0265abfa62
Bump msgpack from 1.1.2 to 1.2.1 in /tools ( #10727 )
...
Bumps [msgpack](https://github.com/msgpack/msgpack-python ) from 1.1.2 to
1.2.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/msgpack/msgpack-python/releases ">msgpack's
releases</a>.</em></p>
<blockquote>
<h2>v1.2.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies
group by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/694 ">msgpack/msgpack-python#694</a></li>
<li>release v1.2.1 by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/698 ">msgpack/msgpack-python#698</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/msgpack/msgpack-python/compare/v1.2.0...v1.2.1 ">https://github.com/msgpack/msgpack-python/compare/v1.2.0...v1.2.1 </a></p>
<h2>v1.2.0</h2>
<h2>What's Changed</h2>
<ul>
<li>relax setuptools version by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/652 ">msgpack/msgpack-python#652</a></li>
<li>update setuptools requirements to >=78.1.1 by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/653 ">msgpack/msgpack-python#653</a></li>
<li>cython: freethreading_compatible by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/654 ">msgpack/msgpack-python#654</a></li>
<li>drop Python 3.9 by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/656 ">msgpack/msgpack-python#656</a></li>
<li>update cython and cibuildwheel by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/658 ">msgpack/msgpack-python#658</a></li>
<li>ci: add riscv64 manylinux/musllinux wheels by <a
href="https://github.com/justeph "><code>@justeph</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/664 ">msgpack/msgpack-python#664</a></li>
<li>fix: check <code>unpack_callback_uint32</code> result by <a
href="https://github.com/KowalskiThomas "><code>@KowalskiThomas</code></a>
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/666 ">msgpack/msgpack-python#666</a></li>
<li>fix: re-raise existing exception when available by <a
href="https://github.com/KowalskiThomas "><code>@KowalskiThomas</code></a>
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/667 ">msgpack/msgpack-python#667</a></li>
<li>fix: check return code in <code>unpack_callback_int64</code> by <a
href="https://github.com/KowalskiThomas "><code>@KowalskiThomas</code></a>
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/665 ">msgpack/msgpack-python#665</a></li>
<li>Fixed README example by <a
href="https://github.com/vallsv "><code>@vallsv</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/668 ">msgpack/msgpack-python#668</a></li>
<li>Bump the all-dependencies group with 6 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/669 ">msgpack/msgpack-python#669</a></li>
<li>ci: use ubuntu-slim for lint by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/670 ">msgpack/msgpack-python#670</a></li>
<li>fix: enforce <code>strict_map_key</code> with
<code>object_pairs_hook</code> by <a
href="https://github.com/KowalskiThomas "><code>@KowalskiThomas</code></a>
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/673 ">msgpack/msgpack-python#673</a></li>
<li>Raise DEFAULT_RECURSE_LIMIT from 511 to 1024 by <a
href="https://github.com/Copilot "><code>@Copilot</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/676 ">msgpack/msgpack-python#676</a></li>
<li>fix: properly handle return codes in <code>pack_timestamp</code> by
<a
href="https://github.com/KowalskiThomas "><code>@KowalskiThomas</code></a>
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/672 ">msgpack/msgpack-python#672</a></li>
<li>fix: avoid memory leak when decoding invalid nested arrays by <a
href="https://github.com/KowalskiThomas "><code>@KowalskiThomas</code></a>
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/671 ">msgpack/msgpack-python#671</a></li>
<li>Add missing autoreset in Packer.pack_ext_type by <a
href="https://github.com/bysiber "><code>@bysiber</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/663 ">msgpack/msgpack-python#663</a></li>
<li>Add no-GIL interpreter support by <a
href="https://github.com/clin1234 "><code>@clin1234</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/641 ">msgpack/msgpack-python#641</a></li>
<li>skip recursion limit test on free-threaded CPython builds by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/679 ">msgpack/msgpack-python#679</a></li>
<li>Fix Timestamp.from_datetime returning wrong value for pre-epoch
datetimes by <a
href="https://github.com/bysiber "><code>@bysiber</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/662 ">msgpack/msgpack-python#662</a></li>
<li>Add 3.15 to CI by <a
href="https://github.com/clin1234 "><code>@clin1234</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/678 ">msgpack/msgpack-python#678</a></li>
<li>fix: use-after-free in <code>get_data_from_buffer</code> by <a
href="https://github.com/KowalskiThomas "><code>@KowalskiThomas</code></a>
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/677 ">msgpack/msgpack-python#677</a></li>
<li>change changelog format to markdown by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/680 ">msgpack/msgpack-python#680</a></li>
