6a3b9580b3f45 \
- --hash=sha256:b5f7a446ddaf6ca0fad9a5535b56fbfc29998bf0e0b450d174bbec0d600e1d72 \
- --hash=sha256:b6d9e5a2ed9c4988c8f9b28b3bc0e3e5b1aaa10c28d210a594ff3a8c02742daf \
- --hash=sha256:b6e2c12160c72aeda9d1283e612f68804621f448145a210f1bf1d79151c47090 \
- --hash=sha256:b818a592bd69bfe437ee8368603d4a2d928c34cffcdf77c2e761a759ffd17d20 \
- --hash=sha256:c1851f429b822831bd2edcbe0cfd12ee9ea77868f8d3daf267b189371671c80e \
- --hash=sha256:c1fb0cda2abcc0ac62f64e2ea4b4e64c57dfd6b885e693095460c61bde7bb18e \
- --hash=sha256:c5ab0ee51f560d179b057555b4f601b7df909ed31312d301b99f8b9fc6028284 \
- --hash=sha256:c70d9ec912802ecfd6cd390dadb34a9578b04f9bcb8e863d0a7598ba5e9e7ccc \
- --hash=sha256:c741107203954f6fc34d3066d213d0a0c40f7bb5aafd698fb39888af277c70d8 \
- --hash=sha256:ca3f059f4ba485d90c8dc75cb5ca897e15325e4e609812ce57f896607c1c0867 \
- --hash=sha256:caf51943715b12af827696ec395bfa68f090a4c1a1d2509eb4e2cb69abbbdb33 \
- --hash=sha256:cb28c1f569f8d33b2b5dcd05d0e6ef7005d8639c54c2f0be824f05aedf715255 \
- --hash=sha256:cdad4ea3b4513b475e027be79e5a0ceac8ee1c113a1a11e5edc3c30c29f964d8 \
- --hash=sha256:cf47cfdabc2194a669dcf7a8dbba62e37a04c5041d2125fae0233b720da6f05c \
- --hash=sha256:d04cab0a54b9dba4d278fe955a1390da3cf71f57feb78ddc7cb67cbe0bd30323 \
- --hash=sha256:d422b945683e409000c888e384546dbab9009bb92f7c0b456e217988cf316107 \
- --hash=sha256:d80bf832ac7b1920ee29a426cdca335f96a2b5caa839811803e999b41ba9030d \
- --hash=sha256:da619979df60a940cd434084355c514c25cf8eb4cf9a508510682f6c851a4f7a \
- --hash=sha256:dafd4c44b74aa4bed4b250f1aed165b8ef5de743bcca3b88fc9619b6087093d2 \
- --hash=sha256:dca83c498b4650a91efcf7b88d669b170256bf8017a5db6f3e06c2bf031f57e0 \
- --hash=sha256:de2713f48c1ad57f89ac25b3cb7daed2156d8e822cf0eca9b96a6f990718cc41 \
- --hash=sha256:de4ed93a8c91debfd5a047be327b7cc8b0cc6afe32a716bbbc4aedca9e2a83af \
- --hash=sha256:df52098cde6d5e02fa75c1f6244f07971773adb4a26625edd5c18fee906fa84d \
- --hash=sha256:dfbf280da5f876d0b00c81f26bedce274e72a678c28845453885a9b3c22ae632 \
- --hash=sha256:e3730a48e5622e598293eee0762b09cff34dd3f271530f47b0894891281f051d \
- --hash=sha256:e5162afc9e0d1f9cae3b577d9c29ddbab3505ab39012cb794d94a005825bde21 \
- --hash=sha256:e5d524d68a474a9688336045bbf76cb0def88549c1b2ad9dbfec1fb7cfbe9170 \
- --hash=sha256:e99685fc95d386da368013e7fb4269dd39c30d99f812a8372d62f244f662709c \
- --hash=sha256:ea89a2458a1a75f87caabefe789c87539ea4e43b40f18cff526052e35bbb4fdf \
- --hash=sha256:ec671691e72dff75817386aa02d81e708b5a7ec0dec6669ec05213ff6b77e1bd \
- --hash=sha256:eed5ac260dd545fbc20da5f4f15e7efe36a55e0e7cf706e4ec005b491a9546a0 \
- --hash=sha256:f14440b9573a6f76b4ee4770c13f0b5921f71dde3b6fcb8dabbefd13b7fe05d7 \
- --hash=sha256:f405c93675d8d4c5ac87364bb38d06c988e11028a64b52a47158a355079661f3 \
- --hash=sha256:f53ec51f9d24e9638a40cabb95078ade8c99251945dad8d57bf4aabe86ecee35 \
- --hash=sha256:f61a9326f80ca59214d1cceb0a09bb2ece5b2563d4e0cd37bfd5515c28510674 \
- --hash=sha256:f7bf2496fa563c046d05e4d232d7b7fd61346e2402052064b773e5c378bf6f73 \
- --hash=sha256:fbaa70553ca116c77717f513e08815aec458e6b69a028d4028d403b3bc84ff37 \
- --hash=sha256:fc3e55a7db08dc9a6ed5fb7103019d2c1a38a349ac41901f9f66d7f95750942f \
- --hash=sha256:fc921b96fa95a097add244da36a1d9e4f3039160d1d30f1b35837bf108c21136 \
- --hash=sha256:fd0641abca296bc1a00183fe44f7fced8807ed49d501f188faa642d0e4975b83 \
- --hash=sha256:feac1045b3327a45944e7dcbeb57530339f6b17baff154df51ef8b0da34c8c12 \
- --hash=sha256:ff110acded3c22c033e637dd8896e411c7d3a11289b2edf041f86663dbc791e9
+rpds-py==0.27.0 \
+ --hash=sha256:010c4843a3b92b54373e3d2291a7447d6c3fc29f591772cc2ea0e9f5c1da434b \
+ --hash=sha256:05284439ebe7d9f5f5a668d4d8a0a1d851d16f7d47c78e1fab968c8ad30cab04 \
+ --hash=sha256:0665be515767dc727ffa5f74bd2ef60b0ff85dad6bb8f50d91eaa6b5fb226f51 \
+ --hash=sha256:069e0384a54f427bd65d7fda83b68a90606a3835901aaff42185fcd94f5a9295 \
+ --hash=sha256:08680820d23df1df0a0260f714d12966bc6c42d02e8055a91d61e03f0c47dda0 \
+ --hash=sha256:0954e3a92e1d62e83a54ea7b3fdc9efa5d61acef8488a8a3d31fdafbfb00460d \
+ --hash=sha256:09965b314091829b378b60607022048953e25f0b396c2b70e7c4c81bcecf932e \
+ --hash=sha256:0c431bfb91478d7cbe368d0a699978050d3b112d7f1d440a41e90faa325557fd \
+ --hash=sha256:0f401c369186a5743694dd9fc08cba66cf70908757552e1f714bfc5219c655b5 \
+ --hash=sha256:0f4f69d7a4300fbf91efb1fb4916421bd57804c01ab938ab50ac9c4aa2212f03 \
+ --hash=sha256:11e8e28c0ba0373d052818b600474cfee2fafa6c9f36c8587d217b13ee28ca7d \
+ --hash=sha256:130c1ffa5039a333f5926b09e346ab335f0d4ec393b030a18549a7c7e7c2cea4 \
+ --hash=sha256:1321bce595ad70e80f97f998db37356b2e22cf98094eba6fe91782e626da2f71 \
+ --hash=sha256:13bbc4846ae4c993f07c93feb21a24d8ec637573d567a924b1001e81c8ae80f9 \
+ --hash=sha256:14f028eb47f59e9169bfdf9f7ceafd29dd64902141840633683d0bad5b04ff34 \
+ --hash=sha256:15ea4d2e182345dd1b4286593601d766411b43f868924afe297570658c31a62b \
+ --hash=sha256:181bc29e59e5e5e6e9d63b143ff4d5191224d355e246b5a48c88ce6b35c4e466 \
+ --hash=sha256:183f5e221ba3e283cd36fdfbe311d95cd87699a083330b4f792543987167eff1 \
+ --hash=sha256:184f0d7b342967f6cda94a07d0e1fae177d11d0b8f17d73e06e36ac02889f303 \
+ --hash=sha256:190d7285cd3bb6d31d37a0534d7359c1ee191eb194c511c301f32a4afa5a1dd4 \
+ --hash=sha256:19c990fdf5acecbf0623e906ae2e09ce1c58947197f9bced6bbd7482662231c4 \
+ --hash=sha256:1d66f45b9399036e890fb9c04e9f70c33857fd8f58ac8db9f3278cfa835440c3 \
+ --hash=sha256:203f581accef67300a942e49a37d74c12ceeef4514874c7cede21b012613ca2c \
+ --hash=sha256:20e222a44ae9f507d0f2678ee3dd0c45ec1e930f6875d99b8459631c24058aec \
+ --hash=sha256:2406d034635d1497c596c40c85f86ecf2bf9611c1df73d14078af8444fe48031 \
+ --hash=sha256:249ab91ceaa6b41abc5f19513cb95b45c6f956f6b89f1fe3d99c81255a849f9e \
+ --hash=sha256:25a4aebf8ca02bbb90a9b3e7a463bbf3bee02ab1c446840ca07b1695a68ce424 \
+ --hash=sha256:27bac29bbbf39601b2aab474daf99dbc8e7176ca3389237a23944b17f8913d97 \
+ --hash=sha256:299a245537e697f28a7511d01038c310ac74e8ea213c0019e1fc65f52c0dcb23 \
+ --hash=sha256:2cff9bdd6c7b906cc562a505c04a57d92e82d37200027e8d362518df427f96cd \
+ --hash=sha256:2e307cb5f66c59ede95c00e93cd84190a5b7f3533d7953690b2036780622ba81 \
+ --hash=sha256:2e39169ac6aae06dd79c07c8a69d9da867cef6a6d7883a0186b46bb46ccfb0c3 \
+ --hash=sha256:2fe6e18e5c8581f0361b35ae575043c7029d0a92cb3429e6e596c2cdde251432 \
+ --hash=sha256:3001013dae10f806380ba739d40dee11db1ecb91684febb8406a87c2ded23dae \
+ --hash=sha256:32196b5a99821476537b3f7732432d64d93a58d680a52c5e12a190ee0135d8b5 \
+ --hash=sha256:33ba649a6e55ae3808e4c39e01580dc9a9b0d5b02e77b66bb86ef117922b1264 \
+ --hash=sha256:341d8acb6724c0c17bdf714319c393bb27f6d23d39bc74f94221b3e59fc31828 \
+ --hash=sha256:343cf24de9ed6c728abefc5d5c851d5de06497caa7ac37e5e65dd572921ed1b5 \
+ --hash=sha256:36184b44bf60a480863e51021c26aca3dfe8dd2f5eeabb33622b132b9d8b8b54 \
+ --hash=sha256:3841f66c1ffdc6cebce8aed64e36db71466f1dc23c0d9a5592e2a782a3042c79 \
+ --hash=sha256:4045e2fc4b37ec4b48e8907a5819bdd3380708c139d7cc358f03a3653abedb89 \
+ --hash=sha256:419dd9c98bcc9fb0242be89e0c6e922df333b975d4268faa90d58499fd9c9ebe \
+ --hash=sha256:42894616da0fc0dcb2ec08a77896c3f56e9cb2f4b66acd76fc8992c3557ceb1c \
+ --hash=sha256:42ccc57ff99166a55a59d8c7d14f1a357b7749f9ed3584df74053fd098243451 \
+ --hash=sha256:4300e15e7d03660f04be84a125d1bdd0e6b2f674bc0723bc0fd0122f1a4585dc \
+ --hash=sha256:443d239d02d9ae55b74015234f2cd8eb09e59fbba30bf60baeb3123ad4c6d5ff \
+ --hash=sha256:44524b96481a4c9b8e6c46d6afe43fa1fb485c261e359fbe32b63ff60e3884d8 \
+ --hash=sha256:45d04a73c54b6a5fd2bab91a4b5bc8b426949586e61340e212a8484919183859 \
+ --hash=sha256:46f48482c1a4748ab2773f75fffbdd1951eb59794e32788834b945da857c47a8 \
+ --hash=sha256:4790c9d5dd565ddb3e9f656092f57268951398cef52e364c405ed3112dc7c7c1 \
+ --hash=sha256:4bc262ace5a1a7dc3e2eac2fa97b8257ae795389f688b5adf22c5db1e2431c43 \
+ --hash=sha256:4c3f8a0d4802df34fcdbeb3dfe3a4d8c9a530baea8fafdf80816fcaac5379d83 \
+ --hash=sha256:5355527adaa713ab693cbce7c1e0ec71682f599f61b128cf19d07e5c13c9b1f1 \
+ --hash=sha256:555ed147cbe8c8f76e72a4c6cd3b7b761cbf9987891b9448808148204aed74a5 \
+ --hash=sha256:55d42a0ef2bdf6bc81e1cc2d49d12460f63c6ae1423c4f4851b828e454ccf6f1 \
+ --hash=sha256:59195dc244fc183209cf8a93406889cadde47dfd2f0a6b137783aa9c56d67c85 \
+ --hash=sha256:59714ab0a5af25d723d8e9816638faf7f4254234decb7d212715c1aa71eee7be \
+ --hash=sha256:5b3a5c8089eed498a3af23ce87a80805ff98f6ef8f7bdb70bd1b7dae5105f6ac \
+ --hash=sha256:5d6790ff400254137b81b8053b34417e2c46921e302d655181d55ea46df58cf7 \
+ --hash=sha256:5df559e9e7644d9042f626f2c3997b555f347d7a855a15f170b253f6c5bfe358 \
+ --hash=sha256:5fa01b3d5e3b7d97efab65bd3d88f164e289ec323a8c033c5c38e53ee25c007e \
+ --hash=sha256:61490d57e82e23b45c66f96184237994bfafa914433b8cd1a9bb57fecfced59d \
+ --hash=sha256:6168af0be75bba990a39f9431cdfae5f0ad501f4af32ae62e8856307200517b8 \
+ --hash=sha256:64a0fe3f334a40b989812de70160de6b0ec7e3c9e4a04c0bbc48d97c5d3600ae \
+ --hash=sha256:64f689ab822f9b5eb6dfc69893b4b9366db1d2420f7db1f6a2adf2a9ca15ad64 \
+ --hash=sha256:699c346abc73993962cac7bb4f02f58e438840fa5458a048d3a178a7a670ba86 \
+ --hash=sha256:6b96b0b784fe5fd03beffff2b1533dc0d85e92bab8d1b2c24ef3a5dc8fac5669 \
+ --hash=sha256:6bde37765564cd22a676dd8101b657839a1854cfaa9c382c5abf6ff7accfd4ae \
+ --hash=sha256:6c135708e987f46053e0a1246a206f53717f9fadfba27174a9769ad4befba5c3 \
+ --hash=sha256:6c27a7054b5224710fcfb1a626ec3ff4f28bcb89b899148c72873b18210e446b \
+ --hash=sha256:6de6a7f622860af0146cb9ee148682ff4d0cea0b8fd3ad51ce4d40efb2f061d0 \
+ --hash=sha256:737005088449ddd3b3df5a95476ee1c2c5c669f5c30eed909548a92939c0e12d \
+ --hash=sha256:7451ede3560086abe1aa27dcdcf55cd15c96b56f543fb12e5826eee6f721f858 \
+ --hash=sha256:7873b65686a6471c0037139aa000d23fe94628e0daaa27b6e40607c90e3f5ec4 \
+ --hash=sha256:79af163a4b40bbd8cfd7ca86ec8b54b81121d3b213b4435ea27d6568bcba3e9d \
+ --hash=sha256:7aed8118ae20515974650d08eb724150dc2e20c2814bcc307089569995e88a14 \
+ --hash=sha256:7cf9bc4508efb18d8dff6934b602324eb9f8c6644749627ce001d6f38a490889 \
+ --hash=sha256:7e57906e38583a2cba67046a09c2637e23297618dc1f3caddbc493f2be97c93f \
+ --hash=sha256:7ec85994f96a58cf7ed288caa344b7fe31fd1d503bdf13d7331ead5f70ab60d5 \
+ --hash=sha256:81f81bbd7cdb4bdc418c09a73809abeda8f263a6bf8f9c7f93ed98b5597af39d \
+ --hash=sha256:86aca1616922b40d8ac1b3073a1ead4255a2f13405e5700c01f7c8d29a03972d \
+ --hash=sha256:88051c3b7d5325409f433c5a40328fcb0685fc04e5db49ff936e910901d10114 \
+ --hash=sha256:887ab1f12b0d227e9260558a4a2320024b20102207ada65c43e1ffc4546df72e \
+ --hash=sha256:8a06aa1197ec0281eb1d7daf6073e199eb832fe591ffa329b88bae28f25f5fe5 \
+ --hash=sha256:8a1dca5507fa1337f75dcd5070218b20bc68cf8844271c923c1b79dfcbc20391 \
+ --hash=sha256:8b23cf252f180cda89220b378d917180f29d313cd6a07b2431c0d3b776aae86f \
+ --hash=sha256:8d0e09cf4863c74106b5265c2c310f36146e2b445ff7b3018a56799f28f39f6f \
+ --hash=sha256:8de567dec6d451649a781633d36f5c7501711adee329d76c095be2178855b042 \
+ --hash=sha256:90fb790138c1a89a2e58c9282fe1089638401f2f3b8dddd758499041bc6e0774 \
+ --hash=sha256:92f3b3ec3e6008a1fe00b7c0946a170f161ac00645cde35e3c9a68c2475e8156 \
+ --hash=sha256:935afcdea4751b0ac918047a2df3f720212892347767aea28f5b3bf7be4f27c0 \
+ --hash=sha256:9a0ff7ee28583ab30a52f371b40f54e7138c52ca67f8ca17ccb7ccf0b383cb5f \
+ --hash=sha256:9ad08547995a57e74fea6abaf5940d399447935faebbd2612b3b0ca6f987946b \
+ --hash=sha256:9b2a4e17bfd68536c3b801800941c95a1d4a06e3cada11c146093ba939d9638d \
+ --hash=sha256:9b78430703cfcf5f5e86eb74027a1ed03a93509273d7c705babb547f03e60016 \
+ --hash=sha256:9d0f92b78cfc3b74a42239fdd8c1266f4715b573204c234d2f9fc3fc7a24f185 \
+ --hash=sha256:9da162b718b12c4219eeeeb68a5b7552fbc7aadedf2efee440f88b9c0e54b45d \
+ --hash=sha256:a00c91104c173c9043bc46f7b30ee5e6d2f6b1149f11f545580f5d6fdff42c0b \
+ --hash=sha256:a029be818059870664157194e46ce0e995082ac49926f1423c1f058534d2aaa9 \
+ --hash=sha256:a1b3db5fae5cbce2131b7420a3f83553d4d89514c03d67804ced36161fe8b6b2 \
+ --hash=sha256:a4cf32a26fa744101b67bfd28c55d992cd19438aff611a46cac7f066afca8fd4 \
+ --hash=sha256:aa0bf113d15e8abdfee92aa4db86761b709a09954083afcb5bf0f952d6065fdb \
+ --hash=sha256:ab47fe727c13c09d0e6f508e3a49e545008e23bf762a245b020391b621f5b726 \
+ --hash=sha256:af22763a0a1eff106426a6e1f13c4582e0d0ad89c1493ab6c058236174cd6c6a \
+ --hash=sha256:af9d4fd79ee1cc8e7caf693ee02737daabfc0fcf2773ca0a4735b356c8ad6f7c \
+ --hash=sha256:b1fef1f13c842a39a03409e30ca0bf87b39a1e2a305a9924deadb75a43105d23 \
+ --hash=sha256:b2eff8ee57c5996b0d2a07c3601fb4ce5fbc37547344a26945dd9e5cbd1ed27a \
+ --hash=sha256:b4c4fbbcff474e1e5f38be1bf04511c03d492d42eec0babda5d03af3b5589374 \
+ --hash=sha256:b8a4131698b6992b2a56015f51646711ec5d893a0b314a4b985477868e240c87 \
+ --hash=sha256:b8a7acf04fda1f30f1007f3cc96d29d8cf0a53e626e4e1655fdf4eabc082d367 \
+ --hash=sha256:ba783541be46f27c8faea5a6645e193943c17ea2f0ffe593639d906a327a9bcc \
+ --hash=sha256:be0744661afbc4099fef7f4e604e7f1ea1be1dd7284f357924af12a705cc7d5c \
+ --hash=sha256:be3964f7312ea05ed283b20f87cb533fdc555b2e428cc7be64612c0b2124f08c \
+ --hash=sha256:be806e2961cd390a89d6c3ce8c2ae34271cfcd05660f716257838bb560f1c3b6 \
+ --hash=sha256:bec77545d188f8bdd29d42bccb9191682a46fb2e655e3d1fb446d47c55ac3b8d \
+ --hash=sha256:c10d92fb6d7fd827e44055fcd932ad93dac6a11e832d51534d77b97d1d85400f \
+ --hash=sha256:c3782fb753aa825b4ccabc04292e07897e2fd941448eabf666856c5530277626 \
+ --hash=sha256:c9ce7a9e967afc0a2af7caa0d15a3e9c1054815f73d6a8cb9225b61921b419bd \
+ --hash=sha256:cb0702c12983be3b2fab98ead349ac63a98216d28dda6f518f52da5498a27a1b \
+ --hash=sha256:cbc619e84a5e3ab2d452de831c88bdcad824414e9c2d28cd101f94dbdf26329c \
+ --hash=sha256:ce4ed8e0c7dbc5b19352b9c2c6131dd23b95fa8698b5cdd076307a33626b72dc \
+ --hash=sha256:ce96ab0bdfcef1b8c371ada2100767ace6804ea35aacce0aef3aeb4f3f499ca8 \
+ --hash=sha256:cf824aceaeffff029ccfba0da637d432ca71ab21f13e7f6f5179cd88ebc77a8a \
+ --hash=sha256:d2a81bdcfde4245468f7030a75a37d50400ac2455c3a4819d9d550c937f90ab5 \
+ --hash=sha256:d2cc2b34f9e1d31ce255174da82902ad75bd7c0d88a33df54a77a22f2ef421ee \
+ --hash=sha256:d2f184336bc1d6abfaaa1262ed42739c3789b1e3a65a29916a615307d22ffd2e \
+ --hash=sha256:d3c622c39f04d5751408f5b801ecb527e6e0a471b367f420a877f7a660d583f6 \
+ --hash=sha256:d7cf5e726b6fa977e428a61880fb108a62f28b6d0c7ef675b117eaff7076df49 \
+ --hash=sha256:d85d784c619370d9329bbd670f41ff5f2ae62ea4519761b679d0f57f0f0ee267 \
+ --hash=sha256:d93ebdb82363d2e7bec64eecdc3632b59e84bd270d74fe5be1659f7787052f9b \
+ --hash=sha256:db8a6313dbac934193fc17fe7610f70cd8181c542a91382531bef5ed785e5615 \
+ --hash=sha256:dbc2ab5d10544eb485baa76c63c501303b716a5c405ff2469a1d8ceffaabf622 \
+ --hash=sha256:dbd749cff1defbde270ca346b69b3baf5f1297213ef322254bf2a28537f0b046 \
+ --hash=sha256:dc662bc9375a6a394b62dfd331874c434819f10ee3902123200dbcf116963f89 \
+ --hash=sha256:dc6b0d5a1ea0318ef2def2b6a55dccf1dcaf77d605672347271ed7b829860765 \
+ --hash=sha256:dc79d192fb76fc0c84f2c58672c17bbbc383fd26c3cdc29daae16ce3d927e8b2 \
+ --hash=sha256:dd2c1d27ebfe6a015cfa2005b7fe8c52d5019f7bbdd801bc6f7499aab9ae739e \
+ --hash=sha256:dea0808153f1fbbad772669d906cddd92100277533a03845de6893cadeffc8be \
+ --hash=sha256:e0d7151a1bd5d0a203a5008fc4ae51a159a610cb82ab0a9b2c4d80241745582e \
+ --hash=sha256:e14aab02258cb776a108107bd15f5b5e4a1bbaa61ef33b36693dfab6f89d54f9 \
+ --hash=sha256:e24d8031a2c62f34853756d9208eeafa6b940a1efcbfe36e8f57d99d52bb7261 \
+ --hash=sha256:e36c80c49853b3ffda7aa1831bf175c13356b210c73128c861f3aa93c3cc4015 \
+ --hash=sha256:e377e4cf8795cdbdff75b8f0223d7b6c68ff4fef36799d88ccf3a995a91c0112 \
+ --hash=sha256:e3acb9c16530362aeaef4e84d57db357002dc5cbfac9a23414c3e73c08301ab2 \
+ --hash=sha256:e3dc8d4ede2dbae6c0fc2b6c958bf51ce9fd7e9b40c0f5b8835c3fde44f5807d \
+ --hash=sha256:e6491658dd2569f05860bad645569145c8626ac231877b0fb2d5f9bcb7054089 \
+ --hash=sha256:eb91d252b35004a84670dfeafadb042528b19842a0080d8b53e5ec1128e8f433 \
+ --hash=sha256:f0396e894bd1e66c74ecbc08b4f6a03dc331140942c4b1d345dd131b68574a60 \
+ --hash=sha256:f09c9d4c26fa79c1bad927efb05aca2391350b8e61c38cbc0d7d3c814e463124 \
+ --hash=sha256:f3cd110e02c5bf17d8fb562f6c9df5c20e73029d587cf8602a2da6c5ef1e32cb \
+ --hash=sha256:f7a37dd208f0d658e0487522078b1ed68cd6bce20ef4b5a915d2809b9094b410 \
+ --hash=sha256:fae4a01ef8c4cb2bbe92ef2063149596907dc4a881a8d26743b3f6b304713171 \
+ --hash=sha256:fc327f4497b7087d06204235199daf208fd01c82d80465dc5efa4ec9df1c5b4e \
+ --hash=sha256:fcc01c57ce6e70b728af02b2401c5bc853a9e14eb07deda30624374f0aebfe42 \
+ --hash=sha256:fde355b02934cc6b07200cc3b27ab0c15870a757d1a72fd401aa92e2ea3c6bfe
# via
# jsonschema
# referencing
@@ -609,183 +611,187 @@ urllib3==2.5.0 \
# docker
# pygithub
# requests
-wrapt==1.17.2 \
- --hash=sha256:08e7ce672e35efa54c5024936e559469436f8b8096253404faeb54d2a878416f \
- --hash=sha256:0a6e821770cf99cc586d33833b2ff32faebdbe886bd6322395606cf55153246c \
- --hash=sha256:0b929ac182f5ace000d459c59c2c9c33047e20e935f8e39371fa6e3b85d56f4a \
- --hash=sha256:129a150f5c445165ff941fc02ee27df65940fcb8a22a61828b1853c98763a64b \
- --hash=sha256:13e6afb7fe71fe7485a4550a8844cc9ffbe263c0f1a1eea569bc7091d4898555 \
- --hash=sha256:1473400e5b2733e58b396a04eb7f35f541e1fb976d0c0724d0223dd607e0f74c \
- --hash=sha256:18983c537e04d11cf027fbb60a1e8dfd5190e2b60cc27bc0808e653e7b218d1b \
- --hash=sha256:1a7ed2d9d039bd41e889f6fb9364554052ca21ce823580f6a07c4ec245c1f5d6 \
- --hash=sha256:1e1fe0e6ab7775fd842bc39e86f6dcfc4507ab0ffe206093e76d61cde37225c8 \
- --hash=sha256:1fb5699e4464afe5c7e65fa51d4f99e0b2eadcc176e4aa33600a3df7801d6662 \
- --hash=sha256:2696993ee1eebd20b8e4ee4356483c4cb696066ddc24bd70bcbb80fa56ff9061 \
- --hash=sha256:35621ae4c00e056adb0009f8e86e28eb4a41a4bfa8f9bfa9fca7d343fe94f998 \
- --hash=sha256:36ccae62f64235cf8ddb682073a60519426fdd4725524ae38874adf72b5f2aeb \
- --hash=sha256:3cedbfa9c940fdad3e6e941db7138e26ce8aad38ab5fe9dcfadfed9db7a54e62 \
- --hash=sha256:3d57c572081fed831ad2d26fd430d565b76aa277ed1d30ff4d40670b1c0dd984 \
- --hash=sha256:3fc7cb4c1c744f8c05cd5f9438a3caa6ab94ce8344e952d7c45a8ed59dd88392 \
- --hash=sha256:4011d137b9955791f9084749cba9a367c68d50ab8d11d64c50ba1688c9b457f2 \
- --hash=sha256:40d615e4fe22f4ad3528448c193b218e077656ca9ccb22ce2cb20db730f8d306 \
- --hash=sha256:410a92fefd2e0e10d26210e1dfb4a876ddaf8439ef60d6434f21ef8d87efc5b7 \
- --hash=sha256:41388e9d4d1522446fe79d3213196bd9e3b301a336965b9e27ca2788ebd122f3 \
- --hash=sha256:468090021f391fe0056ad3e807e3d9034e0fd01adcd3bdfba977b6fdf4213ea9 \
- --hash=sha256:49703ce2ddc220df165bd2962f8e03b84c89fee2d65e1c24a7defff6f988f4d6 \
- --hash=sha256:4a721d3c943dae44f8e243b380cb645a709ba5bd35d3ad27bc2ed947e9c68192 \
- --hash=sha256:4afd5814270fdf6380616b321fd31435a462019d834f83c8611a0ce7484c7317 \
- --hash=sha256:4c82b8785d98cdd9fed4cac84d765d234ed3251bd6afe34cb7ac523cb93e8b4f \
- --hash=sha256:4db983e7bca53819efdbd64590ee96c9213894272c776966ca6306b73e4affda \
- --hash=sha256:582530701bff1dec6779efa00c516496968edd851fba224fbd86e46cc6b73563 \
- --hash=sha256:58455b79ec2661c3600e65c0a716955adc2410f7383755d537584b0de41b1d8a \
- --hash=sha256:58705da316756681ad3c9c73fd15499aa4d8c69f9fd38dc8a35e06c12468582f \
- --hash=sha256:5bb1d0dbf99411f3d871deb6faa9aabb9d4e744d67dcaaa05399af89d847a91d \
- --hash=sha256:5c803c401ea1c1c18de70a06a6f79fcc9c5acfc79133e9869e730ad7f8ad8ef9 \
- --hash=sha256:5cbabee4f083b6b4cd282f5b817a867cf0b1028c54d445b7ec7cfe6505057cf8 \
- --hash=sha256:612dff5db80beef9e649c6d803a8d50c409082f1fedc9dbcdfde2983b2025b82 \
- --hash=sha256:62c2caa1585c82b3f7a7ab56afef7b3602021d6da34fbc1cf234ff139fed3cd9 \
- --hash=sha256:69606d7bb691b50a4240ce6b22ebb319c1cfb164e5f6569835058196e0f3a845 \
- --hash=sha256:6d9187b01bebc3875bac9b087948a2bccefe464a7d8f627cf6e48b1bbae30f82 \
- --hash=sha256:6ed6ffac43aecfe6d86ec5b74b06a5be33d5bb9243d055141e8cabb12aa08125 \
- --hash=sha256:703919b1633412ab54bcf920ab388735832fdcb9f9a00ae49387f0fe67dad504 \
- --hash=sha256:766d8bbefcb9e00c3ac3b000d9acc51f1b399513f44d77dfe0eb026ad7c9a19b \
- --hash=sha256:80dd7db6a7cb57ffbc279c4394246414ec99537ae81ffd702443335a61dbf3a7 \
- --hash=sha256:8112e52c5822fc4253f3901b676c55ddf288614dc7011634e2719718eaa187dc \
- --hash=sha256:8c8b293cd65ad716d13d8dd3624e42e5a19cc2a2f1acc74b30c2c13f15cb61a6 \
- --hash=sha256:8fdbdb757d5390f7c675e558fd3186d590973244fab0c5fe63d373ade3e99d40 \
- --hash=sha256:91bd7d1773e64019f9288b7a5101f3ae50d3d8e6b1de7edee9c2ccc1d32f0c0a \
- --hash=sha256:95c658736ec15602da0ed73f312d410117723914a5c91a14ee4cdd72f1d790b3 \
- --hash=sha256:99039fa9e6306880572915728d7f6c24a86ec57b0a83f6b2491e1d8ab0235b9a \
- --hash=sha256:9a2bce789a5ea90e51a02dfcc39e31b7f1e662bc3317979aa7e5538e3a034f72 \
- --hash=sha256:9a7d15bbd2bc99e92e39f49a04653062ee6085c0e18b3b7512a4f2fe91f2d681 \
- --hash=sha256:9abc77a4ce4c6f2a3168ff34b1da9b0f311a8f1cfd694ec96b0603dff1c79438 \
- --hash=sha256:9e8659775f1adf02eb1e6f109751268e493c73716ca5761f8acb695e52a756ae \
- --hash=sha256:9fee687dce376205d9a494e9c121e27183b2a3df18037f89d69bd7b35bcf59e2 \
- --hash=sha256:a5aaeff38654462bc4b09023918b7f21790efb807f54c000a39d41d69cf552cb \
- --hash=sha256:a604bf7a053f8362d27eb9fefd2097f82600b856d5abe996d623babd067b1ab5 \
- --hash=sha256:abbb9e76177c35d4e8568e58650aa6926040d6a9f6f03435b7a522bf1c487f9a \
- --hash=sha256:acc130bc0375999da18e3d19e5a86403667ac0c4042a094fefb7eec8ebac7cf3 \
- --hash=sha256:b18f2d1533a71f069c7f82d524a52599053d4c7166e9dd374ae2136b7f40f7c8 \
- --hash=sha256:b4e42a40a5e164cbfdb7b386c966a588b1047558a990981ace551ed7e12ca9c2 \
- --hash=sha256:b5e251054542ae57ac7f3fba5d10bfff615b6c2fb09abeb37d2f1463f841ae22 \
- --hash=sha256:b60fb58b90c6d63779cb0c0c54eeb38941bae3ecf7a73c764c52c88c2dcb9d72 \
- --hash=sha256:b870b5df5b71d8c3359d21be8f0d6c485fa0ebdb6477dda51a1ea54a9b558061 \
- --hash=sha256:ba0f0eb61ef00ea10e00eb53a9129501f52385c44853dbd6c4ad3f403603083f \
- --hash=sha256:bb87745b2e6dc56361bfde481d5a378dc314b252a98d7dd19a651a3fa58f24a9 \
- --hash=sha256:bb90fb8bda722a1b9d48ac1e6c38f923ea757b3baf8ebd0c82e09c5c1a0e7a04 \
- --hash=sha256:bc570b5f14a79734437cb7b0500376b6b791153314986074486e0b0fa8d71d98 \
- --hash=sha256:c86563182421896d73858e08e1db93afdd2b947a70064b813d515d66549e15f9 \
- --hash=sha256:c958bcfd59bacc2d0249dcfe575e71da54f9dcf4a8bdf89c4cb9a68a1170d73f \
- --hash=sha256:d18a4865f46b8579d44e4fe1e2bcbc6472ad83d98e22a26c963d46e4c125ef0b \
- --hash=sha256:d5e2439eecc762cd85e7bd37161d4714aa03a33c5ba884e26c81559817ca0925 \
- --hash=sha256:e3890b508a23299083e065f435a492b5435eba6e304a7114d2f919d400888cc6 \
- --hash=sha256:e496a8ce2c256da1eb98bd15803a79bee00fc351f5dfb9ea82594a3f058309e0 \
- --hash=sha256:e8b2816ebef96d83657b56306152a93909a83f23994f4b30ad4573b00bd11bb9 \
- --hash=sha256:eaf675418ed6b3b31c7a989fd007fa7c3be66ce14e5c3b27336383604c9da85c \
- --hash=sha256:ec89ed91f2fa8e3f52ae53cd3cf640d6feff92ba90d62236a81e4e563ac0e991 \
- --hash=sha256:ecc840861360ba9d176d413a5489b9a0aff6d6303d7e733e2c4623cfa26904a6 \
- --hash=sha256:f09b286faeff3c750a879d336fb6d8713206fc97af3adc14def0cdd349df6000 \
- --hash=sha256:f393cda562f79828f38a819f4788641ac7c4085f30f1ce1a68672baa686482bb \
- --hash=sha256:f917c1180fdb8623c2b75a99192f4025e412597c50b2ac870f156de8fb101119 \
- --hash=sha256:fc78a84e2dfbc27afe4b2bd7c80c8db9bca75cc5b85df52bfe634596a1da846b \
- --hash=sha256:ff04ef6eec3eee8a5efef2401495967a916feaa353643defcc03fc74fe213b58
+wrapt==1.17.3 \
+ --hash=sha256:02b551d101f31694fc785e58e0720ef7d9a10c4e62c1c9358ce6f63f23e30a56 \
+ --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828 \
+ --hash=sha256:0610b46293c59a3adbae3dee552b648b984176f8562ee0dba099a56cfbe4df1f \
+ --hash=sha256:0b02e424deef65c9f7326d8c19220a2c9040c51dc165cddb732f16198c168396 \
+ --hash=sha256:0b1831115c97f0663cb77aa27d381237e73ad4f721391a9bfb2fe8bc25fa6e77 \
+ --hash=sha256:0ed61b7c2d49cee3c027372df5809a59d60cf1b6c2f81ee980a091f3afed6a2d \
+ --hash=sha256:0f5f51a6466667a5a356e6381d362d259125b57f059103dd9fdc8c0cf1d14139 \
+ --hash=sha256:16ecf15d6af39246fe33e507105d67e4b81d8f8d2c6598ff7e3ca1b8a37213f7 \
+ --hash=sha256:1f0b2f40cf341ee8cc1a97d51ff50dddb9fcc73241b9143ec74b30fc4f44f6cb \
+ --hash=sha256:1f23fa283f51c890eda8e34e4937079114c74b4c81d2b2f1f1d94948f5cc3d7f \
+ --hash=sha256:223db574bb38637e8230eb14b185565023ab624474df94d2af18f1cdb625216f \
+ --hash=sha256:249f88ed15503f6492a71f01442abddd73856a0032ae860de6d75ca62eed8067 \
+ --hash=sha256:24c2ed34dc222ed754247a2702b1e1e89fdbaa4016f324b4b8f1a802d4ffe87f \
+ --hash=sha256:273a736c4645e63ac582c60a56b0acb529ef07f78e08dc6bfadf6a46b19c0da7 \
+ --hash=sha256:281262213373b6d5e4bb4353bc36d1ba4084e6d6b5d242863721ef2bf2c2930b \
+ --hash=sha256:30ce38e66630599e1193798285706903110d4f057aab3168a34b7fdc85569afc \
+ --hash=sha256:33486899acd2d7d3066156b03465b949da3fd41a5da6e394ec49d271baefcf05 \
+ --hash=sha256:343e44b2a8e60e06a7e0d29c1671a0d9951f59174f3709962b5143f60a2a98bd \
+ --hash=sha256:373342dd05b1d07d752cecbec0c41817231f29f3a89aa8b8843f7b95992ed0c7 \
+ --hash=sha256:3af60380ba0b7b5aeb329bc4e402acd25bd877e98b3727b0135cb5c2efdaefe9 \
+ --hash=sha256:3e62d15d3cfa26e3d0788094de7b64efa75f3a53875cdbccdf78547aed547a81 \
+ --hash=sha256:41b1d2bc74c2cac6f9074df52b2efbef2b30bdfe5f40cb78f8ca22963bc62977 \
+ --hash=sha256:423ed5420ad5f5529db9ce89eac09c8a2f97da18eb1c870237e84c5a5c2d60aa \
+ --hash=sha256:46acc57b331e0b3bcb3e1ca3b421d65637915cfcd65eb783cb2f78a511193f9b \
+ --hash=sha256:4da9f45279fff3543c371d5ababc57a0384f70be244de7759c85a7f989cb4ebe \
+ --hash=sha256:507553480670cab08a800b9463bdb881b2edeed77dc677b0a5915e6106e91a58 \
+ --hash=sha256:53e5e39ff71b3fc484df8a522c933ea2b7cdd0d5d15ae82e5b23fde87d44cbd8 \
+ --hash=sha256:54a30837587c6ee3cd1a4d1c2ec5d24e77984d44e2f34547e2323ddb4e22eb77 \
+ --hash=sha256:5531d911795e3f935a9c23eb1c8c03c211661a5060aab167065896bbf62a5f85 \
+ --hash=sha256:55cbbc356c2842f39bcc553cf695932e8b30e30e797f961860afb308e6b1bb7c \
+ --hash=sha256:59923aa12d0157f6b82d686c3fd8e1166fa8cdfb3e17b42ce3b6147ff81528df \
+ --hash=sha256:5a03a38adec8066d5a37bea22f2ba6bbf39fcdefbe2d91419ab864c3fb515454 \
+ --hash=sha256:5a7b3c1ee8265eb4c8f1b7d29943f195c00673f5ab60c192eba2d4a7eae5f46a \
+ --hash=sha256:5d4478d72eb61c36e5b446e375bbc49ed002430d17cdec3cecb36993398e1a9e \
+ --hash=sha256:5ea5eb3c0c071862997d6f3e02af1d055f381b1d25b286b9d6644b79db77657c \
+ --hash=sha256:604d076c55e2fdd4c1c03d06dc1a31b95130010517b5019db15365ec4a405fc6 \
+ --hash=sha256:656873859b3b50eeebe6db8b1455e99d90c26ab058db8e427046dbc35c3140a5 \
+ --hash=sha256:65d1d00fbfb3ea5f20add88bbc0f815150dbbde3b026e6c24759466c8b5a9ef9 \
+ --hash=sha256:6b538e31eca1a7ea4605e44f81a48aa24c4632a277431a6ed3f328835901f4fd \
+ --hash=sha256:6fd1ad24dc235e4ab88cda009e19bf347aabb975e44fd5c2fb22a3f6e4141277 \
+ --hash=sha256:70d86fa5197b8947a2fa70260b48e400bf2ccacdcab97bb7de47e3d1e6312225 \
+ --hash=sha256:7171ae35d2c33d326ac19dd8facb1e82e5fd04ef8c6c0e394d7af55a55051c22 \
+ --hash=sha256:73d496de46cd2cdbdbcce4ae4bcdb4afb6a11234a1df9c085249d55166b95116 \
+ --hash=sha256:7425ac3c54430f5fc5e7b6f41d41e704db073309acfc09305816bc6a0b26bb16 \
+ --hash=sha256:74afa28374a3c3a11b3b5e5fca0ae03bef8450d6aa3ab3a1e2c30e3a75d023dc \
+ --hash=sha256:758895b01d546812d1f42204bd443b8c433c44d090248bf22689df673ccafe00 \
+ --hash=sha256:79573c24a46ce11aab457b472efd8d125e5a51da2d1d24387666cd85f54c05b2 \
+ --hash=sha256:7e18f01b0c3e4a07fe6dfdb00e29049ba17eadbc5e7609a2a3a4af83ab7d710a \
+ --hash=sha256:88547535b787a6c9ce4086917b6e1d291aa8ed914fdd3a838b3539dc95c12804 \
+ --hash=sha256:88bbae4d40d5a46142e70d58bf664a89b6b4befaea7b2ecc14e03cedb8e06c04 \
+ --hash=sha256:8cccf4f81371f257440c88faed6b74f1053eef90807b77e31ca057b2db74edb1 \
+ --hash=sha256:9baa544e6acc91130e926e8c802a17f3b16fbea0fd441b5a60f5cf2cc5c3deba \
+ --hash=sha256:a36692b8491d30a8c75f1dfee65bef119d6f39ea84ee04d9f9311f83c5ad9390 \
+ --hash=sha256:a47681378a0439215912ef542c45a783484d4dd82bac412b71e59cf9c0e1cea0 \
+ --hash=sha256:a7c06742645f914f26c7f1fa47b8bc4c91d222f76ee20116c43d5ef0912bba2d \
+ --hash=sha256:a9a2203361a6e6404f80b99234fe7fb37d1fc73487b5a78dc1aa5b97201e0f22 \
+ --hash=sha256:ab232e7fdb44cdfbf55fc3afa31bcdb0d8980b9b95c38b6405df2acb672af0e0 \
+ --hash=sha256:ad85e269fe54d506b240d2d7b9f5f2057c2aa9a2ea5b32c66f8902f768117ed2 \
+ --hash=sha256:af338aa93554be859173c39c85243970dc6a289fa907402289eeae7543e1ae18 \
+ --hash=sha256:afd964fd43b10c12213574db492cb8f73b2f0826c8df07a68288f8f19af2ebe6 \
+ --hash=sha256:b32888aad8b6e68f83a8fdccbf3165f5469702a7544472bdf41f582970ed3311 \
+ --hash=sha256:c31eebe420a9a5d2887b13000b043ff6ca27c452a9a22fa71f35f118e8d4bf89 \
+ --hash=sha256:caea3e9c79d5f0d2c6d9ab96111601797ea5da8e6d0723f77eabb0d4068d2b2f \
+ --hash=sha256:cf30f6e3c077c8e6a9a7809c94551203c8843e74ba0c960f4a98cd80d4665d39 \
+ --hash=sha256:d40770d7c0fd5cbed9d84b2c3f2e156431a12c9a37dc6284060fb4bec0b7ffd4 \
+ --hash=sha256:d8a210b158a34164de8bb68b0e7780041a903d7b00c87e906fb69928bf7890d5 \
+ --hash=sha256:dc4a8d2b25efb6681ecacad42fca8859f88092d8732b170de6a5dddd80a1c8fa \
+ --hash=sha256:df7d30371a2accfe4013e90445f6388c570f103d61019b6b7c57e0265250072a \
+ --hash=sha256:e01375f275f010fcbf7f643b4279896d04e571889b8a5b3f848423d91bf07050 \
+ --hash=sha256:e1a4120ae5705f673727d3253de3ed0e016f7cd78dc463db1b31e2463e1f3cf6 \
+ --hash=sha256:e228514a06843cae89621384cfe3a80418f3c04aadf8a3b14e46a7be704e4235 \
+ --hash=sha256:e405adefb53a435f01efa7ccdec012c016b5a1d3f35459990afc39b6be4d5056 \
+ --hash=sha256:e6b13af258d6a9ad602d57d889f83b9d5543acd471eee12eb51f5b01f8eb1bc2 \
+ --hash=sha256:e6f40a8aa5a92f150bdb3e1c44b7e98fb7113955b2e5394122fa5532fec4b418 \
+ --hash=sha256:e71d5c6ebac14875668a1e90baf2ea0ef5b7ac7918355850c0908ae82bcb297c \
+ --hash=sha256:ed7c635ae45cfbc1a7371f708727bf74690daedc49b4dba310590ca0bd28aa8a \
+ --hash=sha256:f38e60678850c42461d4202739f9bf1e3a737c7ad283638251e79cc49effb6b6 \
+ --hash=sha256:f66eb08feaa410fe4eebd17f2a2c8e2e46d3476e9f8c783daa8e09e0faa666d0 \
+ --hash=sha256:f9b2601381be482f70e5d1051a5965c25fb3625455a2bf520b5a077b22afb775 \
+ --hash=sha256:fbd3c8319de8e1dc79d346929cd71d523622da527cca14e0c1d257e31c2b8b10 \
+ --hash=sha256:fd341868a4b6714a5962c1af0bd44f7c404ef78720c7de4892901e540417111c
# via deprecated
-zstandard==0.23.0 \
- --hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
- --hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \
- --hash=sha256:11e3bf3c924853a2d5835b24f03eeba7fc9b07d8ca499e247e06ff5676461a15 \
- --hash=sha256:12a289832e520c6bd4dcaad68e944b86da3bad0d339ef7989fb7e88f92e96072 \
- --hash=sha256:1516c8c37d3a053b01c1c15b182f3b5f5eef19ced9b930b684a73bad121addf4 \
- --hash=sha256:157e89ceb4054029a289fb504c98c6a9fe8010f1680de0201b3eb5dc20aa6d9e \
- --hash=sha256:1bfe8de1da6d104f15a60d4a8a768288f66aa953bbe00d027398b93fb9680b26 \
- --hash=sha256:1e172f57cd78c20f13a3415cc8dfe24bf388614324d25539146594c16d78fcc8 \
- --hash=sha256:1fd7e0f1cfb70eb2f95a19b472ee7ad6d9a0a992ec0ae53286870c104ca939e5 \
- --hash=sha256:203d236f4c94cd8379d1ea61db2fce20730b4c38d7f1c34506a31b34edc87bdd \
- --hash=sha256:27d3ef2252d2e62476389ca8f9b0cf2bbafb082a3b6bfe9d90cbcbb5529ecf7c \
- --hash=sha256:29a2bc7c1b09b0af938b7a8343174b987ae021705acabcbae560166567f5a8db \
- --hash=sha256:2ef230a8fd217a2015bc91b74f6b3b7d6522ba48be29ad4ea0ca3a3775bf7dd5 \
- --hash=sha256:2ef3775758346d9ac6214123887d25c7061c92afe1f2b354f9388e9e4d48acfc \
- --hash=sha256:2f146f50723defec2975fb7e388ae3a024eb7151542d1599527ec2aa9cacb152 \
- --hash=sha256:2fb4535137de7e244c230e24f9d1ec194f61721c86ebea04e1581d9d06ea1269 \
- --hash=sha256:32ba3b5ccde2d581b1e6aa952c836a6291e8435d788f656fe5976445865ae045 \
- --hash=sha256:34895a41273ad33347b2fc70e1bff4240556de3c46c6ea430a7ed91f9042aa4e \
