[pull] master from aio-libs:master - #735
Merged
Merged
Conversation
Bumps [blockbuster](https://github.com/cbornet/blockbuster) from 1.5.26 to 1.5.27. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cbornet/blockbuster/releases">blockbuster's releases</a>.</em></p> <blockquote> <h2>v1.5.27</h2> <h2>What's Changed</h2> <ul> <li>Fix false positive for os.sendfile via asyncio sock_sendfile path by <a href="https://github.com/agners"><code>@agners</code></a> in <a href="https://redirect.github.com/cbornet/blockbuster/pull/58">cbornet/blockbuster#58</a></li> <li>Test Python 3.14 in CI by <a href="https://github.com/cbornet"><code>@cbornet</code></a> in <a href="https://redirect.github.com/cbornet/blockbuster/pull/64">cbornet/blockbuster#64</a></li> <li>Bump ruff to 0.16 by <a href="https://github.com/cbornet"><code>@cbornet</code></a> in <a href="https://redirect.github.com/cbornet/blockbuster/pull/65">cbornet/blockbuster#65</a></li> <li>Bump mypy to 2.3 by <a href="https://github.com/cbornet"><code>@cbornet</code></a> in <a href="https://redirect.github.com/cbornet/blockbuster/pull/66">cbornet/blockbuster#66</a></li> <li>Restore blocker patches after activation and context failures by <a href="https://github.com/dsfaccini"><code>@dsfaccini</code></a> in <a href="https://redirect.github.com/cbornet/blockbuster/pull/62">cbornet/blockbuster#62</a></li> <li>Avoid source inspection in blocking-call wrappers by <a href="https://github.com/dsfaccini"><code>@dsfaccini</code></a> in <a href="https://redirect.github.com/cbornet/blockbuster/pull/61">cbornet/blockbuster#61</a></li> <li>Add test that <code>blockbuster_skip</code> is task-local by <a href="https://github.com/dsfaccini"><code>@dsfaccini</code></a> in <a href="https://redirect.github.com/cbornet/blockbuster/pull/67">cbornet/blockbuster#67</a></li> <li>Add exemptions for coverage with branch measurement by <a href="https://github.com/cbornet"><code>@cbornet</code></a> in <a href="https://redirect.github.com/cbornet/blockbuster/pull/69">cbornet/blockbuster#69</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dsfaccini"><code>@dsfaccini</code></a> made their first contribution in <a href="https://redirect.github.com/cbornet/blockbuster/pull/62">cbornet/blockbuster#62</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cbornet/blockbuster/compare/v1.5.26...v1.5.27">https://github.com/cbornet/blockbuster/compare/v1.5.26...v1.5.27</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cbornet/blockbuster/commit/419cccc790cf3511946a1c2704e1da77e7b3324c"><code>419cccc</code></a> Add exemptions for coverage with branch measurement (<a href="https://redirect.github.com/cbornet/blockbuster/issues/69">#69</a>)</li> <li><a href="https://github.com/cbornet/blockbuster/commit/65c74b671b67091ba5a29e918a558b13659d46c8"><code>65c74b6</code></a> Add test that <code>blockbuster_skip</code> is task-local (<a href="https://redirect.github.com/cbornet/blockbuster/issues/67">#67</a>)</li> <li><a href="https://github.com/cbornet/blockbuster/commit/983589bc74ce7f97eabca7cff17cdd7c784497bd"><code>983589b</code></a> Bump version to 1.5.27 (<a href="https://redirect.github.com/cbornet/blockbuster/issues/68">#68</a>)</li> <li><a href="https://github.com/cbornet/blockbuster/commit/f18e48c165adf17080d3a20667f50f72219bb068"><code>f18e48c</code></a> Avoid source inspection in blocking-call wrappers (<a href="https://redirect.github.com/cbornet/blockbuster/issues/61">#61</a>)</li> <li><a href="https://github.com/cbornet/blockbuster/commit/5fd20385dfeb5bd470c252a08407a50e362f840f"><code>5fd2038</code></a> Restore blocker patches after activation and context failures (<a href="https://redirect.github.com/cbornet/blockbuster/issues/62">#62</a>)</li> <li><a href="https://github.com/cbornet/blockbuster/commit/da5e01445d162f6ea3dcf9ebe979190fd4c768df"><code>da5e014</code></a> Remove unwanted ruff config</li> <li><a href="https://github.com/cbornet/blockbuster/commit/07eed8c205e1d5786fb94fb45b62513ecef3c905"><code>07eed8c</code></a> Bump mypy to 2.3 (<a href="https://redirect.github.com/cbornet/blockbuster/issues/66">#66</a>)</li> <li><a href="https://github.com/cbornet/blockbuster/commit/d34275a4ddea622b60122cd29ab68dacd754a9fd"><code>d34275a</code></a> Bump ruff to 