Update all non-major dependencies by renovate[bot] · Pull Request #1110 · pixee/codemodder-python

renovate · 2025-12-05T21:11:47Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
coverage	`>=7.12,<7.13` → `>=7.16,<7.17`	project.optional-dependencies	minor
flask-wtf (changelog)	`~=1.2.0` → `~=1.3.0`	project.optional-dependencies	minor
jsonschema (changelog)	`~=4.25.0` → `~=4.26.0`	project.optional-dependencies	minor
libcst (changelog)	`>=1.8,<1.9` → `>=1.9,<1.10`	project.dependencies	minor
lxml (source, changelog)	`>=6.0.0,<6.1.0` → `>=6.1.3,<6.2.0`	project.optional-dependencies	minor
numpy (changelog)	`~= 2.3.0` → `~=2.5.4`	project.optional-dependencies	minor
pyjwt	`~=2.10.0` → `~=2.15.1`	project.optional-dependencies	minor
pylint (changelog)	`>=4,<4.1` → `>=4,<4.2`	project.dependencies	minor
pytest-mock (changelog)	`>=3.15,<3.16` → `>=3.16,<3.17`	project.optional-dependencies	minor
python	`3.14` → `3.15`	uses-with	minor
python (source)	`3.14` → `3.15`	final	minor
python-json-logger	`~=4.0.0` → `~=4.2.0`	project.dependencies	minor
requests (changelog)	`~=2.32.1` → `~=2.34.2`	project.optional-dependencies	minor
semgrep (changelog)	`>=1.144,<1.145` → `>=1.181,<1.182`	project.optional-dependencies	minor
tomlkit (changelog)	`~=0.13.0` → `~=0.15.2`	project.dependencies	minor
types-defusedxml (changelog)	`==0.7.0.20250822` → `==0.7.0.20260504`	project.optional-dependencies	patch
types-wtforms (changelog)	`==3.2.1.20250809` → `==3.2.1.20260518`	project.optional-dependencies	patch

Release Notes

coveragepy/coveragepy (coverage)

`v7.16.2`

Compare Source

Fix: on Python 3.14 and later, a for loop completing immediately before a
function return could mistakenly report an uncovered branch. This is now
fixed, closing issue 2168_.
Fix: on Python 3.14 and later, the else clause of a try whose body is
a with statement could incorrectly be reported as covered when the
with raised. This is now fixed, closing issue 2289_.
Fix: with dynamic_context = test_function, test methods written as
@staticmethod or @classmethod were not given a context of their own.
Now they are, on Python 3.11 and later. Closes issue 1923_.

.. _issue 1923: #1923
.. _issue 2168: #2168
.. _issue 2289: #2289

.. _changes_7-16-1:

`v7.16.1`

Compare Source

Fix: when the body of an irrefutable case (like case _:) is entirely
excluded, the case line is now excluded too, just as an excluded
else: body removes the else: line. Previously the case line was
left behind and reported as missing. Closes issue 1563_ with pull 2269_.
Fix: using :meth:.CoverageData.update twice on an in-memory database would
fail, as described in issue 2279_. This is now fixed.
Fix: the Total row in the footer of the HTML report's index page was
recomputed in JavaScript with rounding that could disagree with the total
the server rendered in the heading, including showing 100% when coverage
was not complete. The footer now clamps values the way the rest of the
report does, and when nothing is filtered out it is shown exactly as the
server rendered it, so the two can't disagree. That also keeps rows the
report omits (--skip-covered drops fully covered files) in the total.
Fixes issue 2256_.

.. _issue 1563: #1563
.. _issue 2256: #2256
.. _pull 2269: #2269
.. _issue 2279: #2279

.. _changes_7-16-0:

