From 5265459bd350ff52887ad5d0ceeb984779d56dbe Mon Sep 17 00:00:00 2001 From: aio-libs bot Date: Tue, 15 Sep 2026 06:55:23 -0500 Subject: [PATCH 1/5] Drop stale filterwarnings entries from pytest config (#13717) --- CHANGES/13717.contrib.rst | 3 +++ pytest.ini | 23 ----------------------- tests/test_circular_imports.py | 13 ------------- 3 files changed, 3 insertions(+), 36 deletions(-) create mode 100644 CHANGES/13717.contrib.rst diff --git a/CHANGES/13717.contrib.rst b/CHANGES/13717.contrib.rst new file mode 100644 index 00000000000..2a21e528d23 --- /dev/null +++ b/CHANGES/13717.contrib.rst @@ -0,0 +1,3 @@ +Removed stale ``filterwarnings`` ignores from the pytest configuration +that are no longer triggered by aiohttp, the supported Python versions +or the pinned test dependencies -- by :user:`aiolibsbot`. diff --git a/pytest.ini b/pytest.ini index 314d4636657..f8d220488fa 100644 --- a/pytest.ini +++ b/pytest.ini @@ -53,30 +53,7 @@ faulthandler_timeout = 30 filterwarnings = error - ignore:module 'ssl' has no attribute 'OP_NO_COMPRESSION'. The Python interpreter is compiled against OpenSSL < 1.0.0. Ref. https.//docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION:UserWarning ignore:Unclosed client session 2022.06.15`. - ignore:path is deprecated. Use files.. instead. Refer to https.//importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy for migration advice.:DeprecationWarning:certifi.core - # Dateutil deprecation warning already fixed upstream. - # Can be dropped with the next release, `dateutil > 2.8.2` - # https://github.com/dateutil/dateutil/pull/1285 - ignore:datetime.*utcfromtimestamp\(\) is deprecated and scheduled for removal:DeprecationWarning:dateutil.tz.tz - # Tracked upstream and waiting for PR review - # https://github.com/spulec/freezegun/issues/508 - # https://github.com/spulec/freezegun/pull/511 - ignore:datetime.*utcnow\(\) is deprecated and scheduled for removal:DeprecationWarning:freezegun.api # coverage's C tracer is not available on iOS/Android (pure-Python fallback is used instead) ignore:Couldn't import C tracer:coverage.exceptions.CoverageWarning # Weird issue in Python 3.13+ triggered in test_multipart.py diff --git a/tests/test_circular_imports.py b/tests/test_circular_imports.py index bb780fa84e6..a6d1d56e095 100644 --- a/tests/test_circular_imports.py +++ b/tests/test_circular_imports.py @@ -107,19 +107,6 @@ def test_no_warnings(import_path: str) -> None: # fmt: off sys.executable, "-W", "error", - # The following deprecation warning is triggered by importing - # `gunicorn.util`. Hopefully, it'll get fixed in the future. See - # https://github.com/benoitc/gunicorn/issues/2840 for detail. - "-W", "ignore:module 'sre_constants' is " - "deprecated:DeprecationWarning:pkg_resources._vendor.pyparsing", - # Also caused by `gunicorn.util` importing `pkg_resources`: - "-W", "ignore:Creating a LegacyVersion has been deprecated and " - "will be removed in the next major release:" - "DeprecationWarning:", - # Deprecation warning emitted by setuptools v67.5.0+ triggered by importing - # `gunicorn.util`. - "-W", "ignore:pkg_resources is deprecated as an API:" - "DeprecationWarning", "-c", f"import {import_path!s}", # fmt: on ) From 1f2aadd234182ba9dd39fd54028d48772361b9f8 Mon Sep 17 00:00:00 2001 From: aio-libs bot Date: Tue, 15 Sep 2026 07:52:59 -0500 Subject: [PATCH 2/5] Drop leftover pip --user settings from CI workflow (#13721) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What do these changes do? Removes `PIP_USER: 1` (4×) and the `PATH="${HOME}/Library/Python/3.11/bin:${HOME}/.local/bin:${PATH}"` prefix left in the `autobahn` job. Both come from the time CI installed deps with `pip install --user`. Since #12629 the `test` and `autobahn` jobs use `astral-sh/setup-uv` with `activate-environment: true`, so `.venv/bin` is already on `PATH` and uv ignores `PIP_USER`. The prefix also put `~/.local/bin` in front of the venv. #10762 already removed the same prefix from the `test` job. Checked that nothing still depends on them. `PIP_USER` appears only in `ci-cd.yml`. Nothing in `tests/`, `tools/` or the `Makefile` test targets calls pip. The autobahn subprocesses run `sys.executable`. The only `pip install` (`tests/autobahn/Dockerfile.aiohttp`) runs inside a Docker build, which doesn't inherit the step env. In `cython-coverage`, `PIP_USER` was only set on the pytest step, never on the install steps. This is step 1 of #13718. The commit cherry-picks cleanly onto `3.15` and `3.14` (checked locally), so please add `backport-3.14` + `backport-3.15`. #13722 and #13723 bring the remaining master-only workflow bits to those branches. ## Are there changes in behavior for the user? No, CI-only. ## Is it a substantial burden for the maintainers to support this? No. It removes 5 dead lines and makes the stable branches' workflows easier to keep in sync. ## Related issue number Part of #13718 ## Checklist - [x] I think the code is well written - [ ] Unit tests for the changes exist — N/A, CI config; this PR's own CI run exercises the edited jobs - [ ] Documentation reflects the changes — N/A - [ ] If you provide code modification, please add yourself to `CONTRIBUTORS.txt` — N/A - [x] Add a new news fragment into the `CHANGES/` folder