0.16 (<a href="https://redirect.github.com/cbornet/blockbuster/issues/65">#65</a>)</li> <li><a href="https://github.com/cbornet/blockbuster/commit/75269ed22ede1a4f378540c8d69b79023ddf1517"><code>75269ed</code></a> Test Python 3.14 in CI (<a href="https://redirect.github.com/cbornet/blockbuster/issues/64">#64</a>)</li> <li><a href="https://github.com/cbornet/blockbuster/commit/eec83336ead7d538e0c4e6f4f372e6a07bc82338"><code>eec8333</code></a> Fix false positive for os.sendfile via asyncio sock_sendfile path (<a href="https://redirect.github.com/cbornet/blockbuster/issues/58">#58</a>)</li> <li>See full diff in <a href="https://github.com/cbornet/blockbuster/compare/v1.5.26...v1.5.27">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.7 to 4.37.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.37.8</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"><code>db488dd</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4102">#4102</a> from github/update-v4.37.8-9ee088e13</li> <li><a href="https://github.com/github/codeql-action/commit/1845f5ba8b4057590f49ee8e246c95ef2ba4b53f"><code>1845f5b</code></a> Update changelog for v4.37.8</li> <li><a href="https://github.com/github/codeql-action/commit/9ee088e13615f8d1eaef4766f9dde95d3356a8f6"><code>9ee088e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4080">#4080</a> from github/henrymercer/studious-giggle</li> <li><a href="https://github.com/github/codeql-action/commit/1aef003397c876c0ab5bd118e1b1f34c175622e9"><code>1aef003</code></a> Address review feedback on overlay disk flags</li> <li><a href="https://github.com/github/codeql-action/commit/508b83bc415e8df76ce8ea08c0cf42c2529ebc63"><code>508b83b</code></a> Merge main into overlay minimum disk feature branch</li> <li><a href="https://github.com/github/codeql-action/commit/d97b3428e8eebbb1810cf454d6397886d136b4ba"><code>d97b342</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4098">#4098</a> from github/mbg/permission-error-as-configuration-error</li> <li><a href="https://github.com/github/codeql-action/commit/47fa6222231b12097f83215dd7a6b4a0915841fd"><code>47fa622</code></a> Make <code>EACCES</code> a <code>ConfigurationError</code></li> <li><a href="https://github.com/github/codeql-action/commit/45693cc6882bb175b58a06818c91876e201037c7"><code>45693cc</code></a> Refactor <code>ENOSPC</code> check into <code>isDiskConfigurationError</code> function</li> <li><a href="https://github.com/github/codeql-action/commit/c2fd8f54d19fa46c94ed79cb92e6dd6606d61762"><code>c2fd8f5</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4081">#4081</a> from github/mario-campos/version-cache-to-disk</li> <li><a href="https://github.com/github/codeql-action/commit/c56f48e9bd458a387eb68a68534459e503e56b17"><code>c56f48e</code></a> Log unexpected conditions during caching CLI output</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/v4.37.7...v4.37.8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.0.0 to 26.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/benoitc/gunicorn/releases">gunicorn's releases</a>.</em></p> <blockquote> <h2>gunicorn 26.1.0</h2> <h3>New Features</h3> <ul> <li><strong>Glob patterns in <code>reload_extra_files</code></strong>: entries containing <code>*</code>, <code>?</code> or <code>[</code> are treated as patterns, so <code>ui/*/config.json</code> watches every view's config without listing them one by one. Patterns are re-expanded on every reload check rather than once at startup, so a file created later starts being watched without restarting gunicorn, and <code>**</code> recurses. A pattern matching nothing warns instead of failing, since with live expansion it may match later (<a href="https://redirect.github.com/benoitc/gunicorn/issues/1643">#1643</a>, <a href="https://redirect.github.com/benoitc/gunicorn/pull/3662">#3662</a>).</li> </ul> <h3>Security</h3> <ul> <li><strong>Dependency floors raised past known advisories</strong>: every declared floor was checked against the advisory database. <code>tornado</code>, <code>h2</code>, <code>setuptools</code> and <code>pymdown-extensions</code> permitted vulnerable versions and now require the first clean release; <code>pytest</code> and <code>httpx</code> were unpinned and now carry floors. The <code>tornado</code> example pinned <code>tornado<6</code>, which was both the source of several advisories and older than the <code>>=6.5.0</code> the tornado worker needs, so the example could not run as pinned.