Sourced from tornado's changelog.
Release notes
.. toctree:: :maxdepth: 2
releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1
... (truncated)
48fc2d4
Merge pull request #3633
from bdarnell/curl-reset-654ae1ddd
Release notes and version bump for 6.5.73154caa
curl_httpclient: Reset the curl object before putting it on the
freelist7d869c0
Merge pull request #3631
from bdarnell/cve-links288241f
docs: Use the correct link syntax8da981c
docs: Add CVE links to 6.5.6 release notesaba2569
Merge pull request #3626
from bdarnell/fixes-656a24b260
httpclient_test: Accept an additional error message varianta74240a
Release notes and version bump for 6.5.6.e8fc7ed
simple_httpclient: Strip auth headers on cross-origin redirectsSourced from pyjwt's releases.
2.13.0
PyJWT 2.13.0 — Security Release
This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.
Security
GHSA-xgmm-8j9v-c9wx— JWK JSON accepted as HMAC secret (algorithm confusion).HMACAlgorithm.prepare_keypreviously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms inalgorithms=[…]and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by@aradona91.
GHSA-jq35-7prp-9v3f— Algorithm allow-list bypass withPyJWK/PyJWKClient. When verifying with aPyJWK, the caller'salgorithms=[…]allow-list was checked against the token headeralgas a string only; actual verification used the algorithm bound to thePyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token headeralgto match thePyJWK's algorithm before verification. Reported by@sushi-gif.
GHSA-w7vc-732c-9m39— DoS via base64 decode of unused payload segment whenb64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplieddetached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by@thesmartshadow.
GHSA-993g-76c3-p5m4—PyJWKClientaccepts non-HTTP(S) URIs.PyJWKClient.fetch_datapassed its URI tourllib.request.urlopen, which by default also handlesfile://,ftp://, anddata:schemes. An application that fed an attacker-influenced URI intoPyJWKClientcould be coerced into reading local files or reaching other unintended schemes.PyJWKClientnow rejects any URI whose scheme isn'thttporhttps. Reported by@KEIJOT.
GHSA-fhv5-28vv-h8m8—PyJWKClientcache wiped on fetch error. Afinally-blockput(jwk_set=None)cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by@eddieran.Fixed
- Reject empty HMAC keys outright in
HMACAlgorithm.prepare_keywithInvalidKeyErrorinstead of accepting them with only a warning. Defends against theos.getenv("JWT_SECRET", "")footgun. Thanks to@SnailSploitand@spartan8806for the reports.- Forward per-call
options(includingenforce_minimum_key_length) fromPyJWT.decodethrough toPyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on thePyJWTinstance. Thanks to@WLUBfor the report.- RFC 7797 §3 compliance for
b64=false: the encoder now auto-adds"b64"tocrit, and the decoder rejects tokens that setb64=falsewithout listing it incrit. Thanks to@MachineLearning-Nerdfor the report.Changed
- Migrate the
dev,docs, andtestspackage extras to dependency groups, by@kurtmckeein #1152.Upgrade notes
Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:
- Empty HMAC keys now raise. If your app passed
""orb""as a secret (often via a missing env var, e.g.os.getenv("JWT_SECRET", "")),encode/decodewill now raiseInvalidKeyError. This is the intended behavior — fix the configuration.PyJWKdecoding now requires the token'salgto match the JWK's algorithm. Previously a mismatch was silently honored if the headeralgappeared in the allow-list. Tokens that relied on this mismatch will now fail withInvalidAlgorithmError.PyJWKClientnow rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS fromfile://URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. constructPyJWKSet.from_dict(...)directly).b64=falsetokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit"b64"fromcrit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.enforce_minimum_key_lengthset per-call now takes effect. Callers who passedoptions={"enforce_minimum_key_length": True}tojwt.decode()previously got no enforcement; they will now getInvalidKeyErroron undersized keys, as documented.Full changelog: https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0
2.12.1
What's Changed
- Add typing_extensions dependency for Python < 3.11 by
@jpadillain jpadilla/pyjwt#1151Full Changelog: https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1
2.12.0
Security
- Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by
@dmbs335in GHSA-752w-5fwx-jx9f
... (truncated)
Sourced from pyjwt's changelog.
