)]}' { "log": [ { "commit": "ed4a5e564bca79a3da4e601ad3ff9ea4436d1ad3", "tree": "875f3b1d8b0d971fe02675afda6355350c117353", "parents": [ "6dafa6b6f6f980ddd2f667836364c9db5b303942" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Sat Sep 19 11:36:02 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 19 11:36:02 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15670)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "6dafa6b6f6f980ddd2f667836364c9db5b303942", "tree": "3a6cf9fb58baa2e9305fbc01c6dbbe3db86d9280", "parents": [ "fd822db9f9d584e95d9edc15d81ae8bd008895a4" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Sat Sep 19 04:35:37 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 19 04:35:37 2026" }, "message": "Fix *_into methods producing incorrect output for overlapping buffers (#15656)\n\n* Fix *_into methods producing incorrect output for overlapping buffers\n\nThe AEAD encrypt_into/decrypt_into methods, CipherContext.update_into,\nthe Cobblestone update_into methods, and the ConcatKDF/X963KDF\nderive_into methods all handed the caller\u0027s input and output buffers to\nthe underlying implementation without considering whether they shared\nmemory. When they did, the output could overwrite input that had not\nbeen read yet, silently producing incorrect results (in the AEAD case,\nwith a valid tag).\n\n- AEAD *_into and CipherContext.update_into now raise ValueError when\n the buffers partially overlap; exact in-place aliasing keeps working.\n- CipherContext.update_into with a block mode now operates from a copy\n of the input when used in place while a partial block is pending\n inside OpenSSL, instead of clobbering it.\n- Cobblestone update_into and the ConcatKDFHash/ConcatKDFHMAC/X963KDF\n derive_into methods operate from a copy of the input when the buffers\n overlap, since their output never sits at the input\u0027s offset.\n\nDiscovered by Anthropic\u0027s OSS Scanner, as vulnerability ANT-2026-QFHQ4A4C.\nDiscovered by Anthropic\u0027s OSS Scanner, as vulnerability ANT-2026-ECRME9NI.\nDiscovered by Anthropic\u0027s OSS Scanner, as vulnerability ANT-2026-BF6D5V9V.\nDiscovered by Anthropic\u0027s OSS Scanner, as vulnerability ANT-2026-UDR61OGV.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n* Reject any overlap between input and output buffers in *_into methods\n\nPer review: rather than allowing exact in-place aliasing and copying\nwhere the underlying implementation can\u0027t handle it, require the input\nand output buffers of every *_into method (AEAD encrypt_into/\ndecrypt_into, CipherContext.update_into, Cobblestone update_into, and\nall KDF derive_into methods) to be disjoint, raising ValueError\notherwise. The OpenSSH private key serializer, which encrypted in\nplace, now passes a copy of the secrets section.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n* Shorten changelog entry\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "fd822db9f9d584e95d9edc15d81ae8bd008895a4", "tree": "26b611ce6b35ce1f38f35305b6e0e72922574946", "parents": [ "39138c694142b2322b752a851902b745b1be58d0" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Sat Sep 19 04:34:27 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 19 04:34:27 2026" }, "message": "Raise ValueError when an SCT list is too large to encode (#15658)\n\n* Raise ValueError when an SCT list is too large to encode\n\nencode_scts wrote the RFC 6962 list-length prefix with a truncating\n`as u16` cast, so an extension whose serialized SCTs totalled more than\n65535 bytes was silently encoded with a wrapped length. The result is\nrejected by our own parser and by OpenSSL. Use u16::try_from for both\nthe list and per-entry lengths and raise ValueError instead.\n\nDiscovered by Anthropic\u0027s OSS Scanner, as vulnerability ANT-2026-H08T92Y2.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n* Simplify the oversized SCT list test\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n* Drop changelog entry\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n* Drop the unreachable per-entry length check\n\nThe total-length check already bounds every entry, and the branch could\nnever be hit, which failed the 100% coverage requirement.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n* Use try_into().unwrap() for the per-entry SCT length\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "39138c694142b2322b752a851902b745b1be58d0", "tree": "df030976eafd73a7abe4ebb1c294d2f0da6dba6b", "parents": [ "2dbd28726772063bff905a706fe224f1cc2613c2" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Fri Sep 18 11:10:44 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 11:10:44 2026" }, "message": "Bump downstream dependencies in CI (#15669)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "2dbd28726772063bff905a706fe224f1cc2613c2", "tree": "09ebea3ae63ad7915f21575163b2a2163747f502", "parents": [ "265bfb03f21b5c15e03a57b762c93a423aaa36e9" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Fri Sep 18 11:10:23 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 11:10:23 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15668)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "265bfb03f21b5c15e03a57b762c93a423aaa36e9", "tree": "2e9360c5ec8c4774b49c78c9272382811060807c", "parents": [ "038ba1406b54bb814709ef8beb195b4a84d0588d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 18 11:09:55 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 11:09:55 2026" }, "message": "chore(deps): bump platformdirs from 4.11.9 to 4.11.10 (#15667)\n\nBumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.9 to 4.11.10.\n- [Release notes](https://github.com/tox-dev/platformdirs/releases)\n- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.9...4.11.10)\n\n---\nupdated-dependencies:\n- dependency-name: platformdirs\n dependency-version: 4.11.10\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "038ba1406b54bb814709ef8beb195b4a84d0588d", "tree": "bc486960aab3dd5aa3ff5ba3bef25c731f431157", "parents": [ "1c53255ad1dc07fd1f5bf1a321dc3d1c3415c818" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 18 11:09:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 11:09:15 2026" }, "message": "chore(deps): bump virtualenv from 21.7.10 to 21.7.14 (#15666)\n\nBumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.10 to 21.7.14.\n- [Release notes](https://github.com/pypa/virtualenv/releases)\n- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/pypa/virtualenv/compare/21.7.10...21.7.14)\n\n---\nupdated-dependencies:\n- dependency-name: virtualenv\n dependency-version: 21.7.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1c53255ad1dc07fd1f5bf1a321dc3d1c3415c818", "tree": "adde2f1adf27877f2fc1afb9509a2fd9fac12011", "parents": [ "ea173e54583869bb10f9cff5b037f31f16576de7" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 18 11:08:04 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 11:08:04 2026" }, "message": "chore(deps): bump uv from 0.12.15 to 0.12.16 (#15665)\n\nBumps [uv](https://github.com/astral-sh/uv) from 0.12.15 to 0.12.16.\n- [Release notes](https://github.com/astral-sh/uv/releases)\n- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/uv/compare/0.12.15...0.12.16)\n\n---\nupdated-dependencies:\n- dependency-name: uv\n dependency-version: 0.12.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "ea173e54583869bb10f9cff5b037f31f16576de7", "tree": "416cb063e4dc2ff6718f04634940433802bfed09", "parents": [ "b2f7be7ded675a56c4e3eab607149bf7ad208ef7" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 18 11:07:48 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 11:07:48 2026" }, "message": "chore(deps): bump python-discovery from 1.6.0 to 1.6.1 (#15664)\n\nBumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.6.0 to 1.6.1.\n- [Release notes](https://github.com/tox-dev/python-discovery/releases)\n- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/tox-dev/python-discovery/compare/1.6.0...1.6.1)\n\n---\nupdated-dependencies:\n- dependency-name: python-discovery\n dependency-version: 1.6.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b2f7be7ded675a56c4e3eab607149bf7ad208ef7", "tree": "f952029cf29e0b998cf94f60650d3a9f178e06ab", "parents": [ "19ff77880bbd485464849366122982cd3a04d94b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 18 11:07:12 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 11:07:12 2026" }, "message": "chore(deps): bump idna from 3.19 to 3.20 (#15663)\n\nBumps [idna](https://github.com/kjd/idna) from 3.19 to 3.20.