Local verification ``` $ git diff --shortstat upstream/master -- .github/workflows/ci-cd.yml 1 file changed, 5 deletions(-) $ git grep -n -E 'PIP_USER|Library/Python' -- .github/workflows/ (no output) $ python -c 'import yaml; d = yaml.safe_load(open(".github/workflows/ci-cd.yml")); print(len(d["jobs"]), "jobs")' 14 jobs $ yamllint -f parsable -d '{extends: relaxed, rules: {line-length: disable}}' .github/workflows/ci-cd.yml | wc -l 29 # same as upstream/master $ # trial cherry-pick in scratch worktrees 3.15: clean 3.14: clean ```
Drafted with Claude Opus 5 (Kōan); reviewed by: pending operator review. --- ### Quality Report **Changes**: 3 files changed, 5 insertions(+), 5 deletions(-) **Code scan**: clean **Tests**: failed (FAILED) **Branch hygiene**: clean _Generated by [Kōan](https://koan.anantys.com)_ --- .github/workflows/ci-cd.yml | 5 ----- CHANGES/13718.contrib.rst | 4 ++++ CHANGES/13721.contrib.rst | 1 + 3 files changed, 5 insertions(+), 5 deletions(-) create mode 100644 CHANGES/13718.contrib.rst create mode 120000 CHANGES/13721.contrib.rst diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index bc66ed702e8..d105368d71d 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -320,7 +320,6 @@ jobs: env: COLOR: yes AIOHTTP_NO_EXTENSIONS: ${{ matrix.no-extensions }} - PIP_USER: 1 run: >- pytest --junitxml=junit.xml -m 'not dev_mode and not autobahn' shell: bash @@ -336,7 +335,6 @@ jobs: env: COLOR: yes AIOHTTP_NO_EXTENSIONS: ${{ matrix.no-extensions }} - PIP_USER: 1 PYTHONDEVMODE: 1 run: pytest -m dev_mode --cov-append --cov-report=xml --numprocesses=0 shell: bash @@ -470,9 +468,7 @@ jobs: env: COLOR: yes AIOHTTP_NO_EXTENSIONS: ${{ matrix.no-extensions }} - PIP_USER: 1 run: >- - PATH="${HOME}/Library/Python/3.11/bin:${HOME}/.local/bin:${PATH}" pytest --junitxml=junit.xml --cov-report=xml --numprocesses=0 --timeout=0 -o faulthandler_timeout=0 -m autobahn shell: bash @@ -608,7 +604,6 @@ jobs: - name: Run tests with Cython tracing env: COLOR: yes - PIP_USER: 1 run: >- pytest tests/test_client_functional.py tests/test_http_parser.py tests/test_http_writer.py tests/test_web_functional.py tests/test_web_response.py tests/test_websocket_parser.py --cov-config=.coveragerc-cython.toml diff --git a/CHANGES/13718.contrib.rst b/CHANGES/13718.contrib.rst new file mode 100644 index 00000000000..8613749e11f --- /dev/null +++ b/CHANGES/13718.contrib.rst @@ -0,0 +1,4 @@ +Dropped the leftover ``PIP_USER`` setting and the ``pip --user`` ``PATH`` +prefix from the CI workflow; both became dead once the test jobs started +provisioning Python via ``astral-sh/setup-uv`` +-- by :user:`aiolibsbot`. diff --git a/CHANGES/13721.contrib.rst b/CHANGES/13721.contrib.rst new file mode 120000 index 00000000000..994b0da4d0a --- /dev/null +++ b/CHANGES/13721.contrib.rst @@ -0,0 +1 @@ +13718.contrib.rst \ No newline at end of file From ac5685c3709685a2eac683306fa713d15abfe243 Mon Sep 17 00:00:00 2001 From: aio-libs bot Date: Tue, 15 Sep 2026 09:38:01 -0500 Subject: [PATCH 3/5] Point Dependabot GitHub Actions updates at 3.14 too (#13727) --- .github/dependabot.yml | 12 ++++++++++++ CHANGES/13727.contrib.rst | 3 +++ 2 files changed, 15 insertions(+) create mode 100644 CHANGES/13727.contrib.rst diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1657d0444d4..eff47252de0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -70,3 +70,15 @@ updates: target-branch: "3.15" schedule: interval: "monthly" + + # Maintain dependencies for GitHub Actions aiohttp 3.14 backport + - package-ecosystem: "github-actions" + directory: "/" + cooldown: + default-days: 3 + labels: + - dependencies + target-branch: "3.14" + schedule: + interval: "daily" + open-pull-requests-limit: 10 diff --git a/CHANGES/13727.contrib.rst b/CHANGES/13727.contrib.rst new file mode 100644 index 00000000000..cb3368bf558 --- /dev/null +++ b/CHANGES/13727.contrib.rst @@ -0,0 +1,3 @@ +Configured Dependabot to also bump GitHub Actions on the ``3.14`` +branch, so its CI workflow pins no longer fall behind master +-- by :user:`aiolibsbot`. From bf8515b5accaf16011d0045fdbc4ac86d51ab431 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 15 Sep 2026 15:47:20 +0000 Subject: [PATCH 4/5] Bump platformdirs from 4.11.7 to 4.11.8 (#13704) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.7 to 4.11.8.
Release notes

