chore(deps): update python minor/patch #178
No reviewers
Labels
No labels
area:ai
area:ci-cd
area:notifications
area:observability
area:public-pages
backlog
bug
duplicate
enhancement
help wanted
invalid
question
type:decision
type:feature
type:infra
type:maintenance
type:security
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v2.0.0
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
rbrooks/WeatherBot!178
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/python-minorpatch"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
==1.18.5→==1.19.2==1.7.2→==1.8.0==0.140.7→==0.141.1==2.14.2→==2.15.0==1.2.2→==1.2.3==2.0.51→==2.0.52==8.2.5→==8.3.0==9.10.9→==9.11.1==0.51.0→==0.52.4Release Notes
authlib/authlib (authlib)
v1.8.0Compare Source
What's Changed
id_token_signed_response_algclient metadata to guess algs by @azmeuk in #888New Contributors
Full Changelog: https://github.com/authlib/authlib/compare/v1.7.2...v1.8.0
fastapi/fastapi (fastapi)
v0.141.1Compare Source
Fixes
app.frontend(). PR #16105 by @tiangolo.Docs
FASTAPI_ENVin FastAPI CLI guide. PR #16104 by @tiangolo.v0.141.0Compare Source
Features
app.frontend(check_dir="auto"), to make local development more convenient withfastapi dev. PR #16102 by @tiangolo.v0.140.13Compare Source
Fixes
status_codebeing ignored for SSE and JSONL streaming endpoints. PR #15937 by @SAURABHSALVE.Docs
format_sse_eventdocstring rendering of\n\nterminator. PR #15613 by @AshNicolus.v0.140.12Compare Source
Fixes
format_sse_eventto comply with SSE spec. PR #15515 by @Zawwarsami16.v0.140.11Compare Source
Fixes
response_model_*params ignored for non-generator endpoints withIterable[..]return type. PR #15093 by @YuriiMotov.v0.140.10Compare Source
Fixes
Internal
v0.140.9Compare Source
Fixes
exclude_defaultsnot propagated to dict keys and values injsonable_encoder. PR #16043 by @MBGrao.Internal
v0.140.8Compare Source
Fixes
include_router(). PR #15077 by @alex-raw.pydantic/pydantic-settings (pydantic-settings)
v2.15.0Compare Source
Highlights
Behavior changes
case_sensitivenow applies to init kwargs and config-file sources (#900).InitSettingsSourceand the JSON/TOML/YAML config sources previously ignoredcase_sensitive. Since it defaults toFalse, case-insensitive matching is now the default for these sources — e.g.Settings(TeSt=...)now populates atestfield where it previously did not. Nested keys are still matched case-sensitively.IncompleteFieldDefinitionWarningtelling you to callmodel_rebuild(). If you havefilterwarnings = errorconfigured, this may surface as a new failure.ValidationError(#926) instead of a less specific error.New features
cli_show_env_vars=True(#860), so generated--helpoutput doubles as configuration documentation.PYDANTIC_SETTINGS_DEBUGfor debugging settings resolution (#906, #913). Set it to a truthy value withDEBUGlogging enabled to see each source's contribution in priority order, which source won for each value, and whichenv_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my.envbeing picked up?" question.toml_table_headerfor regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not justpyproject.toml.Traversablesupport for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — viaimportlib.resources.files(...)without casting toPath.project_idcan come from an earlier settings source (#878), rather than only from the constructor orGOOGLE_CLOUD_PROJECT.Bug fixes
case_sensitive=True(#894). Windows upper-casesos.environkeys, so fields raisedField requiredinstead of picking up their values.AliasPathon nested model fields not JSON-decoding env values (#898).dbx_tokenbeing swallowed by adb: dictfield.nested_model_default_partial_update=Truecorrupting discriminated unions (#876).Secretsubclasses crashing when loaded from the environment (#920).Optional[Annotated[MyEnum, ...]]withenv_parse_enums=True(#910).yaml_config_sectionnow falls back to defaults instead of raisingAttributeError: 'NoneType' object has no attribute 'keys'(#914).NestedSecretsSettingsSourceno longer follows symlinks pointing outsidesecrets_dir(#889).list_secretscall whencase_sensitive=True(#862), lowering the required IAM permissions to justroles/secretmanager.secretAccessor.types-boto3[secretsmanager]is no longer required at runtime (#880).Documentation
All changes (including dependency bumps and internal maintenance)
What's Changed
New Contributors
Full Changelog: https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.15.0
theskumar/python-dotenv (python-dotenv)
v1.2.3Compare Source
Fixed
.envfile contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@h1whelan] in [#640]set_keynow escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@dchaudhari7177] in [#680]dotenv runnow prints a friendly error instead of a traceback when no command is given by [@bbc2] in [#606].envfiles so repeateddotenv_values/load_dotenvcalls no longer re-read the file by [@ReinerBRO] in [#638]jannikmi/timezonefinder (timezonefinder)
v8.3.0Compare Source
the dataset version is now exposed at runtime.
TimezoneFinder().data_version(andTimezoneFinderL().data_version) return the timezone-boundary-builder release the packaged data was built from, read from adata_version.txtstamp thatscripts/file_converter.pywrites into the data directory it generates and that ships in the wheel. Previously an installedtimezonefindercould not state it at all: the release tag lived only in a repo-root file that is not packaged. Which release a parse is stamped with comes from the input's filename (combined-with-oceans-2026c.json, whichupdate_data.shnow produces), or fromscripts/file_converter.py --data-versionfor an input that cannot carry it; your own GeoJSON is stamped"unknown", and an unpacked release archive that lost its tag is refused rather than compiled into data that could never say where it came from.timezonefinder.__version__is now exposed as well, read from the installed distribution metadata. Solves issue #498fixed a
BufferError: cannot close exported pointers existraised during resource cleanup in file mode (in_memory=False). A coordinate array obtained fromcoords_of()is a zero-copy view onto the memory-mapped file, andmmap.close()refuses to unmap while one is alive, so an array outliving itsTimezoneFinderraised on cleanup. The mapping now stays valid instead of leaving the views dangling, andFileCoordAccessor.cleanup()releases its own references so the deferred close happens as soon as the last view is dropped. The accessor must not be used aftercleanup()polygon coordinates are now stored one axis at a time in the packaged
coordinates.binfiles - all x values followed by all y values per polygon, instead of interleaved. The point in polygon test scans a single axis per iteration, so contiguous per-axis blocks halve the cache lines it touches: ~1.6x faster on a median polygon and ~2.5x faster on the largest ones via the C extension, 14-25% faster via Numba. The bundled data was regenerated accordingly, and the layout is described in thedata format documentation <https://timezonefinder.readthedocs.io/en/latest/data_format.html>__every packaged FlatBuffers file now carries a file identifier and a layout version, and
TimezoneFinderraises aValueErrornaming the offending file when either does not match - previously such a directory was read without complaint and produced wrong timezones. Forcoordinates.binthe version records how the coordinates are encoded and which polygons the file holds. The hybrid shortcut binaries get an identifier that differs per zone id width, because the uint8 and uint16 schemas differ only in the width of a zone id and each parses cleanly as the other; the width is now read from the buffer instead of being guessed from the file name, so a renamed or mispaired shortcut file fails loudly rather than returning wrong zones. If you compile your own data and pointbin_file_locationat it, regenerate it once withscripts/file_converter.py, since the coordinate layout, the hole storage, the shortcut container and the file names all changed in this release. The markers track what a file holds rather than the package version, so this is not a per-release obligation. Solves issue #458the memory footprint of every finder configuration is now measured and published in a new
memory report <https://timezonefinder.readthedocs.io/en/latest/benchmark_results_memory.html>__, separating what a configuration allocates (tracemalloc) from what it makes resident (RSS, which additionally counts memory-mapped pages). The distinction is the point: the default mode maps the coordinate data instead of reading it, so it allocates an order of magnitude less than the in-memory mode, and only the pages a lookup actually touches become resident. This replaces documentation claiming a 40MB process ceiling and a 41MB data directory, both long out of daterestructured the two entry points a reader actually arrives at -
