chore(deps): update dependency yarl to v1.24.1 - autoclosed #89

Closed

renovate-bot wants to merge 1 commit from renovate/yarl-1.x into main

renovate-bot commented

2026-05-19 19:33:16 +02:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
yarl	`==1.23.0` → `==1.24.1`

Release Notes

aio-libs/yarl (yarl)

Contributor-facing changes

Allowed re-running the deploy job after a partial release failure: the
Make Release step now skips when the GitHub Release already exists,
and the PyPI publish step uses skip-existing so dists that were
already uploaded on a prior attempt do not break the retry
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1721.

Bug fixes

Delayed importing pydantic until it's needed to avoid increased import time -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub:
:issue:1607, :issue:1702.
Fixed pickling of :class:~yarl.URL on Python 3.15, where SplitResult
gained a __getstate__ that requires attributes set by __init__.
__getstate__ now returns the raw 5-tuple instead of a SplitResult
built via tuple.__new__, so pickling no longer touches SplitResult
serialization at all. Pickles produced by older yarl releases (which embed
a SplitResult) continue to load unchanged
-- by :user:befeleme.

Related issues and pull requests on GitHub:
:issue:1632, :issue:1642, :issue:1687.
Fixed a parsing issue where URLs containing text before an opening bracket
in the host component (e.g. http://127.0.0.1[aa::ff]) were silently accepted
instead of being rejected as strictly invalid per RFC 3986
-- by :user:rodrigobnogueira.

Related issues and pull requests on GitHub:
:issue:1654.
Raise :exc:ValueError when a URL's authority component contains a
backslash, which is not a valid character per :rfc:3986
-- by :user:rodrigobnogueira.

Related issues and pull requests on GitHub:
:issue:1659.
Fixed a host-confusion parsing bug where URLs containing multiple bracket
characters in the host component (e.g. http://[:localhost[]].google:80)
were silently parsed as an unintended host. Both split_url() and
split_netloc() now raise :exc:ValueError when more than one [ or
] is found in the authority, or when [ does not appear at the start of
the host subcomponent, in compliance with :rfc:3986 -- by
:user:rodrigobnogueira.

Related issues and pull requests on GitHub:
:issue:1661.
Fixed a parser/serializer inconsistency where percent-encoded characters in
the scheme portion of a URL (e.g. ht%74p://...) were decoded by the
requoter, causing str() and :py:meth:~yarl.URL.human_repr to emit an
absolute URL with a scheme and host while the parsed properties
(:attr:~yarl.URL.scheme, :attr:~yarl.URL.host, :attr:~yarl.URL.absolute)
reported a relative, hostless URL. The fix preserves the percent-encoding of
the colon (%3A) in relative paths whenever decoding it would materialize a
URL scheme -- by :user:rodrigobnogueira.

Related issues and pull requests on GitHub:
:issue:1669.
Fixed a parsing issue where URLs containing text after the closing bracket
of an IP-literal host (e.g. http://[::1]allowed.example:1/) were silently
accepted and normalized to the bracketed IP address (http://[::1]:1/),
dropping the trailing suffix and changing the effective host identity.
Per RFC 3986, after the closing ] only : followed by a port number or
end-of-authority is valid
-- by :user:rodrigobnogueira.

Related issues and pull requests on GitHub:
:issue:1672.

Features

Start building and shipping riscv64 wheels
-- by :user:justeph.

Related issues and pull requests on GitHub:
:issue:1626.

Removals and backward incompatible breaking changes

Dropped support for the experimental free-threaded build of Python 3.13 -- by :user:ngoldbaum.

Related issues and pull requests on GitHub:
:issue:1667.

Improved documentation

Added a note in the :meth:~yarl.URL.with_query documentation explaining
that types implementing __int__ (e.g. :class:~uuid.UUID) are
converted to integers, and advising users to cast to :class:str when the
human-readable representation is needed -- by :user:r266-tech.

Related issues and pull requests on GitHub:
:issue:1638, :issue:1645.

