chore(deps): Update Python dependencies #21
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/python-deps"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
==2.8.1→==2.9.0==2.32.5→==2.33.1==3.11.14→==3.13.5Release Notes
pygithub/pygithub (PyGithub)
v2.9.0Compare Source
Notable changes
Lazy PyGithub objects
The notion of lazy objects has been added to some PyGithub classes in version 2.6.0. This release now makes all
CompletableGithubObjects optionally lazy (if useful). See PyGithub/PyGithub#3403 for a complete list.In lazy mode, getting a PyGithub object does not send a request to the GitHub API. Only accessing methods and properties sends the necessary requests to the GitHub API:
All PyGithub classes that implement
CompletableGithubObjectsupport lazy mode (if useful). This is only useful for classes that have methods creating, changing, or getting objects.By default, PyGithub objects are not lazy.
PyGithub objects with a paginated property
The GitHub API has the "feature" of paginated properties. Some objects returned by the API have a property that allows for pagination. Fetching subsequent pages of that property means fetching the entire object (with all other properties) and the specified page of the paginated property. Iterating over the paginated property means fetching all other properties multiple times. Fortunately, the allowed size of each page (
per_pageis usually 300, in contrast to the "usual"per_pagemaximum of 100).Objects with paginated properties:
This PR makes iterating those paginated properties use the configured
per_pagesetting.It further allows to specify an individual
per_pagewhen either retrieving such objects, or fetching paginated properties.See Classes with paginated properties for details.
Drop Python 3.8 support due to End-of-Life
Python 3.8 reached its end-of-life September 6, 2024. Support has been removed with this release.
Deprecations
deleteofReactionis deprecated, useIssueComment.delete_reaction,PullRequestComment.delete_reaction,CommitComment.delete_reactionorIssue.delete_reactioninstead.Issue.assigneeand parameterIssue.edit(assignee=…)are deprecated,use
Issue.assigneesandIssue.edit(assignees=…)instead.Organization.edit_hookis deprecated, useOrganization.get_hook(id).edit(…)instead.If you need to avoid
Organization.get_hook(id)to fetch theHookobject from Github API,use a lazy Github instance:
Team.add_to_membersandTeam.remove_from_membersare deprecated,use
Team.add_membershiporTeam.remove_membershipinstead.New Features
Improvements
api.by @EnricoMi in PyGithub/PyGithub#3419throwoption toWorkflow.create_dispatchto raise exceptions by @dblanchette in PyGithub/PyGithub#2966GETurl or_links.selfas object url by @EnricoMi in PyGithub/PyGithub#3421typeparameter to get_issues by @nrysk in PyGithub/PyGithub#3381Bug Fixes
PaginatedList.totalCountreturning 0 with GitHub deprecation notices by @odedperezcodes in PyGithub/PyGithub#3382Maintenance
Reaction.deleteby @iarspider in PyGithub/PyGithub#3435Issue.assigneeby @EnricoMi in PyGithub/PyGithub#3366Orginization.edit_hookby @EnricoMi in PyGithub/PyGithub#3404Team.add_to_membersandTeam.remove_from_membersby @EnricoMi in PyGithub/PyGithub#3368New Contributors
Full Changelog: https://github.com/PyGithub/PyGithub/compare/v2.8.0...v2.9.0
psf/requests (Requests)
v2.33.1Compare Source
Bugfixes
files in the tmp directory. (#7305)
v2.33.0Compare Source
Announcements
uses Requests, please take a look at #7271. Give it a try, and report
any gaps or feedback you may have in the issue. 📣
Security
requests.utils.extract_zipped_pathsnow extractscontents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.