Sourced from platformdirs's releases.

4.11.8

What's Changed

New Contributors

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.11.7...4.11.8

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.8 (2026-09-08)

  • Make :func:~platformdirs.user_data_path, :func:~platformdirs.user_config_path, :func:~platformdirs.user_preference_path and :func:~platformdirs.user_applications_path return the first site entry when root is redirected by use_site_for_root under multipath, matching their site_*_path twins. They passed the whole joined list to :class:~pathlib.Path, giving one unusable path such as /xdg/a/foo:/xdg/b/foo - by :user:darrenhuai. :pr:538
  • Ignore relative paths in XDG Base Directory environment variables and use the existing platform fallback. Relative entries in $XDG_DATA_DIRS and $XDG_CONFIG_DIRS are skipped. :pr:540
  • Preserve literal percent signs in Unix user-dirs.dirs paths, including 100% complete, 100%% and %(XDG_DESKTOP_DIR)s. Continue to expand $HOME. :pr:542
  • Use the base Python installation to locate Homebrew site directories on macOS, preserving shared data, config, cache and state paths inside virtual environments. :pr:543

4.11.7 (2026-09-01)

4.11.6 (2026-09-01)

  • Give :func:~platformdirs.user_bin_dir and :func:~platformdirs.user_bin_path the use_site_for_root argument. They took none, so neither could reach the Unix redirect of root to :func:~platformdirs.site_bin_dir. :pr:537

4.11.5 (2026-08-27)

