This release updates the minimum required frequenz-channels version is updated
to v1.0.0-rc1. This is a breaking change, because the channels API has changed.
Upgrading
Follow the upgrading instructions from the new channel release: v1.0.0-rc1.
This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
Don't move comments along with delimiters, which could cause crashes (#4248)
Strengthen AST safety check to catch more unsafe changes to strings. Previous versions
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
Fix a bug where line-ranges exceeding the last code line would not work as expected
(#4273)
Performance
Fix catastrophic performance on docstrings that contain large numbers of leading tab
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
Note what happens when --check is used with --quiet (#4236)
This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
Don't move comments along with delimiters, which could cause crashes (#4248)
Strengthen AST safety check to catch more unsafe changes to strings. Previous versions
of Black would incorrectly format the contents of certain unusual f-strings containing
nested strings with the same quote type. Now, Black will crash on such strings until
support for the new f-string syntax is implemented. (#4270)
Fix a bug where line-ranges exceeding the last code line would not work as expected
(#4273)
Performance
Fix catastrophic performance on docstrings that contain large numbers of leading tab
characters. This fixes
CVE-2024-21503.
(#4278)
Documentation
Note what happens when --check is used with --quiet (#4236)
All postprocessors are now run on heading content.
Footnote references are now stripped from heading content. Fixes #660.
A more robust striptags is provided to convert headings to plain text.
Unlike, the markupsafe implementation, HTML entities are not unescaped.
The plain text name, rich html, and unescaped raw data-toc-label are
saved to toc_tokens, allowing users to access the full rich text content of
the headings directly from toc_tokens.
The value of data-toc-label is sanitized separate from heading content
before being written to name. This fixes a bug which allowed markup through
in certain circumstances. To access the raw unsanitized data, retrieve the
value from token['data-toc-label'] directly.
An html.unescape call is made just prior to calling slugify so that
slugify only operates on Unicode characters. Note that html.unescape is
not run on name, html, or data-toc-label.
The functions get_name and stashedHTML2text defined in the toc extension
are both deprecated. Instead, third party extensions should use some
combination of the new functions run_postprocessors, render_inner_html and
striptags.
Fixed
Include scripts/*.py in the generated source tarballs (#1430).
Ensure lines after heading in loose list are properly detabbed (#1443).
Give smarty tree processor higher priority than toc (#1440).
Permit carets (^) and square brackets (]) but explicitly exclude
backslashes (\) from abbreviations (#1444).
In attribute lists (attr_list, fenced_code), quoted attribute values are
now allowed to contain curly braces (}) (#1414).
All postprocessors are now run on heading content.
Footnote references are now stripped from heading content. Fixes #660.
A more robust striptags is provided to convert headings to plain text.
Unlike, the markupsafe implementation, HTML entities are not unescaped.
The plain text name, rich html, and unescaped raw data-toc-label are
saved to toc_tokens, allowing users to access the full rich text content of
the headings directly from toc_tokens.
The value of data-toc-label is sanitized separate from heading content
before being written to name. This fixes a bug which allowed markup through
in certain circumstances. To access the raw unsanitized data, retrieve the
value from token['data-toc-label'] directly.
An html.unescape call is made just prior to calling slugify so that
slugify only operates on Unicode characters. Note that html.unescape is
not run on name, html, or data-toc-label.
The functions get_name and stashedHTML2text defined in the toc extension
are both deprecated. Instead, third party extensions should use some
combination of the new functions run_postprocessors, render_inner_html and
striptags.
Fixed
Include scripts/*.py in the generated source tarballs (#1430).
Ensure lines after heading in loose list are properly detabbed (#1443).
Give smarty tree processor higher priority than toc (#1440).
Permit carets (^) and square brackets (]) but explicitly exclude
backslashes (\) from abbreviations (#1444).
In attribute lists (attr_list, fenced_code), quoted attribute values are
now allowed to contain curly braces (}) (#1414).
We’ve just uploaded mypy 1.9 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.
Breaking Changes
Because the version of typeshed we use in mypy 1.9 doesn't support 3.7, neither does mypy 1.9. (Jared Hance, PR 16883)
We are planning to enable
local partial types (enabled via the
--local-partial-types flag) later this year by default. This change
was announced years ago, but now it's finally happening. This is a
major backward-incompatible change, so we'll probably include it as
part of the upcoming mypy 2.0 release. This makes daemon and
non-daemon mypy runs have the same behavior by default.