Improvements
Bugfixes
malformed authentication to be applied to Requests on
Python 3.11+. (#7205)
Deprecations
Documentation
aio-libs/aiohttp (aiohttp)
v3.13.5Compare Source
===================
Bug fixes
Skipped the duplicate singleton header check in lax mode (the default for response
parsing). In strict mode (request parsing, or
-X dev), all RFC 9110 singletonsare still enforced -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
12302.v3.13.4Compare Source
===================
Features
Added
max_headersparameter to limit the number of headers that should be read from a response -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11955.Added a
dns_cache_max_sizeparameter toTCPConnectorto limit the size of the cache -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12106.Bug fixes
Fixed server hanging indefinitely when chunked transfer encoding chunk-size
does not match actual data length. The server now raises
TransferEncodingErrorinstead of waiting forever for data that willnever arrive -- by :user:
Fridayai700.Related issues and pull requests on GitHub:
:issue:
10596.Fixed access log timestamps ignoring daylight saving time (DST) changes. The
previous implementation used :py:data:
time.timezonewhich is a constant anddoes not reflect DST transitions -- by :user:
nightcityblade.Related issues and pull requests on GitHub:
:issue:
11283.Fixed
RuntimeError: An event loop is runningerror when usingaiohttp.GunicornWebWorkeror
aiohttp.GunicornUVLoopWebWorkeron Python >=3.14.-- by :user:
Tasssadar.Related issues and pull requests on GitHub:
:issue:
11701.Fixed :exc:
ValueErrorwhen creating a TLS connection withClientTimeout(total=0)by converting0toNonebefore passing tossl_handshake_timeoutin :py:meth:asyncio.loop.start_tls-- by :user:veeceey.Related issues and pull requests on GitHub:
:issue:
11859.Restored :py:meth:
~aiohttp.BodyPartReader.decodeas a synchronous methodfor backward compatibility. The method was inadvertently changed to async
in 3.13.3 as part of the decompression bomb security fix. A new
:py:meth:
~aiohttp.BodyPartReader.decode_itermethod is now availablefor non-blocking decompression of large payloads using an async generator.
Internal aiohttp code uses the async variant to maintain security protections.
Changed multipart processing chunk sizes from 64 KiB to 256KiB, to better
match aiohttp internals
-- by :user:
bdracoand :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11898.Fixed false-positive :py:class:
DeprecationWarningfor passingenable_cleanup_closed=Trueto :py:class:~aiohttp.TCPConnectorspecifically on Python 3.12.7.-- by :user:
Robsdedude.Related issues and pull requests on GitHub:
:issue:
11972.Fixed _sendfile_fallback over-reading beyond requested count -- by :user:
bysiber.Related issues and pull requests on GitHub:
:issue:
12096.Fixed digest auth dropping challenge fields with empty string values -- by :user:
bysiber.Related issues and pull requests on GitHub:
:issue:
12097.ClientConnectorCertificateError.os_errorno longer raises :exc:AttributeError-- by :user:
themylogin.Related issues and pull requests on GitHub:
:issue:
12136.Adjusted pure-Python request header value validation to align with RFC 9110 control-character handling, while preserving lax response parser behavior, and added regression tests for Host/header control-character cases.
-- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12231.Rejected duplicate singleton headers (
Host,Content-Type,Content-Length, etc.) in the C extension HTTP parser to matchthe pure Python parser behaviour, preventing potential host-based
access control bypasses via parser differentials
-- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12240.Aligned the pure-Python HTTP request parser with the C parser by splitting
comma-separated and repeated
Connectionheader values for keep-alive,close, and upgrade handling -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12249.Improved documentation
Documented :exc:
asyncio.TimeoutErrorforWebSocketResponse.receive()and related methods -- by :user:
veeceey.Related issues and pull requests on GitHub:
:issue:
12042.Packaging updates and notes for downstreams
Upgraded llhttp to 3.9.1 -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12069.Contributor-facing changes
The benchmark CI job now runs only in the upstream repository -- by :user:
Cycloctane.It used to always fail in forks, which this change fixed.
Related issues and pull requests on GitHub:
:issue:
11737.Fixed flaky performance tests by using appropriate fixed thresholds that account for CI variability -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
11992.Miscellaneous internal changes
Fixed
test_invalid_idnato work withidna3.11 by using an invalid character (\u0080) that is rejected byyarlduring URL construction -- by :user:rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12027.Fixed race condition in
test_data_fileon Python 3.14 free-threaded builds -- by :user:rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12170.v3.13.3Compare Source
===================
This release contains fixes for several vulnerabilities. It is advised to
upgrade as soon as possible.
Bug fixes
Fixed proxy authorization headers not being passed when reusing a connection, which caused 407 (Proxy authentication required) errors
-- by :user:
GLeurquin.Related issues and pull requests on GitHub:
:issue:
2596.Fixed multipart reading failing when encountering an empty body part -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11857.Fixed a case where the parser wasn't raising an exception for a websocket continuation frame when there was no initial frame in context.
Related issues and pull requests on GitHub:
:issue:
11862.Removals and backward incompatible breaking changes
Brotliandbrotlicffiminimum version is now 1.2.Decompression now has a default maximum output size of 32MiB per decompress call -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11898.Packaging updates and notes for downstreams
Moved dependency metadata from :file:
setup.cfgto :file:pyproject.tomlper :pep:621-- by :user:
cdce8p.Related issues and pull requests on GitHub:
:issue:
11643.Contributor-facing changes
Removed unused
update-pre-commitgithub action workflow -- by :user:Cycloctane.Related issues and pull requests on GitHub:
:issue:
11689.Miscellaneous internal changes
Optimized web server performance when access logging is disabled by reducing time syscalls -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10713.Added regression test for cached logging status -- by :user:
meehand.Related issues and pull requests on GitHub:
:issue:
11778.v3.13.2Compare Source
===================
Bug fixes
Fixed cookie parser to continue parsing subsequent cookies when encountering a malformed cookie that fails regex validation, such as Google's
g_statecookie with unescaped quotes -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11632.Fixed loading netrc credentials from the default :file:
~/.netrc(:file:~/_netrcon Windows) location when the :envvar:NETRCenvironment variable is not set -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11713, :issue:11714.Fixed WebSocket compressed sends to be cancellation safe. Tasks are now shielded during compression to prevent compressor state corruption. This ensures that the stateful compressor remains consistent even when send operations are cancelled -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
11725.v3.13.1Compare Source
===================
Features
Make configuration options in
AppRunneralso available inrun_app()-- by :user:
Cycloctane.Related issues and pull requests on GitHub:
:issue:
11633.Bug fixes
Switched to
backports.zstdfor Python <3.14 and fixed zstd decompression for chunked zstd streams -- by :user:ZhaoMJ.Note: Users who installed
zstandardfor support on Python <3.14 will now need to installbackports.zstdinstead (installingaiohttp[speedups]will do this automatically).Related issues and pull requests on GitHub:
:issue:
11623.Updated
Content-Typeheader parsing to returnapplication/octet-streamwhen header contains invalid syntax.See :rfc:
9110#section-8.3-5.-- by :user:
sgaist.Related issues and pull requests on GitHub:
:issue:
10889.Fixed Python 3.14 support when built without
zstdsupport -- by :user:JacobHenner.Related issues and pull requests on GitHub:
:issue:
11603.Fixed blocking I/O in the event loop when using netrc authentication by moving netrc file lookup to an executor -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
11634.Fixed routing to a sub-application added via
.add_domain()not workingif the same path exists on the parent app. -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11673.Packaging updates and notes for downstreams
Moved core packaging metadata from :file:
setup.cfgto :file:pyproject.tomlper :pep:621-- by :user:
cdce8p.Related issues and pull requests on GitHub:
:issue:
9951.v3.13.0Compare Source
===================
Features
Added support for Python 3.14.