Contributor-facing changes

Resolved a ruff ISC004 violation in the PEP 517 build backend so the
pre-commit ruff-check hook passes again
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1674.
Renamed the actions/checkout depth input to fetch-depth in the
reusable codspeed workflow so the actionlint pre-commit hook passes and the
intended shallow clone actually takes effect
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1676.
Bumped the pinned pyupgrade pre-commit hook to v3.21.2 so it stops
crashing on Python 3.14, which made tokenize.cookie_re bytes-only
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1677.
The type preciseness coverage report generated by MyPy <https://mypy-lang.org>__ is now uploaded to Coveralls <https://coveralls.io/github/aio-libs/yarl>__ and
will not be included in the Codecov views <https://app.codecov.io/gh/aio-libs/yarl>__ going forward
-- by :user:webknjaz.

Related issues and pull requests on GitHub:
:issue:1680.
Raised the per-matrix-cell timeout of the CI Test job from
5 to 10 minutes to prevent false failures on slower runners
-- by :user:aiolibsbot.

Related issues and pull requests on GitHub:
:issue:1683.
Added an AGENTS.md orientation file at the repository root,
covering the pull request template, CHANGES/ news fragment
conventions, draft-PR workflow, and the Cython quoter layout, so
LLM contributors land changes that match project style
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1685.
Documented in :file:AGENTS.md that the coverage gate also
applies to test code, so unreachable defensive raise guards
and one-sided cleanup branches in tests will fail CI
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1689.
Shrunk the CI wheel-build matrix on pull requests and non-tag pushes by
restricting CIBW_ARCHS_MACOS to arm64, CIBW_ARCHS_WINDOWS to
AMD64, and skipping the windows-11-arm runner -- the test matrix only
exercises those architectures, so the previously-built x86_64 macOS and
ARM64 Windows wheels were never installed. Tag releases still build the
full architecture set
-- by :user:aiolibsbot.

Related issues and pull requests on GitHub:
:issue:1692.
Documented the docs spell check (make doc-spelling) in
:file:AGENTS.md as a pre-push gate, mirroring
aio-libs/multidict#1345 <https://github.com/aio-libs/multidict/pull/1345>__. The
spell checker reads every CHANGES/*.rst fragment as part
of the docs build, so an unknown technical word in a news
fragment fails CI before a human sees the PR
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1693.
Added a CLAUDE.md at the repository root that imports
:file:AGENTS.md via Claude Code's @-syntax, so the
project's LLM contributor rules load automatically when
working in Claude Code
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1696.
Enforced top-level imports across yarl and tests via the ruff
PLC0415 rule, wired through a new ruff-check pre-commit hook.
Function-scoped imports must now opt in with # noqa: PLC0415 plus
a comment explaining the import-time reason. Dropped the yesqa
hook, which could not recognize ruff-only codes and stripped the new
noqa comments as stale; a wider migration off flake8 onto ruff
will follow separately
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1697.
Migrated the main tree from standalone black and isort
pre-commit hooks to ruff format and the ruff I lint rule,
sharing the existing [tool.ruff] config in pyproject.toml.
ruff-check now runs with --fix so import-order fixes apply
on commit, and the orphan [isort] block in setup.cfg was
removed. The packaging/pep517_backend/ subtree keeps its own
.ruff.toml and is unaffected
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1698.
Switched the cibuildwheel build frontend to build[uv] so
that uv provisions every build and test virtual environment
in the wheel matrix. Test-dependency installation in particular
drops from a multi-second pip install per ABI to a roughly
sub-second uv resolve
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1699.
Restructured the root :file:CLAUDE.md to import contributor
context from a shared aio-libs layer
(~/.claude/aio-libs/context.md), a project-specific layer
(~/.claude/aio-libs/yarl/context.md), the in-tree
:file:AGENTS.md, and an optional per-checkout
:file:CLAUDE.local.md override (added to :file:.gitignore),
so shared aio-libs guidance can live outside the repository
while project rules continue to load automatically in Claude
Code -- by :user:aiolibsbot.

