Skip to content

Bump idna from 3.10 to 3.15#66

Closed
dependabot[bot] wants to merge 283 commits into
mainfrom
dependabot/uv/idna-3.15
Closed

Bump idna from 3.10 to 3.15#66
dependabot[bot] wants to merge 283 commits into
mainfrom
dependabot/uv/idna-3.15

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 19, 2026

Bumps idna from 3.10 to 3.15.

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

  • Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
  • Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
  • Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
  • Allow flit_core 4.x in the build backend.
  • Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
  • Add Dependabot configuration for GitHub Actions.
  • Convert README and HISTORY from reStructuredText to Markdown.
  • Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

  • Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

3.13 (2026-04-22)

  • Correct classification error for codepoint U+A7F1

3.12 (2026-04-21)

  • Update to Unicode 17.0.0.
  • Issue a deprecation warning for the transitional argument.
  • Added lazy-loading to provide some performance improvements.
  • Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

3.11 (2025-10-12)

  • Update to Unicode 16.0.0, including significant changes to UTS46 processing. As a result of Unicode ending support for it, transitional processing no longer has an effect and returns the same result.

... (truncated)

Commits
  • af30a09 Release 3.15
  • 30314d4 Pre-release 3.15rc0
  • 05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
  • 2987fdb Convert README and HISTORY from reStructuredText to Markdown
  • 59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
  • def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
  • bbd8004 Merge pull request #234 from StanFromIreland/patch-1
  • edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
  • 5557db0 Merge branch 'master' into patch-1
  • f11746c Merge pull request #235 from StanFromIreland/patch-2
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Copilot AI and others added 30 commits May 12, 2026 17:23
…site

Add Autoloop Go migration progress site
…o Go (+3418 lines, 4245 total, 5.92%)

Migrated modules:
- utils/content_hash.py -> internal/utils/contenthash
- utils/exclude.py -> internal/utils/exclude (with tests)
- utils/path_security.py -> internal/utils/pathsecurity (with tests)
- utils/version_checker.py -> internal/utils/versionchecker
- utils/file_ops.py -> internal/utils/fileops
- utils/console.py -> internal/utils/console
- utils/diagnostics.py -> internal/utils/diagnostics
- utils/install_tui.py -> internal/utils/installtui
- utils/github_host.py -> internal/utils/githubhost (with tests)
- utils/reflink.py -> internal/utils/reflink (linux+other build tags)
- install/errors.py -> internal/install/errors
- install/cache_pin.py -> internal/install/cachepin
- install/context.py -> internal/install/installctx

Metric: 5.92% (previous best: 5.41%, delta: +0.51%)
Run: https://github.com/githubnext/apm/actions/runs/25771166584

Co-authored-by: Copilot <[email protected]>
- Advance status table to iteration 24 (best metric 9.89%, ~7,092 migrated lines)
- Expand migration progress table through iter 24 with workflow run links
- Expand migrated modules table to all 24 modules from migration-status.json
- Add branch-reset caveat explaining iter-13 JSON baseline vs iter-24 reality
- Refresh manifest-ops benchmark with fresh python3 run (923x check_collision at scale)
- Add Go build/test validation signals table
- Update Next up from memory Future Directions
- Update last-updated timestamp to 2026-05-13 15:14 UTC

Co-authored-by: Copilot <[email protected]>
Includes bundle transport fix for shallow checkouts (#31603) which
fixes the merge-commit-brings-in-protected-files problem.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
…-iter24-7b126167538465d9

[autoloop-progress] docs: update Go migration progress page to iteration 24
- Mark PR #17 as merged (2026-05-13T16:30:28Z)
- Update migrated module count to 54 (from iter-24 issue comment)
- Refresh manifest benchmark table from local run of
  scripts/benchmark_manifest_ops.py (check_collision now 1606x at
  large scale, scoped uninstall 26x)
- Bump Last updated to 2026-05-13 16:32 UTC

Co-authored-by: Copilot <[email protected]>
…ate-iter24-merged-6f8a4775f94dff72

[autoloop-progress] docs: update Go migration progress page for iter-24 / PR #17 merged
…o Go (+3691 Python lines, 11.07%)

Rebuild 30 modules from iter-24 baseline and add 5 new modules:
- compilation: buildid, constants, output_writer, constitution (iter-24 rebuild)
- compilation: claude_formatter, gemini_formatter (agentformatter), injector, template_builder (new)
- models: results, dependency/types
- policy: schema, matcher, inheritance
- install: request, summary, mcp/args
- runtime: base
- marketplace: validator, errors, semver, tag_pattern, shadow_detector
- cache: url_normalize, paths, integrity
- integration: utils, coverage
- workflow: parser (iter-24 rebuild), discovery (new)
- core: null_logger, docker_args
- deps: git_remote_ops, aggregator, installed_package
- primitives: models

New metric: 11.07% (7936/71696 Python lines migrated)
Previous best: 9.89%
Delta: +1.18%

Run: https://github.com/githubnext/apm/actions/runs/25812073376

Co-authored-by: Copilot <[email protected]>
…te-ref

Autoloop can't create PRs because go.mod, go.sum, and other dev files
are on the default protected list. Every iteration silently falls back
to creating an issue instead of a PR.