Related issues and pull requests on GitHub:
:issue:
10851, :issue:10872.Added support for free-threading in Python 3.14+ -- by :user:
kumaraditya303.Related issues and pull requests on GitHub:
:issue:
11466, :issue:11464.Added support for Zstandard (aka Zstd) compression
-- by :user:
KGuillaume-chaps.Related issues and pull requests on GitHub:
:issue:
11161.Added
StreamReader.total_raw_bytesto check the number of bytes downloaded-- by :user:
robpats.Related issues and pull requests on GitHub:
:issue:
11483.Bug fixes
Fixed pytest plugin to not use deprecated :py:mod:
asynciopolicy APIs.Related issues and pull requests on GitHub:
:issue:
10851.Updated
Content-Dispositionheader parsing to handle trailing semicolons and empty parts-- by :user:
PLPeeters.Related issues and pull requests on GitHub:
:issue:
11243.Fixed saved
CookieJarfailing to be loaded if cookies havepartitionedflag whenhttp.cookiedoes not have partitioned cookies supports. -- by :user:Cycloctane.Related issues and pull requests on GitHub:
:issue:
11523.Improved documentation
Added
Wireupto third-party libraries -- by :user:maldoinc.Related issues and pull requests on GitHub:
:issue:
11233.Packaging updates and notes for downstreams
The
blockbustertest dependency is now optional; the corresponding test fixture is disabled when it is unavailable-- by :user:
musicinybrain.Related issues and pull requests on GitHub:
:issue:
11363.Added
riscv64build to releases -- by :user:eshattow.Related issues and pull requests on GitHub:
:issue:
11425.Contributor-facing changes
Fixed
test_send_compress_textfailing when alternative zlib implementationis used. (
zlib-ngin python 3.14 windows build) -- by :user:Cycloctane.Related issues and pull requests on GitHub:
:issue:
11546.v3.12.15Compare Source
====================
Bug fixes
Fixed :class:
~aiohttp.DigestAuthMiddlewareto preserve the algorithm case from the server's challenge in the authorization response. This improves compatibility with servers that perform case-sensitive algorithm matching (e.g., servers expectingalgorithm=MD5-sessinstead ofalgorithm=MD5-SESS)-- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
11352.Improved documentation
Remove outdated contents of
aiohttp-devtoolsandaiohttp-swaggerfrom Web_advanced docs.
-- by :user:
CycloctaneRelated issues and pull requests on GitHub:
:issue:
11347.Packaging updates and notes for downstreams
Started including the
llhttp:file:LICENSEfile in wheels by addingvendor/llhttp/LICENSEtolicense-filesin :file:setup.cfg-- by :user:threexc.Related issues and pull requests on GitHub:
:issue:
11226.Contributor-facing changes
Updated a regex in
test_aiohttp_request_coroutinefor Python 3.14.Related issues and pull requests on GitHub:
:issue:
11271.v3.12.14Compare Source
====================
Bug fixes
Fixed file uploads failing with HTTP 422 errors when encountering 307/308 redirects, and 301/302 redirects for non-POST methods, by preserving the request body when appropriate per :rfc:
9110#section-15.4.3-3.1-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11270.Fixed :py:meth:
ClientSession.close() <aiohttp.ClientSession.close>hanging indefinitely when using HTTPS requests through HTTP proxies -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11273.Bumped minimum version of aiosignal to 1.4+ to resolve typing issues -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11280.Features
Added initial trailer parsing logic to Python HTTP parser -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11269.Improved documentation
Clarified exceptions raised by
WebSocketResponse.send_frameet al.-- by :user:
DoctorJohn.Related issues and pull requests on GitHub:
:issue:
11234.v3.12.13Compare Source
====================
Bug fixes
Fixed auto-created :py:class:
~aiohttp.TCPConnectornot using the session's event loop when :py:class:~aiohttp.ClientSessionis created without an explicit connector -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11147.v3.12.12Compare Source
====================
Bug fixes
Fixed cookie unquoting to properly handle octal escape sequences in cookie values (e.g.,
\012for newline) by vendoring the correct_unquoteimplementation from Python'shttp.cookiesmodule -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11173.Fixed
Cookieheader parsing to treat attribute names as regular cookies per :rfc:6265#section-5.4-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11178.v3.12.11Compare Source
====================
Features
Improved SSL connection handling by changing the default
ssl_shutdown_timeoutfrom
0.1to0seconds. SSL connections now use Python's default gracefulshutdown during normal operation but are aborted immediately when the connector
is closed, providing optimal behavior for both cases. Also added support for
ssl_shutdown_timeout=0on all Python versions. Previously, this value wasrejected on Python 3.11+ and ignored on earlier versions. Non-zero values on
Python < 3.11 now trigger a
RuntimeWarning-- by :user:bdraco.The
ssl_shutdown_timeoutparameter is now deprecated and will be removed inaiohttp 4.0 as there is no clear use case for changing the default.
Related issues and pull requests on GitHub:
:issue:
11148.Deprecations (removal in next major release)
Improved SSL connection handling by changing the default
ssl_shutdown_timeoutfrom
0.1to0seconds. SSL connections now use Python's default gracefulshutdown during normal operation but are aborted immediately when the connector
is closed, providing optimal behavior for both cases. Also added support for
ssl_shutdown_timeout=0on all Python versions. Previously, this value wasrejected on Python 3.11+ and ignored on earlier versions. Non-zero values on
Python < 3.11 now trigger a
RuntimeWarning-- by :user:bdraco.The
ssl_shutdown_timeoutparameter is now deprecated and will be removed inaiohttp 4.0 as there is no clear use case for changing the default.
Related issues and pull requests on GitHub:
:issue:
11148.v3.12.10Compare Source
====================
Bug fixes
Fixed leak of
aiodns.DNSResolverwhen :py:class:~aiohttp.TCPConnectoris closed and no resolver was passed when creating the connector -- by :user:Tasssadar.This was a regression introduced in version 3.12.0 (:pr:
10897).Related issues and pull requests on GitHub:
:issue:
11150.v3.12.9Compare Source
===================
Bug fixes
Fixed
IOBasePayloadandTextIOPayloadreading entire files into memory when streaming large files -- by :user:bdraco.When using file-like objects with the aiohttp client, the entire file would be read into memory if the file size was provided in the
Content-Lengthheader. This could cause out-of-memory errors when uploading large files. The payload classes now correctly read data in chunks ofREAD_SIZE(64KB) regardless of the total content length.Related issues and pull requests on GitHub:
:issue:
11138.v3.12.8Compare Source
===================
Features
Added preemptive digest authentication to :class:
~aiohttp.DigestAuthMiddleware-- by :user:bdraco.The middleware now reuses authentication credentials for subsequent requests to the same
protection space, improving efficiency by avoiding extra authentication round trips.
This behavior matches how web browsers handle digest authentication and follows
:rfc:
7616#section-3.6.Preemptive authentication is enabled by default but can be disabled by passing
preemptive=Falseto the middleware constructor.Related issues and pull requests on GitHub:
:issue:
11128, :issue:11129.v3.12.7Compare Source
===================
.. warning::
This release fixes an issue where the
quote_cookieparameter was not being properlyrespected for shared cookies (domain="", path=""). If your server does not handle quoted
cookies correctly, you may need to disable cookie quoting by setting
quote_cookie=Falsewhen creating your :class:
~aiohttp.ClientSessionor :class:~aiohttp.CookieJar.See :ref:
aiohttp-client-cookie-quoting-routinefor details.Bug fixes
Fixed cookie parsing to be more lenient when handling cookies with special characters
in names or values. Cookies with characters like
{,}, and/in names are nowaccepted instead of causing a :exc:
~http.cookies.CookieErrorand 500 errors. Additionally,cookies with mismatched quotes in values are now parsed correctly, and quoted cookie
values are now handled consistently whether or not they include special attributes
like
Domain. Also fixed :class:~aiohttp.CookieJarto ensure shared cookies (domain="", path="")respect the
quote_cookieparameter, making cookie quoting behavior consistent forall cookies -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
2683, :issue:5397, :issue:7993, :issue:11112.Fixed an issue where cookies with duplicate names but different domains or paths
were lost when updating the cookie jar. The :class:
~aiohttp.ClientSessioncookie jar now correctly stores all cookies even if they have the same name but
different domain or path, following the :rfc:
6265#section-5.3storage model -- by :user:bdraco.Note that :attr:
ClientResponse.cookies <aiohttp.ClientResponse.cookies>returnsa :class:
~http.cookies.SimpleCookiewhich uses the cookie name as a key, soonly the last cookie with each name is accessible via this interface. All cookies
can be accessed via :meth:
ClientResponse.headers.getall('Set-Cookie') <multidict.MultiDictProxy.getall>if needed.Related issues and pull requests on GitHub:
:issue:
4486, :issue:11105, :issue:11106.Miscellaneous internal changes
Avoided creating closed futures in
ResponseHandlerthat will never be awaited -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11107.Downgraded the logging level for connector close errors from ERROR to DEBUG, as these are expected behavior with TLS 1.3 connections -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
11114.v3.12.6Compare Source
===================
Bug fixes
Fixed spurious "Future exception was never retrieved" warnings for connection lost errors when the connector is not closed -- by :user:
bdraco.When connections are lost, the exception is now marked as retrieved since it is always propagated through other means, preventing unnecessary warnings in logs.
Related issues and pull requests on GitHub:
:issue:
11100.v3.12.4Compare Source
===================
Bug fixes
Fixed connector not waiting for connections to close before returning from :meth:
~aiohttp.BaseConnector.close(partial backport of :pr:3733) -- by :user:atemateand :user:bdraco.Related issues and pull requests on GitHub:
:issue:
1925, :issue:11074.v3.12.3Compare Source
===================
Bug fixes
Fixed memory leak in :py:meth:
~aiohttp.CookieJar.filter_cookiesthat caused unbounded memory growthwhen making requests to different URL paths -- by :user:
bdracoand :user:Cycloctane.Related issues and pull requests on GitHub:
:issue:
11052, :issue:11054.v3.12.2Compare Source
===================
Bug fixes
Fixed
Content-Lengthheader not being set to0for non-GET requests withNonebody -- by :user:bdraco.Non-GET requests (
POST,PUT,PATCH,DELETE) withNoneas the body now correctly set theContent-Lengthheader to0, matching the behavior of requests with empty bytes (b""). This regression was introduced in aiohttp 3.12.1.Related issues and pull requests on GitHub:
:issue:
11035.v3.12.1Compare Source
====================
Bug fixes
Fixed :class:
~aiohttp.DigestAuthMiddlewareto preserve the algorithm case from the server's challenge in the authorization response. This improves compatibility with servers that perform case-sensitive algorithm matching (e.g., servers expectingalgorithm=MD5-sessinstead ofalgorithm=MD5-SESS)-- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
11352.Improved documentation
Remove outdated contents of
aiohttp-devtoolsandaiohttp-swaggerfrom Web_advanced docs.
-- by :user:
CycloctaneRelated issues and pull requests on GitHub:
:issue:
11347.Packaging updates and notes for downstreams
Started including the
llhttp:file:LICENSEfile in wheels by addingvendor/llhttp/LICENSEtolicense-filesin :file:setup.cfg-- by :user:threexc.Related issues and pull requests on GitHub:
:issue:
11226.Contributor-facing changes
Updated a regex in
test_aiohttp_request_coroutinefor Python 3.14.Related issues and pull requests on GitHub:
:issue:
11271.v3.12.0Compare Source
===================
Bug fixes
Fixed :py:attr:
~aiohttp.web.WebSocketResponse.preparedproperty to correctly reflect the prepared state, especially during timeout scenarios -- by :user:bdracoRelated issues and pull requests on GitHub:
:issue:
6009, :issue:10988.Response is now always True, instead of using MutableMapping behaviour (False when map is empty)
Related issues and pull requests on GitHub:
:issue:
10119.Fixed connection reuse for file-like data payloads by ensuring buffer
truncation respects content-length boundaries and preventing premature
connection closure race -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10325, :issue:10915, :issue:10941, :issue:10943.Fixed pytest plugin to not use deprecated :py:mod:
asynciopolicy APIs.Related issues and pull requests on GitHub:
:issue:
10851.Fixed :py:class:
~aiohttp.resolver.AsyncResolvernot using theloopargument in versions 3.x where it should still be supported -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10951.Features
Added a comprehensive HTTP Digest Authentication client middleware (DigestAuthMiddleware)
that implements RFC 7616. The middleware supports all standard hash algorithms
(MD5, SHA, SHA-256, SHA-512) with session variants, handles both 'auth' and
'auth-int' quality of protection options, and automatically manages the
authentication flow by intercepting 401 responses and retrying with proper
credentials -- by :user:
feus4177, :user:TimMenninger, and :user:bdraco.Related issues and pull requests on GitHub:
:issue:
2213, :issue:10725.Added client middleware support -- by :user:
bdracoand :user:Dreamsorcerer.This change allows users to add middleware to the client session and requests, enabling features like
authentication, logging, and request/response modification without modifying the core
request logic. Additionally, the
sessionattribute was added toClientRequest,allowing middleware to access the session for making additional requests.