README.rstand thedocumentation landing page <https://timezonefinder.readthedocs.io/en/latest/>__ - so both state what the package is and how it works instead of only what it is called. The README opens with the project banner and a one-sentence statement of what the package is for, then the badges, then the quick guide - and adds three short sections that were missing entirely: How it works (the lookup pipeline and the no-simplification trade-off), Performance (a concrete throughput figure with its configuration named, the three point-in-polygon backends and the pure-Python fallback), and Engineering notes linking the architecture, data format and benchmarking methodology pages. The maintainers-wanted notice moves from the first heading after the intro into a newContributingsection at the bottom, which also linksCONTRIBUTING.mdfor the first time. The badge block is corrected along the way: thecode style: blackbadge named a formatter this project has never used and is replaced byruff, and a supported-Python-versions badge was added. The banner is referenced by absolute URL, since PyPI serves the long description without the repository and adocs/…path renders as a broken image there. The landing page gains the same How it works summary, the no-simplification trade-off and the ocean-zone consequence fortimezone_at(), and its flat seventeen-entry table of contents is grouped into Using it, Design, Performance and Project, so the sidebar says what kind of project this is rather than listing pages in the order they were writtenrewrote the
package comparison <https://timezonefinder.readthedocs.io/en/latest/alternatives.html>__ page. It now states its position in prose before the first table - border correctness is what this package optimises for, speed is the constraint that work happens under - and says plainly whentzfpyis the better choice. Every quantitative cell names what it measures and links its source, and the speed row is deliberately qualitative on both sides, with a note explaining that the two packages have never been benchmarked under one harness. The decision table drops the rows on which the two packages do not differtwo new documentation pages:
Architecture <https://timezonefinder.readthedocs.io/en/latest/architecture.html>__ describes the lookup pipeline, the three point-in-polygon backends and the memory modes, and states the ceilings this package deliberately does not exceed - unsimplified geometry, ~1 cm coordinate resolution, no general-purpose spatial code. It also documents how the package is built and shipped, which was previously described nowhere outside the workflow YAML: why one abi3 wheel per target replaces one wheel per Python version and whatabi3auditis guarding, why three libc targets are built, why the end-to-end job installs the built wheel and asserts the C extension loaded rather than merely importing the package, and why a tag pushed from outsidemasteraborts the release. The testing section gained the property-based suite and the reason the tox matrix is a matrix - the acceleration paths are bound at import time, so a passing run describes one configuration only. Both sections are linked from the README's Engineering notes.Benchmarking Methodology <https://timezonefinder.readthedocs.io/en/latest/benchmarking_methodology.html>__ documents how the published numbers are produced and what they can and cannot tell you:ubuntu-latestpins the runner image and not the CPU, which is why a pull request is measured against its own merge base on the same runner and why every alert threshold is derived from measured noise. It was previously addressed only to contributors, in the second half ofCONTRIBUTING.md, which now keeps the operational instructions and links to itthe H3 resolution choice in the
data format documentation <https://timezonefinder.readthedocs.io/en/latest/data_format.html>__ is no longer asserted to "offer a good balance" but reports the study behind it (prototypes/single_resolution_bench.py): resolution 3 keeps the hybrid index at a small fraction of the packaged polygon data, while resolution 4 would exceed 10 % of it for gains that do not justify the increasethe hand-written documentation no longer restates exact figures that belong to the generated pages - dataset vertex, polygon and hole counts, index and distribution sizes, memory footprints, lookup throughput. Those change with every data update and with code that shifts a footprint, which silently left the copies wrong: the memory figures had already gone stale in four places. The prose now states the magnitude that survives a data update and links
the data report <https://timezonefinder.readthedocs.io/en/latest/data_report.html>__ or the relevantbenchmark report <https://timezonefinder.readthedocs.io/en/latest/7_performance.html>__, which are regenerated from the packaged data and are always currentthe three weakest hand-written documentation pages no longer answer a question by pointing at a file the reader has to open. The
performance page <https://timezonefinder.readthedocs.io/en/latest/7_performance.html>__ now opens with the four benchmark reports and the trend chart instead of a bullet list of adjectives about the binary format, and its C extension and Numba sections are cut to what a user does - which call reports the active backend - with the explanation left to the architecture page that already carried a more precise version of it. Getting started lists the four runtime dependencies and what each is for, where it previously said to consultpyproject.toml, which remains linked as the authoritative source for version ranges. The use case pages carry runnable snippets for building an awaredatetimeand reading a UTC offset, with theexamples/scripts as the follow-up rather than the whole answer; the snippets use the standard library'szoneinfo, so neither needs an optional dependencythe shortcut entry distributions in the
data report <https://timezonefinder.readthedocs.io/en/latest/data_report.html>__ no longer report three quarters of all H3 cells as holding0polygons, which is impossible for data whose ocean zones cover the globe. Those cells are covered by a single timezone and store its id directly, so a lookup there needs no point-in-polygon test at all - the column is now Polygons to test and the row reads none (unique zone). The tables are introduced by a sentence on what they measure, including why no cell ever needs exactly one testthe hybrid shortcut loader no longer keeps the entire shortcut binary in memory. The polygon id arrays it returns were zero-copy views onto the ~1.5 MB file buffer, so ~47 KB of live data pinned the whole thing for the lifetime of every
TimezoneFinder/TimezoneFinderLinstance. They are now disjoint read-only slices of a single compact array, cutting the shortcut mapping's footprint from ~7.4 MB to ~4.7 MB per instance, and every finder's resident set by ~2 MB, at unchanged initialisation time - which matters most for concurrent workloads, where the recommended one-instance-per-thread pattern multiplied the wastethe usage examples in
README.rstand theusage documentation <https://timezonefinder.readthedocs.io/en/latest/1_usage.html>__ now show the result the packaged data actually returns. Every snippet queries the same Berlin coordinates and annotated the answer as'Europe/Paris', which is the value from the reducedtimezones-nowdataset, whereEurope/Berlinis merged intoEurope/Paris- not from the full dataset the package ships by default. All eleven annotations now read'Europe/Berlin', verified against the packaged data for each oftimezone_at(),timezone_at_land(),certain_timezone_at(),unique_timezone_at()andTimezoneFinderL, and theget_geometry()call in the opening example asks for that same zone instead of a different one.tests/test_documented_contracts.pynow re-runs each of those documented lookups, so a data update that moves the example coordinate's zone fails there rather than leaving every snippet on both pages quietly wrong againholes that duplicate a timezone boundary polygon are no longer stored twice. Almost every hole is an enclave, cut into the surrounding zone with exactly the ring the upstream data also emits as the enclosed zone's own boundary polygon - the same geometry under two IDs. The packaged hole coordinate file now holds only the rings with no such twin (27 of 756 in the current data), and a new
holes/poly_ref.npyrecords per hole which boundary polygon to read instead. Hole data drops from ~2.0 MiB to ~0.16 MiB, andin_memory=Truesaves the same amount of RAM, since those holes now resolve into the boundary arrays rather than materialising a second copy. Matching is exact - rings are compared as integer coordinates in a canonical form, with bounding boxes used only to narrow the search - so every timezone lookup returns what it did before. One visible consequence:get_geometry()may hand back a deduplicated hole ring starting at a different vertex or winding the other way than it used to, tracing the same closed path. The encoding is described in thedata format documentation <https://timezonefinder.readthedocs.io/en/latest/data_format.html>__the command line script gained a
--stdinstreaming mode: it reads delimited rows from standard input and writes each back out with atimezonecolumn appended, building the finder once instead of paying full initialisation per coordinate. Which columns hold the coordinates is read off the header by name, or stated with--lng-col/--lat-col, and never inferred from their position - a swapped pair is still a valid coordinate for any longitude between -90 and 90, so guessing would answer with a real but wrong timezone instead of failing. Every input row produces exactly one output row, and a row that cannot be used warns on stderr and makes the run exit non-zero rather than ending the stream. Whether the first row is a header is worked out from the row, or stated with--header/--no-header. New flags-d/--delimiterand--in-memoryapply to the whole stream. See theusage documentation <https://timezonefinder.readthedocs.io/en/latest/1_usage.html#looking-up-many-coordinates-at-once>. Solves issue #504. Thanks toweed33834 <https://github.com/weed33834>for the PR #516the timezone boundary data now ships as its own distribution,
timezonefinder-data.pip install timezonefinderis unchanged - it is a hard dependency and is installed automatically - but the dataset can now be pinned on its own (pip install timezonefinder "timezonefinder-data==1.2026.3"), where previously holding a dataset meant pinning an oldtimezonefinderand forfeiting every code fix since. Every release used to carry the whole ~65 MB dataset in three platform wheels plus an sdist to distinguish a few kilobytes of compiled code, which had already exhausted the PyPI project storage quota once. A data update is consequently no longer atimezonefinderrelease at all: it publishestimezonefinder-dataunder its own tag namespace and is recorded in that package's README rather than here. Its version reads<format>.<year>.<letter>-1.2026.3is data format generation 1 built from timezone-boundary-builder2026c- andtimezonefinderrequirestimezonefinder-data>=…,<2: no ceiling on the data axis, so a dataset update needs no code release, and a hard one on the format axis, so code paired with data it cannot read fails when resolving rather than at the first lookup.DATA_LICENSEmoves with the database it covers and now ships inside the data wheel, and a compiled data directory additionally carries aschemas/copy of the FlatBuffers definitions its binaries were written by, so it can be read back without the package that wrote it. Solves the first part of issue #446the packaged FlatBuffers binaries are now named
.binrather than.fbs:boundaries/coordinates.bin,holes/coordinates.binandhybrid_shortcuts_uint16.bin..fbsis the FlatBuffers schema extension, and the data directory now ships actual schemas next to the buffers, so one extension was naming two unrelated kinds of file. Each buffer already states what it is through the file identifier in its first bytes, which is what a rename or a mispaired copy cannot forge - the name never carried that meaning. The bytes are unchangedInternal:
timezonefinderunless a compatibletimezonefinder-dataalready exists on PyPI. The two distributions release independently, and on a data format change the order is fixed - data first, then the code requiring it - because a code wheel whose declared data version does not exist yet is uninstallable for everyone until it does, and the version number cannot be reused to fix it. The check reads the requirement out of the built wheel rather than out ofpyproject.toml, and asks the index the same question a user's resolver will, so a yanked release does not count as one that satisfies it. It runs before the GitHub Release, which is the first step of the release that cannot be taken back.github/pull_request_template.md) prompting for the change, its motivation and the checks that were runupdate_data.shresolves the timezone-boundary-builder release tag before downloading and fetches that release's asset, instead of fetchingreleases/latest/download/and separately asking the API whatlatestwas - two independent questions that a release landing between them answered differently, attributing one release's data to the other. The tag now names the downloaded archive and the GeoJSON as well, so a leftover file from another release or another dataset variant cannot satisfy the "already downloaded" checks and be parsed in place of what was asked forTimezoneFinder.timezone_atdocuments the optimisation it actually performs: once no other zone can be matched the last remaining zone is returned without a point in polygon test, which is always correct against the packaged data - the ocean zones cover the globe, so every point lies within one of the candidate polygons - but not against custom data that leaves areas uncovered, where a point inside none of the candidates is still attributed to that zone andcertain_timezone_atis the method that tests every candidate. Three tests were named after something other than what they do:test_rectify_coords_valid/_invalidwere named for arectify_coordsthat exists nowhere in the package and both callvalidate_coordinates, and the first was subsumed entirely bytest_validate_coordinates_accepts_finite_values, which covers all four of its distinct corners and additionally asserts the return value where the older test asserted only "does not raise"; andtest_single_element_arrays_should_not_occurasserted that they do occur (assert single_element_count == 2) under a triple-quoted string placed after the first statement, making it a discarded expression rather than a docstring - so it reached neither--collect-onlynor a failure report, which is where the contradicting name was the only thing a reader saw. A stale comment duplicated across the last two lines oftests/main_test.py, reading as a to-do for somethingTestTimezonefinderClassTestMEMalready does, is goneDATA_VERSIONfile tracking which timezone-boundary-builder release the packaged data was generated from, written automatically by the data update script after a successful parse. Thanks toLucas Hemkemeier <https://github.com/hemkdev>__ for the PR #429DATA_VERSIONagainst the latest timezone-boundary-builder release, regenerates the data and opens a ready-to-review update PR, which is merged and released automatically once its CI passes - the version tag is pushed with a GitHub App token, since the default one would not trigger the release pipeline. The tag lives in its owndata-v*namespace, which the code release pipeline excludes at its trigger and again on the job that creates the GitHub Release, and the data stream publishes by PyPI Trusted Publishing from its own deployment environment rather than with a shared token. It refuses to release when the squash it produced did not land on themasterit checked, so the tag names a tree that was actually built. Failed CI takes the same manual-attention path and falls back to the previous notification issue. Each cause labels the PRautomation-failedand leaves one comment naming that cause and linking the run, deduplicated per cause so re-running CI neither repeats a notice nor hides a second one; a failure past the merge is a cause of its own, since that leaves master carrying the update with no tag pushed and only a hand-pushed tag still releases it. The manual release path drops the stop condition it carried for an out-of-orderCHANGELOG.rst: the automation can no longer produce one, and the test suite asserts the committed file's section order if anything else does (issues #273, #167 and #510). Thanks toLucas Hemkemeier <https://github.com/hemkdev>__ for the PRs #434 and #436, and toNice6042 <https://github.com/Nice6042>__ for the PR #518update_data.sh(renamed fromparse_data.sh) is CI-ready: interactive prompts replaced by flags (--dataset=full|same-since-now,--with-oceans,--rm-tmp), the release note for a data update written automatically into the data package's README, no redundanttoxrun, and amake reportsat the end so the benchmark and data reports cannot go stale relative to the data an update PR ships. A standalonemake parse/make testparsestill needs a manualmake reports(issues #167 and #510). Thanks toLucas Hemkemeier <https://github.com/hemkdev>__ for the PRs #432 and #434hypothesis) for coordinate validation (solves issue #143). Thanks toLu Yicheng <https://github.com/01luyicheng>__ for the PRs #431 and #433timeittiming inscripts/check_speed_*.pywithpytest-benchmarksuites underbenchmarks/, excluded frommake test/make testallviatestpaths. Both they and the memory harness run over deterministic committed fixtures (tests/fixtures/benchmarks/), so two runs of the same commit execute the exact same workload; the loader rejects fixtures that no longer match the