release: 26.1.0 - #3693
Merged
Merged
Conversation
Each suite binds fixed host ports, so a single `pytest tests/docker` starts nine compose stacks at once and they answer each other's requests. The failures that produces look like assertion errors from the code, not infrastructure. Add a runner that takes one suite at a time and tears its stack down before the next. Raise the readiness timeouts from 60s to 180s: on a cold image cache the first build outruns them, which reads as every test in the suite failing to reach its service. Document both, along with the port map and the fact that norecursedirs makes `pytest tests/` skip these silently.
Upgrade the lock file, which carried advisories for tornado, h2, idna, pytest and Pygments. The tornado example pinned tornado<6, which is both the source of eight advisories and older than the >=6.5.0 the tornado worker itself needs, so the example could not run as pinned. The app code is already tornado 6 style.
Every declared floor was checked against the advisory database. Four permitted vulnerable versions and are raised to the first clean release: tornado 6.5.0 to 6.5.7, h2 4.1.0 to 4.4.1, setuptools 68.0 to 84.0.0 and pymdown-extensions 10.0 to 11.0.1. pytest and httpx were unpinned, so a resolver could pick a vulnerable version if something else capped them. Both now carry a floor. These change what users and contributors resolve on install, unlike the lock file bump, which only affects local dev.
benoitc
force-pushed
the
release/26.1.0
branch
from
August 18, 2026 08:09
3ab0276 to
ca412e3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts 26.1.0.
Going through every commit since the 26.0.0 tag turned up three merged changes
that never got a changelog entry, so those are in here too: the truncated chunked
body fix (#3382 / #3685), the
--spewcrash on generated code (#3344 / #3495),and dropping
packagingfrom the runtime deps (#3643). Everything else wasalready covered. Dependabot action bumps are left out as in previous releases,
happy to add them if you'd rather.
Unreleased becomes
26.1.0 - 2026-08-18, mirrored into the Latest page. Minorrather than patch because of the new
reload_extra_filesglob support, whichmatches the
versionchanged:: 26.1.0already in config.py.The other half is the docker tests.
pytest tests/dockercannot work: everysuite ships its own compose file and binds fixed host ports, so running them
together means requests land on another suite's containers, and you get failures
that look like the code is broken when nothing is. There's a runner now that
takes one suite at a time and tears each stack down before the next, and the
readiness timeouts go up so a cold image cache doesn't read the same way. The
README covers the runner, the ports each suite claims, and the fact that
tests/dockersits innorecursedirs, sopytest tests/skips all of it andstill reports green.
Note this only lands the bump and the changelog. Tagging and the PyPI upload are
still manual.