`v7.16.0`

Compare Source

When combining files, now path separator slashes will automatically be
converted to the local file system style. This makes it less necessary to
define [paths] configuration to combine data across operating systems.
Fixes issue 2266_.
The :meth:.Coverage.switch_context method now returns the previous context.
Fix: previously, a [paths] pattern would be replaced everywhere in a file
path when it was only meant to be replaced once, in the leading portion of
the path. This is now fixed, in pull 2268_.
Fixes to validation of options and configuration settings:
- Negative precision settings now always cause useful error messages (pull 2261_).
- An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...:
  user-defined function raised exception" error. Now it raises a proper
  configuration error naming the bad regex, like other regex settings do
  (pull 2262_).
- Non-string values in TOML configuration settings now produce a helpful
  error message instead of a traceback. This affects list settings whose
  elements aren't strings (like omit, exclude_lines, or a [paths]
  entry), file settings like data_file, and any wrong-typed value in the
  [paths] section (pull 2263_).
- coverage run refuses run-affecting command-line options like
  --branch alongside --concurrency=multiprocessing, since they can't
  reach the subprocesses. The check only recognized multiprocessing as
  the entire option value, so --concurrency=multiprocessing,thread
  slipped through and failed later with "Can't combine statement coverage
  data with branch data". Each named concurrency library is now properly
  considered (pull 2270_).
Fix: coverage annotate -d DIR raised an AssertionError if any
measured file had an extension other than .py, such as a .pyw file on
Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: #2261
.. _pull 2262: #2262
.. _pull 2263: #2263
.. _pull 2265: #2265
.. _issue 2266: #2266
.. _pull 2268: #2268
.. _pull 2270: #2270

.. _changes_7-15-4:

`v7.15.4`

Compare Source

Fix: in the HTML report, a source file name containing a double quote (legal
on POSIX) wasn't escaped where it's dropped into the href of the index
and prev/next links, so it could close the attribute early and inject markup.
Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.
Fix: the LCOV report wrote file names and other fields into its
line-oriented records without neutralizing control characters. A measured
file whose name contained a newline (legal on POSIX) could forge extra
records, inflating the coverage seen by tools that read the report. Control
characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.
Wheels are now provided for Python 3.15.

.. _pull 2226: #2226
.. _pull 2227: #2227

.. _changes_7-15-3:

`v7.15.3`

Compare Source

Fix: the sysmon core is incompatible with dynamic contexts. Previously, the
combination would be prevented when read from the coverage.py configuration.
But using the context API as pytest-cov does, contexts would be silently
dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>.
Closes issue 2200.
A performance improvement in the low-level line number bookkeeping when
combining data files, thanks to Kevin Turcios <pull 2239_>_.
Performance improvement in HTML reporting by reducing the number of times
files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: #2200
.. _pull 2234: #2234
.. _pull 2239: #2239
.. _pull 2240: #2240

.. _changes_7-15-2:

`v7.15.2`

Compare Source

Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically
increased memory use during reporting for large projects. Now we use a
different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: #2229

.. _changes_7-15-1:

`v7.15.1`

Compare Source

Fix: in the HTML report with show_contexts enabled, a context label
containing </script> (for example a parametrized pytest node id) could
close the inline <script> element in a file page early, injecting markup.
Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.
A number of performance improvements thanks to Paul Kehrer, in pull requests
2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: #2213
.. _pull 2214: #2214
.. _pull 2215: #2215
.. _pull 2216: #2216
.. _pull 2218: #2218
.. _pull 2220: #2220
.. _pull 2221: #2221
.. _pull 2224: #2224

.. _changes_7-15-0:

`v7.15.0`

Compare Source

Since 7.14.0, reporting commands implicitly combine parallel data files. Now
those commands have a new option --keep-combined to retain the data files
after combining them instead of the default, which is to delete them.
Finishes issue 2198_.
Fix: the LCOV report would incorrectly count excluded functions as uncovered,
as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen <pull 2206_>.
When running your program, coverage now correctly sets
yourmodule.__spec__.loader as strongly recommended <--loader--_>,
avoiding the deprecation warning described in issue 2208. Thanks, A5rocks <pull 2209_>_.
Fix: with Python 3.10, running with the -I (isolated mode) option didn't
correctly omit the current directory from the module search path, as
described in issue 2103. That is now fixed thanks to Ilia Sorokin <pull 2211_>.

.. --loader--: https://docs.python.org/3/reference/datamodel.html#module.__loader_
.. _issue 2103: #2103
.. _issue 2198: #2198
.. _issue 2205: #2205
.. _pull 2206: #2206
.. _issue 2208: #2208
.. _pull 2209: #2209
.. _pull 2211: #2211

.. _changes_7-14-3:

`v7.14.3`

Compare Source

Fix: the default ... exclusion rule now also matches function bodies
whose closing return-type bracket is on its own line (for example, after a
long -> dict[ ... ] annotation that a formatter has split over multiple
lines). Closes issue 2185, thanks Mengjia Shang <pull 2196_>.
Fix: On 3.13t, we incorrectly issued Couldn't import C tracer errors.
We can't import the C tracer because in 7.14.2 we stopped shipping compiled
wheels for 3.13t. Thanks, Hugo van Kemenade <pull 2203_>_.