v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>__Security
- Reject JWK JSON documents passed as raw HMAC secrets in ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that the existing PEM/SSH guard did not cover. Reported by @aradona91 in `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__. - Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during verification so the caller's ``algorithms=[...]`` allow-list cannot be bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__. - Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker- influenced URIs cannot read local files or reach unintended schemes via urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__. - Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``. The previous ``finally``-block ``put(None)`` pattern cleared the cache on any transient outage, turning one bad JWKS request into application- wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__. - Skip the unconditional base64 decode of the compact-form payload segment when ``b64=false`` is set in the protected header, and require that segment to be empty (RFC 7515 Appendix F detached form). Closes an unauthenticated DoS amplifier. Reported by @thesmartshadow in `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.Fixed
- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with ``InvalidKeyError`` instead of accepting them with only a warning. Thanks to @SnailSploit and @spartan8806 for independently flagging the footgun. - Forward per-call ``options`` (including ``enforce_minimum_key_length``) from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the option actually takes effect when set at the call site rather than only on the ``PyJWT`` instance. Thanks to @WLUB for the report. - RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds ``"b64"`` to the ``crit`` header parameter, and the decoder rejects tokens that set ``b64=false`` without listing it in ``crit``. Thanks to @MachineLearning-Nerd for the report. Changed
- Migrate the
dev,docs, andtestspackage extras to dependency groups by@kurtmckeein[#1152](https://github.com/jpadilla/pyjwt/issues/1152) <https://github.com/jpadilla/pyjwt/pull/1152>__
v2.12.1 <https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1>__ </tr></table>
... (truncated)
7144e45
Apply ruff formatd2f4bec
Restore cast() calls with cross-version type:
ignore for prepare_key22f478c
Remove redundant casts in RSAAlgorithm.prepare_key and
`ECAlgorithm.prepare...95791b1
Bundle security fixes and hardening into 2.13.0dcc27a9
[pre-commit.ci] pre-commit autoupdate (#1155)9d08a9a
[pre-commit.ci] pre-commit autoupdate (#1146)b87c100
Bump codecov/codecov-action from 5 to 6 (#1154)40e3147
Migrate development extras to dependency groups (#1152)a4e1a3d
Add typing_extensions dependency for Python < 3.11 (#1151)bd9700c
Use PyJWK algorithm when encoding without explicit algorithm (#1148)Sourced from @babel/core's releases.
v7.29.7 (2026-05-25)
Re-release all packages with npm provenance attestations
v7.29.6 (2026-05-25)
:bug: Bug Fix
babel-generator
- #18014 Catchup source map position in preserveFormat (
@nicolo-ribaudo)babel-corebabel-core,babel-generator
- #17998 Preserve original identifier names from input sourcemaps (#17992) (
@Andarist)Committers: 3
- Huáng Jùnliàng (
@JLHwung)- Mateusz Burzyński (
@Andarist)- Nicolò Ribaudo (
@nicolo-ribaudo)v7.29.5 (2026-05-05)
:house: Internal
babel-preset-env
- Update
@babel/*dependenciesv7.29.4 (2026-05-05)
:bug: Bug Fix
babel-plugin-transform-modules-systemjsCommitters: 1
- Huáng Jùnliàng (
@JLHwung)v7.29.3 (2026-04-30)
:eyeglasses: Spec Compliance
:bug: Bug Fix
babel-helper-create-class-features-plugin,babel-plugin-proposal-decoratorsbabel-register
- #17915 Fix thread synchronization issues in
@babel/register(@liuxingbaoyu)babel-compat-data,babel-plugin-bugfix-safari-rest-destructuring-rhs-array,babel-preset-env:nail_care: Polish
babel-parser
... (truncated)
4fba754
v7.29.704ea6b2
v7.29.699f498a
[7.x packport]Improve input source map handling (#18001)feba0a3
Preserve original identifier names from input sourcemaps (#17992)
(#17998)aa8394e
v7.29.0ad0d03f
[7.x backport] feat: Allow specifying startLine in code frame (#17739)d7f4008
v7.28.6e130225
Polish(standalone): improve message on invalid preset/plugin (#17606)99dcba5
chore: enable some ts-eslint rules (#17592)c92c491
Improve Unicode handling in code-frame tokenizer (#17589)This version was pushed to npm by GitHub Actions, a new
releaser for @babel/core since your current version.
