[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
idna (changelog)	==3.4 → ==3.20

---

Release Notes

kjd/idna (idna)

v3.20

Compare Source

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental
  codec.
• Add support for Python 3.15.

v3.19

Compare Source

• Restore the std3_rules option, which had no effect since changes
  to UTS #​46 processing in Unicode 16. Note that uts46_remap()
  defaults to enabling STD3 rules, so direct callers will see input
  containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #​46 mapping, particularly for
  ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document
  thread safety.
• Expose the Unicode version of the generated tables as
  idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to
  IDNAError so that the failed rule and the offending character can
  be identified without parsing the exception message.
• The deprecated transitional argument to encode() and
  uts46_remap() is now completely ignored, and gives a deprecation warning
  for the latter.
• Reject A-labels that are not the canonical Punycode encoding of
  their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of
  InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes
  passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage
  measurement, and CI checks that the data tables match the generator
  output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for
contributions to this release.

v3.18

Compare Source

• When decoding a domain, add a display argument that will pass
  through invalid labels rather than raising an exception.

v3.17

Compare Source

• Substantial 75% reduction in memory usage through new data
  structures and some optimization in processing speed.
• Added a general 1024-character input length cap to the public
  validation, conversion, and codec entry points. This is well above
  any legitimate domain or label and guards against pathological
  inputs.

v3.16

Compare Source

• Add a command-line interface (python -m idna, also available as
  the idna script). Encodes or decodes one or more domains supplied
  as arguments or on standard input, with options to select A-label
  or U-label output and control error handling.
• Raise the minimum supported Python version to 3.9
• Various code quality improvements

v3.15

Compare Source

• Enforce DNS-length cap on individual labels early in check_label,
  short-circuiting contextual-rule processing for oversized input
  while staying compatible with UTS 46 usage.
• Tidy core helpers: hoist bidi category sets to module-level
  frozensets (avoiding per-codepoint list construction), simplify
  length checks, and reuse the shared _unicode_dots_re from
  idna.core in the codec module.
• Use raise ... from err for proper exception chaining and
  switch internal string formatting to f-strings.
• Allow flit_core 4.x in the build backend.
• Expand the ruff lint set (flake8-bugbear, flake8-simplify,
  pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
  to Python 3.14.
• Add Dependabot configuration for GitHub Actions.
• Convert README and HISTORY from reStructuredText to Markdown.
• Reference CVE-2026-45409 for the 3.14 advisory in place of the
  initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.

v3.14

Compare Source

• Removed opportunity to process long inputs into quadratic
  time by rejecting oversize inputs up-front. Closes a bypass
  of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

v3.13

Compare Source

• Correct classification error for codepoint U+A7F1

v3.12

Compare Source

• Update to Unicode 17.0.0.
• Issue a deprecation warning for the transitional argument.
• Added lazy-loading to provide some performance improvements.
• Removed vestiges of code related to Python 2 support, including
  segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

v3.11

Compare Source

• Update to Unicode 16.0.0, including significant changes to UTS46
  processing. As a result of Unicode ending support for it, transitional
  processing no longer has an effect and returns the same result.
• Add support for Python 3.14, lowest supported version is Python 3.8.
• Various updates to packaging, including PEP 740 support.

v3.10

Compare Source

• Reverted to Unicode 15.1.0 data. Unicode 16 has some significant changes
  to UTS46 processing that will require more work to properly implement.

v3.9

Compare Source

• Update to Unicode 16.0.0
• Deprecate setup.cfg in favour of pyproject.toml
• Use ruff for code formatting

Thanks to Waket Zheng for contributions to this release.

v3.8

Compare Source

• Fix regression where IDNAError exception was not being produced for
  certain inputs.
• Add support for Python 3.13, drop support for Python 3.5 as it is no
  longer testable.
• Documentation improvements
• Updates to package testing using Github actions

Thanks to Hugo van Kemenade for contributions to this release.

v3.7

Compare Source

• Fix issue where specially crafted inputs to encode() could
  take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

v3.6

Compare Source

• Fix regression to include tests in source distribution.

v3.5

Compare Source

• Update to Unicode 15.1.0
• String codec name is now "idna2008" as overriding the system codec
  "idna" was not working.
• Fix typing error for codec encoding
• "setup.cfg" has been added for this release due to some downstream
  lack of adherence to PEP 517. Should be removed in a future release
  so please prepare accordingly.
• Removed reliance on a symlink for the "idna-data" tool to comport
  with PEP 517 and the Python Packaging User Guide for sdist archives.
• Added security reporting protocol for project

Thanks Jon Ribbens, Diogo Teles Sant'Anna, Wu Tingfeng for contributions
to this release.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.