.. _issue 2185: #2185
.. _pull 2196: #2196
.. _pull 2203: #2203

.. _changes_7-14-2:

`v7.14.2`

Compare Source

Fix: some messages were being written to stdout, making coverage json -o - useless for capturing JSON output. Now messages are written to stderr,
fixing issue 2197_.
Fix: CoverageData kept one SQLite connection per thread that recorded
coverage, but never closed them when those threads terminated. On long runs
with many short-lived threads this leaked one file descriptor per dead
thread, eventually failing with OSError: [Errno 24] Too many open files.
Connections belonging to terminated threads are now closed and dropped.
Fixes issue 2192. Thanks, Matthew Lloyd <pull 2193_>.
Fix: when using sys.monitoring, we were assuming we could use the
COVERAGE_ID tool id. But other tools might also assume they could use
that id. Pre-allocated ids don't really make sense, so now we search for a
usable one instead. Fixes issue 2187_.
Following the advice of cibuildwheel <no-13t_>_, we no longer distribute
wheels for Python 3.13 free-threaded.

.. _issue 2187: #2187
.. _issue 2192: #2192
.. _pull 2193: #2193
.. _issue 2197: #2197
.. _no-13t: https://py-free-threading.github.io/ci/#building-free-threaded-wheels-with-cibuildwheel

.. _changes_7-14-1:

`v7.14.1`

Compare Source

Fix: the HTML report used typographic niceties to make file paths more
readable by adding a small amount of space around slashes. Those spaces
interfered with searching the page for file paths of interest. Now the report
uses CSS to accomplish the same visual tweak so that searches with slashes
work correctly. Closes issue 2170_.
Add a 3.16 PyPI classifier <hugo-316_>_ since we test on the 3.16 main
branch.

.. _issue 2170: #2170
.. _hugo-316: https://mastodon.social/@hugovk/116588523571204490

.. _changes_7-14-0:

`v7.14.0`

Compare Source

Feature: now when running one of the reporting commands, if there are
parallel data files that need combining, they will be implicitly combined
before creating the report. There is no option to avoid the combination; let
us know if you have a use case that requires it. Thanks, Tim Hatch <pull 2162_>. Closes issue 1781.
Fix: the output from combine was too verbose, listing each file
considered. Now it shows a single line with the counts of files combined,
files skipped, and files with errors. The -q flag suppresses this line.
The old detailed lines are available with the new --debug=combine option.
Fix: running a Python file through a symlink now sets the sys.path correctly,
matching regular Python behavior. Fixes issue 2157_.
Fix: Collector.flush_data could fail with "RuntimeError: Set changed
size during iteration" when a tracer in another thread added a line to the
per-file set that add_lines (or add_arcs) was iterating. The values
passed to CoverageData are now snapshotted via dict.copy() and
set.copy(), which are atomic under the GIL. Thanks, Alex Vandiver <pull 2165_>_.
Fix: the soft keyword lazy is now bolded in HTML reports.
We are no longer testing eventlet support. Eventlet started issuing stern
deprecation warnings that break our tests. Our support code is still there.

.. _issue 1781: #1781
.. _issue 2157: #2157
.. _pull 2162: #2162
.. _pull 2165: #2165

.. _changes_7-13-5:

`v7.13.5`

Compare Source

Fix: issue 2138_ describes a memory leak that happened when repeatedly
using the Coverage API with in-memory data. This is now fixed.
Fix: the markdown-formatted coverage report didn't fully escape special
characters in file paths (issue 2141). This would be very unlikely to
cause a problem, but now it's done properly, thanks to Ellie Ayla <pull 2142_>.
Fix: the C extension wouldn't build on VS2019, but now it does (issue 2145_).

.. _issue 2138: #2138
.. _issue 2141: #2141
.. _pull 2142: #2142
.. _issue 2145: #2145

.. _changes_7-13-4:

`v7.13.4`

Compare Source

Fix: the third-party code fix in 7.13.3 required examining the parent
directories where coverage was run. In the unusual situation that one of the
parent directories is unreadable, a PermissionError would occur, as
described in issue 2129_. This is now fixed.
Fix: in test suites that change sys.path, coverage.py could fail with
"RuntimeError: Set changed size during iteration" as described and fixed in
pull 2130_. Thanks, Noah Fatsi.
We now publish ppc64le wheels, thanks to Pankhudi Jain <pull 2121_>_.

