PyPI - devpi-server - Versions diffs - 6.16.0__tar.gz → 6.17.0__tar.gz - Mend

devpi-server 6.16.0tar.gz → 6.17.0tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (131) hide show

{devpi_server-6.16.0 → devpi_server-6.17.0}/.flake8 RENAMED Viewed

@@ -2,8 +2,8 @@
 # E203 is ignored because we enforce ruff format which contradicts it
 ignore = E203,E501,E704,E741,W503
 per-file-ignores =
-    plugin.py:E127,E128,E225,E231
+    plugin.py:E127,E128,E231
     importexport.py:E127
-    model.py:E128,E225,E231
+    model.py:E128,E231
     test_importexport.py:E121
     test*.py:E126,E127,E128,E225,E226,E231,E251

{devpi_server-6.16.0 → devpi_server-6.17.0}/CHANGELOG RENAMED Viewed

@@ -2,22 +2,66 @@
 .. towncrier release notes start
-6.16.0 (2025-06-25)
+6.17.0 (2025-08-27)
 ===================
 Deprecations and Removals
 -------------------------
-- Dropped support for Python 3.7 and 3.8.
+- Dropped support for migrating old password hashes that were replaced in devpi-server 4.2.0.
+- Removed support for basic authorization in primary URL. The connection is already secured by a bearer token header.
+- Removed the experimental ``--replica-cert`` option. The replica is already using a token via a shared secret, so this is redundant.
+- Removed ``--replica-max-retries`` option. It wasn't implemented for async_httpget and didn't work correctly when streaming data.
 Features
 --------
-- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
+- Use httpx for all data fetching for mirrors and fetch projects list asynchronously to allow update in background even after a timeout.
+- Use httpx instead of requests when proxying from replicas to primary.
+- Use httpx for all requests from replicas to primary.
+- Use httpx when pushing releases to external index.
+- Added ``mirror_ignore_serial_header`` mirror index option, which allows switching from PyPI to a mirror without serials header when set to ``True``, otherwise only stale links will be served and no updates be stored.
+- The HTTP cache information for mirrored projects is persisted and re-used on server restarts.
+- Added ``--file-replication-skip-indexes`` option to skip file replication for ``all``, by index type (i.e. ``mirror``) or index name (i.e. ``root/pypi``).
+Bug Fixes
+---------
+- Correctly handle lists for ``Provides-Extra`` and ``License-File`` metadata in database.
+- Fix traceback by returning 401 error code when using wrong password with a user that was created using an authentication plugin like devpi-ldap which passes authentication through in that case.
+- Fix #1053: allow users to update their passwords when ``--restrict-modify`` is used.
+- Fix #1097: return 404 when trying to POST to +simple.
+Other Changes
+-------------
+- Changed User-Agent when fetching data for mirrors from just "server" to "devpi-server".
+6.16.0 (2025-06-25)
+===================
+Deprecations and Removals
+-------------------------
+- Dropped support for Python 3.7 and 3.8.
+Features
+--------
+- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
 Bug Fixes
 ---------
@@ -27,7 +71,6 @@ Bug Fixes
 - Keep original metadata_version in database.
 6.15.0 (2025-05-18)
 ===================
@@ -37,7 +80,6 @@ Features
 - Add ``--connection-limit`` option to devpi-server passed on to waitress.
 6.14.0 (2024-10-16)
 ===================
@@ -50,15 +92,12 @@ Features
 - Allow pushing of documentation only with no release files. Requires devpi-client 7.2.0.
 Bug Fixes
 ---------