  • Give :func:~platformdirs.user_preference_dir and :func:~platformdirs.user_preference_path the same arguments as :func:~platformdirs.user_config_dir. Added without arguments in :pr:491, they could only return the unscoped base directory even though the property they wrap appends the app name and version. :pr:531
  • Make :func:~platformdirs.site_applications_path return the first entry when multipath=True, matching :func:~platformdirs.site_data_path. On Unix and macOS it passed the whole $XDG_DATA_DIRS list to :class:~pathlib.Path, giving one unusable path such as /first/applications:/second/applications. :pr:532
  • Give :func:~platformdirs.user_applications_dir, :func:~platformdirs.user_applications_path, :func:~platformdirs.site_applications_dir and :func:~platformdirs.site_applications_path the app arguments. Android scopes both applications directories to the app, so without them the functions could only return the unscoped base directory there. On the two site functions they are keyword-only, keeping multipath first positional as it has been since 4.9.0; the two user functions take their boolean options keyword-only. :pr:534

... (truncated)

Commits
  • c5ef1ed Release 4.11.8
  • 0e85d6f fix: retain Homebrew site directories inside virtual environments (#543)
  • b86a670 fix: preserve literal percent signs in user-dirs paths (#542)
  • a6791c8 fix: return one user path for root under multipath (#538)
  • 5550385 fix: ignore relative XDG base directory paths (#540)
  • a209bf8 [pre-commit.ci] pre-commit autoupdate (#541)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.11.7&new-version=4.11.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 32210cd9454..615da83e34c 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -168,7 +168,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.7 +platformdirs==4.11.8 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 7ce427eae91..77e3e6592a4 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -165,7 +165,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.7 +platformdirs==4.11.8 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 8e019e49a77..2e4cc3a5f68 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -86,7 +86,7 @@ packaging==26.3 # via pytest pathspec==1.1.1 # via mypy -platformdirs==4.11.7 +platformdirs==4.11.8 # via virtualenv pluggy==1.6.0 # via pytest From a9a4317557d5fe3f9e8fbafcd2308c0804f5c01a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 15 Sep 2026 15:53:24 +0000 Subject: [PATCH 5/5] Bump ast-serialize from 0.10.0 to 0.11.1 (#13701) Bumps [ast-serialize](https://github.com/mypyc/ast_serialize) from 0.10.0 to 0.11.1.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ast-serialize&package-manager=pip&previous-version=0.10.0&new-version=0.11.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 615da83e34c..e4f9dfa73b2 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -26,7 +26,7 @@ alabaster==1.0.0 # via sphinx annotated-types==0.8.0 # via pydantic -ast-serialize==0.10.0 +ast-serialize==0.11.1 # via mypy async-timeout==5.0.1 ; python_version < "3.11" # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 77e3e6592a4..a679092b69f 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -26,7 +26,7 @@ alabaster==1.0.0 # via sphinx annotated-types==0.8.0 # via pydantic -ast-serialize==0.10.0 +ast-serialize==0.11.1 # via mypy async-timeout==5.0.1 ; python_version < "3.11" # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 2e4cc3a5f68..dc8106d210c 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -14,7 +14,7 @@ aiosignal==1.4.0 # via aiohttp annotated-types==0.8.0 # via pydantic -ast-serialize==0.10.0 +ast-serialize==0.11.1 # via mypy async-timeout==5.0.1 # via diff --git a/requirements/test-common.txt b/requirements/test-common.txt index 32f454b09db..cd4ff07f0ed 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -10,7 +10,7 @@ aiosignal==1.4.0 # via aiohttp annotated-types==0.8.0 # via pydantic -ast-serialize==0.10.0 +ast-serialize==0.11.1 # via mypy async-timeout==5.0.1 # via aiohttp diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 6f0695e9ecd..952ef1f5b5f 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -18,7 +18,7 @@ aiosignal==1.4.0 # aiohttp annotated-types==0.8.0 # via pydantic -ast-serialize==0.10.0 +ast-serialize==0.11.1 # via mypy async-timeout==5.0.1 ; python_version < "3.11" # via diff --git a/requirements/test.txt b/requirements/test.txt index 9c6936dfa3a..ee8946bd05e 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -18,7 +18,7 @@ aiosignal==1.4.0 # aiohttp annotated-types==0.8.0 # via pydantic -ast-serialize==0.10.0 +ast-serialize==0.11.1 # via mypy async-timeout==5.0.1 ; python_version < "3.11" # via