.. _pull 2121: #2121
.. _issue 2129: #2129
.. _pull 2130: #2130

.. _changes_7-13-3:

`v7.13.3`

Compare Source

Fix: in some situations, third-party code was measured when it shouldn't have
been, slowing down test execution. This happened with layered virtual
environments such as uv sometimes makes. The problem is fixed, closing issue 2082_. Now any directory on sys.path that is inside a virtualenv is
considered third-party code.

.. _issue 2082: #2082

.. _changes_7-13-2:

`v7.13.2`

Compare Source

Fix: when Python is installed via symlinks, for example with Homebrew, the
standard library files could be incorrectly included in coverage reports.
This is now fixed, closing issue 2115_.
Fix: if a data file is created with no read permissions, the combine step
would fail completely. Now a warning is issued and the file is skipped.
Closes issue 2117_.

.. _issue 2115: #2115
.. _issue 2117: #2117

.. _changes_7-13-1:

`v7.13.1`

Compare Source

Added: the JSON report now includes a "start_line" key for function and
class regions, indicating the first line of the region in the source. Closes
issue 2110_.
Added: The debug data command now takes file names as arguments on the
command line, so you can inspect specific data files without needing to set
the COVERAGE_FILE environment variable.
Fix: the JSON report used to report module docstrings as executed lines,
which no other report did, as described in issue 2105_. This is now fixed,
thanks to Jianrong Zhao.
Fix: coverage.py uses a more disciplined approach to detecting where
third-party code is installed, and avoids measuring it. This shouldn't change
any behavior. If you find that it does, please get in touch.
Performance: data files that will be combined now record their hash as part
of the file name. This lets us skip duplicate data more quickly, speeding the
combining step.
Docs: added a section explaining more about what is considered a missing
branch and how it is reported: :ref:branch_explain, as requested in issue 1597. Thanks to Ayisha Mohammed <pull 2092_>.
Tests: the test suite misunderstood what core was being tested if
COVERAGE_CORE wasn't set on 3.14+. This is now fixed, closing issue 2109_.

.. _issue 1597: #1597
.. _pull 2092: #2092
.. _issue 2105: #2105
.. _issue 2109: #2109
.. _issue 2110: #2110

.. _changes_7-13-0:

`v7.13.0`

Compare Source

Feature: coverage.py now supports :file:.coveragerc.toml configuration
files. These files use TOML syntax and take priority over
:file:pyproject.toml but lower priority than :file:.coveragerc files.
Closes issue 1643_ thanks to Olena Yefymenko <pull 1952_>_.
Fix: we now include a permanent .pth file which is installed with the code,
fixing issue 2084. In 7.12.1b1 this was done incorrectly: it didn't work
when using the source wheel (py3-none-any). This is now fixed. Thanks,
Henry Schreiner <pull 2100_>.
Deprecated: when coverage.py is installed, it creates three command entry
points: coverage, coverage3, and coverage-3.10 (if installed for
Python 3.10). The second and third of these are not needed and will
eventually be removed. They still work for now, but print a message about
their deprecation.

.. _issue 1643: #1643
.. _pull 1952: #1952
.. _pull 2100: #2100

.. _changes_7-12-1b1:

python-jsonschema/jsonschema (jsonschema)

`v4.26.0`

Compare Source

=======

Decrease import time by delaying importing of urllib.request (#1416).

Instagram/LibCST (libcst)

`v1.9.0`

Compare Source

Added

Add support for Python 3.15 by @AlexWaygood and @thatch in #1454 and #1456
Add CodemodCommand helpers for adding and removing imports by @frvnkliu in #1432

Fixed

Recognize Python 3.14 parser configurations by @bowiechen in #1452
Allow a trailing comma after **rest in class patterns by @itamaro in #1438

Updated

Document the new CodemodCommand import helpers by @frvnkliu in #1437
Fix the tokenize function's docstring grammar by @galenseilis in #1434
Remove the retired macOS 13 runner from CI by @drinkmorewaterr in #1433

New Contributors

@AlexWaygood made their first contribution in #1454
@bowiechen made their first contribution in #1452
@galenseilis made their first contribution in #1434

Full Changelog: Instagram/LibCST@v1.8.6...v1.9.0

lxml/lxml (lxml)

`v6.1.3`

Compare Source

==================

Bugs fixed

LP#2165901: External parameter entity parsing was allowed by default
(with resolve_entities="internal").
Issue found by Tomer Fichman.