 - No longer automatically "register" a project when pushing releases to PyPI. The reply changed from HTTP status 410 to 400 breaking the upload. With devpi-client 7.2.0 there is a ``--register-project`` option if it is still required for some other package registry.
 6.13.0 (2024-09-19)
 ===================
@@ -70,8 +109,6 @@ Deprecations and Removals
   Using the old terms will now output warnings.
   The ``+status`` API has additional fields and the ``role`` field content will change with 7.0.0.
 Features
 --------
@@ -79,8 +116,6 @@ Features
 - Added support uv pip as an installer.
 Bug Fixes
 ---------
@@ -93,7 +128,6 @@ Bug Fixes
 - Only warn about replica not being in sync instead of fatal status while still replicating.
 6.12.1 (2024-07-24)
 ===================
@@ -107,7 +141,6 @@ Bug Fixes
 - Fix #1044: Correctly update cache expiry time when mirrored server returns 304 Not Modified.
 6.12.0 (2024-06-25)
 ===================
@@ -118,15 +151,12 @@ Features
 - Added ``devpiserver_on_toxresult_upload_forbidden`` hook to allow returning a custom message and result (403 or 200).
 Bug Fixes
 ---------
 - Return json data if toxresult upload is forbidden.
 6.11.0 (2024-04-20)
 ===================
@@ -137,8 +167,6 @@ Features
 - Fix #983: Add plugin hook for mirror authentication header.
 Bug Fixes
 ---------
@@ -147,7 +175,6 @@ Bug Fixes
 - Fix #1033: Use ``int`` for ``--mirror-cache-expiry`` to fix value of ``proxy_cache_valid`` in nginx caching config.
 6.10.0 (2023-12-19)
 ===================
@@ -158,8 +185,6 @@ Features
 - Fix #998: Use the pure Python httpx library instead of aiohttp to prevent delays in supporting newest Python releases.
 Bug Fixes
 ---------
@@ -168,7 +193,6 @@ Bug Fixes
 - Only compare hostname instead of full URL prefix when parsing mirror packages to fix mirrors with basic authentication and absolute URLs. See #1006
 6.9.2 (2023-08-06)
 ==================
@@ -199,7 +223,6 @@ Features
 - Fix #931: Add ``mirror_no_project_list`` setting for mirror indexes that have no full project list like google cloud artifacts or if you want to prevent downloading the full list for huge indexes like PyPI.
 Bug Fixes
 ---------
@@ -222,7 +245,6 @@ Features
 - Fix #929: Cache normalized project names per transaction on mirror index instances.
 Bug Fixes
 ---------
@@ -245,7 +267,6 @@ Features
 - Set headers to prevent caching for simple links with stale results.
 Bug Fixes
 ---------
@@ -283,7 +304,6 @@ Features
 - Support `PEP-691 <https://peps.python.org/pep-0691/>`_ conformant fetching for mirrors, and requests with JSON result for installers. Proxy servers should add compression support for the ``application/vnd.pypi.simple.v1+json`` content type (``gzip_types`` for nginx).
 Bug Fixes
 ---------
@@ -325,7 +345,6 @@ Features
 - Better logging and handling if a thread unexpectedly dies.
 Bug Fixes
 ---------
@@ -346,13 +365,11 @@ Deprecations and Removals
 - As announced with 6.0.0, support for Python 3.6 has been dropped, because it has reached its end of life.
 Features
 --------
 - When an installer user agent is detected the full list of projects is returned unsorted and with less info to improve performance and reduce memory usage.
 Bug Fixes
 ---------
@@ -378,7 +395,6 @@ Features
 - Use aiohttp (asyncio) for fetching release links from mirrors to return stale links immediately in case of a timeout, but update the database in the background for the next request.
 Bug Fixes
 ---------
@@ -412,7 +428,6 @@ Deprecations and Removals
 - Renamed 'pypi_submit' permission to 'upload'. The old permission still works, but will be removed in a later major release.
 Features
 --------
@@ -420,7 +435,6 @@ Features
 - Allow user and index URLs to work with a trailing slash.
 Bug Fixes
 ---------
@@ -448,7 +462,6 @@ Deprecations and Removals
 - Removed deprecated ``--start``, ``--stop`` and ``--status`` options.
 Features
 --------
@@ -480,7 +493,6 @@ Features
 - The user creation and modification time is now stored. Adding or removing an index doesn't count as a modification.
 Bug Fixes
 ---------
@@ -492,7 +504,6 @@ Bug Fixes
 - Handle cases where the ``Content-Type`` header from a mirror can be an empty string.
 Other Changes
 -------------
@@ -559,7 +570,6 @@ Features
 - On import files for mirror indexes are now imported when they were included in the dump (see ``--include-mirrored-files``).
 Bug Fixes
 ---------
@@ -587,7 +597,6 @@ Features
 - proxy requests from the replica to the master will use number of seconds from the new ``--proxy-timeout`` option as their timeout value.
 Bug Fixes
 ---------
@@ -610,7 +619,6 @@ Deprecations and Removals
 - The ``--passwd`` option is deprecated, use the new ``devpi-passwd`` command instead.
 Features
 --------
@@ -624,7 +632,6 @@ Features
 - Storage options can now be specified as a dict in yaml config files.
 Bug Fixes
 ---------
@@ -646,7 +653,6 @@ Bug Fixes
 - Unnecessary database writes where the final value didn't change are now prevented.
 Other Changes
 -------------
@@ -680,7 +686,6 @@ Deprecations and Removals
 - deprecated Python 2.7 support. This is the last major version supporting Python 2.7. For upgrading to Python 3.x you have to export your data using your current setup with Python 2.7 and import it in a new installation with Python 3.x.
 Features
 --------
@@ -698,7 +703,6 @@ Features
 - when credentials for the user are rejected, the error message now says so instead of claiming the user could not be found.
 Other Changes
 -------------
@@ -733,7 +737,6 @@ Features
 - add ``--hard-links`` support for replicas together with the ``--replica-file-search-path`` option. When a matching file is found it's hard linked instead of writing a copy.
 Bug Fixes
 ---------
@@ -743,7 +746,6 @@ Bug Fixes
 - use timeout when waiting for data from master in replica on mirror simple pages.
 Other Changes
 -------------
@@ -775,7 +777,6 @@ Features
 - The PATCH method of indexes supports a list of arguments with operations in the form of ``key=value`` for setting values and for lists in the form of ``key+=value`` and ``key-=value`` to add and remove items. This prevents undoing changes sent in concurrent PATCH requests.
 Bug Fixes
 ---------
@@ -805,7 +806,6 @@ Deprecations and Removals
 - Deprecated DEVPI_SERVERDIR environment variable in favor of DEVPISERVER_SERVERDIR to be consistent with the other option overwrites.
 Features
 --------
@@ -825,7 +825,6 @@ Features
 - Better handling of 404s in mirror indexes. Every project not found would create an entry in the database which would grow it unnecessarily.
 Bug Fixes
 ---------
@@ -863,7 +862,6 @@ Features
 - add `--request-timeout` option to provide adjustable request timeout
 Bug Fixes
 ---------
@@ -889,7 +887,6 @@ Features
 - Use ``pypi.org`` as new default for ``root/pypi`` mirror index.
 Bug Fixes
 ---------
@@ -909,7 +906,6 @@ Features
 - fix issue469: Add ``acl_toxresult_upload`` to index configuration.
 Bug Fixes
 ---------

{devpi_server-6.16.0 → devpi_server-6.17.0}/CHANGELOG.short.rst RENAMED Viewed

@@ -9,22 +9,66 @@ Changelog
 .. towncrier release notes start
-6.16.0 (2025-06-25)
+6.17.0 (2025-08-27)
 ===================
 Deprecations and Removals
 -------------------------
-- Dropped support for Python 3.7 and 3.8.
+- Dropped support for migrating old password hashes that were replaced in devpi-server 4.2.0.
+- Removed support for basic authorization in primary URL. The connection is already secured by a bearer token header.
+- Removed the experimental ``--replica-cert`` option. The replica is already using a token via a shared secret, so this is redundant.
+- Removed ``--replica-max-retries`` option. It wasn't implemented for async_httpget and didn't work correctly when streaming data.
 Features
 --------
-- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
+- Use httpx for all data fetching for mirrors and fetch projects list asynchronously to allow update in background even after a timeout.
+- Use httpx instead of requests when proxying from replicas to primary.
+- Use httpx for all requests from replicas to primary.
+- Use httpx when pushing releases to external index.
+- Added ``mirror_ignore_serial_header`` mirror index option, which allows switching from PyPI to a mirror without serials header when set to ``True``, otherwise only stale links will be served and no updates be stored.
+- The HTTP cache information for mirrored projects is persisted and re-used on server restarts.
+- Added ``--file-replication-skip-indexes`` option to skip file replication for ``all``, by index type (i.e. ``mirror``) or index name (i.e. ``root/pypi``).
+Bug Fixes
+---------
+- Correctly handle lists for ``Provides-Extra`` and ``License-File`` metadata in database.
+- Fix traceback by returning 401 error code when using wrong password with a user that was created using an authentication plugin like devpi-ldap which passes authentication through in that case.
+- Fix #1053: allow users to update their passwords when ``--restrict-modify`` is used.
+- Fix #1097: return 404 when trying to POST to +simple.
+Other Changes
+-------------
+- Changed User-Agent when fetching data for mirrors from just "server" to "devpi-server".
+6.16.0 (2025-06-25)
+===================
+Deprecations and Removals
+-------------------------
+- Dropped support for Python 3.7 and 3.8.
+Features
+--------
+- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
 Bug Fixes
 ---------
@@ -34,7 +78,6 @@ Bug Fixes
 - Keep original metadata_version in database.
 6.15.0 (2025-05-18)
 ===================
@@ -44,7 +87,6 @@ Features
 - Add ``--connection-limit`` option to devpi-server passed on to waitress.
 6.14.0 (2024-10-16)
 ===================
@@ -57,15 +99,12 @@ Features
 - Allow pushing of documentation only with no release files. Requires devpi-client 7.2.0.
 Bug Fixes
 ---------
 - No longer automatically "register" a project when pushing releases to PyPI. The reply changed from HTTP status 410 to 400 breaking the upload. With devpi-client 7.2.0 there is a ``--register-project`` option if it is still required for some other package registry.
 6.13.0 (2024-09-19)
 ===================
@@ -77,8 +116,6 @@ Deprecations and Removals
   Using the old terms will now output warnings.
   The ``+status`` API has additional fields and the ``role`` field content will change with 7.0.0.
 Features
 --------
@@ -86,8 +123,6 @@ Features
 - Added support uv pip as an installer.
 Bug Fixes
 ---------
@@ -99,18 +134,3 @@ Bug Fixes
 - Only warn about replica not being in sync instead of fatal status while still replicating.
-6.12.1 (2024-07-24)
-===================
-Bug Fixes
----------
-- Support Python 3.13 by depending on legacy-cgi.
-- Preserve query string when proxying requests from replica to primary. This fixes force removal on non-volatile indexes and probably other bugs.
-- Fix #1044: Correctly update cache expiry time when mirrored server returns 304 Not Modified.

