[dependabot]

Bumps autobahn from 26.7.1 to 26.10.1.

Release notes

Sourced from autobahn's releases.

Release fork_79f45be6_oberstet_autobahn_python_fix_2024_202610261807

Official release fork_79f45be6_oberstet_autobahn_python_fix_2024_202610261807

Included Platforms

• Linux: x86_64, ARM64 (manylinux_2_34 wheels with NVX)
• macOS: Apple Silicon ARM64 (binary wheels with NVX)
• Windows: x86_64 (binary wheels with NVX)

Python Versions

• CPython: 3.11, 3.12, 3.13, 3.14
• PyPy: 3.11

Installation

pip install autobahn[all]==fork_79f45be6_oberstet_autobahn_python_fix_2024_202610261807

Or download wheels directly from this release.

Build Information

• Release Date: 2026-10-26 18:52:57 UTC
• Total Wheels: 32
• Source Distributions: 3

Features

Autobahn|Python provides:

• WebSocket client and server implementations (RFC 6455)
• WAMP client library for both Twisted and asyncio
• NVX acceleration for high-performance networking (binary wheels)
• Pure Python fallback wheels for maximum compatibility

Documentation

• Read the Docs
• GitHub Repository
• WAMP Protocol

Development Build fork-79f45be6-oberstet_autobahn_python-fix_2024-202610261807

Development build from pull request

Build Information

... (truncated)

Changelog

Sourced from autobahn's changelog.

26.10.1

General

• Load the vendored FlatBuffers runtime only when a FlatBuffers message is first built or parsed, instead of on every import autobahn. The runtime imports numpy whenever numpy is installed, so up to 26.7.1 every process importing autobahn also loaded numpy, including WebSocket-only users such as Django Channels applications served by Daphne. Every autobahn import now needs about 13-17 MB less memory on CPython and 18-24 MB less on PyPy, and none loads numpy. A new documentation page (docs/memory-footprint.rst, just memory-footprint) shows the import memory footprint per release on CPython and PyPy (#1983)

Wheels

• Publish native Windows ARM64 (win_arm64) wheels with NVX for CPython 3.11-3.14, built on GitHub's windows-11-arm runners (PyPy publishes no Windows ARM64 interpreter); thanks to @​ndabas. cryptography currently publishes no win_arm64 wheel, so the build compiles it against an OpenSSL from vcpkg (#1937, #1945)
• Build cryptography against an OpenSSL from vcpkg on Windows x86_64 too: cryptography 50.0.2 publishes its Windows PyPy wheels for PyPy 8 (pp80) only, and the pypy311 wheel build uses PyPy 7.3 (pp73), so pip builds it from source there (#1959)

WebSocket

• Make all four per-message compression extensions (permessage-deflate, -bzip2, -brotli, -snappy) enforce the decompression budget the same way: decompression stops near the remaining maxMessagePayloadSize budget instead of decompressing a whole frame first, and "over budget" as well as "budget already used up" raise PayloadExceededError. brotli now bounds its output with Decompressor.process(output_buffer_limit=...), snappy is decompressed one framing chunk at a time, and deflate no longer lets one octet through once the budget is used up (#1986)
• Add autobahn.exception.PayloadCorruptError: every compression extension now raises it for input it cannot decompress (corrupt, truncated, or not the extension's format), instead of the library's own exception (zlib.error, OSError, brotli.error, ...), and snappy no longer accepts such input silently. The protocol fails the connection with close code 1007 (invalid frame payload data), the same for every extension and on both Twisted and asyncio (#1986)
• Fix permessage-brotli failing on the second message of a connection when context takeover was negotiated (the default): the compressor and decompressor were reused after their brotli stream had finished. Each message is now a new brotli stream, which is the wire format brotli used for the first message already, and for no context takeover (#1986)
• Fix an asyncio WebSocket connection being left open, but no longer serviced, when an exception escaped the processing of received data: the connection is now dropped, as on Twisted (#1986)
• Add a documentation page on WebSocket compression (docs/websocket/compression.rst): for each of the four extensions, which Python package and which compression library (and bundled version) it uses on CPython and on PyPy, plus context takeover, decompression limits and the handling of invalid data. The old, unpublished page under docs/work/ did not cover permessage-brotli (#1986)