- --hash=sha256:379b378ae694ba78cef921581ebd420c938936a153ded602c4fea612b7eaa90d \
- --hash=sha256:38302b78a850ff82656beaddeb0bb989a0322a8bbb1bf1ab10c17506681d772a \
- --hash=sha256:3aa014d55c3af933c1315eb4bb06dd0459661cc0b15cd61077afa6489bec63bb \
- --hash=sha256:4051e406288b8cdbb993798b9a45c59a4896b6ecee2f875424ec10276a895740 \
- --hash=sha256:40b33d93c6eddf02d2c19f5773196068d875c41ca25730e8288e9b672897c105 \
- --hash=sha256:43da0f0092281bf501f9c5f6f3b4c975a8a0ea82de49ba3f7100e64d422a1274 \
- --hash=sha256:445e4cb5048b04e90ce96a79b4b63140e3f4ab5f662321975679b5f6360b90e2 \
- --hash=sha256:48ef6a43b1846f6025dde6ed9fee0c24e1149c1c25f7fb0a0585572b2f3adc58 \
- --hash=sha256:50a80baba0285386f97ea36239855f6020ce452456605f262b2d33ac35c7770b \
- --hash=sha256:519fbf169dfac1222a76ba8861ef4ac7f0530c35dd79ba5727014613f91613d4 \
- --hash=sha256:53dd9d5e3d29f95acd5de6802e909ada8d8d8cfa37a3ac64836f3bc4bc5512db \
- --hash=sha256:53ea7cdc96c6eb56e76bb06894bcfb5dfa93b7adcf59d61c6b92674e24e2dd5e \
- --hash=sha256:576856e8594e6649aee06ddbfc738fec6a834f7c85bf7cadd1c53d4a58186ef9 \
- --hash=sha256:59556bf80a7094d0cfb9f5e50bb2db27fefb75d5138bb16fb052b61b0e0eeeb0 \
- --hash=sha256:5d41d5e025f1e0bccae4928981e71b2334c60f580bdc8345f824e7c0a4c2a813 \
- --hash=sha256:61062387ad820c654b6a6b5f0b94484fa19515e0c5116faf29f41a6bc91ded6e \
- --hash=sha256:61f89436cbfede4bc4e91b4397eaa3e2108ebe96d05e93d6ccc95ab5714be512 \
- --hash=sha256:62136da96a973bd2557f06ddd4e8e807f9e13cbb0bfb9cc06cfe6d98ea90dfe0 \
- --hash=sha256:64585e1dba664dc67c7cdabd56c1e5685233fbb1fc1966cfba2a340ec0dfff7b \
- --hash=sha256:65308f4b4890aa12d9b6ad9f2844b7ee42c7f7a4fd3390425b242ffc57498f48 \
- --hash=sha256:66b689c107857eceabf2cf3d3fc699c3c0fe8ccd18df2219d978c0283e4c508a \
- --hash=sha256:6a41c120c3dbc0d81a8e8adc73312d668cd34acd7725f036992b1b72d22c1772 \
- --hash=sha256:6f77fa49079891a4aab203d0b1744acc85577ed16d767b52fc089d83faf8d8ed \
- --hash=sha256:72c68dda124a1a138340fb62fa21b9bf4848437d9ca60bd35db36f2d3345f373 \
- --hash=sha256:752bf8a74412b9892f4e5b58f2f890a039f57037f52c89a740757ebd807f33ea \
- --hash=sha256:76e79bc28a65f467e0409098fa2c4376931fd3207fbeb6b956c7c476d53746dd \
- --hash=sha256:774d45b1fac1461f48698a9d4b5fa19a69d47ece02fa469825b442263f04021f \
- --hash=sha256:77da4c6bfa20dd5ea25cbf12c76f181a8e8cd7ea231c673828d0386b1740b8dc \
- --hash=sha256:77ea385f7dd5b5676d7fd943292ffa18fbf5c72ba98f7d09fc1fb9e819b34c23 \
- --hash=sha256:80080816b4f52a9d886e67f1f96912891074903238fe54f2de8b786f86baded2 \
- --hash=sha256:80a539906390591dd39ebb8d773771dc4db82ace6372c4d41e2d293f8e32b8db \
- --hash=sha256:82d17e94d735c99621bf8ebf9995f870a6b3e6d14543b99e201ae046dfe7de70 \
- --hash=sha256:837bb6764be6919963ef41235fd56a6486b132ea64afe5fafb4cb279ac44f259 \
- --hash=sha256:84433dddea68571a6d6bd4fbf8ff398236031149116a7fff6f777ff95cad3df9 \
- --hash=sha256:8c24f21fa2af4bb9f2c492a86fe0c34e6d2c63812a839590edaf177b7398f700 \
- --hash=sha256:8ed7d27cb56b3e058d3cf684d7200703bcae623e1dcc06ed1e18ecda39fee003 \
- --hash=sha256:9206649ec587e6b02bd124fb7799b86cddec350f6f6c14bc82a2b70183e708ba \
- --hash=sha256:983b6efd649723474f29ed42e1467f90a35a74793437d0bc64a5bf482bedfa0a \
- --hash=sha256:98da17ce9cbf3bfe4617e836d561e433f871129e3a7ac16d6ef4c680f13a839c \
- --hash=sha256:9c236e635582742fee16603042553d276cca506e824fa2e6489db04039521e90 \
- --hash=sha256:9da6bc32faac9a293ddfdcb9108d4b20416219461e4ec64dfea8383cac186690 \
- --hash=sha256:a05e6d6218461eb1b4771d973728f0133b2a4613a6779995df557f70794fd60f \
- --hash=sha256:a0817825b900fcd43ac5d05b8b3079937073d2b1ff9cf89427590718b70dd840 \
- --hash=sha256:a4ae99c57668ca1e78597d8b06d5af837f377f340f4cce993b551b2d7731778d \
- --hash=sha256:a8c86881813a78a6f4508ef9daf9d4995b8ac2d147dcb1a450448941398091c9 \
- --hash=sha256:a8fffdbd9d1408006baaf02f1068d7dd1f016c6bcb7538682622c556e7b68e35 \
- --hash=sha256:a9b07268d0c3ca5c170a385a0ab9fb7fdd9f5fd866be004c4ea39e44edce47dd \
- --hash=sha256:ab19a2d91963ed9e42b4e8d77cd847ae8381576585bad79dbd0a8837a9f6620a \
- --hash=sha256:ac184f87ff521f4840e6ea0b10c0ec90c6b1dcd0bad2f1e4a9a1b4fa177982ea \
- --hash=sha256:b0e166f698c5a3e914947388c162be2583e0c638a4703fc6a543e23a88dea3c1 \
- --hash=sha256:b2170c7e0367dde86a2647ed5b6f57394ea7f53545746104c6b09fc1f4223573 \
- --hash=sha256:b2d8c62d08e7255f68f7a740bae85b3c9b8e5466baa9cbf7f57f1cde0ac6bc09 \
- --hash=sha256:b4567955a6bc1b20e9c31612e615af6b53733491aeaa19a6b3b37f3b65477094 \
- --hash=sha256:b69bb4f51daf461b15e7b3db033160937d3ff88303a7bc808c67bbc1eaf98c78 \
- --hash=sha256:b8c0bd73aeac689beacd4e7667d48c299f61b959475cdbb91e7d3d88d27c56b9 \
- --hash=sha256:be9b5b8659dff1f913039c2feee1aca499cfbc19e98fa12bc85e037c17ec6ca5 \
- --hash=sha256:bf0a05b6059c0528477fba9054d09179beb63744355cab9f38059548fedd46a9 \
- --hash=sha256:c16842b846a8d2a145223f520b7e18b57c8f476924bda92aeee3a88d11cfc391 \
- --hash=sha256:c363b53e257246a954ebc7c488304b5592b9c53fbe74d03bc1c64dda153fb847 \
- --hash=sha256:c7c517d74bea1a6afd39aa612fa025e6b8011982a0897768a2f7c8ab4ebb78a2 \
- --hash=sha256:d20fd853fbb5807c8e84c136c278827b6167ded66c72ec6f9a14b863d809211c \
- --hash=sha256:d2240ddc86b74966c34554c49d00eaafa8200a18d3a5b6ffbf7da63b11d74ee2 \
- --hash=sha256:d477ed829077cd945b01fc3115edd132c47e6540ddcd96ca169facff28173057 \
- --hash=sha256:d50d31bfedd53a928fed6707b15a8dbeef011bb6366297cc435accc888b27c20 \
- --hash=sha256:dc1d33abb8a0d754ea4763bad944fd965d3d95b5baef6b121c0c9013eaf1907d \
- --hash=sha256:dc5d1a49d3f8262be192589a4b72f0d03b72dcf46c51ad5852a4fdc67be7b9e4 \
- --hash=sha256:e2d1a054f8f0a191004675755448d12be47fa9bebbcffa3cdf01db19f2d30a54 \
- --hash=sha256:e7792606d606c8df5277c32ccb58f29b9b8603bf83b48639b7aedf6df4fe8171 \
- --hash=sha256:ed1708dbf4d2e3a1c5c69110ba2b4eb6678262028afd6c6fbcc5a8dac9cda68e \
- --hash=sha256:f2d4380bf5f62daabd7b751ea2339c1a21d1c9463f1feb7fc2bdcea2c29c3160 \
- --hash=sha256:f3513916e8c645d0610815c257cbfd3242adfd5c4cfa78be514e5a3ebb42a41b \
- --hash=sha256:f8346bfa098532bc1fb6c7ef06783e969d87a99dd1d2a5a18a892c1d7a643c58 \
- --hash=sha256:f83fa6cae3fff8e98691248c9320356971b59678a17f20656a9e59cd32cee6d8 \
- --hash=sha256:fa6ce8b52c5987b3e34d5674b0ab529a4602b632ebab0a93b07bfb4dfc8f8a33 \
- --hash=sha256:fb2b1ecfef1e67897d336de3a0e3f52478182d6a47eda86cbd42504c5cbd009a \
- --hash=sha256:fc9ca1c9718cb3b06634c7c8dec57d24e9438b2aa9a0f02b8bb36bf478538880 \
- --hash=sha256:fd30d9c67d13d891f2360b2a120186729c111238ac63b43dbd37a5a40670b8ca \
- --hash=sha256:fd7699e8fd9969f455ef2926221e0233f81a2542921471382e77a9e2f2b57f4b \
- --hash=sha256:fe3b385d996ee0822fd46528d9f0443b880d4d05528fd26a9119a54ec3f91c69
+zstandard==0.24.0 \
+ --hash=sha256:0101f835da7de08375f380192ff75135527e46e3f79bef224e3c49cb640fef6a \
+ --hash=sha256:010302face38c9a909b8934e3bf6038266d6afc69523f3efa023c5cb5d38271b \
+ --hash=sha256:05d27c953f2e0a3ecc8edbe91d6827736acc4c04d0479672e0400ccdb23d818c \
+ --hash=sha256:09887301001e7a81a3618156bc1759e48588de24bddfdd5b7a4364da9a8fbc20 \
+ --hash=sha256:0a416814608610abf5488889c74e43ffa0343ca6cf43957c6b6ec526212422da \
+ --hash=sha256:0a9e95ceb180ccd12a8b3437bac7e8a8a089c9094e39522900a8917745542184 \
+ --hash=sha256:0c9c3cba57f5792532a3df3f895980d47d78eda94b0e5b800651b53e96e0b604 \
+ --hash=sha256:0d66da2649bb0af4471699aeb7a83d6f59ae30236fb9f6b5d20fb618ef6c6777 \
+ --hash=sha256:0dc5654586613aebe5405c1ba180e67b3f29e7d98cf3187c79efdcc172f39457 \
+ --hash=sha256:0ed8345b504df1cab280af923ef69ec0d7d52f7b22f78ec7982fde7c33a43c4f \
+ --hash=sha256:0f6d9a146e07458cb41423ca2d783aefe3a3a97fe72838973c13b8f1ecc7343a \
+ --hash=sha256:10e284748a7e7fbe2815ca62a9d6e84497d34cfdd0143fa9e8e208efa808d7c4 \
+ --hash=sha256:13fc548e214df08d896ee5f29e1f91ee35db14f733fef8eabea8dca6e451d1e2 \
+ --hash=sha256:1b14bc92af065d0534856bf1b30fc48753163ea673da98857ea4932be62079b1 \
+ --hash=sha256:1bda8a85e5b9d5e73af2e61b23609a8cc1598c1b3b2473969912979205a1ff25 \
+ --hash=sha256:1e133a9dd51ac0bcd5fd547ba7da45a58346dbc63def883f999857b0d0c003c4 \
+ --hash=sha256:1f578fab202f4df67a955145c3e3ca60ccaaaf66c97808545b2625efeecdef10 \
+ --hash=sha256:27b6fa72b57824a3f7901fc9cc4ce1c1c834b28f3a43d1d4254c64c8f11149d4 \
+ --hash=sha256:2825a3951f945fb2613ded0f517d402b1e5a68e87e0ee65f5bd224a8333a9a46 \
+ --hash=sha256:2fc67eb15ed573950bc6436a04b3faea6c36c7db98d2db030d48391c6736a0dc \
+ --hash=sha256:337572a7340e1d92fd7fb5248c8300d0e91071002d92e0b8cabe8d9ae7b58159 \
+ --hash=sha256:35f13501a8accf834457d8e40e744568287a215818778bc4d79337af2f3f0d97 \
+ --hash=sha256:388aad2d693707f4a0f6cc687eb457b33303d6b57ecf212c8ff4468c34426892 \
+ --hash=sha256:3aa3b4344b206941385a425ea25e6dd63e5cb0f535a4b88d56e3f8902086be9e \
+ --hash=sha256:3adb4b5414febf074800d264ddf69ecade8c658837a83a19e8ab820e924c9933 \
+ --hash=sha256:3b95fc06489aa9388400d1aab01a83652bc040c9c087bd732eb214909d7fb0dd \
+ --hash=sha256:3f2fe35ec84908dddf0fbf66b35d7c2878dbe349552dd52e005c755d3493d61c \
+ --hash=sha256:3f96a9130171e01dbb6c3d4d9925d604e2131a97f540e223b88ba45daf56d6fb \
+ --hash=sha256:444633b487a711e34f4bccc46a0c5dfbe1aee82c1a511e58cdc16f6bd66f187c \
+ --hash=sha256:498f88f5109666c19531f0243a90d2fdd2252839cd6c8cc6e9213a3446670fa8 \
+ --hash=sha256:51a86bd963de3f36688553926a84e550d45d7f9745bd1947d79472eca27fcc75 \
+ --hash=sha256:52788e7c489069e317fde641de41b757fa0ddc150e06488f153dd5daebac7192 \
+ --hash=sha256:52cd7d9fa0a115c9446abb79b06a47171b7d916c35c10e0c3aa6f01d57561382 \
+ --hash=sha256:55872e818598319f065e8192ebefecd6ac05f62a43f055ed71884b0a26218f41 \
+ --hash=sha256:561123d05681197c0e24eb8ab3cfdaf299e2b59c293d19dad96e1610ccd8fbc6 \
+ --hash=sha256:57be3abb4313e0dd625596376bbb607f40059d801d51c1a1da94d7477e63b255 \
+ --hash=sha256:5e941654cef13a1d53634ec30933722eda11f44f99e1d0bc62bbce3387580d50 \
+ --hash=sha256:622e1e04bd8a085994e02313ba06fbcf4f9ed9a488c6a77a8dbc0692abab6a38 \
+ --hash=sha256:6324fde5cf5120fbf6541d5ff3c86011ec056e8d0f915d8e7822926a5377193a \
+ --hash=sha256:6374feaf347e6b83ec13cc5dcfa70076f06d8f7ecd46cc71d58fac798ff08b76 \
+ --hash=sha256:63d39b161000aeeaa06a1cb77c9806e939bfe460dfd593e4cbf24e6bc717ae94 \
+ --hash=sha256:656ed895b28c7e42dd5b40dfcea3217cfc166b6b7eef88c3da2f5fc62484035b \
+ --hash=sha256:663848a8bac4fdbba27feea2926049fdf7b55ec545d5b9aea096ef21e7f0b079 \
+ --hash=sha256:6885ae4b33aee8835dbdb4249d3dfec09af55e705d74d9b660bfb9da51baaa8b \
+ --hash=sha256:6b005bcee4be9c3984b355336283afe77b2defa76ed6b89332eced7b6fa68b68 \
+ --hash=sha256:76cdfe7f920738ea871f035568f82bad3328cbc8d98f1f6988264096b5264efd \
+ --hash=sha256:77b8b7b98893eaf47da03d262816f01f251c2aa059c063ed8a45c50eada123a5 \
+ --hash=sha256:7ac6e4d727521d86d20ec291a3f4e64a478e8a73eaee80af8f38ec403e77a409 \
+ --hash=sha256:7de5869e616d426b56809be7dc6dba4d37b95b90411ccd3de47f421a42d4d42c \
+ --hash=sha256:869bf13f66b124b13be37dd6e08e4b728948ff9735308694e0b0479119e08ea7 \
+ --hash=sha256:87ae1684bc3c02d5c35884b3726525eda85307073dbefe68c3c779e104a59036 \
+ --hash=sha256:8ecd3b1f7a601f79e0cd20c26057d770219c0dc2f572ea07390248da2def79a4 \
+ --hash=sha256:92be52ca4e6e604f03d5daa079caec9e04ab4cbf6972b995aaebb877d3d24e13 \
+ --hash=sha256:92ea7855d5bcfb386c34557516c73753435fb2d4a014e2c9343b5f5ba148b5d8 \
+ --hash=sha256:962ea3aecedcc944f8034812e23d7200d52c6e32765b8da396eeb8b8ffca71ce \
+ --hash=sha256:98ca91dc9602cf351497d5600aa66e6d011a38c085a8237b370433fcb53e3409 \
+ --hash=sha256:9b84c6c210684286e504022d11ec294d2b7922d66c823e87575d8b23eba7c81f \
+ --hash=sha256:a0f6fc2ea6e07e20df48752e7700e02e1892c61f9a6bfbacaf2c5b24d5ad504b \
+ --hash=sha256:a2bda8f2790add22773ee7a4e43c90ea05598bffc94c21c40ae0a9000b0133c3 \
+ --hash=sha256:aa705beb74ab116563f4ce784fa94771f230c05d09ab5de9c397793e725bb1db \
+ --hash=sha256:aadf32c389bb7f02b8ec5c243c38302b92c006da565e120dfcb7bf0378f4f848 \
+ --hash=sha256:ab2357353894a5ec084bb8508ff892aa43fb7fe8a69ad310eac58221ee7f72aa \
+ --hash=sha256:ad9fd176ff6800a0cf52bcf59c71e5de4fa25bf3ba62b58800e0f84885344d34 \
+ --hash=sha256:addfc23e3bd5f4b6787b9ca95b2d09a1a67ad5a3c318daaa783ff90b2d3a366e \
+ --hash=sha256:af1394c2c5febc44e0bbf0fc6428263fa928b50d1b1982ce1d870dc793a8e5f4 \
+ --hash=sha256:b04c94718f7a8ed7cdd01b162b6caa1954b3c9d486f00ecbbd300f149d2b2606 \
+ --hash=sha256:b4f20417a4f511c656762b001ec827500cbee54d1810253c6ca2df2c0a307a5f \
+ --hash=sha256:b7a8c30d9bf4bd5e4dcfe26900bef0fcd9749acde45cdf0b3c89e2052fda9a13 \
+ --hash=sha256:b7fa260dd2731afd0dfa47881c30239f422d00faee4b8b341d3e597cface1483 \
+ --hash=sha256:b91380aefa9c7ac831b011368daf378d3277e0bdeb6bad9535e21251e26dd55a \
+ --hash=sha256:bb2446a55b3a0fd8aa02aa7194bd64740015464a2daaf160d2025204e1d7c282 \
+ --hash=sha256:bc05f8a875eb651d1cc62e12a4a0e6afa5cd0cc231381adb830d2e9c196ea895 \
+ --hash=sha256:bcf69e0bcddbf2adcfafc1a7e864edcc204dd8171756d3a8f3340f6f6cc87b7b \
+ --hash=sha256:bf02f915fa7934ea5dfc8d96757729c99a8868b7c340b97704795d6413cf5fe6 \
+ --hash=sha256:c39d2b6161f3c5c5d12e9207ecf1006bb661a647a97a6573656b09aaea3f00ef \
+ --hash=sha256:c59740682a686bf835a1a4d8d0ed1eefe31ac07f1c5a7ed5f2e72cf577692b00 \
+ --hash=sha256:cc76de75300f65b8eb574d855c12518dc25a075dadb41dd18f6322bda3fe15d5 \
+ --hash=sha256:cd0d3d16e63873253bad22b413ec679cf6586e51b5772eb10733899832efec42 \
+ --hash=sha256:cda61c46343809ecda43dc620d1333dd7433a25d0a252f2dcc7667f6331c7b61 \
+ --hash=sha256:cf7fbb4e54136e9a03c7ed7691843c4df6d2ecc854a2541f840665f4f2bb2edd \
+ --hash=sha256:d2b3b4bda1a025b10fe0269369475f420177f2cb06e0f9d32c95b4873c9f80b8 \
+ --hash=sha256:d5e3b9310fd7f0d12edc75532cd9a56da6293840c84da90070d692e0bb15f186 \
+ --hash=sha256:d64899cc0f33a8f446f1e60bffc21fa88b99f0e8208750d9144ea717610a80ce \
+ --hash=sha256:d6975f2d903bc354916a17b91a7aaac7299603f9ecdb788145060dde6e573a16 \
+ --hash=sha256:d82ac87017b734f2fb70ff93818c66f0ad2c3810f61040f077ed38d924e19980 \
+ --hash=sha256:dd91b0134a32dfcd8be504e8e46de44ad0045a569efc25101f2a12ccd41b5759 \
+ --hash=sha256:df4be1cf6e8f0f2bbe2a3eabfff163ef592c84a40e1a20a8d7db7f27cfe08fc2 \
+ --hash=sha256:e05d66239d14a04b4717998b736a25494372b1b2409339b04bf42aa4663bf251 \
+ --hash=sha256:e40cd0fc734aa1d4bd0e7ad102fd2a1aefa50ce9ef570005ffc2273c5442ddc3 \
+ --hash=sha256:e46eb6702691b24ddb3e31e88b4a499e31506991db3d3724a85bd1c5fc3cfe4e \
+ --hash=sha256:e4ebb000c0fe24a6d0f3534b6256844d9dbf042fdf003efe5cf40690cf4e0f3e \
+ --hash=sha256:e69f8e534b4e254f523e2f9d4732cf9c169c327ca1ce0922682aac9a5ee01155 \
+ --hash=sha256:e91a4e5d62da7cb3f53e04fe254f1aa41009af578801ee6477fe56e7bef74ee2 \
+ --hash=sha256:ec194197e90ca063f5ecb935d6c10063d84208cac5423c07d0f1a09d1c2ea42b \
+ --hash=sha256:f6ae9fc67e636fc0fa9adee39db87dfbdeabfa8420bc0e678a1ac8441e01b22b \
+ --hash=sha256:f7d3fe9e1483171e9183ffdb1fab07c5fef80a9c3840374a38ec2ab869ebae20 \
+ --hash=sha256:fdc7a52a4cdaf7293e10813fd6a3abc0c7753660db12a3b864ab1fb5a0c60c16 \
+ --hash=sha256:fe3198b81c00032326342d973e526803f183f97aa9e9a98e3f897ebafe21178f \
+ --hash=sha256:ff19efaa33e7f136fe95f9bbcc90ab7fb60648453b03f95d1de3ab6997de0f32
# via -r requirements.in
From 0fa18acc1e60c981c7c315255bc3bbe4bf1f16fa Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Wed, 3 Sep 2025 10:16:35 -0400
Subject: [PATCH 082/231] Run `cargo fmt` and `cargo clippy --fix` (#781)
This is from cargo 1.88, since 1.89 pulls in let-chains, and whatever
version of Rust is in GitHub CI doesn't support them last time I tried.
(We should upgrade it at some point, though, since our Rust usage is all
internal.)
---
src/github.rs | 60 ++++++++++++++---------------------------
src/macho.rs | 23 ++++++++--------
src/main.rs | 6 ++---
src/release.rs | 6 ++---
src/validation.rs | 68 +++++++++++++++++++----------------------------
5 files changed, 65 insertions(+), 98 deletions(-)
diff --git a/src/github.rs b/src/github.rs
index 5db224723..87e316e0a 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -4,22 +4,22 @@
use {
crate::release::{
- bootstrap_llvm, produce_install_only, produce_install_only_stripped, RELEASE_TRIPLES,
+ RELEASE_TRIPLES, bootstrap_llvm, produce_install_only, produce_install_only_stripped,
},
- anyhow::{anyhow, Result},
+ anyhow::{Result, anyhow},
bytes::Bytes,
clap::ArgMatches,
futures::StreamExt,
octocrab::{
+ Octocrab, OctocrabBuilder,
models::{repos::Release, workflows::WorkflowListArtifact},
params::actions::ArchiveFormat,
- Octocrab, OctocrabBuilder,
},
rayon::prelude::*,
reqwest::{Client, StatusCode},
reqwest_retry::{
- default_on_request_failure, policies::ExponentialBackoff, RetryPolicy, Retryable,
- RetryableStrategy,
+ RetryPolicy, Retryable, RetryableStrategy, default_on_request_failure,
+ policies::ExponentialBackoff,
},
sha2::{Digest, Sha256},
std::{
@@ -70,6 +70,7 @@ enum UploadSource {
Data(Bytes),
}
+#[allow(clippy::too_many_arguments)]
async fn upload_release_artifact(
client: &Client,
retry_policy: &impl RetryPolicy,
@@ -286,16 +287,13 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
let parts = name.split('-').collect::>();
if parts[0] != "cpython" {
- println!("ignoring {} not a cpython artifact", name);
+ println!("ignoring {name} not a cpython artifact");
continue;
};
let python_version = pep440_rs::Version::from_str(parts[1])?;
if !release_version_range.contains(&python_version) {
- println!(
- "{} not in release version range {}",
- name, release_version_range
- );
+ println!("{name} not in release version range {release_version_range}");
continue;
}
@@ -310,17 +308,14 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
}
})
else {
- println!(
- "ignoring {} does not match any registered release triples",
- name
- );
+ println!("ignoring {name} does not match any registered release triples");
continue;
};
let stripped_name = if let Some(s) = name.strip_suffix(".tar.zst") {
s
} else {
- println!("ignoring {} not a .tar.zst artifact", name);
+ println!("ignoring {name} not a .tar.zst artifact");
continue;
};
@@ -333,7 +328,7 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
let build_suffix = &stripped_name[triple_start + triple.len() + 1..];
if !release.suffixes(None).any(|suffix| build_suffix == suffix) {
- println!("ignoring {} not a release artifact for triple", name);
+ println!("ignoring {name} not a release artifact for triple");
continue;
}
@@ -342,7 +337,7 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
zf.read_to_end(&mut buf)?;
std::fs::write(&dest_path, &buf)?;
- println!("prepared {} for release", name);
+ println!("prepared {name} for release");
if build_suffix == release.install_only_suffix {
install_paths.push(dest_path);
@@ -452,34 +447,19 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
for suffix in release.suffixes(Some(&python_version)) {
wanted_filenames.insert(
- format!(
- "cpython-{}-{}-{}-{}.tar.zst",
- version, triple, suffix, datetime
- ),
- format!(
- "cpython-{}+{}-{}-{}-full.tar.zst",
- version, tag, triple, suffix
- ),
+ format!("cpython-{version}-{triple}-{suffix}-{datetime}.tar.zst"),
+ format!("cpython-{version}+{tag}-{triple}-{suffix}-full.tar.zst"),
);
}
wanted_filenames.insert(
- format!(
- "cpython-{}-{}-install_only-{}.tar.gz",
- version, triple, datetime
- ),
- format!("cpython-{}+{}-{}-install_only.tar.gz", version, tag, triple),
+ format!("cpython-{version}-{triple}-install_only-{datetime}.tar.gz"),
+ format!("cpython-{version}+{tag}-{triple}-install_only.tar.gz"),
);
wanted_filenames.insert(
- format!(
- "cpython-{}-{}-install_only_stripped-{}.tar.gz",
- version, triple, datetime
- ),
- format!(
- "cpython-{}+{}-{}-install_only_stripped.tar.gz",
- version, tag, triple
- ),
+ format!("cpython-{version}-{triple}-install_only_stripped-{datetime}.tar.gz"),
+ format!("cpython-{version}+{tag}-{triple}-install_only_stripped.tar.gz"),
);
}
}
@@ -490,7 +470,7 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
.collect::>();
for f in &missing {
- println!("missing release artifact: {}", f);
+ println!("missing release artifact: {f}");
}
if missing.is_empty() {
println!("found all {} release artifacts", wanted_filenames.len());
@@ -564,7 +544,7 @@ pub async fn command_upload_release_distributions(args: &ArgMatches) -> Result<(
let shasums = digests
.iter()
- .map(|(filename, digest)| format!("{} {}\n", digest, filename))
+ .map(|(filename, digest)| format!("{digest} {filename}\n"))
.collect::>()
.join("");
diff --git a/src/macho.rs b/src/macho.rs
index 4717fb96a..2173ee7b6 100644
--- a/src/macho.rs
+++ b/src/macho.rs
@@ -4,7 +4,7 @@
use {
crate::validation::ValidationContext,
- anyhow::{anyhow, Context, Result},
+ anyhow::{Context, Result, anyhow},
apple_sdk::{AppleSdk, SdkSearch, SdkSearchLocation, SdkSorting, SdkVersion, SimpleSdk},
semver::Version,
std::{
@@ -53,7 +53,7 @@ impl std::fmt::Display for MachOPackedVersion {
let minor = (self.value >> 8) & 0xff;
let subminor = self.value & 0xff;
- f.write_str(&format!("{}.{}.{}", major, minor, subminor))
+ f.write_str(&format!("{major}.{minor}.{subminor}"))
}
}
@@ -128,9 +128,9 @@ impl RequiredSymbols {
fn tbd_relative_path(path: &str) -> Result {
if let Some(stripped) = path.strip_prefix('/') {
if let Some(stem) = stripped.strip_suffix(".dylib") {
- Ok(format!("{}.tbd", stem))
+ Ok(format!("{stem}.tbd"))
} else {
- Ok(format!("{}.tbd", stripped))
+ Ok(format!("{stripped}.tbd"))
}
} else {
Err(anyhow!("could not determine tbd path from {}", path))
@@ -165,13 +165,13 @@ impl TbdMetadata {
export
.objc_classes
.iter()
- .map(|cls| format!("_OBJC_CLASS_${}", cls)),
+ .map(|cls| format!("_OBJC_CLASS_${cls}")),
)
.chain(
export
.objc_classes
.iter()
- .map(|cls| format!("_OBJC_METACLASS_${}", cls)),
+ .map(|cls| format!("_OBJC_METACLASS_${cls}")),
),
);
@@ -214,13 +214,13 @@ impl TbdMetadata {
export
.objc_classes
.iter()
- .map(|cls| format!("_OBJC_CLASS_$_{}", cls)),
+ .map(|cls| format!("_OBJC_CLASS_$_{cls}")),
)
.chain(
export
.objc_classes
.iter()
- .map(|cls| format!("_OBJC_METACLASS_$_{}", cls)),
+ .map(|cls| format!("_OBJC_METACLASS_$_{cls}")),
),
);
@@ -249,13 +249,13 @@ impl TbdMetadata {
export
.objc_classes
.iter()
- .map(|cls| format!("_OBJC_CLASS_$_{}", cls)),
+ .map(|cls| format!("_OBJC_CLASS_$_{cls}")),
)
.chain(
export
.objc_classes
.iter()
- .map(|cls| format!("_OBJC_METACLASS_$_{}", cls)),
+ .map(|cls| format!("_OBJC_METACLASS_$_{cls}")),
),
);
res.weak_symbols
@@ -370,8 +370,7 @@ impl IndexedSdks {
"x86_64-apple-darwin" => "x86_64-macos",
_ => {
context.errors.push(format!(
- "unknown target triple for Mach-O symbol analysis: {}",
- triple
+ "unknown target triple for Mach-O symbol analysis: {triple}"
));
return Ok(());
}
diff --git a/src/main.rs b/src/main.rs
index c8d422e82..99ef5b5e9 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -9,8 +9,8 @@ mod release;
mod validation;
use {
- anyhow::{anyhow, Context, Result},
- clap::{value_parser, Arg, ArgAction, Command},
+ anyhow::{Context, Result, anyhow},
+ clap::{Arg, ArgAction, Command, value_parser},
std::{
io::Read,
path::{Path, PathBuf},
@@ -240,7 +240,7 @@ fn main() {
let exit_code = match main_impl() {
Ok(()) => 0,
Err(err) => {
- eprintln!("Error: {:?}", err);
+ eprintln!("Error: {err:?}");
1
}
};
diff --git a/src/release.rs b/src/release.rs
index 4c123f618..b49f0fac8 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -13,7 +13,7 @@ use std::{
use url::Url;
use {
crate::json::parse_python_json,
- anyhow::{anyhow, Result},
+ anyhow::{Result, anyhow},
once_cell::sync::Lazy,
pep440_rs::VersionSpecifier,
std::{
@@ -628,7 +628,7 @@ static LLVM_URL: Lazy = Lazy::new(|| {
/// Returns the path to the top-level `llvm` directory.
pub async fn bootstrap_llvm() -> Result {
let url = &*LLVM_URL;
- let filename = url.path_segments().unwrap().last().unwrap();
+ let filename = url.path_segments().unwrap().next_back().unwrap();
let llvm_dir = Path::new("build").join("llvm");
std::fs::create_dir_all(&llvm_dir)?;
@@ -646,7 +646,7 @@ pub async fn bootstrap_llvm() -> Result {
// Download the tarball.
let tarball_path = temp_dir
.path()
- .join(url.path_segments().unwrap().last().unwrap());
+ .join(url.path_segments().unwrap().next_back().unwrap());
let mut tarball_file = tokio::fs::File::create(&tarball_path).await?;
let mut bytes_stream = reqwest::Client::new()
.get(url.clone())
diff --git a/src/validation.rs b/src/validation.rs
index 33e61e2e9..dbe897648 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -4,13 +4,14 @@
use {
crate::{json::*, macho::*},
- anyhow::{anyhow, Context, Result},
+ anyhow::{Context, Result, anyhow},
clap::ArgMatches,
normalize_path::NormalizePath,
object::{
+ Architecture, Endianness, FileKind, Object, SectionIndex, SymbolScope,
elf::{
- FileHeader32, FileHeader64, ET_DYN, ET_EXEC, SHN_UNDEF, STB_GLOBAL, STB_WEAK, STV_DEFAULT,
- STV_HIDDEN,
+ ET_DYN, ET_EXEC, FileHeader32, FileHeader64, SHN_UNDEF, STB_GLOBAL, STB_WEAK,
+ STV_DEFAULT, STV_HIDDEN,
},
macho::{LC_CODE_SIGNATURE, MH_OBJECT, MH_TWOLEVEL, MachHeader32, MachHeader64},
read::{
@@ -18,7 +19,6 @@ use {
macho::{LoadCommandVariant, MachHeader, Nlist, Section, Segment},
pe::{ImageNtHeaders, PeFile, PeFile32, PeFile64},
},
- Architecture, Endianness, FileKind, Object, SectionIndex, SymbolScope,
},
once_cell::sync::Lazy,
std::{
@@ -973,7 +973,7 @@ fn validate_elf>(
"x86_64_v2-unknown-linux-musl" => object::elf::EM_X86_64,
"x86_64_v3-unknown-linux-musl" => object::elf::EM_X86_64,
"x86_64_v4-unknown-linux-musl" => object::elf::EM_X86_64,
- _ => panic!("unhandled target triple: {}", target_triple),
+ _ => panic!("unhandled target triple: {target_triple}"),
};
let endian = elf.endian()?;
@@ -998,27 +998,23 @@ fn validate_elf>(
if json.libpython_link_mode == "shared" {
if target_triple.contains("-musl") {
// On musl, we link to `libpython` and rely on `RUN PATH`
- allowed_libraries.push(format!("libpython{}.so.1.0", python_major_minor));
- allowed_libraries.push(format!("libpython{}d.so.1.0", python_major_minor));
- allowed_libraries.push(format!("libpython{}t.so.1.0", python_major_minor));
- allowed_libraries.push(format!("libpython{}td.so.1.0", python_major_minor));
+ allowed_libraries.push(format!("libpython{python_major_minor}.so.1.0"));
+ allowed_libraries.push(format!("libpython{python_major_minor}d.so.1.0"));
+ allowed_libraries.push(format!("libpython{python_major_minor}t.so.1.0"));
+ allowed_libraries.push(format!("libpython{python_major_minor}td.so.1.0"));
} else {
// On glibc, we can use `$ORIGIN` for relative, reloctable linking
allowed_libraries.push(format!(
- "$ORIGIN/../lib/libpython{}.so.1.0",
- python_major_minor
+ "$ORIGIN/../lib/libpython{python_major_minor}.so.1.0"
));
allowed_libraries.push(format!(
- "$ORIGIN/../lib/libpython{}d.so.1.0",
- python_major_minor
+ "$ORIGIN/../lib/libpython{python_major_minor}d.so.1.0"
));
allowed_libraries.push(format!(
- "$ORIGIN/../lib/libpython{}t.so.1.0",
- python_major_minor
+ "$ORIGIN/../lib/libpython{python_major_minor}t.so.1.0"
));
allowed_libraries.push(format!(
- "$ORIGIN/../lib/libpython{}td.so.1.0",
- python_major_minor
+ "$ORIGIN/../lib/libpython{python_major_minor}td.so.1.0"
));
}
}
@@ -1229,8 +1225,8 @@ fn validate_macho>(
bytes: &[u8],
) -> Result<()> {
let advertised_target_version =
- semver::Version::parse(&format!("{}.0", advertised_target_version))?;
- let advertised_sdk_version = semver::Version::parse(&format!("{}.0", advertised_sdk_version))?;
+ semver::Version::parse(&format!("{advertised_target_version}.0"))?;
+ let advertised_sdk_version = semver::Version::parse(&format!("{advertised_sdk_version}.0"))?;
let endian = header.endian()?;
@@ -1661,7 +1657,7 @@ fn validate_extension_modules(
wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_14);
}
_ => {
- panic!("unhandled Python version: {}", python_major_minor);
+ panic!("unhandled Python version: {python_major_minor}");
}
}
@@ -1732,11 +1728,11 @@ fn validate_extension_modules(
}
for extra in have_extensions.difference(&wanted) {
- errors.push(format!("extra/unknown extension module: {}", extra));
+ errors.push(format!("extra/unknown extension module: {extra}"));
}
for missing in wanted.difference(have_extensions) {
- errors.push(format!("missing extension module: {}", missing));
+ errors.push(format!("missing extension module: {missing}"));
}
Ok(errors)
@@ -1791,7 +1787,7 @@ fn validate_json(json: &PythonJsonMain, triple: &str, is_debug: bool) -> Result<
for extension in json.build_info.extensions.keys() {
if GLOBALLY_BANNED_EXTENSIONS.contains(&extension.as_str()) {
- errors.push(format!("banned extension detected: {}", extension));
+ errors.push(format!("banned extension detected: {extension}"));
}
}
@@ -1828,11 +1824,7 @@ fn validate_distribution(
let triple = RECOGNIZED_TRIPLES
.iter()
- .find(|triple| {
- dist_path
- .to_string_lossy()
- .contains(&format!("-{}-", triple))
- })
+ .find(|triple| dist_path.to_string_lossy().contains(&format!("-{triple}-")))
.ok_or_else(|| {
anyhow!(
"could not identify triple from distribution filename: {}",
@@ -1883,7 +1875,7 @@ fn validate_distribution(
.unwrap()
.python_paths
.values()
- .map(|x| format!("python/{}", x)),
+ .map(|x| format!("python/{x}")),
);
} else {
context.errors.push(format!(
@@ -2031,8 +2023,7 @@ fn validate_distribution(
for path in wanted_python_paths {
context.errors.push(format!(
- "path prefix {} seen in python_paths does not appear in archive",
- path
+ "path prefix {path} seen in python_paths does not appear in archive"
));
}
@@ -2046,7 +2037,7 @@ fn validate_distribution(
for lib in wanted_dylibs.difference(&context.seen_dylibs) {
context
.errors
- .push(format!("required library dependency {} not seen", lib));
+ .push(format!("required library dependency {lib} not seen"));
}
if triple.contains("-windows-") && is_static {
@@ -2083,8 +2074,7 @@ fn validate_distribution(
if let Some(shared) = &ext.shared_lib {
if !seen_paths.contains(&PathBuf::from("python").join(shared)) {
context.errors.push(format!(
- "extension module {} references missing shared library path {}",
- name, shared
+ "extension module {name} references missing shared library path {shared}"
));
}
}
@@ -2106,13 +2096,11 @@ fn validate_distribution(
if want_shared && ext.shared_lib.is_none() {
context.errors.push(format!(
- "extension module {} does not have a shared library",
- name
+ "extension module {name} does not have a shared library"
));
} else if !want_shared && ext.shared_lib.is_some() {
context.errors.push(format!(
- "extension module {} contains a shared library unexpectedly",
- name
+ "extension module {name} contains a shared library unexpectedly"
));
}
@@ -2165,7 +2153,7 @@ fn validate_distribution(
if triple.contains("-apple-darwin") {
if let Some(sdks) = macos_sdks {
if let Some(value) = json.as_ref().unwrap().apple_sdk_deployment_target.as_ref() {
- let target_minimum_sdk = semver::Version::parse(&format!("{}.0", value))?;
+ let target_minimum_sdk = semver::Version::parse(&format!("{value}.0"))?;
sdks.validate_context(&mut context, target_minimum_sdk, triple)?;
} else {
@@ -2253,7 +2241,7 @@ pub fn command_validate_distribution(args: &ArgMatches) -> Result<()> {
println!(" {} OK", path.display());
} else {
for error in errors {
- println!(" error: {}", error);
+ println!(" error: {error}");
}
success = false;
From 8138f8f7337d95bd098b398d368d4763861f2395 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=90=B4=E5=B0=8F=E7=99=BD?= <296015668@qq.com>
Date: Sat, 6 Sep 2025 05:02:03 +0800
Subject: [PATCH 083/231] Add loongarch64-linux support (#653)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
- https://github.com/astral-sh/python-build-standalone/issues/204
Add support for loongarch64 linux gnu target.
No automated builds; manual execution of `./build-linux.py --target
loongarch64-unknown-linux-gnu`.
Signed-off-by: 吴小白 <296015668@qq.com>
---
cpython-unix/base.Dockerfile | 2 +-
cpython-unix/base.debian9.Dockerfile | 2 +-
cpython-unix/build-cpython.sh | 12 ++++
cpython-unix/build-libX11.sh | 6 ++
cpython-unix/build-libxcb.sh | 6 ++
cpython-unix/build-main.py | 1 +
cpython-unix/build-ncurses.sh | 2 +
cpython-unix/build-xorgproto.sh | 6 ++
cpython-unix/build.Dockerfile | 2 +
.../build.cross-loongarch64.Dockerfile | 64 +++++++++++++++++++
cpython-unix/build.cross-riscv64.Dockerfile | 2 +-
cpython-unix/build.cross.Dockerfile | 2 +-
cpython-unix/extension-modules.yml | 1 +
...atch-configure-add-loongarch-triplet.patch | 50 +++++++++++++++
cpython-unix/targets.yml | 41 ++++++++++++
docs/building.rst | 1 +
16 files changed, 196 insertions(+), 4 deletions(-)
create mode 100644 cpython-unix/build.cross-loongarch64.Dockerfile
create mode 100644 cpython-unix/patch-configure-add-loongarch-triplet.patch
diff --git a/cpython-unix/base.Dockerfile b/cpython-unix/base.Dockerfile
index 7e666e045..4838db499 100644
--- a/cpython-unix/base.Dockerfile
+++ b/cpython-unix/base.Dockerfile
@@ -1,6 +1,6 @@
# Debian Jessie.
FROM debian@sha256:32ad5050caffb2c7e969dac873bce2c370015c2256ff984b70c1c08b3a2816a0
-MAINTAINER Gregory Szorc
+LABEL org.opencontainers.image.authors="Gregory Szorc "
RUN groupadd -g 1000 build && \
useradd -u 1000 -g 1000 -d /build -s /bin/bash -m build && \
diff --git a/cpython-unix/base.debian9.Dockerfile b/cpython-unix/base.debian9.Dockerfile
index 1b47b35a2..28078a59b 100644
--- a/cpython-unix/base.debian9.Dockerfile
+++ b/cpython-unix/base.debian9.Dockerfile
@@ -1,6 +1,6 @@
# Debian Stretch.
FROM debian@sha256:c5c5200ff1e9c73ffbf188b4a67eb1c91531b644856b4aefe86a58d2f0cb05be
-MAINTAINER Gregory Szorc
+LABEL org.opencontainers.image.authors="Gregory Szorc "
RUN groupadd -g 1000 build && \
useradd -u 1000 -g 1000 -d /build -s /bin/bash -m build && \
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index d21533a89..aeebf8b56 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -69,6 +69,15 @@ if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
fi
fi
+# configure doesn't support cross-compiling on LoongArch. Teach it.
+if [ "${PYBUILD_PLATFORM}" != "macos" ]; then
+ case "${PYTHON_MAJMIN_VERSION}" in
+ 3.9|3.10|3.11)
+ patch -p1 -i ${ROOT}/patch-configure-add-loongarch-triplet.patch
+ ;;
+ esac
+fi
+
# disable readelf check when cross-compiling on older Python versions
if [ -n "${CROSS_COMPILING}" ]; then
if [ -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_11}" ]; then
@@ -1107,6 +1116,9 @@ armv7-unknown-linux-gnueabi)
armv7-unknown-linux-gnueabihf)
PYTHON_ARCH="arm-linux-gnueabihf"
;;
+loongarch64-unknown-linux-gnu)
+ PYTHON_ARCH="loongarch64-linux-gnu"
+ ;;
mips-unknown-linux-gnu)
PYTHON_ARCH="mips-linux-gnu"
;;
diff --git a/cpython-unix/build-libX11.sh b/cpython-unix/build-libX11.sh
index 9be17eea9..7407570c3 100755
--- a/cpython-unix/build-libX11.sh
+++ b/cpython-unix/build-libX11.sh
@@ -54,6 +54,9 @@ if [ -n "${CROSS_COMPILING}" ]; then
armv7-unknown-linux-gnueabihf)
EXTRA_FLAGS="${EXTRA_FLAGS} --enable-malloc0returnsnull"
;;
+ loongarch64-unknown-linux-gnu)
+ EXTRA_FLAGS="${EXTRA_FLAGS} --enable-malloc0returnsnull"
+ ;;
mips-unknown-linux-gnu)
EXTRA_FLAGS="${EXTRA_FLAGS} --enable-malloc0returnsnull"
;;
@@ -78,6 +81,9 @@ if [ -n "${CROSS_COMPILING}" ]; then
aarch64-unknown-linux-musl)
EXTRA_FLAGS="${EXTRA_FLAGS} --enable-malloc0returnsnull"
;;
+ loongarch64-unknown-linux-musl)
+ EXTRA_FLAGS="${EXTRA_FLAGS} --enable-malloc0returnsnull"
+ ;;
mips-unknown-linux-musl)
EXTRA_FLAGS="${EXTRA_FLAGS} --enable-malloc0returnsnull"
;;
diff --git a/cpython-unix/build-libxcb.sh b/cpython-unix/build-libxcb.sh
index 0b6cb9111..1076157f0 100755
--- a/cpython-unix/build-libxcb.sh
+++ b/cpython-unix/build-libxcb.sh
@@ -13,6 +13,12 @@ export PKG_CONFIG_PATH=/tools/deps/share/pkgconfig:/tools/deps/lib/pkgconfig
tar -xf libxcb-${LIBXCB_VERSION}.tar.gz
pushd libxcb-${LIBXCB_VERSION}
+if [[ "${TARGET_TRIPLE}" = loongarch64* ]]; then
+ rm -f build-aux/config.guess build-aux/config.sub
+ curl -sSL -o build-aux/config.guess 'https://git.savannah.gnu.org/cgit/config.git/plain/config.guess'
+ curl -sSL -o build-aux/config.sub 'https://git.savannah.gnu.org/cgit/config.git/plain/config.sub'
+fi
+
if [ "${CC}" = "musl-clang" ]; then
EXTRA_FLAGS="--disable-shared"
fi
diff --git a/cpython-unix/build-main.py b/cpython-unix/build-main.py
index 23d473ef1..e4276be2a 100755
--- a/cpython-unix/build-main.py
+++ b/cpython-unix/build-main.py
@@ -95,6 +95,7 @@ def main():
"toolchain-image-build",
"toolchain-image-build.cross",
"toolchain-image-build.cross-riscv64",
+ "toolchain-image-build.cross-loongarch64",
"toolchain-image-build.debian9",
"toolchain-image-gcc",
"toolchain-image-xcb",
diff --git a/cpython-unix/build-ncurses.sh b/cpython-unix/build-ncurses.sh
index 25df7e227..cedeb7022 100755
--- a/cpython-unix/build-ncurses.sh
+++ b/cpython-unix/build-ncurses.sh
@@ -109,6 +109,8 @@ else
"
fi
+mkdir -p ${ROOT}/out/usr/lib
+
CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" CPPFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" ./configure ${CONFIGURE_FLAGS}
make -j ${NUM_CPUS}
make -j ${NUM_CPUS} install DESTDIR=${ROOT}/out
diff --git a/cpython-unix/build-xorgproto.sh b/cpython-unix/build-xorgproto.sh
index 97c1aa4f9..99c5db0e3 100755
--- a/cpython-unix/build-xorgproto.sh
+++ b/cpython-unix/build-xorgproto.sh
@@ -15,6 +15,12 @@ export PKG_CONFIG_PATH=/tools/deps/share/pkgconfig
tar -xf xorgproto-${XORGPROTO_VERSION}.tar.gz
pushd xorgproto-${XORGPROTO_VERSION}
+if [[ "${TARGET_TRIPLE}" = loongarch64* ]]; then
+ rm -f config.guess.sub config.sub
+ curl -sSL -o config.guess 'https://git.savannah.gnu.org/cgit/config.git/plain/config.guess'
+ curl -sSL -o config.sub 'https://git.savannah.gnu.org/cgit/config.git/plain/config.sub'
+fi
+
CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" CPPFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" ./configure \
--build=${BUILD_TRIPLE} \
--host=${TARGET_TRIPLE} \
diff --git a/cpython-unix/build.Dockerfile b/cpython-unix/build.Dockerfile
index e44d0a2e2..5a5dcad8a 100644
--- a/cpython-unix/build.Dockerfile
+++ b/cpython-unix/build.Dockerfile
@@ -9,6 +9,8 @@
# Various other build tools are needed for various building.
RUN ulimit -n 10000 && apt-get install \
bzip2 \
+ ca-certificates \
+ curl \
file \
libc6-dev \
libffi-dev \
diff --git a/cpython-unix/build.cross-loongarch64.Dockerfile b/cpython-unix/build.cross-loongarch64.Dockerfile
new file mode 100644
index 000000000..fc1f27bcf
--- /dev/null
+++ b/cpython-unix/build.cross-loongarch64.Dockerfile
@@ -0,0 +1,64 @@
+# Debian Trixie.
+FROM debian@sha256:5e64db7e29879fbb479ab2c6324656c9c0e489423e4885ed7e2f22c5b58a7a9b
+LABEL org.opencontainers.image.authors="Gregory Szorc "
+
+RUN groupadd -g 1000 build && \
+ useradd -u 1000 -g 1000 -d /build -s /bin/bash -m build && \
+ mkdir /tools && \
+ chown -R build:build /build /tools
+
+ENV HOME=/build \
+ SHELL=/bin/bash \
+ USER=build \
+ LOGNAME=build \
+ HOSTNAME=builder \
+ DEBIAN_FRONTEND=noninteractive
+
+CMD ["/bin/bash", "--login"]
+WORKDIR '/build'
+
+RUN for s in debian_trixie debian_trixie-updates; do \
+ echo "deb http://snapshot.debian.org/archive/${s%_*}/20240812T212427Z/ ${s#*_} main"; \
+ done > /etc/apt/sources.list && \
+ for s in debian-security_trixie-security/updates; do \
+ echo "deb http://snapshot.debian.org/archive/${s%_*}/20240813T064849Z/ ${s#*_} main"; \
+ done >> /etc/apt/sources.list && \
+ ( echo 'quiet "true";'; \
+ echo 'APT::Get::Assume-Yes "true";'; \
+ echo 'APT::Install-Recommends "false";'; \
+ echo 'Acquire::Check-Valid-Until "false";'; \
+ echo 'Acquire::Retries "5";'; \
+ ) > /etc/apt/apt.conf.d/99cpython-portable && \
+ rm -f /etc/apt/sources.list.d/*
+
+RUN apt-get update
+
+# Host building.
+RUN apt-get install \
+ bzip2 \
+ ca-certificates \
+ curl \
+ gcc \
+ g++ \
+ libc6-dev \
+ libffi-dev \
+ make \
+ patch \
+ perl \
+ pkg-config \
+ tar \
+ xz-utils \
+ unzip \
+ zip \
+ zlib1g-dev
+
+RUN apt-get install \
+ gcc-loongarch64-linux-gnu \
+ libc6-dev-loong64-cross
+
+RUN cd /tmp && \
+ curl -LO https://snapshot.debian.org/archive/debian-ports/20240812T192057Z/pool-loong64/main/libx/libxcrypt/libcrypt-dev_4.4.36-4_loong64.deb && \
+ curl -LO https://snapshot.debian.org/archive/debian-ports/20240812T192057Z/pool-loong64/main/libx/libxcrypt/libcrypt1_4.4.36-4_loong64.deb && \
+ dpkg -x libcrypt-dev_4.4.36-4_loong64.deb / && \
+ dpkg -x libcrypt1_4.4.36-4_loong64.deb / && \
+ rm -f /tmp/*.deb
diff --git a/cpython-unix/build.cross-riscv64.Dockerfile b/cpython-unix/build.cross-riscv64.Dockerfile
index 740a098b2..6114fe755 100644
--- a/cpython-unix/build.cross-riscv64.Dockerfile
+++ b/cpython-unix/build.cross-riscv64.Dockerfile
@@ -1,6 +1,6 @@
# Debian Buster.
FROM debian@sha256:2a0c1b9175adf759420fe0fbd7f5b449038319171eb76554bb76cbe172b62b42
-MAINTAINER Gregory Szorc
+LABEL org.opencontainers.image.authors="Gregory Szorc "
RUN groupadd -g 1000 build && \
useradd -u 1000 -g 1000 -d /build -s /bin/bash -m build && \
diff --git a/cpython-unix/build.cross.Dockerfile b/cpython-unix/build.cross.Dockerfile
index aa17d6c18..d8e557fe3 100644
--- a/cpython-unix/build.cross.Dockerfile
+++ b/cpython-unix/build.cross.Dockerfile
@@ -1,6 +1,6 @@
# Debian Stretch.
FROM debian@sha256:cebe6e1c30384958d471467e231f740e8f0fd92cbfd2a435a186e9bada3aee1c
-MAINTAINER Gregory Szorc
+LABEL org.opencontainers.image.authors="Gregory Szorc "
RUN groupadd -g 1000 build && \
useradd -u 1000 -g 1000 -d /build -s /bin/bash -m build && \
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index 214d90afd..3d4f1bf03 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -261,6 +261,7 @@ _decimal:
- define: CONFIG_64=1
targets:
- aarch64-.*
+ - loongarch64-unknown-linux.*
- ppc64le-unknown-linux.*
- riscv64-unknown-linux.*
- s390x-unknown-linux-.*
diff --git a/cpython-unix/patch-configure-add-loongarch-triplet.patch b/cpython-unix/patch-configure-add-loongarch-triplet.patch
new file mode 100644
index 000000000..30b9e5a02
--- /dev/null
+++ b/cpython-unix/patch-configure-add-loongarch-triplet.patch
@@ -0,0 +1,50 @@
+diff --git a/configure b/configure
+index b7be60e..d799415 100755
+--- a/configure
++++ b/configure
+@@ -5261,6 +5261,20 @@ cat >> conftest.c <=6) && defined(_MIPSEL)
+diff --git a/configure.ac b/configure.ac
+index aa515da..b5bad6e 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -779,6 +779,20 @@ cat >> conftest.c <=6) && defined(_MIPSEL)
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index 451b9840b..221a0e461 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -332,6 +332,47 @@ armv7-unknown-linux-gnueabihf:
- zstd
openssl_target: linux-armv4
+loongarch64-unknown-linux-gnu:
+ host_platforms:
+ - linux_x86_64
+ pythons_supported:
+ - '3.9'
+ - '3.10'
+ - '3.11'
+ - '3.12'
+ - '3.13'
+ - '3.14'
+ docker_image_suffix: .cross-loongarch64
+ host_cc: /usr/bin/x86_64-linux-gnu-gcc
+ host_cxx: /usr/bin/x86_64-linux-gnu-g++
+ target_cc: /usr/bin/loongarch64-linux-gnu-gcc
+ target_cxx: /usr/bin/loongarch64-linux-gnu-g++
+ needs:
+ - autoconf
+ - bdb
+ - binutils
+ - bzip2
+ - expat
+ - libedit
+ - libffi
+ - libX11
+ - libXau
+ - libxcb
+ - m4
+ - mpdecimal
+ - ncurses
+ - openssl-3.0
+ - patchelf
+ - sqlite
+ - tcl
+ - tk
+ - uuid
+ - xorgproto
+ - xz
+ - zlib
+ - zstd
+ openssl_target: linux64-loongarch64
+
mips-unknown-linux-gnu:
host_platforms:
- linux_x86_64
diff --git a/docs/building.rst b/docs/building.rst
index 605f5f038..4557072ae 100644
--- a/docs/building.rst
+++ b/docs/building.rst
@@ -39,6 +39,7 @@ As are various other targets::
$ ./build-linux.py --target aarch64-unknown-linux-gnu
$ ./build-linux.py --target armv7-unknown-linux-gnueabi
$ ./build-linux.py --target armv7-unknown-linux-gnueabihf
+ $ ./build-linux.py --target loongarch64-unknown-linux-gnu
$ ./build-linux.py --target mips-unknown-linux-gnu
$ ./build-linux.py --target mipsel-unknown-linux-gnu
$ ./build-linux.py --target ppc64le-unknown-linux-gnu
From 6d3649fb6aaabef776602430b1df92afe4a5c101 Mon Sep 17 00:00:00 2001
From: Edward Knight
Date: Mon, 1 Sep 2025 14:16:46 +0100
Subject: [PATCH 084/231] Add OpenSSL 3.5, build with instead of 3.0
This means all supported Unix platforms (CPython 3.9+),
and Windows from CPython 3.11+.
This initial attempt copies what we did for OpenSSL 3.0.
---
cpython-unix/Makefile | 4 +++
cpython-unix/build-openssl-3.5.sh | 50 +++++++++++++++++++++++++++++
cpython-unix/build.py | 3 +-
cpython-unix/targets.yml | 52 +++++++++++++++----------------
cpython-windows/build.py | 4 +--
pythonbuild/downloads.py | 13 ++++++--
src/verify_distribution.py | 4 +--
7 files changed, 96 insertions(+), 34 deletions(-)
create mode 100755 cpython-unix/build-openssl-3.5.sh
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
index 7e5641458..8fdcc94a6 100644
--- a/cpython-unix/Makefile
+++ b/cpython-unix/Makefile
@@ -177,6 +177,9 @@ $(OUTDIR)/openssl-1.1-$(OPENSSL_1.1_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP
$(OUTDIR)/openssl-3.0-$(OPENSSL_3.0_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-openssl-3.0.sh
$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) openssl-3.0
+$(OUTDIR)/openssl-3.5-$(OPENSSL_3.5_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-openssl-3.5.sh
+ $(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) openssl-3.5
+
LIBEDIT_DEPENDS = \
$(PYTHON_DEP_DEPENDS) \
$(OUTDIR)/ncurses-$(NCURSES_VERSION)-$(PACKAGE_SUFFIX).tar \
@@ -263,6 +266,7 @@ PYTHON_DEPENDS_$(1) := \
$$(if $$(NEED_NCURSES),$$(OUTDIR)/ncurses-$$(NCURSES_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_OPENSSL_1_1),$$(OUTDIR)/openssl-1.1-$$(OPENSSL_1.1_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_OPENSSL_3_0),$$(OUTDIR)/openssl-3.0-$$(OPENSSL_3.0_VERSION)-$$(PACKAGE_SUFFIX).tar) \
+ $$(if $$(NEED_OPENSSL_3_5),$$(OUTDIR)/openssl-3.5-$$(OPENSSL_3.5_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_PATCHELF),$$(OUTDIR)/patchelf-$$(PATCHELF_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_SQLITE),$$(OUTDIR)/sqlite-$$(SQLITE_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_TCL),$$(OUTDIR)/tcl-$$(TCL_VERSION)-$$(PACKAGE_SUFFIX).tar) \
diff --git a/cpython-unix/build-openssl-3.5.sh b/cpython-unix/build-openssl-3.5.sh
new file mode 100755
index 000000000..952098c5d
--- /dev/null
+++ b/cpython-unix/build-openssl-3.5.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+set -ex
+
+ROOT=`pwd`
+
+export PATH=${TOOLS_PATH}/${TOOLCHAIN}/bin:${TOOLS_PATH}/host/bin:$PATH
+
+tar -xf openssl-${OPENSSL_3_5_VERSION}.tar.gz
+
+pushd openssl-${OPENSSL_3_5_VERSION}
+
+# Otherwise it gets set to /tools/deps/ssl by default.
+case "${TARGET_TRIPLE}" in
+ *apple*)
+ EXTRA_FLAGS="--openssldir=/private/etc/ssl"
+ ;;
+ *)
+ EXTRA_FLAGS="--openssldir=/etc/ssl"
+ ;;
+esac
+
+# musl is missing support for various primitives.
+# TODO disable secure memory is a bit scary. We should look into a proper
+# workaround.
+if [ "${CC}" = "musl-clang" ]; then
+ EXTRA_FLAGS="${EXTRA_FLAGS} no-async -DOPENSSL_NO_ASYNC -D__STDC_NO_ATOMICS__=1 no-engine -DOPENSSL_NO_SECURE_MEMORY"
+fi
+
+# The -arch cflags confuse Configure. And OpenSSL adds them anyway.
+# Strip them.
+EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS/\-arch arm64/}
+EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS/\-arch x86_64/}
+
+EXTRA_FLAGS="${EXTRA_FLAGS} ${EXTRA_TARGET_CFLAGS}"
+
+/usr/bin/perl ./Configure \
+ --prefix=/tools/deps \
+ --libdir=lib \
+ ${OPENSSL_TARGET} \
+ no-legacy \
+ no-shared \
+ no-tests \
+ ${EXTRA_FLAGS}
+
+make -j ${NUM_CPUS}
+make -j ${NUM_CPUS} install_sw install_ssldirs DESTDIR=${ROOT}/out
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index c5d73a1c0..8a5e35ab7 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -274,7 +274,7 @@ def simple_build(
add_target_env(env, host_platform, target_triple, build_env)
- if entry in ("openssl-1.1", "openssl-3.0"):
+ if entry.startswith("openssl-"):
settings = get_targets(TARGETS_CONFIG)[target_triple]
env["OPENSSL_TARGET"] = settings["openssl_target"]
@@ -1114,6 +1114,7 @@ def main():
"ncurses",
"openssl-1.1",
"openssl-3.0",
+ "openssl-3.5",
"patchelf",
"sqlite",
"tcl",
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index 221a0e461..cb1e77f31 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -102,7 +102,7 @@ aarch64-apple-darwin:
- libffi
- m4
- mpdecimal
- - openssl-3.0
+ - openssl-3.5
- sqlite
- tcl
- tk
@@ -149,7 +149,7 @@ aarch64-apple-ios:
- libffi
- m4
- mpdecimal
- - openssl-3.0
+ - openssl-3.5
- sqlite
- xz
- zstd
@@ -190,7 +190,7 @@ aarch64-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -244,7 +244,7 @@ arm64-apple-tvos:
- expat
- m4
- mpdecimal
- - openssl-3.0
+ - openssl-3.5
- sqlite
- xz
- zstd
@@ -279,7 +279,7 @@ armv7-unknown-linux-gnueabi:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -320,7 +320,7 @@ armv7-unknown-linux-gnueabihf:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -361,7 +361,7 @@ loongarch64-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -402,7 +402,7 @@ mips-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -443,7 +443,7 @@ mipsel-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -484,7 +484,7 @@ ppc64le-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -525,7 +525,7 @@ riscv64-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -566,7 +566,7 @@ s390x-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -615,7 +615,7 @@ thumb7k-apple-watchos:
- expat
- m4
- mpdecimal
- - openssl-3.0
+ - openssl-3.5
- sqlite
- xz
- zstd
@@ -668,7 +668,7 @@ x86_64-apple-darwin:
- libffi
- m4
- mpdecimal
- - openssl-3.0
+ - openssl-3.5
- sqlite
- tcl
- tk
@@ -715,7 +715,7 @@ x86_64-apple-ios:
- libffi
- m4
- mpdecimal
- - openssl-3.0
+ - openssl-3.5
- sqlite
- xz
- zstd
@@ -758,7 +758,7 @@ x86_64-apple-tvos:
- expat
- m4
- mpdecimal
- - openssl-3.0
+ - openssl-3.5
- sqlite
- xz
- zstd
@@ -801,7 +801,7 @@ x86_64-apple-watchos:
- expat
- m4
- mpdecimal
- - openssl-3.0
+ - openssl-3.5
- sqlite
- xz
- zstd
@@ -840,7 +840,7 @@ x86_64-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -887,7 +887,7 @@ x86_64_v2-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -934,7 +934,7 @@ x86_64_v3-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -981,7 +981,7 @@ x86_64_v4-unknown-linux-gnu:
- m4
- mpdecimal
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -1026,7 +1026,7 @@ x86_64-unknown-linux-musl:
- mpdecimal
- musl
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -1071,7 +1071,7 @@ x86_64_v2-unknown-linux-musl:
- mpdecimal
- musl
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -1116,7 +1116,7 @@ x86_64_v3-unknown-linux-musl:
- mpdecimal
- musl
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -1161,7 +1161,7 @@ x86_64_v4-unknown-linux-musl:
- mpdecimal
- musl
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
@@ -1208,7 +1208,7 @@ aarch64-unknown-linux-musl:
- mpdecimal
- musl
- ncurses
- - openssl-3.0
+ - openssl-3.5
- patchelf
- sqlite
- tcl
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index 5fce1abfb..19e5b9696 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -470,7 +470,7 @@ def hack_props(
raise Exception("unhandled architecture: %s" % arch)
try:
- # CPython 3.11+ builds with OpenSSL 3.0 by default.
+ # CPython 3.11+ builds with OpenSSL 3.x by default.
static_replace_in_file(
openssl_props,
b"<_DLLSuffix>-3",
@@ -1874,7 +1874,7 @@ def main() -> None:
if args.python in ("cpython-3.9", "cpython-3.10"):
openssl_entry = "openssl-1.1"
else:
- openssl_entry = "openssl-3.0"
+ openssl_entry = "openssl-3.5"
openssl_archive = BUILD / (
"%s-%s-%s.tar" % (openssl_entry, target_triple, build_options)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index e1562c04d..2f2469c17 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -247,9 +247,6 @@
"licenses": ["OpenSSL"],
"license_file": "LICENSE.openssl-1.1.txt",
},
- # We use OpenSSL 3.0 because it is an LTS release and has a longer support
- # window. If CPython ends up gaining support for 3.1+ releases, we can consider
- # using the latest available.
# Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
"openssl-3.0": {
"url": "https://www.openssl.org/source/openssl-3.0.16.tar.gz",
@@ -260,6 +257,16 @@
"licenses": ["Apache-2.0"],
"license_file": "LICENSE.openssl-3.txt",
},
+ # Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
+ "openssl-3.5": {
+ "url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.2/openssl-3.5.2.tar.gz",
+ "size": 53180161,
+ "sha256": "c53a47e5e441c930c3928cf7bf6fb00e5d129b630e0aa873b08258656e7345ec",
+ "version": "3.5.2",
+ "library_names": ["crypto", "ssl"],
+ "licenses": ["Apache-2.0"],
+ "license_file": "LICENSE.openssl-3.txt",
+ },
"nasm-windows-bin": {
"url": "https://github.com/python/cpython-bin-deps/archive/nasm-2.11.06.tar.gz",
"size": 384826,
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 62d58f978..a4704f3fb 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -147,12 +147,12 @@ def test_ssl(self):
self.assertTrue(ssl.HAS_TLSv1_2)
self.assertTrue(ssl.HAS_TLSv1_3)
- # OpenSSL 1.1 on older CPython versions on Windows. 3.0 everywhere
+ # OpenSSL 1.1 on older CPython versions on Windows. 3.5 everywhere
# else.
if os.name == "nt" and sys.version_info[0:2] < (3, 11):
wanted_version = (1, 1, 1, 23, 15)
else:
- wanted_version = (3, 0, 0, 16, 0)
+ wanted_version = (3, 5, 0, 2, 0)
self.assertEqual(ssl.OPENSSL_VERSION_INFO, wanted_version)
From e81856b40332c8d9bd24bed80f33c837f1a2905c Mon Sep 17 00:00:00 2001
From: Edward Knight
Date: Tue, 2 Sep 2025 10:18:27 +0100
Subject: [PATCH 085/231] Bump minimum supported s390x arch-level to z10
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This has been done to support OpenSSL 3.5 that uses the `cijne` opcode.
This is still a very conservative arch-level.
Gentoo also made this change when updating to OpenSSL 3.5, and to quote
the news item from Andreas K. Hüttel:
> The z10 Enterprise Class (2097 series) was introduced in February 2008,
> which essentially means everyone except hardware archaeologists should be fine.
---
cpython-unix/targets.yml | 3 +++
1 file changed, 3 insertions(+)
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index cb1e77f31..73fe43cc9 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -552,6 +552,9 @@ s390x-unknown-linux-gnu:
host_cxx: /usr/bin/x86_64-linux-gnu-g++
target_cc: /usr/bin/s390x-linux-gnu-gcc
target_cxx: /usr/bin/s390x-linux-gnu-g++
+ target_cflags:
+ # set the minimum compatibility level to z10 (released 2008)
+ - '-march=z10'
needs:
- autoconf
- bdb
From 643516bc192af4fe846fea0d84bcbe491580ed8f Mon Sep 17 00:00:00 2001
From: Edward Knight
Date: Tue, 2 Sep 2025 10:31:02 +0100
Subject: [PATCH 086/231] Bump NASM version to 2.16.03
This is to support building OpenSSL 3.5.
Version 2.16.03 is the latest stable version at the time of writing.
---
cpython-windows/build.py | 4 ++--
pythonbuild/downloads.py | 8 ++++----
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index 19e5b9696..26023247f 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -720,11 +720,11 @@ def build_openssl_for_arch(
log("extracting %s to %s" % (openssl_archive, build_root))
extract_tar_to_directory(openssl_archive, build_root)
log("extracting %s to %s" % (nasm_archive, build_root))
- extract_tar_to_directory(nasm_archive, build_root)
+ extract_zip_to_directory(nasm_archive, build_root)
log("extracting %s to %s" % (jom_archive, build_root))
extract_zip_to_directory(jom_archive, build_root / "jom")
- nasm_path = build_root / ("cpython-bin-deps-nasm-%s" % nasm_version)
+ nasm_path = build_root / ("nasm-%s" % nasm_version)
jom_path = build_root / "jom"
env = dict(os.environ)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 2f2469c17..c63fba2b2 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -268,10 +268,10 @@
"license_file": "LICENSE.openssl-3.txt",
},
"nasm-windows-bin": {
- "url": "https://github.com/python/cpython-bin-deps/archive/nasm-2.11.06.tar.gz",
- "size": 384826,
- "sha256": "8af0ae5ceed63fa8a2ded611d44cc341027a91df22aaaa071efedc81437412a5",
- "version": "2.11.06",
+ "url": "https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/win64/nasm-2.16.03-win64.zip",
+ "size": 513543,
+ "sha256": "3ee4782247bcb874378d02f7eab4e294a84d3d15f3f6ee2de2f47a46aa7226e6",
+ "version": "2.16.03",
},
"patchelf": {
"url": "https://github.com/NixOS/patchelf/releases/download/0.13.1/patchelf-0.13.1.tar.bz2",
From 7edd1aabe4dc7e355a0bb642adda9729dc1b3b12 Mon Sep 17 00:00:00 2001
From: Edward Knight
Date: Tue, 2 Sep 2025 10:50:39 +0100
Subject: [PATCH 087/231] Patch OpenSSL 3.5 to hardcode the vlenb CSR address
on RISC-V
Our GCC version doesn't know it, so replace the `vlenb` variable with
`0xc22`. See openssl/openssl#23011.
---
cpython-unix/build-openssl-3.5.sh | 6 ++++++
cpython-unix/build.py | 4 ++++
.../patch-openssl-3.5-riscv-vlenb-register.patch | 15 +++++++++++++++
3 files changed, 25 insertions(+)
create mode 100644 cpython-unix/patch-openssl-3.5-riscv-vlenb-register.patch
diff --git a/cpython-unix/build-openssl-3.5.sh b/cpython-unix/build-openssl-3.5.sh
index 952098c5d..ea7d5c60b 100755
--- a/cpython-unix/build-openssl-3.5.sh
+++ b/cpython-unix/build-openssl-3.5.sh
@@ -13,6 +13,12 @@ tar -xf openssl-${OPENSSL_3_5_VERSION}.tar.gz
pushd openssl-${OPENSSL_3_5_VERSION}
+# hardcode the vlenb CSR address (0xc22) as our GCC version doesn't know it
+# https://github.com/riscv/riscv-isa-manual/blob/c001fa237cdd8b6079384044462a89eb0e3fd9cf/src/v-st-ext.adoc?plain=1#L74
+if [[ "${TARGET_TRIPLE}" = "riscv64-unknown-linux-gnu" ]]; then
+ patch -p1 -i "${ROOT}/patch-openssl-3.5-riscv-vlenb-register.patch"
+fi
+
# Otherwise it gets set to /tools/deps/ssl by default.
case "${TARGET_TRIPLE}" in
*apple*)
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index 8a5e35ab7..cef7be616 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -274,9 +274,13 @@ def simple_build(
add_target_env(env, host_platform, target_triple, build_env)
+ # for OpenSSL, set the OPENSSL_TARGET environment variable and copy in patches
if entry.startswith("openssl-"):
settings = get_targets(TARGETS_CONFIG)[target_triple]
env["OPENSSL_TARGET"] = settings["openssl_target"]
+ build_env.copy_file(
+ SUPPORT / "patch-openssl-3.5-riscv-vlenb-register.patch"
+ )
build_env.run("build-%s.sh" % entry, environment=env)
diff --git a/cpython-unix/patch-openssl-3.5-riscv-vlenb-register.patch b/cpython-unix/patch-openssl-3.5-riscv-vlenb-register.patch
new file mode 100644
index 000000000..dacedeef6
--- /dev/null
+++ b/cpython-unix/patch-openssl-3.5-riscv-vlenb-register.patch
@@ -0,0 +1,15 @@
+diff --git a/crypto/riscv64cpuid.pl b/crypto/riscv64cpuid.pl
+index 5dcdc5c584..7751ad50d9 100644
+--- a/crypto/riscv64cpuid.pl
++++ b/crypto/riscv64cpuid.pl
+@@ -94,8 +94,8 @@ $code .= <<___;
+ .globl riscv_vlen_asm
+ .type riscv_vlen_asm,\@function
+ riscv_vlen_asm:
+- csrr $ret, vlenb
+- slli $ret, $ret, 3
++ csrr a0, 0xc22
++ slli a0, a0, 3
+ ret
+ .size riscv_vlen_asm,.-riscv_vlen_asm
+ ___
From 87563b47e397d589653affad1f0f470e1bb01d73 Mon Sep 17 00:00:00 2001
From: Edward Knight
Date: Tue, 2 Sep 2025 15:40:32 +0100
Subject: [PATCH 088/231] Add C++ to cross-compiling Docker images
This is a follow-on from #512 / d0ed97f where we started always setting
the CXX environment variable to ensure we don't accidentally try and use
the host (non-cross-compiling) C++ compiler.
In attempting to upgrade to a more modern s509x minimum arch-level
(z10), we found that the configure script for bdb fails. It tries to
check the C++ compiler is working (respecting the CXX environment
variable that is set), but fails to run the pre-processor with
`$CXX -E` (as the C++ compiler isn't actually installed). It then falls
back to `/lib/cpp`, which up until now has been working fine. Now that
we're specifying `-march=z10` this fails as `/lib/cpp` doesn't know
about `z10`.
I don't know if we actually need to use the C++ compiler, but I'm adding
it in to at least satisfy the configure script, and do the correct thing
should we need it (rather than the incorrect thing of falling back to
the host compiler).
---
cpython-unix/build.cross-loongarch64.Dockerfile | 1 +
cpython-unix/build.cross-riscv64.Dockerfile | 9 +++++++++
cpython-unix/build.cross.Dockerfile | 8 ++++++++
3 files changed, 18 insertions(+)
diff --git a/cpython-unix/build.cross-loongarch64.Dockerfile b/cpython-unix/build.cross-loongarch64.Dockerfile
index fc1f27bcf..2e78250ef 100644
--- a/cpython-unix/build.cross-loongarch64.Dockerfile
+++ b/cpython-unix/build.cross-loongarch64.Dockerfile
@@ -53,6 +53,7 @@ RUN apt-get install \
zlib1g-dev
RUN apt-get install \
+ g++-loongarch64-linux-gnu \
gcc-loongarch64-linux-gnu \
libc6-dev-loong64-cross
diff --git a/cpython-unix/build.cross-riscv64.Dockerfile b/cpython-unix/build.cross-riscv64.Dockerfile
index 6114fe755..2e43a1521 100644
--- a/cpython-unix/build.cross-riscv64.Dockerfile
+++ b/cpython-unix/build.cross-riscv64.Dockerfile
@@ -48,6 +48,15 @@ RUN apt-get install \
# Cross-building.
RUN apt-get install \
+ g++-aarch64-linux-gnu \
+ g++-arm-linux-gnueabi \
+ g++-arm-linux-gnueabihf \
+ g++-mips-linux-gnu \
+ g++-mips64el-linux-gnuabi64 \
+ g++-mipsel-linux-gnu \
+ g++-powerpc64le-linux-gnu \
+ g++-riscv64-linux-gnu \
+ g++-s390x-linux-gnu \
gcc-aarch64-linux-gnu \
gcc-arm-linux-gnueabi \
gcc-arm-linux-gnueabihf \
diff --git a/cpython-unix/build.cross.Dockerfile b/cpython-unix/build.cross.Dockerfile
index d8e557fe3..3665f9ac2 100644
--- a/cpython-unix/build.cross.Dockerfile
+++ b/cpython-unix/build.cross.Dockerfile
@@ -51,6 +51,14 @@ RUN apt-get install \
# Cross-building.
RUN apt-get install \
+ g++-aarch64-linux-gnu \
+ g++-arm-linux-gnueabi \
+ g++-arm-linux-gnueabihf \
+ g++-mips-linux-gnu \
+ g++-mips64el-linux-gnuabi64 \
+ g++-mipsel-linux-gnu \
+ g++-powerpc64le-linux-gnu \
+ g++-s390x-linux-gnu \
gcc-aarch64-linux-gnu \
gcc-arm-linux-gnueabi \
gcc-arm-linux-gnueabihf \
From e00d99a6a07ebc1d5b7c44fd25288e39dedb8584 Mon Sep 17 00:00:00 2001
From: Edward Knight
Date: Wed, 3 Sep 2025 11:11:29 +0100
Subject: [PATCH 089/231] Remove OpenSSL 3.0
Now we're building with OpenSSL 3.5 instead of 3.0, we no longer need
the build configuration around.
---
cpython-unix/Makefile | 4 ---
cpython-unix/build-openssl-3.0.sh | 50 -------------------------------
cpython-unix/build.py | 1 -
pythonbuild/downloads.py | 10 -------
4 files changed, 65 deletions(-)
delete mode 100755 cpython-unix/build-openssl-3.0.sh
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
index 8fdcc94a6..577f44fd0 100644
--- a/cpython-unix/Makefile
+++ b/cpython-unix/Makefile
@@ -174,9 +174,6 @@ $(OUTDIR)/ncurses-$(NCURSES_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS
$(OUTDIR)/openssl-1.1-$(OPENSSL_1.1_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-openssl-1.1.sh
$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) openssl-1.1
-$(OUTDIR)/openssl-3.0-$(OPENSSL_3.0_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-openssl-3.0.sh
- $(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) openssl-3.0
-
$(OUTDIR)/openssl-3.5-$(OPENSSL_3.5_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-openssl-3.5.sh
$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) openssl-3.5
@@ -265,7 +262,6 @@ PYTHON_DEPENDS_$(1) := \
$$(if $$(NEED_MPDECIMAL),$$(OUTDIR)/mpdecimal-$$(MPDECIMAL_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_NCURSES),$$(OUTDIR)/ncurses-$$(NCURSES_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_OPENSSL_1_1),$$(OUTDIR)/openssl-1.1-$$(OPENSSL_1.1_VERSION)-$$(PACKAGE_SUFFIX).tar) \
- $$(if $$(NEED_OPENSSL_3_0),$$(OUTDIR)/openssl-3.0-$$(OPENSSL_3.0_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_OPENSSL_3_5),$$(OUTDIR)/openssl-3.5-$$(OPENSSL_3.5_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_PATCHELF),$$(OUTDIR)/patchelf-$$(PATCHELF_VERSION)-$$(PACKAGE_SUFFIX).tar) \
$$(if $$(NEED_SQLITE),$$(OUTDIR)/sqlite-$$(SQLITE_VERSION)-$$(PACKAGE_SUFFIX).tar) \
diff --git a/cpython-unix/build-openssl-3.0.sh b/cpython-unix/build-openssl-3.0.sh
deleted file mode 100755
index 1d1f91348..000000000
--- a/cpython-unix/build-openssl-3.0.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-set -ex
-
-ROOT=`pwd`
-
-export PATH=${TOOLS_PATH}/${TOOLCHAIN}/bin:${TOOLS_PATH}/host/bin:$PATH
-
-tar -xf openssl-${OPENSSL_3_0_VERSION}.tar.gz
-
-pushd openssl-${OPENSSL_3_0_VERSION}
-
-# Otherwise it gets set to /tools/deps/ssl by default.
-case "${TARGET_TRIPLE}" in
- *apple*)
- EXTRA_FLAGS="--openssldir=/private/etc/ssl"
- ;;
- *)
- EXTRA_FLAGS="--openssldir=/etc/ssl"
- ;;
-esac
-
-# musl is missing support for various primitives.
-# TODO disable secure memory is a bit scary. We should look into a proper
-# workaround.
-if [ "${CC}" = "musl-clang" ]; then
- EXTRA_FLAGS="${EXTRA_FLAGS} no-async -DOPENSSL_NO_ASYNC -D__STDC_NO_ATOMICS__=1 no-engine -DOPENSSL_NO_SECURE_MEMORY"
-fi
-
-# The -arch cflags confuse Configure. And OpenSSL adds them anyway.
-# Strip them.
-EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS/\-arch arm64/}
-EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS/\-arch x86_64/}
-
-EXTRA_FLAGS="${EXTRA_FLAGS} ${EXTRA_TARGET_CFLAGS}"
-
-/usr/bin/perl ./Configure \
- --prefix=/tools/deps \
- --libdir=lib \
- ${OPENSSL_TARGET} \
- no-legacy \
- no-shared \
- no-tests \
- ${EXTRA_FLAGS}
-
-make -j ${NUM_CPUS}
-make -j ${NUM_CPUS} install_sw install_ssldirs DESTDIR=${ROOT}/out
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index cef7be616..1fbb019bd 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -1117,7 +1117,6 @@ def main():
"mpdecimal",
"ncurses",
"openssl-1.1",
- "openssl-3.0",
"openssl-3.5",
"patchelf",
"sqlite",
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index c63fba2b2..e5f3c0aed 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -248,16 +248,6 @@
"license_file": "LICENSE.openssl-1.1.txt",
},
# Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
- "openssl-3.0": {
- "url": "https://www.openssl.org/source/openssl-3.0.16.tar.gz",
- "size": 15334967,
- "sha256": "57e03c50feab5d31b152af2b764f10379aecd8ee92f16c985983ce4a99f7ef86",
- "version": "3.0.16",
- "library_names": ["crypto", "ssl"],
- "licenses": ["Apache-2.0"],
- "license_file": "LICENSE.openssl-3.txt",
- },
- # Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
"openssl-3.5": {
"url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.2/openssl-3.5.2.tar.gz",
"size": 53180161,
From 877486854b01df47f6dfb558d8430b2282b65f4b Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Wed, 17 Sep 2025 09:50:53 -0400
Subject: [PATCH 090/231] macOS CI: Stop setting $APPLE_SDK_PATH (#795)
The build script supports locating this with `xcrun --show-sdk-path`. It
looks like we originally started overriding this in CI to force use of
the 10.15 SDK to work around issues with the 11.0 one (09ca2ac775). We
should be able to support building with the newest SDK because we set
`-mmacosx-version-min` / `MACOSX_DEPLOYMENT_TARGET` to a low value, and
this keeps us robust to GitHub runner image changes. There are SDK
compatibility tests, too.
---
.github/workflows/macos.yml | 9 ---------
1 file changed, 9 deletions(-)
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index cadaf4c47..941b48dd0 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -142,15 +142,6 @@ jobs:
- name: Build
if: ${{ ! matrix.dry-run }}
run: |
- if [ "${MATRIX_TARGET_TRIPLE}" = "aarch64-apple-darwin" ]; then
- export APPLE_SDK_PATH=/Applications/Xcode_15.2.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.2.sdk
- elif [ "${MATRIX_TARGET_TRIPLE}" = "x86_64-apple-darwin" ]; then
- export APPLE_SDK_PATH=/Applications/Xcode_15.2.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.2.sdk
- else
- echo "unhandled target triple: ${MATRIX_TARGET_TRIPLE}"
- exit 1
- fi
-
./build-macos.py --target-triple ${MATRIX_TARGET_TRIPLE} --python cpython-${MATRIX_PYTHON} --options ${MATRIX_BUILD_OPTIONS}
env:
MATRIX_TARGET_TRIPLE: ${{ matrix.target_triple }}
From aeba083000901a0a8e00aac9484e043fd40b6bee Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Wed, 17 Sep 2025 19:16:15 -0400
Subject: [PATCH 091/231] downloads: Switch NASM and ftp.gnu.org sources to
mirrors (#796)
---
pythonbuild/downloads.py | 31 +++++++++++++++++++++++--------
1 file changed, 23 insertions(+), 8 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index e5f3c0aed..c4c12516d 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -2,9 +2,20 @@
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+# Several files here are mirrored from their upstream sources due to flaky
+# downloads from upstream hosts (either intentional rate limiting or general
+# low-availability / non-CDN infrastructure) and to reduce load on them. To
+# update a file, push the new artifact to github.com/astral-sh/mirror (without
+# removing the old artifact) and then update here once GitHub Pages has
+# deployed. Feel free to point directly to the upstream source while working on
+# a PR, especially if you don't have push access to astral-sh/mirror or are
+# unsure if the PR will land, but we should make sure to switch back to the
+# mirror shortly after landing the dependency.
+
DOWNLOADS = {
"autoconf": {
- "url": "https://ftp.gnu.org/gnu/autoconf/autoconf-2.72.tar.gz",
+ # Mirrored from https://ftp.gnu.org/gnu/autoconf/autoconf-2.72.tar.gz
+ "url": "https://astral-sh.github.io/mirror/files/autoconf-2.72.tar.gz",
"size": 2143794,
"sha256": "afb181a76e1ee72832f6581c0eddf8df032b83e2e0239ef79ebedc4467d92d6e",
"version": "2.72",
@@ -20,14 +31,14 @@
"license_file": "LICENSE.bdb.txt",
},
"binutils": {
- "url": "https://ftp.gnu.org/gnu/binutils/binutils-2.43.tar.xz",
+ # Mirrored from https://ftp.gnu.org/gnu/binutils/binutils-2.43.tar.xz
+ "url": "https://astral-sh.github.io/mirror/files/binutils-2.43.tar.xz",
"size": 28175768,
"sha256": "b53606f443ac8f01d1d5fc9c39497f2af322d99e14cea5c0b4b124d630379365",
"version": "2.43",
},
"bzip2": {
- # Mirror of `https://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz` due to
- # rate limiting
+ # Mirrored from https://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz
"url": "https://astral-sh.github.io/mirror/files/bzip2-1.0.8.tar.gz",
"size": 810029,
"sha256": "ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269",
@@ -200,7 +211,8 @@
"version": "20.1.4+20250511",
},
"m4": {
- "url": "https://ftp.gnu.org/gnu/m4/m4-1.4.19.tar.xz",
+ # Mirrored from https://ftp.gnu.org/gnu/m4/m4-1.4.19.tar.xz
+ "url": "https://astral-sh.github.io/mirror/files/m4-1.4.19.tar.xz",
"size": 1654908,
"sha256": "63aede5c6d33b6d9b13511cd0be2cac046f2e70fd0a07aa9573a04a82783af96",
"version": "1.4.19",
@@ -229,7 +241,8 @@
"version": "1.2.5",
},
"ncurses": {
- "url": "https://ftp.gnu.org/pub/gnu/ncurses/ncurses-6.5.tar.gz",
+ # Mirrored from https://ftp.gnu.org/pub/gnu/ncurses/ncurses-6.5.tar.gz
+ "url": "https://astral-sh.github.io/mirror/files/ncurses-6.5.tar.gz",
"size": 3688489,
"sha256": "136d91bc269a9a5785e5f9e980bc76ab57428f604ce3e5a5a90cebc767971cc6",
"version": "6.5",
@@ -258,7 +271,8 @@
"license_file": "LICENSE.openssl-3.txt",
},
"nasm-windows-bin": {
- "url": "https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/win64/nasm-2.16.03-win64.zip",
+ # Mirrored from https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/win64/nasm-2.16.03-win64.zip
+ "url": "https://astral-sh.github.io/mirror/files/nasm-2.16.03-win64.zip",
"size": 513543,
"sha256": "3ee4782247bcb874378d02f7eab4e294a84d3d15f3f6ee2de2f47a46aa7226e6",
"version": "2.16.03",
@@ -276,7 +290,8 @@
"version": "24.3.1",
},
"readline": {
- "url": "https://ftp.gnu.org/gnu/readline/readline-8.2.tar.gz",
+ # Mirrored from https://ftp.gnu.org/gnu/readline/readline-8.2.tar.gz
+ "url": "https://astral-sh.github.io/mirror/files/readline-8.2.tar.gz",
"size": 3043952,
"sha256": "3feb7171f16a84ee82ca18a36d7b9be109a52c04f492a053331d7d1095007c35",
"version": "8.2",
From e414d4c7cd6a008a73c5d2138ab360ee60bac095 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Thu, 18 Sep 2025 08:52:56 -0400
Subject: [PATCH 092/231] sqlite: Remove -DSQLITE_ENABLE_FTS3_TOKENIZER and add
tests for compile options (#791)
As noted in the discussion in #562, compiling SQLite with the
-DSQLITE_ENABLE_FTS3_TOKENIZER flag is equivalent to using
`connection.setconfig(sqlite3.SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER)` at
runtime. The purpose of this option, in either syntax, is to disable a
security measure to provide backwards compatibility for older code.
Specifically, the `fts3_tokenizer()` function can accept or return a
native-code pointer to a structure containing callback functions, which
makes it an attractive target for SQL injection attacks to escalate to
arbitrary native code execution. The more-secure behavior is to require
the use of bound parameters with this function; the backwards-compatible
behavior allows the function to be called with blob literals or computed
values. Because of a documentation shortcoming, some applications
thought they needed this option on at compile time, and so Debian's
SQLite build, used by e.g. the `python` container on Dockerhub, has it
on. But there is no functionality that is only enabled by having this
option on at compile time. Ideally, applications should use bound
parameters when calling this function. If that code change is hard, they
can alternatively set the option themselves at runtime to preserve
compatibility with existing code, but that still doesn't need anything
turned on at compile time. So the right decision for us is not to enable
this flag at compile time and preserve the secure behavior.
Add a test that `fts3_tokenizer()` is usable with bound parameters but
not with blob literals, and also add tests for a couple of other
preivously-requested SQLite flags for compatibility with other
implementations:
* #309: -DSQLITE_ENABLE_DBSTAT_VTAB
* #449: serialize/deserialize (on by default, was just a compile-time
detection issue)
* #550: -DSQLITE_ENABLE_FTS3_PARENTHESIS
---
cpython-unix/build-sqlite.sh | 1 -
src/verify_distribution.py | 40 ++++++++++++++++++++++++++++++++++++
2 files changed, 40 insertions(+), 1 deletion(-)
diff --git a/cpython-unix/build-sqlite.sh b/cpython-unix/build-sqlite.sh
index ef7c6a631..596ceae9c 100755
--- a/cpython-unix/build-sqlite.sh
+++ b/cpython-unix/build-sqlite.sh
@@ -32,7 +32,6 @@ CFLAGS="${EXTRA_TARGET_CFLAGS} \
-DSQLITE_ENABLE_DBSTAT_VTAB \
-DSQLITE_ENABLE_FTS3 \
-DSQLITE_ENABLE_FTS3_PARENTHESIS \
- -DSQLITE_ENABLE_FTS3_TOKENIZER \
-DSQLITE_ENABLE_FTS4 \
-DSQLITE_ENABLE_FTS5 \
-DSQLITE_ENABLE_GEOPOLY \
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index a4704f3fb..169018836 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -3,6 +3,7 @@
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
import os
+import struct
import sys
import unittest
@@ -137,6 +138,45 @@ def test_sqlite(self):
cursor.execute(
f"CREATE VIRTUAL TABLE test{extension} USING {extension}(a, b, c);"
)
+
+ # Test various SQLite flags and features requested / expected by users.
+ # The DBSTAT virtual table shows some metadata about disk usage.
+ # https://www.sqlite.org/dbstat.html
+ self.assertNotEqual(
+ cursor.execute("SELECT COUNT(*) FROM dbstat;").fetchone()[0],
+ 0,
+ )
+
+ # The serialize/deserialize API is configurable at compile time.
+ if sys.version_info[0:2] >= (3, 11):
+ self.assertEqual(conn.serialize()[:15], b"SQLite format 3")
+
+ # The "enhanced query syntax" (-DSQLITE_ENABLE_FTS3_PARENTHESIS) allows parenthesizable
+ # AND, OR, and NOT operations. The "standard query syntax" only has OR as a keyword, so we
+ # can test for the difference with a query using AND.
+ # https://www.sqlite.org/fts3.html#_set_operations_using_the_enhanced_query_syntax
+ cursor.execute("INSERT INTO testfts3 VALUES('hello world', '', '');")
+ self.assertEqual(
+ cursor.execute(
+ "SELECT COUNT(*) FROM testfts3 WHERE a MATCH 'hello AND world';"
+ ).fetchone()[0],
+ 1,
+ )
+
+ # fts3_tokenizer() takes/returns native pointers. Newer SQLite versions require the use of
+ # bound parameters with this function to avoid the risk of a SQL injection esclating into a
+ # full RCE. This requirement can be disabled at either compile time or runtime for
+ # backwards compatibility. Ensure that the check is enabled (more secure) by default but
+ # applications can still use fts3_tokenize with a bound parameter. See discussion at
+ # https://github.com/astral-sh/python-build-standalone/pull/562#issuecomment-3254522958
+ wild_pointer = struct.pack("P", 0xDEADBEEF)
+ with self.assertRaises(sqlite3.OperationalError) as caught:
+ cursor.execute(
+ f"SELECT fts3_tokenizer('mytokenizer', x'{wild_pointer.hex()}')"
+ )
+ self.assertEqual(str(caught.exception), "fts3tokenize disabled")
+ cursor.execute("SELECT fts3_tokenizer('mytokenizer', ?)", (wild_pointer,))
+
conn.close()
def test_ssl(self):
From 4cec9330e55f62daae294cae2812e1f282a656b8 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Thu, 18 Sep 2025 08:23:14 -0500
Subject: [PATCH 093/231] Bump CPython to 3.14rc3 (#798)
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index c4c12516d..9aadb6f4f 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -93,10 +93,10 @@
"python_tag": "cp313",
},
"cpython-3.14": {
- "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0rc2.tar.xz",
- "size": 23566140,
- "sha256": "bc62854cf232345bd22c9091a68464e01e056c6473a3fffa84572c8a342da656",
- "version": "3.14.0rc2",
+ "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0rc3.tar.xz",
+ "size": 23585028,
+ "sha256": "646dc945e49c73a141896deda12d43f3f293fd69426774c16fc43496180e8fcd",
+ "version": "3.14.0rc3",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp314",
From 9793ac5f2ecd576cb3248c615a60d49f61cbc065 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Thu, 18 Sep 2025 11:52:13 -0400
Subject: [PATCH 094/231] Upgrade OpenSSL to 3.5.3 (#797)
---
cpython-unix/build-openssl-3.5.sh | 6 ------
cpython-unix/build.py | 5 +----
.../patch-openssl-3.5-riscv-vlenb-register.patch | 15 ---------------
pythonbuild/downloads.py | 8 ++++----
src/verify_distribution.py | 2 +-
5 files changed, 6 insertions(+), 30 deletions(-)
delete mode 100644 cpython-unix/patch-openssl-3.5-riscv-vlenb-register.patch
diff --git a/cpython-unix/build-openssl-3.5.sh b/cpython-unix/build-openssl-3.5.sh
index ea7d5c60b..952098c5d 100755
--- a/cpython-unix/build-openssl-3.5.sh
+++ b/cpython-unix/build-openssl-3.5.sh
@@ -13,12 +13,6 @@ tar -xf openssl-${OPENSSL_3_5_VERSION}.tar.gz
pushd openssl-${OPENSSL_3_5_VERSION}
-# hardcode the vlenb CSR address (0xc22) as our GCC version doesn't know it
-# https://github.com/riscv/riscv-isa-manual/blob/c001fa237cdd8b6079384044462a89eb0e3fd9cf/src/v-st-ext.adoc?plain=1#L74
-if [[ "${TARGET_TRIPLE}" = "riscv64-unknown-linux-gnu" ]]; then
- patch -p1 -i "${ROOT}/patch-openssl-3.5-riscv-vlenb-register.patch"
-fi
-
# Otherwise it gets set to /tools/deps/ssl by default.
case "${TARGET_TRIPLE}" in
*apple*)
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index 1fbb019bd..662d70216 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -274,13 +274,10 @@ def simple_build(
add_target_env(env, host_platform, target_triple, build_env)
- # for OpenSSL, set the OPENSSL_TARGET environment variable and copy in patches
+ # for OpenSSL, set the OPENSSL_TARGET environment variable
if entry.startswith("openssl-"):
settings = get_targets(TARGETS_CONFIG)[target_triple]
env["OPENSSL_TARGET"] = settings["openssl_target"]
- build_env.copy_file(
- SUPPORT / "patch-openssl-3.5-riscv-vlenb-register.patch"
- )
build_env.run("build-%s.sh" % entry, environment=env)
diff --git a/cpython-unix/patch-openssl-3.5-riscv-vlenb-register.patch b/cpython-unix/patch-openssl-3.5-riscv-vlenb-register.patch
deleted file mode 100644
index dacedeef6..000000000
--- a/cpython-unix/patch-openssl-3.5-riscv-vlenb-register.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/crypto/riscv64cpuid.pl b/crypto/riscv64cpuid.pl
-index 5dcdc5c584..7751ad50d9 100644
---- a/crypto/riscv64cpuid.pl
-+++ b/crypto/riscv64cpuid.pl
-@@ -94,8 +94,8 @@ $code .= <<___;
- .globl riscv_vlen_asm
- .type riscv_vlen_asm,\@function
- riscv_vlen_asm:
-- csrr $ret, vlenb
-- slli $ret, $ret, 3
-+ csrr a0, 0xc22
-+ slli a0, a0, 3
- ret
- .size riscv_vlen_asm,.-riscv_vlen_asm
- ___
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 9aadb6f4f..066ad434e 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -262,10 +262,10 @@
},
# Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
"openssl-3.5": {
- "url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.2/openssl-3.5.2.tar.gz",
- "size": 53180161,
- "sha256": "c53a47e5e441c930c3928cf7bf6fb00e5d129b630e0aa873b08258656e7345ec",
- "version": "3.5.2",
+ "url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.3/openssl-3.5.3.tar.gz",
+ "size": 53183370,
+ "sha256": "c9489d2abcf943cdc8329a57092331c598a402938054dc3a22218aea8a8ec3bf",
+ "version": "3.5.3",
"library_names": ["crypto", "ssl"],
"licenses": ["Apache-2.0"],
"license_file": "LICENSE.openssl-3.txt",
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 169018836..f0a1780d4 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -192,7 +192,7 @@ def test_ssl(self):
if os.name == "nt" and sys.version_info[0:2] < (3, 11):
wanted_version = (1, 1, 1, 23, 15)
else:
- wanted_version = (3, 5, 0, 2, 0)
+ wanted_version = (3, 5, 0, 3, 15)
self.assertEqual(ssl.OPENSSL_VERSION_INFO, wanted_version)
From 3811863706546c810782d758997cb8afdaf76d7e Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Thu, 18 Sep 2025 11:52:36 -0400
Subject: [PATCH 095/231] windows: Sync SQLite build flags from the UNIX build
(#800)
Notably this adds
* SQLITE_ENABLE_FTS3_PARENTHESIS (syntax change, see #550)
* SQLITE_ENABLE_DBSTAT_VTAB (#309)
* SQLITE_ENABLE_GEOPOLY (historically present on UNIX, maybe see #694)
---
cpython-unix/build-sqlite.sh | 1 +
cpython-windows/build.py | 30 ++++++++++++++++++++++++++++++
src/verify_distribution.py | 11 ++---------
3 files changed, 33 insertions(+), 9 deletions(-)
diff --git a/cpython-unix/build-sqlite.sh b/cpython-unix/build-sqlite.sh
index 596ceae9c..780e82705 100755
--- a/cpython-unix/build-sqlite.sh
+++ b/cpython-unix/build-sqlite.sh
@@ -28,6 +28,7 @@ fi
unset CXX
CC_FOR_BUILD="${HOST_CC}" \
+# Please try to keep these in sync with cpython-windows/build.py
CFLAGS="${EXTRA_TARGET_CFLAGS} \
-DSQLITE_ENABLE_DBSTAT_VTAB \
-DSQLITE_ENABLE_FTS3 \
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index 26023247f..f89021328 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -568,6 +568,36 @@ def hack_project_files(
rb"%s" % sqlite3_version_parts[3],
)
+ # Please try keep these in sync with cpython-unix/build-sqlite.sh
+ sqlite_build_flags = {
+ b"SQLITE_ENABLE_DBSTAT_VTAB",
+ b"SQLITE_ENABLE_FTS3",
+ b"SQLITE_ENABLE_FTS3_PARENTHESIS",
+ b"SQLITE_ENABLE_FTS4",
+ b"SQLITE_ENABLE_FTS5",
+ b"SQLITE_ENABLE_GEOPOLY",
+ b"SQLITE_ENABLE_RTREE",
+ }
+ with sqlite3_path.open("rb") as fh:
+ data = fh.read()
+ sqlite_preprocessor_regex = (
+ rb"(SQLITE_ENABLE.*)"
+ )
+ m = re.search(sqlite_preprocessor_regex, data)
+ if m is None:
+ raise NoSearchStringError(
+ "search string (%s) not in %s" % (sqlite_preprocessor_regex, sqlite3_path)
+ )
+ current_flags = set(m.group(1).split(b";"))
+ data = (
+ data[: m.start(1)]
+ + b";".join(sqlite_build_flags - current_flags)
+ + b";"
+ + data[m.start(1) :]
+ )
+ with sqlite3_path.open("wb") as fh:
+ fh.write(data)
+
# Our version of the xz sources is newer than what's in cpython-source-deps
# and the xz sources changed the path to config.h. Hack the project file
# accordingly.
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index f0a1780d4..efd352876 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -123,15 +123,8 @@ def test_sqlite(self):
self.assertTrue(hasattr(conn, "enable_load_extension"))
# Backup feature requires modern SQLite, which we always have.
self.assertTrue(hasattr(conn, "backup"))
- # Ensure that various extensions are present. These will raise if they are not. Note that
- # CPython upstream carries configuration flags for the Windows build, so geopoly is missing
- # on all versions and rtree is missing in 3.9. On non-Windows platforms, we configure
- # SQLite ourselves. We might want to patch the build to enable these on Windows, see #666.
- extensions = ["fts3", "fts4", "fts5"]
- if os.name != "nt":
- extensions.append("geopoly")
- if os.name != "nt" or sys.version_info[0:2] > (3, 9):
- extensions.append("rtree")
+ # Ensure that various extensions are present. These will raise if they are not.
+ extensions = ["fts3", "fts4", "fts5", "geopoly", "rtree"]
cursor = conn.cursor()
for extension in extensions:
with self.subTest(extension=extension):
From ceeed39f762907a2847586a1105f4f5b700b33cd Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Thu, 18 Sep 2025 12:23:01 -0400
Subject: [PATCH 096/231] cpython-unix/build-sqlite.sh: Fix typo in location of
comment (#803)
---
cpython-unix/build-sqlite.sh | 2 +-
cpython-windows/build.py | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/cpython-unix/build-sqlite.sh b/cpython-unix/build-sqlite.sh
index 780e82705..1d727c9a2 100755
--- a/cpython-unix/build-sqlite.sh
+++ b/cpython-unix/build-sqlite.sh
@@ -27,8 +27,8 @@ fi
# it's not looked for.
unset CXX
+# Please try to keep the build flags in sync with cpython-windows/build.py
CC_FOR_BUILD="${HOST_CC}" \
-# Please try to keep these in sync with cpython-windows/build.py
CFLAGS="${EXTRA_TARGET_CFLAGS} \
-DSQLITE_ENABLE_DBSTAT_VTAB \
-DSQLITE_ENABLE_FTS3 \
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index f89021328..c94aa4ab2 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -568,7 +568,7 @@ def hack_project_files(
rb"%s" % sqlite3_version_parts[3],
)
- # Please try keep these in sync with cpython-unix/build-sqlite.sh
+ # Please try to keep these in sync with cpython-unix/build-sqlite.sh
sqlite_build_flags = {
b"SQLITE_ENABLE_DBSTAT_VTAB",
b"SQLITE_ENABLE_FTS3",
From 45586d707de1cf94c3bff95d50d40c3c2a6f01ca Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Thu, 18 Sep 2025 12:23:15 -0400
Subject: [PATCH 097/231] CI: Disable Docker build summaries and artifacts
(#802)
The interesting work for our build happens outside of the Docker build,
so these just make the GitHub Actions summary page noisier.
https://github.com/docker/build-push-action#environment-variables
---
.github/workflows/linux.yml | 2 ++
1 file changed, 2 insertions(+)
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 3abc7bcfa..bcbac1c8e 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -99,6 +99,8 @@ jobs:
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
env:
SOURCE_DATE_EPOCH: 0
+ DOCKER_BUILD_SUMMARY: false
+ DOCKER_BUILD_RECORD_UPLOAD: false
with:
context: .
file: build/${{ matrix.name }}.Dockerfile
From cd5307d658e68052e7b67dda265a9474955a08fa Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Thu, 18 Sep 2025 15:23:23 -0400
Subject: [PATCH 098/231] Fix AsyncioDebug section detection on Python 3.14
(#804)
Fixes #717.
---
cpython-unix/build-cpython.sh | 7 ++
.../patch-python-3.14-asyncio-static.patch | 71 +++++++++++++++++++
2 files changed, 78 insertions(+)
create mode 100644 cpython-unix/patch-python-3.14-asyncio-static.patch
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index aeebf8b56..f8f5eb0cd 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -319,6 +319,13 @@ if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_12}" ]; then
patch -p1 -i ${ROOT}/patch-test-embed-prevent-segfault.patch
fi
+# Cherry-pick an upstream change in Python 3.15 to build _asyncio as
+# static (which we do anyway in our own fashion) and more importantly to
+# take this into account when finding the AsyncioDebug section.
+if [ "${PYTHON_MAJMIN_VERSION}" = 3.14 ]; then
+ patch -p1 -i ${ROOT}/patch-python-3.14-asyncio-static.patch
+fi
+
# Most bits look at CFLAGS. But setup.py only looks at CPPFLAGS.
# So we need to set both.
CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC -I${TOOLS_PATH}/deps/include -I${TOOLS_PATH}/deps/include/ncursesw"
diff --git a/cpython-unix/patch-python-3.14-asyncio-static.patch b/cpython-unix/patch-python-3.14-asyncio-static.patch
new file mode 100644
index 000000000..ac9ed09e7
--- /dev/null
+++ b/cpython-unix/patch-python-3.14-asyncio-static.patch
@@ -0,0 +1,71 @@
+From b7d722547bcc9e92dca4837b9fdbe7457788820b Mon Sep 17 00:00:00 2001
+From: Kumar Aditya
+Date: Wed, 16 Jul 2025 22:09:08 +0530
+Subject: [PATCH 1/1] gh-136669: build `_asyncio` as static module (#136670)
+
+`_asyncio` is now built as a static module so that thread states can be accessed directly via registers and avoids the overhead of function call.
+---
+ .../Library/2025-07-15-16-37-34.gh-issue-136669.Yexwah.rst | 1 +
+ Modules/Setup.stdlib.in | 7 ++++++-
+ Modules/_remote_debugging_module.c | 6 +++---
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2025-07-15-16-37-34.gh-issue-136669.Yexwah.rst
+
+diff --git a/Misc/NEWS.d/next/Library/2025-07-15-16-37-34.gh-issue-136669.Yexwah.rst b/Misc/NEWS.d/next/Library/2025-07-15-16-37-34.gh-issue-136669.Yexwah.rst
+new file mode 100644
+index 00000000000..0d93397ff35
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2025-07-15-16-37-34.gh-issue-136669.Yexwah.rst
+@@ -0,0 +1 @@
++:mod:`!_asyncio` is now statically linked for improved performance.
+diff --git a/Modules/Setup.stdlib.in b/Modules/Setup.stdlib.in
+index 3a38a60a152..86c8eb27c0a 100644
+--- a/Modules/Setup.stdlib.in
++++ b/Modules/Setup.stdlib.in
+@@ -32,7 +32,6 @@
+ ############################################################################
+ # Modules that should always be present (POSIX and Windows):
+ @MODULE_ARRAY_TRUE@array arraymodule.c
+-@MODULE__ASYNCIO_TRUE@_asyncio _asynciomodule.c
+ @MODULE__BISECT_TRUE@_bisect _bisectmodule.c
+ @MODULE__CSV_TRUE@_csv _csv.c
+ @MODULE__HEAPQ_TRUE@_heapq _heapqmodule.c
+@@ -193,3 +192,9 @@
+ # Limited API template modules; must be built as shared modules.
+ @MODULE_XXLIMITED_TRUE@xxlimited xxlimited.c
+ @MODULE_XXLIMITED_35_TRUE@xxlimited_35 xxlimited_35.c
++
++
++# for performance
++*static*
++
++@MODULE__ASYNCIO_TRUE@_asyncio _asynciomodule.c
+diff --git a/Modules/_remote_debugging_module.c b/Modules/_remote_debugging_module.c
+index d72031137e0..b50e5e403a1 100644
+--- a/Modules/_remote_debugging_module.c
++++ b/Modules/_remote_debugging_module.c
+@@ -811,7 +811,7 @@ _Py_RemoteDebug_GetAsyncioDebugAddress(proc_handle_t* handle)
+ }
+ #elif defined(__linux__)
+ // On Linux, search for asyncio debug in executable or DLL
+- address = search_linux_map_for_section(handle, "AsyncioDebug", "_asyncio.cpython");
++ address = search_linux_map_for_section(handle, "AsyncioDebug", "python");
+ if (address == 0) {
+ // Error out: 'python' substring covers both executable and DLL
+ PyObject *exc = PyErr_GetRaisedException();
+@@ -820,10 +820,10 @@ _Py_RemoteDebug_GetAsyncioDebugAddress(proc_handle_t* handle)
+ }
+ #elif defined(__APPLE__) && TARGET_OS_OSX
+ // On macOS, try libpython first, then fall back to python
+- address = search_map_for_section(handle, "AsyncioDebug", "_asyncio.cpython");
++ address = search_map_for_section(handle, "AsyncioDebug", "libpython");
+ if (address == 0) {
+ PyErr_Clear();
+- address = search_map_for_section(handle, "AsyncioDebug", "_asyncio.cpython");
++ address = search_map_for_section(handle, "AsyncioDebug", "python");
+ }
+ if (address == 0) {
+ // Error out: 'python' substring covers both executable and DLL
+--
+2.39.5 (Apple Git-154)
+
From c6b6babb6e54692d565e66d921e84aa969fe611a Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Tue, 7 Oct 2025 09:18:47 -0400
Subject: [PATCH 099/231] Bump OpenSSL 3.5.3 -> 3.5.4 (#807)
---
pythonbuild/downloads.py | 8 ++++----
src/verify_distribution.py | 9 +++++++--
2 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 066ad434e..02725a676 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -262,10 +262,10 @@
},
# Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
"openssl-3.5": {
- "url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.3/openssl-3.5.3.tar.gz",
- "size": 53183370,
- "sha256": "c9489d2abcf943cdc8329a57092331c598a402938054dc3a22218aea8a8ec3bf",
- "version": "3.5.3",
+ "url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.4/openssl-3.5.4.tar.gz",
+ "size": 53190367,
+ "sha256": "967311f84955316969bdb1d8d4b983718ef42338639c621ec4c34fddef355e99",
+ "version": "3.5.4",
"library_names": ["crypto", "ssl"],
"licenses": ["Apache-2.0"],
"license_file": "LICENSE.openssl-3.txt",
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index efd352876..d97a36825 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -181,11 +181,16 @@ def test_ssl(self):
self.assertTrue(ssl.HAS_TLSv1_3)
# OpenSSL 1.1 on older CPython versions on Windows. 3.5 everywhere
- # else.
+ # else. The format is documented a bit here:
+ # https://docs.openssl.org/1.1.1/man3/OPENSSL_VERSION_NUMBER/
+ # https://docs.openssl.org/3.5/man3/OpenSSL_version/
+ # For 1.x it is the three numerical version components, the
+ # suffix letter as a 1-based integer, and 0xF for "release". For
+ # 3.x it is the major, minor, 0, patch, and 0.
if os.name == "nt" and sys.version_info[0:2] < (3, 11):
wanted_version = (1, 1, 1, 23, 15)
else:
- wanted_version = (3, 5, 0, 3, 15)
+ wanted_version = (3, 5, 0, 4, 0)
self.assertEqual(ssl.OPENSSL_VERSION_INFO, wanted_version)
From 145dc8dae81a23ef0ea3ca65e8610709950f0f8b Mon Sep 17 00:00:00 2001
From: Zsolt Dollenstein
Date: Tue, 7 Oct 2025 15:28:29 +0100
Subject: [PATCH 100/231] Bump CPython to 3.14.0 (#812)
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 02725a676..98f388d0b 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -93,10 +93,10 @@
"python_tag": "cp313",
},
"cpython-3.14": {
- "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0rc3.tar.xz",
- "size": 23585028,
- "sha256": "646dc945e49c73a141896deda12d43f3f293fd69426774c16fc43496180e8fcd",
- "version": "3.14.0rc3",
+ "url": "https://www.python.org/ftp/python/3.14.0/Python-3.14.0.tar.xz",
+ "size": 23595844,
+ "sha256": "2299dae542d395ce3883aca00d3c910307cd68e0b2f7336098c8e7b7eee9f3e9",
+ "version": "3.14.0",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp314",
From 8d46b87afd32a2d2a16e2253b094f30338d6c162 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Tue, 7 Oct 2025 10:54:46 -0400
Subject: [PATCH 101/231] Use relative paths in build-details.json (#811)
Fixes #712.
---
cpython-unix/build-cpython.sh | 6 +++
.../patch-python-relative-build-details.patch | 53 +++++++++++++++++++
2 files changed, 59 insertions(+)
create mode 100644 cpython-unix/patch-python-relative-build-details.patch
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index f8f5eb0cd..7f7c4c385 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -326,6 +326,12 @@ if [ "${PYTHON_MAJMIN_VERSION}" = 3.14 ]; then
patch -p1 -i ${ROOT}/patch-python-3.14-asyncio-static.patch
fi
+# Ensure the new build-details.json file reports relocatable paths.
+# There is not yet a flag in ./configure for this, sadly.
+if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
+ patch -p1 -i ${ROOT}/patch-python-relative-build-details.patch
+fi
+
# Most bits look at CFLAGS. But setup.py only looks at CPPFLAGS.
# So we need to set both.
CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC -I${TOOLS_PATH}/deps/include -I${TOOLS_PATH}/deps/include/ncursesw"
diff --git a/cpython-unix/patch-python-relative-build-details.patch b/cpython-unix/patch-python-relative-build-details.patch
new file mode 100644
index 000000000..ad2a65334
--- /dev/null
+++ b/cpython-unix/patch-python-relative-build-details.patch
@@ -0,0 +1,53 @@
+From 5bb9be38eae4afe6246691a7affe0c7681f45ca2 Mon Sep 17 00:00:00 2001
+From: Geoffrey Thomas
+Date: Mon, 6 Oct 2025 18:07:47 -0400
+Subject: [PATCH 1/1] Makefile: Generate relative paths for build-details.json
+
+---
+ Makefile.pre.in | 2 +-
+ Tools/build/generate-build-details.py | 5 ++++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 764eef5be3e..4dbbf8ad8bc 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -1004,7 +1004,7 @@ pybuilddir.txt: $(PYTHON_FOR_BUILD_DEPS)
+ fi
+
+ build-details.json: pybuilddir.txt
+- $(RUNSHARED) $(PYTHON_FOR_BUILD) $(srcdir)/Tools/build/generate-build-details.py `cat pybuilddir.txt`/build-details.json
++ $(RUNSHARED) $(PYTHON_FOR_BUILD) $(srcdir)/Tools/build/generate-build-details.py --relative-paths --config-file-path $(LIBDEST)/build-details.json `cat pybuilddir.txt`/build-details.json
+
+ # Build static library
+ $(LIBRARY): $(LIBRARY_OBJS)
+diff --git a/Tools/build/generate-build-details.py b/Tools/build/generate-build-details.py
+index ed9ab2844d2..8d086ce3b32 100644
+--- a/Tools/build/generate-build-details.py
++++ b/Tools/build/generate-build-details.py
+@@ -131,11 +131,12 @@ def generate_data(schema_version: str) -> collections.defaultdict[str, Any]:
+
+
+ def make_paths_relative(data: dict[str, Any], config_path: str | None = None) -> None:
++ base_prefix = data['base_prefix']
++
+ # Make base_prefix relative to the config_path directory
+ if config_path:
+ data['base_prefix'] = relative_path(data['base_prefix'],
+ os.path.dirname(config_path))
+- base_prefix = data['base_prefix']
+
+ # Update path values to make them relative to base_prefix
+ PATH_KEYS = (
+@@ -203,6 +204,8 @@ def main() -> None:
+ if args.relative_paths:
+ make_paths_relative(data, args.config_file_path)
+
++ print(f"generate-build-details debug: {sysconfig=} {sysconfig.get_platform()=}", file=sys.stderr)
++
+ json_output = json.dumps(data, indent=2)
+ with open(args.location, 'w', encoding='utf-8') as f:
+ f.write(json_output)
+--
+2.39.5 (Apple Git-154)
+
From 1abe86213664d4a47226779f3cc0b0daaa9b46ab Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Tue, 7 Oct 2025 10:11:27 -0500
Subject: [PATCH 102/231] Bump CPython 3.13 to 3.13.8 (#813)
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 98f388d0b..738633274 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -84,10 +84,10 @@
"python_tag": "cp312",
},
"cpython-3.13": {
- "url": "https://www.python.org/ftp/python/3.13.7/Python-3.13.7.tar.xz",
- "size": 22769492,
- "sha256": "5462f9099dfd30e238def83c71d91897d8caa5ff6ebc7a50f14d4802cdaaa79a",
- "version": "3.13.7",
+ "url": "https://www.python.org/ftp/python/3.13.8/Python-3.13.8.tar.xz",
+ "size": 22681576,
+ "sha256": "b9910730526b298299b46b35595ced9055722df60c06ad6301f6a4e2c728a252",
+ "version": "3.13.8",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp313",
From 31349d7b98bb156bf778492f546a6c5dc405cfcc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edgar=20Ram=C3=ADrez=20Mondrag=C3=B3n?=
Date: Fri, 10 Oct 2025 06:23:57 -0600
Subject: [PATCH 103/231] Bump stable Python versions: 3.12.12, 3.11.14,
3.10.19 and 3.9.24 (#817)
---
pythonbuild/downloads.py | 32 ++++++++++++++++----------------
1 file changed, 16 insertions(+), 16 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 738633274..130235008 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -48,37 +48,37 @@
"license_file": "LICENSE.bzip2.txt",
},
"cpython-3.9": {
- "url": "https://www.python.org/ftp/python/3.9.23/Python-3.9.23.tar.xz",
- "size": 19659284,
- "sha256": "61a42919e13d539f7673cf11d1c404380e28e540510860b9d242196e165709c9",
- "version": "3.9.23",
+ "url": "https://www.python.org/ftp/python/3.9.24/Python-3.9.24.tar.xz",
+ "size": 20176216,
+ "sha256": "668391afabd5083faafa4543753d190f82f33ce6ba22d6e9ac728b43644b278a",
+ "version": "3.9.24",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp39",
},
"cpython-3.10": {
- "url": "https://www.python.org/ftp/python/3.10.18/Python-3.10.18.tar.xz",
- "size": 19619316,
- "sha256": "ae665bc678abd9ab6a6e1573d2481625a53719bc517e9a634ed2b9fefae3817f",
- "version": "3.10.18",
+ "url": "https://www.python.org/ftp/python/3.10.19/Python-3.10.19.tar.xz",
+ "size": 19873020,
+ "sha256": "c8f4a596572201d81dd7df91f70e177e19a70f1d489968b54b5fbbf29a97c076",
+ "version": "3.10.19",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp310",
},
"cpython-3.11": {
- "url": "https://www.python.org/ftp/python/3.11.13/Python-3.11.13.tar.xz",
- "size": 20117496,
- "sha256": "8fb5f9fbc7609fa822cb31549884575db7fd9657cbffb89510b5d7975963a83a",
- "version": "3.11.13",
+ "url": "https://www.python.org/ftp/python/3.11.14/Python-3.11.14.tar.xz",
+ "size": 20326860,
+ "sha256": "8d3ed8ec5c88c1c95f5e558612a725450d2452813ddad5e58fdb1a53b1209b78",
+ "version": "3.11.14",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp311",
},
"cpython-3.12": {
- "url": "https://www.python.org/ftp/python/3.12.11/Python-3.12.11.tar.xz",
- "size": 20525812,
- "sha256": "c30bb24b7f1e9a19b11b55a546434f74e739bb4c271a3e3a80ff4380d49f7adb",
- "version": "3.12.11",
+ "url": "https://www.python.org/ftp/python/3.12.12/Python-3.12.12.tar.xz",
+ "size": 20798712,
+ "sha256": "fb85a13414b028c49ba18bbd523c2d055a30b56b18b92ce454ea2c51edc656c4",
+ "version": "3.12.12",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp312",
From 5cfcffdca412afb7a9b39428fcb9b8a110f25b07 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Tue, 14 Oct 2025 12:11:59 -0500
Subject: [PATCH 104/231] Bump to 3.13.9 (#820)
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 130235008..4e1f33006 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -84,10 +84,10 @@
"python_tag": "cp312",
},
"cpython-3.13": {
- "url": "https://www.python.org/ftp/python/3.13.8/Python-3.13.8.tar.xz",
- "size": 22681576,
- "sha256": "b9910730526b298299b46b35595ced9055722df60c06ad6301f6a4e2c728a252",
- "version": "3.13.8",
+ "url": "https://www.python.org/ftp/python/3.13.9/Python-3.13.9.tar.xz",
+ "size": 22681368,
+ "sha256": "ed5ef34cda36cfa2f3a340f07cac7e7814f91c7f3c411f6d3562323a866c5c66",
+ "version": "3.13.9",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp313",
From a4eb9b3fab6aaa945b1dc29d2c11f003eccbed49 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Tue, 14 Oct 2025 13:19:11 -0500
Subject: [PATCH 105/231] Add support for Python 3.15 (#819)
---
ci-targets.yaml | 18 +++++++
cpython-unix/Makefile | 2 +-
cpython-unix/build-cpython.sh | 17 ++++++-
cpython-unix/build-main.py | 1 +
cpython-unix/build.py | 47 ++++++++++++++++---
.../patch-jit-llvm-version-3.15.patch | 12 +++++
cpython-unix/targets.yml | 18 +++++++
cpython-windows/build.py | 1 +
pythonbuild/buildenv.py | 3 +-
pythonbuild/downloads.py | 17 +++++--
src/validation.rs | 44 +++++++++++++++--
11 files changed, 161 insertions(+), 19 deletions(-)
create mode 100644 cpython-unix/patch-jit-llvm-version-3.15.patch
diff --git a/ci-targets.yaml b/ci-targets.yaml
index 0662bbee9..7a12bddf7 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -10,6 +10,7 @@ darwin:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- pgo+lto
@@ -28,6 +29,7 @@ darwin:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- pgo+lto
@@ -48,6 +50,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- pgo+lto
@@ -67,6 +70,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- noopt
@@ -88,6 +92,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- noopt
@@ -109,6 +114,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- noopt
@@ -130,6 +136,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- noopt
@@ -151,6 +158,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- noopt
@@ -172,6 +180,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- pgo+lto
@@ -193,6 +202,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- pgo+lto
@@ -214,6 +224,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- pgo+lto
@@ -235,6 +246,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug
- pgo+lto
@@ -255,6 +267,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug+static
- noopt+static
@@ -281,6 +294,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug+static
- noopt+static
@@ -307,6 +321,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug+static
- noopt+static
@@ -333,6 +348,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- debug+static
- noopt+static
@@ -385,6 +401,7 @@ windows:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- pgo
build_options_conditional:
@@ -402,6 +419,7 @@ windows:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- pgo
build_options_conditional:
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
index 577f44fd0..b4618d22f 100644
--- a/cpython-unix/Makefile
+++ b/cpython-unix/Makefile
@@ -6,7 +6,7 @@ BUILD := $(HERE)/build.py
NULL :=
SPACE := $(subst ,, )
-ALL_PYTHON_VERSIONS := 3.9 3.10 3.11 3.12 3.13 3.14
+ALL_PYTHON_VERSIONS := 3.9 3.10 3.11 3.12 3.13 3.14 3.15
ifndef PYBUILD_TARGET_TRIPLE
$(error PYBUILD_TARGET_TRIPLE not defined)
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 7f7c4c385..32992ee56 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -512,9 +512,13 @@ if [ -n "${CPYTHON_OPTIMIZED}" ]; then
patch -p1 -i "${ROOT}/patch-jit-llvm-version-3.13.patch"
fi
- if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]]; then
+ if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" && -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_14}" ]]; then
patch -p1 -i "${ROOT}/patch-jit-llvm-version-3.14.patch"
fi
+
+ if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_15}" ]]; then
+ patch -p1 -i "${ROOT}/patch-jit-llvm-version-3.15.patch"
+ fi
fi
fi
@@ -609,10 +613,19 @@ if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]; then
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_explicit_bzero=no"
fi
+# Define the base PGO profiling task, which we'll extend below with ignores
+export PROFILE_TASK='-m test --pgo'
+
# On 3.14+ `test_strftime_y2k` fails when cross-compiling for `x86_64_v2` and `x86_64_v3` targets on
# Linux, so we ignore it. See https://github.com/python/cpython/issues/128104
if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" && -n "${CROSS_COMPILING}" && "${PYBUILD_PLATFORM}" != macos* ]]; then
- export PROFILE_TASK='-m test --pgo --ignore test_strftime_y2k'
+ PROFILE_TASK="${PROFILE_TASK} --ignore test_strftime_y2k"
+fi
+
+# On 3.15+ `test_json.test_recursion.TestCRecursion.test_highly_nested_objects_decoding` fails during
+# PGO due to RecursionError not being raised as expected. See https://github.com/python/cpython/issues/140125
+if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_15}" ]]; then
+ PROFILE_TASK="${PROFILE_TASK} --ignore test_json"
fi
# ./configure tries to auto-detect whether it can build 128-bit and 256-bit SIMD helpers for HACL,
diff --git a/cpython-unix/build-main.py b/cpython-unix/build-main.py
index e4276be2a..366ec8cfa 100755
--- a/cpython-unix/build-main.py
+++ b/cpython-unix/build-main.py
@@ -61,6 +61,7 @@ def main():
"cpython-3.12",
"cpython-3.13",
"cpython-3.14",
+ "cpython-3.15",
},
default="cpython-3.11",
help="Python distribution to build",
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index 662d70216..23d946024 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -393,13 +393,23 @@ def build_cpython_host(
target_triple: str,
build_options: list[str],
dest_archive,
+ python_source=None,
+ entry_name=None,
):
"""Build binutils in the Docker image."""
- archive = download_entry(entry, DOWNLOADS_PATH)
+ if not python_source:
+ python_version = entry["version"]
+ archive = download_entry(entry_name, DOWNLOADS_PATH)
+ else:
+ python_version = os.environ["PYBUILD_PYTHON_VERSION"]
+ archive = DOWNLOADS_PATH / ("Python-%s.tar.xz" % python_version)
+ print("Compressing %s to %s" % (python_source, archive))
+ with archive.open("wb") as fh:
+ create_tar_from_directory(
+ fh, python_source, path_prefix="Python-%s" % python_version
+ )
with build_environment(client, image) as build_env:
- python_version = DOWNLOADS[entry]["version"]
-
build_env.install_toolchain(
BUILD,
host_platform,
@@ -434,7 +444,7 @@ def build_cpython_host(
# Set environment variables allowing convenient testing for Python
# version ranges.
- for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14"):
+ for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "3.15"):
normal_version = v.replace(".", "_")
if meets_python_minimum_version(python_version, v):
@@ -706,12 +716,15 @@ def build_cpython(
"""Build CPython in a Docker image'"""
parsed_build_options = set(build_options.split("+"))
entry_name = "cpython-%s" % version
- entry = DOWNLOADS[entry_name]
if not python_source:
+ entry = DOWNLOADS[entry_name]
python_version = entry["version"]
python_archive = download_entry(entry_name, DOWNLOADS_PATH)
else:
+ entry = DOWNLOADS.get(entry_name, {})
python_version = os.environ["PYBUILD_PYTHON_VERSION"]
+ entry.setdefault("licenses", ["Python-2.0", "CNRI-Python"])
+ entry.setdefault("python_tag", "cp" + "".join(version.split(".")))
python_archive = DOWNLOADS_PATH / ("Python-%s.tar.xz" % python_version)
print("Compressing %s to %s" % (python_source, python_archive))
with python_archive.open("wb") as fh:
@@ -804,7 +817,7 @@ def build_cpython(
# Set environment variables allowing convenient testing for Python
# version ranges.
- for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14"):
+ for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "3.15"):
normal_version = v.replace(".", "_")
if meets_python_minimum_version(python_version, v):
@@ -1024,6 +1037,18 @@ def main():
log_name = "%s-%s" % (action, host_platform)
elif args.action.startswith("cpython-") and args.action.endswith("-host"):
log_name = args.action
+ elif action.startswith("cpython-"):
+ version = (
+ os.environ["PYBUILD_PYTHON_VERSION"]
+ if python_source
+ else DOWNLOADS[action]["version"]
+ )
+ log_name = "%s-%s-%s-%s" % (
+ action,
+ version,
+ target_triple,
+ build_options,
+ )
else:
entry = DOWNLOADS[action]
log_name = "%s-%s-%s-%s" % (
@@ -1229,14 +1254,21 @@ def main():
)
elif action.startswith("cpython-") and action.endswith("-host"):
+ entry_name = action[:-5]
+ if not python_source:
+ entry = DOWNLOADS[entry_name]
+ else:
+ entry = DOWNLOADS.get(entry_name, {})
build_cpython_host(
client,
get_image(client, ROOT, BUILD, docker_image, host_platform),
- action[:-5],
+ entry,
host_platform=host_platform,
target_triple=target_triple,
build_options=build_options,
dest_archive=dest_archive,
+ python_source=python_source,
+ entry_name=entry_name,
)
elif action in (
@@ -1246,6 +1278,7 @@ def main():
"cpython-3.12",
"cpython-3.13",
"cpython-3.14",
+ "cpython-3.15",
):
build_cpython(
settings,
diff --git a/cpython-unix/patch-jit-llvm-version-3.15.patch b/cpython-unix/patch-jit-llvm-version-3.15.patch
new file mode 100644
index 000000000..d87ac8402
--- /dev/null
+++ b/cpython-unix/patch-jit-llvm-version-3.15.patch
@@ -0,0 +1,12 @@
+diff --git a/Tools/jit/_llvm.py b/Tools/jit/_llvm.py
+--- a/Tools/jit/_llvm.py
++++ b/Tools/jit/_llvm.py
+@@ -11,7 +11,7 @@
+ import _targets
+
+
+-_LLVM_VERSION = "19"
++_LLVM_VERSION = "20"
+ _EXTERNALS_LLVM_TAG = "llvm-19.1.7.0"
+
+
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index 73fe43cc9..e2b018eff 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -70,6 +70,7 @@ aarch64-apple-darwin:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
host_cc: clang
host_cxx: clang++
@@ -166,6 +167,7 @@ aarch64-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
docker_image_suffix: .debian9
needs_toolchain: true
host_cc: clang
@@ -260,6 +262,7 @@ armv7-unknown-linux-gnueabi:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
docker_image_suffix: .cross
host_cc: /usr/bin/x86_64-linux-gnu-gcc
host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -301,6 +304,7 @@ armv7-unknown-linux-gnueabihf:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
docker_image_suffix: .cross
host_cc: /usr/bin/x86_64-linux-gnu-gcc
host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -383,6 +387,7 @@ mips-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
docker_image_suffix: .cross
host_cc: /usr/bin/x86_64-linux-gnu-gcc
host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -424,6 +429,7 @@ mipsel-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
docker_image_suffix: .cross
host_cc: /usr/bin/x86_64-linux-gnu-gcc
host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -465,6 +471,7 @@ ppc64le-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
docker_image_suffix: .cross
host_cc: /usr/bin/x86_64-linux-gnu-gcc
host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -506,6 +513,7 @@ riscv64-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
docker_image_suffix: .cross-riscv64
host_cc: /usr/bin/x86_64-linux-gnu-gcc
host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -547,6 +555,7 @@ s390x-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
docker_image_suffix: .cross
host_cc: /usr/bin/x86_64-linux-gnu-gcc
host_cxx: /usr/bin/x86_64-linux-gnu-g++
@@ -639,6 +648,7 @@ x86_64-apple-darwin:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
apple_sdk_platform: macosx
host_cc: clang
@@ -820,6 +830,7 @@ x86_64-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
host_cc: clang
host_cxx: clang++
@@ -866,6 +877,7 @@ x86_64_v2-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
host_cc: clang
host_cxx: clang++
@@ -913,6 +925,7 @@ x86_64_v3-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
host_cc: clang
host_cxx: clang++
@@ -960,6 +973,7 @@ x86_64_v4-unknown-linux-gnu:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
host_cc: clang
host_cxx: clang++
@@ -1007,6 +1021,7 @@ x86_64-unknown-linux-musl:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
host_cc: clang
host_cxx: clang++
@@ -1051,6 +1066,7 @@ x86_64_v2-unknown-linux-musl:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
host_cc: clang
host_cxx: clang++
@@ -1096,6 +1112,7 @@ x86_64_v3-unknown-linux-musl:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
host_cc: clang
host_cxx: clang++
@@ -1141,6 +1158,7 @@ x86_64_v4-unknown-linux-musl:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
host_cc: clang
host_cxx: clang++
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index c94aa4ab2..d02559e07 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -1856,6 +1856,7 @@ def main() -> None:
"cpython-3.12",
"cpython-3.13",
"cpython-3.14",
+ "cpython-3.15",
},
default="cpython-3.11",
help="Python distribution to build",
diff --git a/pythonbuild/buildenv.py b/pythonbuild/buildenv.py
index 4b2a0e6e4..9266ad37e 100644
--- a/pythonbuild/buildenv.py
+++ b/pythonbuild/buildenv.py
@@ -164,10 +164,9 @@ def copy_file(self, source: pathlib.Path, dest_path=None, dest_name=None):
def install_toolchain_archive(
self, build_dir, package_name, host_platform, version=None
):
- entry = DOWNLOADS[package_name]
basename = "%s-%s-%s.tar" % (
package_name,
- version or entry["version"],
+ version or DOWNLOADS[package_name]["version"],
host_platform,
)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 4e1f33006..9cc4f9d89 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -101,6 +101,15 @@
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp314",
},
+ "cpython-3.15": {
+ "url": "https://www.python.org/ftp/python/3.15.0/Python-3.15.0a1.tar.xz",
+ "size": 23646768,
+ "sha256": "3194939d488eeaeefdcf990d35542d9ad1ce788789c4e2305a2060eb7058e5a4",
+ "version": "3.15.0a1",
+ "licenses": ["Python-2.0", "CNRI-Python"],
+ "license_file": "LICENSE.cpython.txt",
+ "python_tag": "cp315",
+ },
"expat": {
"url": "https://github.com/libexpat/libexpat/releases/download/R_2_6_3/expat-2.6.3.tar.xz",
"size": 485600,
@@ -284,10 +293,10 @@
"version": "0.13.1",
},
"pip": {
- "url": "https://files.pythonhosted.org/packages/ef/7d/500c9ad20238fcfcb4cb9243eede163594d7020ce87bd9610c9e02771876/pip-24.3.1-py3-none-any.whl",
- "size": 1822182,
- "sha256": "3790624780082365f47549d032f3770eeb2b1e8bd1f7b2e02dace1afa361b4ed",
- "version": "24.3.1",
+ "url": "https://files.pythonhosted.org/packages/b7/3f/945ef7ab14dc4f9d7f40288d2df998d1837ee0888ec3659c813487572faa/pip-25.2-py3-none-any.whl",
+ "size": 1752557,
+ "sha256": "6d67a2b4e7f14d8b31b8b52648866fa717f45a1eb70e83002f4331d07e953717",
+ "version": "25.2",
},
"readline": {
# Mirrored from https://ftp.gnu.org/gnu/readline/readline-8.2.tar.gz
diff --git a/src/validation.rs b/src/validation.rs
index dbe897648..419927346 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -136,6 +136,8 @@ const PE_ALLOWED_LIBRARIES: &[&str] = &[
"python313t.dll",
"python314.dll",
"python314t.dll",
+ "python315.dll",
+ "python315t.dll",
"sqlite3.dll",
"tcl86t.dll",
"tk86t.dll",
@@ -149,6 +151,15 @@ const PE_ALLOWED_LIBRARIES_314: &[&str] = &[
"msvcrt.dll", // zlib loads this library
];
const PE_ALLOWED_LIBRARIES_ARM64: &[&str] = &["msvcrt.dll", "zlib1.dll"];
+const PE_ALLOWED_LIBRARIES_315: &[&str] = &[
+ // See `PE_ALLOWED_LIBRARIES_314` for zlib-related libraries
+ "zlib1.dll",
+ "api-ms-win-crt-private-l1-1-0.dll",
+ "msvcrt.dll",
+ // `_remote_debugging` loads `ntdll`
+ // See https://github.com/python/cpython/pull/138710
+ "ntdll.dll",
+];
static GLIBC_MAX_VERSION_BY_TRIPLE: Lazy>> =
Lazy::new(|| {
@@ -371,6 +382,26 @@ static DARWIN_ALLOWED_DYLIBS: Lazy> = Lazy::new(|| {
max_compatibility_version: "3.14.0".try_into().unwrap(),
required: false,
},
+ MachOAllowedDylib {
+ name: "@executable_path/../lib/libpython3.15.dylib".to_string(),
+ max_compatibility_version: "3.15.0".try_into().unwrap(),
+ required: false,
+ },
+ MachOAllowedDylib {
+ name: "@executable_path/../lib/libpython3.15d.dylib".to_string(),
+ max_compatibility_version: "3.15.0".try_into().unwrap(),
+ required: false,
+ },
+ MachOAllowedDylib {
+ name: "@executable_path/../lib/libpython3.15t.dylib".to_string(),
+ max_compatibility_version: "3.15.0".try_into().unwrap(),
+ required: false,
+ },
+ MachOAllowedDylib {
+ name: "@executable_path/../lib/libpython3.15td.dylib".to_string(),
+ max_compatibility_version: "3.15.0".try_into().unwrap(),
+ required: false,
+ },
MachOAllowedDylib {
name: "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit".to_string(),
max_compatibility_version: "45.0.0".try_into().unwrap(),
@@ -1495,6 +1526,11 @@ fn validate_pe<'data, Pe: ImageNtHeaders>(
continue;
}
}
+ "3.15" => {
+ if PE_ALLOWED_LIBRARIES_315.contains(&lib.as_str()) {
+ continue;
+ }
+ }
_ => {}
}
@@ -1653,7 +1689,7 @@ fn validate_extension_modules(
"3.13" => {
wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_13);
}
- "3.14" => {
+ "3.14" | "3.15" => {
wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_14);
}
_ => {
@@ -1678,7 +1714,7 @@ fn validate_extension_modules(
wanted.extend(GLOBAL_EXTENSIONS_WINDOWS_PRE_3_13);
}
- if matches!(python_major_minor, "3.14") {
+ if matches!(python_major_minor, "3.14" | "3.15") {
wanted.extend(GLOBAL_EXTENSIONS_WINDOWS_3_14);
}
@@ -1718,7 +1754,7 @@ fn validate_extension_modules(
wanted.insert("_testexternalinspection");
}
- if (is_linux || is_macos) && matches!(python_major_minor, "3.12" | "3.13" | "3.14") {
+ if (is_linux || is_macos) && matches!(python_major_minor, "3.12" | "3.13" | "3.14" | "3.15") {
wanted.insert("_testsinglephase");
}
@@ -1844,6 +1880,8 @@ fn validate_distribution(
"3.13"
} else if dist_filename.starts_with("cpython-3.14.") {
"3.14"
+ } else if dist_filename.starts_with("cpython-3.15.") {
+ "3.15"
} else {
return Err(anyhow!("could not parse Python version from filename"));
};
From bd5227106d439127be97530b7781ac933d849324 Mon Sep 17 00:00:00 2001
From: Zanie Blue
Date: Tue, 14 Oct 2025 16:02:59 -0500
Subject: [PATCH 106/231] Add missing 3.15 aarch64 targets (#821)
---
ci-targets.yaml | 2 ++
cpython-unix/targets.yml | 1 +
2 files changed, 3 insertions(+)
diff --git a/ci-targets.yaml b/ci-targets.yaml
index 7a12bddf7..10a13206a 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -374,6 +374,7 @@ linux:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
# TODO: Static support is current blocked by some compiler-rt linking issues
# - debug+static
@@ -438,6 +439,7 @@ windows:
- "3.12"
- "3.13"
- "3.14"
+ - "3.15"
build_options:
- pgo
build_options_conditional:
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index e2b018eff..f700e705f 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -1205,6 +1205,7 @@ aarch64-unknown-linux-musl:
- '3.12'
- '3.13'
- '3.14'
+ - '3.15'
needs_toolchain: true
docker_image_suffix: .debian9
needs_toolchain: true
From 5dcb8cc60ba86f1bf20b8fccb05928a69bd0e9da Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Tue, 21 Oct 2025 16:23:09 -0400
Subject: [PATCH 107/231] Use siphash on architectures that support misaligned
accesses (#825)
Python uses siphash (siphash13 in 3.11+, siphash24 on older versions) as
the default internal hashing algorithm, but only on architectures that
support misaligned accesses, i.e., reads/writes of integers from a
memory address that is not a round multiple of the integer size. On
other architectures it uses fnv, which is not supported by Numba and
raises a warning. The distinction between architectures is done by a
configure-time code execution check, which is not supported on our cross
builds, including on our x86_64_vN microarchitecture builds (see #599),
so Python defaults to assuming it is not supported.
Hard-code a list of platforms that are known to support misaligned
accesses just fine. Credit to
https://blog.vitlabuda.cz/2025/01/22/unaligned-memory-access-on-various-cpu-architectures.html
for pointing out that the Linux kernel has this pretty well documented
in Kconfig.
Note that loongarch and riscv have optional support for misaligned
access, and it's quite possible that the hardware that people actually
use have support for them (or that we are targeting a limited hardware
profile anyway for some reason that implies support for misaligned
access). I've left them out for now but we can add them later.
Fixes #683.
---
cpython-unix/build-cpython.sh | 14 +++++++++++++-
src/verify_distribution.py | 6 ++++++
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 32992ee56..8b8933ded 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -673,7 +673,19 @@ if [ -n "${CROSS_COMPILING}" ]; then
# default on relatively modern compilers.
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_pthread=yes"
- # TODO: There are probably more of these, see #399.
+ # Also, it cannot detect whether misaligned memory accesses should
+ # be avoided, and conservatively defaults to yes, which makes it
+ # pick the 'fnv' hash instead of 'siphash', which numba does not
+ # like (#683, see also comment in cpython/configure.ac). These
+ # answers are taken from the Linux kernel source's Kconfig files,
+ # search for HAVE_EFFICIENT_UNALIGNED_ACCESS.
+ case "${TARGET_TRIPLE}" in
+ arm64*|aarch64*|armv7*|thumb7*|ppc64*|s390*|x86*)
+ CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_aligned_required=no"
+ ;;
+ esac
+
+ # TODO: There are probably more of these, see #599.
fi
# We patched configure.ac above. Reflect those changes.
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index d97a36825..41382cdd4 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -249,6 +249,12 @@ def say_hi(self):
root = tk.Tk()
Application(master=root)
+ def test_hash_algorithm(self):
+ self.assertTrue(
+ sys.hash_info.algorithm.startswith("siphash"),
+ msg=f"{sys.hash_info.algorithm=!r} is not siphash",
+ )
+
if __name__ == "__main__":
unittest.main()
From 7b747741020f12f044ca9fe1432c31897f8396c0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Oct 2025 09:28:58 -0500
Subject: [PATCH 108/231] Bump the python group with 13 updates (#808)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the python group with 13 updates:
| Package | From | To |
| --- | --- | --- |
| [cffi](https://github.com/python-cffi/cffi) | `1.17.1` | `2.0.0` |
| [cryptography](https://github.com/pyca/cryptography) | `45.0.6` |
`46.0.1` |
|
[jsonschema-specifications](https://github.com/python-jsonschema/jsonschema-specifications)
| `2025.4.1` | `2025.9.1` |
| [pycparser](https://github.com/eliben/pycparser) | `2.22` | `2.23` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.7.0` | `2.8.1` |
| [pynacl](https://github.com/pyca/pynacl) | `1.5.0` | `1.6.0` |
| [rpds-py](https://github.com/crate-py/rpds) | `0.27.0` | `0.27.1` |
| [typing-extensions](https://github.com/python/typing_extensions) |
`4.14.1` | `4.15.0` |
| [zstandard](https://github.com/indygreg/python-zstandard) | `0.24.0` |
`0.25.0` |
| [mypy](https://github.com/python/mypy) | `1.17.1` | `1.18.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.12.9` | `0.13.0` |
| [types-jsonschema](https://github.com/typeshed-internal/stub_uploader)
| `4.25.0.20250809` | `4.25.1.20250822` |
| [types-pyyaml](https://github.com/typeshed-internal/stub_uploader) |
`6.0.12.20250809` | `6.0.12.20250915` |
Updates `cffi` from 1.17.1 to 2.0.0
Release notes
Sourced from cffi's
releases.
v2.0.0
What's Changed
- Add Python 3.14 support.
- Add CPython free-threaded support (3.14t+ only) - huge thanks to the
folks at Quansight Labs for all the work to get this one sorted!
- Drop Python <= 3.8 support.
- Fix order dependency affecting nested type size calculation (#148).
Full Changelog: https://github.com/python-cffi/cffi/compare/v1.17.1...v2.0.0
v2.0.0b1
What's Changed
- Add Python 3.14 support.
- Add CPython free-threaded support (3.14t+ only).
- Drop Python <= 3.8 support.
- Fix order dependency affecting nested type size calculation (#148).
Full Changelog: https://github.com/python-cffi/cffi/compare/v1.17.1...v2.0.0b1
Commits
6366c01
release 2.0.0 (#196)
95c8476
2.0.0 post beta backports (#195)
195cbda
Release 2.0.0b1 (#183)
b4bbe79
fix version test to support beta
7ed073d
Add support for the free-threaded build (#178)
67a170d
Change the license from MIT to MIT-no-attribution, which is the same
without ...
92645ec
Add Python 3.14 support/testing (#177)
2b81170
doc: update test commands in Section Testing/development tips (#158)
25172b8
doc: update year (#153)
b57a92c
issue 147: force-compute nested structs before parent structs. Occurs
mainly...
- Additional commits viewable in compare
view
Updates `cryptography` from 45.0.6 to 46.0.1
Changelog
Sourced from cryptography's
changelog.
46.0.1 - 2025-09-16
* Fixed an issue where users installing via ``pip`` on Python 3.14
development
versions would not properly install a dependency.
* Fixed an issue building the free-threaded macOS 3.14 wheels.
.. _v46-0-0:
46.0.0 - 2025-09-16
- BACKWARDS INCOMPATIBLE: Support for Python 3.7 has
been removed.
- Support for OpenSSL < 3.0 is deprecated and will be removed in
the next
release.
- Support for
x86_64 macOS (including publishing wheels)
is deprecated
and will be removed in two releases. We will switch to publishing an
arm64 only wheel for macOS.
- Support for 32-bit Windows (including publishing wheels) is
deprecated
and will be removed in two releases. Users should move to a 64-bit
Python installation.
- Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL
3.5.3.
- We now build
ppc64le manylinux wheels and
publish them to PyPI.
- We now build
win_arm64 (Windows on Arm) wheels and
publish them to PyPI.
- Added support for free-threaded Python 3.14.
- Removed the deprecated
get_attribute_for_oid method on
:class:~cryptography.x509.CertificateSigningRequest. Users
should use
:meth:~cryptography.x509.Attributes.get_attribute_for_oid
instead.
- Removed the deprecated
CAST5, SEED,
IDEA, and Blowfish
classes from the cipher module. These are still available in
:doc:/hazmat/decrepit/index.
- In X.509, when performing a PSS signature with a SHA-3 hash, it is
now
encoded with the official NIST SHA3 OID.
.. _v45-0-7:
45.0.7 - 2025-09-01
* Added a function to support an upcoming ``pyOpenSSL`` release.
.. _v45-0-6:
Commits
Updates `jsonschema-specifications` from 2025.4.1 to 2025.9.1
Release notes
Sourced from jsonschema-specifications's
releases.
v2025.9.1
What's Changed
New Contributors
Full Changelog: https://github.com/python-jsonschema/jsonschema-specifications/compare/v2025.4.1...v2025.9.1
Commits
3b84601
Update docs requirements.
5a27ff3
Merge pull request #107
from branen/relocate-misplaced-metaschema
c2e2b75
Move 2019-09 "format" schema to correct directory
e2b4d6a
Merge pull request #106
from python-jsonschema/pre-commit-ci-update-config
1336f01
[pre-commit.ci] pre-commit autoupdate
9dd6369
Merge pull request #105
from python-jsonschema/pre-commit-ci-update-config
c1563ea
[pre-commit.ci] pre-commit autoupdate
cbd01ef
No lockfile yet.
125eafa
Merge pull request #103
from python-jsonschema/pre-commit-ci-update-config
9dca87c
Use the setup-uv action for uv.
- Additional commits viewable in compare
view
Updates `pycparser` from 2.22 to 2.23
Release notes
Sourced from pycparser's
releases.
release_v2.23
What's Changed
New Contributors
Full Changelog: https://github.com/eliben/pycparser/compare/release_v2.22...release_v2.23
Commits
Updates `pygithub` from 2.7.0 to 2.8.1
Release notes
Sourced from pygithub's
releases.
v2.8.1
What's Changed
Bug Fixes
Full Changelog: https://github.com/PyGithub/PyGithub/compare/v2.8.0...v2.8.1
v2.8.0
What's Changed
New Features
Improvements
Bug Fixes
Maintenance
... (truncated)
Changelog
Sourced from pygithub's
changelog.
Version 2.8.1 (September 02, 2025)
Bug Fixes
^^^^^^^^^
- Use default type if known type is not supported
(
[#3365](https://github.com/pygithub/pygithub/issues/3365)
<https://github.com/PyGithub/PyGithub/pull/3365>)
(40506415
<https://github.com/PyGithub/PyGithub/commit/40506415>)
Version 2.8.0 (September 02, 2025)
New Features
^^^^^^^^^^^^
- Add self hosted runner management to Organization
(
[#3203](https://github.com/pygithub/pygithub/issues/3203)
<https://github.com/PyGithub/PyGithub/pull/3203>)
(4ea1c4e2
<https://github.com/PyGithub/PyGithub/commit/4ea1c4e2>)
- Add support to generate release notes
(
[#3022](https://github.com/pygithub/pygithub/issues/3022)
<https://github.com/PyGithub/PyGithub/pull/3022>)
(e359b83a
<https://github.com/PyGithub/PyGithub/commit/e359b83a>)
Improvements
^^^^^^^^^^^^
- Fix connection pooling to improve connection performance
(
[#3289](https://github.com/pygithub/pygithub/issues/3289)
<https://github.com/PyGithub/PyGithub/pull/3289>_)
- Add
Repository.get_automated_security_fixes method
([#3303](https://github.com/pygithub/pygithub/issues/3303)
<https://github.com/PyGithub/PyGithub/pull/3303>)
(22048d83
<https://github.com/PyGithub/PyGithub/commit/22048d83>)
- Sync
Issue class with API spec
([#3338](https://github.com/pygithub/pygithub/issues/3338)
<https://github.com/PyGithub/PyGithub/pull/3338>)
(62da467a
<https://github.com/PyGithub/PyGithub/commit/62da467a>)
- Return more union classes like
NamedUser | Organization |
Enterprise
([#3224](https://github.com/pygithub/pygithub/issues/3224)
<https://github.com/PyGithub/PyGithub/pull/3224>)
(aea64148
<https://github.com/PyGithub/PyGithub/commit/aea64148>)
- Sync
Enterprise class with API spec
([#3342](https://github.com/pygithub/pygithub/issues/3342)
<https://github.com/PyGithub/PyGithub/pull/3342>)
(01bb5ab1
<https://github.com/PyGithub/PyGithub/commit/01bb5ab1>)
- Sync
GitReleaseAsset class with API spec
([#3343](https://github.com/pygithub/pygithub/issues/3343)
<https://github.com/PyGithub/PyGithub/pull/3343>)
(74449fed
<https://github.com/PyGithub/PyGithub/commit/74449fed>)
- Sync many class with OpenAPI spec
(
[#3344](https://github.com/pygithub/pygithub/issues/3344)
<https://github.com/PyGithub/PyGithub/pull/3344>_)
- Point deprecation warnings to the caller code rather than inner
class (
[#3275](https://github.com/pygithub/pygithub/issues/3275)
<https://github.com/PyGithub/PyGithub/pull/3275>)
(99bb5270
<https://github.com/PyGithub/PyGithub/commit/99bb5270>)
- Allow for repo strings in all
Team repo methods
([#3356](https://github.com/pygithub/pygithub/issues/3356)
<https://github.com/PyGithub/PyGithub/pull/3356>)
(3234a21f
<https://github.com/PyGithub/PyGithub/commit/3234a21f>)
Bug Fixes
^^^^^^^^^
- Fix API path of
Repository.get_git_ref
([#2992](https://github.com/pygithub/pygithub/issues/2992)
<https://github.com/PyGithub/PyGithub/pull/2992>)
(a6965031
<https://github.com/PyGithub/PyGithub/commit/a6965031>)
- Rework redirection URL allowance check
(
[#3329](https://github.com/pygithub/pygithub/issues/3329)
<https://github.com/PyGithub/PyGithub/pull/3329>)
(065b1319
<https://github.com/PyGithub/PyGithub/commit/065b1319>)
- Fix
GitRelease.name, deprecate
GitRelease.title
([#3346](https://github.com/pygithub/pygithub/issues/3346)
<https://github.com/PyGithub/PyGithub/pull/3346>)
(fb51957f
<https://github.com/PyGithub/PyGithub/commit/fb51957f>)
- Remove
"COMMENT" as the default event for
create_review
([#3078](https://github.com/pygithub/pygithub/issues/3078)
<https://github.com/PyGithub/PyGithub/pull/3078>)
(8494da5c
<https://github.com/PyGithub/PyGithub/commit/8494da5c>)
- Add support for public release assets
(
[#3339](https://github.com/pygithub/pygithub/issues/3339)
<https://github.com/PyGithub/PyGithub/pull/3339>)
(abad296e
<https://github.com/PyGithub/PyGithub/commit/abad296e>)
- Fix GitHub breaking API change of
maintainers in
Organization.create_team
([#3291](https://github.com/pygithub/pygithub/issues/3291)
<https://github.com/PyGithub/PyGithub/pull/3291>)
(17bc4df4
<https://github.com/PyGithub/PyGithub/commit/17bc4df4>)
Maintenance
^^^^^^^^^^^
- Minor fix to release.yml
(
[#3201](https://github.com/pygithub/pygithub/issues/3201)
<https://github.com/PyGithub/PyGithub/pull/3201>)
(f1fc6e7c
<https://github.com/PyGithub/PyGithub/commit/f1fc6e7c>)
- Reduce test replay data
(
[#3243](https://github.com/pygithub/pygithub/issues/3243)
<https://github.com/PyGithub/PyGithub/pull/3243>)
(19426454
<https://github.com/PyGithub/PyGithub/commit/19426454>)
- Add check to OpenAPI script to check doc-string verbs
(
[#3332](https://github.com/pygithub/pygithub/issues/3332)
<https://github.com/PyGithub/PyGithub/pull/3332>)
(3efde77d
<https://github.com/PyGithub/PyGithub/commit/3efde77d>)
- Improve apply OpenAPI schemas
(
[#3333](https://github.com/pygithub/pygithub/issues/3333)
<https://github.com/PyGithub/PyGithub/pull/3333>)
(ec189dd6
<https://github.com/PyGithub/PyGithub/commit/ec189dd6>)
- Add config to OpenAPI script to ignore schemas
(
[#3334](https://github.com/pygithub/pygithub/issues/3334)
<https://github.com/PyGithub/PyGithub/pull/3334>)
(0478d33b
<https://github.com/PyGithub/PyGithub/commit/0478d33b>)
- Add suggest and create method feature to OpenAPI script
(
[#3318](https://github.com/pygithub/pygithub/issues/3318)
<https://github.com/PyGithub/PyGithub/pull/3318>_)
- Fix CI OpenApi apply command
(
[#3341](https://github.com/pygithub/pygithub/issues/3341)
<https://github.com/PyGithub/PyGithub/pull/3341>)
(cdc10a27
<https://github.com/PyGithub/PyGithub/commit/cdc10a27>)
- Improve OpenAPI scripts
(
[#3340](https://github.com/pygithub/pygithub/issues/3340)
<https://github.com/PyGithub/PyGithub/pull/3340>)
(ad278c5f
<https://github.com/PyGithub/PyGithub/commit/ad278c5f>)
- Improve OpenAPI CI
(
[#3347](https://github.com/pygithub/pygithub/issues/3347)
<https://github.com/PyGithub/PyGithub/pull/3347>)
(8165bbc9
<https://github.com/PyGithub/PyGithub/commit/8165bbc9>)
- Rework test framework
(
[#3271](https://github.com/pygithub/pygithub/issues/3271)
<https://github.com/PyGithub/PyGithub/pull/3271>)
(1b700187
<https://github.com/PyGithub/PyGithub/commit/1b700187>)
- Some minor fixes to OpenAPI scripts
(
[#3350](https://github.com/pygithub/pygithub/issues/3350)
<https://github.com/PyGithub/PyGithub/pull/3350>)
(a813a945
<https://github.com/PyGithub/PyGithub/commit/a813a945>)
- Add manual workflow to fix auto-fixable issues
(
[#3351](https://github.com/pygithub/pygithub/issues/3351)
<https://github.com/PyGithub/PyGithub/pull/3351>)
(0e6317d9
<https://github.com/PyGithub/PyGithub/commit/0e6317d9>)
... (truncated)
Commits
Updates `pynacl` from 1.5.0 to 1.6.0
Changelog
Sourced from pynacl's
changelog.
1.6.0 (2025-09-11)
- BACKWARDS INCOMPATIBLE: Removed support for Python
3.6 and 3.7.
- Added support for the low level AEAD AES bindings.
- Added support for
crypto_core_ed25519_from_uniform.
- Update
libsodium to 1.0.20-stable (2025-08-27
build).
- Added support for free-threaded Python 3.14.
- Added support for Windows on ARM wheels.
Commits
Updates `rpds-py` from 0.27.0 to 0.27.1
Release notes
Sourced from rpds-py's
releases.
v0.27.1
What's Changed
New Contributors
Full Changelog: https://github.com/crate-py/rpds/compare/v0.27.0...v0.27.1
Commits
7ecc7a5
Merge pull request #165
from EpicWink/pypi-publish-subdir
ab51ff3
Download packages to subdirectory in PyPI publish CI job
d1fd8ac
Merge pull request #162
from crate-py/dependabot/github_actions/astral-sh/set...
cfb1867
Merge pull request #163
from crate-py/dependabot/github_actions/github/codeql...
c29352f
Merge pull request #161
from EpicWink/pypi-publish-fix-dir
21da625
Bump github/codeql-action from 3.29.10 to 3.29.11
79cbefa
Bump astral-sh/setup-uv from 6.5.0 to 6.6.0
c32f229
Specify packages directory for PyPI publish action
09865d3
Tag a release.
16a674d
Merge branch 'pypi-publish-action'
- Additional commits viewable in compare
view
Updates `typing-extensions` from 4.14.1 to 4.15.0
Release notes
Sourced from typing-extensions's
releases.
4.15.0
No user-facing changes since 4.15.0rc1.
New features since 4.14.1:
- Add the
@typing_extensions.disjoint_base decorator, as
specified
in PEP 800. Patch by Jelle Zijlstra.
- Add
typing_extensions.type_repr, a backport of
annotationlib.type_repr,
introduced in Python 3.14 (CPython PR #124551,
originally by Jelle Zijlstra). Patch by Semyon Moroz.
- Fix behavior of type params in
typing_extensions.evaluate_forward_ref. Backport of
CPython PR #137227
by Jelle Zijlstra.
4.15.0rc1
- Add the
@typing_extensions.disjoint_base decorator, as
specified
in PEP 800. Patch by Jelle Zijlstra.
- Add
typing_extensions.type_repr, a backport of
annotationlib.type_repr,
introduced in Python 3.14 (CPython PR #124551,
originally by Jelle Zijlstra). Patch by Semyon Moroz.
- Fix behavior of type params in
typing_extensions.evaluate_forward_ref. Backport of
CPython PR #137227
by Jelle Zijlstra.
Changelog
Sourced from typing-extensions's
changelog.
Release 4.15.0 (August 25, 2025)
No user-facing changes since 4.15.0rc1.
Release 4.15.0rc1 (August 18, 2025)
- Add the
@typing_extensions.disjoint_base decorator, as
specified
in PEP 800. Patch by Jelle Zijlstra.
- Add
typing_extensions.type_repr, a backport of
annotationlib.type_repr,
introduced in Python 3.14 (CPython PR #124551,
originally by Jelle Zijlstra). Patch by Semyon Moroz.
- Fix behavior of type params in
typing_extensions.evaluate_forward_ref. Backport of
CPython PR #137227
by Jelle Zijlstra.
Commits
Updates `zstandard` from 0.24.0 to 0.25.0
Release notes
Sourced from zstandard's
releases.
0.25.0
- PyO3 Rust created upgraded from 0.24 to 0.25. (#273)
- We now use
Py_REFCNT(obj) instead of accessing
(*obj)->ob_refcnt directly.
This fixes a nogil / multi-threaded compile error. (#201,
#275)
- A zstandard commit to fix qsort detection on BSD operating systems
has been backported. (#272)
- The
PYTHON_ZSTANDARD_IMPORT_POLICY environment variable
now has leading
and trailing whitespace stripped. Values like cffi and
cffi are
now equivalent to cffi.
- The CI jobs for building wheels have been overhauled to always use
cibuildwheel and uv (where possible). This
change should be backwards
compatible. But wheel building for this project has historically been
fragile and there may be unwanted changes. We're optimistic that
standardizing
on uv (except for musllinux ppc64le and s390x where uv isn't available)
will lead to more stability over time.
- CI now runs tests against the wheels we distribute. Previously, we
ran
tests against a separate build that was theoretically identical. But the
builds may have been subtly different, leading to preventable bugs in
our
wheels. (Enabling this test coverage did not uncover any failures.)
- The
pyproject.toml build backend has been switched from
setuptools.build_meta:__legacy__ to
setuptools.build_meta.
- The setuptools build dependency has been upgraded from <69.0.0 to
>=77.0.0.
Modern versions of setuptools broke
--config-settings=--build-option=... as part of
implementing PEP 660.
A workaround is to use
--config-settings=--global-option=... instead.
--global-option apparently is deprecated and the setuptools
folks have yet
to figure out how to thread config settings into setup.py
invocations.
(--build-option is sent to the build_wheel
command but not the
build_editable command.)
- Python 3.14 wheels are now built with
manylinux_2_28
(versus
manylinux2014) for older Python versions. This may raise
the minimum
glibc version, effectively dropping support for Debian 8 and 9, Ubuntu
13.10 through 18.04, Fedora 19 to 28, and RHEL/Centos 7. However, in
practice most platforms don't container newer glibc symbols and are
still
ABI compatible with manylinux2014 and glibc 2.17.
- We now require cffi >= 2.0.0b on Python 3.14. <3.14 still
requires 1.17.
(#274)
- The cffi backend is now automatically disabled for free-threaded
builds
on Python <3.14, as cffi didn't implement free-threaded support until
the 2.0 release. (#274)
- Added CI coverage for free-threaded CPython 3.13 and 3.14. We do not
yet
formally support free-threaded builds. (#276)
- The C and Rust backends now declare the GIL as unused.
- The
pythoncapi_compat.h file has been upgraded to the
latest version. (#278)
setup.py now depends on packaging and uses
packaging.version.Version
for version comparisons. This removes some deprecation warnings from
usage of
legacy distutils Version classes.
- Relax run-time libzstd version checking in C extension from exactly
1.5.7
to >=1.5.6. (#254,
#267)
- C extension types now (correctly) declare their fully qualified type
names
... (truncated)
Changelog
Sourced from zstandard's
changelog.
0.25.0 (released 2025-09-14)
- PyO3 Rust created upgraded from 0.24 to 0.25. (#273)
- We now use
Py_REFCNT(obj) instead of accessing
(*obj)->ob_refcnt directly.
This fixes a nogil / multi-threaded compile error. (#201,
#275)
- A zstandard commit to fix qsort detection on BSD operating systems
has been backported. (#272)
- The
PYTHON_ZSTANDARD_IMPORT_POLICY environment variable
now has leading
and trailing whitespace stripped. Values like cffi and
cffi are
now equivalent to cffi.
- The CI jobs for building wheels have been overhauled to always use
cibuildwheel and uv (where possible). This
change should be backwards
compatible. But wheel building for this project has historically been
fragile and there may be unwanted changes. We're optimistic that
standardizing
on uv (except for musllinux ppc64le and s390x where uv isn't available)
will lead to more stability over time.
- CI now runs tests against the wheels we distribute. Previously, we
ran
tests against a separate build that was theoretically identical. But the
builds may have been subtly different, leading to preventable bugs in
our
wheels. (Enabling this test coverage did not uncover any failures.)
- The
pyproject.toml build backend has been switched from
setuptools.build_meta:__legacy__ to
setuptools.build_meta.
- The setuptools build dependency has been upgraded from <69.0.0 to
>=77.0.0.
Modern versions of setuptools broke
--config-settings=--build-option=... as part of
implementing PEP 660.
A workaround is to use --config-settings=--global-option=...``
instead. --global-optionapparently is deprecated and the
setuptools folks have yet to figure out how to thread config settings
intosetup.py invocations. (`--build-option is sent
to the build_wheel command but not the
build_editable command.)
- Python 3.14 wheels are now built with
manylinux_2_28
(versus
manylinux2014) for older Python versions. This may raise
the minimum
glibc version, effectively dropping support for Debian 8 and 9, Ubuntu
13.10 through 18.04, Fedora 19 to 28, and RHEL/Centos 7. However, in
practice most platforms don't container newer glibc symbols and are
still
ABI compatible with manylinux2014 and glibc 2.17.
- We now require cffi >= 2.0.0b on Python 3.14. <3.14 still
requires 1.17.
(#274)
- The cffi backend is now automatically disabled for free-threaded
builds
on Python <3.14, as cffi didn't implement free-threaded support until
the 2.0 release. (#274)
- Added CI coverage for free-threaded CPython 3.13 and 3.14. We do not
yet
formally support free-threaded builds. (#276)
- The C and Rust backends now declare the GIL as unused.
- The
pythoncapi_compat.h file has been upgraded to the
latest version. (#278)
setup.py now depends on packaging and uses
packaging.version.Version
for version comparisons. This removes some deprecation warnings from
usage of
legacy distutils Version classes.
- Relax run-time libzstd version checking in C extension from exactly
1.5.7
... (truncated)
Commits
7a77a75
global: release 0.25.0
7935539
rust: cargo upgrade
bc3074c
rust: update dependencies
-
Date: Mon, 27 Oct 2025 09:29:11 -0500
Subject: [PATCH 109/231] Bump the actions group in /.github/workflows with 3
updates (#810)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the actions group in /.github/workflows with 3 updates:
[actions/setup-python](https://github.com/actions/setup-python),
[actions/attest-build-provenance](https://github.com/actions/attest-build-provenance)
and
[zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).
Updates `actions/setup-python` from 5.6.0 to 6.0.0
Release notes
Sourced from actions/setup-python's
releases.
v6.0.0
What's Changed
Breaking Changes
Make sure your runner is on version v2.327.1 or later to ensure
compatibility with this release. See
Release Notes
Enhancements:
Bug fixes:
Dependency updates:
New Contributors
Full Changelog: https://github.com/actions/setup-python/compare/v5...v6.0.0
Commits
e797f83
Upgrade to node 24 (#1164)
3d1e2d2
Revert "Enhance cache-dependency-path handling to support files
outside the w...
65b0712
Clarify pythonLocation behavior for PyPy and GraalPy in environment
variables...
5b668cf
Bump actions/checkout from 4 to 5 (#1181)
f62a0e2
Change missing cache directory error to warning (#1182)
9322b3c
Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in
PackageIn...
fbeb884
Bump form-data to fix critical vulnerabilities #182
& #183
(#1163)
03bb615
Bump idna from 2.9 to 3.7 in /tests/data (#843)
36da51d
Add version parsing from Pipfile (#1067)
3c6f142
update documentation (#1156)
- Additional commits viewable in compare
view
Updates `actions/attest-build-provenance` from 2.4.0 to 3.0.0
Release notes
Sourced from actions/attest-build-provenance's
releases.
v3.0.0
What's Changed
⚠️ Minimum Compatible Runner Version
v2.327.1
Release
Notes
Make sure your runner is updated to this version or newer to use this
release.
Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0
Commits
Updates `zizmorcore/zizmor-action` from 0.1.2 to 0.2.0
Release notes
Sourced from zizmorcore/zizmor-action's
releases.
v0.2.0
What's Changed
New Contributors
Full Changelog: https://github.com/zizmorcore/zizmor-action/compare/v0.1.2...v0.2.0
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/check.yml | 2 +-
.github/workflows/linux.yml | 10 +++++-----
.github/workflows/macos.yml | 4 ++--
.github/workflows/release.yml | 2 +-
.github/workflows/windows.yml | 4 ++--
.github/workflows/zizmor.yml | 2 +-
6 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index ccf2ab865..5165792ed 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -22,7 +22,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+ - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: "3.12"
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index bcbac1c8e..8d05a86f6 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -72,7 +72,7 @@ jobs:
persist-credentials: false
- name: Install Python
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+ uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: "3.11"
@@ -223,7 +223,7 @@ jobs:
persist-credentials: false
- name: Install Python
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+ uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: "3.11"
@@ -277,7 +277,7 @@ jobs:
MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
- uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+ uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
if: ${{ github.ref == 'refs/heads/main' }}
with:
subject-path: dist/*
@@ -331,7 +331,7 @@ jobs:
persist-credentials: false
- name: Install Python
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+ uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: "3.11"
@@ -385,7 +385,7 @@ jobs:
MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
- uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+ uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
if: ${{ github.ref == 'refs/heads/main' }}
with:
subject-path: dist/*
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 941b48dd0..ed58b3d83 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -129,7 +129,7 @@ jobs:
persist-credentials: false
- name: Install Python
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+ uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: "3.11"
@@ -149,7 +149,7 @@ jobs:
MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
- uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+ uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
if: ${{ github.ref == 'refs/heads/main' }}
with:
subject-path: dist/*
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index be9c3d111..3ec62442e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -91,7 +91,7 @@ jobs:
GITHUB_EVENT_INPUTS_SHA: ${{ github.event.inputs.sha }}
GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
- name: Generate attestations
- uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+ uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
if: ${{ github.event.inputs.dry-run == 'false' }}
with:
subject-path: |
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index fc8c9886b..86d02af71 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -135,7 +135,7 @@ jobs:
packages: autoconf automake libtool
- name: Install Python
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+ uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: "3.12"
@@ -162,7 +162,7 @@ jobs:
MATRIX_BUILD_OPTIONS: ${{ matrix.build_options }}
- name: Generate attestations
- uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+ uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
if: ${{ github.ref == 'refs/heads/main' }}
with:
subject-path: dist/*
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 860113426..f5252e070 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -21,4 +21,4 @@ jobs:
persist-credentials: false
- name: Run zizmor
- uses: zizmorcore/zizmor-action@5ca5fc7a4779c5263a3ffa0e1f693009994446d1 # v0.1.2
+ uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0
From b73246f40a7073d85c580c71f600594b79d9162c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Oct 2025 09:29:33 -0500
Subject: [PATCH 110/231] Bump the rust group across 1 directory with 31
updates (#809)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the rust group with 31 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.95` | `1.0.99` |
| [apple-sdk](https://github.com/indygreg/apple-platform-rs) | `0.5.2` |
`0.6.0` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.10.0` | `1.10.1` |
| [clap](https://github.com/clap-rs/clap) | `4.5.28` | `4.5.47` |
| [duct](https://github.com/oconnor663/duct.rs) | `0.13.7` | `1.1.0` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.0.35` | `1.1.2`
|
| [goblin](https://github.com/m4b/goblin) | `0.8.2` | `0.10.1` |
| [http](https://github.com/hyperium/http) | `1.2.0` | `1.3.1` |
| [http-body-util](https://github.com/hyperium/http-body) | `0.1.2` |
`0.1.3` |
| [hyper](https://github.com/hyperium/hyper) | `1.6.0` | `1.7.0` |
| [hyper-util](https://github.com/hyperium/hyper-util) | `0.1.10` |
`0.1.17` |
| [object](https://github.com/gimli-rs/object) | `0.37.1` | `0.37.3` |
| [octocrab](https://github.com/XAMPPRocky/octocrab) | `0.44.1` |
`0.45.0` |
| [once_cell](https://github.com/matklad/once_cell) | `1.20.2` |
`1.21.3` |
| [pep440_rs](https://github.com/konstin/pep440-rs) | `0.6.6` | `0.7.3`
|
| [rayon](https://github.com/rayon-rs/rayon) | `1.10.0` | `1.11.0` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.12.12` |
`0.12.23` |
| [reqwest-middleware](https://github.com/TrueLayer/reqwest-middleware)
| `0.4.0` | `0.4.2` |
| [scroll](https://github.com/m4b/scroll) | `0.12.0` | `0.13.0` |
| [semver](https://github.com/dtolnay/semver) | `1.0.25` | `1.0.27` |
| [serde](https://github.com/serde-rs/serde) | `1.0.217` | `1.0.225` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.138` | `1.0.145`
|
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.8` | `0.10.9` |
| [tar](https://github.com/alexcrichton/tar-rs) | `0.4.43` | `0.4.44` |
| [tempfile](https://github.com/Stebalien/tempfile) | `3.16.0` |
`3.22.0` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.43.1` | `1.47.1` |
| [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.13` | `0.7.16`
|
| [url](https://github.com/servo/rust-url) | `2.5.4` | `2.5.7` |
| [version-compare](https://gitlab.com/timvisee/version-compare) |
`0.1.1` | `0.2.0` |
| [zip](https://github.com/zip-rs/zip2) | `0.6.6` | `5.1.1` |
| [zstd](https://github.com/gyscos/zstd-rs) | `0.13.2` | `0.13.3` |
Updates `anyhow` from 1.0.95 to 1.0.99
Release notes
Sourced from anyhow's
releases.
