Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-autobahn for openSUSE:Factory
checked in at 2026-11-05 18:20:26
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-autobahn (Old)
and /work/SRC/openSUSE:Factory/.python-autobahn.new.3759290 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-autobahn"
Thu Nov 5 18:20:26 2026 rev:34 rq:1395068 version:26.11.1
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-autobahn/python-autobahn.changes
2026-09-22 15:53:15.604336125 +0200
+++
/work/SRC/openSUSE:Factory/.python-autobahn.new.3759290/python-autobahn.changes
2026-11-05 18:22:15.418556290 +0100
@@ -1,0 +2,37 @@
+Thu Nov 5 01:14:17 UTC 2026 - Steve Kowalik <[email protected]>
+
+- Update to 26.11.1:
+ * Security (CVE-2026-111497): Raised the compress extra requirement
+ floors to brotli >= 1.2.1 (CPython) and brotlicffi >= 1.2.1.0
+ (PyPy) to address an out-of-bounds write in the Brotli decoder.
+ (bsc#1288235)
+ * Standardized all four WebSocket per-message compression extensions
+ (permessage-deflate, -bzip2, -brotli, -snappy) to uniformly enforce
+ the maxMessagePayloadSize decompression budget.
+ * Added PayloadCorruptError (mapped to WebSocket close code 1007) for
+ corrupt compressed payloads and ensured asyncio connections drop on
+ unhandled receive errors.
+ * Fixed permessage-brotli failing on the second message of a
+ connection and required brotli >= 1.2.0 for bounded decompression
+ via output_buffer_limit.
+ * Removed python-snappy from the default compress extra so it remains
+ an optional dependency when native libsnappy is installed.
+ * Deferred loading the vendored FlatBuffers runtime until a
+ FlatBuffers message is actually built or parsed, rather than on
+ every import of autobahn.
+ * Avoided eagerly importing numpy on WebSocket-only imports, reducing
+ per-process memory overhead by 13-17 MB on CPython and preventing
+ broken numpy installations from breaking imports.
+ * Fixed Python 3.14 compatibility across asyncio entry points
+ (ApplicationRunner.run(), Component.start(), run(), and WebSocket
+ factories) when no implicit event loop exists.
+ * Fixed ApplicationSession.call() on the asyncio backend to raise the
+ underlying payload codec error instead of an unrelated
+ AttributeError.
+ * Updated dependency floors for cryptography >= 50, zope.interface >=
+ 6.2, and cbor2 >= 6.1.0.
+ * Added test coverage for compressor version floors and WebSocket-only
+ import isolation.
+- Refreshed patch no-flatc-entrypoint.patch
+
+-------------------------------------------------------------------
Old:
----
autobahn-26.7.1.tar.gz
New:
----
autobahn-26.11.1.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-autobahn.spec ++++++
--- /var/tmp/diff_new_pack.ggdlmw/_old 2026-11-05 18:22:16.400597113 +0100
+++ /var/tmp/diff_new_pack.ggdlmw/_new 2026-11-05 18:22:16.403597238 +0100
@@ -23,7 +23,7 @@
%endif
Name: python-autobahn
-Version: 26.7.1
+Version: 26.11.1
Release: 0
Summary: WebSocket and WAMP in Python for Twisted and asyncio
License: MIT
@@ -33,14 +33,15 @@
Patch0: intrin-arch.patch
# PATCH-FIX-OPENSUSE Do not ship flatc wrapper
Patch1: no-flatc-entrypoint.patch
+BuildRequires: %{python_module Brotli >= 1.2.1}
BuildRequires: %{python_module PyNaCl >= 1.4.0}