checkout. Measurement and rendering are decoupled, sodocs/benchmark_results_*.rstcan be regenerated from a stored JSON without re-measuring. Run viamake speedtest,make benchmarks,make memoryormake reportsscripts/measure_memory.py,make memory) rather than bypytest-benchmark, which times code and would have its timings distorted by allocation tracking. It emits pytest-benchmark-shaped JSON, so the existing normalisation, noise and comparison tooling works on it unchanged given a--metric.tests/test_memory_footprint.pyfails if a mode's allocation leaves its order of magnitude - the regression that would makein_memory=Falsestop being the low-memory optionbuild.yml: the tracked core subset and the memory harness run on every pull request and every push tomaster, publishingtrend charts <https://jannikmi.github.io/timezonefinder/dev/bench/>__ togh-pagesand posting a same-runner base/head comparison on the pull request. The comparison reports added or removed benchmark IDs without trying to ratio unmatched measurements, which lets the trusted default-branch consumer remain compatible while the suite evolves. A pull request is measured against its own merge base in the same job rather than against a stored baseline, becauseruns-on: ubuntu-latestpins the runner image and not the CPU. The measurement design, the tracked estimator and every alert threshold are documented in the newbenchmarking methodology <https://timezonefinder.readthedocs.io/en/latest/benchmarking_methodology.html>__ page. The measuring job holds no write permissions and no secrets, so branch and fork pull requests behave identically; the comment is posted by a separate, privileged workflow viaworkflow_runtests/test_benchmark_names.pyandtests/test_memory_metric_names.pypin the node ids and metric names that join a measurement to its chart history, so a rename fails loudly instead of starting an empty chart beside the orphaned old one;tests/test_benchmark_workflows.pyasserts that the constants duplicated across the two workflows agree, where a one-sided edit previously had no failure mode at all, and that the cross-machine trend chart cannot creep back into the pull request comparison; and every generated report page states the inputs it describes -docs/benchmark_results_*.rstthe fixture and timezone data versions they were measured against,docs/data_report.rstthe timezone data version its figures were derived from. Both stamps are covered by tests: one renders each report and fails if a renderer stops emitting it, another checks the committed pages against the current fixture metadata andDATA_VERSION, so regenerating fixtures or updating the data without re-rendering fails loudly instead of leaving a page whose numbers are all plausible and all stalewrite_jsonsorts keys the waypretty-format-jsondoes, and neitherscripts/reporting.pynorBenchmarkReporteremits trailing whitespace on empty cells or a trailing blank line. Previously everymake parse/make reportsleft its outputs looking modified until the hooks had run, which masked whether a regeneration had actually changed anythingmake flatbufno longer overwrites hand-maintained__init__.pyfiles.flatcderives its output path from the schema namespace and writes an empty__init__.pyat every level of it, so generating in place wiped the__all__intimezonefinder/__init__.py- the whole public API. The target now generates into a scratch tree, copies back only the generated packages, and runs the formatters on the result so a regeneration diff shows the codegen change rather than formatting churnflatc-generated bindings.ignore_errorspreviously covered roughly 800 lines of hand-written code as well, where a blatantly wrong return type still reported "Success"; they all pass once the exemption is lifted, bar two genuine findings now fixed.tests/test_mypy_config.pykeeps the list restricted to generated code, so silencing a module is a reviewed decision rather than a one-line editSHORTCUT_SCHEMASintimezonefinder/flatbuf/io/hybrid_shortcuts.py) instead of dispatching on the zone id width in three places, each keyed differently. OneShortcutSchemaper width owns the width, the file name, theuintNmarker and the maximum zone id, which were previously written down across five places with nothing tying them together. Verified behaviour-preserving down to the bytes: re-writing the shipped shortcut binary produces a byte-identical filebuild/liband never prunes it, so a file renamed in the source tree keeps being zipped into every later wheel built from that checkout, which is how a 63 MBcoordinates.fbswas still shipping next to thecoordinates.binthat replaced it and doubling the wheel whose size is the reason the distribution was split out. The wheel builders clear that directory first, so a local build matches the fresh checkout CI builds from, and the code sdist's checks cover its grafted test fixtures againscripts/file_converter.pyis a supported use case, holes that are ordinary interior rings rather than enclaves are stored inline and answer correctly, and the converter only reports the ratio rather than refusing to compile.prototypes/hole_boundary_redundancy.pyis the study behind the threshold: it reads the upstream GeoJSON, so re-running it against a new release re-verifies the assumption rather than restating it.prototypes/hole_removal_impact.pyis the study behind keeping the unmatched holes stored inline rather than dropping them, which is the obvious next step and does not work: dropping holes and re-running the lookups changes answers, wrongly, because being covered by another zone only puts that zone among the shortcut candidates and says nothing about it being tested first (issue #513)__slots__entries were declared but assigned by nothing, which silently re-permitted the very attributes__slots__is there to forbid - assigning those names now raisesAttributeError, andtest_declared_slots_are_assignedkeeps the list honestget_corrected_hex_boundariesexists once again. An earlier refactor left two verbatim copies of the antimeridian and pole clipping rules with nothing keeping them in sync; the copy without callers is deleted, and the survivor is now covered bytests/hex_utils_test.py- it previously had no direct tests at all.scripts/configs.pyno longer declaresMAX_LAT/MAX_LNGas a second pair of names fortimezonefinder.configs's constantsprototypes/has aREADME.mdsaying what the three scripts there are: exploratory studies behind committed design decisions, run by hand, outside the package and the test suite. One of them is the measurement that chose H3 resolution 3 - the central algorithmic parameter of the package, already cited from the data format page - and another is the evidence for not building a hierarchical index.MANIFEST.innow excludes the whole directory from the source distribution rather than only its*.pyfilesplans/is git-ignored alongsidetmp/and.venv/: implementation plans written while working on a change are local scratch, and leaving the directory untracked-but-unignored made it noise in everygit statusand a candidate for an over-broadgit addtests/auxiliaries.py'srun_commandassembled the child's stdout and stderr into a message and then raised a freshCalledProcessErrorthat never used it, withfrom Nonediscarding the original too, so a packaging failure undermake testintreported an exit code and nothing about the cause; it now echoes the captured streams and re-raises the original exception with its traceback intact.scripts/reporting.pypasses the coordinate file paths intoget_polygon_collection, whose optionalfile_pathexists precisely so an incompatible-layoutValueErrorcan say which of the two files was stale -make reportsagainst an outdated data directory previously could not.Boundaries.overlapsnames the type it rejected instead of raising a bareTypeError, and theRuntimeErrorfor missingoriginal_polygonsnames the polygon and resolution it was computing. The two re-raises ruff flags underB904now sayfrom Noneexplicitly, so a deliberately dropped exception chain is distinguishable from a forgotten one, andtimezonefinder/command_line.pydropsFileNotFoundErrorfrom anexcepttuple that already caught its base classOSError.tests/test_error_diagnostics.pypins what each of these messages must containmainredirected stdout to amkstempfile for the duration of the lookup and then, in verbose mode, reopened it to read back a string it still held in a local variable - nothing inside the redirected block ever wrote to stdout, since the lookup functions return their result rather than printing it. The context manager, the read-back, its warning path and the file cleanup are gone, and the lookup function is now resolved once per invocation instead of twice, so-f 3/-f 4under-vno longer construct a secondTimezoneFinderLand reload its shortcut data just to read a function name. Output is unchanged character for character, across every function id in both modes.tests/cli_test.pygains the coverage that makes that checkable - verbose mode, the empty line printed when no timezone is found, and the rejected function id had none - and asserts the printed name verbatim instead of passing it throughrstrip("\n\x1b[0m"), which strips a set of characters rather than a suffix and so truncates 12 of the packaged zone names (Europe/Amsterdam->Europe/Amsterda)AbstractTimezoneFinder.