`v6.1.2`

Compare Source

==================

GH#526: Some build files were missing in the sdist.
Patch by Nicola Soranzo.
Some minor corrections for error handling cases.

Other changes

Built with Cython 3.2.9.

`v6.1.1`

Compare Source

==================

Bugs fixed

The known link attributes in lxml.html.defs.link_attrs were missing xlink:href,
which can be used for URL bypass attacks in embedded SVG/MathML/etc. content.
GHSA-4jhm-jv67-739f
The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.
The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

`v6.1.0`

Compare Source

==================

This release fixes a possible external entity injection (XXE) vulnerability in
iterparse() and the ETCompatXMLParser.

Features added

GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes
in lxml.html.defs. This allows lxml_html_clean to pass them through.
Patch by oomsveta.
The default chunk size for reading from file-likes in iterparse() is now configurable
with a new chunk_size argument.

Bugs fixed

LP#2146291: The resolve_entities option was still set to True for
iterparse and ETCompatXMLParser, allowing for external entity injection (XXE)
when using these parsers without setting this option explicitly.
The default was now changed to 'internal' only (as for the normal XML and HTML parsers
since lxml 5.0).
Issue found by Sihao Qiu as CVE-2026-41066.

numpy/numpy (numpy)

`v2.5.4`: (Oct 10, 2026)

Compare Source

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3
release. Highlights are:

Many typing fixes and improvements,
A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing
infinities instead of returning garbage results.
Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs
containing infinities for recent versions of some LAPACK implementations.
numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now
have equal hashes. Previously, distinct NaN objects could produce equal
dtype instances with different hashes, causing dictionary lookups and set
deduplication to fail.

(gh-32563)

Changes

`MaskedArray` resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value
for the new dtype when it cannot be represented in that dtype. Previously the
copied value could be stale: ufuncs that change dtype left the result holding a
fill_value typed for the old dtype, which raised a TypeError only when
something later validated it (such as .view()), and a floating point
fill_value that overflows an integer dtype was kept as an out-of-range value
together with a RuntimeWarning. Both now fall back to the default,
including when a masked array is passed to MaskedArray with a different
dtype. A fill_value given explicitly by the user is still validated and
raises as before. This can now raise a ComplexWarning if the fill_value is
complex and the new dtype is real.

(gh-32508)
(gh-32562)

Contributors

A total of 9 people contributed to this release. People with a "+" by their
names contributed a patch for the first time.

Aniket Singh Yadav
Bhuvansh Kataria +
Charles Harris
Iason Krommydas
Joren Hammudoglu
Lazizbek Ergashev +
Nathan Goldbaum
Sebastian Berg
Yeonho Kim

Pull requests merged

A total of 17 pull requests were merged for this release.

#32520: MAINT: Prepare 2.5.x for further development
#32557: BUG: Reset an unrepresentable fill_value on a dtype change (#32508)
#32565: BLD: work around MSVC 19.51 bug (#32561)
#32600: BUG: fix np.strings.replace truncating old/new to a's
#32707: BUG: fix [ureduce]{#ureduce} reshape when a kept axis has size 0 (#32536)
#32709: BUG: fix two possible crashes in the ufunc.accumulate implementation...
#32710: BUG: Reset an inherited fill_value in MaskedArray.__new__ as...
#32711: ENH: Improvements and fixes for stringdtype hashing (#32563)
#32713: CI: increase ppc64le timeout to match other timeouts (#32583)
#32718: BUG: fix memory leak in legacy ArrayMethod wrapper code
#32719: BUG: check for non-finite input before calling gesdd/gelsd and...
#32738: BUG: fix segfault in as_arrays() on self-referencing pyscalars
#32741: TYP: Various typing improvements.
#32791: BUG: Fix canonicalization/promotion of nested subarray types...
#32888: MAINT: Update vendored-meson to match main.
#32904: TYP: Backport a number of typing updates.
#32956: TYP: Various typing fixes and improvements.

