CVS commit: pkgsrc/www/py-autobahn

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Sep  4 06:56:08 UTC 2026

Modified Files:
        pkgsrc/www/py-autobahn: Makefile PLIST distinfo

Log Message:
py-autobahn: updated to 26.7.1

26.7.1
------

**Security**

* Fix WebSocket ``maxMessagePayloadSize`` being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress 
(deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; 
security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed 
with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past 
``maxMessagePayloadSize`` is now rejected where it previously passed; uncompressed traffic and the per-frame ``maxFramePayloadSize`` wire guard are unaffected
* Fix the permessage-deflate ``max_message_size`` receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded ``decompress(…, 
max_length)`` left the remaining input in ``unconsumed_tail`` undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises 
``PayloadExceededError`` as soon as the uncompressed size would exceed the cap
* Make bounded decompression backend-agnostic: ``decompress_message_data()`` gains an optional ``max_output_len`` argument (documented on the ``PerMessageCompress`` base class) and every 
permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, 
inflate the frame (already bounded on the wire by ``maxFramePayloadSize``) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining 
``maxMessagePayloadSize`` budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check
* Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio ``WampRawSocketFactory`` now exposes ``setProtocolOptions(maxMessagePayloadSize=...)`` / 
``resetProtocolOptions()`` (bounds ``[512, 2**24]``, default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next 
power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead ``max_size=None`` branch), so an asyncio WAMP peer could not tighten its RawSocket 
receive limit for DoS hardening and Crossbar's RawSocket ``max_message_size`` had no effect on the asyncio path

**FlatBuffers**

* Fix ``check_zlmdb_flatbuffers_version_in_sync()`` comparing the build-time ``version()`` (which is ``(0, 0, 0, None, None)`` on installed wheels, where the vendored FlatBuffers ``__git_version__`` 
is unstamped) — it now compares the reliably-stamped ``__version__`` and returns a version string. Added regression tests
* Make ``autobahn.flatbuffers.version()`` reliable on installed wheels: when the build-time ``__git_version__`` is a bare commit hash or ``"unknown"`` (shallow clone / submodule absent from the 
sdist), ``version()`` now falls back to parsing the static vendored ``__version__`` and returns ``(major, minor, patch, None, None)`` instead of ``(0, 0, 0, None, None)``; rich ``git describe`` 
detail is still returned on genuine dev/git builds. Also hardened ``hatch_build.py`` so it never stamps a non-parseable ``__git_version__``. Return shape is unchanged (5-tuple); no API break

**Build & CI/CD**

* Add CalVer / PEP 440 version-management ``just`` recipes (``file-version``, ``bump-dev``, ``bump-next``, ``prep-release``) mirroring Crossbar.io, and document the versioning policy in 
``CONTRIBUTING.md``
* Add ``ruff check --select ANN,UP,TCH`` (annotation presence, ``pyupgrade`` modern syntax, ``TYPE_CHECKING`` imports) to the ``just check-typing`` recipe so annotation/style regressions are caught 
in the ``quality-checks`` CI job. The existing gaps in ``src/autobahn/`` are ratcheted via an explicit ``--ignore`` allowlist to be removed module-by-module
* Fix the aarch64 CPython 3.14 wheel shipping the free-threaded ABI (``cp314t``) in the GIL ``cp314`` slot (26.6.x). Root cause: manylinux images pre-install both the GIL and free-threaded 3.14 under 
``/opt/python`` and prepend them to ``PATH``, and ``uv`` resolved ``cpython-3.14`` to the free-threaded interpreter (first on ``PATH``). The ``create`` recipe now drops free-threaded ``…t/bin`` dirs 
from ``PATH`` for GIL envs so ``uv`` selects the GIL build. As defence-in-depth, ``just build`` also asserts (via ``_check-venv-abi``) that the interpreter's GIL/free-threaded status matches the env 
and aborts on mismatch, so a wrong-ABI wheel can never be published. A reserved ``cpy314t`` env spec (``cpython-3.14t``) is added for a future free-threaded wheel variant
* Bump the ``.cicd`` (wamp-cicd) submodule to include exact CPython ABI-tag matching in the shared ``check-release-fileset`` release-gate action, so a wrong-ABI wheel (e.g. ``cp314t`` in the 
``cp314`` slot) is also rejected at release-fileset validation, not only by the build-time guard above
* Publish ``musllinux_1_2`` (musl libc / Alpine Linux) binary wheels with NVX acceleration for CPython 3.11–3.14 on both x86_64 and aarch64. Previously ``pip install autobahn`` on Alpine fell back to 
a source build that failed (the clang-built python-build-standalone interpreter's ``sysconfig`` carries a ``--rtlib=compiler-rt`` flag that Alpine's gcc rejects), so Alpine users could not install 
autobahn at all; the prebuilt wheels make it "just work". Built inside the official PyPA ``musllinux_1_2`` images (gcc toolchain), tagged automatically by ``auditwheel``, and gated by the 
``check-release-fileset`` targets. PyPy-on-musl is a tracked follow-up (no official PyPA musllinux PyPy image)