__init__calledin_memoryinert and "kept for API compatibility" when it is what selects memory-mapped against in-memory coordinate access - the claimhelp(TimezoneFinder)surfaces, and the opposite of what the usage docs say; bothget_geometrydocstrings pointed at atimezone_names.jsonthat does not exist under that name;read_zone_namespromised an empty list where it raisesFileNotFoundError, and illustrated itself with a hardcoded zone count that the packaged data had since outgrown; andzone_id_of/zone_name_from_ideach advertised an exception type they convert away, sending callers to write handlers that can never fire. Five further:param:/Args:entries inscripts/andtests/documented arguments that were removed along with the parallel shortcut compilation they belonged to.tests/test_documented_contracts.pypins the exception types and the coordinate access mode, so those promises now rest on something besides prosepytest.raisesblocks intests/main_test.py, and execution leaves such a block at the first statement to raise - so one out-of-range coordinate, one positional call shape and one rejectedget_geometryinput were verified while the remaining fifteen were unreachable. Each is a test case of its own now: every coordinate just outside the WGS84 range, every positional call shape of every keyword-only lookup method, and the unknown-zone-name, past-the-end and negative zone id rejections ofget_geometry. The__del__cleanup test binds its exception per iteration rather than closing over the loop variable, which decided what a garbage-collected instance would raise long after the loop had moved on. On the benchmark side,pip_inputs_by_stratumvalidated only the strata the fixture happened to contain, so one missing from it altogether passed and surfaced later as a bareKeyErrorinside a benchmark, and the points and their labels were paired from two files with a non-strictzipthat truncates silently. That grouping now lives intests/auxiliaries.pyasgroup_pip_inputs_by_stratum, checks against the declaredPIP_STRATA- which the generator no longer keeps a second copy of - and has tests for each way the two fixture files can disagreeuv sync --all-groups) makes it - so the C extension was reached only by direct-kernel tests on hand-built arrays, and everything about how real polygon buffers arrive at it, including the read-only memory-mapped views, was first exercised in CI's non-numba tox environments: the configuration a plainpip install timezonefinderproduces.tests/test_acceleration_paths.pynow rebindsutils.inside_polygonand drives the full lookup stack through both implementations, asserting that they agree across the real boundary data, that the C path returns the known-correct answers, and that the point-in-polygon stage was reached at all rather than short-circuited by the shortcut layer (issue #482)tests/test_package_contents.pyno longer names files that do not exist. It asserts that nothing in the built sdist and wheel matches a list of unwanted paths, which passes just as readily when a pattern matches nothing at all:.githublacked the trailing slash that directory patterns need,Agents.*stopped matching when the file was renamed toAGENTS.md, andreadthedocs.yamlnever matchedreadthedocs.yml- so the CI configuration and both of those files were unguarded while the suite stayed green. The patterns are corrected, the provider stubs,contributing/,.agents/,.claude/and.cursor/are covered to match whatMANIFEST.inexcludes, andtest_every_unwanted_pattern_matches_a_project_filenow fails on any hand-written pattern that matches no path in the checkout, so the next rename cannot silently disarm one. It carries theunitmarker rather than the module's former blanketintegrationmark, since it needs no build: a mistyped pattern surfaces inmake test..gitignorere-include lines (!…) are also no longer read as exclusions, which had produced one more parametrised case that could never fail. The converse direction is checked too:test_every_manifest_exclusion_is_guardedparses theexclude/recursive-exclude/prune/global-excludedirectives out ofMANIFEST.inand fails when one of them keeps a path out of the build that no pattern here names - previously such a line was enforced by the build and verified by nothing, so deleting it would have shipped the file with the suite still green. The two lists are hand-maintained statements of one intent and had drifted before, in both directions. Thearchitecture page <https://timezonefinder.readthedocs.io/en/latest/architecture.html>__ describes the guard from both sides: among the tests that exist to give an invariant a failure mode, and under How it ships as the check on what the built artifacts actually containuv buildwas invoked without--python, so it targeted the newest interpreter on the machine, whiletests/test_integration.pycreates its throwaway venv fromsys.executable: on a checkout whose.venvis older than the newest installed Python,make testintproduced acp314wheel and failed with pip's "not a supported wheel on this platform". Every tox environment offers a single interpreter, so the two agreed by accident in CI and the mismatch only ever hit developer machines, where the workaround was to pinUV_PYTHON.test_build_commands_pin_the_running_interpreterkeeps the pin in place; it needs no build, so it fails inmake testrather than waiting on a CI environment that cannot reproduce the mismatchnp.seterrand the warning filters are process-global, andtest_overflow(tests/main_test.py) plustest_inside_polygon(tests/utils_test.py, six parametrisations) each set them and never restored them - so every later test in the same process ran withunderpromoted fromignoretowarn, and which of the two modules pytest collected first decided the state the other ran under. The filters were undone only incidentally, by pytest's per-testcatch_warnings(), not by the tests themselves.benchmarks/conftest.pyalready had the correct pattern; it now lives intests/auxiliaries.pyas thestrict_numpy_errorscontext manager plus a thinstrict_numpy_warningsfixture, re-exported through the conftest of each suite, and both call sites request it. The context manager form is what makes the restore directly testable - a leaked global otherwise surfaces only as an unrelated later failure that depends on collection order, which is the hardest kind to attributescripts/timezone_data.pyare each enforced in exactly one place, and now have tests.ZoneCollection.validate_structureandzone_positionseach walkedpoly_zone_idselement by element checking it was non-decreasing and each raised the same message built from its own locals; the scan moves into one_validate_non_decreasinghelper andzone_positionsdrops its copy, which could only ever have fired if a caller mutated the array in place - the validator runs at construction and nothing writes to it afterwards. Aif min_zone_id < 0branch is deleted as unreachable: the same method rejects any non-unsigned dtype a dozen lines earlier, so it read as the guard against negative zone ids while being incapable of firing. The class had no tests at all, so what it actually promises - the unsigned-dtype rejection that makes a negative id unrepresentable, the ordering and maximum-id rules, and the shapezone_positionsreturns - is now pinned bytests/timezone_data_test.pytests/locations.pyinstead of verbatim in bothtests/main_test.pyandtests/utils_test.py, where only one copy carried the comment explaining what makes them interesting and adding a corner to it left the other testing a smaller setscripts/shortcuts.pyis annotated for what it is actually passed. Both annotations were the wrong way round:check_shortcut_sortingdeclarednp.ndarrayand only ever receives thelist[int]thatoptimise_shortcut_orderingreturns, and it hands thenp.ndarrayit derives tohas_coherent_sequences(lst: list[int]). Widened rather than swapped, sincetests/shortcut_test.pycalls the latter with real listsrequires-pythonand one classifier per minor version inpyproject.toml, thepy{...}factors oftox.ini's envlist, the test matrix andCIBW_BUILD_VERSIONSinbuild.yml, andpy_limited_apiinsetup.py- and two "must match" comments said so while nothing enforced them.tests/test_python_version_support.pyfails when they drift, in either of the two directions that fail silently: a classifier added without a matrix entry ships a version the package claims to support and CI never runs, and arequires-pythonraised without moving the abi3 base builds wheels tagged for an interpreter that is no longer supported. Each assertion was checked against the specific one-sided edit it targets, and both comments now name the testcalculate_shortcut_index_statstook the number of H3 cells existing at the shortcut resolution from a ladder of literals covering resolutions 0 to 4 and fell through, for anything else, to the number of cells actually stored - which reports coverage of exactly 100 % instead of failing - behind anexcept ImportErrorthat cannot fire, since h3 is a runtime dependency rather than an optional one. It asksh3.get_num_cells, which returns precisely the numbers that were tabulated. Running mypy overscripts/reporting.py, which the pre-commit hook excludes, found seventeen further disagreements between the module and its own signatures: the statistics bag was typed as holding scalars while returning two distributions,load_binary_data's nine-key result was a baredictindexed by string literal, the table renderer declared string rows while stringifying whatever it is handed,mainwas annotatedNonewhile returning exit codes toexit(), andprint_polygon_distribution_tabledocumented a return value it never produced while its one caller discarded it. The two dict results are nowTypedDict\ s inscripts/configs.py, carrying tests that assert their keys against what is really returned, since CI cannot type-checkscripts/. The polygon count that labels a distribution row is no longer formatted into that label and parsed back out of it to key the example lookup.docs/data_report.rstand the benchmark reports regenerate byte-identically throughoutscripts/utils.pyand theimport picklethey kept alive, thei8dtype shim intimezonefinder/_numba_replacements.pythat the no-numba fallback never imports, and a test helper self-documented as kept for future reference - and a guard inscripts/hex_utils.pythat could not fire.Hex.poly_candidatesre-read its cache after initialising it and returned an empty set if it were still unset, which no path through_init_candidatesleaves it: an empty set there means "no candidate polygons", so a converter bug would have surfaced as silently missing shortcuts rather than as a failure. The property had no direct test, being reached only through shortcut generation, and now has one._memory_mode_labellooks its two labels up inPARAM_LABELSinstead of spelling them out, so renaming the display vocabulary can no longer leave the comparison bullets and the tables above them disagreeingmake parseandmake testparserun again. Both invokedscripts/file_converter.pyby path, which putsscripts/onsys.path[0]instead of the repository root, so the converter's ownfrom scripts.timezone_data import ...raisedModuleNotFoundErrorbefore any work started - a total failure that CI never sees, since it runs neither target.make testparseis the only cheap end-to-end exercise of the converter (update_data.shneeds a ~55 MB download), and nothing undertests/coversparse_data(), so while it was broken the converter had no smoke test at all. The invocation documented in the usage docs had the same defect and is now thepython -m scripts.file_converterform thatupdate_data.shalready used;tests/test_script_invocations.pyfails if a by-path invocation returns. Note thatparse_data()writes its report to the checkout's committeddocs/data_report.rstwhatever-outit is given, somake testparseleaves that file describing the three-zone fixture - the target now says soscripts/is type-checked by the mypy pre-commit hook instead of being excluded from it. The directory holds the data converter and the benchmark tooling - most of the repository's non-library Python - and with nothing running mypy over it the annotations had drifted to fifteen errors: two# type: ignorecodes mypy no longer emits, so the ignore silenced nothing; two implicitOptionaldefaults thatno_implicit_optional = truewas already configured to reject; a dict annotated with a narrower value type than it is assigned; a bucket key and four bounding-box lists annotatedintwhileBoundariesdeclaresfloat; and two missing variable annotations. All fixed as annotations, with no runtime change. Two of the four errors mypy reported intests/auxiliaries.py, which it reaches by following imports out ofscripts/, are fixed alongside.test_scripts_are_type_checked_by_the_hookguards the exclude, which is a quieter way to stop type-checking a directory than theignore_errorslist the neighbouring tests already cover: it takes no override entry and reports nothing__del__cleanup tests that differed only in which exceptioncleanup()raised, and whether zero or oneResourceWarningwas expected, are two parametrized tests over the suppressed and warned exception tuples. Each previously repeated the same subclass, the samecatch_warningsblock and the same filter, so adding a ninth exception to__del__'s suppression list meant copying the block a ninth time and a copy asserting the wrong count would be invisible. Coverage rises rather than falls: the hand-rolled loop asserting that__del__never raises to user code now runs over all six exception types instead of fourhas_coherent_sequencesbuilt an iterator solely to take its first element and then looped from the start anyway (correct, but it reads as an off-by-one),compile_bboxesunpacked a pair and immediately reassigned half of it, andprocess_single_hexreturned thehex_idit was handed so its only caller reassigned the loop variable to itself. Two shadowed builtins (diras a loop variable,idas a parameter) are renamed and three bare generator signatures annotated. The benchmark renderer classifies its "other" group by name suffix, as the two lines above it do, rather than by deep-equality scan over lists of dicts; and thecheck-manifestignore list drops two entries naming files that do not exist (CONTRIBUTING.rst,publish.py). Every converter change was verified by parsingtests/test_input.jsonbefore and after and comparing the outputs byte for bytetwilio/twilio-python (twilio)
v9.11.1Compare Source
Library - Fix
Audiences
2026-09-01
FetchCohortSnapshotoperation.2026-08-26
/preview/Audiences(AdminListAudiences)/preview/Audiences/{audienceId}(AdminGetAudience)/preview/Snapshots(AdminListSnapshots)/preview/Snapshots/{snapshotId}(AdminGetSnapshot)/preview/Operations/{operationId}(AdminGetOperation)2026-08-25
2026-08-24
/preview/Snapshots/{cohortSnapshotId}/Operations(AdminListSnapshotOperations)/preview/Snapshots/{snapshotId}/Operations(ListAdminSnapshotOperations)2026-08-20
AdminGetCohort->FetchAdminCohort) to meet standard.infolibraryVisibilitytohiddento exclude this admin spec from generation.pageSize/pageTokenquery parameters toListAdminSnapshotOperations, the only list operation missing them.2026-08-19
/preview/Cohorts(AdminListCohorts)/preview/Cohorts/{cohortId}(AdminGetCohort)/preview/CohortSnapshots(AdminListCohortSnapshots)/preview/CohortSnapshots/{cohortSnapshotId}(AdminGetCohortSnapshot)/preview/CohortOperations/{cohortOperationId}(AdminGetCohortOperation)2026-09-01
Get*operations toFetch*to match the operationId standard:FetchCohort,FetchCohortSnapshot,FetchCohortOperation. The transpiler skips operations whose operationId does not start with a standard keyword, which had been dropping all three from generated output.libraryVisibilitytoprivate(washidden) so the spec is eligible for the private docs pipeline.2026-08-28
/preview/Audiences(ListAudiences, CreateAudience)/preview/Audiences/{audienceId}(FetchAudience, UpdateAudience, DeleteAudience)/preview/Snapshots(ListSnapshots, CreateSnapshot)/preview/Snapshots/{snapshotId}(FetchSnapshot, DeleteSnapshot)/preview/Snapshots/{snapshotId}/Profiles(ListSnapshotProfiles)/preview/Operations/{operationId}(FetchOperation)2026-08-20
Get*operations toFetch*to match the operationId standard./preview/Operations/{operationId}.Conversations
VIDEOto the Conversations v2 Communication channel enum.Data-ingress
API Changes
2026-09-01
2026-08-12
2026-08-12
Destinations
2026-09-08
prod-ie1tosupportedRealmsandiamOperationEnabledRealmsfor all endpoints2026-09-01
admin-apiplaceholder fromsupportedRealmson the public endpoints;admin_openapi.yaml./v1/ControlPlane/Destinations(AdminListDestinations)/v1/ControlPlane/Destinations/{destinationId}(AdminGetDestination)/v1/ControlPlane/Subscriptions(AdminListSubscriptions)/v1/ControlPlane/Subscriptions/{subscriptionId}(AdminGetSubscription)/v1/ControlPlane/Subscriptions/{subscriptionId}/EventTypes(AdminListSubscribedEvents)/v1/ControlPlane/Subscriptions/{subscriptionId}/EventTypes/{eventType}(AdminGetSubscribedEvent)2026-08-26
2026-08-26
2026-08-25
CreateDestination2026-08-12
2026-08-12
DestinationType: releaseStatusDestinationType: maturityEmail
API Changes
2026-09-02
/v1/Sends/Cohorts(sendCohort)2026-08-28
sendTransactionalsendTransactional: X-Twilio-VersionSuppressionsGroupSuppressionsGroup: typeSuppressionsGroup: modeSuppressionsGlobalSuppressionsGlobal: typeSuppressionsGlobal: modeSuppressionsLongRunningOperationResponse2026-08-27
SendEmailSendEmail: Content-Encoding, Idempotency-KeyEnvelopeSuppressionsGroupSuppressionsGlobalIam
Instrumentation
API Changes
2026-09-04
IdempotencyKeyHeaderto Create/Patch/DeleteAutoInstrumentationRule; corrected the shared header's descriptionoperationId/createdAttoLongRunningOperationResponse; corrected examplestatusfromRUNNINGtoPENDINGSignal.timestamp→occurredAt,HourlyStats.hourTimestamp→hourAt; uppercasedSignal.typeandListSignals'signalTypeenums to SCREAMING_SNAKE_CASEUserBehaviorsrequest/response fields to camelCase; added thesummaryDeliverywebhook callbackPaginationMeta(added requiredkey, correctedpageSizebounds) and all 6 list operations (ListEventSources,ListEventSourceDatasets,ListEventSchemas,ListAutoInstrumentationRules,ListSignals,ListSignalStats) to themetaenvelope; addedListSignalStats'500responsesupportedRealmstodev-us1only;POST /v1/UserBehaviors(AnalyzeUserBehaviors) keeps its owndev-us1/stage-us1override (prod withheld pending stage validation) — every other operation is now dev-only2026-08-31
tdi_TTID prefix throughout (path params, examples, transaction URLs) toevents_; unified dataset/schema ID formats (tdi_dat_/tdi_dataset_→events_dataset_,tdi_schema_→events_evsch_); fixed rule-version examples to match the realversion: integerfieldoperationIdto use the domain-agnosticproc_job_TTID prefix; corrected theOperationIdparameter's length constraint (max=34→max=35) and added apatterntdi_prefix length:IngestEventBatch'ssourceIdpath parameter (maxLength37 → 40); removed the stale, redundantTwilio-Write-Keyheader parameterAutoInstrumentationRuleIdregexpatterninfo.title("Twilio Data Ingress - Instrumentation API" → "Events Domain - Instrumentation API")/v1/UserBehaviors(AnalyzeUserBehaviors)2026-07-28
/v1/ControlPlane/…):/v1/ControlPlane/EventSources(CreateEventSource, ListEventSources)/v1/ControlPlane/EventSources/{sourceId}(FetchEventSource, PatchEventSource, DeleteEventSource)/v1/ControlPlane/EventSources/{sourceId}/WriteKeys(CreateWriteKey, ListWriteKeys)/v1/ControlPlane/EventSources/{sourceId}/WriteKeys/{writeKey}(DeleteWriteKey)/v1/ControlPlane/EventSources/{sourceId}/Datasets(CreateEventSourceDataset, ListEventSourceDatasets)/v1/ControlPlane/EventSources/{sourceId}/Datasets/{datasetId}(FetchEventSourceDataset, PatchEventSourceDataset, DeleteEventSourceDataset)/v1/ControlPlane/EventSources/{sourceId}/EventSchemas(CreateEventSchema, ListEventSchemas)/v1/ControlPlane/EventSources/{sourceId}/EventSchemas/{schemaId}(FetchEventSchema, PatchEventSchema, DeleteEventSchema)/v1/ControlPlane/EventSources/{sourceId}/AutoInstrumentationRules(CreateAutoInstrumentationRule, ListAutoInstrumentationRules)/v1/ControlPlane/EventSources/{sourceId}/AutoInstrumentationRules/{autoInstrumentationRuleId}(FetchAutoInstrumentationRule, PatchAutoInstrumentationRule, DeleteAutoInstrumentationRule)/v1/ControlPlane/EventSources/{sourceId}/AutoInstrumentationRules/{autoInstrumentationRuleId}/Versions(ListAutoInstrumentationRuleVersions)/v1/ControlPlane/EventSources/{sourceId}/AutoInstrumentationRules/{autoInstrumentationRuleId}/Versions/{version}(FetchAutoInstrumentationRuleVersion)/v1/ControlPlane/Datasets(ListDatasets)/v1/ControlPlane/Datasets/{datasetId}(FetchDataset)/v1/ControlPlane/Operations/{operationId}(FetchControlPlaneOperationStatus)/v1/ControlPlane/Datasets(ListDatasets)/v1/ControlPlane/Datasets/{datasetId}(FetchDataset)/v1/EventSources/…):/v1/EventSources/{sourceId}/Batch(IngestEventBatch)/v1/EventSources/{sourceId}/AutoInstrumentationRules/{autoInstrumentationRuleId}/Preview(TriggerAutoInstrumentationPreview)/v1/EventSources/{sourceId}/AutoInstrumentationRules/{autoInstrumentationRuleId}/Preview/{operationId}(GetAutoInstrumentationPreviewResult)/v1/EventSources/…):/v1/EventSources/{sourceId}/Signals(IngestSignals, ListSignals)/v1/EventSources/{sourceId}/Signals/{signalKey}(GetSignalBySignalKey)/v1/EventSources/{sourceId}/SignalStats(ListSignalStats)Knowledge
2026-07-20
KnowledgeErrorInstance,KnowledgeErrorGrouperrorsfield toWebSourceDetailsfor reporting web crawl errorsMemory
2026-08-18
CSVandDATASETvalues from theDataMappingTypeenum.INGRESS,DATASET_CLOUDAPP, andDATASET_WAREHOUSEare the only valid values now.DataMappingFromCSVandDataMappingFromDataSetschemas and theironeOf/discriminator entries onDataMappingFromTypes, along with the correspondingCSV/DATASETdiscriminator mapping keys.type: CSVortype: DATASETonAdminListDataMappings2026-08-10
DataMappingTypegainsINGRESS,DATASET_CLOUDAPP, andDATASET_WAREHOUSE.CSVandDATASETremain valid and unchanged; they are deprecated aliases andDataMappingFromTypesgains threeoneOfmembers and three discriminator keys:DataMappingFromIngress(renamesDataMappingFromCSV),DataMappingFromCloudAppDataSetandDataMappingFromWarehouseDataSetDataMappingFromDataSet, distinguishing a cloud-app-backedCSVandDATASETpayloads are2026-08-27
/v1/ControlPlane/TraitExtractionStrategies(ListTraitExtractionStrategies, CreateTraitExtractionStrategy)/v1/ControlPlane/TraitExtractionStrategies/{traitStrategyId}(FetchTraitExtractionStrategy, UpdateTraitExtractionStrategy, DeleteTraitExtractionStrategy)2026-08-18
CSVandDATASETvalues from theDataMappingTypeenum.INGRESS,DATASET_CLOUDAPP, andDATASET_WAREHOUSEare the only valid values now.DataMappingFromCSVandDataMappingFromDataSetschemas and theironeOf/discriminator entries onDataMappingFromTypes, along with the correspondingCSV/DATASETdiscriminator mapping keys.type: CSVortype: DATASETonCreateDataMappingorUpdateDataMapping(or filteringListDataMappings/ListDataMappingSuggestionsby2026-08-10
DataMappingTypegainsINGRESS,DATASET_CLOUDAPP, andDATASET_WAREHOUSE.CSVandDATASETremain valid and unchanged; they are deprecated aliases andDataMappingFromTypesgains threeoneOfmembers and three discriminator keys:DataMappingFromIngress(renamesDataMappingFromCSV),DataMappingFromCloudAppDataSetandDataMappingFromWarehouseDataSetDataMappingFromDataSet, distinguishing a cloud-app-backedCSVandDATASETpayloads areMessaging
/v1/Channels/WhatsApp/Senders) from RestProxy; the sender was routed to the sunsettingmessaging-whatsapp-k8s-orchdownstream. Use the Senders v2 API (/v2/Channels/Senders) instead.Verify
Templatesoptional parameter on Verification creation (a stringified JSON array ofsid/substitutionsentries). When provided,Templatestakes precedence overTemplateSid.Voice
2026-09-03
links.conversationto Transcription resources as the absolute Conversations API URL for theconversationId. It is present once the transcript has been stored; thelinksobject2026-09-01
mediaUrlfromCreateRequestWithMediaUrl's required fields so a request with neithersourceIdnormediaUrlreaches the downstream service, which rejects it with the specific error code 17500 instead of a generic gateway 400additionalProperties: falseon bothCreateRequestWithSourceIdandCreateRequestWithMediaUrlso the twooneOfvariants stay mutually exclusive:sourceIdis undeclared on the media-URL variant andmediaUrlis undeclared on the source-ID variant, keeping every request shape resolvable to exactly one variant2026-08-05
Webhooks
API Changes
2026-08-24
v9.11.0Compare Source
Library - Fix
Twiml
<Assistant>noun from<Connect>verb as part of the AI Assistants deprecation (breaking change)passportsattribute to<Dial>verb for SHAKEN/STIR passport passthroughAccounts
SuppressEmailNotificationparameter to the Secondary Auth Token and Auth Token promotion endpoints. Set it totrueto suppress the email notification sent to account owners and administrators. Defaults tofalse, preserving existing behavior.Ai
Api
uriproperty to thetwiml_sessionresourceData-ingress
2026-08-07
/v1/DataQuery(Realtime DataQuery)2026-07-07
/v1/DataQuery(Realtime DataQuery)2026-06-17
OAuthJWTBearerCredentials: privateKey, privateKeyPassphrase2026-06-12
/v1/DataSyncs/{syncId}(FetchDataSync)/v1/CloudAppSources/{sourceId}/Objects(ListCloudAppObjects)/v1/WarehouseSources/{sourceId}/Preview(CreateWarehousePreview)/v1/WarehouseSources/{sourceId}/Preview/{operationId}(FetchWarehousePreview)/v1/DataSample/{operationId}(FetchDataSample)/v1/ControlPlane/CloudAppSources/{sourceId}(FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)/v1/ControlPlane/CloudAppSources/{sourceId}/Datasets(ListCloudAppDatasets, CreateCloudAppDataset)/v1/ControlPlane/CloudAppSources/{sourceId}/Datasets/{datasetId}(FetchCloudAppDataset, PatchCloudAppDataset, DeleteCloudAppDataset)/v1/ControlPlane/WarehouseSources/{sourceId}(FetchWarehouseSource, PatchWarehouseSource, DeleteWarehouseSource)/v1/ControlPlane/WarehouseSources/{sourceId}/Datasets(ListWarehouseDatasets, CreateWarehouseDataset)/v1/DataSyncs/{SyncId}(FetchDataSync)/v1/CloudAppSources/{SourceId}/Objects(ListCloudAppObjects)/v1/WarehouseSources/{SourceId}/Preview(CreateWarehousePreview)/v1/WarehouseSources/{SourceId}/Preview/{OperationId}(FetchWarehousePreview)/v1/DataSample/{OperationId}(FetchDataSample)/v1/ControlPlane/CloudAppSources/{SourceId}(FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)/v1/ControlPlane/CloudAppSources/{SourceId}/Datasets(ListCloudAppDatasets, CreateCloudAppDataset)/v1/ControlPlane/CloudAppSources/{SourceId}/Datasets/{DatasetId}(FetchCloudAppDataset, PatchCloudAppDataset, DeleteCloudAppDataset)/v1/ControlPlane/WarehouseSources/{SourceId}(FetchWarehouseSource, PatchWarehouseSource, DeleteWarehouseSource)/v1/ControlPlane/WarehouseSources/{SourceId}/Datasets(ListWarehouseDatasets, CreateWarehouseDataset)2026-06-11