BuildRequires: %{python_module Twisted >= 24.3.0}
BuildRequires: %{python_module argon2-cffi >= 20.1.0}
BuildRequires: %{python_module attrs >= 20.3.0}
BuildRequires: %{python_module base58 >= 2.1.1}
-BuildRequires: %{python_module cbor2 >= 5.2.0}
+BuildRequires: %{python_module cbor2 >= 6.1.0}
BuildRequires: %{python_module cffi >= 2.0.0}
-BuildRequires: %{python_module cryptography >= 3.4.6}
+BuildRequires: %{python_module cryptography >= 50}
BuildRequires: %{python_module devel >= 3.11}
BuildRequires: %{python_module ecdsa >= 0.19.1}
BuildRequires: %{python_module flatbuffers >= 22.12.6}
@@ -53,18 +54,19 @@
BuildRequires: %{python_module pytest >= 2.8.6}
BuildRequires: %{python_module pytest-aiohttp}
BuildRequires: %{python_module pytest-asyncio}
+BuildRequires: %{python_module python-snappy >= 0.7.3}
BuildRequires: %{python_module pytrie >= 0.4.0}
BuildRequires: %{python_module qrcode >= 7.3.1}
BuildRequires: %{python_module service_identity >= 18.1.0}
BuildRequires: %{python_module txaio >= 25.12.2}
BuildRequires: %{python_module ujson >= 4.0.2}
BuildRequires: %{python_module wsaccel >= 0.6.3}
-BuildRequires: %{python_module zope.interface >= 5.2.0}
+BuildRequires: %{python_module zope.interface >= 6.2.0}
BuildRequires: fdupes
BuildRequires: python-rpm-macros
-Requires: python-cbor2 >= 5.2.0
+Requires: python-cbor2 >= 6.1.0
Requires: python-cffi >= 2.0.0
-Requires: python-cryptography >= 3.4.6
+Requires: python-cryptography >= 50
Requires: python-hyperlink >= 21.0.0
Requires: python-msgpack >= 1.0.2
Requires: python-txaio >= 25.12.2
@@ -74,7 +76,7 @@
# [twisted]
Suggests: python-Twisted >= 24.3.0
Suggests: python-attrs >= 20.3.0
-Suggests: python-zope.interface >= 5.2.0
+Suggests: python-zope.interface >= 6.2.0
# [accelerate]
Suggests: python-wsaccel >= 0.6.3
# [encryption]
@@ -99,9 +101,6 @@
%prep
%autosetup -p1 -n autobahn-%{version}
-# this test relies too much on rng that can behave randomly in obs
-rm src/autobahn/test/test_rng.py
-
%build
%if %{with nvx_support}
export AUTOBAHN_USE_NVX=1
@@ -133,7 +132,8 @@
export USE_TWISTED=1
%{python_expand # line continues
pushd %{buildroot}%{$python_sitearch}
- $python -m twisted.trial --no-recurse \
+ PYTHONPATH=%{buildroot}%{$python_sitearch} $python \
+ -m twisted.trial --no-recurse \
autobahn.test \
autobahn.twisted.test \
autobahn.websocket.test \
++++++ autobahn-26.7.1.tar.gz -> autobahn-26.11.1.tar.gz ++++++
/work/SRC/openSUSE:Factory/python-autobahn/autobahn-26.7.1.tar.gz
/work/SRC/openSUSE:Factory/.python-autobahn.new.3759290/autobahn-26.11.1.tar.gz
differ: char 13, line 1
++++++ no-flatc-entrypoint.patch ++++++
--- /var/tmp/diff_new_pack.ggdlmw/_old 2026-11-05 18:22:16.446599026 +0100
+++ /var/tmp/diff_new_pack.ggdlmw/_new 2026-11-05 18:22:16.449599150 +0100
@@ -1,8 +1,8 @@
-Index: autobahn-26.7.1/pyproject.toml
+Index: autobahn-26.11.1/pyproject.toml
===================================================================
---- autobahn-26.7.1.orig/pyproject.toml
-+++ autobahn-26.7.1/pyproject.toml
-@@ -231,7 +231,6 @@ asyncio = []
+--- autobahn-26.11.1.orig/pyproject.toml
++++ autobahn-26.11.1/pyproject.toml
+@@ -261,7 +261,6 @@ asyncio = []
[project.scripts]
wamp = "autobahn.__main__:_main"