Local partial types can also be enabled in the mypy config file:
local_partial_types = True
We are looking at providing a tool to make it easier to migrate
projects to use --local-partial-types, but it's not yet clear whether
this is practical. The migration usually involves adding some
explicit type annotations to module-level and class-level variables.
Basic Support for Type Parameter Defaults (PEP 696)
This release contains new experimental support for type parameter
defaults (PEP 696). Please try it
out! This feature was contributed by Marc Mueller.
Since this feature will be officially introduced in the next Python
feature release (3.13), you will need to import TypeVar, ParamSpec
or TypeVarTuple from typing_extensions to use defaults for now.
This example adapted from the PEP defines a default for BotT:
from typing import Generic
from typing_extensions import TypeVar
This release is not a usual bug fix release -- it contains features and improvements, being a follow up
to 8.1.0, which has been yanked from PyPI.
:::
Features
#11475: Added the new consider_namespace_packages{.interpreted-text role="confval"} configuration option, defaulting to False.
If set to True, pytest will attempt to identify modules that are part of namespace packages when importing modules.
#11653: Added the new verbosity_test_cases{.interpreted-text role="confval"} configuration option for fine-grained control of test execution verbosity.
See Fine-grained verbosity <pytest.fine_grained_verbosity>{.interpreted-text role="ref"} for more details.
Improvements
#10865: pytest.warns{.interpreted-text role="func"} now validates that warnings.warn{.interpreted-text role="func"} was called with a [str]{.title-ref} or a [Warning]{.title-ref}.
Currently in Python it is possible to use other types, however this causes an exception when warnings.filterwarnings{.interpreted-text role="func"} is used to filter those warnings (see [CPython #103577](python/cpython#103577) for a discussion).
While this can be considered a bug in CPython, we decided to put guards in pytest as the error message produced without this check in place is confusing.
#11311: When using --override-ini for paths in invocations without a configuration file defined, the current working directory is used
as the relative directory.
Previoulsy this would raise an AssertionError{.interpreted-text role="class"}.
#11475: --import-mode=importlib <import-mode-importlib>{.interpreted-text role="ref"} now tries to import modules using the standard import mechanism (but still without changing :pysys.path{.interpreted-text role="data"}), falling back to importing modules directly only if that fails.
This means that installed packages will be imported under their canonical name if possible first, for example app.core.models, instead of having the module name always be derived from their path (for example .env310.lib.site_packages.app.core.models).
#11801: Added the iter_parents() <_pytest.nodes.Node.iter_parents>{.interpreted-text role="func"} helper method on nodes.
It is similar to listchain <_pytest.nodes.Node.listchain>{.interpreted-text role="func"}, but goes from bottom to top, and returns an iterator, not a list.
#11850: Added support for sys.last_exc{.interpreted-text role="data"} for post-mortem debugging on Python>=3.12.
#11962: In case no other suitable candidates for configuration file are found, a pyproject.toml (even without a [tool.pytest.ini_options] table) will be considered as the configuration file and define the rootdir.
#11978: Add --log-file-mode option to the logging plugin, enabling appending to log-files. This option accepts either "w" or "a" and defaults to "w".
Previously, the mode was hard-coded to be "w" which truncates the file before logging.
#415: MockType and AsyncMockType can be imported from pytest_mock for type annotation purposes.
#420: Fixed a regression which would cause mocker.patch.object to not being properly cleared between tests.
v3.13.0
#417: spy now has spy_return_list, which is a list containing all the values returned by the spied function.
pytest-mock now requires pytest>=6.2.5.
#410: pytest-mock's setup.py file is removed.
If you relied on this file, e.g. to install pytest using setup.py install,
please see Why you shouldn't invoke setup.py directly for alternatives.
[#415](https://github.com/pytest-dev/pytest-mock/issues/415) <https://github.com/pytest-dev/pytest-mock/pull/415>_: MockType and AsyncMockType can be imported from pytest_mock for type annotation purposes.
[#420](https://github.com/pytest-dev/pytest-mock/issues/420) <https://github.com/pytest-dev/pytest-mock/issues/420>_: Fixed a regression which would cause mocker.patch.object to not being properly cleared between tests.
3.13.0 (2024-03-21)
[#417](https://github.com/pytest-dev/pytest-mock/issues/417) <https://github.com/pytest-dev/pytest-mock/pull/417>_: spy now has spy_return_list, which is a list containing all the values returned by the spied function.
pytest-mock now requires pytest>=6.2.5.
[#410](https://github.com/pytest-dev/pytest-mock/issues/410) <https://github.com/pytest-dev/pytest-mock/pull/410>: pytest-mock's setup.py file is removed.