To generate a diff of this commit:
cvs rdiff -u -r1.50 -r1.51 pkgsrc/www/py-autobahn/Makefile
cvs rdiff -u -r1.25 -r1.26 pkgsrc/www/py-autobahn/PLIST
cvs rdiff -u -r1.36 -r1.37 pkgsrc/www/py-autobahn/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-autobahn/Makefile
diff -u pkgsrc/www/py-autobahn/Makefile:1.50 pkgsrc/www/py-autobahn/Makefile:1.51
--- pkgsrc/www/py-autobahn/Makefile:1.50        Sat Jul 18 23:02:28 2026
+++ pkgsrc/www/py-autobahn/Makefile     Fri Sep  4 06:56:08 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.50 2026/07/18 23:02:28 gdt Exp $
+# $NetBSD: Makefile,v 1.51 2026/09/04 06:56:08 adam Exp $
 
-DISTNAME=      autobahn-26.6.2
+DISTNAME=      autobahn-26.7.1
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
-PKGREVISION=   1
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=a/autobahn/}
 

Index: pkgsrc/www/py-autobahn/PLIST
diff -u pkgsrc/www/py-autobahn/PLIST:1.25 pkgsrc/www/py-autobahn/PLIST:1.26
--- pkgsrc/www/py-autobahn/PLIST:1.25   Fri Jul  3 07:23:16 2026
+++ pkgsrc/www/py-autobahn/PLIST        Fri Sep  4 06:56:08 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.25 2026/07/03 07:23:16 adam Exp $
+@comment $NetBSD: PLIST,v 1.26 2026/09/04 06:56:08 adam Exp $
 bin/flatc-${PYVERSSUFFIX}
 bin/wamp-${PYVERSSUFFIX}
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
@@ -601,9 +601,15 @@ ${PYSITELIB}/autobahn/websocket/protocol
 ${PYSITELIB}/autobahn/websocket/test/__init__.py
 ${PYSITELIB}/autobahn/websocket/test/__init__.pyc
 ${PYSITELIB}/autobahn/websocket/test/__init__.pyo
+${PYSITELIB}/autobahn/websocket/test/test_websocket_compress.py
+${PYSITELIB}/autobahn/websocket/test/test_websocket_compress.pyc
+${PYSITELIB}/autobahn/websocket/test/test_websocket_compress.pyo
 ${PYSITELIB}/autobahn/websocket/test/test_websocket_frame.py
 ${PYSITELIB}/autobahn/websocket/test/test_websocket_frame.pyc
 ${PYSITELIB}/autobahn/websocket/test/test_websocket_frame.pyo
+${PYSITELIB}/autobahn/websocket/test/test_websocket_max_message_size.py
+${PYSITELIB}/autobahn/websocket/test/test_websocket_max_message_size.pyc
+${PYSITELIB}/autobahn/websocket/test/test_websocket_max_message_size.pyo
 ${PYSITELIB}/autobahn/websocket/test/test_websocket_protocol.py
 ${PYSITELIB}/autobahn/websocket/test/test_websocket_protocol.pyc
 ${PYSITELIB}/autobahn/websocket/test/test_websocket_protocol.pyo

Index: pkgsrc/www/py-autobahn/distinfo
diff -u pkgsrc/www/py-autobahn/distinfo:1.36 pkgsrc/www/py-autobahn/distinfo:1.37
--- pkgsrc/www/py-autobahn/distinfo:1.36        Fri Jul  3 07:23:16 2026
+++ pkgsrc/www/py-autobahn/distinfo     Fri Sep  4 06:56:08 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.36 2026/07/03 07:23:16 adam Exp $
+$NetBSD: distinfo,v 1.37 2026/09/04 06:56:08 adam Exp $
 
-BLAKE2s (autobahn-26.6.2.tar.gz) = 61041713407c82248e0e2f175f31b6682caa8c9696f6dd82eae87efc8817a7bb
-SHA512 (autobahn-26.6.2.tar.gz) = eee85eabb3ea860a1e8cd2294178112176bd6c399fa03daa14747ef525e88e42b23509a2e1beb040a51ef5f1455ee0194175c49d4d71bd2a4fb079b7e5ba942a
-Size (autobahn-26.6.2.tar.gz) = 14041630 bytes
+BLAKE2s (autobahn-26.7.1.tar.gz) = bc1065702fdb8ce4e44f97cb44c18cbf509a87055ecb81333fbeaa08fd1bcce0
+SHA512 (autobahn-26.7.1.tar.gz) = 6c270cf163c59db1febb588ff3fab282a53d81266aa17a237d6b68ad681b92daa4d5ddab15e7e44556cdfd1e93f8fa75741dae7e7809b141794605b65b8797cc
+Size (autobahn-26.7.1.tar.gz) = 14056542 bytes