start new dev branch; add audit file

.audit/oberstet_fix_1999.md

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the project's AI_POLICY.md when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2026-10-18
+Related issue(s): #1999
+Branch: oberstet:fix_1999

docs/changelog.rst

@@ -5,8 +5,17 @@
 Changelog
 =========
 
-26.9.1
-------
+26.10.1
+-------
+
+**General**
+
+* Load the vendored FlatBuffers runtime only when a FlatBuffers message is first built or parsed, instead of on every ``import autobahn``. The runtime imports numpy whenever numpy is installed, so up to 26.7.1 every process importing autobahn also loaded numpy, including WebSocket-only users such as Django Channels applications served by Daphne. Every autobahn import now needs about 13-17 MB less memory on CPython and 18-24 MB less on PyPy, and none loads numpy. A new documentation page (``docs/memory-footprint.rst``, ``just memory-footprint``) shows the import memory footprint per release on CPython and PyPy (#1983)
+
+**Wheels**
+
+* Publish native Windows ARM64 (``win_arm64``) wheels with NVX for CPython 3.11-3.14, built on GitHub's ``windows-11-arm`` runners (PyPy publishes no Windows ARM64 interpreter); thanks to @ndabas. ``cryptography`` currently publishes no ``win_arm64`` wheel, so the build compiles it against an OpenSSL from vcpkg (#1937, #1945)
+* Build ``cryptography`` against an OpenSSL from vcpkg on Windows x86_64 too: ``cryptography`` 50.0.2 publishes its Windows PyPy wheels for PyPy 8 (``pp80``) only, and the ``pypy311`` wheel build uses PyPy 7.3 (``pp73``), so pip builds it from source there (#1959)
 
 **WebSocket**
 
@@ -23,6 +32,10 @@ Changelog
 * Remove the opt-in entropy depletion tests (``autobahn/test/test_rng.py``, enabled by ``AUTOBAHN_CI_ENABLE_RNG_DEPLETION_TESTS``, never run in CI): they read ``/proc/sys/kernel/random/entropy_avail``, which has been a constant 256 since Linux 5.18, and ``/dev/random`` no longer blocks since Linux 5.6, so one test passed whatever happened and the other always failed (#1278)
 * Build the ARM64 Linux wheels natively on GitHub's ``ubuntu-24.04-arm`` runners instead of under QEMU emulation on x86_64 runners, as zlmdb does since #183. Under emulation the builds took around 40 minutes (up to 96) and segfaulted intermittently, so each build had 9 attempts of 120 minutes; the same container images and build script are used, and a build attempt now gets 60 minutes and 3 tries (#1940)
 * Build the bundled ``flatc`` on all cores: ``hatch_build.py`` ran ``cmake --build`` without ``--parallel``, so ``flatc`` was compiled on one core in every wheel build, editable install and ``just test-*`` run. It now passes ``--parallel <os.cpu_count()>``; an explicit ``CMAKE_BUILD_PARALLEL_LEVEL`` in the environment still wins. Measured on a 32-core host: 237 s serial, 25 s with 16 jobs. Skipping the build when ``flatc``'s inputs did not change is still open (#1985)
+* Install ``patchelf`` with pip, next to ``auditwheel``, in the custom PyPy ARM64 build images: Debian's ``patchelf`` 0.14.3 is older than the 0.14.5 that current ``auditwheel repair`` requires (#1941)
+* Remove dead code reported by ``ty`` (an unused ``_unique_list`` helper in both ``component.py`` modules, and an unreachable response-body block in the WebSocket server opening handshake) instead of adding it to the ignore list (#1938)
+* Adopt the WAMP fleet's shared developer workflow recipes from wamp-cicd (``just where``, ``what``, ``new-branch``, ``land``, ...); the release upload recipe ``publish`` is renamed ``publish-release`` (#1943)
+* Apply the fleet's shared ``python-package`` and ``way-a`` aspects (repository files kept in sync from wamp-cicd, with generated ``aspects.toml``), and bump ``.cicd`` accordingly (#1960, #1972, #1975, #1977, #1979, #1981)
 * Add an ``import-smoke-lowest`` CI job (``just test-imports-lowest``) that runs the import smoke test on CPython 3.11 with every direct dependency resolved to the lowest version ``pyproject.toml`` allows (``uv --resolution lowest-direct``), so stale version floors are caught. The import smoke test now also covers the Twisted and asyncio bindings, each module imported in a fresh interpreter (#1955)
 