/v1/EventSources/{sourceId}/Signals(ListSignals)/v1/EventSources/{sourceId}/Signals/{signalKey}(GetSignalBySignalKey)/v1/EventSources/{sourceId}/SignalStats(ListSignalStats)2026-05-26
/v1/ControlPlane/EventSources(CreateEventSource, ListEventSources)/v1/ControlPlane/EventSources/{SourceId}(FetchEventSource, PatchEventSource, DeleteEventSource)/v1/ControlPlane/EventSources/{SourceId}/WriteKeys(CreateWriteKey, ListWriteKeys)/v1/ControlPlane/EventSources/{SourceId}/WriteKeys/{WriteKey}(DeleteWriteKey)/v1/ControlPlane/EventSources/{SourceId}/Datasets(CreateEventSourceDataset, ListEventSourceDatasets)/v1/ControlPlane/EventSources/{SourceId}/Datasets/{DatasetId}(FetchEventSourceDataset, PatchEventSourceDataset, DeleteEventSourceDataset)/v1/ControlPlane/EventSources/{SourceId}/EventSchemas(CreateEventSchema, ListEventSchemas)/v1/ControlPlane/EventSources/{SourceId}/EventSchemas/{SchemaId}(FetchEventSchema, PatchEventSchema, DeleteEventSchema)/v1/ControlPlane/AutoInstrumentationRule(CreateAutoInstrumentationRule, ListAutoInstrumentationRules)/v1/ControlPlane/AutoInstrumentationRule/{AutoInstrumentationRuleId}(FetchAutoInstrumentationRule, PatchAutoInstrumentationRule, DeleteAutoInstrumentationRule)/v1/ControlPlane/AutoInstrumentationRule/{AutoInstrumentationRuleId}/Versions(ListAutoInstrumentationRuleVersions)/v1/ControlPlane/AutoInstrumentationRule/{AutoInstrumentationRuleId}/Versions/{Version}(FetchAutoInstrumentationRuleVersion)2026-06-12
/v1/DataSyncs/{syncId}(FetchDataSync)/v1/CloudAppSources/{sourceId}/Objects(ListCloudAppObjects)/v1/WarehouseSources/{sourceId}/Preview(CreateWarehousePreview)/v1/WarehouseSources/{sourceId}/Preview/{operationId}(FetchWarehousePreview)/v1/DataSample/{operationId}(FetchDataSample)/v1/ControlPlane/CloudAppSources/{sourceId}(FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)/v1/ControlPlane/CloudAppSources/{sourceId}/Datasets(ListCloudAppDatasets, CreateCloudAppDataset)/v1/ControlPlane/CloudAppSources/{sourceId}/Datasets/{datasetId}(FetchCloudAppDataset, PatchCloudAppDataset, DeleteCloudAppDataset)/v1/ControlPlane/WarehouseSources/{sourceId}(FetchWarehouseSource, PatchWarehouseSource, DeleteWarehouseSource)/v1/ControlPlane/WarehouseSources/{sourceId}/Datasets(ListWarehouseDatasets, CreateWarehouseDataset)/v1/DataSyncs/{SyncId}(FetchDataSync)/v1/CloudAppSources/{SourceId}/Objects(ListCloudAppObjects)/v1/WarehouseSources/{SourceId}/Preview(CreateWarehousePreview)/v1/WarehouseSources/{SourceId}/Preview/{OperationId}(FetchWarehousePreview)/v1/DataSample/{OperationId}(FetchDataSample)/v1/ControlPlane/CloudAppSources/{SourceId}(FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)/v1/ControlPlane/CloudAppSources/{SourceId}/Datasets(ListCloudAppDatasets, CreateCloudAppDataset)/v1/ControlPlane/CloudAppSources/{SourceId}/Datasets/{DatasetId}(FetchCloudAppDataset, PatchCloudAppDataset, DeleteCloudAppDataset)/v1/ControlPlane/WarehouseSources/{SourceId}(FetchWarehouseSource, PatchWarehouseSource, DeleteWarehouseSource)/v1/ControlPlane/WarehouseSources/{SourceId}/Datasets(ListWarehouseDatasets, CreateWarehouseDataset)Deletions
API Changes
2026-06-23
POST/GET /v1/UserDataDeletions,GET /v1/UserDataDeletions/{deletionId},GET /v1/Operations/{operationId}).Destinations
API Changes
2026-08-07
ListDestinationSupportedEventTypes2026-08-07
ListDestinationSupportedEventTypes2026-08-07
/v1/Catalog/DestinationSupportedEventTypes(ListDestinationSupportedEventTypes)/v1/ControlPlane/Subscriptions/{subscriptionId}/EventTypes(ListSubscribedEvents, CreateSubscribedEvent)/v1/ControlPlane/Subscriptions/{subscriptionId}/EventTypes/{eventType}(GetSubscribedEvent, UpdateSubscribedEvent, DeleteSubscribedEvent)/v1/ControlPlane/Subscriptions/{subscriptionId}/SubscribedEvents(ListSubscribedEvents, CreateSubscribedEvent)/v1/ControlPlane/Subscriptions/{subscriptionId}/SubscribedEvents/{eventType}(GetSubscribedEvent, UpdateSubscribedEvent, DeleteSubscribedEvent)/v1/Catalog/DestinationEventTypes(ListDestinationEventTypes)2026-08-04
2026-08-04
2026-08-04
2026-08-04
2026-08-04
SubscriptionResponse: eventTypes2026-08-03
DestinationType: documentationUrl, maturity, tier, categories2026-07-27
2026-07-23
metais now a required property in the response ofListDestinations,ListSubscriptions, andListSubscribedEventsCreateSubscribedEventrequest body schema consolidated ontoSubscribedEventInput(previouslySubscribedEventCreate, a duplicate schema)ListDestinations,ListSubscriptions, andListSubscribedEvents2026-07-23
/v1/Catalog/DestinationEventTypes(ListDestinationEventTypes)2026-07-22
ListDestinations: namePrefixUpdateSubscriptionSubscriptionUpdate: eventTypes2026-07-16
Events
stage-ie1realm support for EventTypes and Schemas endpoints (datataps-catalog)Memory
2026-08-10
Eventsendpoints from the spec, as they were hidden, never implemented, and are not part of the public API2026-08-07
pageSize,pageToken, andorderByquery parameters toListProfileImportsV2, plus ametaobject in its response, to support pagination.ListProfileImportsV2description to document the new pagination behavior.CreateProfilesImportV2to match the real S3 bucket naming convention.meta.keyexample onListProfileTraits's response (wasprofiles, nowtraits) to accurately describe which response field it points to.2026-08-07
matchingRulesdescription inIdentityResolutionSettingsCoreto remove compoundANDrule documentation2026-07-30
codefrom99999to9999992026-07-28
pageSizedescription on the paginationMetaschema to clarify it reflects the number of items actually returned, not the requested or default page size.2026-07-13
ListProfilesresponse schema references fromProfileID/ProfilesMetatoIdentityProfileID/IdentityProfilesMeta(newIdentityProfilesMetaschema added;ProfileID/ProfilesMetaretained for other operations).2026-07-08
CreateDataMappingSuggestionFetchDataMappingSuggestion2026-07-06
/v1/ControlPlane/Stores/{storeId}/DataMappings/Suggestions(ListDataMappingSuggestions, CreateDataMappingSuggestion)/v1/ControlPlane/Stores/{storeId}/DataMappings/Suggestions/{suggestionId}(FetchDataMappingSuggestion)2026-06-26
instancetolistfor all endpoints that don't end with a /{param}UpdateProfileTraitsUpdateProfileTraitsMappingTraitItem: fieldNameadditionalPropertiesfromallofschemas since it isn't supported and causes invalid lint errors on example blocks.2026-06-24
2026-05-01
UpdateProfileTraitsFetchIdentityResolutionSettingsMappingTraitItem: fieldNameoccurredAt,content, orsource2026-04-28
UpdateProfileTraitsUpdateProfileTraitsTraitDefinition: validationRuleMappingTraitItem: fieldNameMessaging_admin
/v1/Messaging/IntelligentAlertsEvents/*, routing to intelligent-alerts-api via messaging-monkey-backend. Account SID is a required query parameter (accountSid) on all three endpoints.Kludex/uvicorn (uvicorn)
v0.52.4: Version 0.52.4Compare Source
Fixed
Dateheaders from accepted WebSocket handshakes withwebsockets-sansio(#3078)Full Changelog: https://github.com/Kludex/uvicorn/compare/0.52.3...0.52.4
v0.52.3: Version 0.52.3Compare Source
Changed
zttpto 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)Full Changelog: https://github.com/Kludex/uvicorn/compare/0.52.2...0.52.3
v0.52.2: Version 0.52.2Compare Source
Fixed
zttpto 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)Full Changelog: https://github.com/Kludex/uvicorn/compare/0.52.1...0.52.2
v0.52.1: Version 0.52.1Compare Source
Fixed
websockets-sansioandwsprotoimplementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)websockets-sansioimplementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)Content-TypeandContent-Lengthheaders from WebSocket denial responses on thewebsockets-sansioimplementation, and deliver non-UTF-8 denial bodies intact (#3041)Full Changelog: https://github.com/Kludex/uvicorn/compare/0.52.0...0.52.1
v0.52.0: Version 0.52.0Compare Source
This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.
It is still experimental, so don't put it in front of production traffic yet. Try it with
--http zttp, and please send any feedback to the issue tracker.Added
zttpHTTP/1.1 implementation, selectable with--http zttp(#2979)Fixed
Full Changelog: https://github.com/Kludex/uvicorn/compare/0.51.0...0.52.0
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.
b0ec11f77707435a268207435a2682339b1c3c5d339b1c3c5d108a38839c108a38839c7d6f9b16467d6f9b16469b52093c8e9b52093c8e7e374cd9037e374cd903171edff1e9171edff1e9dad1a0e75cdad1a0e75cc1f8f671d2c1f8f671d272cd7c855272cd7c8552c91fdd4714c91fdd47143c5ed19d67View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.