Related issues and pull requests on GitHub:
:issue:
9732, :issue:10902, :issue:10945, :issue:10952, :issue:10959, :issue:10968.Allow user setting zlib compression backend -- by :user:
TimMenningerThis change allows the user to call :func:
aiohttp.set_zlib_backend()with thezlib compression module of their choice. Default behavior continues to use
the builtin
zliblibrary.Related issues and pull requests on GitHub:
:issue:
9798.Added support for overriding the base URL with an absolute one in client sessions
-- by :user:
vivodi.Related issues and pull requests on GitHub:
:issue:
10074.Added
hostparameter toaiohttp_serverfixture -- by :user:christianwbrock.Related issues and pull requests on GitHub:
:issue:
10120.Detect blocking calls in coroutines using BlockBuster -- by :user:
cbornet.Related issues and pull requests on GitHub:
:issue:
10433.Added
socket_factoryto :py:class:aiohttp.TCPConnectorto allow specifying custom socket options-- by :user:
TimMenninger.Related issues and pull requests on GitHub:
:issue:
10474, :issue:10520, :issue:10961, :issue:10962.Started building armv7l manylinux wheels -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10797.Implemented shared DNS resolver management to fix excessive resolver object creation
when using multiple client sessions. The new
_DNSResolverManagersingleton ensuresonly one
DNSResolverobject is created for default configurations, significantlyreducing resource usage and improving performance for applications using multiple
client sessions simultaneously -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10847, :issue:10923, :issue:10946.Upgraded to LLHTTP 9.3.0 -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
10972.Optimized small HTTP requests/responses by coalescing headers and body into a single TCP packet -- by :user:
bdraco.This change enhances network efficiency by reducing the number of packets sent for small HTTP payloads, improving latency and reducing overhead. Most importantly, this fixes compatibility with memory-constrained IoT devices that can only perform a single read operation and expect HTTP requests in one packet. The optimization uses zero-copy
writelineswhen coalescing data and works with both regular and chunked transfer encoding.When
aiohttpuses client middleware to communicate with anaiohttpserver, connection reuse is more likely to occur since complete responses arrive in a single packet for small payloads.This aligns
aiohttpwith other popular HTTP clients that already coalesce small requests.Related issues and pull requests on GitHub:
:issue:
10991.Improved documentation
Improved documentation for middleware by adding warnings and examples about
request body stream consumption. The documentation now clearly explains that
request body streams can only be read once and provides best practices for
sharing parsed request data between middleware and handlers -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
2914.Packaging updates and notes for downstreams
Removed non SPDX-license description from
setup.cfg-- by :user:devanshu-ziphq.Related issues and pull requests on GitHub:
:issue:
10662.Added support for building against system
llhttplibrary -- by :user:mgorny.This change adds support for :envvar:
AIOHTTP_USE_SYSTEM_DEPSenvironment variable thatcan be used to build aiohttp against the system install of the
llhttplibrary ratherthan the vendored one.
Related issues and pull requests on GitHub:
:issue:
10759.aiodnsis now installed on Windows with speedups extra -- by :user:bdraco.As of
aiodns3.3.0,SelectorEventLoopis no longer required when usingpycares4.7.0 or later.Related issues and pull requests on GitHub:
:issue:
10823.Fixed compatibility issue with Cython 3.1.1 -- by :user:
bdracoRelated issues and pull requests on GitHub:
:issue:
10877.Contributor-facing changes
Sped up tests by disabling
blockbusterfixture fortest_static_file_hugeandtest_static_file_huge_canceltests -- by :user:dikos1337.Related issues and pull requests on GitHub:
:issue:
9705, :issue:10761.Updated tests to avoid using deprecated :py:mod:
asynciopolicy APIs andmake it compatible with Python 3.14.