1.0.99
- Allow build-script cleanup failure with NFSv3 output directory to be
non-fatal (#420)
1.0.98
1.0.97
- Documentation improvements
1.0.96
- Documentation improvements
Commits
f2b963a
Release 1.0.99
2c64c15
Merge pull request #420
from dtolnay/enotempty
8cf66f7
Allow build-script cleanup failure with NFSv3 output directory to be
non-fatal
f5e145c
Revert "Pin nightly toolchain used for miri job"
1d7ef1d
Update ui test suite to nightly-2025-06-30
6929572
Update ui test suite to nightly-2025-06-18
37224e3
Ignore mismatched_lifetime_syntaxes lint
11f0e81
Pin nightly toolchain used for miri job
d04c999
Raise required compiler for backtrace feature to rust 1.82
219d163
Update test suite to nightly-2025-05-01
- Additional commits viewable in compare
view
Updates `apple-sdk` from 0.5.2 to 0.6.0
Commits
1168eb2
workspace: perform releases
1cbcefc
workspace: enable http2 reqwest feature
d5d09f0
apple-codesign: add release notes for Info.plist fix
0e88caf
apple-codesign: print S3 error context
b7fab9b
apple-codesign: honor verbose level to set logging level
cfb7529
apple-platform-rs: fix non-macOS Info.plist detection
100545d
apple-xar: add id attribute for extended attribute struct
5fb3af6
apple-sdk: support reading path set by xcode-select
--switch
9ba97e6
app-store-connect: add api to enable capability for a bundle ID
e09f979
app-store-connect: add IosDistribution certificate type
- Additional commits viewable in compare
view
Updates `bytes` from 1.10.0 to 1.10.1
Release notes
Sourced from bytes's
releases.
Bytes v1.10.1
1.10.1 (March 5th, 2025)
Fixed
- Fix memory leak when using
to_vec with
Bytes::from_owner (#773)
#773:
tokio-rs/bytes#773
Changelog
Sourced from bytes's
changelog.
1.10.1 (March 5th, 2025)
Fixed
- Fix memory leak when using
to_vec with
Bytes::from_owner (#773)
Commits
Updates `clap` from 4.5.28 to 4.5.47
Release notes
Sourced from clap's
releases.
v4.5.47
[4.5.47] - 2025-09-02
Features
- Added
impl FromArgMatches for ()
- Added
impl Args for ()
- Added
impl Subcommand for ()
- Added
impl FromArgMatches for Infallible
- Added
impl Subcommand for Infallible
Fixes
- (derive) Update runtime error text to match
clap
v4.5.46
[4.5.46] - 2025-08-26
Features
- Expose
StyledStr::push_str
v4.5.45
[4.5.45] - 2025-08-12
Fixes
- (unstable-v5)
ValueEnum variants now use the
full doc comment, not summary, for PossibleValue::help
v4.5.44
[4.5.44] - 2025-08-11
Features
- Add
Command::mut_subcommands
v4.5.43
[4.5.43] - 2025-08-06
Fixes
- (help) In long help, list Possible Values before defaults,
rather than after, for a more consistent look
v4.5.42
[4.5.42] - 2025-07-30
Fixes
- Include subcommand visible long aliases in
--help
... (truncated)
Changelog
Sourced from clap's
changelog.
[4.5.47] - 2025-09-02
Features
- Added
impl FromArgMatches for ()
- Added
impl Args for ()
- Added
impl Subcommand for ()
- Added
impl FromArgMatches for Infallible
- Added
impl Subcommand for Infallible
Fixes
- (derive) Update runtime error text to match
clap
[4.5.46] - 2025-08-26
Features
- Expose
StyledStr::push_str
[4.5.45] - 2025-08-12
Fixes
- (unstable-v5)
ValueEnum variants now use the
full doc comment, not summary, for PossibleValue::help
[4.5.44] - 2025-08-11
Features
- Add
Command::mut_subcommands
[4.5.43] - 2025-08-06
Fixes
- (help) In long help, list Possible Values before defaults,
rather than after, for a more consistent look
[4.5.42] - 2025-07-30
Fixes
- Include subcommand visible long aliases in
--help
[4.5.41] - 2025-07-09
Features
- Add
Styles::context and
Styles::context_value to customize the styling of
[default: value] like notes in the --help
... (truncated)
Commits
f046ca6
chore: Release
436949d
docs: Update changelog
1ddab84
Merge pull request #5954
from epage/tests
8a66dbf
test(complete): Add more native cases
76465cf
test(complete): Make things more consistent
232cedb
test(complete): Remove redundant index
02244a6
Merge pull request #5949
from krobelus/option-name-completions-after-positionals
2e13847
fix(complete): Missing options in multi-val arg
74388d7
test(complete): Multi-valued, unbounded positional
5b3d45f
refactor(complete): Extract function for options
- Additional commits viewable in compare
view
Updates `duct` from 0.13.7 to 1.1.0
Commits
2757052
version 1.1.0
d2c8040
test_env_case_preserving
ae8814e
use a mixed-case env var name in test_env_remove_case_sensitivity
944c126
add tests for EnvNameString
61f29ff
avoid allocating in EnvNameString::hash
fc909f7
use case-insensitive strings for env var names on Windows
306bb5c
clarify a comment in StdinBytesHandle::wait
ca531e2
improve the Expression docs
38fa270
wait_timeout and wait_deadline
0c90564
switch back to IntoRawFd/IntoRawHandle bounds
- Additional commits viewable in compare
view
Updates `flate2` from 1.0.35 to 1.1.2
Release notes
Sourced from flate2's
releases.
1.1.2
What's Changed
Full Changelog: https://github.com/rust-lang/flate2-rs/compare/1.1.1...1.1.2
1.1.1
This release should be smaller and thus faster to download.
Additionally, when using the zlib-rs backend, duplicate
symbol issues shouldn't occur anymore.
What's Changed
New Contributors
Full Changelog: https://github.com/rust-lang/flate2-rs/compare/1.1.0...1.1.1
1.1.0
What's Changed
... (truncated)
Commits
ac4d950
Merge pull request #490
from folkertdev/update-zlib-rs-0.5.1
e38e16f
upgrade zlib-rs to version 0.5.1
76cc0cc
Merge pull request #489
from CosminPerRam/feat/revert_updates
8f52350
Revert "chore: update deps"
df11207
Merge pull request #488
from CosminPerRam/ci/audit
a8872d7
ci: rename audit job
190750c
ci: add audit check
c2c78de
solve remaining clippy warnings and add it to CI (#487)
306e909
Merge pull request #485
from CosminPerRam/chore/update_deps
29d8194
Merge pull request #484
from CosminPerRam/feat/simplify_manual_conversion
- Additional commits viewable in compare
view
Updates `goblin` from 0.8.2 to 0.10.1
Changelog
Sourced from goblin's
changelog.
[0.10.1]
Added
pe: Add .NET CLR parser, thanks @kkent030315: m4b/goblin#432
pe: Add parser for C_SCOPE_TABLE, thanks @kkent030315: m4b/goblin#477
pe: Add resource parser, thanks @kkent030315: m4b/goblin#431
pe: Add parse_tls_data option, thanks @ideeockus: m4b/goblin#457
pe: Add load config parser, thanks @kkent030315: m4b/goblin#464
elf: added type_to_str support for coredump constants,
thanks @gunbux: m4b/goblin#475
elf: added PowerPC64 relocations, thanks @Gelbpunkt: m4b/goblin#484
Fixed
pe: fix load config parser out of bounds, thanks @kkent030315 and
Robel Campbell: m4b/goblin#483
pe: remove unwind info alignment assertion, thanks @kkent030315: m4b/goblin#480
pe: fix base relocation parser panic, thanks @kkent030315: m4b/goblin#465
pe: Fix some offsets computation when using scroll, thanks @DreydenGys: m4b/goblin#471
pe: cannot read cb size, thanks chf0x: m4b/goblin#472
pe: fix tls raw data parser, thanks @jorgeaduran and
@kkent030315:
m4b/goblin#473
build: fix no-std build errors, thanks @hannahfluch: m4b/goblin#478
[0.10.0] - 2025-5-25
Breaking
build: use rust 2024 edition; bump MSRV to 1.85
pe: fix address size incompatibility on 32-bit builds, thanks @kkent030315: m4b/goblin#441
pe: fix fail on malformed certificate table parsing, thanks @ideeockus: m4b/goblin#417
pe: remove use of generics for is_32bit, thanks @kkent030315: m4b/goblin#435
pe: Support multiple debug directories and VCFeature, Repro,
ExDllCharacteristics, POGO parsers, thanks @kkent030315: m4b/goblin#403
Added
elf: add Loongarch macros and name mapping, thanks @000lbh: m4b/goblin#446
pe: Add base relocation parser thanks @kkent030315: m4b/goblin#444
Fixed
pe.header: fix parse without rich header, thanks @ideeockus: m4b/goblin#451
pe.header: fix parse header with no dos stub, thanks @ideeockus: m4b/goblin#456
pe.imports: ignore malformed imports in ParseMode::Permissive, thanks @ideeockus: m4b/goblin#442
pe: Change Section Table Real Name Handling, thanks @prettyroseslover:
m4b/goblin#438
pe.tls: tlsdata.parse_with_opts - integer overflow + out of
bound, thanks @BinFlip: m4b/goblin#448
pe.debug: POGOInfo.parse_with_opts - integer overflow + out
of bound, thanks @BinFlip: m4b/goblin#449
archive: fix subtract with overflow in archive parser, thanks @kkent030315: m4b/goblin#454
te: fix subtract with overflow in TE header parser, thanks @kkent030315: m4b/goblin#452
archive: fix size overflow in name index parser, thanks @kkent030315: m4b/goblin#455
coff: fix subtract with overflow in COFF header parser, thanks @kkent030315: m4b/goblin#453
[0.9.3] - 2025-1-5
Fixed
pe: fix import parser for non-well-formed import table, thanks @kkent030315: m4b/goblin#429
pe: fix empty import table parsing, thanks @kkent030315: m4b/goblin#430
Added
pe: Add tests for TLS parser and characteristics constants, thanks @kkent030315: m4b/goblin#426
elf: added new constants for 32-bit PowerPC, thanks @ivlzme m4b/goblin#439
[0.9.2] - 2024-10-26
... (truncated)
Commits
Updates `http` from 1.2.0 to 1.3.1
Release notes
Sourced from http's
releases.
v1.3.1
What's Changed
Full Changelog: https://github.com/hyperium/http/compare/v1.3.0...v1.3.1
v1.3.0
What's Changed
- Allow most UTF-8 characters in URI path and query. (hyperium/http#715)
- This means paring
Uris with previously illegal
characters according the original RFC will now be accepted. They used to
be rejected in the name of spec purity, but many operators were using a
fork of http because reality is that most characters are
seen in the real world.
- Fix
HeaderMap::reserve() to allocate sufficient
capacity.
New Contributors
Thanks!
Full Changelog: https://github.com/hyperium/http/compare/v1.2.0...v1.3.0
Changelog
Sourced from http's
changelog.
1.3.1 (March 11, 2025)
- Fix validation that all characters are UTF-8 in URI path and
query.
1.3.0 (March 11, 2025)
- Allow most UTF-8 characters in URI path and query.
- Fix
HeaderMap::reserve() to allocate sufficient
capacity.
Commits
8c1fb20
v1.3.1
6637a72
fix: validate path bytes are at least utf8 (#756)
d0dd91e
v1.3.0
64bd92b
docs: Fixed encryption/compression typo for 'accept-encoding: identity'.
(#695)
b03ed6a
chore: use range.contains in StatusCode methods (#748)
a463fb5
chore(ci): use yq to get rust-version in manifest (#746)
68845bd
fix: HeaderMap::reserve allocates insufficient capacity (#741)
4e02046
refactor(header): remove BytesMut inline optimization when creating (#738)
091ee9a
feat(uri): allow utf8 char, not rfc 3986 compliant, in path and query
(#715)
- See full diff in compare
view
Updates `http-body-util` from 0.1.2 to 0.1.3
Release notes
Sourced from http-body-util's
releases.
http-body-util v0.1.3
Features
- Add
Channel, a body type backed by an async
channel.
- Make
Empty::new() to be const fn.
Thanks!
Commits
Updates `hyper` from 1.6.0 to 1.7.0
Release notes
Sourced from hyper's
releases.
v1.7.0
Highlights
Features
- client:
- error: add
Error::is_shutdown() (#3863)
(b8affd8a,
closes #2745)
- server: add
allow_multiple_spaces_in_request_line_delimiters http1
builder method (#3929)
(9749184f)
Bug Fixes
- server: improve caching accuracy of Date header (#3887)
(436cadd1)
What's Changed
New Contributors
... (truncated)
Changelog
Sourced from hyper's
changelog.
v1.7.0 (2025-08-18)
Bug Fixes
- server: improve caching accuracy of Date header (#3887)
(436cadd1)
Features
- client:
- error: add
Error::is_shutdown() (#3863)
(b8affd8a,
closes #2745)
- server: add
allow_multiple_spaces_in_request_line_delimiters http1
builder method (#3929)
(9749184f)
Commits
400bdfd
v1.7.0
9749184
feat(server): add
allow_multiple_spaces_in_request_line_delimiters http1
bu...
caa166c
chore(dependencies): avoid implicit cargo feature of futures-util (#3931)
8ad2595
test(common): add missing assertion in full_rewind test (#3926)
24f0da8
chore(ci): update to cargo-check-external-types-0.3.0 (#3928)
974289f
docs(rt): improve rt module overview (#3920)
283fd23
docs: improve ext module overview and Protocol
docs (#3921)
b8affd8
feat(error): add Error::is_shutdown() (#3863)
c88df78
docs(SECURITY): update policy to use GSA drafts when reporting
vulnerabilitie...
436cadd
fix(server): improve caching accuracy of Date header (#3887)
- Additional commits viewable in compare
view
Updates `hyper-util` from 0.1.10 to 0.1.17
Release notes
Sourced from hyper-util's
releases.
v0.1.17
Highlights
- Fix
legacy::Client to allow absolute-form URIs when
Connected::proxy(true) is passed and the scheme is
https.
What's Changed
Full Changelog: https://github.com/hyperium/hyper-util/compare/v0.1.16...v0.1.17
v0.1.16
Highlights
- Add
impl Clone for proxy::Tunnel
service.
- Fix
proxy::Matcher to detect SOCKS4 schemes.
- Fix
legacy::Client pool idle checker to trigger less
aggresively, saving CPU.
What's Changed
New Contributors
Full Changelog: https://github.com/hyperium/hyper-util/compare/v0.1.15...v0.1.16
v0.1.15
tl;dr
- Add header casing options to
auto::Builder.
- Fix
proxy::Socksv5 to check for enough bytes before
parsing ipv6 responses.
- Fix including
client-proxy in the full
feature set.
What's Changed
... (truncated)
Changelog
Sourced from hyper-util's
changelog.
0.1.17 (2025-09-15)
- Fix
legacy::Client to allow absolute-form URIs when
Connected::proxy(true) is passed and the scheme is
https.
0.1.16 (2025-07-22)
- Add
impl Clone for proxy::Tunnel
service.
- Fix
proxy::Matcher to detect SOCKS4 schemes.
- Fix
legacy::Client pool idle checker to trigger less
aggresively, saving CPU.
0.1.15 (2025-07-07)
- Add header casing options to
auto::Builder.
- Fix
proxy::Socksv5 to check for enough bytes before
parsing ipv6 responses.
- Fix including
client-proxy in the full
feature set.
0.1.14 (2025-06-04)
- Fix
HttpConnector to defer address family order to
resolver sort order.
- Fix
proxy::Matcher to find HTTPS system proxies on
Windows.
0.1.13 (2025-05-27)
- Fix
HttpConnector to always prefer IPv6 addresses
first, if happy eyeballs is enabled.
- Fix
legacy::Client to return better errors if available
on the connection.
0.1.12 (2025-05-19)
- Add
client::legacy::proxy::Tunnel connector that wraps
another connector with HTTP tunneling.
- Add
client::legacy::proxy::{SocksV4, SocksV5}
connectors that wraps another connector with SOCKS.
- Add
client::proxy::matcher::Matcher type that can use
environment variables to match proxy rules.
- Add
server::graceful::Watcher type that can be sent to
watch a connection in another task.
- Add
GracefulShutdown::count() method to get number of
currently watched connections.
- Fix missing
must_use attributes on
Connection futures.
- Fix tracing span in GAI resolver that can cause panics.
0.1.11 (2025-03-31)
- Add
tracing crate feature with support in
TokioExecutor.
- Add
HttpConnector::interface() support for macOS and
Solarish systems.
- Add
rt::WithHyperIo and rt::WithTokioIo
combinators.
- Add
auto_date_header() for auto server builder.
- Add
max_local_error_reset_streams() for auto server
builder.
- Add
ignore_invalid_headers() for auto server
builder.
- Add methods to determine if auto server is configured for HTTP/1 or
HTTP/2.
- Implement
Connection for UnixStream and
NamedPipeClient.
- Fix HTTP/2 websocket requests sent through
legacy::Client.
Commits
3021828
v0.1.17
9fb7cd5
fix(client): allow absolute-form if is_proxied is set even on HTTPS (#225)
00035ba
refactor: set correct cfg on common::{rewind, Exec, Lazy, SyncWrapper}
(#224)
ad8c7c5
refactor(connect): safely convert Socket to Tokio
TcpSocket (#223)
00911ec
chore(test): remove some miri exception config ("]
edition = "2024"
[dependencies]
-anyhow = "1.0.80"
-apple-sdk = "0.5.2"
-bytes = "1.5.0"
-clap = "4.5.1"
-duct = "0.13.7"
-flate2 = "1.0.28"
+anyhow = "1.0.99"
+apple-sdk = "0.6.0"
+bytes = "1.10.1"
+clap = "4.5.47"
+duct = "1.1.0"
+flate2 = "1.1.2"
futures = "0.3.30"
-goblin = "0.8.0"
+goblin = "0.10.1"
hex = "0.4.3"
-http = "1.0.0"
-http-body-util = "0.1.0"
-hyper = { version = "1.2.0", features = ["client"] }
-hyper-util = { version = "0.1.3" }
+http = "1.3.1"
+http-body-util = "0.1.3"
+hyper = { version = "1.7.0", features = ["client"] }
+hyper-util = { version = "0.1.17" }
normalize-path = "0.2.1"
-object = "0.37.1"
-octocrab = { version = "0.44.1", features = ["rustls", "stream"] }
-once_cell = "1.19.0"
+object = "0.37.3"
+octocrab = { version = "0.45.0", features = ["rustls", "stream"] }
+once_cell = "1.21.3"
pdb = "0.8.0"
-pep440_rs = "0.6.6"
-rayon = "1.8.1"
-reqwest = { version = "0.12.12", features = ["rustls-tls-webpki-roots", "stream"] }
-reqwest-middleware = "0.4.0"
+pep440_rs = "0.7.3"
+rayon = "1.11.0"
+reqwest = { version = "0.12.23", features = ["rustls-tls-webpki-roots", "stream"] }
+reqwest-middleware = "0.4.2"
reqwest-retry = "0.7.0"
-scroll = "0.12.0"
-semver = "1.0.22"
-serde = { version = "1.0.197", features = ["derive"] }
-serde_json = "1.0.114"
-sha2 = "0.10.8"
-tar = "0.4.40"
-tempfile = "3.10.0"
+scroll = "0.13.0"
+semver = "1.0.27"
+serde = { version = "1.0.225", features = ["derive"] }
+serde_json = "1.0.145"
+sha2 = "0.10.9"
+tar = "0.4.44"
+tempfile = "3.22.0"
text-stub-library = "0.9.0"
-tokio = "1.43.1"
-tokio-util = "0.7.13"
-url = "2.5.0"
-version-compare = "0.1.1"
-zip = "0.6.6"
-zstd = "0.13.0"
+tokio = "1.47.1"
+tokio-util = "0.7.16"
+url = "2.5.7"
+version-compare = "0.2.0"
+zip = "5.1.1"
+zstd = "0.13.3"
From ce3b5ae806cf52ea7018e5d973eb24c9e3d65289 Mon Sep 17 00:00:00 2001
From: Mohammad Miadh Angkad
Date: Tue, 28 Oct 2025 05:52:40 +0800
Subject: [PATCH 111/231] Upgrade pip from 25.2 -> 25.3 (#826)
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 9cc4f9d89..265de582b 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -293,10 +293,10 @@
"version": "0.13.1",
},
"pip": {
- "url": "https://files.pythonhosted.org/packages/b7/3f/945ef7ab14dc4f9d7f40288d2df998d1837ee0888ec3659c813487572faa/pip-25.2-py3-none-any.whl",
- "size": 1752557,
- "sha256": "6d67a2b4e7f14d8b31b8b52648866fa717f45a1eb70e83002f4331d07e953717",
- "version": "25.2",
+ "url": "https://files.pythonhosted.org/packages/44/3c/d717024885424591d5376220b5e836c2d5293ce2011523c9de23ff7bf068/pip-25.3-py3-none-any.whl",
+ "size": 1778622,
+ "sha256": "9655943313a94722b7774661c21049070f6bbb0a1516bf02f7c8d5d9201514cd",
+ "version": "25.3",
},
"readline": {
# Mirrored from https://ftp.gnu.org/gnu/readline/readline-8.2.tar.gz
From 4f27e392e9259560b62aa31e30172f3b13abdde4 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Mon, 27 Oct 2025 20:54:00 -0400
Subject: [PATCH 112/231] Fix musl detection in Python 3.12 and below (#827)
CPython 3.10 and below don't even attempt to fix the target triple for
musl. CPython 3.11 and 3.12 do, but in our setup it doesn't work right
because of an autoconf bug. CPython 3.13 rewrites the target triple
detection logic and works fine.
Fixes #724.
---
cpython-unix/build-cpython-host.sh | 7 +---
cpython-unix/build-cpython.sh | 17 +++++----
...on-configure-target-triple-musl-3.10.patch | 31 ++++++++++++++++
...on-configure-target-triple-musl-3.12.patch | 36 +++++++++++++++++++
src/verify_distribution.py | 12 +++++++
5 files changed, 91 insertions(+), 12 deletions(-)
create mode 100644 cpython-unix/patch-cpython-configure-target-triple-musl-3.10.patch
create mode 100644 cpython-unix/patch-cpython-configure-target-triple-musl-3.12.patch
diff --git a/cpython-unix/build-cpython-host.sh b/cpython-unix/build-cpython-host.sh
index ff7c3a45c..93fdea7cc 100755
--- a/cpython-unix/build-cpython-host.sh
+++ b/cpython-unix/build-cpython-host.sh
@@ -37,17 +37,12 @@ pushd "Python-${PYTHON_VERSION}"
# Clang 13 actually prints something with --print-multiarch, confusing CPython's
# configure. This is reported as https://bugs.python.org/issue45405. We nerf the
# check since we know what we're doing.
-if [ "${CC}" = "clang" ]; then
+if [[ "${CC}" = "clang" || "${CC}" = "musl-clang" ]]; then
if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
patch -p1 -i ${ROOT}/patch-disable-multiarch-13.patch
else
patch -p1 -i ${ROOT}/patch-disable-multiarch.patch
fi
-elif [ "${CC}" = "musl-clang" ]; then
- # Similarly, this is a problem for musl Clang on Python 3.13+
- if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]; then
- patch -p1 -i ${ROOT}/patch-disable-multiarch-13.patch
- fi
fi
autoconf
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 8b8933ded..e58f5eff7 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -115,6 +115,14 @@ if [ -n "${CROSS_COMPILING}" ]; then
fi
fi
+# CPython <=3.10 doesn't properly detect musl. CPython <=3.12 tries, but fails
+# in our environment because of an autoconf bug. CPython >=3.13 is fine.
+if [ -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_10}" ]; then
+ patch -p1 -i ${ROOT}/patch-cpython-configure-target-triple-musl-3.10.patch
+elif [ -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_12}" ]; then
+ patch -p1 -i ${ROOT}/patch-cpython-configure-target-triple-musl-3.12.patch
+fi
+
# Clang 13 actually prints something with --print-multiarch, confusing CPython's
# configure. This is reported as https://bugs.python.org/issue45405. We nerf the
# check since we know what we're doing.
@@ -1133,11 +1141,10 @@ mkdir -p "${LIB_DYNLOAD}"
touch "${LIB_DYNLOAD}/.empty"
# Symlink libpython so we don't have 2 copies.
+# TODO(geofft): Surely we can get PYTHON_ARCH out of the build?
case "${TARGET_TRIPLE}" in
aarch64-unknown-linux-*)
- # In Python 3.13+, the musl target is identified in cross compiles and the output directory
- # is named accordingly.
- if [[ "${CC}" = "musl-clang" && -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]]; then
+ if [[ "${CC}" = "musl-clang" ]]; then
PYTHON_ARCH="aarch64-linux-musl"
else
PYTHON_ARCH="aarch64-linux-gnu"
@@ -1176,9 +1183,7 @@ s390x-unknown-linux-gnu)
PYTHON_ARCH="s390x-linux-gnu"
;;
x86_64-unknown-linux-*)
- # In Python 3.13+, the musl target is identified in cross compiles and the output directory
- # is named accordingly.
- if [[ "${CC}" = "musl-clang" && -n "${PYTHON_MEETS_MINIMUM_VERSION_3_13}" ]]; then
+ if [[ "${CC}" = "musl-clang" ]]; then
PYTHON_ARCH="x86_64-linux-musl"
else
PYTHON_ARCH="x86_64-linux-gnu"
diff --git a/cpython-unix/patch-cpython-configure-target-triple-musl-3.10.patch b/cpython-unix/patch-cpython-configure-target-triple-musl-3.10.patch
new file mode 100644
index 000000000..a391278b6
--- /dev/null
+++ b/cpython-unix/patch-cpython-configure-target-triple-musl-3.10.patch
@@ -0,0 +1,31 @@
+From d7a70fe9ffa0e4e173bae545cdcba62dc7a2a1f1 Mon Sep 17 00:00:00 2001
+From: Geoffrey Thomas
+Date: Sat, 25 Oct 2025 18:49:45 -0400
+Subject: [PATCH 1/1] LOCAL: configure.ac: Fix musl detection
+Forwarded: not-needed
+
+Newer versions of Python rework this code significantly, so this does
+not need to be upstreamed.
+---
+ configure.ac | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index ac3be3850a9..9c7c02ea6de 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -866,6 +866,11 @@ EOF
+
+ if $CPP $CPPFLAGS conftest.c >conftest.out 2>/dev/null; then
+ PLATFORM_TRIPLET=`grep -v '^#' conftest.out | grep -v '^ *$' | tr -d ' '`
++ case "$CC" in
++ musl-*)
++ PLATFORM_TRIPLET=`echo "$PLATFORM_TRIPLET" | sed 's/linux-gnu/linux-musl/'`
++ ;;
++ esac
+ AC_MSG_RESULT([$PLATFORM_TRIPLET])
+ else
+ AC_MSG_RESULT([none])
+--
+2.39.5 (Apple Git-154)
+
diff --git a/cpython-unix/patch-cpython-configure-target-triple-musl-3.12.patch b/cpython-unix/patch-cpython-configure-target-triple-musl-3.12.patch
new file mode 100644
index 000000000..145f536a7
--- /dev/null
+++ b/cpython-unix/patch-cpython-configure-target-triple-musl-3.12.patch
@@ -0,0 +1,36 @@
+From 851c49bafb1fe11c02eafe4850e952cafec548b7 Mon Sep 17 00:00:00 2001
+From: Geoffrey Thomas
+Date: Sat, 25 Oct 2025 18:49:45 -0400
+Subject: [PATCH 1/1] LOCAL: configure.ac: Fix musl detection
+Forwarded: not-needed
+
+We set HOST_CC to regular (glibc) clang and CC to musl-clang.
+AC_CANONICAL_HOST sets build_os based on the output of config.guess,
+which looks at HOST_CC in preference to CC, and therefore misreports the
+target triple as gnu. Directly checking CC works for us.
+
+Newer versions of Python rework this code significantly to not rely on
+build_os and do musl detection internally, so this does not need to be
+upstreamed.
+---
+ configure.ac | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 1a02d19f1b2..ee743c11aa5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1108,8 +1108,8 @@ EOF
+
+ if $CPP $CPPFLAGS conftest.c >conftest.out 2>/dev/null; then
+ PLATFORM_TRIPLET=`grep -v '^#' conftest.out | grep -v '^ *$' | tr -d ' '`
+- case "$build_os" in
+- linux-musl*)
++ case "$CC" in
++ musl-*)
+ PLATFORM_TRIPLET=`echo "$PLATFORM_TRIPLET" | sed 's/linux-gnu/linux-musl/'`
+ ;;
+ esac
+--
+2.39.5 (Apple Git-154)
+
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index 41382cdd4..e7cf4d7d6 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -2,6 +2,7 @@
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import importlib.machinery
import os
import struct
import sys
@@ -255,6 +256,17 @@ def test_hash_algorithm(self):
msg=f"{sys.hash_info.algorithm=!r} is not siphash",
)
+ def test_libc_identity(self):
+ def assertLibc(value):
+ for libc in ("-gnu", "-musl"):
+ if os.environ["TARGET_TRIPLE"].endswith(libc):
+ self.assertIn(libc, value)
+ else:
+ self.assertNotIn(libc, value)
+
+ assertLibc(sys.implementation._multiarch)
+ assertLibc(importlib.machinery.EXTENSION_SUFFIXES[0])
+
if __name__ == "__main__":
unittest.main()
From 615a5d26fa9907c52b8121f47c6ffea8bc53ccbe Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Tue, 28 Oct 2025 07:44:36 -0400
Subject: [PATCH 113/231] Skip sys.implementation._multiarch tests on Windows
(#832)
This isn't present on Windows (which surprises me).
---
src/verify_distribution.py | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/verify_distribution.py b/src/verify_distribution.py
index e7cf4d7d6..8a25b1bd1 100644
--- a/src/verify_distribution.py
+++ b/src/verify_distribution.py
@@ -264,7 +264,9 @@ def assertLibc(value):
else:
self.assertNotIn(libc, value)
- assertLibc(sys.implementation._multiarch)
+ if hasattr(sys.implementation, "_multiarch"):
+ assertLibc(sys.implementation._multiarch)
+
assertLibc(importlib.machinery.EXTENSION_SUFFIXES[0])
From c7bf8b1528ad90e66229485f4329f09c59645d73 Mon Sep 17 00:00:00 2001
From: "Jonathan J. Helmus"
Date: Wed, 29 Oct 2025 15:56:56 -0500
Subject: [PATCH 114/231] include existing LDFLAGS on macos when building tk
(#833)
closes #737
---
cpython-unix/build-tk.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpython-unix/build-tk.sh b/cpython-unix/build-tk.sh
index bd936c8e7..ef13bedde 100755
--- a/cpython-unix/build-tk.sh
+++ b/cpython-unix/build-tk.sh
@@ -26,7 +26,7 @@ LDFLAGS="${EXTRA_TARGET_LDFLAGS}"
if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
CFLAGS="${CFLAGS} -I${TOOLS_PATH}/deps/include -Wno-availability"
CFLAGS="${CFLAGS} -Wno-deprecated-declarations -Wno-unknown-attributes -Wno-typedef-redefinition"
- LDFLAGS="-L${TOOLS_PATH}/deps/lib"
+ LDFLAGS="${LDFLAGS} -L${TOOLS_PATH}/deps/lib"
EXTRA_CONFIGURE_FLAGS="--enable-aqua=yes --without-x"
else
LDFLAGS="${LDFLAGS} -Wl,--exclude-libs,ALL"
From d0969cd0c195042e8274fb8d077356600640c566 Mon Sep 17 00:00:00 2001
From: Gregory Szorc
Date: Thu, 30 Oct 2025 06:43:28 -0700
Subject: [PATCH 115/231] Update LLVM toolchains to 21.0.4 (#835)
Let's stay modern.
---
.../patch-jit-llvm-version-3.13.patch | 2 +-
.../patch-jit-llvm-version-3.14.patch | 2 +-
.../patch-jit-llvm-version-3.15.patch | 2 +-
pythonbuild/downloads.py | 36 +++++++++----------
pythonbuild/utils.py | 4 +--
src/release.rs | 6 ++--
6 files changed, 26 insertions(+), 26 deletions(-)
diff --git a/cpython-unix/patch-jit-llvm-version-3.13.patch b/cpython-unix/patch-jit-llvm-version-3.13.patch
index 33f81e082..649bb4825 100644
--- a/cpython-unix/patch-jit-llvm-version-3.13.patch
+++ b/cpython-unix/patch-jit-llvm-version-3.13.patch
@@ -6,7 +6,7 @@ diff --git a/Tools/jit/_llvm.py b/Tools/jit/_llvm.py
import typing
-_LLVM_VERSION = 18
-+_LLVM_VERSION = 20
++_LLVM_VERSION = 21
_LLVM_VERSION_PATTERN = re.compile(rf"version\s+{_LLVM_VERSION}\.\d+\.\d+\S*\s+")
_P = typing.ParamSpec("_P")
diff --git a/cpython-unix/patch-jit-llvm-version-3.14.patch b/cpython-unix/patch-jit-llvm-version-3.14.patch
index f81e80d33..cd375945c 100644
--- a/cpython-unix/patch-jit-llvm-version-3.14.patch
+++ b/cpython-unix/patch-jit-llvm-version-3.14.patch
@@ -6,7 +6,7 @@ diff --git a/Tools/jit/_llvm.py b/Tools/jit/_llvm.py
import typing
-_LLVM_VERSION = 19
-+_LLVM_VERSION = 20
++_LLVM_VERSION = 21
_LLVM_VERSION_PATTERN = re.compile(rf"version\s+{_LLVM_VERSION}\.\d+\.\d+\S*\s+")
_P = typing.ParamSpec("_P")
diff --git a/cpython-unix/patch-jit-llvm-version-3.15.patch b/cpython-unix/patch-jit-llvm-version-3.15.patch
index d87ac8402..35aae48ee 100644
--- a/cpython-unix/patch-jit-llvm-version-3.15.patch
+++ b/cpython-unix/patch-jit-llvm-version-3.15.patch
@@ -6,7 +6,7 @@ diff --git a/Tools/jit/_llvm.py b/Tools/jit/_llvm.py
-_LLVM_VERSION = "19"
-+_LLVM_VERSION = "20"
++_LLVM_VERSION = "21"
_EXTERNALS_LLVM_TAG = "llvm-19.1.7.0"
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 265de582b..5b1487075 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -192,32 +192,32 @@
"version": "14.0.3+20220508",
},
# Remember to update LLVM_URL in src/release.rs whenever upgrading.
- "llvm-20-aarch64-linux": {
- "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20250511/llvm-20.1.4+20250511-gnu_only-aarch64-unknown-linux-gnu.tar.zst",
- "size": 255946687,
- "sha256": "e70753f294b8f83fffbaf07af36857c27ceaef0291cb10f724ada6af11b0a5bc",
- "version": "20.1.4+20250511",
+ "llvm-21-aarch64-linux": {
+ "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-gnu_only-aarch64-unknown-linux-gnu.tar.zst",
+ "size": 230693810,
+ "sha256": "2933d04136d102d7b82e6a712c5a2d45430045a17689033713e7daab931f111f",
+ "version": "21.1.4+20251029",
},
# Remember to update LLVM_URL in src/release.rs whenever upgrading.
- "llvm-20-x86_64-linux": {
- "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20250511/llvm-20.1.4+20250511-gnu_only-x86_64-unknown-linux-gnu.tar.zst",
- "size": 299883811,
- "sha256": "32374eb8b32fc79e9022f21eefc848d75fa3c46e68054a5dfc1f68d6f2f20429",
- "version": "20.1.4+20250511",
+ "llvm-21-x86_64-linux": {
+ "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-gnu_only-x86_64-unknown-linux-gnu.tar.zst",
+ "size": 273582186,
+ "sha256": "4d33971109cab386c1721f7af80b8559f7e678164a0fed443909a84347c666f4",
+ "version": "21.1.4+20251029",
},
# Remember to update LLVM_URL in src/release.rs whenever upgrading.
"llvm-aarch64-macos": {
- "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20250511/llvm-20.1.4+20250511-aarch64-apple-darwin.tar.zst",
- "size": 152858186,
- "sha256": "d44bf8256b2468339c3b4491edb9c799ab89e466d98d098391286dc86e86a63b",
- "version": "20.1.4+20250511",
+ "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-aarch64-apple-darwin.tar.zst",
+ "size": 155537884,
+ "sha256": "4a17d032ea9c2bd86203f5195df57fe621b0cc5163b858bb4208584fa41e8fc4",
+ "version": "21.1.4+20251029",
},
# Remember to update LLVM_URL in src/release.rs whenever upgrading.
"llvm-x86_64-macos": {
- "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20250511/llvm-20.1.4+20250511-x86_64-apple-darwin.tar.zst",
- "size": 160140682,
- "sha256": "31b35734b678ad22471e31cf6a173c54819a3bca9ffefd4a70d8cdb935d67501",
- "version": "20.1.4+20250511",
+ "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-x86_64-apple-darwin.tar.zst",
+ "size": 163122945,
+ "sha256": "a245a0a8bf529d8dc57ea48b930313b1325f5540bf42ddb8704ce525926cde46",
+ "version": "21.1.4+20251029",
},
"m4": {
# Mirrored from https://ftp.gnu.org/gnu/m4/m4-1.4.19.tar.xz
diff --git a/pythonbuild/utils.py b/pythonbuild/utils.py
index 9e581c5b6..90acbeb64 100644
--- a/pythonbuild/utils.py
+++ b/pythonbuild/utils.py
@@ -481,9 +481,9 @@ def clang_toolchain(host_platform: str, target_triple: str) -> str:
if "musl" in target_triple:
return "llvm-14-x86_64-linux"
else:
- return "llvm-20-x86_64-linux"
+ return "llvm-21-x86_64-linux"
elif host_platform == "linux_aarch64":
- return "llvm-20-aarch64-linux"
+ return "llvm-21-aarch64-linux"
elif host_platform == "macos_arm64":
return "llvm-aarch64-macos"
elif host_platform == "macos_x86_64":
diff --git a/src/release.rs b/src/release.rs
index b49f0fac8..9558361ce 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -610,14 +610,14 @@ pub fn produce_install_only_stripped(tar_gz_path: &Path, llvm_dir: &Path) -> Res
static LLVM_URL: Lazy = Lazy::new(|| {
if cfg!(target_os = "macos") {
if std::env::consts::ARCH == "aarch64" {
- Url::parse("https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20250511/llvm-20.1.4+20250511-aarch64-apple-darwin.tar.zst").unwrap()
+ Url::parse("https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-aarch64-apple-darwin.tar.zst").unwrap()
} else if std::env::consts::ARCH == "x86_64" {
- Url::parse("https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20250511/llvm-20.1.4+20250511-x86_64-apple-darwin.tar.zst").unwrap()
+ Url::parse("https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-x86_64-apple-darwin.tar.zst").unwrap()
} else {
panic!("unsupported macOS architecture");
}
} else if cfg!(target_os = "linux") {
- Url::parse("https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20250511/llvm-20.1.4+20250511-gnu_only-x86_64-unknown-linux-gnu.tar.zst").unwrap()
+ Url::parse("https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-20.1.4+20251029-gnu_only-x86_64-unknown-linux-gnu.tar.zst").unwrap()
} else {
panic!("unsupported platform");
}
From 5ac34b43ddcde27d057d8cbc42aba809f3a2c52f Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Fri, 31 Oct 2025 18:38:50 -0400
Subject: [PATCH 116/231] Build _dbm as a shared module (#838)
Partially addresses #836.
---
cpython-unix/extension-modules.yml | 2 ++
src/validation.rs | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index 3d4f1bf03..445f52a82 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -246,6 +246,8 @@ _dbm:
- name: db
targets:
- .*-unknown-linux-.*
+ # Allow people who want to avoid the Sleepycat license to remove _dbm entirely.
+ build-mode: shared
_decimal:
sources:
diff --git a/src/validation.rs b/src/validation.rs
index 419927346..862b90d8e 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -913,7 +913,7 @@ const GLOBAL_EXTENSIONS_WINDOWS_PRE_3_13: &[&str] = &["_msi"];
const GLOBAL_EXTENSIONS_WINDOWS_NO_STATIC: &[&str] = &["_testinternalcapi", "_tkinter"];
/// Extension modules that should be built as shared libraries.
-const SHARED_LIBRARY_EXTENSIONS: &[&str] = &["_crypt", "_ctypes_test", "_tkinter"];
+const SHARED_LIBRARY_EXTENSIONS: &[&str] = &["_crypt", "_ctypes_test", "_dbm", "_tkinter"];
const PYTHON_VERIFICATIONS: &str = include_str!("verify_distribution.py");
From bdabbfb560c3b42341e00283957bae4dcdc5c36f Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Fri, 31 Oct 2025 18:39:12 -0400
Subject: [PATCH 117/231] CPython 3.9.25 (#839)
---
pythonbuild/downloads.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 5b1487075..e0811bba7 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -48,10 +48,10 @@
"license_file": "LICENSE.bzip2.txt",
},
"cpython-3.9": {
- "url": "https://www.python.org/ftp/python/3.9.24/Python-3.9.24.tar.xz",
- "size": 20176216,
- "sha256": "668391afabd5083faafa4543753d190f82f33ce6ba22d6e9ac728b43644b278a",
- "version": "3.9.24",
+ "url": "https://www.python.org/ftp/python/3.9.25/Python-3.9.25.tar.xz",
+ "size": 20183236,
+ "sha256": "00e07d7c0f2f0cc002432d1ee84d2a40dae404a99303e3f97701c10966c91834",
+ "version": "3.9.25",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp39",
From 651d39334275a2b5061f1a581e0467fba7eb358c Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Thu, 6 Nov 2025 19:44:57 +0200
Subject: [PATCH 118/231] Drop support for EOL Python 3.9 (#845)
First pass for
https://github.com/astral-sh/python-build-standalone/issues/841.
There's some `3.9` still left in
https://github.com/hugovk/python-build-standalone/blob/main/cpython-unix/targets.yml
because seven targets _only_ support 3.9, like `aarch64-apple-ios` and
`arm64-apple-tvos`:
https://github.com/hugovk/python-build-standalone/blob/2181bddcc918f14275232ad6d1365035f2ae75c4/cpython-unix/targets.yml#L114-L119
Should they be removed? Or upgraded?
Also ran `ruff check --select UP --target-version py310 --fix` and `run
check --fix`. There's a lot of `--unsafe-fixes` that can be applied, but
they can be in their own PR to avoid making this too big.
---
ci-matrix.py | 16 +-
ci-targets.yaml | 22 +-
cpython-unix/Makefile | 2 +-
cpython-unix/build-cpython.sh | 79 +----
cpython-unix/build-main.py | 1 -
cpython-unix/build-sqlite.sh | 6 -
cpython-unix/build.py | 17 +-
cpython-unix/extension-modules.yml | 47 +--
.../patch-decimal-modern-mpdecimal.patch | 22 --
...static-libpython-for-interpreter-3.9.patch | 93 ------
.../patch-python-link-modules-3.9.patch | 12 -
cpython-unix/patch-readline-libedit.patch | 49 ---
cpython-unix/patch-tkinter-3.9.patch | 117 --------
.../patch-xopen-source-ios-legacy.patch | 17 --
cpython-unix/patch-xopen-source-ios.patch | 17 --
cpython-unix/targets.yml | 280 ------------------
cpython-windows/build.py | 3 +-
docs/building.rst | 2 +-
docs/quirks.rst | 4 +-
docs/status.rst | 11 +-
pythonbuild/buildenv.py | 4 +-
pythonbuild/downloads.py | 9 -
pythonbuild/utils.py | 10 +-
src/github.rs | 2 +-
src/release.rs | 16 +-
src/validation.rs | 121 +-------
26 files changed, 54 insertions(+), 925 deletions(-)
delete mode 100644 cpython-unix/patch-decimal-modern-mpdecimal.patch
delete mode 100644 cpython-unix/patch-python-configure-add-enable-static-libpython-for-interpreter-3.9.patch
delete mode 100644 cpython-unix/patch-python-link-modules-3.9.patch
delete mode 100644 cpython-unix/patch-readline-libedit.patch
delete mode 100644 cpython-unix/patch-tkinter-3.9.patch
delete mode 100644 cpython-unix/patch-xopen-source-ios-legacy.patch
delete mode 100644 cpython-unix/patch-xopen-source-ios.patch
diff --git a/ci-matrix.py b/ci-matrix.py
index 91cfa953b..38d154fcd 100644
--- a/ci-matrix.py
+++ b/ci-matrix.py
@@ -9,7 +9,7 @@
import argparse
import json
import sys
-from typing import Any, Optional
+from typing import Any
import yaml
from packaging.version import Version
@@ -39,7 +39,7 @@ def meets_conditional_version(version: str, min_version: str) -> bool:
return Version(version) >= Version(min_version)
-def parse_labels(labels: Optional[str]) -> dict[str, set[str]]:
+def parse_labels(labels: str | None) -> dict[str, set[str]]:
"""Parse labels into a dict of category filters."""
if not labels:
return {}
@@ -106,7 +106,7 @@ def should_include_entry(entry: dict[str, str], filters: dict[str, set[str]]) ->
def generate_docker_matrix_entries(
runners: dict[str, Any],
- platform_filter: Optional[str] = None,
+ platform_filter: str | None = None,
) -> list[dict[str, str]]:
"""Generate matrix entries for docker image builds."""
if platform_filter and platform_filter != "linux":
@@ -132,7 +132,7 @@ def generate_crate_build_matrix_entries(
runners: dict[str, Any],
config: dict[str, Any],
force_crate_build: bool = False,
- platform_filter: Optional[str] = None,
+ platform_filter: str | None = None,
) -> list[dict[str, str]]:
"""Generate matrix entries for crate builds based on python build matrix."""
needed_builds = set()
@@ -181,8 +181,8 @@ def generate_crate_build_matrix_entries(
def generate_python_build_matrix_entries(
config: dict[str, Any],
runners: dict[str, Any],
- platform_filter: Optional[str] = None,
- label_filters: Optional[dict[str, set[str]]] = None,
+ platform_filter: str | None = None,
+ label_filters: dict[str, set[str]] | None = None,
) -> list[dict[str, str]]:
"""Generate matrix entries for python builds."""
matrix_entries = []
@@ -348,10 +348,10 @@ def main() -> None:
args = parse_args()
labels = parse_labels(args.labels)
- with open(CI_TARGETS_YAML, "r") as f:
+ with open(CI_TARGETS_YAML) as f:
config = yaml.safe_load(f)
- with open(CI_RUNNERS_YAML, "r") as f:
+ with open(CI_RUNNERS_YAML) as f:
runners = yaml.safe_load(f)
# If only free runners are allowed, reduce to a subset
diff --git a/ci-targets.yaml b/ci-targets.yaml
index 10a13206a..fa3eb0357 100644
--- a/ci-targets.yaml
+++ b/ci-targets.yaml
@@ -4,7 +4,6 @@ darwin:
aarch64-apple-darwin:
arch: aarch64
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -23,7 +22,6 @@ darwin:
x86_64-apple-darwin:
arch: x86_64
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -44,7 +42,6 @@ linux:
arch: aarch64
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -64,7 +61,6 @@ linux:
arch: armv7
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -86,7 +82,6 @@ linux:
arch: armv7
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -108,7 +103,6 @@ linux:
arch: s390x
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -130,7 +124,6 @@ linux:
arch: ppc64le
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -152,7 +145,6 @@ linux:
arch: riscv64
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -174,7 +166,6 @@ linux:
arch: x86_64
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -196,7 +187,6 @@ linux:
arch_variant: v2
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -218,7 +208,6 @@ linux:
arch_variant: v3
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -240,7 +229,6 @@ linux:
arch_variant: v4
libc: gnu
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -261,7 +249,6 @@ linux:
arch: x86_64
libc: musl
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -288,7 +275,6 @@ linux:
arch_variant: v2
libc: musl
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -315,7 +301,6 @@ linux:
arch_variant: v3
libc: musl
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -342,7 +327,6 @@ linux:
arch_variant: v4
libc: musl
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -368,7 +352,6 @@ linux:
arch: aarch64
libc: musl
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -396,7 +379,6 @@ windows:
arch: x86
vcvars: vcvars32.bat
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -414,7 +396,6 @@ windows:
arch: x86_64
vcvars: vcvars64.bat
python_versions:
- - "3.9"
- "3.10"
- "3.11"
- "3.12"
@@ -432,8 +413,7 @@ windows:
arch: aarch64
vcvars: vcvarsamd64_arm64.bat
python_versions:
- # On 3.9 / 3.10, `_tkinter` is failing to be included in the build
- # - "3.9"
+ # On 3.10, `_tkinter` is failing to be included in the build
# - "3.10"
- "3.11"
- "3.12"
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
index b4618d22f..b6e772c72 100644
--- a/cpython-unix/Makefile
+++ b/cpython-unix/Makefile
@@ -6,7 +6,7 @@ BUILD := $(HERE)/build.py
NULL :=
SPACE := $(subst ,, )
-ALL_PYTHON_VERSIONS := 3.9 3.10 3.11 3.12 3.13 3.14 3.15
+ALL_PYTHON_VERSIONS := 3.10 3.11 3.12 3.13 3.14 3.15
ifndef PYBUILD_TARGET_TRIPLE
$(error PYBUILD_TARGET_TRIPLE not defined)
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index e58f5eff7..9c65394e5 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -72,7 +72,7 @@ fi
# configure doesn't support cross-compiling on LoongArch. Teach it.
if [ "${PYBUILD_PLATFORM}" != "macos" ]; then
case "${PYTHON_MAJMIN_VERSION}" in
- 3.9|3.10|3.11)
+ 3.10|3.11)
patch -p1 -i ${ROOT}/patch-configure-add-loongarch-triplet.patch
;;
esac
@@ -85,13 +85,6 @@ if [ -n "${CROSS_COMPILING}" ]; then
fi
fi
-# This patch is slightly different on Python 3.10+.