<li>Bump the all-dependencies group with 2 updates by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/684 ">msgpack/msgpack-python#684</a></li>
<li>Bump sys.setrecursionlimit within test_nest_limit_1024 by <a
href="https://github.com/clin1234 "><code>@clin1234</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/682 ">msgpack/msgpack-python#682</a></li>
<li>Guard <code>Packer</code> buffer protocol hooks with Cython critical
sections by <a
href="https://github.com/Copilot "><code>@Copilot</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/686 ">msgpack/msgpack-python#686</a></li>
<li>Harden <code>Unpacker.__init__</code> re-entry cleanup to prevent
buffer/context leaks by <a
href="https://github.com/Copilot "><code>@Copilot</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/687 ">msgpack/msgpack-python#687</a></li>
<li>release v1.2.0rc1 by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/681 ">msgpack/msgpack-python#681</a></li>
<li>Wheels CI hangs for MacOS Intel by <a
href="https://github.com/crusaderky "><code>@crusaderky</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/689 ">msgpack/msgpack-python#689</a></li>
<li>Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 in the all-dependencies
group by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/691 ">msgpack/msgpack-python#691</a></li>
<li>release v1.2.0 by <a
href="https://github.com/methane "><code>@methane</code></a> in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/692 ">msgpack/msgpack-python#692</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/justeph "><code>@justeph</code></a> made
their first contribution in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/664 ">msgpack/msgpack-python#664</a></li>
<li><a
href="https://github.com/KowalskiThomas "><code>@KowalskiThomas</code></a>
made their first contribution in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/666 ">msgpack/msgpack-python#666</a></li>
<li><a href="https://github.com/vallsv "><code>@vallsv</code></a> made
their first contribution in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/668 ">msgpack/msgpack-python#668</a></li>
<li><a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
made their first contribution in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/669 ">msgpack/msgpack-python#669</a></li>
<li><a href="https://github.com/Copilot "><code>@Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/676 ">msgpack/msgpack-python#676</a></li>
<li><a href="https://github.com/bysiber "><code>@bysiber</code></a> made
their first contribution in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/663 ">msgpack/msgpack-python#663</a></li>
<li><a href="https://github.com/clin1234 "><code>@clin1234</code></a>
made their first contribution in <a
href="https://redirect.github.com/msgpack/msgpack-python/pull/641 ">msgpack/msgpack-python#641</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md ">msgpack's
changelog</a>.</em></p>
<blockquote>
<h1>1.2.1</h1>
<p>Release Date: 2026-06-19</p>
<p>Fix a segfault when calling <code>Unpacker.unpack()</code> or
<code>Unpacker.skip()</code> after an unpacking failure.
But note that reusing the same <code>Unpacker</code> instance after an
unpacking failure is not supported.
Please create a new <code>Unpacker</code> instance instead.
GHSA-6v7p-g79w-8964</p>
<h1>1.2.0</h1>
<p>Release Date: 2026-06-11</p>
<ul>
<li>Support free threaded Python. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/654 ">#654</a>,
<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/686 ">#686</a></li>
<li>Dropped support for Python 3.9. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/656 ">#656</a></li>
<li>Fix missing error checks in C code. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/665 ">#665</a>,
<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/666 ">#666</a>,
<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/667 ">#667</a>,
<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/672 ">#672</a></li>
<li>Fix <code>strict_map_key</code> option didn't work for
<code>object_pairs_hook</code>. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/673 ">#673</a></li>
<li>Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/676 ">#676</a></li>
<li>Fix memory leak when Unpacker returns error for invalid input. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/671 ">#671</a></li>
<li>Fix <code>Packer.pack_ext_type()</code> ignored
<code>autoreset</code> option. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/663 ">#663</a></li>
<li>Fix <code>Timestamp.from_datetime()</code> returning wrong value for
pre-epoch datetimes. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/662 ">#662</a></li>
<li>Fix use-after-free in <code>unpackb()</code> and
<code>Unpacker.unpack()</code> for non-contiguous input. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/677 ">#677</a></li>
<li>Fix possible memory leak when calling
<code>Unpacker.__init__()</code> several times. <a
href="https://redirect.github.com/msgpack/msgpack-python/issues/687 ">#687</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/448d43f5dcca7b3a2b0810e161af0a6431d90071 "><code>448d43f</code></a>
release v1.2.1 (<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/698 ">#698</a>)</li>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d "><code>2c56ddb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/0f4f350b6f3e80f24750422673424cce5d96e15d "><code>0f4f350</code></a>
Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group
(<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/694 ">#694</a>)</li>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/11ed0a5110c1920b85b7d24d9414f480983e0f16 "><code>11ed0a5</code></a>
release v1.2.0 (<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/692 ">#692</a>)</li>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/c410a388c58d55091736e510cad064977a12cb8b "><code>c410a38</code></a>
Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 (<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/691 ">#691</a>)</li>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/97ba6ca0d29c1e8a5b30112f13f37a4d6b3c4492 "><code>97ba6ca</code></a>
skip ci: remove unneeded CIBW_SKIP option</li>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/cdde1b0d6336caff4e82310c3c7d2b4c73f22d59 "><code>cdde1b0</code></a>
Wheels CI hangs for MacOS Intel (<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/689 ">#689</a>)</li>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/5eb57e15455f5dd25001e97a7ef1170911dee104 "><code>5eb57e1</code></a>
release v1.2.0rc1 (<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/681 ">#681</a>)</li>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/77395c19a50061238306df5ea10e67c5312ceff0 "><code>77395c1</code></a>
Harden <code>Unpacker.__init__</code> re-entry cleanup to prevent
buffer/context leaks (...</li>
<li><a
href="https://github.com/msgpack/msgpack-python/commit/7df7136e20933fd3a498bd58bff7975a24790516 "><code>7df7136</code></a>
Guard <code>Packer</code> buffer protocol hooks with Cython critical
sections (<a
href="https://redirect.github.com/msgpack/msgpack-python/issues/686 ">#686</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/msgpack/msgpack-python/compare/v1.1.2...v1.2.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/certbot/certbot/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-06 13:42:45 -07:00
ohemorange and GitHub
dda67bfb9a
Get version number from github instead of azure pipelines in finish_release.py ( #10669 )
2026-06-10 15:33:22 -07:00
Will Greenberg and GitHub
7440ff40dd
repin dependencies ( #10645 )
...
This pulls in an updated urllib3, which addresses two security vulns
found by dependabot:
* https://github.com/certbot/certbot/security/dependabot/133
* https://github.com/certbot/certbot/security/dependabot/135
2026-05-18 12:49:59 -07:00
c8ebcb49bd
Migrate certbot-dns-cloudflare to cloudflare 4.x SDK ( #10587 )
...
## Summary
- Migrate `certbot-dns-cloudflare` from the archived `python-cloudflare`
2.x library (`import CloudFlare`) to the actively maintained Cloudflare
Python SDK 4.x (`import cloudflare`)
- Update all API calls to the new SDK surface:
`dns.records.create/list/delete`, `zones.list`, typed response objects
instead of dicts
- Replace `CloudFlare.exceptions.CloudFlareAPIError` with
`cloudflare.APIStatusError` and extract CF error codes from
`response.json()`
- Bump dependency from `cloudflare>=2.19, <2.20` to `cloudflare>=4.0`
- Update oldest pinning from `cloudflare 2.19` to `4.0.0`
- Update all test mocks and assertions accordingly
Fixes #9938
## API Migration
| Operation | Old 2.x | New 4.x |
|---|---|---|
| Import | `import CloudFlare` | `import cloudflare` |
| Client (token) | `CloudFlare.CloudFlare(token=t)` |
`cloudflare.Cloudflare(api_token=t)` |
| Client (key) | `CloudFlare.CloudFlare(email, key)` |
`cloudflare.Cloudflare(api_email=e, api_key=k)` |
| List zones | `cf.zones.get(params={...})` → `list[dict]` |
`cf.zones.list(name=n)` → iterable of Zone objects |
| Create record | `cf.zones.dns_records.post(zone_id, data={...})` |
`cf.dns.records.create(zone_id=id, **data)` |
| List records | `cf.zones.dns_records.get(zone_id, params={...})` |
`cf.dns.records.list(zone_id=id, type=..., ...)` |
| Delete record | `cf.zones.dns_records.delete(zone_id, record_id)` |
`cf.dns.records.delete(dns_record_id=rid, zone_id=zid)` |
| Exceptions | `CloudFlare.exceptions.CloudFlareAPIError` |
`cloudflare.APIStatusError` |
## Test plan
- [x] All 20 existing tests pass with updated mocks
- [x] Credentials INI file format is unchanged — no user-facing config
changes
- [x] Live dry-run renewal tested successfully across 5 domains
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
Co-authored-by: Ember <BeigeBox@users.noreply.github.com >
Co-authored-by: Brad Warren <bmw@users.noreply.github.com >
2026-05-06 09:35:38 -07:00
ohemorange and GitHub
6114144bd2
Merge pull request #10630 from certbot/lexicon-repin
...