Sourced from starlette's releases.
Version 1.3.1
What's Changed
- Use
StarletteDeprecationWarninginstead ofDeprecationWarningby@Kludexin Kludex/starlette#3119- Enforce
max_fieldsandmax_part_sizeinFormParserby@Kludexin Kludex/starlette#3329- Enforce
FormParserlimits in parser callbacks by@Kludexin Kludex/starlette#3331Full Changelog: https://github.com/Kludex/starlette/compare/1.3.0...1.3.1
Version 1.3.0
What's Changed
- Clamp oversized suffix ranges in
FileResponseby@jiyujie2006in Kludex/starlette#3307- Catch
OSErroralongsideMultiPartExceptionwhen closing temp files by@N3XT3R1337in Kludex/starlette#3191- Add
httpx2to thefullextra by@Kludexin Kludex/starlette#3323- Adjust testclient typing and warnings by
@waketzhengin Kludex/starlette#3322- Fix IndexError in URL.replace() on a URL with no authority by
@LeSingh1in Kludex/starlette#3317- Annotate URLPath protocol parameter with Literal by
@Chang-LeHungin Kludex/starlette#3285- avoid collapsing exception groups from user code by
@graingertin Kludex/starlette#2830- Use
removeprefixto strip weak ETag indicator inis_not_modifiedby@gnosyslambdain Kludex/starlette#3193- Build
request.urlfrom structured components by@Kludexin Kludex/starlette#3326New Contributors
@jiyujie2006made their first contribution in Kludex/starlette#3307@N3XT3R1337made their first contribution in Kludex/starlette#3191@leestana01made their first contribution in Kludex/starlette#3319@LeSingh1made their first contribution in Kludex/starlette#3317@EmmanuelNiyonshutimade their first contribution in Kludex/starlette#3204@Chang-LeHungmade their first contribution in Kludex/starlette#3285@gnosyslambdamade their first contribution in Kludex/starlette#3193Full Changelog: https://github.com/Kludex/starlette/compare/1.2.1...1.3.0
Version 1.2.1
What's Changed
- Use
httpx2for type checking in thetestclientmodule by@leifwarin Kludex/starlette#3304- Add assert error for requires() when request param is not Request type by
@KeeganOPin Kludex/starlette#3298New Contributors
@leifwarmade their first contribution in Kludex/starlette#3304@diskeumade their first contribution in Kludex/starlette#3243@KeeganOPmade their first contribution in Kludex/starlette#3298Full Changelog: https://github.com/Kludex/starlette/compare/1.2.0...1.2.1
Version 1.2.0
What's Changed
- Support httpx2 in the test client by
@Kludexin Kludex/starlette#3291Full Changelog: https://github.com/Kludex/starlette/compare/1.1.0...1.2.0
Version 1.1.0
... (truncated)
Sourced from starlette's changelog.
1.3.1 (June 12, 2026)
Fixed
- Enforce
max_fieldsandmax_part_sizeinFormParser#3329.- Enforce
FormParserlimits in parser callbacks #3331.1.3.0 (June 11, 2026)
Added
Fixed
- Build
request.urlfrom structured components #3326.- Clamp oversized suffix ranges in
FileResponse#3307.- Catch
OSErroralongsideMultiPartExceptionwhen closing temp files #3191.- Avoid collapsing exception groups raised from user code #2830.
- Use
removeprefixto strip the weakETagindicator inis_not_modified#3193.- Fix
IndexErrorinURL.replace()on a URL with no authority #3317.- Adjust
testclienttyping and warnings #3322.1.2.1 (May 31, 2026)
Fixed
- Use
httpx2for type checking in thetestclientmodule #3304.- Add assert error for
requires()when the request parameter is not aRequesttype #3298.1.2.0 (May 28, 2026)
Added
- Support httpx2 in the test client #3291.
1.1.0 (May 23, 2026)
Added
- Use
"application/octet-stream"as theFileResponsemedia type fallback #3283.Fixed
- Only dispatch standard HTTP verbs in
HTTPEndpoint#3286.- Reject absolute paths in
StaticFiles.lookup_path#3287.1.0.1 (May 21, 2026)
... (truncated)
8ebffd0
Version 1.3.1 (#3330)25b8e17
Enforce FormParser limits in parser callbacks (#3331)dba1c4b
Enforce max_fields and max_part_size in
FormParser (#3329)45e51dc
Use StarletteDeprecationWarning instead of
DeprecationWarning (#3119)5f8610c
Version 1.3.0 (#3327)167b585
Build request.url from structured components (#3326)3730925
Use removeprefix to strip weak ETag indicator in
is_not_modified (#3193)e6f7ad1
avoid collapsing exception groups from user code (#2830)115228f
Annotate URLPath protocol parameter with Literal (#3285)113f193
docs: replace inline ASGI server list with link to canonical implemen…
(#3204)7bba978
3.1.5bd25942
docs: add warning about ReDoS1a9c27c
fix partial matching of globstar patterns1a2e084
3.1.4ae24656
update lockfileb100374
limit recursion for **, improve perf considerably26ffeaa
lockfile update9eca892
lock node version to 1400c323b
3.1.330486b2
update CI matrix and actionsSourced from pymongo's changelog.
Changes in Version 4.16.0 (2026/01/07)
PyMongo 4.16 brings a number of changes including:
- Removed invalid documents from :class:
bson.errors.InvalidDocumenterror messages as doing so may leak sensitive user data. Instead, invalid documents are stored in :attr:bson.errors.InvalidDocument.document.- PyMongo now requires
dnspython>=2.6.1, sincednspython1.0 is no longer maintained. The minimum version is2.6.1to account forCVE-2023-29483 <https://www.cve.org/CVERecord?id=CVE-2023-29483>_.- Removed support for Eventlet. Eventlet is actively being sunset by its maintainers and has compatibility issues with PyMongo's dnspython dependency.
- Use Zstandard support from the standard library for Python 3.14+, and use
backports.zstdfor older versions.- Fixed return type annotation for
find_one_and_*methods on :class:~pymongo.asynchronous.collection.AsyncCollectionand :class:~pymongo.synchronous.collection.Collectionto includeNone.- Added support for NumPy 1D-arrays in :class:
bson.binary.BinaryVector.- Prevented :class:
~pymongo.encryption.ClientEncryptionfrom loading the crypt shared library to fix "MongoCryptError: An existing crypt_shared library is loaded by the application" unless the linked library search path is set.Changes in Version 4.15.5 (2025/12/02)
Version 4.15.5 is a bug fix release.
- Fixed a bug that could cause
AutoReconnect("connection pool paused")errors when cursors fetched more documents from the database after SDAM heartbeat failures.Changes in Version 4.15.4 (2025/10/21)
Version 4.15.4 is a bug fix release.
- Relaxed the callback type of :meth:
~pymongo.asynchronous.client_session.AsyncClientSession.with_transactionto allow the broader Awaitable type rather than only Coroutine objects.- Added the missing Python 3.14 trove classifier to the package metadata.
Issues Resolved ...............
See the
PyMongo 4.15.4 release notes in JIRA_ for the list of resolved issues in this release... _PyMongo 4.15.4 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=47237
Changes in Version 4.15.3 (2025/10/07)
Version 4.15.3 is a bug fix release.
- Fixed a memory leak when raising :class:
bson.errors.InvalidDocumentwith C extensions.- Fixed the return type of the :meth:
~pymongo.asynchronous.collection.AsyncCollection.distinct,
... (truncated)
3290101
Prepare 4.16.0 release (#2672)1be94d2
PYTHON-5685 Fix unified spec sync metadata for csot and sessions tests
(#2669)6585d9c
PYTHON-2442: Refactor: use _asdict() in _options_dict() (#2670)fdb1f7e
PYTHON-5677 Prevent ClientEncryption from loading crypt shared library
(#2659)0cd9763
Bump zizmorcore/zizmor-action from
cb3d8e846e148d1111d90b03375b9c03deceda37 t...2f263d4
PYTHON-5680 Fix handling of expectedDocuments in Unified Test Runner (#2665)e9658b2
Add 4.15.5 release date to changelog (#2666)10dd204
Update coverage[toml] requirement from <=7.10.6,>=5 to
>=5,<=7.10.7 (#2662)1300677
[Spec Resync] 12-22-2025 (#2663)18c1f14
PYTHON-5529 Introduce optin setting to await for MinPoolSize population
(#2664)Sourced from bleach's changelog.