-if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_10}" ]; then
- patch -p1 -i ${ROOT}/patch-xopen-source-ios.patch
-else
- patch -p1 -i ${ROOT}/patch-xopen-source-ios-legacy.patch
-fi
-
# LIBTOOL_CRUFT is unused and breaks cross-compiling on macOS. Nuke it.
# Submitted upstream at https://github.com/python/cpython/pull/101048.
if [ -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_11}" ]; then
@@ -175,9 +168,7 @@ fi
# executable. This behavior is kinda suspect on all platforms, as it could be adding
# library dependencies that shouldn't need to be there.
if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
- if [ "${PYTHON_MAJMIN_VERSION}" = "3.9" ]; then
- patch -p1 -i ${ROOT}/patch-python-link-modules-3.9.patch
- elif [ "${PYTHON_MAJMIN_VERSION}" = "3.10" ]; then
+ if [ "${PYTHON_MAJMIN_VERSION}" = "3.10" ]; then
patch -p1 -i ${ROOT}/patch-python-link-modules-3.10.patch
else
patch -p1 -i ${ROOT}/patch-python-link-modules-3.11.patch
@@ -205,8 +196,6 @@ elif [ "${PYTHON_MAJMIN_VERSION}" = "3.11" ]; then
patch -p1 -i ${ROOT}/patch-tkinter-3.11.patch
elif [ "${PYTHON_MAJMIN_VERSION}" = "3.10" ]; then
patch -p1 -i ${ROOT}/patch-tkinter-3.10.patch
-else
- patch -p1 -i ${ROOT}/patch-tkinter-3.9.patch
fi
# Code that runs at ctypes module import time does not work with
@@ -214,34 +203,12 @@ fi
# See https://bugs.python.org/issue37060.
patch -p1 -i ${ROOT}/patch-ctypes-static-binary.patch
-# Older versions of Python need patching to work with modern mpdecimal.
-if [ -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_9}" ]; then
- patch -p1 -i ${ROOT}/patch-decimal-modern-mpdecimal.patch
-fi
-
# We build against libedit instead of readline in all environments.
#
# On macOS, we use the system/SDK libedit, which is likely somewhat old.
#
# On Linux, we use our own libedit, which should be modern.
#
-# CPython 3.10 added proper support for building against libedit outside of
-# macOS. On older versions, we need to hack up readline.c to build against
-# libedit. This patch breaks older libedit (as seen on macOS) so don't apply
-# on macOS.
-if [[ -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_9}" && "${PYBUILD_PLATFORM}" != macos* ]]; then
- # readline.c assumes that a modern readline API version has a free_history_entry().
- # but libedit does not. Change the #ifdef accordingly.
- #
- # Similarly, we invoke configure using readline, which sets
- # HAVE_RL_COMPLETION_SUPPRESS_APPEND improperly. So hack that. This is a bug
- # in our build system, as we should probably be invoking configure again when
- # using libedit.
- #
- # Similar workaround for on_completion_display_matches_hook.
- patch -p1 -i ${ROOT}/patch-readline-libedit.patch
-fi
-
if [ "${PYTHON_MAJMIN_VERSION}" = "3.10" ]; then
# Even though 3.10 is libedit aware, it isn't compatible with newer
# versions of libedit. We need to backport a 3.11 patch to teach the
@@ -367,11 +334,8 @@ fi
# Always build against libedit instead of the default of readline.
# macOS always uses the system libedit, so no tweaks are needed.
if [[ "${PYBUILD_PLATFORM}" != macos* ]]; then
- # CPython 3.10 introduced proper configure support for libedit, so add configure
- # flag there.
- if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_10}" ]; then
- EXTRA_CONFIGURE_FLAGS="${EXTRA_CONFIGURE_FLAGS} --with-readline=editline"
- fi
+ # Add configure flag for proper configure support for libedit.
+ EXTRA_CONFIGURE_FLAGS="${EXTRA_CONFIGURE_FLAGS} --with-readline=editline"
fi
# On Python 3.14+, enable the tail calling interpreter which is more performant.
@@ -546,25 +510,6 @@ if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
# as Homebrew or MacPorts. So nerf the check to prevent this.
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_lib_intl_textdomain=no"
- # CPython 3.9+ have proper support for weakly referenced symbols and
- # runtime availability guards. CPython 3.8 will emit weak symbol references
- # (this happens automatically when linking due to SDK version targeting).
- # However CPython lacks the runtime availability guards for most symbols.
- # This results in runtime failures when attempting to resolve/call the
- # symbol.
- if [ -n "${PYTHON_MEETS_MAXIMUM_VERSION_3_9}" ]; then
- if [ "${TARGET_TRIPLE}" != "aarch64-apple-darwin" ]; then
- for symbol in clock_getres clock_gettime clock_settime faccessat fchmodat fchownat fdopendir fstatat futimens getentropy linkat mkdirat openat preadv pwritev readlinkat renameat symlinkat unlinkat utimensat uttype; do
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_${symbol}=no"
- done
- fi
-
- # mkfifoat, mknodat introduced in SDK 13.0.
- for symbol in mkfifoat mknodat; do
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_${symbol}=no"
- done
- fi
-
if [ -n "${CROSS_COMPILING}" ]; then
# Python's configure doesn't support cross-compiling on macOS. So we need
# to explicitly set MACHDEP to avoid busted checks. The code for setting
@@ -574,26 +519,10 @@ if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} MACHDEP=darwin"
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_sys_system=Darwin"
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_sys_release=$(uname -r)"
- elif [ "${TARGET_TRIPLE}" = "aarch64-apple-ios" ]; then
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} MACHDEP=iOS"
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_sys_system=iOS"
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_sys_release="
- # clock_settime() not available on iOS.
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_clock_settime=no"
- # getentropy() not available on iOS.
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_getentropy=no"
elif [ "${TARGET_TRIPLE}" = "x86_64-apple-darwin" ]; then
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} MACHDEP=darwin"
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_sys_system=Darwin"
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_sys_release=$(uname -r)"
- elif [ "${TARGET_TRIPLE}" = "x86_64-apple-ios" ]; then
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} MACHDEP=iOS"
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_sys_system=iOS"
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_sys_release="
- # clock_settime() not available on iOS.
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_clock_settime=no"
- # getentropy() not available on iOS.
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_func_getentropy=no"
else
echo "unsupported target triple: ${TARGET_TRIPLE}"
exit 1
diff --git a/cpython-unix/build-main.py b/cpython-unix/build-main.py
index 366ec8cfa..866f0b9be 100755
--- a/cpython-unix/build-main.py
+++ b/cpython-unix/build-main.py
@@ -55,7 +55,6 @@ def main():
parser.add_argument(
"--python",
choices={
- "cpython-3.9",
"cpython-3.10",
"cpython-3.11",
"cpython-3.12",
diff --git a/cpython-unix/build-sqlite.sh b/cpython-unix/build-sqlite.sh
index 1d727c9a2..d39c6bdad 100755
--- a/cpython-unix/build-sqlite.sh
+++ b/cpython-unix/build-sqlite.sh
@@ -16,12 +16,6 @@ pushd sqlite-autoconf-${SQLITE_VERSION}
CONFIGURE_FLAGS="--build=${BUILD_TRIPLE} --host=${TARGET_TRIPLE}"
CONFIGURE_FLAGS="${CONFIGURE_FLAGS} --prefix=/tools/deps --disable-shared"
-if [ "${TARGET_TRIPLE}" = "aarch64-apple-ios" ]; then
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_search_system=no"
-elif [ "${TARGET_TRIPLE}" = "x86_64-apple-ios" ]; then
- CONFIGURE_FLAGS="${CONFIGURE_FLAGS} ac_cv_search_system=no"
-fi
-
# The SQLite autosetup looks for the C++ compiler if the variable is set and will fail if it's not
# found, even if it's not needed. We don't actually have a C++ compiler in some builds, so ensure
# it's not looked for.
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index 23d946024..6fd2fe752 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -444,7 +444,7 @@ def build_cpython_host(
# Set environment variables allowing convenient testing for Python
# version ranges.
- for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "3.15"):
+ for v in ("3.10", "3.11", "3.12", "3.13", "3.14", "3.15"):
normal_version = v.replace(".", "_")
if meets_python_minimum_version(python_version, v):
@@ -483,11 +483,7 @@ def python_build_info(
arch = platform.removeprefix("linux_")
bi["core"]["static_lib"] = (
- "install/lib/python{version}/config-{version}{binary_suffix}-{arch}-linux-gnu/libpython{version}{binary_suffix}.a".format(
- version=version,
- binary_suffix=binary_suffix,
- arch=arch,
- )
+ f"install/lib/python{version}/config-{version}{binary_suffix}-{arch}-linux-gnu/libpython{version}{binary_suffix}.a"
)
if not static:
@@ -508,9 +504,7 @@ def python_build_info(
object_file_format = "elf"
elif platform.startswith("macos_"):
bi["core"]["static_lib"] = (
- "install/lib/python{version}/config-{version}{binary_suffix}-darwin/libpython{version}{binary_suffix}.a".format(
- version=version, binary_suffix=binary_suffix
- )
+ f"install/lib/python{version}/config-{version}{binary_suffix}-darwin/libpython{version}{binary_suffix}.a"
)
bi["core"]["shared_lib"] = "install/lib/libpython%s%s.dylib" % (
version,
@@ -761,7 +755,7 @@ def build_cpython(
static="static" in build_options,
)
- packages = target_needs(TARGETS_CONFIG, target_triple, python_version)
+ packages = target_needs(TARGETS_CONFIG, target_triple)
# Toolchain packages are handled specially.
packages.discard("binutils")
packages.discard("musl")
@@ -817,7 +811,7 @@ def build_cpython(
# Set environment variables allowing convenient testing for Python
# version ranges.
- for v in ("3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "3.15"):
+ for v in ("3.10", "3.11", "3.12", "3.13", "3.14", "3.15"):
normal_version = v.replace(".", "_")
if meets_python_minimum_version(python_version, v):
@@ -1272,7 +1266,6 @@ def main():
)
elif action in (
- "cpython-3.9",
"cpython-3.10",
"cpython-3.11",
"cpython-3.12",
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index 445f52a82..c9e5df9c2 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -152,11 +152,6 @@ _ctypes_test:
- m
_curses:
- # ncurses not available on iOS.
- disabled-targets:
- - .*-apple-ios
- - .*-apple-tvos
- - .*-apple-watchos
sources:
- _cursesmodule.c
defines:
@@ -178,11 +173,6 @@ _curses:
- .*-apple-darwin
_curses_panel:
- # ncurses not available on iOS.
- disabled-targets:
- - .*-apple-ios
- - .*-apple-tvos
- - .*-apple-watchos
sources:
- _curses_panel.c
defines:
@@ -407,11 +397,6 @@ _opcode:
_operator:
setup-enabled: true
-_peg_parser:
- minimum-python-version: "3.9"
- maximum-python-version: "3.9"
- setup-enabled: true
-
_pickle:
sources:
- _pickle.c
@@ -448,7 +433,6 @@ _scproxy:
# _scproxy is Apple OS only.
# APIs required by _scproxy not available on iOS.
disabled-targets:
- - .*-apple-ios
- .*-unknown-linux-.*
sources:
- _scproxy.c
@@ -537,7 +521,7 @@ _sqlite3:
includes:
- Modules/_sqlite
defines-conditional:
- # Require dynamic binaries to load extensions. Cannot load on iOS.
+ # Require dynamic binaries to load extensions.
# 3.11+ uses opt in. <3.11 uses opt out.
- define: PY_SQLITE_ENABLE_LOAD_EXTENSION=1
targets:
@@ -546,11 +530,6 @@ _sqlite3:
# linked. But this would break verification code. So enabled for
# backwards compatibility.
- .*-unknown-linux-.*
- - define: SQLITE_OMIT_LOAD_EXTENSION=1
- targets:
- - .*-ios
- - define: "MODULE_NAME=\\\"sqlite3\\\""
- maximum-python-version: "3.9"
links:
- sqlite3
@@ -608,7 +587,7 @@ _sysconfig:
- _sysconfig.c
_testbuffer:
- minimum-python-version: '3.9'
+ minimum-python-version: '3.10'
sources:
- _testbuffer.c
@@ -628,7 +607,7 @@ _testexternalinspection:
- _testexternalinspection.c
_testimportmultiple:
- minimum-python-version: '3.9'
+ minimum-python-version: '3.10'
sources:
- _testimportmultiple.c
@@ -656,7 +635,7 @@ _testinternalcapi:
minimum-python-version: "3.14"
_testmultiphase:
- minimum-python-version: '3.9'
+ minimum-python-version: '3.10'
sources:
- _testmultiphase.c
@@ -671,9 +650,6 @@ _thread:
- .*
_tkinter:
- # tk not available on iOS.
- disabled-targets:
- - .*-apple-ios
sources:
- _tkinter.c
- tkappinit.c
@@ -749,13 +725,13 @@ _xxinterpchannels:
- _xxinterpchannelsmodule.c
_xxsubinterpreters:
- minimum-python-version: '3.9'
+ minimum-python-version: '3.10'
maximum-python-version: '3.12'
sources:
- _xxsubinterpretersmodule.c
_xxtestfuzz:
- minimum-python-version: '3.9'
+ minimum-python-version: '3.10'
sources:
- _xxtestfuzz/_xxtestfuzz.c
- _xxtestfuzz/fuzzer.c
@@ -771,7 +747,7 @@ _zstd:
- zstd
_zoneinfo:
- minimum-python-version: "3.9"
+ minimum-python-version: "3.10"
sources:
- _zoneinfo.c
@@ -877,11 +853,6 @@ ossaudiodev:
sources:
- ossaudiodev.c
-parser:
- maximum-python-version: "3.9"
- sources:
- - parsermodule.c
-
posix:
setup-enabled: true
required-targets:
@@ -898,10 +869,6 @@ pyexpat:
- expat
readline:
- disabled-targets:
- - .*-apple-ios
- - .*-apple-tvos
- - .*-apple-watchos
sources:
- readline.c
defines:
diff --git a/cpython-unix/patch-decimal-modern-mpdecimal.patch b/cpython-unix/patch-decimal-modern-mpdecimal.patch
deleted file mode 100644
index 87eaa6293..000000000
--- a/cpython-unix/patch-decimal-modern-mpdecimal.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/Modules/_decimal/_decimal.c b/Modules/_decimal/_decimal.c
-index 83e237d02b..9a4329f494 100644
---- a/Modules/_decimal/_decimal.c
-+++ b/Modules/_decimal/_decimal.c
-@@ -3293,7 +3293,7 @@ dec_format(PyObject *dec, PyObject *args)
- }
- else {
- size_t n = strlen(spec.dot);
-- if (n > 1 || (n == 1 && !isascii((uchar)spec.dot[0]))) {
-+ if (n > 1 || (n == 1 && !isascii((unsigned char)spec.dot[0]))) {
- /* fix locale dependent non-ascii characters */
- dot = dotsep_as_utf8(spec.dot);
- if (dot == NULL) {
-@@ -3302,7 +3302,7 @@ dec_format(PyObject *dec, PyObject *args)
- spec.dot = PyBytes_AS_STRING(dot);
- }
- n = strlen(spec.sep);
-- if (n > 1 || (n == 1 && !isascii((uchar)spec.sep[0]))) {
-+ if (n > 1 || (n == 1 && !isascii((unsigned char)spec.sep[0]))) {
- /* fix locale dependent non-ascii characters */
- sep = dotsep_as_utf8(spec.sep);
- if (sep == NULL) {
diff --git a/cpython-unix/patch-python-configure-add-enable-static-libpython-for-interpreter-3.9.patch b/cpython-unix/patch-python-configure-add-enable-static-libpython-for-interpreter-3.9.patch
deleted file mode 100644
index d2c0a45c8..000000000
--- a/cpython-unix/patch-python-configure-add-enable-static-libpython-for-interpreter-3.9.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 5ae9112a87d45c3aff5ee269ff8e2e49ca278ed3 Mon Sep 17 00:00:00 2001
-From: Geoffrey Thomas
-Date: Sat, 19 Apr 2025 11:13:40 -0400
-Subject: [PATCH 1/1] configure: add --enable-static-libpython-for-interpreter
-
-This option changes the behavior of --enable-shared to continue to build
-the libpython3.x.so shared library, but not use it for linking the
-python3 interpreter executable. Instead, the executable is linked
-directly against the libpython .o files as it would be with
---disable-shared [in newer versions of Python].
-
-There are two benefits of this change. First, libpython uses
-thread-local storage, which is noticeably slower when used in a loaded
-module instead of in the main program, because the main program can take
-advantage of constant offsets from the thread state pointer but loaded
-modules have to dynamically call a function __tls_get_addr() to
-potentially allocate their thread-local storage area. (There is another
-thread-local storage model for dynamic libraries which mitigates most of
-this performance hit, but it comes at the cost of preventing
-dlopen("libpython3.x.so"), which is a use case we want to preserve.)
-
-Second, this improves the user experience around relocatable Python a
-little bit, in that we don't need to use an $ORIGIN-relative path to
-locate libpython3.x.so, which has some mild benefits around musl (which
-does not support $ORIGIN-relative DT_NEEDED, only $ORIGIN-relative
-DT_RPATH/DT_RUNPATH), users who want to make the interpreter setuid or
-setcap (which prevents processing $ORIGIN), etc.
----
- Makefile.pre.in | 4 +++-
- configure.ac | 18 ++++++++++++++++++
- 2 files changed, 21 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile.pre.in b/Makefile.pre.in
-index a276d535c7f..193439aa73e 100644
---- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -460,6 +460,8 @@ LIBRARY_OBJS= \
- $(LIBRARY_OBJS_OMIT_FROZEN) \
- Python/frozen.o
-
-+LINK_PYTHON_OBJS=@LINK_PYTHON_OBJS@
-+
- ##########################################################################
- # DTrace
-
-@@ -589,7 +591,7 @@ clinic: check-clean-src $(srcdir)/Modules/_blake2/blake2s_impl.c
-
- # Build the interpreter
- $(BUILDPYTHON): Programs/python.o $(LIBRARY) $(LDLIBRARY) $(PY3LIBRARY) $(EXPORTSYMS)
-- $(LINKCC) $(PY_CORE_LDFLAGS) $(LINKFORSHARED) -o $@ Programs/python.o $(BLDLIBRARY) $(LIBS) $(MODLIBS) $(SYSLIBS)
-+ $(LINKCC) $(PY_CORE_LDFLAGS) $(LINKFORSHARED) -o $@ Programs/python.o $(LINK_PYTHON_OBJS) $(LIBS) $(MODLIBS) $(SYSLIBS)
-
- platform: $(BUILDPYTHON) pybuilddir.txt
- $(RUNSHARED) $(PYTHON_FOR_BUILD) -c 'import sys ; from sysconfig import get_platform ; print("%s-%d.%d" % (get_platform(), *sys.version_info[:2]))' >platform
-diff --git a/configure.ac b/configure.ac
-index aa515da4655..122b11def62 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1106,6 +1106,17 @@ then
- fi
- AC_MSG_RESULT($enable_shared)
-
-+AC_MSG_CHECKING([for --enable-static-libpython-for-interpreter])
-+AC_ARG_ENABLE([static-libpython-for-interpreter],
-+ AS_HELP_STRING([--enable-static-libpython-for-interpreter],
-+ [even with --enable-shared, statically link libpython into the interpreter (default is to use the shared library)]))
-+
-+if test -z "$enable_static_libpython_for_interpreter"
-+then
-+ enable_static_libpython_for_interpreter="no"
-+fi
-+AC_MSG_RESULT([$enable_static_libpython_for_interpreter])
-+
- AC_MSG_CHECKING(for --enable-profiling)
- AC_ARG_ENABLE(profiling,
- AS_HELP_STRING([--enable-profiling], [enable C-level code profiling with gprof (default is no)]))
-@@ -1211,6 +1222,13 @@ fi
-
- AC_MSG_RESULT($LDLIBRARY)
-
-+if test "$enable_static_libpython_for_interpreter" = "yes"; then
-+ LINK_PYTHON_OBJS='$(LIBRARY_OBJS)'
-+else
-+ LINK_PYTHON_OBJS='$(BLDLIBRARY)'
-+fi
-+AC_SUBST(LINK_PYTHON_OBJS)
-+
- AC_SUBST(AR)
- AC_CHECK_TOOLS(AR, ar aal, ar)
-
---
-2.39.5 (Apple Git-154)
-
diff --git a/cpython-unix/patch-python-link-modules-3.9.patch b/cpython-unix/patch-python-link-modules-3.9.patch
deleted file mode 100644
index 772cacced..000000000
--- a/cpython-unix/patch-python-link-modules-3.9.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/Makefile.pre.in b/Makefile.pre.in
---- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -563,7 +563,7 @@ clinic: check-clean-src $(srcdir)/Modules/_blake2/blake2s_impl.c
-
- # Build the interpreter
- $(BUILDPYTHON): Programs/python.o $(LIBRARY) $(LDLIBRARY) $(PY3LIBRARY) $(EXPORTSYMS)
-- $(LINKCC) $(PY_CORE_LDFLAGS) $(LINKFORSHARED) -o $@ Programs/python.o $(BLDLIBRARY) $(LIBS) $(MODLIBS) $(SYSLIBS)
-+ $(LINKCC) $(PY_CORE_LDFLAGS) $(LINKFORSHARED) -o $@ Programs/python.o $(BLDLIBRARY) $(LIBS) $(SYSLIBS)
-
- platform: $(BUILDPYTHON) pybuilddir.txt
- $(RUNSHARED) $(PYTHON_FOR_BUILD) -c 'import sys ; from sysconfig import get_platform ; print("%s-%d.%d" % (get_platform(), *sys.version_info[:2]))' >platform
diff --git a/cpython-unix/patch-readline-libedit.patch b/cpython-unix/patch-readline-libedit.patch
deleted file mode 100644
index 534f9a456..000000000
--- a/cpython-unix/patch-readline-libedit.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-diff --git a/Modules/readline.c b/Modules/readline.c
-index 1e74f997b07..0c982857283 100644
---- a/Modules/readline.c
-+++ b/Modules/readline.c
-@@ -35,7 +35,7 @@
- #define completion_matches(x, y) \
- rl_completion_matches((x), ((rl_compentry_func_t *)(y)))
- #else
--#if defined(_RL_FUNCTION_TYPEDEF)
-+#ifdef USE_LIBEDIT
- extern char **completion_matches(char *, rl_compentry_func_t *);
- #else
-
-@@ -390,7 +390,7 @@ set_completion_display_matches_hook(PyObject *self, PyObject *args)
- default completion display. */
- rl_completion_display_matches_hook =
- readlinestate_global->completion_display_matches_hook ?
--#if defined(_RL_FUNCTION_TYPEDEF)
-+#ifdef USE_LIBEDIT
- (rl_compdisp_func_t *)on_completion_display_matches_hook : 0;
- #else
- (VFunction *)on_completion_display_matches_hook : 0;
-@@ -511,7 +511,7 @@ set the word delimiters for completion");
-
- /* _py_free_history_entry: Utility function to free a history entry. */
-
--#if defined(RL_READLINE_VERSION) && RL_READLINE_VERSION >= 0x0500
-+#ifndef USE_LIBEDIT
-
- /* Readline version >= 5.0 introduced a timestamp field into the history entry
- structure; this needs to be freed to avoid a memory leak. This version of
-@@ -1055,7 +1055,7 @@ flex_complete(const char *text, int start, int end)
- #ifdef HAVE_RL_COMPLETION_APPEND_CHARACTER
- rl_completion_append_character ='\0';
- #endif
--#ifdef HAVE_RL_COMPLETION_SUPPRESS_APPEND
-+#ifndef USE_LIBEDIT
- rl_completion_suppress_append = 0;
- #endif
-
-@@ -1241,7 +1241,7 @@ readline_until_enter_or_signal(const char *prompt, int *signal)
- PyEval_SaveThread();
- if (s < 0) {
- rl_free_line_state();
--#if defined(RL_READLINE_VERSION) && RL_READLINE_VERSION >= 0x0700
-+#ifndef USE_LIBEDIT
- rl_callback_sigcleanup();
- #endif
- rl_cleanup_after_signal();
diff --git a/cpython-unix/patch-tkinter-3.9.patch b/cpython-unix/patch-tkinter-3.9.patch
deleted file mode 100644
index 3e99eb38a..000000000
--- a/cpython-unix/patch-tkinter-3.9.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c
-index e153047b778..02f5d12db1a 100644
---- a/Modules/_tkinter.c
-+++ b/Modules/_tkinter.c
-@@ -115,6 +115,7 @@ Copyright (C) 1994 Steen Lumholt.
- #ifdef MS_WINDOWS
- #include
- #define WAIT_FOR_STDIN
-+#endif
-
- static PyObject *
- _get_tcl_lib_path()
-@@ -132,6 +133,7 @@ _get_tcl_lib_path()
- return NULL;
- }
-
-+#ifdef MS_WINDOWS
- /* Check expected location for an installed Python first */
- tcl_library_path = PyUnicode_FromString("\\tcl\\tcl" TCL_VERSION);
- if (tcl_library_path == NULL) {
-@@ -169,11 +171,31 @@ _get_tcl_lib_path()
- tcl_library_path = NULL;
- #endif
- }
-+#else
-+ /* Check expected location for an installed Python first */
-+ tcl_library_path = PyUnicode_FromString("/lib/tcl" TCL_VERSION);
-+ if (tcl_library_path == NULL) {
-+ return NULL;
-+ }
-+ tcl_library_path = PyUnicode_Concat(prefix, tcl_library_path);
-+ if (tcl_library_path == NULL) {
-+ return NULL;
-+ }
-+ stat_return_value = _Py_stat(tcl_library_path, &stat_buf);
-+ if (stat_return_value == -2) {
-+ return NULL;
-+ }
-+ if (stat_return_value == -1) {
-+ /* install location doesn't exist, reset errno and leave Tcl
-+ to its own devices */
-+ errno = 0;
-+ tcl_library_path = NULL;
-+ }
-+#endif
- already_checked = 1;
- }
- return tcl_library_path;
- }
--#endif /* MS_WINDOWS */
-
- /* The threading situation is complicated. Tcl is not thread-safe, except
- when configured with --enable-threads.
-@@ -822,6 +844,30 @@ Tkapp_New(const char *screenName, const char *className,
-
- ret = GetEnvironmentVariableW(L"TCL_LIBRARY", NULL, 0);
- if (!ret && GetLastError() == ERROR_ENVVAR_NOT_FOUND) {
-+ str_path = _get_tcl_lib_path();
-+ if (str_path == NULL && PyErr_Occurred()) {
-+ return NULL;
-+ }
-+ if (str_path != NULL) {
-+ utf8_path = PyUnicode_AsUTF8String(str_path);
-+ if (utf8_path == NULL) {
-+ return NULL;
-+ }
-+ Tcl_SetVar(v->interp,
-+ "tcl_library",
-+ PyBytes_AS_STRING(utf8_path),
-+ TCL_GLOBAL_ONLY);
-+ Py_DECREF(utf8_path);
-+ }
-+ }
-+ }
-+#else
-+ {
-+ const char *env_val = getenv("TCL_LIBRARY");
-+ if (!env_val) {
-+ PyObject *str_path;
-+ PyObject *utf8_path;
-+
- str_path = _get_tcl_lib_path();
- if (str_path == NULL && PyErr_Occurred()) {
- return NULL;
-@@ -3631,7 +3677,32 @@ PyInit__tkinter(void)
- PyMem_Free(wcs_path);
- }
- #else
-+ int set_var = 0;
-+ PyObject *str_path;
-+ char *path;
-+
-+ if (!getenv("TCL_LIBRARY")) {
-+ str_path = _get_tcl_lib_path();
-+ if (str_path == NULL && PyErr_Occurred()) {
-+ Py_DECREF(m);
-+ return NULL;
-+ }
-+ if (str_path != NULL) {
-+ path = PyUnicode_AsUTF8(str_path);
-+ if (path == NULL) {
-+ Py_DECREF(m);
-+ return NULL;
-+ }
-+ setenv("TCL_LIBRARY", path, 1);
-+ set_var = 1;
-+ }
-+ }
-+
- Tcl_FindExecutable(PyBytes_AS_STRING(cexe));
-+
-+ if (set_var) {
-+ unsetenv("TCL_LIBRARY");
-+ }
- #endif /* MS_WINDOWS */
- }
- Py_XDECREF(cexe);
diff --git a/cpython-unix/patch-xopen-source-ios-legacy.patch b/cpython-unix/patch-xopen-source-ios-legacy.patch
deleted file mode 100644
index 00484f1f0..000000000
--- a/cpython-unix/patch-xopen-source-ios-legacy.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index aa515da465..2feb013926 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -521,6 +521,12 @@ case $ac_sys_system/$ac_sys_release in
- define_xopen_source=no;;
- Darwin/@<:@[12]@:>@@<:@0-9@:>@.*)
- define_xopen_source=no;;
-+ iOS/*)
-+ define_xopen_source=no;;
-+ tvOS/*)
-+ define_xopen_source=no;;
-+ watchOS/*)
-+ define_xopen_source=no;;
- # On AIX 4 and 5.1, mbstate_t is defined only when _XOPEN_SOURCE == 500 but
- # used in wcsnrtombs() and mbsnrtowcs() even if _XOPEN_SOURCE is not defined
- # or has another value. By not (re)defining it, the defaults come in place.
diff --git a/cpython-unix/patch-xopen-source-ios.patch b/cpython-unix/patch-xopen-source-ios.patch
deleted file mode 100644
index e59ca5f30..000000000
--- a/cpython-unix/patch-xopen-source-ios.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index cc69015b10..e7fde9c027 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -521,6 +521,12 @@ case $ac_sys_system/$ac_sys_release in
- define_xopen_source=no;;
- Darwin/@<:@[12]@:>@@<:@0-9@:>@.*)
- define_xopen_source=no;;
-+ iOS/*)
-+ define_xopen_source=no;;
-+ tvOS/*)
-+ define_xopen_source=no;;
-+ watchOS/*)
-+ define_xopen_source=no;;
- # On QNX 6.3.2, defining _XOPEN_SOURCE prevents netdb.h from
- # defining NI_NUMERICHOST.
- QNX/6.3.2)
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
index f700e705f..64b0d5ecd 100644
--- a/cpython-unix/targets.yml
+++ b/cpython-unix/targets.yml
@@ -64,7 +64,6 @@ aarch64-apple-darwin:
- macos_arm64
- macos_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -112,56 +111,11 @@ aarch64-apple-darwin:
- zstd
openssl_target: darwin64-arm64-cc
-aarch64-apple-ios:
- host_platforms:
- - macos_arm64
- - macos_x86_64
- pythons_supported:
- - '3.9'
- needs_toolchain: true
- apple_sdk_platform: iphoneos
- host_cc: clang
- host_cxx: clang++
- target_cc: clang
- target_cxx: clang++
- target_cflags:
- - '-arch'
- - 'arm64'
- - '-mios-version-min=12.3'
- # Suppress extremely verbose warnings we see with LLVM 10.
- - '-Wno-nullability-completeness'
- - '-Wno-expansion-to-defined'
- # LLVM 11 contains commit https://reviews.llvm.org/D83250,
- # which enables -Werror for undef-prefix=TARGET_OS_.
- # However, the macOS SDK has headers that reference deprecated
- # TARGET_OS defines, like TARGET_OS_EMBEDDED. So LLVM 11 refuses
- # to work with the macOS SDKs out of the box. We work around
- # this by undoing the -Werror=undef-prefix in that commit.
- - '-Wno-undef-prefix'
- - '-fvisibility=hidden'
- target_ldflags:
- - '-arch'
- - 'arm64'
- - '-mios-version-min=12.3'
- needs:
- - autoconf
- - bzip2
- - expat
- - libffi
- - m4
- - mpdecimal
- - openssl-3.5
- - sqlite
- - xz
- - zstd
- openssl_target: ios64-cross
-
aarch64-unknown-linux-gnu:
host_platforms:
- linux_x86_64
- linux_aarch64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -209,54 +163,10 @@ aarch64-unknown-linux-gnu:
# See https://github.com/llvm/llvm-project/issues/146541
# bolt_capable: true
-arm64-apple-tvos:
- host_platforms:
- - macos_arm64
- - macos_x86_64
- pythons_supported:
- - '3.9'
- needs_toolchain: true
- apple_sdk_platform: appletvos
- host_cc: clang
- host_cxx: clang++
- target_cc: clang
- target_cxx: clang++
- target_cflags:
- - '-arch'
- - 'arm64'
- - '-mappletvos-version-min=12.3'
- # Suppress extremely verbose warnings we see with LLVM 10.
- - '-Wno-nullability-completeness'
- - '-Wno-expansion-to-defined'
- # LLVM 11 contains commit https://reviews.llvm.org/D83250,
- # which enables -Werror for undef-prefix=TARGET_OS_.
- # However, the macOS SDK has headers that reference deprecated
- # TARGET_OS defines, like TARGET_OS_EMBEDDED. So LLVM 11 refuses
- # to work with the macOS SDKs out of the box. We work around
- # this by undoing the -Werror=undef-prefix in that commit.
- - '-Wno-undef-prefix'
- - '-fvisibility=hidden'
- target_ldflags:
- - '-arch'
- - 'arm64'
- - '-mappletvos-version-min=12.3'
- needs:
- - autoconf
- - bzip2
- - expat
- - m4
- - mpdecimal
- - openssl-3.5
- - sqlite
- - xz
- - zstd
- openssl_target: todo
-
armv7-unknown-linux-gnueabi:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -298,7 +208,6 @@ armv7-unknown-linux-gnueabihf:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -340,7 +249,6 @@ loongarch64-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -381,7 +289,6 @@ mips-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -423,7 +330,6 @@ mipsel-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -465,7 +371,6 @@ ppc64le-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -507,7 +412,6 @@ riscv64-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -549,7 +453,6 @@ s390x-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -590,49 +493,6 @@ s390x-unknown-linux-gnu:
- zstd
openssl_target: linux64-s390x
-thumb7k-apple-watchos:
- host_platforms:
- - macos_arm64
- - macos_x86_64
- pythons_supported:
- - '3.9'
- needs_toolchain: true
- apple_sdk_platform: watchos
- host_cc: clang
- host_cxx: clang++
- target_cc: clang
- target_cxx: clang++
- target_cflags:
- - '-arch'
- - 'armv7k'
- - '-mwatchos-version-min-7.0'
- # Suppress extremely verbose warnings we see with LLVM 10.
- - '-Wno-nullability-completeness'
- - '-Wno-expansion-to-defined'
- # LLVM 11 contains commit https://reviews.llvm.org/D83250,
- # which enables -Werror for undef-prefix=TARGET_OS_.
- # However, the macOS SDK has headers that reference deprecated
- # TARGET_OS defines, like TARGET_OS_EMBEDDED. So LLVM 11 refuses
- # to work with the macOS SDKs out of the box. We work around
- # this by undoing the -Werror=undef-prefix in that commit.
- - '-Wno-undef-prefix'
- - '-fvisibility=hidden'
- target_ldflags:
- - '-arch'
- - 'armv7k'
- - '-mwatchos-version-min-7.0'
- needs:
- - autoconf
- - bzip2
- - expat
- - m4
- - mpdecimal
- - openssl-3.5
- - sqlite
- - xz
- - zstd
- openssl_target: todo
-
# Intel macOS.
#
# We target compatibility with macOS 10.15+ for compatibility with older Apple
@@ -642,7 +502,6 @@ x86_64-apple-darwin:
- macos_arm64
- macos_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -690,141 +549,10 @@ x86_64-apple-darwin:
- zstd
openssl_target: darwin64-x86_64-cc
-x86_64-apple-ios:
- host_platforms:
- - macos_arm64
- - macos_x86_64
- pythons_supported:
- - '3.9'
- needs_toolchain: true
- apple_sdk_platform: iphonesimulator
- host_cc: clang
- host_cxx: clang++
- target_cc: clang
- target_cxx: clang++
- target_cflags:
- - '-arch'
- - 'x86_64'
- - '-mios-simulator-version-min=12.3'
- # Suppress extremely verbose warnings we see with LLVM 10.
- - '-Wno-nullability-completeness'
- - '-Wno-expansion-to-defined'
- # LLVM 11 contains commit https://reviews.llvm.org/D83250,
- # which enables -Werror for undef-prefix=TARGET_OS_.
- # However, the macOS SDK has headers that reference deprecated
- # TARGET_OS defines, like TARGET_OS_EMBEDDED. So LLVM 11 refuses
- # to work with the macOS SDKs out of the box. We work around
- # this by undoing the -Werror=undef-prefix in that commit.
- - '-Wno-undef-prefix'
- - '-fvisibility=hidden'
- target_ldflags:
- - '-arch'
- - 'x86_64'
- - '-mios-simulator-version-min=12.3'
- needs:
- - autoconf
- - bzip2
- - expat
- - libffi
- - m4
- - mpdecimal
- - openssl-3.5
- - sqlite
- - xz
- - zstd
- openssl_target: darwin64-x86_64-cc
-
-x86_64-apple-tvos:
- host_platforms:
- - macos_arm64
- - macos_x86_64
- pythons_supported:
- - '3.9'
- needs_toolchain: true
- apple_sdk_platform: appletvsimulator
- host_cc: clang
- host_cxx: clang++
- target_cc: clang
- target_cxx: clang++
- target_cflags:
- - '-arch'
- - 'x86_64'
- - '-mappletvsimulator-version-min=12.3'
- # Suppress extremely verbose warnings we see with LLVM 10.
- - '-Wno-nullability-completeness'
- - '-Wno-expansion-to-defined'
- # LLVM 11 contains commit https://reviews.llvm.org/D83250,
- # which enables -Werror for undef-prefix=TARGET_OS_.
- # However, the macOS SDK has headers that reference deprecated
- # TARGET_OS defines, like TARGET_OS_EMBEDDED. So LLVM 11 refuses
- # to work with the macOS SDKs out of the box. We work around
- # this by undoing the -Werror=undef-prefix in that commit.
- - '-Wno-undef-prefix'
- - '-fvisibility=hidden'
- target_ldflags:
- - '-arch'
- - 'x86_64'
- - '-mappletvsimulator-version-min=12.3'
- needs:
- - autoconf
- - bzip2
- - expat
- - m4
- - mpdecimal
- - openssl-3.5
- - sqlite
- - xz
- - zstd
- openssl_target: todo
-
-x86_64-apple-watchos:
- host_platforms:
- - macos_arm64
- - macos_x86_64
- pythons_supported:
- - '3.9'
- needs_toolchain: true
- apple_sdk_platform: watchsimulator
- host_cc: clang
- host_cxx: clang++
- target_cc: clang
- target_cxx: clang++
- target_cflags:
- - '-arch'
- - 'x86_64'
- - '-mwatchsimulator-version-min=7.0'
- # Suppress extremely verbose warnings we see with LLVM 10.
- - '-Wno-nullability-completeness'
- - '-Wno-expansion-to-defined'
- # LLVM 11 contains commit https://reviews.llvm.org/D83250,
- # which enables -Werror for undef-prefix=TARGET_OS_.
- # However, the macOS SDK has headers that reference deprecated
- # TARGET_OS defines, like TARGET_OS_EMBEDDED. So LLVM 11 refuses
- # to work with the macOS SDKs out of the box. We work around
- # this by undoing the -Werror=undef-prefix in that commit.
- - '-Wno-undef-prefix'
- - '-fvisibility=hidden'
- target_ldflags:
- - '-arch'
- - 'x86_64'
- - '-mwatchsimulator-version-min=7.0'
- needs:
- - autoconf
- - bzip2
- - expat
- - m4
- - mpdecimal
- - openssl-3.5
- - sqlite
- - xz
- - zstd
- openssl_target: todo
-
x86_64-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -871,7 +599,6 @@ x86_64_v2-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -919,7 +646,6 @@ x86_64_v3-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -967,7 +693,6 @@ x86_64_v4-unknown-linux-gnu:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -1015,7 +740,6 @@ x86_64-unknown-linux-musl:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -1060,7 +784,6 @@ x86_64_v2-unknown-linux-musl:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -1106,7 +829,6 @@ x86_64_v3-unknown-linux-musl:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -1152,7 +874,6 @@ x86_64_v4-unknown-linux-musl:
host_platforms:
- linux_x86_64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
@@ -1199,7 +920,6 @@ aarch64-unknown-linux-musl:
- linux_x86_64
- linux_aarch64
pythons_supported:
- - '3.9'
- '3.10'
- '3.11'
- '3.12'
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index d02559e07..d113cbbed 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -1850,7 +1850,6 @@ def main() -> None:
parser.add_argument(
"--python",
choices={
- "cpython-3.9",
"cpython-3.10",
"cpython-3.11",
"cpython-3.12",
@@ -1902,7 +1901,7 @@ def main() -> None:
# CPython 3.11+ have native support for OpenSSL 3.x. We anticipate this
# will change in a future minor release once OpenSSL 1.1 goes out of support.
# But who knows.
- if args.python in ("cpython-3.9", "cpython-3.10"):
+ if args.python == "cpython-3.10":
openssl_entry = "openssl-1.1"
else:
openssl_entry = "openssl-3.5"
diff --git a/docs/building.rst b/docs/building.rst
index 4557072ae..410a6fb65 100644
--- a/docs/building.rst
+++ b/docs/building.rst
@@ -7,7 +7,7 @@ Building
Linux
=====
-The host system must be 64-bit. A Python 3.9+ interpreter must be
+The host system must be 64-bit. A Python 3.10+ interpreter must be
available. The execution environment must have access to a Docker
daemon (all build operations are performed in Docker containers for
isolation from the host system).
diff --git a/docs/quirks.rst b/docs/quirks.rst
index 84b2e1edc..1259f23ef 100644
--- a/docs/quirks.rst
+++ b/docs/quirks.rst
@@ -53,7 +53,7 @@ the *terminfo database* in an uncommon location, you can set the
For instance, you may need to do something like:
- $ TERMINFO_DIRS=/uncommon/place/terminfo install/bin/python3.9
+ $ TERMINFO_DIRS=/uncommon/place/terminfo install/bin/python3.10
If you are running on a relatively standard OS and this does not work
out of the box, please file a bug report so we can add the location of
@@ -106,7 +106,7 @@ about the ``python`` executable that pip uses.)