Related issues and pull requests on GitHub:
:issue:1700, :issue:1701.
Switched CI/CD to tox-dev/workflow's :file:reusable-tox.yml
driven by an in-tree :file:tox.ini. The build,
metadata-validation and lint (pre-commit,
spellcheck-docs, build-docs) jobs all run through the
reusable workflow; MyPy coverage uploads to Coveralls from a
post-tox-job hook
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1711.
Switched the CI test job from actions/setup-python to
astral-sh/setup-uv with uv pip install. Pre-release
interpreters skip the wheel cache so each run resolves freshly
against the current snapshot
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1715.
Switched the Aiohttp workflow that runs the aiohttp test
suite against the in-tree yarl checkout from
actions/setup-python to astral-sh/setup-uv with uv pip install
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1716.
Switched the Aiohttp workflow's make .develop step to
install aiohttp's dev env through uv pip by passing
PIP="uv pip"
-- by :user:bdraco.

Related issues and pull requests on GitHub:
:issue:1717.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [yarl](https://github.com/aio-libs/yarl) | `==1.23.0` → `==1.24.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/yarl/1.24.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/yarl/1.23.0/1.24.1?slim=true) | --- ### Release Notes <details> <summary>aio-libs/yarl (yarl)</summary> ### [`v1.24.1`](https://github.com/aio-libs/yarl/blob/HEAD/CHANGES.rst#v1241) [Compare Source](https://github.com/aio-libs/yarl/compare/v1.24.0...v1.24.1) \======= *(2026-05-19)* ## Contributor-facing changes - Allowed re-running the deploy job after a partial release failure: the `Make Release` step now skips when the GitHub Release already exists, and the PyPI publish step uses `skip-existing` so dists that were already uploaded on a prior attempt do not break the retry \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1721`. *** ### [`v1.24.0`](https://github.com/aio-libs/yarl/blob/HEAD/CHANGES.rst#v1240) [Compare Source](https://github.com/aio-libs/yarl/compare/v1.23.0...v1.24.0) \======= *(2026-05-19)* ## Bug fixes - Delayed importing pydantic until it's needed to avoid increased import time -- by :user:`Dreamsorcerer`. *Related issues and pull requests on GitHub:* :issue:`1607`, :issue:`1702`. - Fixed pickling of :class:`~yarl.URL` on Python 3.15, where `SplitResult` gained a `__getstate__` that requires attributes set by `__init__`. `__getstate__` now returns the raw 5-tuple instead of a `SplitResult` built via `tuple.__new__`, so pickling no longer touches `SplitResult` serialization at all. Pickles produced by older yarl releases (which embed a `SplitResult`) continue to load unchanged \-- by :user:`befeleme`. *Related issues and pull requests on GitHub:* :issue:`1632`, :issue:`1642`, :issue:`1687`. - Fixed a parsing issue where URLs containing text before an opening bracket in the host component (e.g. `http://127.0.0.1[aa::ff]`) were silently accepted instead of being rejected as strictly invalid per RFC 3986 \-- by :user:`rodrigobnogueira`. *Related issues and pull requests on GitHub:* :issue:`1654`. - Raise :exc:`ValueError` when a URL's authority component contains a backslash, which is not a valid character per :rfc:`3986` \-- by :user:`rodrigobnogueira`. *Related issues and pull requests on GitHub:* :issue:`1659`. - Fixed a host-confusion parsing bug where URLs containing multiple bracket characters in the host component (e.g. `http://[:localhost[]].google:80`) were silently parsed as an unintended host. Both `split_url()` and `split_netloc()` now raise :exc:`ValueError` when more than one `[` or `]` is found in the authority, or when `[` does not appear at the start of the host subcomponent, in compliance with :rfc:`3986` -- by :user:`rodrigobnogueira`. *Related issues and pull requests on GitHub:* :issue:`1661`. - Fixed a parser/serializer inconsistency where percent-encoded characters in the scheme portion of a URL (e.g. `ht%74p://...