Update all dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/checkout	action	major	v4 → v6
actions/download-artifact	action	major	v4 → v8
actions/setup-python	action	major	v4 → v6
actions/upload-artifact	action	major	v4 → v7
booleanOperations		minor	==0.9.0 → ==0.10.0
defcon		minor	==0.10.3 → ==0.12.2
fontMath		minor	==0.9.4 → ==0.10.0
github/codeql-action	action	major	v2 → v4
lxml (source, changelog)		major	==4.9.3 → ==6.0.2
pypa/cibuildwheel	action	major	v2.21.1 → v3.4.0
python	uses-with	minor	3.11 → 3.14
python	uses-with	minor	3.9 → 3.14
softprops/action-gh-release	action	major	v1 → v2
ufoProcessor		minor	==1.13.1 → ==1.14.1
ufonormalizer		patch	==0.6.2 → ==0.6.3

---

Release Notes

actions/checkout (actions/checkout)

v6

Compare Source

v5

Compare Source

actions/download-artifact (actions/download-artifact)

v8

Compare Source

v7

Compare Source

v6

Compare Source

v5

Compare Source

actions/setup-python (actions/setup-python)

v6

Compare Source

v5

Compare Source

actions/upload-artifact (actions/upload-artifact)

v7

Compare Source

v6

Compare Source

v5

Compare Source

typemytype/booleanOperations (booleanOperations)

v0.10.0

Compare Source

What's Changed

• Remove wheel from setup_requires by @​alerque in #​63
• Improved mergeFirstSegments handling by @​skef in #​67
• Correct for (rare) bad tracking of previousIntersectionPoint by @​skef in #​65
• Fix test compatibility with fonttools splitCubicAtT precision improvement by @​anthrotype in #​70
• Add GitHub Actions CI workflow by @​anthrotype in #​71

New Contributors

• @​alerque made their first contribution in #​63
• @​skef made their first contribution in #​67

Full Changelog: typemytype/booleanOperations@0.9.0...0.10.0

robotools/defcon (defcon)

v0.12.2

Compare Source

What's Changed

• simplify use of pyfilesystem2 API in test suite by @​anthrotype in #​468
• bump fonttools >= 4.59, remove fs dependency by @​anthrotype in #​469

Full Changelog: robotools/defcon@0.12.1...0.12.2

v0.12.1

Compare Source

What's Changed

• clear glyph.lib on glyph.clear by @​typemytype in #​463

Full Changelog: robotools/defcon@0.12.0...0.12.1

v0.12.0

Compare Source

What's Changed

• Loop over all possibilities and test if one of them is disabled by @​typemytype in #​462

Full Changelog: robotools/defcon@0.11.0...0.12.0

v0.11.0

Compare Source

What's Changed

• add .readthedocs.yaml by @​roberto-arista in #​451
• Remove some big memory attributes from all defcon objects on delete by @​typemytype in #​453
• Mark regex/docstring as raw to fix SyntaxWarning invalid escape seq by @​hosiet in #​455
• Remove a useless shebang line in a non-executable test script by @​musicinmybrain in #​456
• Remove guideline color key when setting color none by @​typemytype in #​457
• Update tested python versions by @​benkiel in #​459

New Contributors

• @​roberto-arista made their first contribution in #​451
• @​hosiet made their first contribution in #​455
• @​musicinmybrain made their first contribution in #​456
• @​dependabot made their first contribution in #​452

Full Changelog: robotools/defcon@0.10.3...0.11.0

robotools/fontMath (fontMath)

v0.10.0

Compare Source

What's Changed

• Use trusted publishing by @​madig in #​330
• Update fonttools to 4.60.2, drop Python 3.8 support @​benkiel in #​332

This version drops support for Python versions less than 3.9

Full Changelog: robotools/fontMath@0.9.4...0.10.0

github/codeql-action (github/codeql-action)

v4

Compare Source

v3

Compare Source

lxml/lxml (lxml)

v6.0.2

Compare Source

==================

Bugs fixed

• LP#2125278: Compilation with libxml2 2.15.0 failed.
  Original patch by Xi Ruoyao.

• Setting decompress=True in the parser had no effect in libxml2 2.15.

• Binary wheels on Linux and macOS use the library version libxml2 2.14.6.
  See https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.14.6

• Test failures in libxml2 2.15.0 were fixed.

Other changes

• Binary wheels for Py3.9-3.11 on the riscv64 architecture were added.