Repin dependencies to pull in updated dns-lexicon, which contains the fix for OVH challenge deletion bug
2026-04-28 12:28:31 -07:00
Brad Warren and GitHub
08c2354f46
update poetry ( #10615 )
...
this is in response to
https://github.com/certbot/certbot/security/dependabot/126
as you can see by examining the github status checks on this PR, i ran
the full test suite and everything passed
i also don't think this PR requires two reviews
2026-04-02 14:11:07 -07:00
ohemorange and GitHub
3d803821b7
Repin dependencies ( #10611 )
2026-03-27 09:03:31 -07:00
Brad Warren and GitHub
410ee87242
fix compatibility with pyparsing 3 and update to it ( #10560 )
...
on main if you run tools/pinning/current/repin.sh and run our unit
tests, they will fail due to new deprecation warnings from pyparsing.
the cause of these warnings is described at
https://github.com/pyparsing/pyparsing/blob/dc009668d8025b96522eb7503e2ef84c2be58843/docs/whats_new_in_3_0_0.rst?plain=1#L613-L708
this PR fixes these warnings and updates our minimum required pyparsing
version to 3.0 where the new naming convention is available. i ran our
full test suite on the first commit here and it passed
i don't think it's worth trying to keep compatibility with pyparsing<3
unless we get a request for us to do so which i really doubt we will
2026-02-03 11:51:26 -08:00
ohemorange and GitHub
b362109bf6
Fix certbot tests after updating pytest to 9.0.2 ( #10545 )
...
Fixes #10518 .
`tools/pinning/current/repin.sh` is not run; only pytest version is
updated. This is because `pypinning` had a bunch of syntax changes that
seem simply but I believe should be in a separate PR, which I think
should be done after this to collect all repin changes.
As discussed further in #10518 , these issues were caused by pytest's
internalization of pytest-subtest, which had several implementation
changes.
To fix these, we simply no longer use subtest in the failing tests. The
test in acme is now parametrized instead, and the tests in apache only
ever had a single parameter.
To use parametrization in the acme test, I converted `DNSTest` from
unittest to pytest style, which was pretty straightforward. The only
note there is that while it would be nice to make `ec_secp384r1_key` a
fixture, you [can't use fixtures in
parameters](https://github.com/pytest-dev/pytest/issues/349 ). You could
use requests, but that seemed less clear and messier, because then you'd
be checking the value of the parameter and only sometimes loading it.
Could also make it a global variable, but that didn't really seem
necessary, as it's only called twice. Happy to consider other options,
not strongly tied to this one, just seemed nicest to me.
2026-02-02 12:13:24 -08:00
Brad Warren and GitHub
991ecd7c8e
update dependencies ( #10552 )
...
as of writing this, this resolves all alerts those with access can see
at https://github.com/certbot/certbot/security/dependabot
i ran the full test suite on this branch at
https://dev.azure.com/certbot/certbot/_build/results?buildId=10057&view=results
and everything passed
i don't think this PR requires two reviews
2026-02-02 10:09:02 -08:00
Brad Warren and GitHub
36ddada4b3
update pinned dependencies ( #10516 )
...
this fixes the dependabot alerts those with access can see at
https://github.com/certbot/certbot/security/dependabot
i don't think those alerts are particularly relevant to us, but i think
it's good for us to update anyway
2025-12-15 15:05:27 -08:00
ohemorange and GitHub
2ec8320763
Add python 3.14 support ( #10481 )
...
fixes https://github.com/certbot/certbot/issues/10477 . this is based on
the PR that did this for 3.13 at
https://github.com/certbot/certbot/pull/10164
2025-11-04 10:49:51 -08:00
Brad Warren and GitHub
e9dd4eb03b
stop running setup.py and switch to python -m build ( #10442 )
...
fixes #10404
unfortunately, exactly what `python setup.py clean` did doesn't seem
well documented so i dug into the code with a debugger. executing the
`clean` subcommand is done by [this
code](https://github.com/pypa/setuptools/blob/9cc2f5c05c333cd4cecd2c0d9e7c5e208f2a3148/setuptools/_distutils/command/clean.py#L54-L77 )
where the relevant build variables are set by the `build` subcommand
[here](https://github.com/pypa/setuptools/blob/9cc2f5c05c333cd4cecd2c0d9e7c5e208f2a3148/setuptools/_distutils/command/build.py#L52 )
and
[here](https://github.com/pypa/setuptools/blob/9cc2f5c05c333cd4cecd2c0d9e7c5e208f2a3148/setuptools/_distutils/command/build.py#L112 ).
it turns out us running `python setup.py clean` was already redundant
with `rm -rf build` on the next line
i built two releases, one on the latest commit in this PR and another on
https://github.com/certbot/certbot/commit/44f1dd677b75da27f12374fd34d68306ae6f615c
before the switch to `python -m build`. a simple diff of the resulting
tarballs and wheels fails, presumably because of metadata differences,
but after untaring or unzipping the files, the contents are identical
for all of our built packages
2025-08-22 11:03:00 -07:00
ohemorange and GitHub
00a51ab22b
Drop in uv for pip ( #10428 )
...
It's a [drop-in
replacement](https://docs.astral.sh/uv/pip/compatibility/ ) that speeds
things up. I don't see any reason why not.
`--use-pep517` is [set by default](
https://docs.astral.sh/uv/pip/compatibility/#pep-517-build-isolation ),
so we don't need it.
`--disable-pip-version-check` also does nothing on uv.
`uv` [uses
separate](https://docs.astral.sh/uv/pip/compatibility/#build-constraints )
`UV_BUILD_CONSTRAINT` and `UV_CONSTRAINT`. I just added it to both to do
the simplest thing here. We could split them.
We probably don't actually need to pipstrap pip anymore, I could take
that out.
What's happening with `parsedatetime` and `python-digitalocean` is that
they were always secretly wrong. Since `pip` compiles bytecode by
default, it was suppressing the errors. If you add the
`--compile-bytecode` flag to `uv`, it passes, but I don't think we
should do that. You can see the failure happen on main by passing
`--no-compile` to the pip args and running `certbot -r -e oldest`.
Now what I don't understand is that some places seem to say the `'\/'`
error from `parsedatetime` only started in python 3.12, whereas others
see it on earlier python. Perhaps pytest is vendorizing python or
something. Not too worried about that, needed to get updated anyway, and
it's an accurate oldest version based on our oldest OSes.
`python-digitalocean` is techincally newer than debian 11, but we've
made that decision before so it seems fine to me.
2025-08-18 13:17:02 -07:00
Brad Warren and GitHub
34a128ae88
update pinned dependencies ( #10416 )
...
this fixes the alert those with access can see at
https://github.com/certbot/certbot/security/dependabot
2025-08-13 17:59:55 +00:00
ohemorange and GitHub
dea3e5f1c4
Set up ruff so that test files have at least some linting ( #10399 )
...
Alternative implementation for #7908 .
In this PR:
- set up ruff in CI (add to `tox.ini`, mark dep in `certbot/setup.py`)
- add a `ruff.toml` that ignores particularly annoying errors. I think
line length isn't actually necessary to set with this workflow since
we're not checking it but putting it there for future usage.
- either fix or ignore the rest of the errors that come with the default
linting configuration. fixed errors are mostly unused variables. ignored
are usually where we're doing weird import things for a specific reason.
2025-08-08 08:48:43 -07:00
2ac7baa651
Add towncrier for automatic changelog generation ( #10379 )
...
blast from the past! resurrects
https://github.com/certbot/certbot/pull/9803 with all of @bmw's changes.
i figured instead of force-pushing a basically brand new branch and
obliterating the old review, i'd just start from a clean slate
fixes #8272
---------
Co-authored-by: Brad Warren <bmw@users.noreply.github.com >
Co-authored-by: Brad Warren <bmw@eff.org >
2025-07-31 07:12:56 -07:00
SATOH Fumiyasu and GitHub
6ba8abe8d5
Remove the dependency on pytz ( #10350 )
...
The `pytz` is obsoleted by Python 3.9.
2025-07-28 08:00:16 -07:00
Brad Warren and GitHub
eb563ccc1d
update dependencies ( #10368 )
...
this fixes the security alerts those with access can see at
https://github.com/certbot/certbot/security/dependabot
setting `PIP_USE_PEP517: "true"` is needed with modern versions of
setuptools as described in the issue linked in the code comment. we're
already setting the equivalent flag in builds outside of snaps. see
https://github.com/certbot/certbot/pull/10249
2025-07-17 11:56:03 -07:00
Brad Warren and GitHub
10747555ae
upgrade python-augeas ( #10286 )
...
a couple weeks ago, [python-augeas
1.2.0](https://pypi.org/project/python-augeas/#history ) was uploaded to
pypi. unfortunately, this broke things for us
the first major change was from
https://github.com/hercules-team/python-augeas/pull/49 where
python-augeas now needs the new OS packages described in the initial
comment there
the second change was from
https://github.com/hercules-team/python-augeas/pull/51 which added a
python interface to augeas functions that weren't introduced until
[augeas
1.13.0](https://github.com/hercules-team/augeas/blob/af2aa88ab37fc48167d8c5e43b1770a4ba2ff403/NEWS#L65-L66 ).
this isn't ideal, but i don't think it's a big deal for us. augeas
1.13.0 is over three years old and [ubuntu
20.04](https://ubuntu.com/blog/ubuntu-20-04-eol-for-devicesional ) and
[debian bullseye](https://www.debian.org/releases/ ) which have older
versions than that are technically EOL'd
regardless of how we feel about these changes, our tests don't currently
work with an updated version of python-augeas and this PR fixes it. i'm
also tracking https://github.com/certbot/certbot/issues/10282 to update
certbot.eff.org to list the newly required OS packages
2025-05-08 13:03:31 -07:00
Brad Warren and GitHub
cc08242abc
update pinned dependencies ( #10278 )
...
this fixes the security alerts those with access can see at
https://github.com/certbot/certbot/security/dependabot
i based what needed to be done to drop python < 3.9.2 support on
https://github.com/certbot/certbot/pull/10077 and concluded we only
really needed to update `python_requires`. we could do a deprecation
period for this, but i think it's not necessary. cryptography didn't
(it's not even in mentioned in [their
changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst ))
and none of the major LTS distros use python 3.9.0 or 3.9.1
2025-05-06 10:56:19 -07:00
ohemorange and GitHub
16f858547f
Add --use-pep517 flag to pip to silence warning in tools/venv.py, and switch codebase to src-layout ( #10249 )
...
Fixes #10252 .
See further discussion here: https://github.com/pypa/pip/issues/11457
We are doing option:
> Alternatively, enable the --use-pep517 pip option, possibly with
--no-build-isolation. The --use-pip517 flag will force pip to use the
modern mechanism for editable installs. --no-build-isolation may be
needed if your project has build-time requirements beyond setuptools and
wheel. By passing this flag, you are responsible for making sure your
environment already has the required dependencies to build your package.
Once the legacy mechanism is removed, --use-pep517 will have no effect
and will essentially be enabled by default in this context.
Major changes made here include:
- Add `--use-pep517` to use the modern mechanism, which will be the only
mechanism in future pip releases
- Change to `/src` layout to appease mypy, and because for editable
installs that really is the normal way these days.
- `cd acme && mkdir src && mv acme src/` etc.
- add `where='src'` argument to `find_packages` and add
`package_dir={'': 'src'},` in `setup.py`s
- update `MANIFEST.in` files with new path locations
- Update our many hardcoded filepaths
- Update `importlib-metadata` requirement to fix
double-plugin-entry-point problem in oldest tests
2025-04-11 19:30:33 +00:00
Will Greenberg and GitHub
15024aabd3
Repin dependencies for josepy 2.0 ( #10254 )
2025-04-02 18:17:44 +00:00
Jonathan Vanasco and GitHub
dd876a40ed
Feature acme cryptography 2 ( #10245 )
...
redoing https://github.com/certbot/certbot/pull/10174 but lots of
mergecommits and ff wanted; so test in a clean environment
2025-04-02 10:53:47 -07:00
ohemorange and GitHub
aafe7ba2f9
Update to latest poetry-plugin-export to fix urllib3 multiple versions issue and unpin urllib3 ( #10169 )
...
We can use modern urllib3 now! They
[fixed](https://github.com/python-poetry/poetry-plugin-export/pull/286 )
the poetry
[issue](https://github.com/python-poetry/poetry-plugin-export/issues/183 )
and shipped it!
Since this PR updates the requirements file, it pulls in the new
`josepy` release, so I've silenced those warnings here. If I should do
that in a separate PR lmk.
