Sourced from soupsieve's releases.
2.8.4
- FIX: Fix another inefficient attribute pattern (
@mauriceng98).- FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests (
@mauriceng98).2.8.3
- FIX: Fix inefficient attribute pattern.
2.8.2
- FIX: Ensure custom selectors or namespace dictionaries reject non-string keys (
@mundanevision20).- FIX: Fix handling of
:in-rangeand:out-of-rangewith end of year weeks (@mundanevision20).- FIX: Fix a potential infinite loop in the pretty printing debug function (
@mundanevision20).
28108ab
Limit excessive selectorsef18872
Fix test for Windowseb43976
Merge commit from fork3a661b2
Fix typo in pseudo-classes.md (#294)0cb533d
Update hatchling version requirement in pyproject.toml (#290)5aedc41
Update doc themed7c4784
Attribute pattern fix (#289)09e106d
Fix grammar09b2769
Update docsc6e80fc
Various fixes by @mundanevision20
(#288)Sourced from mistune's releases.
v3.3.0
🐞 Bug Fixes
- Resolve O(n^2) DoS in parse_link_text (CWE-400) - by bhanugoudm041 (b6b49)
- Resolve O(n^2) DoS in parse_link_text (CWE-400)-Type handling/testing done - by bhanugoudm041 (b3af8)
- block: Avoid quadratic ref link scans - by
@lepture(2b04d)- cli: Add entrypoint and utf-8 output - by
@lepture(2f244)- directives: Constrain include targets - by
@lepture(1bef3)- formatting: Avoid quadratic marker scans - by
@lepture(96d0f)- image: Validate figure width option - by
@lepture(e3e51)- inline: Avoid bracket parsing DoS - by
@lepture(25f25)- math: Reject currency patterns and cross-line matches in inline math - by
@geopanther(566e1)- math: Support display and backtick math - by
@lepture(1141e)- renderer: Render plugin list and table nodes - by
@lepture(614b0)- renderer: Block encoded unsafe URL schemes - by
@lepture(c7101)- toc: Avoid generated id collisions - by
@lepture(c4093)🏎 Performance
View changes on GitHub
Sourced from mistune's changelog.
Version 3.3.0
Released on Jun 21, 2026
- Improve CommonMark compatibility and parser performance.
- Add command line entrypoint with UTF-8 output.
- Support display and backtick math.
- Render plugin list and table nodes in Markdown renderer.
- Escape leading block markers in Markdown renderer.
- Fix RST renderer for block quotes nested in lists.
- Avoid generated heading ID collisions in TOC.
- Harden URL, image, figure, and include directive handling.
- Fix quadratic scans in inline links, reference links, and formatting markers.
- Fix math escaping, currency pattern matching, and cross-line matching.
15c3b79
chore: release 3.3.0bdc01ad
tests: increase run time on pypy7cf1814
tests: increase run time for pypy6dfdc3d
tests: add more tests17c50f6
chore: fix mypy issues63abe4b
chore: use ruff check and formate6c1b18
chore: resolve mypy issuesdcf8902
test(math): cover escaped math outputc4093c4
fix(toc): avoid generated id collisionse3e51de
fix(image): validate figure width optionSourced from websockets's releases.
16.0
See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.
d4303a5
Release version 16.0.851bcd7
Bump pypa/cibuildwheel from 3.3.0 to 3.3.1740c8d3
Temporarily remove the trio implementation.92ea055
Add missing changelog entry.ba74244
Document bug fix.9410483
Pin sphinx to avoid error in sphinxcontrib-trio.8e4d408
Document asyncio's TLS read buffer.cb3500b
Stop referring to the asyncio implementation as new.6563a9c
The threading implementation supports max_queue.9f17e92
Clarify that protocol_mutex protects pending_pings.Sourced from setuptools's changelog.
v83.0.0
Features
- Require Python 3.10 or later.