If you relied on this file, e.g. to install pytest using setup.py install,
please see Why you shouldn't invoke setup.py directly <https://blog.ganssle.io/articles/2021/10/setup-py-deprecated.html#summary> for alternatives.
As of v0.23, pytest-asyncio attaches an asyncio event loop to each item of the test suite (i.e. session, packages, modules, classes, functions) and allows tests to be run in those loops when marked accordingly. Pytest-asyncio currently assumes that async fixture scope is correlated with the new event loop scope. This prevents fixtures from being evaluated independently from the event loop scope and breaks some existing test suites (see #706). For example, a test suite may require all fixtures and tests to run in the same event loop, but have async fixtures that are set up and torn down for each module. If you're affected by this issue, please continue using the v0.21 release, until it is resolved.
Fix typing errors with recent versions of mypy #769
Prevent DeprecationWarning about internal use of asyncio.get_event_loop() from affecting test cases #757
Known issues
As of v0.23, pytest-asyncio attaches an asyncio event loop to each item of the test suite (i.e. session, packages, modules, classes, functions) and allows tests to be run in those loops when marked accordingly. Pytest-asyncio currently assumes that async fixture scope is correlated with the new event loop scope. This prevents fixtures from being evaluated independently from the event loop scope and breaks some existing test suites (see #706). For example, a test suite may require all fixtures and tests to run in the same event loop, but have async fixtures that are set up and torn down for each module. If you're affected by this issue, please continue using the v0.21 release, until it is resolved.
Commits
c34da04 [docs] Mentioned pytest 8.2 compatibility fix in changelog.
143f745 Fix compatibility with pytest 8.2 FixtureDef.unittest removal
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
dependabot[bot]
commented
3 months ago
Updates the requirements on frequenz-client-base, black, markdown, mkdocs-material, mypy, types-markdown, pytest, pytest-mock, pytest-asyncio, async-solipsism and hypothesis to permit the latest version. Updates
frequenz-client-baseto 0.3.0Release notes
Sourced from frequenz-client-base's releases.
Commits
6230161Update minimumfrequenz-channelsversion tov1.0.0-rc1(#35)e21cc53Update RELEASE_NOTES.md and prepare for release v0.3.031de004Update minimumfrequenz-channelsversion to v1.0.0-rc197196bdClear release notes (#33)1c8d447Don't create nox sessions twice in cross-arch tests (#34)43584c4Don't create nox sessions twice in cross-arch tests5695429Clear release notesUpdates
blackfrom 24.2.0 to 24.3.0Release notes
Sourced from black's releases.
Changelog
Sourced from black's changelog.
Commits
552baf8Prepare release 24.3.0 (#4279)f000936Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)7b5a657Fix --line-ranges behavior when ranges are at EOF (#4273)1abcffcUse regex where we ignore case on windows (#4252)719e674Fix 4227: Improve documentation for --quiet --check (#4236)e5510afupdate plugin url for Thonny (#4259)6af7d11Fix AST safety check false negative (#4270)f03ee11Ensureblib2to3.pygramis initialized before use (#4224)e4bfedbfix: Don't move comments while splitting delimiters (#4248)d0287e1Make trailing comma logic more concise (#4202)Updates
markdownfrom 3.5.2 to 3.6Release notes
Sourced from markdown's releases.
Changelog
Sourced from markdown's changelog.
Commits
e524b8fBump version to 3.63d8afc6Allow attr_list quoted values to contain curly braces9edba85Refactor abbr escapinge4ab4a6Refactor TOC sanitationa18765cExplicitly omit carot and backslash from abbr421f1e8Give smarty tree processor higher priority than tocc334a3eEnsure lines after heading in loose list are properly detabbedea92856Update the license template so GitHub can detect ita2effd6Disable mkdocstrings show_symbol_type_toc option to work around searching iss...91f9a12Restore Attribute symbol type in mkdocstrings templateUpdates
mkdocs-materialfrom 9.5.12 to 9.5.16Release notes
Sourced from mkdocs-material's releases.
Changelog
Sourced from mkdocs-material's changelog.
... (truncated)
Commits
8956524Updated Insiders changelog0db4e66Updated changelog29cf44bImproved resilience of privacy plugin6c9ba87Prepare 9.5.16 releasef2bfab9Updated dependencies9e40207Updated dependenciesa2cb35dImproved error handling on social plugin (#6818)abfac1aSwitched to Babel'sformat_datetimeto allow for time in formatted dates (#...01b2dd1Updated Russian translationsad72336Fixed social plugin Google Fonts integrationUpdates
mypyfrom 1.8.0 to 1.9.0Changelog
Sourced from mypy's changelog.