`v2.5.3`: (Sep 6, 2026)

Compare Source

NumPy 2.5.3 Release Notes

The NumPy 2.5.3 is a patch release that fixes bugs discovered after the 2.5.2
release. Apart from the usual bug and maintenance work, there are a number of
StringDType related fixes for problems discovered during the ongoing string
work in the main branch.

This release supports Python versions 3.12-3.15

Changes

Casting a fixed-width byte string array (np.bytes_) to StringDType
now raises TypeError when the bytes are not valid UTF-8. Previously the
invalid bytes were stored as-is and later caused undefined behavior in
string operations.

(gh-32296)
MaskedArray._fill_value would become stale when ufuncs that change dtype
left the result holding a fill_value typed for the old dtype. The mismatch
was silent until something later called _check_fill_value, such as
.view(), and then a TypeError would be raised. Now, when the copied
fill_value is no longer valid for the new dtype, fall back to the
default fill_value for that dtype instead of propagating the stale value.
This may raise a ComplexWarning if the fill_value is complex and the
new dtype is real.

(gh-32423)

Contributors

A total of 9 people contributed to this release. People with a "+" by their
names contributed a patch for the first time.

Charles Harris
Iason Krommydas
James Davies +
Joren Hammudoglu
Maanas Arora
Matti Picus
Nathan Goldbaum
Shikhar Goel +
Yeonho Kim +

Pull requests merged

A total of 27 pull requests were merged for this release.

#32235: MAINT: Prepare 2.5.x for further development
#32289: BUG: raise ValueError when reading into record array with references...
#32290: BUG: avoid uninitialized memory access / NULL-pointer deref in...
#32291: TYP: fix np.random.{get,set}_bit_generator implicit re-exports...
#32292: BUG: don't assume strides are a multiple of itemsize in stringdtype...
#32293: CI: fix ccache CC override, add CXX in mac Conda CI (#32285)
#32303: BUG: Fix ref leak in [convert_from_type]{#convert_from_type} for custom scalar types...
#32304: BUG: fix a number of issues around iterators and StringDType...
#32326: TST: avoid allocating huge tuple of arrays in concatenate test...
#32338: BUG: avoid possible UB in 'safe' multiplication helpers (#32294)
#32339: MAINT: use PyObject_ functions instead of raw PyArray_ ones (#32331)
#32378: BUG: validate UTF-8 and harden StringDType bounds handling (#32296)
#32380: BUG: fix two error handling mistakes in stringdtype replace loop...
#32381: BUG: fix visibility annotations for functions in StringDType...
#32384: MAINT: Update ml_dtypes pin to 8/21/2026.
#32385: MAINT: Update numpy/_core/src/umath/svml
#32410: MAINT: skip failing cython limited API tests on Cython 3.3.0...
#32427: BUG: close duplicated file descriptor if fdopen fails (#32386)
#32428: MAINT: add missing space in warning and error messages (#32405)
#32430: BUG: fix error handling in StringDType to fixed-width bytes case...
#32441: MAINT: Only run nightly BLAS tests on main.
#32471: BUG: fix memory leak in StringDType creation error path (#32470)
#32477: BUG: fix stale fill_value after ufuncs change MaskedArray dtype...
#32478: MAINT: exit deadlock tests quickly on slow hardware (#32466)
#32481: BUG: Backport StringDType byteorder fixes
#32506: DOC: use static scipy doc site for intershpinx (#32503)
#32509: BUG: fix crash in ufunc.resolve_dtypes with a Python scalar type...

`v2.5.2`: (Aug 9, 2026)

Compare Source

NumPy 2.5.2 Release Notes

The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1
release. The big news is that it includes wheels for the newly released
Python 3.15.0rc1.

This release supports Python versions 3.12-3.15

C API changes

`PyArray_StringDTypeObject` is opaque under the abi3t stable ABI

The PyArray_StringDTypeObject was accidentally exposed in NumPy
2.5 when targeting the free-threading-compatible stable ABI
(Py_TARGET_ABI3T). PyArray_StringDTypeObject is now an opaque
struct: extensions compiled that way cannot access its fields, since
the struct layout depends on the size of the object header. Any code
that accessed PyArray_StringDTypeObject fields in an abi3t build
would have crashed, so we are making this API change in a bugfix
release.

The NpyString allocator API remains usable by passing the
descriptor object pointer, e.g.
NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr).