Bugfixes
MANIFEST.inmatching (viaFileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously anexclude,global-exclude,recursive-exclude, orprunerule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.Deprecations and Removals
pypa/distutils#334v82.0.1
Bugfixes
- Fix the loading of
launcher manifest.xmlfile. (#5047)- Replaced deprecated
json.__version__with fixture in tests. (#5186)Improved Documentation
- Add advice about how to improve predictability when installing sdists. (#5168)
Misc
v82.0.0
... (truncated)
6519f72
Bump version: 82.0.1 → 83.0.0d1151b1
Merge pull request #5250
from pypa/feature/distutils-d7633fbeda2df31e
Capture removal of dry_run parameter in changelog.00144dc
Moved newsfragment to the release where it occurred.a4a5a2b
Add news fragment.77470c2
Merge https://github.com/pypa/distutils
into feature/distutils-d7633fbed3c43897
Merge pull request #5247
from pypa/copilot/fix-pypy-version-issuebb6ea66
Bump PyPy from 3.10 to 3.11 in CI workflowa2bc3ac
Fix broken intersphinx reference to build's installation docs2d6a739
Use stacked parametrize decorators instead of itertools.productSourced from setuptools's changelog.
v83.0.0
Features
- Require Python 3.10 or later.
Bugfixes
MANIFEST.inmatching (viaFileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously anexclude,global-exclude,recursive-exclude, orprunerule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.Deprecations and Removals
pypa/distutils#334
6519f72
Bump version: 82.0.1 → 83.0.0d1151b1
Merge pull request #5250
from pypa/feature/distutils-d7633fbeda2df31e
Capture removal of dry_run parameter in changelog.00144dc
Moved newsfragment to the release where it occurred.a4a5a2b
Add news fragment.77470c2
Merge https://github.com/pypa/distutils
into feature/distutils-d7633fbed3c43897
Merge pull request #5247
from pypa/copilot/fix-pypy-version-issuebb6ea66
Bump PyPy from 3.10 to 3.11 in CI workflowa2bc3ac
Fix broken intersphinx reference to build's installation docs2d6a739
Use stacked parametrize decorators instead of itertools.productSourced from js-yaml's changelog.
4.3.0, 3.15.0 - 2026-06-27
Security
- Backported
maxTotalMergeKeysoption.[5.2.0] - 2026-06-26
Added
- Added
maxTotalMergeKeys(10000) loader option to limit the total number of keys processed by YAML merge (<<) across oneload()/loadAll()call.- Added
maxAliases(-1) loader option to limit the number of YAML aliases per document.Removed
maxMergeSeqLengthreplaced withmaxTotalMergeKeysfor limiting YAML merge processing.Fixed
- Round-trip of integers with exponential form (>=
1e21)[5.1.0] - 2026-06-23
Added
- Collection tags can finalize an incrementally populated carrier into a different result value.
Changed
- [breaking]
quoteStylenow selects the preferred quote style; use the restoredforceQuotesoption to force quoting non-key strings.[5.0.0] - 2026-06-20
Added
- Added named exports for schemas, tags, parser events and AST utilities.
- Reworked
JSON_SCHEMAandCORE_SCHEMAwith spec-compliant scalar resolution rules, and addedYAML11_SCHEMA.- Added
realMapTagfor lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.- Added
dump()transformoption for changing the generated AST before rendering.- Added
dump()optionsseqInlineFirst,flowBracketPadding,flowSkipCommaSpace,flowSkipColonSpace,quoteFlowKeys,quoteStyleandtagBeforeAnchor.- Added formal data layers (events and AST) for modular data pipelines.
- Added low-level parser (to events), presenter and visitor APIs.
- Added the YAML Test Suite to the test set.
Changed
- See the migration guide for upgrade notes.
- Rewritten in TypeScript and reorganized the public API around flat named exports.
... (truncated)
33d05b5
4.3.0 released663bfab
Drop demo publish, to not override new v5 one.1cb8c7b
Add v4-legacy tag for publish02f27af
Restore umd builds back to es58be84ed
Fix es5 compatibility59423c6
Replace maxMergeSeqLength option with
maxTotalMergeKeys (more robust). Ba...6842ef6
doc polishSourced from jupyterlab's releases.
v4.5.10
4.5.10
Security patches
- GHSA-gx64-gj6p-pc4c
- GHSA-89vp-jrxv-24w8
- GHSA-h5v5-8746-g7mm
- GHSA-pppj-hq3g-57pj
- GHSA-whvh-wf3x-g77j
Bugs fixed
- Backport of security patches to
4.5.xbranch #19186 (@krassowski,@MUFFANUJ)Maintenance and upkeep improvements
- Reconfigure 4.5.x branch (4.6.x is new stable) #19060 (
@krassowski)- Split external link checks and only run if diff includes a URL #19029 (
@MUFFANUJ)Contributors to this release
The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.