\n- [Release notes](https://github.com/kjd/idna/releases)\n- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)\n- [Commits](https://github.com/kjd/idna/compare/v3.19...v3.20)\n\n---\nupdated-dependencies:\n- dependency-name: idna\n dependency-version: \u00273.20\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "19ff77880bbd485464849366122982cd3a04d94b", "tree": "277038ebbf0311f6f186a8dc2e31f9f5c231274f", "parents": [ "e273f32259fc87b08e9ddf31fc2b1c17dd57ac34" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Fri Sep 18 03:51:18 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 03:51:18 2026" }, "message": "Document that DoS via parsing untrusted key material is out of scope (#15660)" }, { "commit": "e273f32259fc87b08e9ddf31fc2b1c17dd57ac34", "tree": "743072be891f7c0e5c43557b68e3c05c673634b6", "parents": [ "af4a928f59f627e8c0f7fbb1c857bf154ce8fa75" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Fri Sep 18 03:08:18 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 03:08:18 2026" }, "message": "asn1: make SetOf equality independent of element order (#15659)" }, { "commit": "af4a928f59f627e8c0f7fbb1c857bf154ce8fa75", "tree": "e738c12f7784e6eca0984598693b78bfcf6b79a6", "parents": [ "bdad0508129694cb4ecf6b42830e8ed94b52eb23" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Fri Sep 18 03:06:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 03:06:15 2026" }, "message": "asn1: reject optional or DEFAULT element types for list and SetOf (#15661)" }, { "commit": "bdad0508129694cb4ecf6b42830e8ed94b52eb23", "tree": "6ae7a03bc85caa1aa6227302ffe85b0f8e2713d5", "parents": [ "0f8ed4558edbe46db18990787148f760ee5442b5" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Fri Sep 18 02:56:07 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 02:56:07 2026" }, "message": "Release the GIL while parsing PKCS#12 bundles (#15657)\n\n* Release the GIL while parsing PKCS#12 bundles\n\nPKCS12_parse runs the MAC KDF and every PBE KDF in the bundle for the\niteration counts the file specifies, which can take a long time. Run it\nwith the GIL released, as the KDFs in kdf.rs already do, so that other\nPython threads are not stalled for the duration.\n\nDiscovered by Anthropic\u0027s OSS Scanner, as vulnerability ANT-2026-S35HH95Z.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n* Drop changelog entry\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01HVLJ4Wp5FraEfACovDdSN6\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "0f8ed4558edbe46db18990787148f760ee5442b5", "tree": "f9eefa54d5acfd3453f405eb10440bf3f2729dbc", "parents": [ "6be2ae4c598f206e49331ede25400f4d15a512aa" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Fri Sep 18 02:39:55 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 02:39:55 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15662)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "6be2ae4c598f206e49331ede25400f4d15a512aa", "tree": "1bee0fcffedfb1501ac3bf983f477e1ae97b56e3", "parents": [ "349f7de0b930cf05eac4442c2d5007c4f650b41c" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Thu Sep 17 22:28:29 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 22:28:29 2026" }, "message": "Bump downstream dependencies in CI (#15627)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "349f7de0b930cf05eac4442c2d5007c4f650b41c", "tree": "288955b5f69fb3e3ee17d7ec72874acf24ebb4f4", "parents": [ "2b8618a33165335ea1406540d82c81e708af0b30" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Thu Sep 17 22:10:38 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 22:10:38 2026" }, "message": "Switch downstream tests to Ubuntu 26.04 (#15628)\n\n* Switch downstream tests to Ubuntu 26.04\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01EkX3LD8jYgtCyGDVRUq6cr\n\n* Drop the stale cffi pin when installing aws-encryption-sdk-python\u0027s test requirements\n\nUbuntu 26.04 ships GCC 15, which rejects the implicit function\ndeclaration in cffi 1.15.1\u0027s _cffi_backend.c that GCC 13 only warned\nabout, so the source build for Python 3.14 fails. The pin is replaced by\ncryptography\u0027s own cffi requirement as soon as cryptography is\ninstalled, so skipping it changes nothing about what the tests run\nagainst.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01EkX3LD8jYgtCyGDVRUq6cr\n\n* Bump aws-encryption-sdk-python in CI and drop the cffi workaround\n\naws-encryption-sdk-python\u0027s test requirements now pin a cffi that builds\non Python 3.14 with GCC 15, so the downstream script can install the\nrequirements file unmodified again.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01EkX3LD8jYgtCyGDVRUq6cr\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "2b8618a33165335ea1406540d82c81e708af0b30", "tree": "ba205c8665b9f67355d9cd1fd9956b175bd1c291", "parents": [ "6d208e5973984ffdfd55e9889fa7a412c2f2d591" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Thu Sep 17 11:07:47 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 11:07:47 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15655)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "6d208e5973984ffdfd55e9889fa7a412c2f2d591", "tree": "c817e5a4e47215e0a5ccfda3ada7fb0278c9ea04", "parents": [ "d8080421a903abccbe2838565281854bde66c259" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 17 11:07:26 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 11:07:26 2026" }, "message": "chore(deps): bump platformdirs from 4.11.8 to 4.11.9 (#15654)\n\nBumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.8 to 4.11.9.\n- [Release notes](https://github.com/tox-dev/platformdirs/releases)\n- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.8...4.11.9)\n\n---\nupdated-dependencies:\n- dependency-name: platformdirs\n dependency-version: 4.11.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d8080421a903abccbe2838565281854bde66c259", "tree": "90aba38824a2e05bb5b88ebe2d5e63483bc18532", "parents": [ "3ce040daa3105de336ebe14842074fda70cc7f2c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 17 11:06:37 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 11:06:37 2026" }, "message": "chore(deps): bump ruff from 0.16.7 to 0.16.8 (#15653)\n\nBumps [ruff](https://github.com/astral-sh/ruff) from 0.16.7 to 0.16.8.\n- [Release notes](https://github.com/astral-sh/ruff/releases)\n- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/ruff/compare/0.16.7...0.16.8)\n\n---\nupdated-dependencies:\n- dependency-name: ruff\n dependency-version: 0.16.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "3ce040daa3105de336ebe14842074fda70cc7f2c", "tree": "29b4b811cfe9ca09e16e318f94c2b0851a38496b", "parents": [ "e4d1e395e215a4770f245f2e59a8ca66a9d2fea8" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 17 11:06:23 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 11:06:23 2026" }, "message": "chore(deps): bump cfg-if from 1.0.4 to 1.0.5 (#15651)\n\nBumps [cfg-if](https://github.com/rust-lang/cfg-if) from 1.0.4 to 1.0.5.\n- [Release notes](https://github.com/rust-lang/cfg-if/releases)\n- [Changelog](https://github.com/rust-lang/cfg-if/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/rust-lang/cfg-if/compare/v1.0.4...v1.0.5)\n\n---\nupdated-dependencies:\n- dependency-name: cfg-if\n dependency-version: 1.0.5\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e4d1e395e215a4770f245f2e59a8ca66a9d2fea8", "tree": "aa89abdd09f16ebd34c21add0fd9d8fae17dc7be", "parents": [ "6964deb501d43bd25fc92da6b43ae963d89a0099" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 17 11:05:54 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 11:05:54 2026" }, "message": "chore(deps): bump unicode-ident from 1.0.24 to 1.0.26 (#15650)\n\nBumps [unicode-ident](https://github.com/dtolnay/unicode-ident) from 1.0.24 to 1.0.26.\n- [Release notes](https://github.com/dtolnay/unicode-ident/releases)\n- [Commits](https://github.com/dtolnay/unicode-ident/compare/1.0.24...1.0.26)\n\n---\nupdated-dependencies:\n- dependency-name: unicode-ident\n dependency-version: 1.0.26\n dependency-type: indirect\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "6964deb501d43bd25fc92da6b43ae963d89a0099", "tree": "092a6817b206050ddca43729fa4d63052e682c1d", "parents": [ "773e35b6f179dd462b6de41bf086002926949f22" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 16 11:19:44 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 11:19:44 2026" }, "message": "chore(deps): bump urllib3 from 2.7.0 to 2.8.0 (#15648)\n\nBumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0.\n- [Release notes](https://github.com/urllib3/urllib3/releases)\n- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)\n- [Commits](https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0)\n\n---\nupdated-dependencies:\n- dependency-name: urllib3\n dependency-version: 2.8.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "773e35b6f179dd462b6de41bf086002926949f22", "tree": "98dce6e2f8b1ab45e42e47fe19d93eb8331a9488", "parents": [ "f0d63a17b855c0cdcd063ede423eac2b1d1f7951" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Wed Sep 16 11:07:40 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 11:07:40 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15649)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "f0d63a17b855c0cdcd063ede423eac2b1d1f7951", "tree": "cca660adb31e060d668f07935be6a87cd9d82e4d", "parents": [ "2b8df18bb9a5aca7b15ce4773dd0cc13a1925c8a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 16 11:04:35 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 11:04:35 2026" }, "message": "chore(deps): bump uv from 0.12.14 to 0.12.15 (#15647)\n\nBumps [uv](https://github.com/astral-sh/uv) from 0.12.14 to 0.12.15.\n- [Release notes](https://github.com/astral-sh/uv/releases)\n- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/uv/compare/0.12.14...0.12.15)\n\n---\nupdated-dependencies:\n- dependency-name: uv\n dependency-version: 0.12.15\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2b8df18bb9a5aca7b15ce4773dd0cc13a1925c8a", "tree": "a1c05873585997307d8ed1204df1dd3b4c0ec852", "parents": [ "0441a3d22e3dcf7b24d6430e32f84b217896309a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 16 11:04:20 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 11:04:20 2026" }, "message": "chore(deps): bump pyproject-hooks from 1.2.0 to 1.3.3 (#15646)\n\nBumps [pyproject-hooks](https://github.com/pypa/pyproject-hooks) from 1.2.0 to 1.3.3.\n- [Changelog](https://github.com/pypa/pyproject-hooks/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/pypa/pyproject-hooks/compare/v1.2.0...v1.3.3)\n\n---\nupdated-dependencies:\n- dependency-name: pyproject-hooks\n dependency-version: 1.3.3\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "0441a3d22e3dcf7b24d6430e32f84b217896309a", "tree": "cade5cc89ff606359466cf0acda08fea15ed9b76", "parents": [ "2122d7959f9bb9d06c06a02169f3315bdd017a71" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 16 11:03:29 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 11:03:29 2026" }, "message": "chore(deps): bump virtualenv from 21.7.9 to 21.7.10 (#15645)\n\nBumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.9 to 21.7.10.\n- [Release notes](https://github.com/pypa/virtualenv/releases)\n- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/pypa/virtualenv/compare/21.7.9...21.7.10)\n\n---\nupdated-dependencies:\n- dependency-name: virtualenv\n dependency-version: 21.7.10\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2122d7959f9bb9d06c06a02169f3315bdd017a71", "tree": "cf95b768fe183b086644534a93d3abb19cfab611", "parents": [ "2ad2c2b06e1ec374c05f0d8291cadce08eb7d102" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 16 11:02:54 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 11:02:54 2026" }, "message": "chore(deps): bump filelock from 3.32.6 to 3.32.7 (#15644)\n\nBumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.6 to 3.32.7.\n- [Release notes](https://github.com/tox-dev/py-filelock/releases)\n- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/tox-dev/py-filelock/compare/3.32.6...3.32.7)\n\n---\nupdated-dependencies:\n- dependency-name: filelock\n dependency-version: 3.32.7\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2ad2c2b06e1ec374c05f0d8291cadce08eb7d102", "tree": "d3b0cff23b052e8f1050490a7e16d0d2f141e083", "parents": [ "79eb899c68831dbe44d960691ac8ce970c9c0778" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Tue Sep 15 11:06:23 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 11:06:23 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15641)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "79eb899c68831dbe44d960691ac8ce970c9c0778", "tree": "767e3e7b097bf520d0e8b9269a9df83082529a7c", "parents": [ "db86f7a02e1b238daa4106ac0bc9c775aef3480b" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Tue Sep 15 11:05:10 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 11:05:10 2026" }, "message": "Bump x509-limbo and/or wycheproof in CI (#15642)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "db86f7a02e1b238daa4106ac0bc9c775aef3480b", "tree": "7a3a8161b01be4f53566db2408efaddfbc1a0fce", "parents": [ "67946b90c9b8f093caf54125bf484e5e0ac4422b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Sep 15 11:04:52 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 11:04:52 2026" }, "message": "chore(deps): bump uv from 0.12.13 to 0.12.14 (#15640)\n\nBumps [uv](https://github.com/astral-sh/uv) from 0.12.13 to 0.12.14.\n- [Release notes](https://github.com/astral-sh/uv/releases)\n- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/uv/compare/0.12.13...0.12.14)\n\n---\nupdated-dependencies:\n- dependency-name: uv\n dependency-version: 0.12.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "67946b90c9b8f093caf54125bf484e5e0ac4422b", "tree": "be9f22c75636391b86ebda8a94117c513a183068", "parents": [ "d21e67881550c6c9c1b9a22348067f2486b02d39" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Mon Sep 14 11:07:34 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 11:07:34 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15639)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "d21e67881550c6c9c1b9a22348067f2486b02d39", "tree": "eb290b353c2922597b6400c3746e87985a3dc4c4", "parents": [ "e1059053516381eb4e3e842ace8efd38e466b7b2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 14 11:07:12 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 11:07:12 2026" }, "message": "chore(deps): bump coverage from 7.16.0 to 7.16.1 (#15638)\n\nBumps [coverage](https://github.com/coveragepy/coveragepy) from 7.16.0 to 7.16.1.\n- [Release notes](https://github.com/coveragepy/coveragepy/releases)\n- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)\n- [Commits](https://github.com/coveragepy/coveragepy/compare/7.16.0...7.16.1)\n\n---\nupdated-dependencies:\n- dependency-name: coverage\n dependency-version: 7.16.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e1059053516381eb4e3e842ace8efd38e466b7b2", "tree": "0f48a9e47df51cb98e9459049abed7d2bbb938b1", "parents": [ "90ef872e92b4b52d1fe6e7559ef2c9b451feb30e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 14 11:06:21 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 11:06:21 2026" }, "message": "chore(deps): bump ast-serialize from 0.11.1 to 0.11.2 (#15637)\n\nBumps [ast-serialize](https://github.com/mypyc/ast_serialize) from 0.11.1 to 0.11.2.\n- [Commits](https://github.com/mypyc/ast_serialize/compare/v0.11.1...v0.11.2)\n\n---\nupdated-dependencies:\n- dependency-name: ast-serialize\n dependency-version: 0.11.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "90ef872e92b4b52d1fe6e7559ef2c9b451feb30e", "tree": "a969b35414b6f7e69d5923500067ae8cfdcfb45c", "parents": [ "3a4fba419123da6afe323f7dcd9db9ddc37d5728" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 14 11:05:59 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 11:05:59 2026" }, "message": "chore(deps): bump cc from 1.4.5 to 1.4.6 (#15636)\n\nBumps [cc](https://github.com/rust-lang/cc-rs) from 1.4.5 to 1.4.6.\n- [Release notes](https://github.com/rust-lang/cc-rs/releases)\n- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/rust-lang/cc-rs/compare/cc-v1.4.5...cc-v1.4.6)\n\n---\nupdated-dependencies:\n- dependency-name: cc\n dependency-version: 1.4.6\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "3a4fba419123da6afe323f7dcd9db9ddc37d5728", "tree": "3dfba79fe7920aeec708b1e727b423e7273b5e75", "parents": [ "643eb8ad012918486abee10791787d4d8875b9bb" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Sun Sep 13 13:15:02 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 13 13:15:02 2026" }, "message": "Accept RFC 5958 OneAsymmetricKey (PKCS8 v2) private keys (#15635)\n\nThe PKCS8 parser hardcoded the version field to 0, rejecting keys that\nuse version 1 (v2) as defined by RFC 5958\u0027s OneAsymmetricKey. This was\na regression in 45.0.0.\n\nAccept v2 keys, including the optional publicKey field. When a publicKey\nis present it is decoded with the same code used for SubjectPublicKeyInfo\nand must correspond to the private key, and a v1 key that carries a\npublicKey is rejected.\n\nFixes #15631\n\n\nClaude-Session: https://claude.ai/code/session_01C9h43nPNWwyd3NJuKQjXPn\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "643eb8ad012918486abee10791787d4d8875b9bb", "tree": "ffe7aa5630cd999c6bf4dcbb22c4cacca2ca280a", "parents": [ "7de3e66db5f1615092e6ee1abda399ea0e9ede78" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Sun Sep 13 12:50:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 13 12:50:03 2026" }, "message": "Add test vectors for RFC 5958 OneAsymmetricKey (PKCS8 v2) private keys (#15632)\n\n* Add test vectors for RFC 5958 OneAsymmetricKey (PKCS8 v2) private keys\n\nThe existing invalid-version.der vector was actually a valid v2\n(version\u003d1) key. It now uses version 2 so it remains invalid, and its\nprevious contents are preserved as ec-v2.der.\n\nNew vectors cover, for each key type, a v2 key with a publicKey field\nthat matches the private key and one with a publicKey that does not,\nplus a v1 key that (incorrectly) carries a publicKey and the Ed25519 v2\nkey from the report in #15631.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01C9h43nPNWwyd3NJuKQjXPn\n\n* Add a PKCS8 v2 vector with a compressed EC publicKey\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01C9h43nPNWwyd3NJuKQjXPn\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "7de3e66db5f1615092e6ee1abda399ea0e9ede78", "tree": "d2684d9802d596bd018c90a868e18f3c6db99702", "parents": [ "5053a6dddf10a5a2f7874bbfea1d0db0513718ae" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Sun Sep 13 10:44:54 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 13 10:44:54 2026" }, "message": "Bump x509-limbo and/or wycheproof in CI (#15634)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "5053a6dddf10a5a2f7874bbfea1d0db0513718ae", "tree": "967f71cde5586b08cf09e6f22166b81fe43c0d03", "parents": [ "24a62923a0b291d94161e3d2d49b829f9fff6842" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Sun Sep 13 10:44:29 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 13 10:44:29 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15633)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "24a62923a0b291d94161e3d2d49b829f9fff6842", "tree": "cf0570d27be9b1819b9fe5985b917b561b80ccf3", "parents": [ "cdaac7bad5fdf752d82aa182bb016b7f59a21d48" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Sat Sep 12 12:00:06 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 12 12:00:06 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15629)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "cdaac7bad5fdf752d82aa182bb016b7f59a21d48", "tree": "de857890de6c696d3d2452983a885730798dca39", "parents": [ "e8ba85a0e9f42e4230417baca7e50c8b40c299ca" ], "author": { "name": "Paul Kehrer", "email": "paul.l.kehrer@gmail.com", "time": "Fri Sep 11 11:40:01 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 11:40:01 2026" }, "message": "Use uv-managed Python for the remaining workflows (#15622)\n\nbenchmark, linkcheck and pypi-publish were the last users of\nactions/setup-python. They get uv from setup-uv with the version pinned\nby ci-constraints-requirements.txt, as ci.yml and the wheel builder\nalready do.