 **asyncio**

docs/memory-footprint.rst

@@ -57,7 +57,8 @@ so for a child of a Python process it never drops below that parent's size.)
   hence "n/a".
 * Columns: **25.10.2** is the last release with FlatBuffers as an optional
   dependency, measured *without* that extra (as Daphne installs it). **26.7.1** is the
-  latest release. The last column is the current development version.
+  last release that loaded the FlatBuffers runtime on import. **26.10.1** loads it on
+  first use (#1983).
 
 .. |crossbar_version| replace:: 26.7.1
 
@@ -82,12 +83,12 @@ venvs use numpy 2.4.x, the last numpy release with PyPy wheels.
 Findings
 --------
 
-* **This change:** every row that imports autobahn drops by about 13-17 MB on
+* **26.10.1:** every row that imports autobahn drops by about 13-17 MB on
   CPython, and by about 18-24 MB on PyPy, and none of them loads numpy any more. For
-  example, ``from daphne.server import Server`` drops from 64.6 MB to 51.6 MB on CPython
+  example, ``from daphne.server import Server`` drops from 64.8 MB to 51.8 MB on CPython
   3.14, and ``import autobahn`` alone is back to the size of the bare interpreter.
-* **Compared with 25.10.2:** the WebSocket and WAMP rows remain about 1.3-1.6 MB above
-  25.10.2 on CPython (about 0.4-0.8 MB on PyPy). In 25.10.2 without the ``serialization``
+* **Compared with 25.10.2:** the WebSocket and WAMP rows remain about 1.2-1.6 MB above
+  25.10.2 on CPython (about 0.5-0.6 MB on PyPy). In 25.10.2 without the ``serialization``
   extra, cbor2 was not installed and the WAMP message module skipped that import. Since
   26.x, cbor2 is a regular dependency.
 * **WebSocket only:** with Twisted, most of what remains is Twisted itself; with

docs/memory-footprint/cpy314-versions.inc

@@ -1,7 +1,7 @@
 * **25.10.2** (venv): autobahn 25.10.2, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.5.4, daphne 4.2.3
 * **26.7.1** (venv): autobahn 26.7.1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.5.4, cbor2 6.1.5, daphne 4.2.3
-* **26.7.1** (crossbar venv): autobahn 26.7.1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.5.4, cbor2 6.1.5, crossbar 26.7.1, zlmdb 26.7.1
-* **fix_1983** (venv): autobahn 26.10.1.dev1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.5.4, cbor2 6.1.5, daphne 4.2.3
-* **fix_1983** (crossbar venv): autobahn 26.10.1.dev1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.5.4, cbor2 6.1.5, crossbar 26.7.1, zlmdb 26.7.1
+* **26.7.1** (crossbar venv): autobahn 26.7.1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.5.4, cbor2 6.1.5, crossbar 26.7.1, zlmdb 26.10.1
+* **26.10.1** (venv): autobahn 26.10.1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.5.4, cbor2 6.1.5, daphne 4.2.3
+* **26.10.1** (crossbar venv): autobahn 26.10.1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.5.4, cbor2 6.1.5, crossbar 26.7.1, zlmdb 26.10.1
 
 Interpreter: ``CPython 3.14.7`` (3.14.7 (main, Sep 1 2026, 14:18:09) [Clang 22.1.3 ]); Linux 6.12.95+deb12-amd64 x86_64, median of 5 runs.