• Error constants were updated to match libxml2 2.15.0.

• Built using Cython 3.1.4.

v6.0.1

Compare Source

==================

Bugs fixed

• LP#2116333: lxml.sax._getNsTag() could fail with an exception on malformed input.

• GH#467: Some test adaptations were made for libxml2 2.15.
  Patch by Nick Wellnhofer.

• LP2119510, GH#473: A Python compatibility test was fixed for Python 3.14+.
  Patch by Lumír Balhar.

• GH#471: Wheels for "riscv64" on recent Python versions were added.
  Patch by ffgan.

• GH#469: The wheel build no longer requires the wheel package unconditionally.
  Patch by Miro Hrončok.

• Binary wheels use the library version libxml2 2.14.5.
  See https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.14.5

• Windows binary wheels continue to use a security patched library version libxml2 2.11.9.

v6.0.0

Compare Source

==================

Features added

• GH#463: lxml.html.diff is faster and provides structurally better diffs.
  Original patch by Steven Fernandez.

• GH#405: The factories Element and ElementTree can now be used in type hints.

• GH#448: Parsing from memoryview and other buffers is supported to allow zero-copy parsing.

• GH#437: lxml.html.builder was missing several HTML5 tag names.
  Patch by Nick Tarleton.

• GH#458: CDATA can now be written into the incremental xmlfile() writer.
  Original patch by Lane Shaw.

• A new parser option decompress=False was added that controls the automatic
  input decompression when using libxml2 2.15.0 or later. Disabling this option
  by default will effectively prevent decompression bombs when handling untrusted
  input. Code that depends on automatic decompression must enable this option.
  Note that libxml2 2.15.0 was not released yet, so this option currently has no
  effect but can already be used.

• The set of compile time / runtime supported libxml2 feature names is available as
  etree.LIBXML_COMPILED_FEATURES and etree.LIBXML_FEATURES.
  This currently includes
  catalog, ftp, html, http, iconv, icu,
  lzma, regexp, schematron, xmlschema, xpath, zlib.

Bugs fixed

• GH#353: Predicates in .find*() could mishandle tag indices if a default namespace is provided.
  Original patch by Luise K.

• GH#272: The head and body properties of lxml.html elements failed if no such element
  was found. They now return None instead.
  Original patch by FVolral.

• Tag names provided by code (API, not data) that are longer than INT_MAX
  could be truncated or mishandled in other ways.

• .text_content() on lxml.html elements accidentally returned a "smart string"
  without additional information. It now returns a plain string.

• LP#2109931: When building lxml with coverage reporting, it now disables the sys.monitoring
  support due to the lack of support in nedbat/coveragepy#1790

Other changes

• Support for Python < 3.8 was removed.

• Parsing directly from zlib (or lzma) compressed data is now considered an optional
  feature in lxml. It may get removed from libxml2 at some point for security reasons
  (compression bombs) and is therefore no longer guaranteed to be available in lxml.

  As of this release, zlib support is still normally available in the binary wheels
  but may get disabled or removed in later (x.y.0) releases. To test the availability,
  use "zlib" in etree.LIBXML_FEATURES.

• The Schematron class is deprecated and will become non-functional in a future lxml version.
  The feature will soon be removed from libxml2 and stop being available.

• GH#438: Wheels include the arm7l target.

• GH#465: Windows wheels include the arm64 target.
  Patch by Finn Womack.

• Binary wheels use the library versions libxml2 2.14.4 and libxslt 1.1.43.
  Note that this disables direct HTTP and FTP support for parsing from URLs.
  Use Python URL request tools instead (which usually also support HTTPS).
  To test the availability, use "http" in etree.LIBXML_FEATURES.

• Windows binary wheels use the library versions libxml2 2.11.9, libxslt 1.1.39 and libiconv 1.17.
  They are now based on VS-2022.

• Built using Cython 3.1.2.

• The debug methods MemDebug.dump() and MemDebug.show() were removed completely.
  libxml2 2.13.0 discarded this feature.

v5.4.0

Compare Source

==================

Bugs fixed

• LP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs.
  (Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.)
  Issue found by Anatoly Katyushin.

v5.3.2

Compare Source

==================

This release resolves CVE-2025-24928 as described in
https://gitlab.gnome.org/GNOME/libxml2/-/issues/847

Bugs fixed

• Binary wheels use libxml2 2.12.10 and libxslt 1.1.42.