2025-02-05 17:14:25 -08:00
e050fe91a3
Allow using cryptography certs and keys in the standalone plugin ( #10133 )
...
Co-authored-by: Brad Warren <bmw@users.noreply.github.com >
2025-01-16 22:16:45 +00:00
Brad Warren and GitHub
a00e343459
update policy on minimum dependency versions ( #10130 )
...
fixes #10105
this PR updates our minimally required cryptography and pyopenssl
versions as well as updating our policy for choosing minimum dependency
versions generally
before this PR, we were trying to keep compatibility with packages
available in EPEL 9 using the python 3 version available in RHEL 9.
after the discussion in #10105 we decided not to do this anymore
because:
* EPEL 9 may not want to update to certbot 3.0+ anyway because of our
backwards incompatible changes from certbot 2.x
* RHEL 9 appstream repos now contain newer versions of many of our
dependencies for newer versions of python
* alternate installation methods for RHEL 9 based users including our
snaps and pip are available
on a call we then discussed what distro repositories we should track
instead of EPEL 9. our docs previously said Debian sid/unstable, but we
felt this as unnecessary because Debian sid can and does change very
quickly. if we wanted a new dependency there, Debian could probably
accommodate it
we also considered RHEL 10 + EPEL 10, however, these repos are not even
stable yet and certbot and many of its dependencies are not yet packaged
there at all
for these reasons, plus many of the reasons we decided to upgrade past
EPEL 9 with the default python 3 version there, we decided that at least
for now, we will remove any linux distro considerations when choosing
minimal dependency versions of certbot
as i wrote in the contributing docs, we may choose to reconsider this
plan if there are requests for us to do so, but based on the information
above, we are not sure this will ever even happen and removing this
constraint significantly simplifies development of certbot
2025-01-15 09:47:40 -08:00
Brad Warren and GitHub
9f9a1df85e
upgrade pylint ( #10121 )
...
we need this for https://github.com/certbot/certbot/issues/10045
2025-01-07 09:43:14 -08:00
Brad Warren
fc07f5f935
update pinnings
2024-12-12 08:57:10 -08:00
Brad Warren and GitHub
2c8609464c
fix upgrading pyopenssl ( #10080 )
...
i hit this when working on https://github.com/certbot/certbot/pull/10076
where i found that updating all our dependencies no longer worked
because of new deprecations in pyopenssl. this pr fixes that
2024-12-11 15:15:55 -08:00
Brad Warren and GitHub
7a48c235a9
remove importlib_resources ( #10076 )
...
this is part of my work on
https://github.com/certbot/certbot/issues/10035 based on erica's comment
at
https://github.com/certbot/certbot/issues/10035#issuecomment-2452212686
2024-12-06 12:37:17 -08:00
Brad Warren and GitHub
087cb4d1f4
remove python 3.8 support ( #10077 )
...
fixes https://github.com/certbot/certbot/issues/10035 . you can compare
this to the PR that did this for python 3.7 at
https://github.com/certbot/certbot/pull/9792
i agree with erica's comment at
https://github.com/certbot/certbot/issues/10035#issuecomment-2452212686 ,
but felt this PR was already getting pretty large so i did that in a
second PR at https://github.com/certbot/certbot/pull/10076
2024-12-04 14:55:20 -08:00
Brad Warren and GitHub
c4be440853
update dependencies ( #10036 )
...
this fixes the current [dependabot alert](https://github.com/certbot/certbot/security/dependabot )
2024-11-01 10:04:10 -07:00
80e68bec26
Update dependencies (27-08-2024) ( #9993 )
...
Update dependencies & proactively defends against major bump to Josepy 2+
Co-authored-by: Brad Warren <bmw@users.noreply.github.com >
2024-08-28 07:22:22 -07:00
Brad Warren
c31f53a225
run tools/pinning/current/repin.sh
2024-05-31 10:10:46 -07:00
Brad Warren and GitHub
443ec2200f
pin back cloudflare ( #9940 )
...
* pin back cloudflare
* update readme
2024-05-16 09:18:21 -07:00
Erica Portnoy
920b717c45
update poetry version using urllib3 workaround
2024-03-28 15:34:24 -07:00
Erica Portnoy
c8a1e30981
change tox pin to >= 4 and rerun pinning script
2024-03-27 14:05:59 -07:00
Brad Warren and GitHub
b8b759f1d2
update dependencies ( #9893 )
...