... (truncated)
Commits
5ff46f8Remove +dev.155909a[Release 1.9] Unsupport targetting 3.7. (#16883) (#16900)6615cab[Release 1.9] Stubtest: ignore a new protocol dunder (#16895) (#16899)b956e6astubtest: Private parameters can be omitted (#16507)ede0b20Bump ruff to 0.2.0 (#16870)7bdd61fstubgen: Fix crash on star unpack of TypeVarTuple (#16869)8c2ef9dUpdate hashes in sync-typeshed.py following recent typeshed sync0dd4b6fRevert use ofParamSpecforfunctools.wrapsdd12a2dRevert typeshed ctypes changed132999Revert sum literal integer change (#13961)Updates
types-markdownfrom 3.5.0.20240129 to 3.6.0.20240316Commits
Updates
pytestfrom 8.0.2 to 8.1.1Release notes
Sourced from pytest's releases.
... (truncated)
Commits
81653eeAdjust changelog manually for 8.1.1e60b4b9Prepare release version 8.1.115fbe57[8.1.x] Revert legacy path removals (#12093)86c3aab[8.1.x] Do not import duplicated modules with --importmode=importlib (#12077)5b82b0c[8.1.x] Yank version 8.1.0 (#12076)0a53681Merge pull request #12054 from pytest-dev/release-8.1.0b9a167fPrepare release version 8.1.000043f7Merge pull request #12038 from bluetech/fixtures-rm-arg2indexf4e1025Merge pull request #12048 from bluetech/fixture-teardown-excgroup43492f5Merge pull request #12051 from jakkdl/test_debugging_pythonbreakpointUpdates
pytest-mockfrom 3.12.0 to 3.14.0Release notes
Sourced from pytest-mock's releases.
Changelog
Sourced from pytest-mock's changelog.
Commits
8733134Update CHANGELOG for 3.14.05257e3cRefactor MockCache to have a narrow interface4faf92aFix regression with mocker.patch not being undone correctly6bd8712Drop pre-Python 3.8 support code366966bExportMockType/AsyncMockTypefor type annotations (#415)852116bMerge pull request #418 from pytest-dev/release-3.13.0ef9461bAdd instructions on how to start deploy from command-line5b9d285Release 3.13.06d5d6dcImplementspy_return_list(#417)dc28a0e[pre-commit.ci] pre-commit autoupdate (#416)Updates
pytest-asynciofrom 0.23.5 to 0.23.6Release notes
Sourced from pytest-asyncio's releases.
Commits
c34da04[docs] Mentioned pytest 8.2 compatibility fix in changelog.143f745Fix compatibility with pytest 8.2 FixtureDef.unittest removal13d4b79Remove unused function_removesuffixcdd2c49UseFixtureRequestinstead ofSubRequestc3429faBuild(deps): Bump packaging from 23.2 to 24.0 in /dependencies/docs5f2338dBuild(deps): Bump pypa/gh-action-pypi-publish from 1.8.12 to 1.8.14726c6e0Build(deps): Bump coverage from 7.4.3 to 7.4.4 in /dependencies/default8bd8288Build(deps): Bump pytest from 8.0.2 to 8.1.1 in /dependencies/defaultef3b347Build(deps): Bump packaging from 23.2 to 24.0 in /dependencies/defaultb22d84e[docs] Fixes the example showing how to run all tests in a session-scoped loop.Updates
async-solipsismfrom 0.5 to 0.6Commits
462ababFix content-type for README3e011a7Add dist directory to .gitignore6398818Update README for 0.6 releasebec1263Bump version to 0.67ce816cMove package config into pyproject.toml2b5b163Run GHA on pull request tood47ed8cFix GHA (hopefully)a1495c3Generate requirements.txt with pip-compile448a203Improve compatibility with pytest-asyncio 0.23393e7b5Drop support for end-of-life Python versionsUpdates
hypothesisfrom 6.98.17 to 6.100.0Commits
6867da7Bump hypothesis-python version to 6.100.0 and update changelog77914f8Merge pull request #3946 from Zac-HD/numpy-nate6567e5some updates7295c14Allow excluding NaT15ae3c2Bump hypothesis-python version to 6.99.13 and update changelog95fde9cMerge pull request #3935 from Zac-HD/faster-coverage17296f0Another workaround for black067fc76Observe clearer status_reason2fda65fTest CrossHair backend in the CI9a8422cObserve backend in how_generatedDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show