Version 6.4.0 (June 5th, 2026)
NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue:
<https://github.com/mozilla/bleach/issues/698>__Backwards incompatible changes
- Dropped support for pypy 3.10. (#764)
Security fixes
Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.
Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.
For example::
import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))
outputs::
'Click'
See the advisory for details.
Fix GHSA-gj48-438w-jh9v.
Fix issue where URI sanitization wasn't happening in formaction attributes.
See the advisory for details.
Bug fixes
f0355a7
fix: fix last release date in CHANGESae4e8a2
chore: bleach 6.4.0 and final release970df58
fix: uri-sanitization in formaction attributes7c4867c
fix: xss bypass in allowed protocol test using unicode invisible
characters913ab75
fix: reduce redundancy in workflow jobs218c15a
fix: rework pip caching4f0b097
fix: fix tox platform restrictionse95a79d
chore: update pytest91539d4
Bump actions/cache from 5.0.3 to 5.0.4cd47b4c
fix: handle left-angle-bracket that's not a tag (#733)Sourced from torch's releases.
PyTorch 2.12.0 Release Notes
- Highlights
- Backwards Incompatible Changes
- Deprecations
- New Features
- Improvements
- Bug fixes
- Performance
- Documentation
- Developers
- Security
Highlights
For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.
Backwards Incompatible Changes
Build Frontend
Strengthened SVE compile checks in
FindARM.cmake, which may reject previously accepted but incorrect SVE configurations (#176646)Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.
Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (#178925)
Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure
CUDA_HOMEpoints to that installation.Version 2.11:
CUDA_HOME=/usr/local/cuda-12.4 python setup.py developVersion 2.12:
CUDA_HOME=/usr/local/cuda-12.6 python setup.py developEnforced a C++20 minimum in CMake build files (#178662)
... (truncated)
0d62256
[release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (#183346)7661cd9
[MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (#181886)9da6087
Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes #182250)
(#182369)e4c37cc
Avoid raw stream name collisions in Inductor (#182178)822d047
[MPS] Fix bool mask handling in 1-pass SDPA decode kernel (#182285)
(#182311)5c5e523
Add enable_gqa parameter to SDPA MPS meta registration (#181550)eece52e
[AOTI] Add BC-safe c_shim v2 for
_scaled_dot_product_attention_math_for_mps e...b39330b
[Inductor] Call latest c_shim version for versioned fallback ops (#181548)06f10d0
Revert "[FSDP2] add fqn to communication ops" (#182100)
(#182157)449e339
Revert "[Inductor] Improve materialization heuristic for a chain of
computaio...Sourced from pyarrow's releases.
Apache Arrow 23.0.1
Release Notes URL: https://arrow.apache.org/release/23.0.1.html
Apache Arrow 23.0.1 RC0
Release Notes: Release Candidate: 23.0.1 RC0
Apache Arrow 23.0.0
Release Notes URL: https://arrow.apache.org/release/23.0.0.html
Apache Arrow 23.0.0 RC2
Release Notes: Release Candidate: 23.0.0 RC2
Apache Arrow 22.0.0
Release Notes URL: https://arrow.apache.org/release/22.0.0.html
Apache Arrow 22.0.0 RC1
Release Notes: Release Candidate: 22.0.0 RC1
Apache Arrow 22.0.0 RC0
Release Notes: Release Candidate: 22.0.0 RC0
82a374e
MINOR: [Release] Update versions for 23.0.1c1ae37c
MINOR: [Release] Update .deb/.rpm changelogs for 23.0.18f6e557
MINOR: [Release] Update CHANGELOG.md for 23.0.14e16a1a
GH-49159:
[C++][Gandiva] Detect overflow in repeat() (#49160)985621d
GH-48817
[R][C++] Bump C++20 in R build infrastructure (#48819)1bea06a
GH-49024:
[CI] Update Debian version in .env (#49032)147bcd6
GH-49156:
[Python] Require GIL for string comparison (#49161)e4f922b
GH-49138:
[Packaging][Python] Remove nightly cython install from manylinux
wh...f9376e4
GH-49003:
[C++] Don't consider out_of_range an error in float parsing
(#49095)ab2c0ad
GH-49044:
[CI][Python] Fix test_download_tzdata_on_windows by adding
required...Sourced from idna's changelog.
3.15 (2026-05-12)
- Enforce DNS-length cap on individual labels early in
check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.- Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared
_unicode_dots_refromidna.corein the codec module.- Use
raise ... from errfor proper exception chaining and switch internal string formatting to f-strings.- Allow
flit_core4.x in the build backend.- Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
- Add Dependabot configuration for GitHub Actions.
- Convert README and HISTORY from reStructuredText to Markdown.
- Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.
Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.
3.14 (2026-05-10)
- Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]
Thanks to Stan Ulbrych for reporting the issue.
3.13 (2026-04-22)
- Correct classification error for codepoint U+A7F1
3.12 (2026-04-21)
- Update to Unicode 17.0.0.
- Issue a deprecation warning for the transitional argument.
- Added lazy-loading to provide some performance improvements.
- Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.
Thanks to Rodrigo Nogueira for contributions to this release.
af30a09
Release 3.1530314d4
Pre-release 3.15rc005d4b21
Merge pull request #237 from
kjd/convert-docs-to-markdown2987fdb
Convert README and HISTORY from reStructuredText to Markdown59fa800
Merge pull request #236 from
kjd/dependabot/github_actions/actions-f3e34333eadef6983
Merge branch 'master' into
dependabot/github_actions/actions-f3e34333eabbd8004
Merge pull request #234 from
StanFromIreland/patch-1edd07c0
Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions
group5557db0
Merge branch 'master' into patch-1f11746c
Merge pull request #235 from
StanFromIreland/patch-2Sourced from authlib's releases.
v1.6.12
- Fix redirecting to unvalidated
redirect_urionInvalidScopeErrorinOpenIDImplicitGrantandOpenIDHybridGrant. Full Changelog: https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12
Sourced from authlib's changelog.
Version 1.6.12
Released on may 4, 2026
- Fix redirecting to unvalidated
redirect_urionInvalidScopeErrorinOpenIDImplicitGrantandOpenIDHybridGrant.
e46e515
chore: bump to 1.6.129babc13
fix: redirecting to unvalidated redirect_uri on InvalidScopeError in
OIDC grantsSourced from mistune's releases.
v3.2.1
🐞 Bug Fixes
- Resolve Windows compatibility issues in file inclusion and tests - by
@Yuki9814(25471)- Escape html text - by
@lepture(a3cb6)- Update link reference - by
@lepture(85eb5)- Handle escaped dollar signs in inline math - by
@saschabuehrlein lepture/mistune#370 (7bd57)- Escape id of toc - by
@lepture(04880)- Escape id of headings - by
@lepture(28556)- Remove double-encoding of image alt text - by
@lawrence3699(0d6f3)- Escape xml for math plugin - by
@lepture(5fa09)- Use strict regex for image's height and width - by
@lepture(8d0cb)View changes on GitHub
Sourced from mistune's changelog.
Version 3.2.1
Released on May 3, 2026
- Escape link in
render_toc_ul.- Escape text in math plugin.
- Fix regex for math plugin.
- Escape heading's ID attribute.
- Fix
LINK_TITLE_REto prevent DoS.- Escape class attribute for admonition directive.
- Remove double-encoding of image alt text.
- Escape class attribute for image directive.
- Fix width/height attribute for image directive.
067f908
chore: release 3.2.1bf55030
Merge pull request #438
from saschabuehrle/fix/issue-3708d0cb75
fix: use strict regex for image's height and width5fa092e
fix: escape xml for math plugin71ec947
Merge pull request #440
from lawrence3699/fix/image-alt-double-encoding0d6f3d8
fix: remove double-encoding of image alt text2855622
fix: escape id of headings04880a0
fix: escape id of toc7bd5709
fix: handle escaped dollar signs in inline math (fixes #370)85eb54f
fix: update link reference