{devpi_server-6.16.0 → devpi_server-6.17.0}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devpi-server
-Version: 6.16.0
+Version: 6.17.0
 Summary: devpi-server: reliable, private, and pypi.org caching server
 Maintainer-email: Florian Schulze <mail@pyfidelity.com>
 License-Expression: MIT
@@ -32,7 +32,7 @@ Requires-Dist: argon2-cffi
 Requires-Dist: attrs>=22.2.0
 Requires-Dist: defusedxml
 Requires-Dist: devpi_common<5,>3.6.0
-Requires-Dist: httpx
+Requires-Dist: httpx<1
 Requires-Dist: itsdangerous>=0.24
 Requires-Dist: lazy
 Requires-Dist: legacy-cgi; python_version >= "3.13"
@@ -121,22 +121,66 @@ Changelog
 .. towncrier release notes start
-6.16.0 (2025-06-25)
+6.17.0 (2025-08-27)
 ===================
 Deprecations and Removals
 -------------------------
-- Dropped support for Python 3.7 and 3.8.
+- Dropped support for migrating old password hashes that were replaced in devpi-server 4.2.0.
+- Removed support for basic authorization in primary URL. The connection is already secured by a bearer token header.
+- Removed the experimental ``--replica-cert`` option. The replica is already using a token via a shared secret, so this is redundant.
+- Removed ``--replica-max-retries`` option. It wasn't implemented for async_httpget and didn't work correctly when streaming data.
 Features
 --------
-- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
+- Use httpx for all data fetching for mirrors and fetch projects list asynchronously to allow update in background even after a timeout.
+- Use httpx instead of requests when proxying from replicas to primary.
+- Use httpx for all requests from replicas to primary.
+- Use httpx when pushing releases to external index.
+- Added ``mirror_ignore_serial_header`` mirror index option, which allows switching from PyPI to a mirror without serials header when set to ``True``, otherwise only stale links will be served and no updates be stored.
+- The HTTP cache information for mirrored projects is persisted and re-used on server restarts.
+- Added ``--file-replication-skip-indexes`` option to skip file replication for ``all``, by index type (i.e. ``mirror``) or index name (i.e. ``root/pypi``).
+Bug Fixes
+---------
+- Correctly handle lists for ``Provides-Extra`` and ``License-File`` metadata in database.
+- Fix traceback by returning 401 error code when using wrong password with a user that was created using an authentication plugin like devpi-ldap which passes authentication through in that case.
+- Fix #1053: allow users to update their passwords when ``--restrict-modify`` is used.
+- Fix #1097: return 404 when trying to POST to +simple.
+Other Changes
+-------------
+- Changed User-Agent when fetching data for mirrors from just "server" to "devpi-server".
+6.16.0 (2025-06-25)
+===================
+Deprecations and Removals
+-------------------------
+- Dropped support for Python 3.7 and 3.8.
+Features
+--------
+- Update stored package metadata fields to version 2.4 for license expressions (PEP 639).
 Bug Fixes
 ---------
@@ -146,7 +190,6 @@ Bug Fixes
 - Keep original metadata_version in database.
 6.15.0 (2025-05-18)
 ===================
@@ -156,7 +199,6 @@ Features
 - Add ``--connection-limit`` option to devpi-server passed on to waitress.
 6.14.0 (2024-10-16)
 ===================
@@ -169,15 +211,12 @@ Features
 - Allow pushing of documentation only with no release files. Requires devpi-client 7.2.0.
 Bug Fixes
 ---------
 - No longer automatically "register" a project when pushing releases to PyPI. The reply changed from HTTP status 410 to 400 breaking the upload. With devpi-client 7.2.0 there is a ``--register-project`` option if it is still required for some other package registry.
 6.13.0 (2024-09-19)
 ===================
@@ -189,8 +228,6 @@ Deprecations and Removals
   Using the old terms will now output warnings.
   The ``+status`` API has additional fields and the ``role`` field content will change with 7.0.0.
 Features
 --------
@@ -198,8 +235,6 @@ Features
 - Added support uv pip as an installer.
 Bug Fixes
 ---------
@@ -211,18 +246,3 @@ Bug Fixes
 - Only warn about replica not being in sync instead of fatal status while still replicating.
-6.12.1 (2024-07-24)
-===================
-Bug Fixes
----------
-- Support Python 3.13 by depending on legacy-cgi.
-- Preserve query string when proxying requests from replica to primary. This fixes force removal on non-volatile indexes and probably other bugs.
-- Fix #1044: Correctly update cache expiry time when mirrored server returns 304 Not Modified.

devpi_server-6.17.0/devpi_server/__init__.py ADDED Viewed

	@@ -0,0 +1 @@
1	+ __version__ = "6.17.0"

devpi-server 6.16.0__tar.gz → 6.17.0__tar.gz

devpi-server 6.16.0tar.gz → 6.17.0tar.gz