Fixes https://github.com/certbot/certbot/issues/9892 and https://github.com/certbot/certbot/security/dependabot
Upgrading the base docker image has been done in previous PRs like https://github.com/certbot/certbot/pull/9415 . Doing this was needed because the [newer versions of `cryptography` need a newer version of rust](https://dev.azure.com/certbot/certbot/_build/results?buildId=7451&view=logs&j=fdd3565a-f3c6-5154-eca9-9ae03666f7bd&t=5dbd9851-46a4-524f-73a8-4028241afcde&l=475 ).
I ran the full test suite on this branch which you can see in the GitHub status checks below. The boulder tests should fail as they're to be fixed by https://github.com/certbot/certbot/pull/9889 but everything else should pass.
2024-02-07 17:55:30 -08:00
Brad Warren and GitHub
3833255980
update dependencies ( #9848 )
2023-12-05 10:33:31 -08:00
Brad Warren and GitHub
76f9a33e45
Upgrade the pinned version of pylint ( #9839 )
...
* upgrade pylint
* fix upgraded pylint
* downgrade pyopenssl
* remove unneeded ignores
* stop using text
* update sphinx-rtd-theme
2023-11-15 09:52:37 +01:00
Adrien Ferrand and GitHub
5f67bb99a8
Full cleanup of pkg_resources ( #9797 )
...
Fixes #9606
This PRs removes some elements that were related to pkg_resources dependency and its deprecation.
2023-11-13 15:50:32 -08:00
Adrien Ferrand and GitHub
5cf5f36f19
Update Lexicon requirements to stabilize certbot-dns-ovh behavior ( #9802 )
...
* Update minimum Lexicon version required for certbot-dns-ovh
* Add types
* FIx mypy
* Fix lint
* Fix BOTH lint and mypy
2023-10-18 13:19:26 -07:00
Adrien Ferrand and GitHub
8a95c030e6
Drop Python 3.7 support ( #9792 )
...
* Drop Python 3.7 support
* Fix lint and test
* Check for venv generation
* Update requirements
* Update oldest constaints and compatibility tests runtime
2023-10-13 06:57:42 -07:00
Brad Warren and GitHub
5849ff73fb
update pinned dependencies ( #9788 )
...
This fixes the security alerts those with access can see at https://github.com/certbot/certbot/security/dependabot .
2023-10-06 11:39:08 -07:00
732a3ac962
Refactor Lexicon-based DNS plugins ( #9746 )
...
* Refactor Lexicon-based DNS plugins and upgrade minimal version of Lexicon
* Relax filterwarning to comply with envs where boto3 is not installed
* Update pinned dependencies
* Use our previous method to deprecate part of modules
* Safe import internally
* Add changelog
Co-authored-by: Brad Warren <bmw@users.noreply.github.com >
2023-09-25 15:15:04 -07:00
23f9dfc655
Migrate pkg_resources usages to importlib.metadata ( #9749 )
...
* Migrate entrypoint logic from pkg_resources to importlib.metadata
* Usage of importlib_metadata up to Python 3.9 to align API behavior to Python 3.10
---------
Co-authored-by: Adrien Ferrand <adrien.ferrand@amadeus.com >
Co-authored-by: Adrien Ferrand <adrien.ferrand@arteris.com >
2023-09-12 08:18:57 -07:00
cc359dab46
Migrate pkg_resources usages to importlib.resources ( #9748 )
...
* Migrate pkg_resources API related to resources to importlib_resources
* Fix lint and mypy + pin lexicon
* Update filterwarnings
* Update oldest tests requirements
* Update pinned dependencies
* Fix for modern versions of python
* Fix assets load in nginx integration tests
* Fix a warning
* Isolate static generation from importlib.resource into a private function
---------
Co-authored-by: Adrien Ferrand <adrien.ferrand@amadeus.com >
2023-09-07 11:38:44 -07:00
Brad Warren and GitHub
9b4b99f3e8
Update dependencies ( #9754 )
...
This takes care of the dependabot alerts those with access can see at https://github.com/certbot/certbot/security/dependabot .
Pinning back `cython` is needed because without it, our full test suite will fail when trying to build `pyyaml` on ARM systems.
2023-08-24 17:05:54 -07:00
alexzorin and GitHub
d0e11c81b1
Repin dependencies to fix security alerts ( #9717 )
...
* repin current
* repin oldest
* csr must have version set to zero
* only set PIP_USE_PEP517 for macOS
* experiment with brew update git failure workaround
2023-07-05 06:40:02 -07:00