Linking Static Library on macOS
===============================
-Python 3.9+ makes use of the ``__builtin_available()`` compiler feature.
+Python 3.10+ makes use of the ``__builtin_available()`` compiler feature.
This functionality requires a symbol from ``libclang_rt``, which may not
be linked by default. Failure to link against ``libclang_rt`` could result
in a linker error due to an undefined symbol ``___isOSVersionAtLeast``.
diff --git a/docs/status.rst b/docs/status.rst
index cd50e078d..41f4de1db 100644
--- a/docs/status.rst
+++ b/docs/status.rst
@@ -5,7 +5,7 @@ Project Status
==============
There is support for producing CPython distributions for Windows,
-macOS, Linux, and iOS. All distributions are highly self-contained and have
+macOS, and Linux. All distributions are highly self-contained and have
limited shared library dependencies.
Planned and features include:
@@ -19,15 +19,6 @@ Planned and features include:
Target Notes
============
-Non-Darwin Apple Targets
-------------------------
-
-Apple targets that aren't Darwin/macOS (iOS, tvOS, watchOS, and corresponding
-simulators) are considered alpha quality. The builds may or may not work. The
-builds haven't been widely tested.
-
-Only Python 3.9 is currently supported.
-
Non-x86 Linux Targets
---------------------
diff --git a/pythonbuild/buildenv.py b/pythonbuild/buildenv.py
index 9266ad37e..a946813ed 100644
--- a/pythonbuild/buildenv.py
+++ b/pythonbuild/buildenv.py
@@ -23,7 +23,7 @@
)
-class ContainerContext(object):
+class ContainerContext:
def __init__(self, container):
self.container = container
@@ -139,7 +139,7 @@ def find_output_files(self, base_path, pattern):
yield line[len("/build/out/%s/" % base_path) :].decode("ascii")
-class TempdirContext(object):
+class TempdirContext:
def __init__(self, td):
self.td = pathlib.Path(td)
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index e0811bba7..b4b28b434 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -47,15 +47,6 @@
"licenses": ["bzip2-1.0.6"],
"license_file": "LICENSE.bzip2.txt",
},
- "cpython-3.9": {
- "url": "https://www.python.org/ftp/python/3.9.25/Python-3.9.25.tar.xz",
- "size": 20183236,
- "sha256": "00e07d7c0f2f0cc002432d1ee84d2a40dae404a99303e3f97701c10966c91834",
- "version": "3.9.25",
- "licenses": ["Python-2.0", "CNRI-Python"],
- "license_file": "LICENSE.cpython.txt",
- "python_tag": "cp39",
- },
"cpython-3.10": {
"url": "https://www.python.org/ftp/python/3.10.19/Python-3.10.19.tar.xz",
"size": 19873020,
diff --git a/pythonbuild/utils.py b/pythonbuild/utils.py
index 90acbeb64..36c3f9fb2 100644
--- a/pythonbuild/utils.py
+++ b/pythonbuild/utils.py
@@ -96,16 +96,14 @@ def supported_targets(yaml_path: pathlib.Path):
return targets
-def target_needs(yaml_path: pathlib.Path, target: str, python_version: str):
+def target_needs(yaml_path: pathlib.Path, target: str):
"""Obtain the dependencies needed to build the specified target."""
settings = get_targets(yaml_path)[target]
needs = set(settings["needs"])
- # We only ship libedit linked readline extension on 3.10+ to avoid a GPL
- # dependency.
- if not python_version.startswith("3.9"):
- needs.discard("readline")
+ # Ship libedit linked readline extension to avoid a GPL dependency.
+ needs.discard("readline")
return needs
@@ -571,7 +569,7 @@ def add_env_common(env):
env_path = os.path.expanduser("~/.python-build-standalone-env")
try:
- with open(env_path, "r") as fh:
+ with open(env_path) as fh:
for line in fh:
line = line.strip()
if line.startswith("#"):
diff --git a/src/github.rs b/src/github.rs
index 87e316e0a..f7df4b574 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -180,7 +180,7 @@ pub async fn command_fetch_release_distributions(args: &ArgMatches) -> Result<()
let (client, _) = new_github_client(args)?;
- let release_version_range = pep440_rs::VersionSpecifier::from_str(">=3.9")?;
+ let release_version_range = pep440_rs::VersionSpecifier::from_str(">=3.10")?;
let workflows = client.workflows(org, repo);
diff --git a/src/release.rs b/src/release.rs
index 9558361ce..0fb00e819 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -183,7 +183,7 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
TripleRelease {
suffixes: linux_suffixes_nopgo.clone(),
install_only_suffix: "lto",
- python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
+ python_version_requirement: Some(VersionSpecifier::from_str(">=3.10").unwrap()),
conditional_suffixes: vec![ConditionalSuffixes {
python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
suffixes: linux_suffixes_nopgo_freethreaded.clone(),
@@ -196,7 +196,7 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
TripleRelease {
suffixes: linux_suffixes_nopgo.clone(),
install_only_suffix: "lto",
- python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
+ python_version_requirement: Some(VersionSpecifier::from_str(">=3.10").unwrap()),
conditional_suffixes: vec![ConditionalSuffixes {
python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
suffixes: linux_suffixes_nopgo_freethreaded.clone(),
@@ -209,7 +209,7 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
TripleRelease {
suffixes: linux_suffixes_nopgo.clone(),
install_only_suffix: "lto",
- python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
+ python_version_requirement: Some(VersionSpecifier::from_str(">=3.10").unwrap()),
conditional_suffixes: vec![ConditionalSuffixes {
python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
suffixes: linux_suffixes_nopgo_freethreaded.clone(),
@@ -222,7 +222,7 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
TripleRelease {
suffixes: linux_suffixes_nopgo.clone(),
install_only_suffix: "lto",
- python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
+ python_version_requirement: Some(VersionSpecifier::from_str(">=3.10").unwrap()),
conditional_suffixes: vec![ConditionalSuffixes {
python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
suffixes: linux_suffixes_nopgo_freethreaded.clone(),
@@ -235,7 +235,7 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
TripleRelease {
suffixes: linux_suffixes_nopgo.clone(),
install_only_suffix: "lto",
- python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
+ python_version_requirement: Some(VersionSpecifier::from_str(">=3.10").unwrap()),
conditional_suffixes: vec![ConditionalSuffixes {
python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
suffixes: linux_suffixes_nopgo_freethreaded.clone(),
@@ -260,7 +260,7 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
TripleRelease {
suffixes: linux_suffixes_pgo.clone(),
install_only_suffix: "pgo+lto",
- python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
+ python_version_requirement: Some(VersionSpecifier::from_str(">=3.10").unwrap()),
conditional_suffixes: vec![ConditionalSuffixes {
python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
suffixes: linux_suffixes_pgo_freethreaded.clone(),
@@ -272,7 +272,7 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
TripleRelease {
suffixes: linux_suffixes_pgo.clone(),
install_only_suffix: "pgo+lto",
- python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
+ python_version_requirement: Some(VersionSpecifier::from_str(">=3.10").unwrap()),
conditional_suffixes: vec![ConditionalSuffixes {
python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
suffixes: linux_suffixes_pgo_freethreaded.clone(),
@@ -284,7 +284,7 @@ pub static RELEASE_TRIPLES: Lazy> = Lazy::
TripleRelease {
suffixes: linux_suffixes_pgo.clone(),
install_only_suffix: "pgo+lto",
- python_version_requirement: Some(VersionSpecifier::from_str(">=3.9").unwrap()),
+ python_version_requirement: Some(VersionSpecifier::from_str(">=3.10").unwrap()),
conditional_suffixes: vec![ConditionalSuffixes {
python_version_requirement: VersionSpecifier::from_str(">=3.13").unwrap(),
suffixes: linux_suffixes_pgo_freethreaded.clone(),
diff --git a/src/validation.rs b/src/validation.rs
index 862b90d8e..9b4756fe2 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -32,13 +32,11 @@ use {
const RECOGNIZED_TRIPLES: &[&str] = &[
"aarch64-apple-darwin",
- "aarch64-apple-ios",
"aarch64-pc-windows-msvc",
"aarch64-unknown-linux-gnu",
"aarch64-unknown-linux-musl",
"armv7-unknown-linux-gnueabi",
"armv7-unknown-linux-gnueabihf",
- "arm64-apple-tvos",
"i686-pc-windows-msvc",
"i686-unknown-linux-gnu",
// Note there's build support for mips* targets but they are not tested
@@ -49,11 +47,7 @@ const RECOGNIZED_TRIPLES: &[&str] = &[
"ppc64le-unknown-linux-gnu",
"riscv64-unknown-linux-gnu",
"s390x-unknown-linux-gnu",
- "thumbv7k-apple-watchos",
"x86_64-apple-darwin",
- "x86_64-apple-ios",
- "x86_64-apple-tvos",
- "x86_64-apple-watchos",
"x86_64-pc-windows-msvc",
"x86_64-unknown-linux-gnu",
"x86_64_v2-unknown-linux-gnu",
@@ -302,16 +296,6 @@ static ELF_ALLOWED_LIBRARIES_BY_MODULE: Lazy> = Lazy::new(|| {
[
- MachOAllowedDylib {
- name: "@executable_path/../lib/libpython3.9.dylib".to_string(),
- max_compatibility_version: "3.9.0".try_into().unwrap(),
- required: false,
- },
- MachOAllowedDylib {
- name: "@executable_path/../lib/libpython3.9d.dylib".to_string(),
- max_compatibility_version: "3.9.0".try_into().unwrap(),
- required: false,
- },
MachOAllowedDylib {
name: "@executable_path/../lib/libpython3.10.dylib".to_string(),
max_compatibility_version: "3.10.0".try_into().unwrap(),
@@ -503,59 +487,6 @@ static DARWIN_ALLOWED_DYLIBS: Lazy> = Lazy::new(|| {
.to_vec()
});
-static IOS_ALLOWED_DYLIBS: Lazy> = Lazy::new(|| {
- [
- MachOAllowedDylib {
- name: "@executable_path/../lib/libpython3.9.dylib".to_string(),
- max_compatibility_version: "3.9.0".try_into().unwrap(),
- required: false,
- },
- MachOAllowedDylib {
- name: "@executable_path/../lib/libpython3.9d.dylib".to_string(),
- max_compatibility_version: "3.9.0".try_into().unwrap(),
- required: false,
- },
- MachOAllowedDylib {
- name: "@executable_path/../lib/libpython3.10.dylib".to_string(),
- max_compatibility_version: "3.10.0".try_into().unwrap(),
- required: false,
- },
- MachOAllowedDylib {
- name: "@executable_path/../lib/libpython3.10d.dylib".to_string(),
- max_compatibility_version: "3.10.0".try_into().unwrap(),
- required: false,
- },
- MachOAllowedDylib {
- name: "@executable_path/../lib/libpython3.11.dylib".to_string(),
- max_compatibility_version: "3.11.0".try_into().unwrap(),
- required: false,
- },
- MachOAllowedDylib {
- name: "@executable_path/../lib/libpython3.11d.dylib".to_string(),
- max_compatibility_version: "3.11.0".try_into().unwrap(),
- required: false,
- },
- // For some reason, CoreFoundation is present in debug/noopt builds but not
- // LTO builds.
- MachOAllowedDylib {
- name: "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation".to_string(),
- max_compatibility_version: "150.0.0".try_into().unwrap(),
- required: false,
- },
- MachOAllowedDylib {
- name: "/usr/lib/libSystem.B.dylib".to_string(),
- max_compatibility_version: "1.0.0".try_into().unwrap(),
- required: true,
- },
- MachOAllowedDylib {
- name: "/usr/lib/libz.1.dylib".to_string(),
- max_compatibility_version: "1.0.0".try_into().unwrap(),
- required: true,
- },
- ]
- .to_vec()
-});
-
static ALLOWED_DYLIBS_BY_MODULE: Lazy>> =
Lazy::new(|| {
[(
@@ -582,7 +513,6 @@ static ALLOWED_DYLIBS_BY_MODULE: Lazy> = Lazy::new(|| {
[
("aarch64-apple-darwin", "macosx-11.0-arm64"),
- ("aarch64-apple-ios", "iOS-aarch64"),
("aarch64-pc-windows-msvc", "win-arm64"),
("aarch64-unknown-linux-gnu", "linux-aarch64"),
("aarch64-unknown-linux-musl", "linux-aarch64"),
@@ -597,7 +527,6 @@ static PLATFORM_TAG_BY_TRIPLE: Lazy> = Lazy:
("riscv64-unknown-linux-gnu", "linux-riscv64"),
("s390x-unknown-linux-gnu", "linux-s390x"),
("x86_64-apple-darwin", "macosx-10.15-x86_64"),
- ("x86_64-apple-ios", "iOS-x86_64"),
("x86_64-pc-windows-msvc", "win-amd64"),
("x86_64-unknown-linux-gnu", "linux-x86_64"),
("x86_64_v2-unknown-linux-gnu", "linux-x86_64"),
@@ -746,6 +675,7 @@ const GLOBAL_EXTENSIONS: &[&str] = &[
"_json",
"_locale",
"_lsprof",
+ "_zoneinfo",
"_lzma",
"_md5",
"_multibytecodec",
@@ -794,8 +724,6 @@ const GLOBAL_EXTENSIONS: &[&str] = &[
"zlib",
];
-// _zoneinfo added in 3.9.
-// parser removed in 3.10.
// _tokenize added in 3.11.
// _typing added in 3.11.
// _testsinglephase added in 3.12.
@@ -803,25 +731,11 @@ const GLOBAL_EXTENSIONS: &[&str] = &[
// _xxinterpchannels added in 3.12.
// audioop removed in 3.13.
-// We didn't build ctypes_test until 3.9.
-// We didn't build some test extensions until 3.9.
-
-const GLOBAL_EXTENSIONS_PYTHON_3_9: &[&str] = &[
- "audioop",
- "_peg_parser",
- "_sha256",
- "_sha512",
- "_xxsubinterpreters",
- "_zoneinfo",
- "parser",
-];
-
const GLOBAL_EXTENSIONS_PYTHON_3_10: &[&str] = &[
"audioop",
"_sha256",
"_sha512",
"_xxsubinterpreters",
- "_zoneinfo",
];
const GLOBAL_EXTENSIONS_PYTHON_3_11: &[&str] = &[
@@ -831,7 +745,6 @@ const GLOBAL_EXTENSIONS_PYTHON_3_11: &[&str] = &[
"_tokenize",
"_typing",
"_xxsubinterpreters",
- "_zoneinfo",
];
const GLOBAL_EXTENSIONS_PYTHON_3_12: &[&str] = &[
@@ -841,7 +754,6 @@ const GLOBAL_EXTENSIONS_PYTHON_3_12: &[&str] = &[
"_typing",
"_xxinterpchannels",
"_xxsubinterpreters",
- "_zoneinfo",
];
const GLOBAL_EXTENSIONS_PYTHON_3_13: &[&str] = &[
@@ -853,7 +765,6 @@ const GLOBAL_EXTENSIONS_PYTHON_3_13: &[&str] = &[
"_sysconfig",
"_tokenize",
"_typing",
- "_zoneinfo",
];
const GLOBAL_EXTENSIONS_PYTHON_3_14: &[&str] = &[
@@ -866,7 +777,6 @@ const GLOBAL_EXTENSIONS_PYTHON_3_14: &[&str] = &[
"_sysconfig",
"_tokenize",
"_typing",
- "_zoneinfo",
"_hmac",
"_types",
"_zstd",
@@ -921,8 +831,6 @@ fn allowed_dylibs_for_triple(triple: &str) -> Vec {
match triple {
"aarch64-apple-darwin" => DARWIN_ALLOWED_DYLIBS.clone(),
"x86_64-apple-darwin" => DARWIN_ALLOWED_DYLIBS.clone(),
- "aarch64-apple-ios" => IOS_ALLOWED_DYLIBS.clone(),
- "x86_64-apple-ios" => IOS_ALLOWED_DYLIBS.clone(),
_ => vec![],
}
}
@@ -1263,9 +1171,7 @@ fn validate_macho>(
let wanted_cpu_type = match target_triple {
"aarch64-apple-darwin" => object::macho::CPU_TYPE_ARM64,
- "aarch64-apple-ios" => object::macho::CPU_TYPE_ARM64,
"x86_64-apple-darwin" => object::macho::CPU_TYPE_X86_64,
- "x86_64-apple-ios" => object::macho::CPU_TYPE_X86_64,
_ => return Err(anyhow!("unhandled target triple: {}", target_triple)),
};
@@ -1660,23 +1566,14 @@ fn validate_extension_modules(
) -> Result> {
let mut errors = vec![];
- let is_ios = target_triple.contains("-apple-ios");
let is_macos = target_triple.contains("-apple-darwin");
let is_linux = target_triple.contains("-unknown-linux-");
let is_windows = target_triple.contains("-pc-windows-");
let is_linux_musl = target_triple.contains("-unknown-linux-musl");
- // iOS isn't well supported. So don't do any validation.
- if is_ios {
- return Ok(errors);
- }
-
let mut wanted = BTreeSet::from_iter(GLOBAL_EXTENSIONS.iter().copied());
match python_major_minor {
- "3.9" => {
- wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_9);
- }
"3.10" => {
wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_10);
}
@@ -1700,7 +1597,7 @@ fn validate_extension_modules(
if is_macos {
wanted.extend(GLOBAL_EXTENSIONS_POSIX);
- if matches!(python_major_minor, "3.9" | "3.10" | "3.11" | "3.12") {
+ if matches!(python_major_minor, "3.10" | "3.11" | "3.12") {
wanted.extend(GLOBAL_EXTENSIONS_POSIX_PRE_3_13);
}
@@ -1710,7 +1607,7 @@ fn validate_extension_modules(
if is_windows {
wanted.extend(GLOBAL_EXTENSIONS_WINDOWS);
- if matches!(python_major_minor, "3.9" | "3.10" | "3.11" | "3.12") {
+ if matches!(python_major_minor, "3.10" | "3.11" | "3.12") {
wanted.extend(GLOBAL_EXTENSIONS_WINDOWS_PRE_3_13);
}
@@ -1728,15 +1625,15 @@ fn validate_extension_modules(
if is_linux {
wanted.extend(GLOBAL_EXTENSIONS_POSIX);
- if matches!(python_major_minor, "3.9" | "3.10" | "3.11" | "3.12") {
+ if matches!(python_major_minor, "3.10" | "3.11" | "3.12") {
wanted.extend(GLOBAL_EXTENSIONS_POSIX_PRE_3_13);
}
- if matches!(python_major_minor, "3.9" | "3.10" | "3.11" | "3.12") {
+ if matches!(python_major_minor, "3.10" | "3.11" | "3.12") {
wanted.extend(GLOBAL_EXTENSIONS_LINUX_PRE_3_13);
}
- if !is_linux_musl && matches!(python_major_minor, "3.9" | "3.10" | "3.11" | "3.12") {
+ if !is_linux_musl && matches!(python_major_minor, "3.10" | "3.11" | "3.12") {
wanted.insert("ossaudiodev");
}
}
@@ -1868,9 +1765,7 @@ fn validate_distribution(
)
})?;
- let python_major_minor = if dist_filename.starts_with("cpython-3.9.") {
- "3.9"
- } else if dist_filename.starts_with("cpython-3.10.") {
+ let python_major_minor = if dist_filename.starts_with("cpython-3.10.") {
"3.10"
} else if dist_filename.starts_with("cpython-3.11.") {
"3.11"
@@ -2161,7 +2056,7 @@ fn validate_distribution(
} else if name == "_warnings" {
// But not on Python 3.13 on Windows
if triple.contains("-windows-") {
- matches!(python_major_minor, "3.9" | "3.10" | "3.11" | "3.12")
+ matches!(python_major_minor, "3.10" | "3.11" | "3.12")
} else {
true
}
From cdb5ce6f3b038a97619b37d45e76084eda3030f2 Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas
Date: Tue, 11 Nov 2025 10:26:58 -0500
Subject: [PATCH 119/231] Fix LLVM URL in release script (#840)
---
src/release.rs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/release.rs b/src/release.rs
index 0fb00e819..21fa1b2c6 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -617,7 +617,7 @@ static LLVM_URL: Lazy = Lazy::new(|| {
panic!("unsupported macOS architecture");
}
} else if cfg!(target_os = "linux") {
- Url::parse("https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-20.1.4+20251029-gnu_only-x86_64-unknown-linux-gnu.tar.zst").unwrap()
+ Url::parse("https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-gnu_only-x86_64-unknown-linux-gnu.tar.zst").unwrap()
} else {
panic!("unsupported platform");
}
From 1859bbe33a43d0caf02e92a6e15bbc2b601d3db3 Mon Sep 17 00:00:00 2001
From: "Jonathan J. Helmus"
Date: Wed, 12 Nov 2025 15:29:01 -0600
Subject: [PATCH 120/231] Add optimization flag based on build type (#852)
Use `-O0` when building all projects for the debug option and `-O3` in
other cases. Individual build script can adjust these if needed.
closes #849
partially addresses #846
---
cpython-unix/build.py | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
index 6fd2fe752..409209402 100755
--- a/cpython-unix/build.py
+++ b/cpython-unix/build.py
@@ -64,7 +64,7 @@
MACOS_ALLOW_FRAMEWORKS = {"CoreFoundation"}
-def add_target_env(env, build_platform, target_triple, build_env):
+def add_target_env(env, build_platform, target_triple, build_env, build_options):
add_env_common(env)
settings = get_target_settings(TARGETS_CONFIG, target_triple)
@@ -83,7 +83,11 @@ def add_target_env(env, build_platform, target_triple, build_env):
env["PYBUILD_PLATFORM"] = build_platform
env["TOOLS_PATH"] = build_env.tools_path
- extra_target_cflags = list(settings.get("target_cflags", []))
+ if "debug" in build_options:
+ extra_target_cflags = ["-O0"]
+ else:
+ extra_target_cflags = ["-O3"]
+ extra_target_cflags += list(settings.get("target_cflags", []))
extra_target_ldflags = list(settings.get("target_ldflags", []))
extra_host_cflags = []
extra_host_ldflags = []
@@ -272,7 +276,7 @@ def simple_build(
if "static" in build_options:
env["STATIC"] = 1
- add_target_env(env, host_platform, target_triple, build_env)
+ add_target_env(env, host_platform, target_triple, build_env, build_options)
# for OpenSSL, set the OPENSSL_TARGET environment variable
if entry.startswith("openssl-"):
@@ -379,7 +383,7 @@ def build_libedit(
"LIBEDIT_VERSION": DOWNLOADS["libedit"]["version"],
}
- add_target_env(env, host_platform, target_triple, build_env)
+ add_target_env(env, host_platform, target_triple, build_env, build_options)
build_env.run("build-libedit.sh", environment=env)
build_env.get_tools_archive(dest_archive, "deps")
@@ -440,7 +444,7 @@ def build_cpython_host(
"PYTHON_VERSION": python_version,
}
- add_target_env(env, host_platform, target_triple, build_env)
+ add_target_env(env, host_platform, target_triple, build_env, build_options)
# Set environment variables allowing convenient testing for Python
# version ranges.
@@ -831,7 +835,7 @@ def build_cpython(
if "static" in parsed_build_options:
env["CPYTHON_STATIC"] = "1"
- add_target_env(env, host_platform, target_triple, build_env)
+ add_target_env(env, host_platform, target_triple, build_env, build_options)
build_env.run("build-cpython.sh", environment=env)
From 652d246a8a995a2cdc7ef6a21f2e3037c155fc37 Mon Sep 17 00:00:00 2001
From: Sergio Garcia <47090312+singiamtel@users.noreply.github.com>
Date: Thu, 13 Nov 2025 15:49:16 +0100
Subject: [PATCH 121/231] Fix typo (#854)
---
Justfile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Justfile b/Justfile
index c9b8167f0..19b52fd2e 100644
--- a/Justfile
+++ b/Justfile
@@ -1,4 +1,4 @@
-# Diff 2 releases using diffocope.
+# Diff 2 releases using diffoscope.
diff a b:
diffoscope \
--html build/diff.html \
From ddddc082077512d23de217fe599c23e4881f1069 Mon Sep 17 00:00:00 2001
From: "Jonathan J. Helmus"
Date: Mon, 17 Nov 2025 13:09:18 -0600
Subject: [PATCH 122/231] Upgrade xz from 5.2.12 -> 5.8.1 (#853)
In version 5.6.0 and newer, liblzma is licensed under the BSD Zero Clause License (0BSD).
---
LICENSE.liblzma.txt | 14 +++++-
cpython-unix/build-xz.sh | 12 +++++-
cpython-windows/build.py | 38 +++++++++++++---
cpython-windows/xz-support/README | 8 ++++
cpython-windows/xz-support/config.h | 67 +++++++++++++++++++++++++++++
pythonbuild/downloads.py | 19 ++++----
6 files changed, 140 insertions(+), 18 deletions(-)
create mode 100644 cpython-windows/xz-support/README
create mode 100644 cpython-windows/xz-support/config.h
diff --git a/LICENSE.liblzma.txt b/LICENSE.liblzma.txt
index 4590b3a23..2d7885199 100644
--- a/LICENSE.liblzma.txt
+++ b/LICENSE.liblzma.txt
@@ -1 +1,13 @@
-liblzma is in the public domain.
+Copyright (C) The XZ Utils authors and contributors
+
+Permission to use, copy, modify, and/or distribute this
+software for any purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/cpython-unix/build-xz.sh b/cpython-unix/build-xz.sh
index 01e71e9fb..a3ee106a8 100755
--- a/cpython-unix/build-xz.sh
+++ b/cpython-unix/build-xz.sh
@@ -13,6 +13,15 @@ tar -xf xz-${XZ_VERSION}.tar.gz
pushd xz-${XZ_VERSION}
+EXTRA_CONFIGURE_FLAGS=
+
+# musl-clang injects flags that are not used during compilation,
+# e.g. -fuse-ld=musl-clang. These raise warnings that can be ignored but
+# cause the -Werror check to fail. Skip the check.
+if [ "${CC}" = "musl-clang" ]; then
+ EXTRA_CONFIGURE_FLAGS="${EXTRA_CONFIGURE_FLAGS} SKIP_WERROR_CHECK=yes"
+fi
+
CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" CPPFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" CCASFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" ./configure \
--build=${BUILD_TRIPLE} \
--host=${TARGET_TRIPLE} \
@@ -23,7 +32,8 @@ CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" CPPFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC" CC
--disable-lzmadec \
--disable-lzmainfo \
--disable-lzma-links \
- --disable-scripts
+ --disable-scripts \
+ ${EXTRA_CONFIGURE_FLAGS}
make -j ${NUM_CPUS}
make -j ${NUM_CPUS} install DESTDIR=${ROOT}/out
diff --git a/cpython-windows/build.py b/cpython-windows/build.py
index d113cbbed..d4048dadb 100644
--- a/cpython-windows/build.py
+++ b/cpython-windows/build.py
@@ -598,23 +598,40 @@ def hack_project_files(
with sqlite3_path.open("wb") as fh:
fh.write(data)
- # Our version of the xz sources is newer than what's in cpython-source-deps
- # and the xz sources changed the path to config.h. Hack the project file
+ # Our version of the xz sources may be newer than what's in cpython-source-deps.
+ # The source files and locations may have changed. Hack the project file
# accordingly.
#
- # ... but CPython finally upgraded liblzma in 2022, so newer CPython releases
- # already have this patch. So we're phasing it out.
+ # CPython updates xz occasionally. When these changes make it into a release
+ # these modification to the project file are not needed.
+ # The most recent change was an update to version 5.8.1:
+ # https://github.com/python/cpython/pull/141022
try:
liblzma_path = pcbuild_path / "liblzma.vcxproj"
static_replace_in_file(
liblzma_path,
+ rb"$(lzmaDir)windows/vs2019;$(lzmaDir)src/liblzma/common;",
rb"$(lzmaDir)windows;$(lzmaDir)src/liblzma/common;",
- rb"$(lzmaDir)windows\vs2019;$(lzmaDir)src/liblzma/common;",
)
static_replace_in_file(
liblzma_path,
- rb'',
+ b'\r\n \r\n',
+ b'\r\n ',
+ )
+ static_replace_in_file(
+ liblzma_path,
+ b'\r\n \r\n',
+ b'\r\n ',
+ )
+ static_replace_in_file(
+ liblzma_path,
+ b'',
+ b'\r\n ',
+ )
+ static_replace_in_file(
+ liblzma_path,
rb'',
+ rb'',
)
except NoSearchStringError:
pass
@@ -1412,6 +1429,15 @@ def build_cpython(
for f in fs:
f.result()
+ # Copy the config.h file used by upstream CPython for xz 5.8.1
+ # https://github.com/python/cpython-source-deps/blob/665d407bd6bc941944db2152e4b5dca388ea586e/windows/config.h
+ xz_version = DOWNLOADS["xz"]["version"]
+ xz_path = td / ("xz-%s" % xz_version)
+ config_src = SUPPORT / "xz-support" / "config.h"
+ config_dest = xz_path / "windows" / "config.h"
+ log(f"copying {config_src} to {config_dest}")
+ shutil.copyfile(config_src, config_dest)
+
extract_tar_to_directory(libffi_archive, td)
# We need all the OpenSSL library files in the same directory to appease
diff --git a/cpython-windows/xz-support/README b/cpython-windows/xz-support/README
new file mode 100644
index 000000000..12b027338
--- /dev/null
+++ b/cpython-windows/xz-support/README
@@ -0,0 +1,8 @@
+The upstream xz sources requires cmake to build on windows.
+This can be avoided by extracting a config.h file extracted from the CMake's
+results, as is done by CPython.
+This file may need to be updated when upgrading the xz version.
+The file in this directory is taken from the xz branch of
+https://github.com/python/cpython-source-deps.
+Specifically:
+https://github.com/python/cpython-source-deps/blob/665d407bd6bc941944db2152e4b5dca388ea586e/windows/config.h
\ No newline at end of file
diff --git a/cpython-windows/xz-support/config.h b/cpython-windows/xz-support/config.h
new file mode 100644
index 000000000..81ddf6b7f
--- /dev/null
+++ b/cpython-windows/xz-support/config.h
@@ -0,0 +1,67 @@
+/* Configuration extracted from CMake'd project files.
+
+This is used by CPython, and is not part of the regular xz release.
+*/
+
+#define HAVE_CHECK_CRC32 1
+#define HAVE_CHECK_CRC64 1
+#define HAVE_CHECK_SHA256 1
+
+#define HAVE_DECODERS 1
+#define HAVE_DECODER_ARM 1
+#define HAVE_DECODER_ARM64 1
+#define HAVE_DECODER_ARMTHUMB 1
+#define HAVE_DECODER_DELTA 1
+#define HAVE_DECODER_IA64 1
+#define HAVE_DECODER_POWERPC 1
+#define HAVE_DECODER_LZMA1 1
+#define HAVE_DECODER_LZMA2 1
+#define HAVE_DECODER_SPARC 1
+#define HAVE_DECODER_X86 1
+
+#define HAVE_ENCODERS 1
+#define HAVE_ENCODER_ARM 1
+#define HAVE_ENCODER_ARM64 1
+#define HAVE_ENCODER_ARMTHUMB 1
+#define HAVE_ENCODER_DELTA 1
+#define HAVE_ENCODER_IA64 1
+#define HAVE_ENCODER_POWERPC 1
+#define HAVE_ENCODER_LZMA1 1
+#define HAVE_ENCODER_LZMA2 1
+#define HAVE_ENCODER_SPARC 1
+#define HAVE_ENCODER_X86 1
+
+#if defined(_M_ARM64)
+
+#undef HAVE_IMMINTRIN_H
+#undef HAVE_USABLE_CLMUL
+
+#else
+
+#define HAVE_IMMINTRIN_H 1
+#define HAVE_USABLE_CLMUL 1
+#define HAVE__MM_MOVEMASK_EPI8 1
+#define TUKLIB_FAST_UNALIGNED_ACCESS 1
+
+#endif
+
+#define HAVE___BUILTIN_ASSUME_ALIGNED 1
+#define HAVE__BOOL 1
+
+#define HAVE_INTTYPES_H 1
+#define HAVE_MF_BT2 1
+#define HAVE_MF_BT3 1
+#define HAVE_MF_BT4 1
+#define HAVE_MF_HC3 1
+#define HAVE_MF_HC4 1
+#define HAVE_STDBOOL_H 1
+#define HAVE_STDINT_H 1
+#define HAVE_VISIBILITY 0
+
+#define MYTHREAD_VISTA 1
+
+#define PACKAGE_BUGREPORT "xz@tukaani.org"
+#define PACKAGE_NAME "XZ Utils"
+#define PACKAGE_URL "https://tukaani.org/xz/"
+
+#define TUKLIB_SYMBOL_PREFIX lzma_
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index b4b28b434..4981e1399 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -414,19 +414,18 @@
"sha256": "936b74c60b19c317c3f3cb1b114575032528dbdaf428740483200ea874c2ca0a",
"version": "1.6.0",
},
- # IMPORTANT: xz 5.6 has a backdoor. Be extremely cautious before taking any xz
- # upgrade since it isn't clear which versions are safe.
+ # IMPORTANT: xz 5.6.0 was released with a backdoor (CVE-2024-3094). This has been resolved.
+ # Be cautious before taking any xz upgrades given this past behavior.
"xz": {
- "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20240224/xz-5.2.12.tar.gz",
- "size": 2190541,
- "sha256": "61bda930767dcb170a5328a895ec74cab0f5aac4558cdda561c83559db582a13",
- "version": "5.2.12",
+ "url": "https://github.com/tukaani-project/xz/releases/download/v5.8.1/xz-5.8.1.tar.gz",
+ "size": 2587189,
+ "sha256": "507825b599356c10dca1cd720c9d0d0c9d5400b9de300af00e4d1ea150795543",
+ "version": "5.8.1",
"library_names": ["lzma"],
- # liblzma is in the public domain. Other parts of code have licenses. But
- # we only use liblzma.
- "licenses": [],
+ # liblzma is licensed as 0BSD. Other parts of code have different licenses.
+ # But we only use liblzma.
+ "licenses": ["0BSD"],
"license_file": "LICENSE.liblzma.txt",
- "license_public_domain": True,
},
"zlib": {
"url": "https://github.com/madler/zlib/releases/download/v1.3.1/zlib-1.3.1.tar.gz",
From ad2b817586e1ca91fd02fc4c458b92ba71f80322 Mon Sep 17 00:00:00 2001
From: Neil Mehta
Date: Wed, 19 Nov 2025 06:29:23 -0800
Subject: [PATCH 123/231] Do not strip VC redists (#856)
Closes #855
Please see the above issue description for why this addition is proposed
---
src/release.rs | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/src/release.rs b/src/release.rs
index 21fa1b2c6..ebdb6fdbf 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -511,8 +511,12 @@ pub fn convert_to_stripped(
| FileKind::Pe32
| FileKind::Pe64)
) {
- data = llvm_strip(&data, llvm_dir)
- .with_context(|| format!("failed to strip {}", path.display()))?;
+ // Skip stripping MSVC runtime DLLs
+ let filename = path.file_name().and_then(|n| n.to_str());
+ if !matches!(filename, Some("vcruntime140.dll" | "vcruntime140_1.dll")) {
+ data = llvm_strip(&data, llvm_dir)
+ .with_context(|| format!("failed to strip {}", path.display()))?;
+ }
}
let mut header = entry.header().clone();
From 4012f5bc3a4be4535c71740e47fd35279a8143b0 Mon Sep 17 00:00:00 2001
From: "Jonathan J. Helmus"
Date: Wed, 19 Nov 2025 16:22:18 -0600
Subject: [PATCH 124/231] Update to CPython 3.15.0a2 (#860)
Update the cpython-3.15 target from 3.15.0a1 -> 3.15.0a2
---
cpython-unix/build-cpython.sh | 6 +++-
cpython-unix/extension-modules.yml | 5 ++++
...patch-configure-bolt-skip-funcs-3.15.patch | 18 ++++++++++++
.../patch-jit-llvm-version-3.15.patch | 4 +--
pythonbuild/downloads.py | 8 ++---
src/validation.rs | 29 ++++++++++++++-----
6 files changed, 56 insertions(+), 14 deletions(-)
create mode 100644 cpython-unix/patch-configure-bolt-skip-funcs-3.15.patch
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
index 9c65394e5..333913365 100755
--- a/cpython-unix/build-cpython.sh
+++ b/cpython-unix/build-cpython.sh
@@ -260,7 +260,11 @@ if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_12}" ]; then
patch -p1 -i ${ROOT}/patch-configure-bolt-icf-safe.patch
# Tweak --skip-funcs to work with our toolchain.
- patch -p1 -i ${ROOT}/patch-configure-bolt-skip-funcs.patch
+ if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_15}" ]; then
+ patch -p1 -i ${ROOT}/patch-configure-bolt-skip-funcs-3.15.patch
+ else
+ patch -p1 -i ${ROOT}/patch-configure-bolt-skip-funcs.patch
+ fi
fi
# The optimization make targets are both phony and non-phony. This leads
diff --git a/cpython-unix/extension-modules.yml b/cpython-unix/extension-modules.yml
index c9e5df9c2..1fb0860d2 100644
--- a/cpython-unix/extension-modules.yml
+++ b/cpython-unix/extension-modules.yml
@@ -362,6 +362,11 @@ _lzma:
links:
- lzma
+_math_integer:
+ minimum-python-version: "3.15"
+ sources:
+ - mathintegermodule.c
+
_md5:
sources:
- md5module.c
diff --git a/cpython-unix/patch-configure-bolt-skip-funcs-3.15.patch b/cpython-unix/patch-configure-bolt-skip-funcs-3.15.patch
new file mode 100644
index 000000000..df3d5a2b2
--- /dev/null
+++ b/cpython-unix/patch-configure-bolt-skip-funcs-3.15.patch
@@ -0,0 +1,18 @@
+diff --git a/configure.ac b/configure.ac
+index a059a07bec2..92a7ff8d54c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2167,11 +2167,8 @@ then
+ [m4_normalize("
+ [-update-debug-sections]
+
+- dnl At least LLVM 19.x doesn't support computed gotos in PIC compiled code.
+- dnl Exclude functions containing computed gotos.
+- dnl TODO this may be fixed in LLVM 20.x via https://github.com/llvm/llvm-project/pull/120267.
+- dnl GCC's LTO creates .lto_priv.0 clones of these functions.
+- [-skip-funcs=_PyEval_EvalFrameDefault,sre_ucs1_match/1,sre_ucs2_match/1,sre_ucs4_match/1,sre_ucs1_match.lto_priv.0/1,sre_ucs2_match.lto_priv.0/1,sre_ucs4_match.lto_priv.0/1]
++ dnl LLVM on at least 20.1.0 crashes on this symbol. Work around.
++ [-skip-funcs=RC4_options/1]
+ ")]
+ )
+ fi
diff --git a/cpython-unix/patch-jit-llvm-version-3.15.patch b/cpython-unix/patch-jit-llvm-version-3.15.patch
index 35aae48ee..5a039ffb7 100644
--- a/cpython-unix/patch-jit-llvm-version-3.15.patch
+++ b/cpython-unix/patch-jit-llvm-version-3.15.patch
@@ -5,8 +5,8 @@ diff --git a/Tools/jit/_llvm.py b/Tools/jit/_llvm.py
import _targets
--_LLVM_VERSION = "19"
+-_LLVM_VERSION = "21"
+_LLVM_VERSION = "21"
- _EXTERNALS_LLVM_TAG = "llvm-19.1.7.0"
+ _EXTERNALS_LLVM_TAG = "llvm-21.1.4.0"
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
index 4981e1399..75686a9fa 100644
--- a/pythonbuild/downloads.py
+++ b/pythonbuild/downloads.py
@@ -93,10 +93,10 @@
"python_tag": "cp314",
},
"cpython-3.15": {
- "url": "https://www.python.org/ftp/python/3.15.0/Python-3.15.0a1.tar.xz",
- "size": 23646768,
- "sha256": "3194939d488eeaeefdcf990d35542d9ad1ce788789c4e2305a2060eb7058e5a4",
- "version": "3.15.0a1",
+ "url": "https://www.python.org/ftp/python/3.15.0/Python-3.15.0a2.tar.xz",
+ "size": 23728836,
+ "sha256": "d8a0a2f4a7f3d7090cf195e81814efe95f70554955557f40e149d8694a662751",
+ "version": "3.15.0a2",
"licenses": ["Python-2.0", "CNRI-Python"],
"license_file": "LICENSE.cpython.txt",
"python_tag": "cp315",
diff --git a/src/validation.rs b/src/validation.rs
index 9b4756fe2..ef64d29d4 100644
--- a/src/validation.rs
+++ b/src/validation.rs
@@ -731,12 +731,8 @@ const GLOBAL_EXTENSIONS: &[&str] = &[
// _xxinterpchannels added in 3.12.
// audioop removed in 3.13.
-const GLOBAL_EXTENSIONS_PYTHON_3_10: &[&str] = &[
- "audioop",
- "_sha256",
- "_sha512",
- "_xxsubinterpreters",
-];
+const GLOBAL_EXTENSIONS_PYTHON_3_10: &[&str] =
+ &["audioop", "_sha256", "_sha512", "_xxsubinterpreters"];
const GLOBAL_EXTENSIONS_PYTHON_3_11: &[&str] = &[
"audioop",
@@ -782,6 +778,22 @@ const GLOBAL_EXTENSIONS_PYTHON_3_14: &[&str] = &[
"_zstd",
];
+const GLOBAL_EXTENSIONS_PYTHON_3_15: &[&str] = &[
+ "_interpchannels",
+ "_interpqueues",
+ "_interpreters",
+ "_math_integer",
+ "_remote_debugging",
+ "_sha2",
+ "_suggestions",
+ "_sysconfig",
+ "_tokenize",
+ "_typing",
+ "_hmac",
+ "_types",
+ "_zstd",
+];
+
const GLOBAL_EXTENSIONS_MACOS: &[&str] = &["_scproxy"];
const GLOBAL_EXTENSIONS_POSIX: &[&str] = &[
@@ -1586,9 +1598,12 @@ fn validate_extension_modules(
"3.13" => {
wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_13);
}
- "3.14" | "3.15" => {
+ "3.14" => {
wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_14);
}
+ "3.15" => {
+ wanted.extend(GLOBAL_EXTENSIONS_PYTHON_3_15);
+ }
_ => {
panic!("unhandled Python version: {python_major_minor}");
}
From 4e1ffb6e1c321ae7514ac7e8584d6aff79e759c2 Mon Sep 17 00:00:00 2001
From: "Jonathan J. Helmus"
Date: Sun, 23 Nov 2025 09:49:35 -0600
Subject: [PATCH 125/231] remove unused build-tix.sh script (#862)
#676 removed the need for this build script. Tix is no longer built in
any configuration
---
cpython-unix/build-tix.sh | 53 ---------------------------------------
1 file changed, 53 deletions(-)
delete mode 100755 cpython-unix/build-tix.sh
diff --git a/cpython-unix/build-tix.sh b/cpython-unix/build-tix.sh
deleted file mode 100755
index c1d5fae3d..000000000
--- a/cpython-unix/build-tix.sh
+++ /dev/null
@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-set -ex
-
-ROOT=`pwd`
-
-export PATH=${TOOLS_PATH}/deps/bin:${TOOLS_PATH}/${TOOLCHAIN}/bin:${TOOLS_PATH}/host/bin:$PATH
-export PKG_CONFIG_PATH=${TOOLS_PATH}/deps/share/pkgconfig:${TOOLS_PATH}/deps/lib/pkgconfig
-
-# We need the tcl/tk source extracted because tix looks for private symbols.
-tar -xf tcl${TCL_VERSION}-src.tar.gz
-tar -xf tk${TK_VERSION}-src.tar.gz
-
-tar -xf tix-${TIX_VERSION}.tar.gz
-
-cd cpython-source-deps-tix-${TIX_VERSION}
-
-# Yes, really.
-chmod +x configure
-
-CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC -DUSE_INTERP_RESULT"
-
-# Error by default in Clang 16.
-if [ "${CC}" = "clang" ]; then
- CFLAGS="${CFLAGS} -Wno-error=implicit-function-declaration -Wno-error=incompatible-function-pointer-types"
-fi
-
-if [[ "${PYBUILD_PLATFORM}" = macos* ]]; then
- CFLAGS="${CFLAGS} -I${TOOLS_PATH}/deps/include"
- EXTRA_CONFIGURE_FLAGS="--without-x"
-else
- EXTRA_CONFIGURE_FLAGS="--x-includes=/tools/deps/include --x-libraries=/tools/deps/lib"
-fi
-
-# -DUSE_INTERP_RESULT is to allow tix to use deprecated fields or something
-# like that.
-CFLAGS="${CFLAGS}" CPPFLAGS="${CFLAGS}" LDFLAGS="${EXTRA_TARGET_LDFLAGS}" ./configure \
- --build=${BUILD_TRIPLE} \
- --host=${TARGET_TRIPLE} \
- --prefix=/tools/deps \
- --with-tcl=${TOOLS_PATH}/deps/lib \
- --with-tk=${TOOLS_PATH}/deps/lib \
- --enable-shared=no \
- ${EXTRA_CONFIGURE_FLAGS}
-
-make -j ${NUM_CPUS}
-make -j ${NUM_CPUS} install DESTDIR=${ROOT}/out
-
-# For some reason libtk*.a have weird permissions. Fix that.
-chmod 644 ${ROOT}/out/tools/deps/lib/Tix*/libTix*.a
From f98de0cd590c876541e77ee2bc52ea240af1ba59 Mon Sep 17 00:00:00 2001
From: "Jonathan J. Helmus"