`) were decoded by the requoter, causing `str()` and :py:meth:`~yarl.URL.human_repr` to emit an absolute URL with a scheme and host while the parsed properties (:attr:`~yarl.URL.scheme`, :attr:`~yarl.URL.host`, :attr:`~yarl.URL.absolute`) reported a relative, hostless URL. The fix preserves the percent-encoding of the colon (`%3A`) in relative paths whenever decoding it would materialize a URL scheme -- by :user:`rodrigobnogueira`. *Related issues and pull requests on GitHub:* :issue:`1669`. - Fixed a parsing issue where URLs containing text after the closing bracket of an IP-literal host (e.g. `http://[::1]allowed.example:1/`) were silently accepted and normalized to the bracketed IP address (`http://[::1]:1/`), dropping the trailing suffix and changing the effective host identity. Per RFC 3986, after the closing `]` only `:` followed by a port number or end-of-authority is valid \-- by :user:`rodrigobnogueira`. *Related issues and pull requests on GitHub:* :issue:`1672`. ## Features - Start building and shipping riscv64 wheels \-- by :user:`justeph`. *Related issues and pull requests on GitHub:* :issue:`1626`. ## Removals and backward incompatible breaking changes - Dropped support for the experimental free-threaded build of Python 3.13 -- by :user:`ngoldbaum`. *Related issues and pull requests on GitHub:* :issue:`1667`. ## Improved documentation - Added a note in the :meth:`~yarl.URL.with_query` documentation explaining that types implementing `__int__` (e.g. :class:`~uuid.UUID`) are converted to integers, and advising users to cast to :class:`str` when the human-readable representation is needed -- by :user:`r266-tech`. *Related issues and pull requests on GitHub:* :issue:`1638`, :issue:`1645`. ## Contributor-facing changes - Resolved a ruff `ISC004` violation in the PEP 517 build backend so the pre-commit `ruff-check` hook passes again \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1674`. - Renamed the `actions/checkout` `depth` input to `fetch-depth` in the reusable codspeed workflow so the actionlint pre-commit hook passes and the intended shallow clone actually takes effect \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1676`. - Bumped the pinned `pyupgrade` pre-commit hook to `v3.21.2` so it stops crashing on Python 3.14, which made `tokenize.cookie_re` bytes-only \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1677`. - The type preciseness coverage report generated by `MyPy <https://mypy-lang.org>`\_\_ is now uploaded to `Coveralls <https://coveralls.io/github/aio-libs/yarl>`\_\_ and will not be included in the `Codecov views <https://app.codecov.io/gh/aio-libs/yarl>`\_\_ going forward \-- by :user:`webknjaz`. *Related issues and pull requests on GitHub:* :issue:`1680`. - Raised the per-matrix-cell timeout of the CI `Test` job from 5 to 10 minutes to prevent false failures on slower runners \-- by :user:`aiolibsbot`. *Related issues and pull requests on GitHub:* :issue:`1683`. - Added an `AGENTS.md` orientation file at the repository root, covering the pull request template, `CHANGES/` news fragment conventions, draft-PR workflow, and the Cython quoter layout, so LLM contributors land changes that match project style \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1685`. - Documented in :file:`AGENTS.md` that the coverage gate also applies to test code, so unreachable defensive `raise` guards and one-sided cleanup branches in tests will fail CI \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1689`. - Shrunk the CI wheel-build matrix on pull requests and non-tag pushes by restricting `CIBW_ARCHS_MACOS` to `arm64`, `CIBW_ARCHS_WINDOWS` to `AMD64`, and skipping the `windows-11-arm` runner -- the test matrix only exercises those architectures, so the previously-built `x86_64` macOS and `ARM64` Windows wheels were never installed. Tag releases still build the full architecture set \-- by :user:`aiolibsbot`. *Related issues and pull requests on GitHub:* :issue:`1692`. - Documented the docs spell check (`make doc-spelling`) in :file:`AGENTS.md` as a pre-push gate, mirroring `aio-libs/multidict#1345 <https://github.com/aio-libs/multidict/pull/1345>`\_\_. The spell checker reads every `CHANGES/*.rst` fragment as part of the docs build, so an unknown technical word in a news fragment fails CI before a human sees the PR \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1693`. - Added a `CLAUDE.md` at the repository root that imports :file:`AGENTS.md` via Claude Code's `@`-syntax, so the project's LLM contributor rules load automatically when working in Claude Code \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1696`. - Enforced top-level imports across `yarl` and `tests` via the ruff `PLC0415` rule, wired through a new `ruff-check` pre-commit hook. Function-scoped imports must now opt in with `# noqa: PLC0415` plus a comment explaining the import-time reason. Dropped the `yesqa` hook, which could not recognize ruff-only codes and stripped the new `noqa` comments as stale; a wider migration off flake8 onto ruff will follow separately \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1697`. - Migrated the main tree from standalone `black` and `isort` pre-commit hooks to `ruff format` and the ruff `I` lint rule, sharing the existing `[tool.ruff]` config in `pyproject.toml`. `ruff-check` now runs with `--fix` so import-order fixes apply on commit, and the orphan `[isort]` block in `setup.cfg` was removed. The `packaging/pep517_backend/` subtree keeps its own `.ruff.toml` and is unaffected \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1698`. - Switched the `cibuildwheel` build frontend to `build[uv]` so that `uv` provisions every build and test virtual environment in the wheel matrix. Test-dependency installation in particular drops from a multi-second `pip install` per ABI to a roughly sub-second `uv` resolve \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1699`. - Restructured the root :file:`CLAUDE.md` to import contributor context from a shared `aio-libs` layer (`~/.claude/aio-libs/context.md`), a project-specific layer (`~/.claude/aio-libs/yarl/context.md`), the in-tree :file:`AGENTS.md`, and an optional per-checkout :file:`CLAUDE.local.md` override (added to :file:`.gitignore`), so shared `aio-libs` guidance can live outside the repository while project rules continue to load automatically in Claude Code -- by :user:`aiolibsbot`. *Related issues and pull requests on GitHub:* :issue:`1700`, :issue:`1701`. - Switched CI/CD to `tox-dev/workflow`'s :file:`reusable-tox.yml` driven by an in-tree :file:`tox.ini`. The `build`, `metadata-validation` and `lint` (`pre-commit`, `spellcheck-docs`, `build-docs`) jobs all run through the reusable workflow; MyPy coverage uploads to Coveralls from a `post-tox-job` hook \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1711`. - Switched the CI `test` job from `actions/setup-python` to `astral-sh/setup-uv` with `uv pip install`. Pre-release interpreters skip the wheel cache so each run resolves freshly against the current snapshot \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1715`. - Switched the `Aiohttp` workflow that runs the aiohttp test suite against the in-tree yarl checkout from `actions/setup-python` to `astral-sh/setup-uv` with `uv pip install` \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1716`. - Switched the `Aiohttp` workflow's `make .develop` step to install aiohttp's dev env through `uv pip` by passing `PIP="uv pip"` \-- by :user:`bdraco`. *Related issues and pull requests on GitHub:* :issue:`1717`. *** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added the

dependencies

label 2026-05-19 19:33:16 +02:00

renovate-bot added 1 commit 2026-05-19 19:33:17 +02:00

chore(deps): update dependency yarl to v1.24.0

PR Tests / test (pull_request) Failing after 38s

Details

NYX Security Scan / nyx-scan (pull_request) Successful in 6m29s

Details

b57bf423ce

renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-05-19 19:33:22 +02:00

renovate-bot force-pushed renovate/yarl-1.x from b57bf423ce to 084a6faf0e

2026-05-19 21:35:35 +02:00

Compare

renovate-bot changed title from ~~chore(deps): update dependency yarl to v1.24.0~~ to chore(deps): update dependency yarl to v1.24.1

2026-05-19 21:35:36 +02:00

renovate-bot changed title from ~~chore(deps): update dependency yarl to v1.24.1~~ to chore(deps): update dependency yarl to v1.24.1 - autoclosed

2026-05-19 22:37:53 +02:00

renovate-bot closed this pull request

2026-05-19 22:37:55 +02:00