Related issues and pull requests on GitHub:
:issue:
10851.Added Winloop to test suite to support in the future -- by :user:
Vizonex.Related issues and pull requests on GitHub:
:issue:
10922.Miscellaneous internal changes
Added support for the
partitionedattribute in theset_cookiemethod.Related issues and pull requests on GitHub:
:issue:
9870.Setting :attr:
aiohttp.web.StreamResponse.last_modifiedto an unsupported type will now raise :exc:TypeErrorinstead of silently failing -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10146.v3.11.18Compare Source
====================
Bug fixes
Disabled TLS in TLS warning (when using HTTPS proxies) for uvloop and newer Python versions -- by :user:
lezgomatt.Related issues and pull requests on GitHub:
:issue:
7686.Fixed reading fragmented WebSocket messages when the payload was masked -- by :user:
bdraco.The problem first appeared in 3.11.17
Related issues and pull requests on GitHub:
:issue:
10764.v3.11.17Compare Source
====================
Miscellaneous internal changes
Optimized web server performance when access logging is disabled by reducing time syscalls -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10713.Improved web server performance when connection can be reused -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10714.Improved performance of the WebSocket reader -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10740.Improved performance of the WebSocket reader with large messages -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10744.v3.11.16Compare Source
====================
Bug fixes
Replaced deprecated
asyncio.iscoroutinefunctionwith its counterpart frominspect-- by :user:
layday.Related issues and pull requests on GitHub:
:issue:
10634.Fixed :class:
multidict.CIMultiDictbeing mutated when passed to :class:aiohttp.web.Response-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10672.v3.11.15Compare Source
====================
Bug fixes
Reverted explicitly closing sockets if an exception is raised during
create_connection-- by :user:bdraco.This change originally appeared in aiohttp 3.11.13
Related issues and pull requests on GitHub:
:issue:
10464, :issue:10617, :issue:10656.Miscellaneous internal changes
Improved performance of WebSocket buffer handling -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10601.Improved performance of serializing headers -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10625.Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.
54a99b43f8to6bb13ad3706bb13ad370to50f5c2c8aa50f5c2c8aato7c1d8cc1577c1d8cc157to352bb2c6ad352bb2c6adtobf32eb7fe6bf32eb7fe6tob6a3ec7707b6a3ec7707to88e9f56eea88e9f56eeatoa1509d2cd4a1509d2cd4to9d255fea099d255fea09to7699f695327699f69532to512a9beb9b512a9beb9btoec27e34cb9ec27e34cb9to43397a454f43397a454fto0c05a88d470c05a88d47to5238e202215238e20221to9c4a7ca4ff9c4a7ca4ffto3b3b7cbae53b3b7cbae5toa562a60d20a562a60d20to0252433f550252433f55tocf8e874066cf8e874066tobdc4af7387bdc4af7387to7e69c7e1137e69c7e113tof8b3dffc65f8b3dffc65to08944b9a9108944b9a91to76eeaa881176eeaa8811to131b95ef0a131b95ef0ato938f283c96938f283c96toeb0bc2f846eb0bc2f846to2579be3fac2579be3factoebc64ca0ceebc64ca0cetoe51450935be51450935btoc80045b62dc80045b62dto32961c351c32961c351cto5554c413075554c41307tob1c3901e91b1c3901e91toe1002ac451e1002ac451to0499712ad5chore(deps): Update Python dependenciesto chore(deps): Update dependency aiohttp to v3.13.30499712ad5toae4c006335ae4c006335to35eab669bdchore(deps): Update dependency aiohttp to v3.13.3to chore(deps): Update Python dependencies35eab669bdtofd25ebbc08fd25ebbc08toa054ec6080a054ec6080to53fdcac10953fdcac109to766de27075View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.