\n\nlinkcheck\u0027s cache key claimed to match the docs job\u0027s, but the docs job\nhas run on 3.12 with an OpenSSL component in its key, and rust-cache\nadds the job id anyway, so it is keyed on the runtime id alone.\npypi-publish only needs uv for `uv publish`, so it no longer sets up an\ninterpreter at all. The benchmark comparison script runs on the PR\nvenv\u0027s interpreter instead of whatever `python` is on PATH.\n\n\nClaude-Session: https://claude.ai/code/session_0116sWJmeCaubZF2aMbR4kfc\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "e8ba85a0e9f42e4230417baca7e50c8b40c299ca", "tree": "188da1e5c98f97159c121f15ac2ab7d666a3eb71", "parents": [ "c76d659b3d611a35ab77424e51d46de52da36fde" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 11:37:21 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 11:37:21 2026" }, "message": "chore(deps): bump uv from 0.12.12 to 0.12.13 (#15626)\n\nBumps [uv](https://github.com/astral-sh/uv) from 0.12.12 to 0.12.13.\n- [Release notes](https://github.com/astral-sh/uv/releases)\n- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/uv/compare/0.12.12...0.12.13)\n\n---\nupdated-dependencies:\n- dependency-name: uv\n dependency-version: 0.12.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "c76d659b3d611a35ab77424e51d46de52da36fde", "tree": "b29b4af8611ff8d5b95199bfe66a364bc2e8b084", "parents": [ "9b23985aebcc41390c19caf761fd0c7dd70a1925" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Fri Sep 11 11:37:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 11:37:03 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15625)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "9b23985aebcc41390c19caf761fd0c7dd70a1925", "tree": "9cf0ad10ec21ace903c57ab36dbbf4e0ac36f6e6", "parents": [ "c507932a7d555e2a163f680722105727d91d472b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 11:36:34 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 11:36:34 2026" }, "message": "chore(deps): bump ruff from 0.16.6 to 0.16.7 (#15624)\n\nBumps [ruff](https://github.com/astral-sh/ruff) from 0.16.6 to 0.16.7.\n- [Release notes](https://github.com/astral-sh/ruff/releases)\n- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/ruff/compare/0.16.6...0.16.7)\n\n---\nupdated-dependencies:\n- dependency-name: ruff\n dependency-version: 0.16.7\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "c507932a7d555e2a163f680722105727d91d472b", "tree": "c787351457ba4a60d5755c09d87b2eaa3d9e5a26", "parents": [ "1c79e9cc2aa030d9019ef0ffddf3e93feaa5ccde" ], "author": { "name": "Paul Kehrer", "email": "paul.l.kehrer@gmail.com", "time": "Fri Sep 11 01:59:02 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 01:59:02 2026" }, "message": "Point the ECDH performance citation at the paper\u0027s landing page (#15623)\n\nThe PDF endpoint at digitalcommons.unl.edu has returned 403 to every\nclient for weeks, which has been failing the scheduled linkcheck. The\nlanding page for the same paper serves fine and lists that PDF URL as\nits own.\n\n\nClaude-Session: https://claude.ai/code/session_0116sWJmeCaubZF2aMbR4kfc\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "1c79e9cc2aa030d9019ef0ffddf3e93feaa5ccde", "tree": "6df4621d87e422ee92b0a0c645232a852de786fd", "parents": [ "ebbbd97eff2edd7d1ef2ad5b14f22b5751c4b2ea" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Fri Sep 11 01:57:43 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 01:57:43 2026" }, "message": "Only pre-key one cipher context for direction-independent AEADs (#15614)\n\n* Key a single base context in EvpCipherAead\n\nPreviously every EvpCipherAead pre-keyed two contexts, one for\nencryption and one for decryption. Most of our AEADs (GCM, ChaCha20-\nPoly1305, SIV, GCM-SIV) only use the forward block cipher, so a context\nkeyed for encryption can be switched to decryption by re-initializing\nit with no cipher or key, which we already do per-operation to set the\nnonce. Only key one context in that case.\n\nOCB is the exception: OpenSSL picks its hardware stream routine at\nkey-setup time based on the direction, so flipping a keyed context\nyields wrong output. It keeps a separate pre-keyed decryption context.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01NMHEsFraACZfyKod2vniDh\n\n* Model AEAD pre-keyed contexts by key schedule kind\n\nReplace the \"base context plus optional decryption context\" shape with\nan explicit KeySchedule enum. A cipher\u0027s key setup is either direction\nindependent (GCM, ChaCha20-Poly1305, SIV, GCM-SIV), in which case one\nkeyed context serves both directions, or per-direction (OCB), in which\ncase one context is keyed for each. CCM keeps no pre-keyed contexts.\n\nThis makes it clear the single-context case is not an assumption about\nwhich direction is more common.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01NMHEsFraACZfyKod2vniDh\n\n* Gate per-direction key schedule on backends that support OCB\n\nOCB is the only cipher with a direction-dependent key schedule, and it\nis unsupported on LibreSSL, BoringSSL, and AWS-LC, so the PerDirection\nvariants were dead code there and failed clippy with -D warnings.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01NMHEsFraACZfyKod2vniDh\n\n---------\n\nCo-authored-by: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e" }, { "commit": "ebbbd97eff2edd7d1ef2ad5b14f22b5751c4b2ea", "tree": "09831dd5643bf7fc2a706f04f0389732bb15b857", "parents": [ "4e7c5cc2837bc95ece3c1e222606ebf1cf3b0aca" ], "author": { "name": "Paul Kehrer", "email": "paul.l.kehrer@gmail.com", "time": "Thu Sep 10 21:55:43 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 21:55:43 2026" }, "message": "Use uv-managed Python for the wheel builder (#15621)\n\n* Use uv-managed Python for the wheel builder\n\nThe sdist, macOS and Windows jobs now get their interpreter from\nastral-sh/setup-uv instead of actions/setup-python or the python.org\npkg installer, with uv pinned from uv-requirements.txt as before. The\nmacOS matrix loses the download URLs, framework paths and installer\nchoice files, and the Windows matrix its freethreaded flag, since uv\u0027s\nversion spellings (3.14t, 3.15t, pypy3.11) cover both. The jobs set\nUV_PYTHON_PREFERENCE\u003donly-managed so a release build never picks up\nwhichever Python the runner image ships; the Windows arm64 jobs ask\nfor the aarch64 interpreter by name for the same reason as in ci.yml.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_0116sWJmeCaubZF2aMbR4kfc\n\n* Take the wheel builder\u0027s uv version from ci-constraints-requirements.txt\n\nThe first run of the wheel builder on setup-uv built the 3.15t wheels\nagainst cpython 3.15.0b4 and the 3.14 wheels against 3.14.6: uv\u0027s\ninterpreter manifest is compiled into the binary, and the pin in\nuv-requirements.txt had been sitting at 0.12.0 because dependabot only\nmaintains the pin in ci-constraints-requirements.txt. Use that file\ninstead, which ci.yml already does, and delete the unmaintained pair.\nNothing else consumed them.\n\nThe 3.15 free-threaded wheels are pinned to 3.15.0rc2 by name, as the\npkg URL and setup-python version were before, so a stale manifest\nfails the build instead of quietly picking an older prerelease.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_0116sWJmeCaubZF2aMbR4kfc\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "4e7c5cc2837bc95ece3c1e222606ebf1cf3b0aca", "tree": "74d8618caaa4b076836b73ecef4dc32e9723077f", "parents": [ "ed05adfc72b8c48d60e50e838b87f3e3bb280bd2" ], "author": { "name": "Paul Kehrer", "email": "paul.l.kehrer@gmail.com", "time": "Thu Sep 10 19:58:22 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 19:58:22 2026" }, "message": "Use uv-managed Python for the CI jobs (#15572)\n\n* Use uv-managed Python for the macOS CI jobs\n\nsetup-python installs the python.org pkg, and that installer runs for\n30-50s per job on the macOS runners. uv installs a python-build-standalone\ninterpreter in a few seconds. The uv version comes from the constraints\nfile, and the matrix names drop the -dev suffix because uv resolves an\nunreleased minor to its latest prerelease.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Drop comment\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Restore the cache key comment\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Use uv-managed Python for the linux, windows x64 and downstream jobs too\n\nThe windows arm64 job stays on setup-python: uv has no Windows arm64\ninterpreters.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Put libpython on the loader path for the rust session\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Use uv-managed Python for the windows arm64 job as well\n\nuv does ship Windows arm64 interpreters; they just don\u0027t appear in\n`uv python list --all-platforms`.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Ask uv for the aarch64 interpreter on the windows arm64 job\n\nLeft to a bare version request, uv on Windows arm64 downloads the\nx86_64 build, and maturin then targets x86_64-pc-windows-msvc.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Key the caches on setup-uv\u0027s python-runtime-id output\n\nsetup-uv v10.1.0 reports the activated venv\u0027s runtime as an opaque id\nlike cpython-3.15.0rc2-linux-x86_64-gnu, so the steps that read the\nresolved version from the interpreter go away. The id also carries the\nimplementation and architecture, which makes the matrix name and arch\ncomponents of the cache keys redundant.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_0116sWJmeCaubZF2aMbR4kfc\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "ed05adfc72b8c48d60e50e838b87f3e3bb280bd2", "tree": "db5347bbe800b8117cf605a52fe6067c9ca7713f", "parents": [ "7f229e65c01a7180e6495e05ffec472e22316b6e" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Thu Sep 10 10:52:23 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 10:52:23 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15619)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "7f229e65c01a7180e6495e05ffec472e22316b6e", "tree": "72eb33caf955b991f7c9f64ff4e01ac8d3cd6cde", "parents": [ "5affd0706f64c713fe2debbe8186892320c34f1c" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Thu Sep 10 10:51:57 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 10:51:57 2026" }, "message": "Bump downstream dependencies in CI (#15620)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "5affd0706f64c713fe2debbe8186892320c34f1c", "tree": "bef386e0bc318d0ecd9cd24cf90bd107bd953d20", "parents": [ "1179d47642408975fdb8a69b8ee40727c53f971d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 10 10:51:16 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 10:51:16 2026" }, "message": "chore(deps): bump uv from 0.12.11 to 0.12.12 (#15618)\n\nBumps [uv](https://github.com/astral-sh/uv) from 0.12.11 to 0.12.12.\n- [Release notes](https://github.com/astral-sh/uv/releases)\n- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/uv/compare/0.12.11...0.12.12)\n\n---\nupdated-dependencies:\n- dependency-name: uv\n dependency-version: 0.12.12\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1179d47642408975fdb8a69b8ee40727c53f971d", "tree": "97fae008d856794c5581c86bb8db12a3d80662de", "parents": [ "dfa09f371e51fc537dbdcb8340d1b1dfe9fcd25f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 10 10:50:58 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 10:50:58 2026" }, "message": "chore(deps): bump ast-serialize from 0.11.0 to 0.11.1 (#15617)\n\nBumps [ast-serialize](https://github.com/mypyc/ast_serialize) from 0.11.0 to 0.11.1.\n- [Commits](https://github.com/mypyc/ast_serialize/compare/v0.11.0...v0.11.1)\n\n---\nupdated-dependencies:\n- dependency-name: ast-serialize\n dependency-version: 0.11.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "dfa09f371e51fc537dbdcb8340d1b1dfe9fcd25f", "tree": "c074343afc4df2aba267b8a45cbe89779b2fdbd9", "parents": [ "c6349249a27bafcdbef68cd2451c60a226daa031" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 10 10:50:37 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 10:50:37 2026" }, "message": "chore(deps): bump build from 1.6.0 to 1.6.1 (#15616)\n\nBumps [build](https://github.com/pypa/build) from 1.6.0 to 1.6.1.\n- [Release notes](https://github.com/pypa/build/releases)\n- [Changelog](https://github.com/pypa/build/blob/1.6.1/CHANGELOG.rst)\n- [Commits](https://github.com/pypa/build/compare/1.6.0...1.6.1)\n\n---\nupdated-dependencies:\n- dependency-name: build\n dependency-version: 1.6.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "c6349249a27bafcdbef68cd2451c60a226daa031", "tree": "6045b87ab11567434b841bee125fa7bc2a7fe615", "parents": [ "e57b92215cad34e96e9a42800e66650eb571feeb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 10 10:50:04 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 10:50:04 2026" }, "message": "chore(deps): bump bitflags from 2.13.1 to 2.13.2 (#15615)\n\nBumps [bitflags](https://github.com/bitflags/bitflags) from 2.13.1 to 2.13.2.\n- [Release notes](https://github.com/bitflags/bitflags/releases)\n- [Changelog](https://github.com/bitflags/bitflags/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/bitflags/bitflags/compare/2.13.1...2.13.2)\n\n---\nupdated-dependencies:\n- dependency-name: bitflags\n dependency-version: 2.13.2\n dependency-type: indirect\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e57b92215cad34e96e9a42800e66650eb571feeb", "tree": "bb11d15361d7f9ea5c97da047fc03aa4929db906", "parents": [ "dd40899c32cad21df4885b4b6a518b475f27d88b" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Wed Sep 09 10:34:30 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 10:34:30 2026" }, "message": "Bump downstream dependencies in CI (#15613)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "dd40899c32cad21df4885b4b6a518b475f27d88b", "tree": "02b218d5f2fe5e6268d049e8813fbbe69ae6d6d8", "parents": [ "00c321882213cb62e47e1208b64feb712f8e802b" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Wed Sep 09 10:34:12 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 10:34:12 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15612)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "00c321882213cb62e47e1208b64feb712f8e802b", "tree": "003e27f6d83e81725a56169e73affe50e32b0dd3", "parents": [ "d9c9c92ba63bd47551aab96d3770605c95884308" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 09 10:26:08 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 10:26:08 2026" }, "message": "chore(deps): bump platformdirs from 4.11.7 to 4.11.8 (#15611)\n\nBumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.7 to 4.11.8.\n- [Release notes](https://github.com/tox-dev/platformdirs/releases)\n- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.7...4.11.8)\n\n---\nupdated-dependencies:\n- dependency-name: platformdirs\n dependency-version: 4.11.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d9c9c92ba63bd47551aab96d3770605c95884308", "tree": "4ecc6eec906765597efa761a5700dffbc46d1765", "parents": [ "c527ed1de7b783a546373fcb7bc157cd345ea850" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 09 10:24:32 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 10:24:32 2026" }, "message": "chore(deps): bump ast-serialize from 0.10.0 to 0.11.0 (#15610)\n\nBumps [ast-serialize](https://github.com/mypyc/ast_serialize) from 0.10.0 to 0.11.0.\n- [Commits](https://github.com/mypyc/ast_serialize/compare/v0.10.0...v0.11.0)\n\n---\nupdated-dependencies:\n- dependency-name: ast-serialize\n dependency-version: 0.11.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "c527ed1de7b783a546373fcb7bc157cd345ea850", "tree": "c372fca0a57b15fa7420a016fa12bb3e89971cca", "parents": [ "0234fa5588c086075b043d36bdca73e56a73cc8e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 09 10:23:58 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 10:23:58 2026" }, "message": "chore(deps): bump filelock from 3.32.5 to 3.32.6 (#15609)\n\nBumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.5 to 3.32.6.\n- [Release notes](https://github.com/tox-dev/py-filelock/releases)\n- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/tox-dev/py-filelock/compare/3.32.5...3.32.6)\n\n---\nupdated-dependencies:\n- dependency-name: filelock\n dependency-version: 3.32.6\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "0234fa5588c086075b043d36bdca73e56a73cc8e", "tree": "664cd19b8f8e342feccff060a572aa25f3687c96", "parents": [ "b7eefd81d38f1d7d7b0fa1e478b94c041cf9a389" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 09 10:23:06 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 10:23:06 2026" }, "message": "chore(deps): bump uv from 0.12.10 to 0.12.11 (#15608)\n\nBumps [uv](https://github.com/astral-sh/uv) from 0.12.10 to 0.12.11.\n- [Release notes](https://github.com/astral-sh/uv/releases)\n- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/uv/compare/0.12.10...0.12.11)\n\n---\nupdated-dependencies:\n- dependency-name: uv\n dependency-version: 0.12.11\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b7eefd81d38f1d7d7b0fa1e478b94c041cf9a389", "tree": "a1d3f28eb3d722e262e0ac8496e9695b104495e2", "parents": [ "80eecfb4cfa94a044b4a8c9bc73c687610ef8063" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 09 10:22:51 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 10:22:51 2026" }, "message": "chore(deps): bump virtualenv from 21.7.8 to 21.7.9 (#15607)\n\nBumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.8 to 21.7.9.\n- [Release notes](https://github.com/pypa/virtualenv/releases)\n- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/pypa/virtualenv/compare/21.7.8...21.7.9)\n\n---\nupdated-dependencies:\n- dependency-name: virtualenv\n dependency-version: 21.7.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "80eecfb4cfa94a044b4a8c9bc73c687610ef8063", "tree": "053db00d80c4964a1e70860ed7396c8b72dd5a7a", "parents": [ "486d30c1a56c6020834856cb9499606c20bed378" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Tue Sep 08 11:03:11 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 11:03:11 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15605)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "486d30c1a56c6020834856cb9499606c20bed378", "tree": "73020af99cad8dbc94bc6224f43044df969d594e", "parents": [ "24cf6c868614c79f6f2f5b9251f23c8dc4e8e5a0" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Tue Sep 08 11:02:42 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 11:02:42 2026" }, "message": "Bump downstream dependencies in CI (#15606)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "24cf6c868614c79f6f2f5b9251f23c8dc4e8e5a0", "tree": "032623f8b160a0244cff40dc361559defbdc1ef3", "parents": [ "3e92fbd7c89f386e4c0c05d9779dd441e8a0222f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Sep 08 11:02:11 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 11:02:11 2026" }, "message": "chore(deps): bump ast-serialize from 0.9.0 to 0.10.0 (#15604)\n\nBumps [ast-serialize](https://github.com/mypyc/ast_serialize) from 0.9.0 to 0.10.0.\n- [Commits](https://github.com/mypyc/ast_serialize/compare/v0.9.0...v0.10.0)\n\n---\nupdated-dependencies:\n- dependency-name: ast-serialize\n dependency-version: 0.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "3e92fbd7c89f386e4c0c05d9779dd441e8a0222f", "tree": "7ddb13606b103bc862425ef882829d9da7777e92", "parents": [ "70d3931e775e2a429ea8b148f5a5e88e7b8c7f30" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Mon Sep 07 11:07:51 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 11:07:51 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15601)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "70d3931e775e2a429ea8b148f5a5e88e7b8c7f30", "tree": "e0c0613db585bfc5c6ae7f499492747898913800", "parents": [ "91e4d6fce34ee1d0ea5ab7aa38d3a9791a2f90e9" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Mon Sep 07 11:07:20 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 11:07:20 2026" }, "message": "Bump downstream dependencies in CI (#15602)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "91e4d6fce34ee1d0ea5ab7aa38d3a9791a2f90e9", "tree": "463745372fc2d6fc77daae9e4a1f10259a47bcb9", "parents": [ "8891ee468e41eb66bddd8dd684e4a7a07d91e70c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 07 11:06:39 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 11:06:39 2026" }, "message": "chore(deps): bump uv from 0.12.9 to 0.12.10 (#15600)\n\nBumps [uv](https://github.com/astral-sh/uv) from 0.12.9 to 0.12.10.\n- [Release notes](https://github.com/astral-sh/uv/releases)\n- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/uv/compare/0.12.9...0.12.10)\n\n---\nupdated-dependencies:\n- dependency-name: uv\n dependency-version: 0.12.10\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "8891ee468e41eb66bddd8dd684e4a7a07d91e70c", "tree": "014e4e686716cfbb8fe072b2b7e5fc2cc369b1fe", "parents": [ "319658c09bd2e444961a7f46277600886f106b35" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Sun Sep 06 12:06:58 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 06 12:06:58 2026" }, "message": "Bump downstream dependencies in CI (#15598)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "319658c09bd2e444961a7f46277600886f106b35", "tree": "76fa61f6de337d0ff087f7d236d62f3f240d1011", "parents": [ "2a7bff07cf49bafd88b9942f4a9c9f72e00273ee" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Sat Sep 05 22:12:05 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 05 22:12:05 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15594)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "2a7bff07cf49bafd88b9942f4a9c9f72e00273ee", "tree": "ead343b21408efca1dc2efc9004bf9e5cfef6164", "parents": [ "693c80d7d493f865c8dcc9891f95785befa255ae" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Sat Sep 05 21:29:13 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 05 21:29:13 2026" }, "message": "Implement Fernet in Rust (#15592)\n\n* Implement Fernet in Rust\n\nMove Fernet and MultiFernet from Python to a Rust extension module,\nkeeping the public API (including the private helpers our tests use)\nunchanged. cryptography.fernet is now a thin shim that re-exports the\nRust classes and defines InvalidToken.\n\nNotable details:\n\n* Token and key base64 decoding matches base64.urlsafe_b64decode\n exactly (lenient alphabet/padding handling), with a fast path through\n the base64 crate for canonical input.\n* Each Fernet holds pre-keyed HMAC and AES-CBC contexts that are copied\n per operation, which is much cheaper than re-keying.\n* int(time.time()) is still obtained by calling into Python so that\n patching time.time keeps working.\n* ttl and current_time accept ints or floats with Python\u0027s arithmetic\n semantics, as the previous implementation did implicitly.\n* Large inputs release the GIL during encryption/decryption.\n* encrypt() now accepts any bytes-like object.\n\nEncrypt/decrypt are roughly 2-6x faster depending on message size.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01XDr9nsqX5Vzcz6vmGyfqTx\n\n* Address review feedback on Rust Fernet\n\n* Decode base64 with the base64 crate (canonical fast path, then a\n lenient URL-safe engine after stripping whitespace and mapping the\n standard alphabet) instead of a hand-written decoder.\n* Drop the ASCII checks on str inputs; non-ASCII simply fails to decode.\n* Drop the value_error helper and the unreachable OverflowError.\n* MultiFernet takes a Vec of Fernet instances.\n* Drop the changelog entry and simplify the CSPRNG wording in the docs.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01XDr9nsqX5Vzcz6vmGyfqTx\n\n* Decode Fernet base64 with a single URL-safe engine\n\nPadding is optional, but there is no special handling of whitespace,\nthe standard alphabet, or other CPython decoder laxities.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01XDr9nsqX5Vzcz6vmGyfqTx\n\n* Drop unneeded handling from Rust Fernet\n\nCoverage flagged code for cases that aren\u0027t required: float ttl and\ncurrent_time values, an IV length check on a test-only helper, and a\nunit test of the base64 crate\u0027s behavior. Remove them, and exercise the\nstr key path in test_generate.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01XDr9nsqX5Vzcz6vmGyfqTx\n\n---------\n\nCo-authored-by: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e" }, { "commit": "693c80d7d493f865c8dcc9891f95785befa255ae", "tree": "9b213b79434b6f491f77ceff956a0a9012cf6076", "parents": [ "e83bbe58e373536636baaa7c33a64a6e8f04c953" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Sat Sep 05 21:14:41 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 05 21:14:41 2026" }, "message": "Deprecate DSA (#15597)\n\n* Deprecate DSA\n\nEverything DSA is now deprecated, following the FFDH deprecation\nprecedent: accessing any public name in\ncryptography.hazmat.primitives.asymmetric.dsa emits a DeprecatedIn51\nwarning, as does loading a DSA key through the key loading APIs\n(including X.509 certificate and CSR public keys).\n\nInternal users of the DSA types (the asymmetric type unions, SSH and\nPKCS#12 serialization, the X.509 builders, and the Rust key type lookups)\ngo through private, non-warning aliases so unrelated code paths don\u0027t\ntrigger the warning.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_014YR2uV1PCas9ov5jz1KphM\n\n* Address review: point docs at ML-DSA, drop test class, fix downstream CI\n\n- The deprecation note now points at ML-DSA as the migration target.\n- Remove the TestDSADeprecation class; the warning is already asserted at\n the existing load sites.\n- certbot\u0027s acme suite and josepy promote warnings to errors and hit the\n new DSA deprecation warning (pyOpenSSL references the DSA types at\n import time; josepy deliberately loads a DSA key), so ignore that one\n warning in those downstream runs.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_014YR2uV1PCas9ov5jz1KphM\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "e83bbe58e373536636baaa7c33a64a6e8f04c953", "tree": "0260f5d855a4ffaf733d6d4ab15c1144ffff0a47", "parents": [ "04b328194844502f916c58e6c7ac94758f320fd2" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Sat Sep 05 21:11:53 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 05 21:11:53 2026" }, "message": "Raise InvalidTag on AEAD finalize failure regardless of error queue (#15596)\n\nOpenSSL f7d2d2acef (openssl/openssl#32587) now pushes PROV_R_BAD_DECRYPT\nonto the error queue when an AEAD tag check fails in EVP_DecryptFinal_ex.\nOur finalize only mapped failures to InvalidTag when the error queue was\nempty, so on OpenSSL master a bad GCM tag surfaced as a ValueError about\nblock length instead.\n\nFor modes with an authentication tag, treat any finalize failure as\nInvalidTag. Older OpenSSL, BoringSSL, AWS-LC, and LibreSSL still leave\nthe queue empty, so behavior there is unchanged.\n\n\nClaude-Session: https://claude.ai/code/session_01Eg4jjDRiLcBQrdEFsL3fCD\n\nCo-authored-by: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e" }, { "commit": "04b328194844502f916c58e6c7ac94758f320fd2", "tree": "27698a30e145c1452ceac516065792e6fd6c38ef", "parents": [ "1d428a1663f93b4a5db3be99453b259a046d9d81" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Sat Sep 05 11:47:25 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 05 11:47:25 2026" }, "message": "Bump downstream dependencies in CI (#15595)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "1d428a1663f93b4a5db3be99453b259a046d9d81", "tree": "77a3b6bae83f3b1bcf21f46a537433a4449779ce", "parents": [ "8079ae9f8cf134dbb2a466a53d0d3f8b8880118a" ], "author": { "name": "Matthieu Darbois", "email": "mayeut@users.noreply.github.com", "time": "Sat Sep 05 11:38:05 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 05 11:38:05 2026" }, "message": "Build abi3.abi3t wheels for CPython 3.15+ (#15496)\n\n* Build abi3.abi3t wheels for CPython 3.15+\n\n* use freethreaded python version\n\n* do not use allow-prereleases\n\n* use 3.15.0rc2\n\n* use 3.15.0rc2" }, { "commit": "8079ae9f8cf134dbb2a466a53d0d3f8b8880118a", "tree": "fa81f6476eee361c7dfca8a566e8a88a7bec7d10", "parents": [ "4a4de1daa83ec20d4eb0e2e32a69debc4064485e" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Fri Sep 04 11:08:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 11:08:03 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15589)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "4a4de1daa83ec20d4eb0e2e32a69debc4064485e", "tree": "92b24843d331e56d0542ce0382aa4cccb2c554a5", "parents": [ "4c52aadccb90358a2fcf11facfe6a940cb15a10a" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Fri Sep 04 11:07:56 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 11:07:56 2026" }, "message": "Bump downstream dependencies in CI (#15591)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "4c52aadccb90358a2fcf11facfe6a940cb15a10a", "tree": "77f0a118f19898e0eb29f08bb41b83966c4627c2", "parents": [ "7799d1ac30e343e8dc57835aaf8b231b1d43615d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 04 11:07:38 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 11:07:38 2026" }, "message": "chore(deps): bump ruff from 0.16.5 to 0.16.6 (#15590)\n\nBumps [ruff](https://github.com/astral-sh/ruff) from 0.16.5 to 0.16.6.\n- [Release notes](https://github.com/astral-sh/ruff/releases)\n- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/ruff/compare/0.16.5...0.16.6)\n\n---\nupdated-dependencies:\n- dependency-name: ruff\n dependency-version: 0.16.6\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "7799d1ac30e343e8dc57835aaf8b231b1d43615d", "tree": "a1a2c5a4b72f6919452c1806cb16513827adb9ec", "parents": [ "4a2b34aae8c80727e91311054cfe3fe12d381e83" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 04 11:06:58 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 11:06:58 2026" }, "message": "chore(deps): bump cc from 1.4.4 to 1.4.5 (#15588)\n\nBumps [cc](https://github.com/rust-lang/cc-rs) from 1.4.4 to 1.4.5.\n- [Release notes](https://github.com/rust-lang/cc-rs/releases)\n- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/rust-lang/cc-rs/compare/cc-v1.4.4...cc-v1.4.5)\n\n---\nupdated-dependencies:\n- dependency-name: cc\n dependency-version: 1.4.5\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "4a2b34aae8c80727e91311054cfe3fe12d381e83", "tree": "ea8e6dbae4ecb469aba1578c370d4638c89fe955", "parents": [ "e2c761e747a25c5cd6c04092ef680f9c0e17dbd6" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 04 11:06:32 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 11:06:32 2026" }, "message": "chore(deps): bump find-msvc-tools from 0.1.11 to 0.1.12 (#15587)\n\nBumps [find-msvc-tools](https://github.com/rust-lang/cc-rs) from 0.1.11 to 0.1.12.\n- [Release notes](https://github.com/rust-lang/cc-rs/releases)\n- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/rust-lang/cc-rs/compare/find-msvc-tools-v0.1.11...find-msvc-tools-v0.1.12)\n\n---\nupdated-dependencies:\n- dependency-name: find-msvc-tools\n dependency-version: 0.1.12\n dependency-type: indirect\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e2c761e747a25c5cd6c04092ef680f9c0e17dbd6", "tree": "a9da3f7abf918cc11045da0c4dbd4000c40dc671", "parents": [ "3c4803c16ddb2dea09377d8b3cb4e006125e023e" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Thu Sep 03 22:07:50 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 22:07:50 2026" }, "message": "Bump downstream dependencies in CI (#15583)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "3c4803c16ddb2dea09377d8b3cb4e006125e023e", "tree": "3a5bc71b9984865ef6c1fe9d65e2504bd7842c7f", "parents": [ "5cf3292c8001496194624f4350c8d62754f2891f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 03 22:06:31 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 22:06:31 2026" }, "message": "chore(deps): bump ast-serialize from 0.8.0 to 0.9.0 (#15582)\n\nBumps [ast-serialize](https://github.com/mypyc/ast_serialize) from 0.8.0 to 0.9.0.\n- [Commits](https://github.com/mypyc/ast_serialize/compare/v0.8.0...v0.9.0)\n\n---\nupdated-dependencies:\n- dependency-name: ast-serialize\n dependency-version: 0.9.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5cf3292c8001496194624f4350c8d62754f2891f", "tree": "3cd8272a5ea15ec17669f7b1f58435b9cf5b383b", "parents": [ "5826448ee648dd3083ecda1ceea72a6c9ddaa4bd" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Thu Sep 03 22:05:09 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 22:05:09 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15586)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "5826448ee648dd3083ecda1ceea72a6c9ddaa4bd", "tree": "b03476824fca03c9379ce3cf4aa521315ae1bbf9", "parents": [ "b3f5a1295d289c13488e09782a5bab95e6cf1b73" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Thu Sep 03 21:59:04 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 21:59:04 2026" }, "message": "Bump x509-limbo and/or wycheproof in CI (#15580)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "b3f5a1295d289c13488e09782a5bab95e6cf1b73", "tree": "0df49a53a420f213e3582ba4033ff11641861265", "parents": [ "6ed4d3aa10454aba1cc844f3441f84cec039805a" ], "author": { "name": "Alex Gaynor", "email": "alex.gaynor@gmail.com", "time": "Thu Sep 03 14:18:48 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 14:18:48 2026" }, "message": "Fix nightly cargo unused_dependencies warning in cryptography-cffi (#15585)\n\n* Fix nightly cargo unused_dependencies warning in cryptography-cffi\n\nThe new `cargo::unused_dependencies` lint (stabilized alongside\n`[lints.cargo]` in Rust 1.100) flags `openssl-sys` in cryptography-cffi\nbecause nothing in the crate references it. The dependency is required\nthough: its build script reads `DEP_OPENSSL_INCLUDE` to compile the\nCFFI-generated C code against the right OpenSSL headers, and Cargo only\nexports a `links` crate\u0027s metadata to its immediate dependents.\n\nMark the dependency as intentional with `use openssl_sys as _;`.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01KdrEHfbwEfRs5CR4328Mbk\n\n* Shorten the openssl-sys dependency comment\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01KdrEHfbwEfRs5CR4328Mbk\n\n---------\n\nCo-authored-by: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e" }, { "commit": "6ed4d3aa10454aba1cc844f3441f84cec039805a", "tree": "6956cbafb8862f174e40d00f2e9359dc1afbb03f", "parents": [ "5936b461718024e377713d875b6c59fe5a5df3f5" ], "author": { "name": "Gleb Khmyznikov", "email": "gkhmyznikov@microsoft.com", "time": "Wed Sep 02 23:05:26 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 23:05:26 2026" }, "message": "Promote Windows on ARM (win_arm64) to a fully supported platform (#15350)\n\nWindows on ARM was previously kept in a stability validation period: its\nwheel was built and smoke-tested but not uploaded, and the arm64 test and\nwheel-build steps used continue-on-error with soft-failure warnings so\nproblems would not block CI or releases.\n\nThis promotes win_arm64 to full support:\n\n- Upload the arm64 wheel like every other platform (drop the arch guard in\n the windows-wheel action).\n- Remove continue-on-error and the \"Report soft failure\" steps for the\n arm64 entries in ci.yml and wheel-builder.yml, so arm64 failures are\n treated as real failures.\n- Add Python 3.15-dev arm64 entries for both tests (ci.yml) and wheel\n builds (wheel-builder.yml).\n\nCo-authored-by: Copilot App \u003c223556219+Copilot@users.noreply.github.com\u003e\nCopilot-Session: 879e51f7-4d6c-4e05-a054-fd91a4649153" }, { "commit": "5936b461718024e377713d875b6c59fe5a5df3f5", "tree": "b0a6c7d705e59a4a36cc23235af4dbbba5a84aa7", "parents": [ "8ffc6698b542d6fa75d1b38ab834258256b61d5b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 02 11:16:32 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 11:16:32 2026" }, "message": "chore(deps): bump uv from 0.12.8 to 0.12.9 (#15579)\n\nBumps [uv](https://github.com/astral-sh/uv) from 0.12.8 to 0.12.9.\n- [Release notes](https://github.com/astral-sh/uv/releases)\n- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/uv/compare/0.12.8...0.12.9)\n\n---\nupdated-dependencies:\n- dependency-name: uv\n dependency-version: 0.12.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "8ffc6698b542d6fa75d1b38ab834258256b61d5b", "tree": "d987b54563cfe1c1341384a23c5d066981059d7b", "parents": [ "f99a0f5911b17713a70c5c8b34295ae9d75d5f0a" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Wed Sep 02 11:16:18 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 11:16:18 2026" }, "message": "Bump downstream dependencies in CI (#15581)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "f99a0f5911b17713a70c5c8b34295ae9d75d5f0a", "tree": "3d1249cb837c2809cce8729352814510d2e397af", "parents": [ "dc90920a2ec398427a3d5700eb2be7cfa1f12932" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Wed Sep 02 11:14:56 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 11:14:56 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15578)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "dc90920a2ec398427a3d5700eb2be7cfa1f12932", "tree": "25c77f6e611e59a2625cad14e71dd6faefc3f095", "parents": [ "545e2ee9c9a366608dec055ae25e429e5b0a1484" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 02 11:08:47 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 11:08:47 2026" }, "message": "chore(deps): bump pytest-randomly from 4.1.0 to 5.0.0 (#15577)\n\nBumps [pytest-randomly](https://github.com/pytest-dev/pytest-randomly) from 4.1.0 to 5.0.0.\n- [Changelog](https://github.com/pytest-dev/pytest-randomly/blob/main/CHANGELOG.rst)\n- [Commits](https://github.com/pytest-dev/pytest-randomly/compare/4.1.0...5.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: pytest-randomly\n dependency-version: 5.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "545e2ee9c9a366608dec055ae25e429e5b0a1484", "tree": "84ccfabc9fd033b1b567a140fe1e16db301d3b71", "parents": [ "ea0db1fcb475d1b597526f20e2379e74e679e5e7" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 02 11:07:23 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 11:07:23 2026" }, "message": "chore(deps): bump platformdirs from 4.11.6 to 4.11.7 (#15576)\n\nBumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.6 to 4.11.7.\n- [Release notes](https://github.com/tox-dev/platformdirs/releases)\n- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.6...4.11.7)\n\n---\nupdated-dependencies:\n- dependency-name: platformdirs\n dependency-version: 4.11.7\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "ea0db1fcb475d1b597526f20e2379e74e679e5e7", "tree": "0019b01973624f28770af9b19373f91fbe91c5d2", "parents": [ "9a7a991ff5894a361d2d05c8e13658322ded5b1b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 02 11:05:37 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 11:05:37 2026" }, "message": "chore(deps): bump virtualenv from 21.7.7 to 21.7.8 (#15575)\n\nBumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.7 to 21.7.8.\n- [Release notes](https://github.com/pypa/virtualenv/releases)\n- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/pypa/virtualenv/compare/21.7.7...21.7.8)\n\n---\nupdated-dependencies:\n- dependency-name: virtualenv\n dependency-version: 21.7.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9a7a991ff5894a361d2d05c8e13658322ded5b1b", "tree": "d8be11e277f67bec2e1fb8b1cde38f8738ef0d40", "parents": [ "f019444e13c677cd58e7b42b0ca47717a4b5fbd2" ], "author": { "name": "Paul Kehrer", "email": "paul.l.kehrer@gmail.com", "time": "Wed Sep 02 11:05:06 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 11:05:06 2026" }, "message": "Skip building the parts of the OpenSSL forks we delete anyway (#15574)\n\nOpenSSL\u0027s default make target also generates the man pages (build_sw\ndoesn\u0027t), LibreSSL builds its apps and AWS-LC its bssl tool; the\nscript removes bin/ and share/ from the install right after.\n\n\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "f019444e13c677cd58e7b42b0ca47717a4b5fbd2", "tree": "0c37f64e6f813f76deff72a01229e3edbe06738c", "parents": [ "b882cf5988082350e603809e89a45f0fb4262b86" ], "author": { "name": "Paul Kehrer", "email": "paul.l.kehrer@gmail.com", "time": "Wed Sep 02 03:57:18 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 03:57:18 2026" }, "message": "Key the cargo cache on the OpenSSL build it was compiled against (#15570)\n\n* Key the cargo cache on the OpenSSL build it was compiled against\n\nopenssl-sys registers cargo:rerun-if-changed on the OpenSSL include\ndirectory, and cargo evaluates that by mtime. The cargo cache was keyed\non the OpenSSL configuration but not on the specific build, so a\ncargo cache saved before the library was rebuilt saw \"newer\" headers on\nevery run and recompiled openssl-sys, openssl, and everything above\nthem until the next Cargo.lock or rustc change rotated the key. On\nmacOS this was happening on every run: the pyca/infra artifact is\nnewer than the cache.\n\nOn macOS and Windows the id of the downloaded artifact becomes part of\nthe key, which means downloading before the cache step. On linux the\nOpenSSL cache key (which, unlike the config hash, includes the build\nscript hash) is used instead of the config hash.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Trim comments\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "b882cf5988082350e603809e89a45f0fb4262b86", "tree": "b739826f7d6c35081bb4a6579c30e47f9cafa58d", "parents": [ "6fa59292134414ca443b68a636743103660752c3" ], "author": { "name": "Paul Kehrer", "email": "paul.l.kehrer@gmail.com", "time": "Wed Sep 02 03:54:44 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 03:54:44 2026" }, "message": "Build BoringSSL and AWS-LC with optimization in CI (#15571)\n\n* Build BoringSSL and AWS-LC with optimization in CI\n\nNeither project sets a default CMAKE_BUILD_TYPE, and the CI build\ndidn\u0027t pass one, so CMake passed no optimization flags at all and the\nlibraries under test were compiled at -O0. RelWithAsserts is Release\nwithout NDEBUG, i.e. -O3 with asserts kept, and is what BoringSSL\u0027s\nown CI uses.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Drop comments\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "6fa59292134414ca443b68a636743103660752c3", "tree": "d6a534578bab29e0aaf23f61198bec26797d0c79", "parents": [ "8ce44c94630e91ae2e8bfd6ee6591f02a80e6044" ], "author": { "name": "Paul Kehrer", "email": "paul.l.kehrer@gmail.com", "time": "Wed Sep 02 03:33:34 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 03:33:34 2026" }, "message": "Don\u0027t build the test suites of the OpenSSL forks we compile in CI (#15569)\n\n* Don\u0027t build the test suites of the OpenSSL forks we compile in CI\n\n`ninja install` depends on `all`, which includes the (large) test\nsuites of BoringSSL, AWS-LC and LibreSSL unless they\u0027re turned off,\nand OpenSSL\u0027s default target builds its test programs. None of them\nare ever run. Locally on 4 cores, BoringSSL goes from 141s to 48s and\nAWS-LC from 87s to 15s.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Drop redundant comment\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n* Drop the remaining comments\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e" }, { "commit": "8ce44c94630e91ae2e8bfd6ee6591f02a80e6044", "tree": "340c4f6a737944769fbd54e3831969cf536e7b86", "parents": [ "be2c8ef4b3a2a6a88505b1472c36a75bb7c856c2" ], "author": { "name": "Sergio C.C.", "email": "117457137+SergioCc13@users.noreply.github.com", "time": "Tue Sep 01 21:38:12 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 21:38:12 2026" }, "message": "docs: tag the hpke module as versionadded 47.0.0 (#15567)\n\nMove the \u0027.. versionadded:: 47.0.0\u0027 from the individual hybrid-key\nclasses (MLKEM768X25519PrivateKey, MLKEM768X25519PublicKey,\nMLKEM1024P384PrivateKey, MLKEM1024P384PublicKey) up to the module\nlevel, so Suite/KEM/KDF/AEAD are covered too. KEM.enc_length()\nkeeps its own \u0027.. versionadded:: 49.0.0\u0027.\n\nRefs #15561" }, { "commit": "be2c8ef4b3a2a6a88505b1472c36a75bb7c856c2", "tree": "edf38c232476c7490d01818ddc7eca5739f460f3", "parents": [ "48f559c7e818aadb750a95a7b4df77d46004ad56" ], "author": { "name": "pyca-boringbot[bot]", "email": "106132319+pyca-boringbot[bot]@users.noreply.github.com", "time": "Tue Sep 01 11:08:34 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 11:08:34 2026" }, "message": "Bump BoringSSL, OpenSSL, AWS-LC in CI (#15562)\n\nCo-authored-by: pyca-boringbot[bot] \u003cpyca-boringbot[bot]+106132319@users.noreply.github.com\u003e" }, { "commit": "48f559c7e818aadb750a95a7b4df77d46004ad56", "tree": "65f1751eadcaaa3976d696206108180429c6aba8", "parents": [ "5796a734d867a41d2fc00bc90733c0e35306cc6b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Sep 01 11:06:58 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 11:06:58 2026" }, "message": "chore(deps): bump uv from 0.12.7 to 0.12.8 (#15563)\n\nBumps [uv](https://github.com/astral-sh/uv) from 0.12.7 to 0.12.8.\n- [Release notes](https://github.com/astral-sh/uv/releases)\n- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/uv/compare/0.12.7...0.12.8)\n\n---\nupdated-dependencies:\n- dependency-name: uv\n dependency-version: 0.12.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5796a734d867a41d2fc00bc90733c0e35306cc6b", "tree": "2cb6cd66f93f8c87a86a03fbf145343c6a7e0fc9", "parents": [ "f9d20b5bbac86c7fb36261a383117bddfdece586" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Sep 01 11:05:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 11:05:15 2026" }, "message": "chore(deps): bump platformdirs from 4.11.5 to 4.11.6 (#15564)\n\nBumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.5 to 4.11.6.\n- [Release notes](https://github.com/tox-dev/platformdirs/releases)\n- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.5...4.11.6)\n\n---\nupdated-dependencies:\n- dependency-name: platformdirs\n dependency-version: 4.11.6\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f9d20b5bbac86c7fb36261a383117bddfdece586", "tree": "2fef0c0b545c8138cc603954b26ccba2a68beb95", "parents": [ "69db85121a2f8671c3e54a8ec7b1c697e4d5fc56" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Sep 01 11:04:51 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 11:04:51 2026" }, "message": "chore(deps): bump filelock from 3.32.4 to 3.32.5 (#15565)\n\nBumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.4 to 3.32.5.\n- [Release notes](https://github.com/tox-dev/py-filelock/releases)\n- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/tox-dev/py-filelock/compare/3.32.4...3.32.5)\n\n---\nupdated-dependencies:\n- dependency-name: filelock\n dependency-version: 3.32.5\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" } ], "next": "69db85121a2f8671c3e54a8ec7b1c697e4d5fc56" }