• Binary wheels for Windows use a patched libxml2 2.11.9 and libxslt 1.1.39.

v5.3.1

Compare Source

==================

Bugs fixed

• GH#440: Some tests were adapted for libxml2 2.14.0.
  Patch by Nick Wellnhofer.

• LP#2097175: DTD(external_id="…") erroneously required a byte string as ID value.

• GH#450: iterparse() internally triggered the `DeprecationWarning`` added in lxml 5.3.0 when parsing HTML.

Other changes

• GH#442: Binary wheels for macOS no longer use the linker flag -flat_namespace.

v5.3.0

Compare Source

==================

Bugs fixed

• GH#440: Some tests were adapted for libxml2 2.14.0.
  Patch by Nick Wellnhofer.

• LP#2097175: DTD(external_id="…") erroneously required a byte string as ID value.

• GH#450: iterparse() internally triggered the `DeprecationWarning`` added in lxml 5.3.0 when parsing HTML.

Other changes

• GH#442: Binary wheels for macOS no longer use the linker flag -flat_namespace.

v5.2.2

Compare Source

==================

Bugs fixed

• GH#417: The test_feed_parser test could fail if lxml_html_clean was not installed.
  It is now skipped in that case.

• LP#2059910: The minimum CPU architecture for the Linux x86 binary wheels was set back to
  "core2", without SSE 4.2.

• If libxml2 uses iconv, the compile time version is available as etree.ICONV_COMPILED_VERSION.

v5.2.1

Compare Source

==================

Bugs fixed

• LP#2059910: The minimum CPU architecture for the Linux x86 binary wheels was set back to
  "core2", but with SSE 4.2 enabled.

• LP#2059977: Element.iterfind("//absolute_path") failed with a SyntaxError
  where it should have issued a warning.

• GH#416: The documentation build was using the non-standard which command.
  Patch by Michał Górny.

v5.2.0

Compare Source

==================

Other changes

• LP#1958539: The lxml.html.clean implementation suffered from several (only if used)
  security issues in the past and was now extracted into a separate library:

  https://github.com/fedora-python/lxml_html_clean

  Projects that use lxml without "lxml.html.clean" will not notice any difference,
  except that they won't have potentially vulnerable code installed.
  The module is available as an "extra" setuptools dependency "lxml[html_clean]",
  so that Projects that need "lxml.html.clean" will need to switch their requirements
  from "lxml" to "lxml[html_clean]", or install the new library themselves.

• The minimum CPU architecture for the Linux x86 binary wheels was upgraded to
  "sandybridge" (launched 2011), and glibc 2.28 / gcc 12 (manylinux_2_28) wheels were added.

• Built with Cython 3.0.10.

v5.1.1

Compare Source

==================

Bugs fixed

• LP#2048920: iterlinks() in lxml.html rejected bytes input in 5.1.0.

• High source line numbers from the parser are no longer truncated
  (up to a C long) when using libxml2 2.11 or later.

Other changes

• GH#407: A compatibility test was adapted to recent expat versions.
  Patch by Miro Hrončok.

• Binary wheels use the library versions libxml2 2.12.6 and libxslt 1.1.39.

• Windows binary wheels use the library versions libxml2 2.11.7 and libxslt 1.1.39.

• Built with Cython 3.0.9.

v5.1.0

Compare Source

==================

Bugs fixed

• LP#2048920: iterlinks() in lxml.html rejected bytes input in 5.1.0.

• High source line numbers from the parser are no longer truncated
  (up to a C long) when using libxml2 2.11 or later.

Other changes

• GH#407: A compatibility test was adapted to recent expat versions.
  Patch by Miro Hrončok.

• Binary wheels use the library versions libxml2 2.12.6 and libxslt 1.1.39.

• Windows binary wheels use the library versions libxml2 2.11.7 and libxslt 1.1.39.

• Built with Cython 3.0.9.

v5.0.2

Compare Source

==================

Other changes

• GH#407: A compatibility test was adapted to recent expat versions.
  Patch by Miro Hrončok.

• Binary wheels use the library versions libxml2 2.12.6 and libxslt 1.1.39.

• Built with Cython 3.0.9.

v5.0.1

Compare Source

==================

Bugs fixed

• LP#2046208: Parsing non-BMP Python Unicode strings could fail on macOS.

• LP#2044225: When incrementally parsing broken HTML, reporting start events on
  missing structural tags failed and could lead to subsequent exceptions.

• LP#2045435: Some (not all) issues with stricter C compilers were resolved.

• The binary wheels in the 5.0.0 release did not validate cleanly (but installed ok).

.. _latest_release:

v5.0.0

Compare Source

==================

Features added

• Character escaping in C14N2 serialisation now uses a single pass over the text
  instead of searching for each unescaped character separately.

• Early support for Python 3.13a2 was added.

Bugs fixed

• LP#1976304: The Element.addnext() method previously inserted the new element
  before existing tail text. The tail text of both sibling elements now stays on
  the respective elements.

• LP#1980767, GH#379: TreeBuilder.close() could fail with a TypeError after
  parsing incorrect input. Original patch by Enrico Minack.

• Element.itertext(with_tail=False) returned the tail text of comments and
  processing instructions, despite the explicit option.

• GH#370: A crash with recent libxml2 2.11.x versions was resolved.
  Patch by Michael Schlenker.

• A compile problem with recent libxml2 2.12.x versions was resolved.

• The internal exception handling in C callbacks was improved for Cython 3.0.

• The exception declarations of xmlInputReadCallback, xmlInputCloseCallback,
  xmlOutputWriteCallback and xmlOutputCloseCallback in tree.pxd were
  corrected to prevent running Python code or calling into the C-API with a live
  exception set.

• GH#385: The long deprecated unittest.m̀akeSuite() function is no longer used.
  Patch by Miro Hrončok.

• LP#1522052: A file-system specific test is now optional and should no longer fail
  on systems that don't support it.

• GH#392: Some tests were adapted for libxml2 2.13.
  Patch by Nick Wellnhofer.

• Contains all fixes from lxml 4.9.4.

Other changes

• LP#1742885: lxml no longer expands external entities (XXE) by default to prevent
  the security risk of loading arbitrary files and URLs. If this feature is needed,
  it can be enabled in a backwards compatible way by using a parser with the option
  resolve_entities=True. The new default is resolve_entities='internal'.

• With libxml2 2.10.4 and later (as provided by the lxml 5.0 binary wheels),
  parsing HTML tags with "prefixes" no longer builds a namespace dictionary
  in nsmap but considers the prefix:name string the actual tag name.
  With older libxml2 versions, since 2.9.11, the prefix was removed. Before
  that, the prefix was parsed as XML prefix.

  lxml 5.0 does not try to hide this difference but now changes the ElementPath
  implementation to let element.find("part1:part2") search for the tag
  part1:part2 in documents parsed as HTML, instead of looking only for part2.

• LP#2024343: The validation of the schema file itself is now optional in the
  ISO-Schematron implementation. This was done because some lxml distributions
  discard the RNG validation schema file due to licensing issues. The validation
  can now always be disabled with Schematron(..., validate_schema=False).
  It is enabled by default if available and disabled otherwise. The module
  constant lxml.isoschematron.schematron_schema_valid_supported can be used
  to detect whether schema file validation is available.

• Some redundant and long deprecated methods were removed:
  parser.setElementClassLookup(),
  xslt_transform.apply(),
  xpath.evaluate().

• Some incorrect declarations were removed from python.pxd. In general, this file
  should not be used by external Cython code. Use the C-API declarations provided by
  Cython itself instead.

• Binary wheels use the library versions libxml2 2.12.3 and libxslt 1.1.39.

• Built with Cython 3.0.7, updated to follow recent changes in Cython 3.1-dev.

v4.9.4

Compare Source

==================

Features added

• Character escaping in C14N2 serialisation now uses a single pass over the text
  instead of searching for each unescaped character separately.

• Early support for Python 3.13a2 was added.

Bugs fixed

• LP#1976304: The Element.addnext() method previously inserted the new element
  before existing tail text. The tail text of both sibling elements now stays on
  the respective elements.

• LP#1980767, GH#379: TreeBuilder.close() could fail with a TypeError after
  parsing incorrect input. Original patch by Enrico Minack.

• Element.itertext(with_tail=False) returned the tail text of comments and
  processing instructions, despite the explicit option.

• GH#370: A crash with recent libxml2 2.11.x versions was resolved.
  Patch by Michael Schlenker.

• A compile problem with recent libxml2 2.12.x versions was resolved.

• The internal exception handling in C callbacks was improved for Cython 3.0.

• The exception declarations of xmlInputReadCallback, xmlInputCloseCallback,
  xmlOutputWriteCallback and xmlOutputCloseCallback in tree.pxd were
  corrected to prevent running Python code or calling into the C-API with a live
  exception set.

• GH#385: The long deprecated unittest.m̀akeSuite() function is no longer used.
  Patch by Miro Hrončok.

• LP#1522052: A file-system specific test is now optional and should no longer fail
  on systems that don't support it.

• GH#392: Some tests were adapted for libxml2 2.13.
  Patch by Nick Wellnhofer.

• Contains all fixes from lxml 4.9.4.

Other changes

• LP#1742885: lxml no longer expands external entities (XXE) by default to prevent
  the security risk of loading arbitrary files and URLs. If this feature is needed,
  it can be enabled in a backwards compatible way by using a parser with the option
  resolve_entities=True. The new default is resolve_entities='internal'.

• With libxml2 2.10.4 and later (as provided by the lxml 5.0 binary wheels),
  parsing HTML tags with "prefixes" no longer builds a namespace dictionary
  in nsmap but considers the prefix:name string the actual tag name.
  With older libxml2 versions, since 2.9.11, the prefix was removed. Before
  that, the prefix was parsed as XML prefix.

  lxml 5.0 does not try to hide this difference but now changes the ElementPath
  implementation to let element.find("part1:part2") search for the tag
  part1:part2 in documents parsed as HTML, instead of looking only for part2.

• LP#2024343: The validation of the schema file itself is now optional in the
  ISO-Schematron implementation. This was done because some lxml distributions
  discard the RNG validation schema file due to licensing issues. The validation
  can now always be disabled with Schematron(..., validate_schema=False).
  It is enabled by default if available and disabled otherwise. The module
  constant lxml.isoschematron.schematron_schema_valid_supported can be used
  to detect whether schema file validation is available.

• Some redundant and long deprecated methods were removed:
  parser.setElementClassLookup(),
  xslt_transform.apply(),
  xpath.evaluate().

• Some incorrect declarations were removed from python.pxd. In general, this file
  should not be used by external Cython code. Use the C-API declarations provided by
  Cython itself instead.

• Binary wheels use the library versions libxml2 2.12.3 and libxslt 1.1.39.

• Built with Cython 3.0.7, updated to follow recent changes in Cython 3.1-dev.

pypa/cibuildwheel (pypa/cibuildwheel)

v3.4.0

Compare Source

• 🌟 You can now build wheels using uv as a build frontend. This should improve performance, especially if your project has lots of build dependencies. To use, set build-frontend to uv. (#​2322)
• ⚠️ We no longer support running on Travis CI. It may continue working but we don't run tests there anymore so we can't be sure. (#​2682)
• ✨ Improvements to building Rust wheels on Android (#​2650)
• 🐛 Fix bug with the GitHub Action on Windows, where PATH was getting unnecessarily changed, causing issues with meson builds. (#​2723)
• ✨ Add support for quiet setting on build and uv from the cibuildwheel build-verbosity setting. (#​2737)
• 📚 Docs updates, including guidance on using Meson on Windows (#​2718)

v3.3.1

Compare Source

• 🛠 Update dependencies and container pins, including updating to CPython 3.14.2. (#​2708)

v3.3.0

Compare Source

• 🐛 Fix an incompatibility with Docker v29 (#​2660)
• ✨ Adds test-runtime option, to customise how tests on simulated/emulated environments are run (#​2636)
• ✨ Adds support for new manylinux_2_35 images on 32-bit ARM armv7l, offering better C++20 compatibility (#​2656)
• ✨ build[uv] is now supported on Android (#​2587)
• ✨ You can now install extras (such as uv) with a simple option on the GitHub Action (#​2630)
• ✨ {project} and {package} placeholders are now supported in repair-wheel-command (#​2589)
• 🛠 The versions set with dependency-versions no longer constrain packages specified by your build-system.requires. Previously, on platforms other than Linux, the constraints in this option would remain in the environment during the build. This has been tidied up make behaviour more consistent between platforms, and to prevent version conflicts. (#​2583)
• 🛠 Improve the handling of test-command on Android, enabling more options to be passed (#​2590)
• 📚 Docs improvements (#​2618)

v3.2.1

Compare Source

• 🛠 Update to CPython 3.14.0 final (#​2614)
• 🐛 Fix the default MACOSX_DEPLOYMENT_TARGET on Python 3.14 (#​2613)
• 📚 Docs improvements (#​2617)

v3.2.0

Compare Source

• ✨ Adds GraalPy v25 (Python 3.12) support (#​2597)
• 🛠 Update to CPython 3.14.0rc3 (#​2602)
• 🛠 Adds CPython 3.14.0 prerelease support for Android, and a number of improvements to Android builds (#​2568, #​2591)
• 🛠 Improvements to testing on Android, passing environment markers when installing the venv, and providing more debug output when build-verbosity is set (#​2575)
• ⚠️ PyPy 3.10 was moved to pypy-eol in the enable option, as it is now end-of-life. (#​2521)
• 📚 Docs improvements (#​2574, #​2601, #​2598)

v3.1.4

Compare Source

• ✨ Add a --clean-cache command to clean up our cache (#​2489)
• 🛠 Update Python to 3.14rc2 and other patch version bumps (#​2542, #​2556)
• 🛠 Update Pyodide to 0.28.2 (#​2562, #​2558)
• 🐛 Fix resolution with pyodide-build when dependency-versions is set (#​2548)
• 🐛 Set CMAKE_FIND_ROOT_PATH_MODE_PACKAGE to BOTH on Android (#​2547)
• 🐛 Add patchelf dependency for platforms that can build Android wheels (#​2552)
• 🐛 Ignore empty values for CIBW_ARCHS like most other environment variables (#​2541)
• 💼 The color and suggest_on_error argparse options are now default in 3.14rc1+ (#​2554)
• 💼 Use the virtualenv release URL instead of blob URL (should be more robust) (#​2555)
• 🧪 For iOS, lowering to macos-14 is needed for now due to issues with GitHub's runner images (#​2557)
• 🧪 Split out platforms iOS and Android in our tests (#​2519)
• 🧪 Fix and enable doctests (#​2546)
• 📚 Improve our docs on free-threading (#​2549)

v3.1.3

Compare Source

• 🐛 Fix bug where "latest" dependencies couldn't update to pip 25.2 on Windows (#​2537)
• 🧪 Use pytest-rerunfailures to improve some of our iOS/Android tests (#​2527, #​2539)
• 🧪 Remove some GraalPy Windows workarounds in our tests (#​2501)

v3.1.2

Compare Source

• ⚠️ Add an error if CIBW_FREE_THREADING_SUPPORT is set; you are likely missing 3.13t wheels, please use the enable/CIBW_ENABLE (#​2520)
• 🛠 riscv64 now enabled if you target that architecture, it's now supported on PyPI (#​2509)
• 🛠 Add warning when using cpython-experimental-riscv64 (no longer needed) (#​2526, #​2528)
• 🛠 iOS versions bumped, fixing issues with 3.14 (now RC 1) (#​2530)
• 🐛 Fix bug in Android running wheel from our GitHub Action (#​2517)
• 🐛 Fix warning when using test-skip of "*-macosx_universal2:arm64" (#​2522)
• 🐛 Fix incorrect number of wheels reported in logs, again (#​2517)
• 📚 We welcome our Android platform maintainer (#​2516)

v3.1.1

Compare Source

• 🐛 Fix a bug showing an incorrect wheel count at the end of execution, and misrepresenting test-only runs in the GitHub Action summary (#​2512)
• 📚 Docs fix (#​2510)

v3.1.0

Compare Source

• 🌟 CPython 3.14 wheels are now built by default - without the "cpython-prerelease" enable set. It's time to build and upload these wheels to PyPI! This release includes CPython 3.14.0rc1, which is guaranteed to be ABI compatible with the final release. (#​2507) Free-threading is no longer experimental in 3.14, so you have to skip it explicitly with 'cp31?t-*' if you don't support it yet. (#​2503)
• 🌟 Adds the ability to build wheels for Android! Set the platform option to android on Linux or macOS to try it out! (#​2349)
• 🌟 Adds Pyodide 0.28, which builds 3.13 wheels (#​2487)
• ✨ Support for 32-bit manylinux_2_28 (now a consistent default) and manylinux_2_34 added (#​2500)
• 🛠 Improved summary, will also use markdown summary output on GHA (#​2469)
• 🛠 The riscv64 images now have a working default (as they are now part of pypy/manylinux), but are still experimental (and behind an enable) since you can't push them to PyPI yet (#​2506)
• 🛠 Fixed a typo in the 3.9 MUSL riscv64 identifier (cp39-musllinux_ricv64 -> cp39-musllinux_riscv64) (#​2490)
• 🛠 Mistyping --only now shows the correct possibilities, and even suggests near matches on Python 3.14+ (#​2499)
• 🛠 Only support one output from the repair step on linux like other platforms; auditwheel fixed this over four years ago! (#​2478)
• 💼 We now use pattern matching extensively (#​2434)
• 📚 We now have platform maintainers for our special platforms and interpreters! (#​2481)