- Exclude go.mod, go.sum, package.json, requirements.txt, etc.
- Add max-patch-files: 500
- Add recreate-ref: true

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
…tected

Exclude dev files from autoloop protected-files list
…+4024 Python lines)

Migrated install/plan.py, insecure_policy.py, 6 install phases (cleanup,
finalize, heal, lockfile, post_deps_local, download), 6 MCP modules
(warnings, conflicts, entry, writer, command, registry), and 2 policy
check modules (policy_checks, ci_checks). All use stdlib-only Go.
go build ./... and go test ./... pass. Metric: 16.68% (prev 15.16, +1.52).

Run: https://github.com/githubnext/apm/actions/runs/25835089265

Co-authored-by: Copilot <[email protected]>
…1103 Python lines)

Migrated modules:
- integration/skill_transformer.py (113) -> skilltransformer: ToHyphenCase, SkillTransformer.TransformToAgent
- integration/dispatch.py (91) -> dispatch: PrimitiveDispatch struct, DefaultDispatchTable
- install/heals/base.py (122) -> heals: HealContext, Heal interface, RunHealChain
- install/heals/branch_ref_drift.py (66) -> heals: BranchRefDriftHeal
- install/heals/buggy_lockfile_recovery.py (99) -> heals: BuggyLockfileRecoveryHeal
- compilation/constitution_block.py (104) -> constitutionblock: RenderBlock, InjectOrUpdate
- install/phases/local_content.py (191) -> localcontent: ProjectHasRootPrimitives, HasLocalApmContent
- install/phases/policy_target_check.py (113) -> policytargetcheck: TargetCheckIDs, ShouldRunCheck
- install/phases/policy_gate.py (204) -> policygate: PolicyViolationError, EnforcementResult

Metric: 16.68 -> 18.22 (+1.54)
Run: https://github.com/githubnext/apm/actions/runs/25836695236

Co-authored-by: Copilot <[email protected]>
github-actions Bot and others added 21 commits May 18, 2026 17:12
…es for 6 packages (console, gitenv, skilltransformer, apmresolver, instructionintegrator, promptintegrator)

Run: https://github.com/githubnext/apm/actions/runs/26051591636

Co-authored-by: Copilot <[email protected]>
…es for 6 thin packages (policytargetcheck, pack, mcpentry, heals, codexruntime, publisher)

Run: https://github.com/githubnext/apm/actions/runs/26054516496

Co-authored-by: Copilot <[email protected]>
…or 6 thin Go packages

Added extra_test.go files for mcpregistry (IP edge cases, decimal loopback,
cloud metadata, RFC1918), guards (nested dirs, multiple roots, sorted violations,
wrapped errors), schema (ApmPolicy combos, FetchFailure/Remote, DependencyPolicy
Allow/Deny/Require), results (overwrite, missing keys, variants), mcp command
(SearchOptions/InstallOptions/InfoOptions fields), and compilationformatter
(FileTypesSummary variants, PlacementStrategy constants, HasIssues, New, FormatDefault).
899 new test lines total; registered 6 new test-migrated entries.

Run: https://github.com/githubnext/apm/actions/runs/26057497454

Co-authored-by: Copilot <[email protected]>
…or 6 thin Go packages

Added extra_test.go files for windsurf, lockfile, baseintegrator,
experimental, auth, and runtime/base; registered 6 new test-migrated
entries (+824 lines).

Run: https://github.com/githubnext/apm/actions/runs/26063987994

Co-authored-by: Copilot <[email protected]>
…s for 7 thin Go packages (yamlio, mkio, manager, sha, exclude, subprocenv, urlnormalize)

Run: https://github.com/githubnext/apm/actions/runs/26071073779

Co-authored-by: Copilot <[email protected]>
…s for 7 thin Go packages (deps, policygate, summary, pkgresolution, cursor, view, dispatch)

Run: https://github.com/githubnext/apm/actions/runs/26073892157

Co-authored-by: Copilot <[email protected]>
Bumps [idna](https://github.com/kjd/idna) from 3.10 to 3.15.
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.10...v3.15)

---
updated-dependencies:
- dependency-name: idna
  dependency-version: '3.15'
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 19, 2026
@mrjf
Copy link
Copy Markdown
Contributor

mrjf commented May 21, 2026

Closing as part of resetting githubnext/apm to match the current state of upstream microsoft/apm. The Python-to-Go migration experiment has been wound down. See commit ccdafc4 on main.

@mrjf mrjf closed this May 21, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 21, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/uv/idna-3.15 branch May 21, 2026 14:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants