Skip to content

Nickvines/20250902 fips#9

Closed
nickvines wants to merge 72 commits intomainfrom
nickvines/20250902-fips
Closed

Nickvines/20250902 fips#9
nickvines wants to merge 72 commits intomainfrom
nickvines/20250902-fips

Conversation

@nickvines
Copy link
Contributor

No description provided.

zanieb and others added 30 commits June 12, 2025 18:21
Silly typo in #659 — turns out macOS is where it fails with the wrong
flags, not Linux
Goes from a range of 26-32m -> 15->23m
Picking up astral-sh/python-build-standalone#93

---------

Co-authored-by: Adrian Antkowiak <adiantek@gmail.com>
Using the free GitHub runners for Linux breaks those builds :)
Uses a raw string literal for the regex to avoid
```
python-build-standalone/pythonbuild/cpython.py:675: SyntaxWarning: invalid escape sequence '\{'
  RE_INITTAB_ENTRY = re.compile('\{"([^"]+)", ([^\}]+)\},')
```
This seems to "just work." Let's stay modern.
I think deletion of the legacy proto packages a few commits ago fixed up
the build failures the deleted comment alluded to.
I just published an LLVM 20 toolchain for aarch64. The toolchain
has support for PGO and BOLT.

This commit switches the Linux aarch64 builds to be performed natively
on aarch64 machines. PGO and BOLT are enabled on the builds, hopefully
making them a bit faster.
This task was deferred from the initial Python 3.14 support. There's
already support on Windows.
[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=pip&previous-version=2.4.0&new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/astral-sh/python-build-standalone/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the python group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [certifi](https://github.com/certifi/python-certifi) | `2025.4.26` |
`2025.6.15` |
| [pyyaml](https://github.com/yaml/pyyaml) | `6.0.1` | `6.0.2` |
| [rpds-py](https://github.com/crate-py/rpds) | `0.25.1` | `0.26.0` |
| [typing-extensions](https://github.com/python/typing_extensions) |
`4.13.2` | `4.14.1` |
| [mypy](https://github.com/python/mypy) | `1.16.0` | `1.16.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.11.13` | `0.12.2` |


Updates `certifi` from 2025.4.26 to 2025.6.15
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/e767d5938eddddf804216cec93a55c85129c5f2d"><code>e767d59</code></a>
2025.06.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/357">#357</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3e7076557d66b598fcca462e422dc988f09a6802"><code>3e70765</code></a>
Bump actions/setup-python from 5.5.0 to 5.6.0</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9afd2ff407b8a0638988c952a6636b8dd623af7c"><code>9afd2ff</code></a>
Bump actions/download-artifact from 4.2.1 to 4.3.0</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/d7c816cbc9cf621b3ddc8cd7fa7eda3f36982620"><code>d7c816c</code></a>
remove code that's no longer required that 3.7 is our minimum (<a
href="https://redirect.github.com/certifi/python-certifi/issues/351">#351</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/189961379209973abd0dd6304297f03e2359e1b9"><code>1899613</code></a>
Declare setuptools as the build backend in pyproject.toml (<a
href="https://redirect.github.com/certifi/python-certifi/issues/350">#350</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c8741423d67e1025c0bdad5225ded05cf962f207"><code>c874142</code></a>
update CI for ubuntu 20.04 deprecation (<a
href="https://redirect.github.com/certifi/python-certifi/issues/348">#348</a>)</li>
<li>See full diff in <a
href="https://github.com/certifi/python-certifi/compare/2025.04.26...2025.06.15">compare
view</a></li>
</ul>
</details>
<br />

Updates `pyyaml` from 6.0.1 to 6.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/yaml/pyyaml/releases">pyyaml's
releases</a>.</em></p>
<blockquote>
<h2>6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Support for Cython 3.x and Python 3.13.</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/yaml/pyyaml/compare/6.0.1...6.0.2">https://github.com/yaml/pyyaml/compare/6.0.1...6.0.2</a></p>
<h2>6.0.2rc1</h2>
<ul>
<li>Support for extension build with Cython 3.x</li>
<li>Support for Python 3.13</li>
<li>Added PyPI wheels for musllinux on aarch64</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/yaml/pyyaml/blob/main/CHANGES">pyyaml's
changelog</a>.</em></p>
<blockquote>
<p>6.0.2 (2024-08-06)</p>
<ul>
<li><a
href="https://redirect.github.com/yaml/pyyaml/pull/808">yaml/pyyaml#808</a>
-- Support for Cython 3.x and Python 3.13</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/yaml/pyyaml/commit/41309b0bcb4559edb1d691d47199035ef539d785"><code>41309b0</code></a>
Release 6.0.2 (<a
href="https://redirect.github.com/yaml/pyyaml/issues/819">#819</a>)</li>
<li><a
href="https://github.com/yaml/pyyaml/commit/dd9f0e1236775dcce682c91823e009556ce2a271"><code>dd9f0e1</code></a>
6.0.2rc1 (<a
href="https://redirect.github.com/yaml/pyyaml/issues/809">#809</a>)</li>
<li><a
href="https://github.com/yaml/pyyaml/commit/f5527a26d518b3e9c66f9211e0af00c83f09a97e"><code>f5527a2</code></a>
disable CI trigger on PR edits</li>
<li><a
href="https://github.com/yaml/pyyaml/commit/b4d80a742142004490d2da7691d534923820b81c"><code>b4d80a7</code></a>
Python 3.12 + musllinux_1_1_x86_64 wheel support</li>
<li>See full diff in <a
href="https://github.com/yaml/pyyaml/compare/6.0.1...6.0.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `rpds-py` from 0.25.1 to 0.26.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/crate-py/rpds/releases">rpds-py's
releases</a>.</em></p>
<blockquote>
<h2>v0.26.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Build CPython 3.14 wheels by <a
href="https://github.com/edgarrmondragon"><code>@​edgarrmondragon</code></a>
in <a
href="https://redirect.github.com/crate-py/rpds/pull/134">crate-py/rpds#134</a></li>
<li>Require maturin&gt;=1.9.0 to ensure support for PEP 639 by <a
href="https://github.com/edgarrmondragon"><code>@​edgarrmondragon</code></a>
in <a
href="https://redirect.github.com/crate-py/rpds/pull/146">crate-py/rpds#146</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/crate-py/rpds/compare/v0.25.1...v0.26.0">https://github.com/crate-py/rpds/compare/v0.25.1...v0.26.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/crate-py/rpds/commit/ff9278f7e718760bb052cd4c130bbdeca8d27b20"><code>ff9278f</code></a>
Tag a release.</li>
<li><a
href="https://github.com/crate-py/rpds/commit/d2f69ef82b23135fedc8b42bda743f9c53af607d"><code>d2f69ef</code></a>
Update requirements.</li>
<li><a
href="https://github.com/crate-py/rpds/commit/58ee607148940533f212893ac886f7e82b3c35bb"><code>58ee607</code></a>
Merge pull request <a
href="https://redirect.github.com/crate-py/rpds/issues/146">#146</a>
from edgarrmondragon/136-require-maturin-1.9-pep639</li>
<li><a
href="https://github.com/crate-py/rpds/commit/5433ab6aa936aa835d97bb204fd73d289525e331"><code>5433ab6</code></a>
Require maturin&gt;=1.9.0 to ensure support for PEP 639</li>
<li><a
href="https://github.com/crate-py/rpds/commit/7557e538fb8d14c4b534133b9ac48f3940e787b4"><code>7557e53</code></a>
Merge pull request <a
href="https://redirect.github.com/crate-py/rpds/issues/144">#144</a>
from crate-py/dependabot/github_actions/github/codeql...</li>
<li><a
href="https://github.com/crate-py/rpds/commit/d0963ae1a2b0bcc61702adb3249ae3b73bc32dda"><code>d0963ae</code></a>
Merge pull request <a
href="https://redirect.github.com/crate-py/rpds/issues/145">#145</a>
from crate-py/dependabot/github_actions/astral-sh/set...</li>
<li><a
href="https://github.com/crate-py/rpds/commit/513ec227cba30c93b4df9c820b4d54e7e6dcb318"><code>513ec22</code></a>
Bump astral-sh/setup-uv from 6.3.0 to 6.3.1</li>
<li><a
href="https://github.com/crate-py/rpds/commit/cbb4277105e08df8248c7e64ab99d5a51a1b4568"><code>cbb4277</code></a>
Bump github/codeql-action from 3.29.0 to 3.29.2</li>
<li><a
href="https://github.com/crate-py/rpds/commit/25123e9a2fed652d68ec490ac0481e543f3c77fd"><code>25123e9</code></a>
Merge pull request <a
href="https://redirect.github.com/crate-py/rpds/issues/143">#143</a>
from crate-py/dependabot/github_actions/PyO3/maturin-...</li>
<li><a
href="https://github.com/crate-py/rpds/commit/7a59bb7f1848a1ac0793bf77066a1381d33de20f"><code>7a59bb7</code></a>
Merge pull request <a
href="https://redirect.github.com/crate-py/rpds/issues/142">#142</a>
from crate-py/dependabot/github_actions/astral-sh/set...</li>
<li>Additional commits viewable in <a
href="https://github.com/crate-py/rpds/compare/v0.25.1...v0.26.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `typing-extensions` from 4.13.2 to 4.14.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/python/typing_extensions/releases">typing-extensions's
releases</a>.</em></p>
<blockquote>
<h2>4.14.1</h2>
<h1>Release 4.14.1 (July 4, 2025)</h1>
<ul>
<li>Fix usage of <code>typing_extensions.TypedDict</code> nested inside
other types
(e.g., <code>typing.Type[typing_extensions.TypedDict]</code>). This is
not allowed by the
type system but worked on older versions, so we maintain support.</li>
</ul>
<h2>4.14.0</h2>
<p>This release adds several new features, including experimental
support for inline typed dictionaries (<a
href="https://peps.python.org/pep-0764/">PEP 764</a>) and sentinels (<a
href="https://peps.python.org/pep-0661/">PEP 661</a>), and support for
changes in Python 3.14. In addition, Python 3.8 is no longer
supported.</p>
<p>Changes since 4.14.0rc1:</p>
<ul>
<li>Remove <code>__or__</code> and <code>__ror__</code> methods from
<code>typing_extensions.Sentinel</code>
on Python versions &lt;3.10. PEP 604 was introduced in Python 3.10, and
<code>typing_extensions</code> does not generally attempt to backport
PEP-604 methods
to prior versions.</li>
<li>Further update <code>typing_extensions.evaluate_forward_ref</code>
with changes in Python 3.14.</li>
</ul>
<p>Changes included in 4.14.0rc1:</p>
<ul>
<li>Drop support for Python 3.8 (including PyPy-3.8). Patch by <a
href="https://github.com/Viicos">Victorien Plot</a>.</li>
<li>Do not attempt to re-export names that have been removed from
<code>typing</code>,
anticipating the removal of <code>typing.no_type_check_decorator</code>
in Python 3.15.
Patch by Jelle Zijlstra.</li>
<li>Update <code>typing_extensions.Format</code>,
<code>typing_extensions.evaluate_forward_ref</code>, and
<code>typing_extensions.TypedDict</code> to align
with changes in Python 3.14. Patches by Jelle Zijlstra.</li>
<li>Fix tests for Python 3.14 and 3.15. Patches by Jelle Zijlstra.</li>
</ul>
<p>New features:</p>
<ul>
<li>Add support for inline typed dictionaries (<a
href="https://peps.python.org/pep-0764/">PEP 764</a>).
Patch by <a href="https://github.com/Viicos">Victorien Plot</a>.</li>
<li>Add <code>typing_extensions.Reader</code> and
<code>typing_extensions.Writer</code>. Patch by
Sebastian Rittau.</li>
<li>Add support for sentinels (<a
href="https://peps.python.org/pep-0661/">PEP 661</a>). Patch by
<a href="https://github.com/Viicos">Victorien Plot</a>.</li>
</ul>
<h2>4.14.0rc1</h2>
<p>Major changes:</p>
<ul>
<li>Drop support for Python 3.8 (including PyPy-3.8). Patch by <a
href="https://github.com/Viicos">Victorien Plot</a>.</li>
<li>Do not attempt to re-export names that have been removed from
<code>typing</code>,
anticipating the removal of <code>typing.no_type_check_decorator</code>
in Python 3.15.
Patch by Jelle Zijlstra.</li>
<li>Update <code>typing_extensions.Format</code>,
<code>typing_extensions.evaluate_forward_ref</code>, and
<code>typing_extensions.TypedDict</code> to align
with changes in Python 3.14. Patches by Jelle Zijlstra.</li>
<li>Fix tests for Python 3.14 and 3.15. Patches by Jelle Zijlstra.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/python/typing_extensions/blob/main/CHANGELOG.md">typing-extensions's
changelog</a>.</em></p>
<blockquote>
<h1>Release 4.14.1 (July 4, 2025)</h1>
<ul>
<li>Fix usage of <code>typing_extensions.TypedDict</code> nested inside
other types
(e.g., <code>typing.Type[typing_extensions.TypedDict]</code>). This is
not allowed by the
type system but worked on older versions, so we maintain support.</li>
</ul>
<h1>Release 4.14.0 (June 2, 2025)</h1>
<p>Changes since 4.14.0rc1:</p>
<ul>
<li>Remove <code>__or__</code> and <code>__ror__</code> methods from
<code>typing_extensions.Sentinel</code>
on Python versions &lt;3.10. PEP 604 was introduced in Python 3.10, and
<code>typing_extensions</code> does not generally attempt to backport
PEP-604 methods
to prior versions.</li>
<li>Further update <code>typing_extensions.evaluate_forward_ref</code>
with changes in Python 3.14.</li>
</ul>
<h1>Release 4.14.0rc1 (May 24, 2025)</h1>
<ul>
<li>Drop support for Python 3.8 (including PyPy-3.8). Patch by <a
href="https://github.com/Viicos">Victorien Plot</a>.</li>
<li>Do not attempt to re-export names that have been removed from
<code>typing</code>,
anticipating the removal of <code>typing.no_type_check_decorator</code>
in Python 3.15.
Patch by Jelle Zijlstra.</li>
<li>Update <code>typing_extensions.Format</code>,
<code>typing_extensions.evaluate_forward_ref</code>, and
<code>typing_extensions.TypedDict</code> to align
with changes in Python 3.14. Patches by Jelle Zijlstra.</li>
<li>Fix tests for Python 3.14 and 3.15. Patches by Jelle Zijlstra.</li>
</ul>
<p>New features:</p>
<ul>
<li>Add support for inline typed dictionaries (<a
href="https://peps.python.org/pep-0764/">PEP 764</a>).
Patch by <a href="https://github.com/Viicos">Victorien Plot</a>.</li>
<li>Add <code>typing_extensions.Reader</code> and
<code>typing_extensions.Writer</code>. Patch by
Sebastian Rittau.</li>
<li>Add support for sentinels (<a
href="https://peps.python.org/pep-0661/">PEP 661</a>). Patch by
<a href="https://github.com/Viicos">Victorien Plot</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python/typing_extensions/commit/42027aba3558c9d9133a90bca17f6fecaecc48d8"><code>42027ab</code></a>
Prepare release 4.14.1 (<a
href="https://redirect.github.com/python/typing_extensions/issues/620">#620</a>)</li>
<li><a
href="https://github.com/python/typing_extensions/commit/59d2c20858ac527516ebad5a89c05af514dac94a"><code>59d2c20</code></a>
Fix off by one in pickle protocol tests (<a
href="https://redirect.github.com/python/typing_extensions/issues/618">#618</a>)</li>
<li><a
href="https://github.com/python/typing_extensions/commit/40e22ebb2ca5747eaa9405b152c43a294ac3af37"><code>40e22eb</code></a>
Do not use slots for <code>_TypedDictSpecialForm</code> (<a
href="https://redirect.github.com/python/typing_extensions/issues/616">#616</a>)</li>
<li><a
href="https://github.com/python/typing_extensions/commit/d17c456d367e88adee4a4e3bef48f81f7e2df473"><code>d17c456</code></a>
allow TypedDict as a type argument (<a
href="https://redirect.github.com/python/typing_extensions/issues/614">#614</a>)</li>
<li><a
href="https://github.com/python/typing_extensions/commit/b07d24525615ba9377e47aaf5a26650a2517b2c4"><code>b07d245</code></a>
Prepare release 4.14.0 (<a
href="https://redirect.github.com/python/typing_extensions/issues/612">#612</a>)</li>
<li><a
href="https://github.com/python/typing_extensions/commit/fcf5265b3040337db1cfd6b786648a8ed0aeb0bf"><code>fcf5265</code></a>
Backport evaluate_forward_ref() changes (<a
href="https://redirect.github.com/python/typing_extensions/issues/611">#611</a>)</li>
<li><a
href="https://github.com/python/typing_extensions/commit/fadc1edbcfd942074007875007870c1df6acd4d0"><code>fadc1ed</code></a>
Remove PEP-604 methods from <code>Sentinel</code> on Python &lt;3.10 (<a
href="https://redirect.github.com/python/typing_extensions/issues/605">#605</a>)</li>
<li><a
href="https://github.com/python/typing_extensions/commit/44de568f73a93f29e52c2fc2d5f149305a4a3bae"><code>44de568</code></a>
Add 3.14 to project classifiers and tox.ini (<a
href="https://redirect.github.com/python/typing_extensions/issues/604">#604</a>)</li>
<li><a
href="https://github.com/python/typing_extensions/commit/36cc47605804318bf40ee26d765de2070741c25c"><code>36cc476</code></a>
Prepare release 4.14.0rc1 (<a
href="https://redirect.github.com/python/typing_extensions/issues/603">#603</a>)</li>
<li><a
href="https://github.com/python/typing_extensions/commit/ec1876c65000ac86faade29552245178918a7a69"><code>ec1876c</code></a>
More fixes for 3.14 and 3.15 (<a
href="https://redirect.github.com/python/typing_extensions/issues/602">#602</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/python/typing_extensions/compare/4.13.2...4.14.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `mypy` from 1.16.0 to 1.16.1
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python/mypy/commit/68b8fa097d080c92d30a429bc74de8acd56caf85"><code>68b8fa0</code></a>
Bump version to 1.16.1</li>
<li><a
href="https://github.com/python/mypy/commit/e253eded9c887630f3f5404c4b9f73f13570476a"><code>e253ede</code></a>
Single underscore is not a sunder (<a
href="https://redirect.github.com/python/mypy/issues/19273">#19273</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/9fb5ff66c51bd971d7a6b1260cc0ec9f1b82cc06"><code>9fb5ff6</code></a>
Fix properties with setters after deleters (<a
href="https://redirect.github.com/python/mypy/issues/19248">#19248</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/c20fd7838338cd65d6c7c6e252eda85996cfc98e"><code>c20fd78</code></a>
Handle assignment of bound methods in class bodies (<a
href="https://redirect.github.com/python/mypy/issues/19233">#19233</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/c86480ce51e4bb6db21f4b3f0b3ec8833aafc8ce"><code>c86480c</code></a>
Tighten metaclass <strong>call</strong> handling in protocols (<a
href="https://redirect.github.com/python/mypy/issues/19191">#19191</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/cb3c6ec6a7aaa96a0e26768a946ac63ea14115f2"><code>cb3c6ec</code></a>
Fix crash on partial type used as context (<a
href="https://redirect.github.com/python/mypy/issues/19216">#19216</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/c39f5e73c47182e51c5d8d488f7cc7301257c974"><code>c39f5e7</code></a>
[mypyc] Fixing condition for handling user-defined <strong>del</strong>
(<a
href="https://redirect.github.com/python/mypy/issues/19188">#19188</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/0a4f28431faa18e59d35bc269cb0ea6c00810653"><code>0a4f284</code></a>
Fix crash on invalid property inside its own body (<a
href="https://redirect.github.com/python/mypy/issues/19208">#19208</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/9b079f6592740a51c0e629728eeb0324ad85126f"><code>9b079f6</code></a>
Bump version to 1.16.1+dev</li>
<li>See full diff in <a
href="https://github.com/python/mypy/compare/v1.16.0...v1.16.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `ruff` from 0.11.13 to 0.12.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.12.2</h2>
<h2>Release Notes</h2>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-pyi</code>] Expand <code>Optional[A]</code> to <code>A
| None</code> (<code>PYI016</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18572">#18572</a>)</li>
<li>[<code>pyupgrade</code>] Mark <code>UP008</code> fix safe if no
comments are in range (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18683">#18683</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-comprehensions</code>] Fix <code>C420</code> to
prepend whitespace when needed (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18616">#18616</a>)</li>
<li>[<code>perflint</code>] Fix <code>PERF403</code> panic on attribute
or subscription loop variable (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19042">#19042</a>)</li>
<li>[<code>pydocstyle</code>] Fix <code>D413</code> infinite loop for
parenthesized docstring (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18930">#18930</a>)</li>
<li>[<code>pylint</code>] Fix <code>PLW0108</code> autofix introducing a
syntax error when the lambda's body contains an assignment expression
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/18678">#18678</a>)</li>
<li>[<code>refurb</code>] Fix false positive on empty tuples
(<code>FURB168</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19058">#19058</a>)</li>
<li>[<code>ruff</code>] Allow more <code>field</code> calls from
<code>attrs</code> (<code>RUF009</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19021">#19021</a>)</li>
<li>[<code>ruff</code>] Fix syntax error introduced for an empty string
followed by a u-prefixed string (<code>UP025</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18899">#18899</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>flake8-executable</code>] Allow <code>uvx</code> in shebang
line (<code>EXE003</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18967">#18967</a>)</li>
<li>[<code>pandas</code>] Avoid flagging <code>PD002</code> if
<code>pandas</code> is not imported (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18963">#18963</a>)</li>
<li>[<code>pyupgrade</code>] Avoid PEP-604 unions with
<code>typing.NamedTuple</code> (<code>UP007</code>, <code>UP045</code>)
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/18682">#18682</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document link between <code>import-outside-top-level
(PLC0415)</code> and
<code>lint.flake8-tidy-imports.banned-module-level-imports</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18733">#18733</a>)</li>
<li>Fix description of the <code>format.skip-magic-trailing-comma</code>
example (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19095">#19095</a>)</li>
<li>[<code>airflow</code>] Make <code>AIR302</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18988">#18988</a>)</li>
<li>[<code>airflow</code>] Make <code>AIR312</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18989">#18989</a>)</li>
<li>[<code>flake8-annotations</code>] Make <code>ANN401</code> example
error out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18974">#18974</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC100</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18993">#18993</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC105</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19002">#19002</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC110</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18975">#18975</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC210</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18977">#18977</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC220</code>,
<code>ASYNC221</code>, and <code>ASYNC222</code> examples error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18978">#18978</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC251</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18990">#18990</a>)</li>
<li>[<code>flake8-bandit</code>] Make <code>S201</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19017">#19017</a>)</li>
<li>[<code>flake8-bandit</code>] Make <code>S604</code> and
<code>S609</code> examples error out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19049">#19049</a>)</li>
<li>[<code>flake8-bugbear</code>] Make <code>B028</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19054">#19054</a>)</li>
<li>[<code>flake8-bugbear</code>] Make <code>B911</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19051">#19051</a>)</li>
<li>[<code>flake8-datetimez</code>] Make <code>DTZ011</code> example
error out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19055">#19055</a>)</li>
<li>[<code>flake8-datetimez</code>] Make <code>DTZ901</code> example
error out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19056">#19056</a>)</li>
<li>[<code>flake8-pyi</code>] Make <code>PYI032</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19061">#19061</a>)</li>
<li>[<code>flake8-pyi</code>] Make example error out-of-the-box
(<code>PYI014</code>, <code>PYI015</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19097">#19097</a>)</li>
<li>[<code>flake8-pyi</code>] Make example error out-of-the-box
(<code>PYI042</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19101">#19101</a>)</li>
<li>[<code>flake8-pyi</code>] Make example error out-of-the-box
(<code>PYI059</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19080">#19080</a>)</li>
<li>[<code>flake8-pyi</code>] Make example error out-of-the-box
(<code>PYI062</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19079">#19079</a>)</li>
<li>[<code>flake8-pytest-style</code>] Make example error out-of-the-box
(<code>PT023</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19104">#19104</a>)</li>
<li>[<code>flake8-pytest-style</code>] Make example error out-of-the-box
(<code>PT030</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19105">#19105</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.12.2</h2>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-pyi</code>] Expand <code>Optional[A]</code> to <code>A
| None</code> (<code>PYI016</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18572">#18572</a>)</li>
<li>[<code>pyupgrade</code>] Mark <code>UP008</code> fix safe if no
comments are in range (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18683">#18683</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-comprehensions</code>] Fix <code>C420</code> to
prepend whitespace when needed (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18616">#18616</a>)</li>
<li>[<code>perflint</code>] Fix <code>PERF403</code> panic on attribute
or subscription loop variable (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19042">#19042</a>)</li>
<li>[<code>pydocstyle</code>] Fix <code>D413</code> infinite loop for
parenthesized docstring (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18930">#18930</a>)</li>
<li>[<code>pylint</code>] Fix <code>PLW0108</code> autofix introducing a
syntax error when the lambda's body contains an assignment expression
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/18678">#18678</a>)</li>
<li>[<code>refurb</code>] Fix false positive on empty tuples
(<code>FURB168</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19058">#19058</a>)</li>
<li>[<code>ruff</code>] Allow more <code>field</code> calls from
<code>attrs</code> (<code>RUF009</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19021">#19021</a>)</li>
<li>[<code>ruff</code>] Fix syntax error introduced for an empty string
followed by a u-prefixed string (<code>UP025</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18899">#18899</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>flake8-executable</code>] Allow <code>uvx</code> in shebang
line (<code>EXE003</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18967">#18967</a>)</li>
<li>[<code>pandas</code>] Avoid flagging <code>PD002</code> if
<code>pandas</code> is not imported (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18963">#18963</a>)</li>
<li>[<code>pyupgrade</code>] Avoid PEP-604 unions with
<code>typing.NamedTuple</code> (<code>UP007</code>, <code>UP045</code>)
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/18682">#18682</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document link between <code>import-outside-top-level
(PLC0415)</code> and
<code>lint.flake8-tidy-imports.banned-module-level-imports</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18733">#18733</a>)</li>
<li>Fix description of the <code>format.skip-magic-trailing-comma</code>
example (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19095">#19095</a>)</li>
<li>[<code>airflow</code>] Make <code>AIR302</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18988">#18988</a>)</li>
<li>[<code>airflow</code>] Make <code>AIR312</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18989">#18989</a>)</li>
<li>[<code>flake8-annotations</code>] Make <code>ANN401</code> example
error out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18974">#18974</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC100</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18993">#18993</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC105</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19002">#19002</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC110</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18975">#18975</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC210</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18977">#18977</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC220</code>,
<code>ASYNC221</code>, and <code>ASYNC222</code> examples error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18978">#18978</a>)</li>
<li>[<code>flake8-async</code>] Make <code>ASYNC251</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/18990">#18990</a>)</li>
<li>[<code>flake8-bandit</code>] Make <code>S201</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19017">#19017</a>)</li>
<li>[<code>flake8-bandit</code>] Make <code>S604</code> and
<code>S609</code> examples error out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19049">#19049</a>)</li>
<li>[<code>flake8-bugbear</code>] Make <code>B028</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19054">#19054</a>)</li>
<li>[<code>flake8-bugbear</code>] Make <code>B911</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19051">#19051</a>)</li>
<li>[<code>flake8-datetimez</code>] Make <code>DTZ011</code> example
error out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19055">#19055</a>)</li>
<li>[<code>flake8-datetimez</code>] Make <code>DTZ901</code> example
error out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19056">#19056</a>)</li>
<li>[<code>flake8-pyi</code>] Make <code>PYI032</code> example error
out-of-the-box (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19061">#19061</a>)</li>
<li>[<code>flake8-pyi</code>] Make example error out-of-the-box
(<code>PYI014</code>, <code>PYI015</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19097">#19097</a>)</li>
<li>[<code>flake8-pyi</code>] Make example error out-of-the-box
(<code>PYI042</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19101">#19101</a>)</li>
<li>[<code>flake8-pyi</code>] Make example error out-of-the-box
(<code>PYI059</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19080">#19080</a>)</li>
<li>[<code>flake8-pyi</code>] Make example error out-of-the-box
(<code>PYI062</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19079">#19079</a>)</li>
<li>[<code>flake8-pytest-style</code>] Make example error out-of-the-box
(<code>PT023</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19104">#19104</a>)</li>
<li>[<code>flake8-pytest-style</code>] Make example error out-of-the-box
(<code>PT030</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19105">#19105</a>)</li>
<li>[<code>flake8-quotes</code>] Make example error out-of-the-box
(<code>Q003</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/19106">#19106</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/9bee8376a17401f9736b45fdefffb62edc2f1668"><code>9bee837</code></a>
Bump 0.12.2 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/19126">#19126</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/1c6717b149ddfbcd4aa0aee2e160320474392da9"><code>1c6717b</code></a>
Filter private symbols from stubs if they are internal types (<a
href="https://redirect.github.com/astral-sh/ruff/issues/19121">#19121</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/1b813cd5f1933ab05ba7b96ace798199429c0bd6"><code>1b813cd</code></a>
Fix description of the <code>format.skip-magic-trailing-comma</code>
example (<a
href="https://redirect.github.com/astral-sh/ruff/issues/19095">#19095</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b00f68a23cedbd3a38fc25bac63638f0f11fc3f0"><code>b00f68a</code></a>
[<code>ruff</code>] Allow more <code>field</code> calls from
<code>attrs</code> (<code>RUF009</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/19021">#19021</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/710c60f7135879b05f6c05a34085cd7af5c19e7f"><code>710c60f</code></a>
[<code>flake8-pytest-style</code>] Make example error out-of-the-box
(<code>PT023</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/19104">#19104</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/811e25d16e22ca4ce124d9514232211c9a0b27a1"><code>811e25d</code></a>
[<code>flake8-pytest-style</code>] Make example error out-of-the-box
(<code>PT030</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/19105">#19105</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b78af2db4822dc55acbfb1024b30e69fe0262311"><code>b78af2d</code></a>
[<code>flake8-quotes</code>] Make example error out-of-the-box
(<code>Q003</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/19106">#19106</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4f36f0677f09b0ed1ba20f583b6f017c4f7d26c8"><code>4f36f06</code></a>
Document link between <code>import-outside-top-level (PLC0415)</code>
and `lint.flake8-t...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2589a2938ee58a1ff1b54a9558807ecb000ccca3"><code>2589a29</code></a>
[<code>flake8-simplify</code>] Make example error out-of-the-box
(<code>SIM113</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/19109">#19109</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/26bb8f7b7189558520bb386867579768b5a17347"><code>26bb8f7</code></a>
[<code>flake8-simplify</code>] Make example error out-of-the-box
(<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/19110">#19110</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.11.13...0.12.2">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
GitHub has started enforcing a 1000 file limit, which breaks us.