v3.0.1

Compare Source

• 🛠 Updates CPython 3.14 prerelease to 3.14.0b3 (#​2471)
• ✨ Adds a CPython 3.14 prerelease iOS build (only when prerelease builds are enabled) (#​2475)

v3.0.0

Compare Source

See @​henryiii's release post for more info on new features!

• 🌟 Adds the ability to build wheels for iOS! Set the platform option to ios on a Mac with the iOS toolchain to try it out! (#​2286, #​2363, #​2432)

• 🌟 Adds support for the GraalPy interpreter! Enable for your project using the enable option. (#​1538, #​2411, #​2414)

• ✨ Adds CPython 3.14 support, under the enable option cpython-prerelease. This version of cibuildwheel uses 3.14.0b2. (#​2390)

  While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.14 will be available in cibuildwheel without the flag. (#​2390)

• ✨ Adds the test-sources option, and changes the working directory for tests. (#​2062, #​2284, #​2437)

  • If this option is set, cibuildwheel will copy the files and folders specified in test-sources into the temporary directory we run from. This is required for iOS builds, but also useful for other platforms, as it allows you to avoid placeholders.
  • If this option is not set, behaviour matches v2.x - cibuildwheel will run the tests from a temporary directory, and you can use the {project} placeholder in the test-command to refer to the project directory. (#​2420)

• ✨ Adds dependency-versions inline syntax (#​2122)

• ✨ Improves support for Pyodide builds and adds the experimental pyodide-version option, which allows you to specify the version of Pyodide to use for builds. (#​2002)

• ✨ Add pyodide-prerelease enable option, with an early build of 0.28 (Python 3.13). (#​2431)

• ✨ Adds the test-environment option, which allows you to set environment variables for the test command. (#​2388)

• ✨ Adds the xbuild-tools option, which allows you to specify tools safe for cross-compilation. Currently only used on iOS; will be useful for Android in the future. (#​2317)

• 🛠 The default manylinux image has changed from manylinux2014 to manylinux_2_28. (#​2330)

• 🛠 EOL images manylinux1, manylinux2010, manylinux_2_24 and musllinux_1_1 can no longer be specified by their shortname. The full OCI name can still be used for these images, if you wish. (#​2316)

• 🛠 Invokes build rather than pip wheel to build wheels by default. You can control this via the build-frontend option. You might notice that you can see your build log output now! (#​2321)

• 🛠 Build verbosity settings have been reworked to have consistent meanings between build backends when non-zero. (#​2339)

• 🛠 Removed the CIBW_PRERELEASE_PYTHONS and CIBW_FREE_THREADED_SUPPORT options - these have been folded into the enable option instead. (#​2095)

• 🛠 Build environments no longer have setuptools and wheel preinstalled. (#​2329)

• 🛠 Use the standard Schema line for the integrated JSONSchema. (#​2433)

• ⚠️ Dropped support for building Python 3.6 and 3.7 wheels. If you need to build wheels for these versions, use cibuildwheel v2.23.3 or earlier. (#​2282)

• ⚠️ The minimum Python version required to run cibuildwheel is now Python 3.11. You can still build wheels for Python 3.8 and newer. (#​1912)

• ⚠️ 32-bit Linux wheels no longer built by default - the arch was removed from "auto". It now requires explicit "auto32". Note that modern manylinux images (like the new default, manylinux_2_28) do not have 32-bit versions. (#​2458)

• ⚠️ PyPy wheels no longer built by default, due to a change to our options system. To continue building PyPy wheels, you'll now need to set the enable option to pypy or pypy-eol. (#​2095)

• ⚠️ Dropped official support for Appveyor. If it was working for you before, it will probably continue to do so, but we can't be sure, because our CI doesn't run there anymore. (#​2386)

• 📚 A reorganisation of the docs, and numerous updates. (#​2280)

• 📚 Use Python 3.14 color output in docs CLI output. (#​2407)

• 📚 Docs now primarily use the pyproject.toml name of options, rather than the environment variable name. ([#​2389](https://redirec

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.