(gh-31771)

Contributors

A total of 16 people contributed to this release. People with a "+" by their
names contributed a patch for the first time.

Abhijeetsingh Meena +
Charalampos Stratakis
Charles Harris
Chris Ninham +
David Woods
Geonho +
Gopu Yeshwanth Reddy +
Iason Krommydas
Ijtihed Kilani
Jelle Zijlstra +
Joren Hammudoglu
Kumar Aditya
Mike Boyle
Nathan Goldbaum
Raghuveer Devulapalli
Sebastian Berg

Pull requests merged

A total of 28 pull requests were merged for this release.

#31864: MAINT: Prepare 2.5.x for further development
#31889: TYP: Backport multiple static typing fixes 1.
#31900: TST: add tests for stable ABI numpy extensions (#31822)
#31901: BUG: fix StringDType coerce flag in binary ufunc promotion...
#31902: BLD: fix meson deprecation warnings (#31892)
#31921: TYP: Backport multiple typing fixes 2.
#31947: MAINT: Update x86-simd-sort subproject (5adb334 → fa944ef) (#31908)
#31949: BUG: fix crash on 32 bit systems using abi3t (#31771)
#31950: MNT: remove some obsolete string to bool workarounds (#31859)
#31952: BUG: centralized helper for output coerce and na_object in stringdtype...
#31953: BUG: fix CPU feature env diagnostic buffer overruns (#31905)
#31954: BUG: restore ndarray.conjugate() for legacy user-defined dtypes...
#31955: TYP: Avoid shadowed dtype annotations
#32077: MAINT: Update verdored-meson/meson to match main.
#32114: BUG: fix refcount leak on overlapping copyto with where=False
#32115: BUG: fix swallowed cast error in fancy indexing assignment (#31975)
#32116: BUG: Fix buffered iterator stride after removing multi-index
#32117: BUG: fix np.fromiter corruption when reusing a StringDType...
#32119: BUG: add a special case for StringDType in np.isdtype (#32030)
#32121: BUG: reference leak in simd_sequence_from_iterable (#32038)
#32122: BUG: ensure lock is held when accessing or writing to RNG state...
#32123: BUG: fully reset cached RNG state for non-MT19937 RNGs (#32062)
#32135: TYP: type capabilities max dimensions
#32158: BUG: avoid possible stack overflow in arraydescr_dealloc (#32133)
#32206: MAINT: Update cibuildwheel to v4.2.0
#32214: MAINT: Skip limited_api tests on some platforms.
#32220: TYP: isclose shape-typing fix for 2d array-likes (#32205)
#32221: BUG: avoid segfaults when legacy copyswap slot is not defined...

`v2.5.1`: (July 4, 2026)

Compare Source

NumPy 2.5.1 Release Notes

The NumPy 2.5.1 is a patch release that fixes bugs discovered after the 2.5.0
release. The most noticeable is the fix is to the numpy datetime cython API
which should allow downstream to support NumPy versions older than 2.5.
Preparation for Python 3.15 continues along with typing improvements.

This release supports Python versions 3.12-3.14

Changes

The minimum supported GCC version has been updated from 9.3.0 to 10.3.0

(gh-31843)

Contributors

A total of 10 people contributed to this release. People with a "+" by their
names contributed a patch for the first time.

Adhyan Gupta +
Ankit Ahlawat
Charles Harris
Iason Krommydas
Joren Hammudoglu
Kumar Aditya
Nathan Goldbaum
Sebastian Berg
Ties Jan Hefting +
Vineet Kumar

Pull requests merged

A total of 20 pull requests were merged for this release.

#31707: MAINT: Prepare 2.5.x for further development
#31721: CI: fix new cython-lint errors (#31711)
#31723: MAINT: Update meson to match main
#31729: TST: use setup-sde instead of curl to get SDE binaries (#31727)
#31829: BUG: Relax finfo to be easier accessible for all user dtypes...
#31831: TYP: Fix flatiter.__next__ return type for object_ and...
#31832: BUG: avoid deadlocks using NpyString API (#31682)
#31833: BUG: fix out array leak in reduceat and accumulate when dtype...
#31835: BUG: fix numpy datetime cython APIs to be compatible with older...
#31836: TYP: Fix incorrect dtype inference of asarray([]) (#31732)
[#31837](https://redirect.github.com/numpy/

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sonarqubecloud · 2026-05-10T21:08:09Z