Build & CI/CD

• Run the unit tests (Twisted/trial and asyncio/pytest) in CI on every supported Python: CPython 3.11–3.14 and PyPy 3.11, instead of on CPython 3.14 only, and with all four compression extensions installed (python-snappy is added to the dev extra; just check-compressors verifies all four are available) (#1986)
• Adopt the contribution workflow shared by all WAMP projects: CONTRIBUTING.md, the pull request template and .audit/README.md are now deployed byte-identically from wamp-cicd (GitHub issue first, red → green tests, AI-assistance disclosure) and kept in sync by a CI drift check; everything specific to Autobahn|Python moved to a new DEVELOPMENT.md (also included in the docs). .cicd is pinned to wamp-cicd 38ded6a, the same commit across the WAMP fleet (#1956)
• Remove the opt-in entropy depletion tests (autobahn/test/test_rng.py, enabled by AUTOBAHN_CI_ENABLE_RNG_DEPLETION_TESTS, never run in CI): they read /proc/sys/kernel/random/entropy_avail, which has been a constant 256 since Linux 5.18, and /dev/random no longer blocks since Linux 5.6, so one test passed whatever happened and the other always failed (#1278)
• Build the ARM64 Linux wheels natively on GitHub's ubuntu-24.04-arm runners instead of under QEMU emulation on x86_64 runners, as zlmdb does since #183. Under emulation the builds took around 40 minutes (up to 96) and segfaulted intermittently, so each build had 9 attempts of 120 minutes; the same container images and build script are used, and a build attempt now gets 60 minutes and 3 tries (#1940)
• Build the bundled flatc on all cores: hatch_build.py ran cmake --build without --parallel, so flatc was compiled on one core in every wheel build, editable install and just test-* run. It now passes --parallel <os.cpu_count()>; an explicit CMAKE_BUILD_PARALLEL_LEVEL in the environment still wins. Measured on a 32-core host: 237 s serial, 25 s with 16 jobs. Skipping the build when flatc's inputs did not change is still open (#1985)
• Install patchelf with pip, next to auditwheel, in the custom PyPy ARM64 build images: Debian's patchelf 0.14.3 is older than the 0.14.5 that current auditwheel repair requires (#1941)
• Remove dead code reported by ty (an unused _unique_list helper in both component.py modules, and an unreachable response-body block in the WebSocket server opening handshake) instead of adding it to the ignore list (#1938)
• Adopt the WAMP fleet's shared developer workflow recipes from wamp-cicd (just where, what, new-branch, land, ...); the release upload recipe publish is renamed publish-release (#1943)
• Apply the fleet's shared python-package and way-a aspects (repository files kept in sync from wamp-cicd, with generated aspects.toml), and bump .cicd accordingly (#1960, #1972, #1975, #1977, #1979, #1981)
• Publish to PyPI through Trusted Publishing (OIDC) with pypa/gh-action-pypi-publish, as the other WAMP Python packages do, instead of twine upload with a PYPI_API_TOKEN secret. Every file on PyPI now carries a PEP 740 publish attestation (provenance), starting with 26.10.1 (#1958)
• Add an import-smoke-lowest CI job (just test-imports-lowest) that runs the import smoke test on CPython 3.11 with every direct dependency resolved to the lowest version pyproject.toml allows (uv --resolution lowest-direct), so stale version floors are caught. The import smoke test now also covers the Twisted and asyncio bindings, each module imported in a fresh interpreter (#1955)

asyncio

• Fix autobahn.asyncio.component.run(), ApplicationRunner.run(), Component.start() and the asyncio WebSocket factories failing on CPython 3.14 with RuntimeError: There is no current event loop when started from plain synchronous code (and the DeprecationWarning on 3.12 / 3.13): CPython no longer creates the loop implicitly in asyncio.get_event_loop(). A new helper autobahn.asyncio.util.get_or_create_event_loop() returns the running loop, else the loop set for the thread, else a new one; run() was first fixed by Lukas Komischke (#1952, #1953), the remaining call sites follow, with a regression test that runs each case in a fresh interpreter (#1965)
• Fix ApplicationSession.call() on asyncio raising AttributeError instead of the payload codec's exception when the payload codec fails to encode the call: the error was logged with log.failure(), which only the Twisted logger has. It is now logged with log.error() and the traceback, on both Twisted and asyncio, and the codec's exception reaches the caller (#1988)

Dependencies

• Raise the compress extra's floors to brotli>=1.2.0 (CPython) and brotlicffi>=1.2.0 (PyPy), the first versions with Decompressor.process(output_buffer_limit=...) (#1986)
• Fix import autobahn.twisted failing on CPython 3.11–3.13 with TypeError: unsupported operand type(s) for |: 'InterfaceClass' and 'InterfaceClass' when zope.interface < 6.2 is installed: autobahn.twisted.util and autobahn.twisted.wamp now use from __future__ import annotations, and the twisted extra's zope.interface floor is raised from >=5.2.0 to >=6.2, the first release whose interfaces support | (#1955)
• Split the cbor2 dependency by Python runtime: CPython uses the current >=6.1.0 line (Rust/pyo3, binary wheels), while PyPy is pinned to cbor2==5.9.0 — the final pure-Python release — deliberately keeping PyPy out of the native-extension matrix. This removes the cbor2 Rust source-compile that was timing out the PyPy-aarch64 wheel build under QEMU emulation. The two implementations are verified wire-equivalent by a new cross-version CBOR conformance test (examples/serdes/tests/test_cbor_cross_version.py) that runs on both CPython and PyPy in CI and asserts each encodes/decodes the wamp-proto canonical CBOR vectors byte-for-byte identically. cbor2==5.9.0 also carries the max_depth decoder hardening for CVE-2026-26209 (#1947)
• Raise the cryptography floor to >=50 so PyPy (including PyPy-aarch64) installs a prebuilt wheel instead of source-compiling Rust under QEMU emulation, and refresh pip/packaging in install-build-tools before installing so newer platform wheel tags (e.g. manylinux_2_34 PyPy-aarch64) resolve to wheels. >=50 is also the first release clear of the known 2026 cryptography advisories — CVE-2026-26007 (fixed 46.0.5), CVE-2026-39892 (fixed 46.0.7) and the PKCS#7 Bleichenbacher oracle (fixed 50.0.0); since cryptography is Rust-only with no pure-Python fallback it cannot be capped, so the floor is raised to the security-clean version (#1947)

Commits

• 2ac4f0e Merge branch 'fix_1999' (#1999)
• 01bbf4d #1999: docs - memory footprint tables for 26.10.1, re-measured
• c725baa #1999: version 26.10.1 for the stable release (just prep-release)
• 36d02ab #1999: docs - release notes for 26.6.1, 26.6.2, 26.7.1 and 26.10.1
• 88f35a9 #1999: changelog - section 26.10.1, and the changes landed without an entry
• 0d51493 start new dev branch; add audit file
• 3eefbfe Merge branch 'fix_1985' (#1985)
• 09bc41b #1985: build the bundled flatc on all cores (cmake --build --parallel)
• a72571c start new dev branch; add audit file
• a25d425 Merge branch 'fix_1940' (#1940)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.