docs/memory-footprint/cpy314.inc

@@ -6,84 +6,84 @@
      - import
      - 25.10.2
      - 26.7.1
-     - fix_1983
+     - 26.10.1
    * - interpreter
      - ``bare interpreter``
-     - 11.9 MB
-     - 11.9 MB
+     - 12.0 MB
+     - 12.0 MB
      - 12.0 MB
    * - cryptography
      - ``import cryptography``
      - 12.0 MB
      - 12.0 MB
-     - 11.9 MB
+     - 12.1 MB
    * -
      - ``from cryptography.hazmat.primitives import hashes``
+     - 20.0 MB
      - 19.9 MB
      - 19.9 MB
-     - 19.8 MB
    * - numpy
      - ``import numpy``
-     - 28.4 MB †
-     - 28.4 MB †
-     - 28.4 MB †
+     - 28.5 MB †
+     - 28.5 MB †
+     - 28.6 MB †
    * - asyncio
      - ``import asyncio``
-     - 18.1 MB
+     - 18.2 MB
      - 18.2 MB
      - 18.2 MB
    * - twisted
      - ``from twisted.internet import reactor``
-     - 43.3 MB
-     - 43.3 MB
-     - 43.4 MB
+     - 43.5 MB
+     - 43.5 MB
+     - 43.5 MB
    * - txaio
      - ``import txaio``
-     - 12.0 MB
+     - 12.1 MB
      - 12.1 MB
      - 12.1 MB
    * -
      - ``import txaio; txaio.use_asyncio()``
      - 18.3 MB
      - 18.3 MB
-     - 18.3 MB
+     - 18.4 MB
    * -
      - ``import txaio; txaio.use_twisted()``
-     - 26.5 MB
-     - 26.5 MB
-     - 26.5 MB
+     - 26.6 MB
+     - 26.6 MB
+     - 26.6 MB
    * - autobahn
      - ``import autobahn``
      - 12.1 MB
-     - 28.8 MB †
-     - 12.0 MB
+     - 28.9 MB †
+     - 12.1 MB
    * -
      - ``txaio.use_asyncio(); import autobahn.wamp``
-     - 31.9 MB
-     - 47.6 MB †
-     - 33.2 MB
+     - 32.0 MB
+     - 47.8 MB †
+     - 33.3 MB
    * -
      - ``txaio.use_twisted(); import autobahn.wamp``
-     - 38.4 MB
+     - 38.6 MB
      - 52.9 MB †
-     - 39.8 MB
+     - 39.9 MB
    * -
      - ``import autobahn.asyncio.websocket``
      - 36.3 MB
-     - 51.1 MB †
-     - 37.8 MB
+     - 51.2 MB †
+     - 38.0 MB
    * -
      - ``import autobahn.twisted.websocket``
-     - 48.9 MB
-     - 63.2 MB †
-     - 50.3 MB
+     - 49.0 MB
+     - 63.3 MB †
+     - 50.4 MB
    * - daphne
      - ``from daphne.server import Server``
-     - 50.3 MB
-     - 64.6 MB †
-     - 51.6 MB
+     - 50.4 MB
+     - 64.8 MB †
+     - 51.8 MB
    * - crossbar
      - ``from crossbar.edge.worker.router import ExtRouterController``
      - n/a
-     - 144.7 MB †
-     - 144.7 MB †
+     - 145.2 MB †
+     - 145.2 MB †

docs/memory-footprint/pypy311-versions.inc

@@ -1,7 +1,7 @@
 * **25.10.2** (venv): autobahn 25.10.2, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.4.6, daphne 4.2.3
 * **26.7.1** (venv): autobahn 26.7.1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.4.6, cbor2 6.1.5, daphne 4.2.3
 * **26.7.1** (crossbar venv): autobahn 26.7.1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.4.6, cbor2 6.1.5, crossbar 26.7.1, zlmdb 26.7.1
-* **fix_1983** (venv): autobahn 26.10.1.dev1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.4.6, cbor2 5.9.0, daphne 4.2.3
-* **fix_1983** (crossbar venv): autobahn 26.10.1.dev1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.4.6, cbor2 5.9.0, crossbar 26.7.1, zlmdb 26.7.1
+* **26.10.1** (venv): autobahn 26.10.1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.4.6, cbor2 5.9.0, daphne 4.2.3
+* **26.10.1** (crossbar venv): autobahn 26.10.1, txaio 26.6.1, twisted 26.4.0, cryptography 50.0.2, numpy 2.4.6, cbor2 5.9.0, crossbar 26.7.1, zlmdb 26.10.1
 
 Interpreter: ``PyPy 3.11.15`` (3.11.15 (194f9f44b505, May 25 2026, 19:34:11) [PyPy 7.3.23 with GCC 10.2.1 20210130 (Red Hat 10.2.1-11)]); Linux 6.12.95+deb12-amd64 x86_64, median of 5 runs.

docs/memory-footprint/pypy311.inc

@@ -6,84 +6,84 @@
      - import
      - 25.10.2
      - 26.7.1
-     - fix_1983
+     - 26.10.1
    * - interpreter
      - ``bare interpreter``
-     - 64.4 MB
-     - 64.4 MB
-     - 64.4 MB
+     - 65.0 MB
+     - 64.9 MB
+     - 64.9 MB
    * - cryptography
      - ``import cryptography``
-     - 64.3 MB
-     - 64.4 MB
-     - 64.4 MB
+     - 64.9 MB
+     - 65.0 MB
+     - 65.0 MB
    * -
      - ``from cryptography.hazmat.primitives import hashes``
-     - 72.1 MB
-     - 72.0 MB
-     - 72.0 MB
+     - 72.5 MB
+     - 72.7 MB
+     - 72.7 MB
    * - numpy
      - ``import numpy``
-     - 88.1 MB †
-     - 88.1 MB †
-     - 88.2 MB †
+     - 88.9 MB †
+     - 88.8 MB †
+     - 88.8 MB †
    * - asyncio
      - ``import asyncio``
-     - 78.7 MB
-     - 78.9 MB
-     - 78.8 MB
+     - 79.5 MB
+     - 79.5 MB
+     - 79.4 MB
    * - twisted
      - ``from twisted.internet import reactor``
-     - 106.1 MB
-     - 106.1 MB
-     - 106.1 MB
+     - 106.8 MB
+     - 106.8 MB
+     - 106.8 MB
    * - txaio
      - ``import txaio``
-     - 64.4 MB
-     - 64.4 MB
-     - 64.2 MB
+     - 65.0 MB
+     - 65.0 MB
+     - 65.0 MB
    * -
      - ``import txaio; txaio.use_asyncio()``
-     - 79.0 MB
-     - 79.0 MB
-     - 79.1 MB
+     - 79.8 MB
+     - 79.7 MB
+     - 79.8 MB
    * -
      - ``import txaio; txaio.use_twisted()``
-     - 88.0 MB
-     - 87.9 MB
-     - 88.0 MB
+     - 88.7 MB
+     - 88.7 MB
+     - 88.8 MB
    * - autobahn
      - ``import autobahn``
-     - 64.4 MB
-     - 87.9 MB †
-     - 64.4 MB
+     - 64.9 MB
+     - 88.7 MB †
+     - 65.0 MB
    * -
      - ``txaio.use_asyncio(); import autobahn.wamp``
-     - 93.0 MB
-     - 112.4 MB †
-     - 93.7 MB
+     - 93.8 MB
+     - 113.0 MB †
+     - 94.4 MB
    * -
      - ``txaio.use_twisted(); import autobahn.wamp``
-     - 100.1 MB
-     - 118.8 MB †
-     - 100.5 MB
+     - 100.8 MB
+     - 119.7 MB †
+     - 101.3 MB
    * -
      - ``import autobahn.asyncio.websocket``
-     - 98.4 MB
-     - 117.2 MB †
-     - 99.0 MB
+     - 99.1 MB
+     - 117.9 MB †
+     - 99.8 MB
    * -
      - ``import autobahn.twisted.websocket``
-     - 113.2 MB
-     - 133.5 MB †
-     - 113.8 MB
+     - 114.0 MB
+     - 134.4 MB †
+     - 114.6 MB
    * - daphne
      - ``from daphne.server import Server``
-     - 114.8 MB
-     - 135.8 MB †
      - 115.6 MB
+     - 136.5 MB †
+     - 116.3 MB
    * - crossbar
      - ``from crossbar.edge.worker.router import ExtRouterController``
      - n/a
-     - 239.5 MB †
-     - 224.1 MB †
+     - 240.6 MB †
+     - 216.5 MB †