I first encountered it in CI during the release:
https://github.com/astral-sh/python-build-standalone/actions/runs/16156480423

Then got to an actual error message via the CLI:

```
❯ gh release upload 20250708 dist/cpython-3.14.0b4-riscv64-unknown-linux-gnu-freethreaded+lto-20250708T1536.tar.zst
HTTP 422: Validation Failed (https://uploads.github.com/repos/astral-sh/python-build-standalone/releases/230978017/assets?label=&name=cpython-3.14.0b4-riscv64-unknown-linux-gnu-freethreaded%2Blto-20250708T1536.tar.zst)
file_count limited to 1000 assets per release
```

You can see they documented a limit recently:


https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases#storage-and-bandwidth-quotas


https://web.archive.org/web/20250629152715/https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases
And add some regression tests.

Co-authored-by: Geoffrey Thomas <geofft@ldpreload.com>
This allows downloading and poking at build artifacts that fail validation.

Now the order of tasks for all platforms is the same: build, upload
attestations, upload artifacts, validate. (This was already the order for
macos.)
geofft and others added 25 commits August 8, 2025 12:44
…#676)

Several important third-party packages, including matplotlib in its
tkagg backend and Pillow, use tkinter as a way of locating libtcl and
libtk and making direct C API calls to those libraries. For more 
details, see the analysis in

astral-sh/python-build-standalone#129 (comment)

To make these packages work, we need to expose the full libtcl and
libtk dynamic symbol ABI; we can't just statically link them into our
own binary. It seems most robust to also expose these as separate
libraries under their usual filenames to match the behavior of other
Python distributions.

Build shared libraries for the _tkinter module and for libtcl and libtk,
and set up rpaths so we find our copies of them. libX11 continues to be
statically linked, but it's linked into libtk. Just as with the build of
Python itself, use --exclude-libs=ALL to prevent the dependencies'
symbols from being exported.

Stop building Tix because it's broken (#723) and it would need to be
changed to dynamic linking.

Configure libX11 with --disable-loadable-xcursor to fix #146, which I
ran into while running tests.

Add zlib as a build-dep of Tcl/Tk so that they can statically link
libz.a. I think we were previously picking up the zlib headers from the
OS, which wasn't a problem when libtcl and libtk were static libraries -
they got linked into CPython itself which also linked zlib.a. But now
libtcl.so and libtk.so need zlib.a.

Fixes #129
Fixes #533
…) (#754)

- **Bump CPython to 3.14.0rc2**
- **Drop the Depot Windows runner**
This reverts commit 6228086c4523ca1d3e77b5215cf5f280c4d3c21b following
#756
`just download-stats*` are failing with an HTTP 504 Gateway Timeout on
GitHub's servers.

We can work around this by reducing the requested number of releases per
page.

As part of this, we adopt a 3rd party package for querying the GitHub
API because I was too lazy to implement pagination manually. Also, since
pagination is enabled, the counts reported by these commands are now
accurate and don't implicitly truncate at the most recent 10 releases.

Co-authored-by: Zanie Blue <contact@zanie.dev>
Starting in Python 3.10, -DMODULE_NAME="sqlite3" is no longer needed
when building _sqlite3.
python/cpython#87610 /
python/cpython#24801
I was looking at the build pipeline for the distributions, and was
surprised to find the builder image artifacts having different SHA256
hashes across runs.

e.g. compare the output of the "Upload Docker Image" step of two jobs:


https://github.com/chowder/python-build-standalone/actions/runs/17012490960/job/48230404008

https://github.com/chowder/python-build-standalone/actions/runs/17012490960/job/48230532790

For the same image: 

```
SHA256 digest of uploaded artifact zip is d47e11cc1c0e648bed6ec64a3613fa166c317981d252085c241c05745604973b
Finalizing artifact upload
Artifact image-build-linux_x86_64.zip successfully finalized. Artifact ID 3780654566
Artifact image-build-linux_x86_64 has been successfully uploaded! Final size is 80890477 bytes. Artifact ID is 3780654566
```
```
SHA256 digest of uploaded artifact zip is 3341d64b1d7efb680db3e4d62ae3dab9bf24e22e384f585aaf3a5b551aee5e7b
Finalizing artifact upload
Artifact image-build-linux_x86_64.zip successfully finalized. Artifact ID 3780667100
Artifact image-build-linux_x86_64 has been successfully uploaded! Final size is 80890477 bytes. Artifact ID is 3780667100
```

Turns out this is because the `upload-artifact` step applies a layer of
compression to the specified files, but doesn't reset/zero out the
mtime, thus making these artifacts non-reproducible.

Given that the docker images are already compressed [in a prior
step](https://github.com/astral-sh/python-build-standalone/blob/main/.github/workflows/linux.yml#L117-L120):

```yaml
      - name: Compress Image
        run: |
          echo ${STEPS_BUILD_IMAGE_OUTPUTS_IMAGEID} > build/image-${MATRIX_NAME}.linux_${MATRIX_ARCH}
          zstd -v -T0 -6 --rm build/image-*.tar
``` 

We can skip the compression in the `upload-artifact` step, and get
reproducible artifacts each time.

#### Test Evidence

See these two runs that include the proposed changes: 


https://github.com/chowder/python-build-standalone/actions/runs/17012517183/job/48230459046

https://github.com/chowder/python-build-standalone/actions/runs/17012517183/job/48230772691

Both generate the same digest: 

```
Finished uploading artifact content to blob storage!
SHA256 digest of uploaded artifact zip is c73f01690d74c103f92bd8113ff158e8b8d2d4de19dca96d36b3d6fbc688fe16
Finalizing artifact upload
Artifact image-build-linux_x86_64.zip successfully finalized. Artifact ID 3780661038
Artifact image-build-linux_x86_64 has been successfully uploaded! Final size is 81208314 bytes. Artifact ID is 3780661038
```

```
SHA256 digest of uploaded artifact zip is c73f01690d74c103f92bd8113ff158e8b8d2d4de19dca96d36b3d6fbc688fe16
Finalizing artifact upload
Artifact image-build-linux_x86_64.zip successfully finalized. Artifact ID 3780693018
Artifact image-build-linux_x86_64 has been successfully uploaded! Final size is 81208314 bytes. Artifact ID is 3780693018
```
I verified this on macOS

```
❯ python -c "from compression import zstd; print(zstd.CompressionParameter.nb_workers.bounds())"
(0, 256)
```

See #761 

I'm not sure if this is all of the performance difference, but using
threads should make a significant difference.
astral-sh/python-build-standalone#761 (comment)
notes that threads are not used by default, so I think there's more
going on — but we should enable this at build time regardless. See also
#768.
Also, enable verbose output in the build system because it is otherwise
too quiet to be helpful.

See
astral-sh/python-build-standalone#761 (comment)
Addressing the environment bootstrap regression from #706 — we can't
build `cryptography` and `pynacl` from source and we don't need download
statistics in CI.
This has been working fine since May 2022....
The former is just a composite of a latter, but does not pin to a commit
so it violates our policy. I do not think `setup-crate` supports pinning
a just commit, so I think we will want to just drop the whole action in
the future.

See 
- astral-sh/python-build-standalone#760
- extractions/setup-just#20
- extractions/setup-just#23

See failure at
https://github.com/astral-sh/python-build-standalone/actions/runs/17052072811/attempts/1
Closes #87 

Does not include the `+static` variant as I was having a hard time
getting the bzip2 build passing. I'll open a new issue to track that.

Related astral-sh/python-build-standalone#484
% `codespell --ignore-words-list=inout
--skip="LICENSE.*,python-licenses.rst" --write-changes`
* https://pypi.org/project/codespell
pull_request: {}
jobs:
running-3rd-party-pr-security-checks:
uses: verkada/securitybots/.github/workflows/3rd-party-pr-checks.yml@main

Check warning

Code scanning / zizmor

secrets unconditionally inherited by called workflow Warning

secrets unconditionally inherited by called workflow
nickvines and others added 2 commits September 4, 2025 14:21
- Remove Windows build targets from release configurations
- Remove unused Linux musl and versioned GNU targets
- Update release workflow to use ubuntu-latest runner
- Simplify build matrix to focus on essential targets only

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
- Replace depot runners with standard GitHub runners
- Add support for aarch64 Linux builds with ubuntu-latest-aarch64
- Update all runners to use free GitHub-hosted runners
- Remove references to paid depot infrastructure

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
@nickvines nickvines closed this Sep 5, 2025
@nickvines nickvines deleted the nickvines/20250902-fips branch September 5, 2025 22:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.