</li> </ul> <h3>Bug Fixes</h3> <ul> <li> <p><strong>SIGHUP did not reload the logger configuration</strong>: <code>Arbiter.reload()</code> re-read the configuration file but kept using the logger built at startup, calling only <code>reopen_files()</code> on its existing handlers. Changes to <code>logconfig</code>, <code>logconfig_dict</code>, <code>logconfig_json</code> and <code>loglevel</code> were ignored until a full restart, which in containers meant replacing the pod. The existing logger now re-runs its setup on reload, so new handlers, formats and levels take effect while the process identity and its listeners are preserved, and re-running the setup no longer stacks duplicate syslog handlers. An invalid log configuration on reload is not fatal either: the error is reported on stderr, the previous working configuration is restored and the master keeps running with it (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3353">#3353</a>).</p> </li> <li> <p><strong>Truncated chunked bodies accepted</strong>: RFC 9112 section 7.1.2 ends a chunked body with <code>0 CRLF CRLF</code>, the second CRLF being the mandatory empty trailer section. <code>ChunkedReader.parse_chunk_size()</code> swallowed the <code>NoMoreData</code> raised while scanning for it, so a body cut short right after the last chunk line was treated as complete instead of rejected. It now raises <code>ChunkMissingTerminator</code> (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3382">#3382</a>, <a href="https://redirect.github.com/benoitc/gunicorn/pull/3685">#3685</a>).</p> </li> <li> <p><strong><code>--spew</code> crashed on dynamically generated code</strong>: the trace hook indexed the 2-tuple returned by <code>inspect.getsourcelines()</code> by line number rather than indexing the list of lines, so a frame with no <code>__file__</code> raised <code>AttributeError: 'int' object has no attribute 'rstrip'</code> on line 1 and</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/benoitc/gunicorn/commit/71b59a75820dd4a762dc42a3280124168b4e44a8"><code>71b59a7</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3698">#3698</a> from benoitc/fix/docker-health-check-readerror</li> <li><a href="https://github.com/benoitc/gunicorn/commit/48287de8d8360825c85ac981ddfe9c80dba3b418"><code>48287de</code></a> test: catch every transport error in the docker health check</li> <li><a href="https://github.com/benoitc/gunicorn/commit/3110e8c37f716ca0ed63ca7f80c7c9ea0fbbdd50"><code>3110e8c</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3696">#3696</a> from benoitc/docs/roadmap</li> <li><a href="https://github.com/benoitc/gunicorn/commit/cc56c410b7103c1f2b877279f81cb3a14705315a"><code>cc56c41</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3693">#3693</a> from benoitc/release/26.1.0</li> <li><a href="https://github.com/benoitc/gunicorn/commit/5cf1f1651a40fa36afe13fde623e3437ca872463"><code>5cf1f16</code></a> docs: surface the roadmap on the site home page</li> <li><a href="https://github.com/benoitc/gunicorn/commit/7e35f72d135056c37da321becf22b19aeec06937"><code>7e35f72</code></a> docs: add FastCGI to the roadmap and point items at Ideas</li> <li><a href="https://github.com/benoitc/gunicorn/commit/18ddc586c9b9513b25e92c6ed6f818f66ff3abcd"><code>18ddc58</code></a> docs: drop the framework and reverse-proxy non-goals from the roadmap</li> <li><a href="https://github.com/benoitc/gunicorn/commit/1ecae56ebd096ee4f94d12c59a36f240ce348572"><code>1ecae56</code></a> docs: add a roadmap and make the chat easy to find</li> <li><a href="https://github.com/benoitc/gunicorn/commit/ca412e3f7134bd9f0e91851778ae6d8dd222cf41"><code>ca412e3</code></a> docs: sync the Latest changelog page with 26.1.0</li> <li><a href="https://github.com/benoitc/gunicorn/commit/640936fb29f7bdf5665d5b7f919783bb73e2f981"><code>640936f</code></a> docs: note the dependency security work in 26.1.0</li> <li>Additional commits viewable in <a href="https://github.com/benoitc/gunicorn/compare/26.0.0...26.1.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )