pathlib-next 0.9.3__tar.gz → 0.9.4__tar.gz

pathlib_next-0.9.4/.gitignore

@@ -0,0 +1,43 @@
+# Category rule: nothing dot-prefixed at the repo root gets tracked except the
+# files re-included below (a category beats a list). Root-anchored on purpose;
+# nested dotfiles are governed by the specific rules further down.
+/.*
+!/.gitignore
+!/.gitattributes
+!/.github/
+# Shared editor settings (black on save, pytest discovery, build task) are
+# tracked deliberately.
+!/.vscode/
+
+# Private agent config. No trailing slash on `.agents` on purpose: it may be a
+# symlink, which git treats as a file, so a directory-only `.agents/` would not
+# match it. These stay even though /.* covers the root: they also catch nested
+# copies. *.local.* is an unshared, machine- or user-specific override and is
+# never committed (it is also excluded from the build in pyproject.toml).
+.agents
+*.local.*
+CLAUDE*
+.claude
+
+# Build/dist output and generated docs site
+build/
+dist/
+site/
+
+# Python
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.hypothesis/
+.mypy_cache/
+.ruff_cache/
+.coverage*
+htmlcov/
+*.egg-info/
+.venv/
+.pyvenv/
+
+# OS/editor
+.DS_Store
+Thumbs.db
+.idea/

pathlib_next-0.9.4/AGENTS.md

@@ -0,0 +1,116 @@
+# pathlib_next — contributor orientation
+
+Orientation for working in a checkout of this repository: layout, environments,
+commands, CI and release. It is not the API reference and it does not ship.
+
+- **Public API contract** (every export, signature and gotcha):
+  [`src/pathlib_next/AGENTS.md`](src/pathlib_next/AGENTS.md). That file ships in
+  the wheel, so it must stay self-contained (no repo-relative links) and must be
+  updated in the same commit as any public API change.
+- **Deliberate differences from `pathlib.Path`**:
+  [`docs/divergences.md`](docs/divergences.md). `pathlib.Path` parity is the
+  contract; a behavioral divergence that is not recorded there is a bug.
+
+## Layout
+
+| Path | Contents |
+| --- | --- |
+| `src/pathlib_next/` | The package (`src/` layout). `py.typed` and the API header ship with it. |
+| `src/pathlib_next/uri/schemes/` | One module per URI scheme; registered through the `pathlib_next.schemes` entry points in `pyproject.toml`. |
+| `tests/` | The pytest suite. |
+| `benchmarks/` | `bench.py` and committed JSON results; see [`benchmarks/README.md`](benchmarks/README.md). Not shipped. |
+| `examples/` | Runnable scripts. Networked ones skip (exit 0) unless their environment variables are set. |
+| `docs/`, `mkdocs.yml` | MkDocs site: hand-written pages plus a `mkdocstrings` API reference. |
+| `CHANGELOG.md` | Keep a Changelog. Released sections are frozen records. |
+
+## Environments
+
+Python 3.9 is the floor (`requires-python = ">=3.9"`) and 3.14 is the latest
+supported. Test on both ends before claiming a change works.
+
+Keep one virtualenv per interpreter under `.venv/<version>-<os>-<arch>/`
+(gitignored), where `<os>` is `os.name` (`nt`/`posix`) or `darwin`, and `<arch>`
+is the architecture the interpreter was built for:
+
+```bash
+python -m venv .venv/3.14-posix-x86_64
+.venv/3.14-posix-x86_64/bin/python -m pip install -e ".[dev,docs,uri,http,sftp,sftp-async,s3,gs,az]"
+```
+
+On Windows the interpreter is `.venv\<name>\Scripts\python.exe`.
+
+Install every extra that has tests. A missing extra does not fail the suite:
+its tests are skipped instead, so check `pytest -rs` before trusting a green run.
+The `gs`/`az` SDKs are the ones most likely to be unavailable for an older
+interpreter or a less common platform; without them their contract suites skip.
+
+## Everyday commands
+
+```bash
+python -m pytest -q                                  # full suite (pythonpath=src is configured)
+python -m pytest -q --cov=pathlib_next --cov-report=term-missing
+python -m black src/ tests/ benchmarks/ examples/    # formatting; --check to verify
+mkdocs build --strict                                # docs must build with no warnings
+python -m build                                      # sdist + wheel into dist/
+```
+
+- **Formatting is black**, pinned to `target-version = ["py39"]` so it never
+  emits syntax the floor cannot parse. No linter or type checker is enforced.
+- **Every file is LF** (`.gitattributes` sets `* text=auto eol=lf`). On Windows,
+  black writes CRLF: convert the files back to LF after formatting and check
+  `git diff --stat` for whitespace-only churn.
+- **3.9 compatibility**: any module using `X | Y` in a runtime-evaluated
+  annotation needs `from __future__ import annotations`.
+- **`*.local.*` files** are per-machine overrides: gitignored and excluded from
+  both build targets. Keep hostnames and credentials in those, never in tracked
+  files.
+
+## Benchmarks
+
+`python benchmarks/bench.py --help` lists the suites. `--save` writes a JSON
+result per (version, interpreter, platform) into `benchmarks/results/`; the
+schema and the reproduce command are in
+[`benchmarks/README.md`](benchmarks/README.md). A local run is a sanity check;
+performance claims in the changelog or release notes come from CI runs.
+
+## CI
+
+Workflows live in `.github/workflows/`:
+
+- `test.yml` runs on `workflow_dispatch` (optional `ref` input) or on a pushed
+  `ci-*` tag, never on ordinary pushes. To test a commit without the dashboard,
+  push a uniquely named throwaway tag (`ci-<topic>-<timestamp>`), follow the run
+  to completion, then delete the tag locally and on the remote.
+- `release.yml` runs on a `v*` tag: test gate, build, PyPI publish through
+  Trusted Publishing, and a GitHub release whose notes come from that
+  version's `CHANGELOG.md` section. Its docs job only checks that the site
+  builds strictly; it never deploys.
+- `docs.yml` owns every GitHub Pages deploy: on a published release, on a push
+  to `main` that touches the docs sources, and on `workflow_dispatch`.
+
+## Releasing
+
+1. Move the `[Unreleased]` entries under a new `## [x.y.z] - <date>` heading and
+   add its link definition at the bottom of `CHANGELOG.md`.
+2. Bump `version` in `pyproject.toml` in the same commit (PEP 440 syntax there;
+   SemVer in tags and the changelog).
+3. Before 1.0, bump the minor only when the documented API breaks. New methods,
+   new optional arguments and fixes are patch releases.
+4. Run the full suite on the floor and latest interpreters, `mkdocs build
+   --strict`, `python -m build`, and the maintainer's leak check (a scan for
+   private references and agent-attribution commit trailers). Judge it by exit
+   code.
+5. Push `main`, then the `v*` tag. Publishing is irreversible, so the tag is
+   pushed only with the maintainer's explicit consent for that specific
+   release.
+
+Changelog entries say what changed and what a user must do about it. They do
+not describe how the work was done.
+
+## Commits
+
+- Logical commits in `type: description` form (`feat:`, `fix:`, `docs:`,
+  `chore:`); keep code with its tests, and docs/config/CI in separate commits.
+- No agent attribution in commit messages: no `Co-Authored-By:` naming a model
+  or assistant, no `*-Session:` trailers, no session URLs, no "generated with"
+  footers.

{pathlib_next-0.9.3 → pathlib_next-0.9.4}/CHANGELOG.md

@@ -7,6 +7,452 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.9.4] - 2026-09-16
+
+### Fixed
+- **`Path.copy()` destroyed or created the target when the source could not
+  be read.** It unlinked an existing target (with `overwrite=True`) and
+  opened the target for writing before opening the source, so a missing
+  file, a directory without `recursive=True`, or a source HTTP 404 left the
+  target empty, or left a new 0-byte file that made a retry fail with
+  `FileExistsError`. The source is now opened first, and a copy that fails
+  mid-stream removes its partial target.
+- **Copying or moving a file onto itself deleted it.** `f.copy(f,
+  overwrite=True)` (or onto a case-insensitive alias such as `F.TXT` on
+  Windows/macOS) emptied the file; a case-only rename with
+  `move(overwrite=True)` deleted it. `copy()` now raises
+  `OSError(EINVAL, "Source and target are the same file")`; `move()` renames
+  in place.
+- **`move(overwrite=True)` removed the target before checking the source.**
+  A missing source, or a file moved onto a directory, deleted the target
+  (including a whole tree) and only then raised. It now raises
+  `FileNotFoundError` / `IsADirectoryError` first and leaves the target
+  alone. A local file target is replaced atomically with `os.replace()`, so a
+  locked source on Windows no longer costs the target.
+- **`rm(recursive=True)` deleted files outside the tree through Windows
+  junctions and `file:` directory symlinks.** A junction reads as a
+  directory to a non-following stat, and `UriPath`'s default `_scandir()`
+  used a following stat, so both were descended into and their targets'
+  contents deleted. Both are now removed as links. `FileUri` listings also
+  reuse `LocalPath`'s scandir metadata (one call per directory).
+- **`PathSyncer.sync()` could delete or write outside its target.**
+  - A root source that does not exist now raises `FileNotFoundError`.
+    Before, with `remove_missing=True` it deleted the entire target (a typo,
+    an unmounted share, a 404); without it, it reported success. **Callers
+    that relied on syncing an absent source as a no-op must now catch the
+    error or pass `ignore_error`.**
+  - Overlapping source and target (one inside the other, same
+    implementation and backend) now raise `ValueError`. Before, the source
+    could be deleted, or copies nested until `RecursionError`.
+  - A child name that would leave the target (`..`, a name the parent-name
+    fallback turned into `..`, or `\`/`:` on a Windows target) now raises
+    `ValueError` through `ignore_error`. Before, such entries from an S3,
+    SFTP or archive listing were written, or removed, outside the target.
+  - Entries listed with an unknown stat (GitLab blobs, FTP without MLSD) are
+    now re-stat'd. Before, with `follow_symlinks=False` nothing was copied
+    and `remove_missing=True` deleted the existing mirror.
+  - A symlink inside the target is replaced by the real file or directory.
+    Before, sync listed, wrote and deleted through it, into whatever it
+    pointed at.
+- **`http:`/`dav:` listings yielded `.` and `..` as children.** wsgidav's
+  parent row (`<a href="..">`) became a file named `..`, and unlinking it
+  deleted the parent collection; a `./` entry made `walk()` loop forever; a
+  PROPFIND href `%2E%2E/` let a recursive copy write outside its destination.
+  Such names are no longer listed.
+- **`DavPath.unlink()` and `HttpPath.unlink()` deleted whole collections.**
+  They sent a bare `DELETE`, which WebDAV applies recursively; `unlink()` on
+  a directory, and `symlink_to(force=True)` over one, removed the tree. Both
+  now raise `IsADirectoryError` for a directory (`HttpPath` relies on its
+  HEAD-based directory check). `rm(recursive=True)` still deletes trees.
+- **`DavPath` read an HTTP error page as file content.** `open("rb")` /
+  `read_bytes()` / `copy()` on a missing or forbidden file returned the
+  server's 404/401/500 body. They now raise `FileNotFoundError` /
+  `PermissionError` / `OSError`.
+- **Reading a local `zip:` archive opened it for writing.** A read-only zip
+  was unreadable (`exists()` returned `False`), `exists()` on a missing
+  archive created it, and probing a file that is not a zip appended 22 bytes
+  to it. Reads now open the archive read-only; the first write into a
+  missing archive creates it. Probing a non-zip file now raises
+  `zipfile.BadZipFile`.
+- **Zip `unlink()`/`rename()`/overwrite reset every other member.** The
+  rewrite gave all members the current time, DEFLATE compression and mode
+  0600, and dropped the archive comment and any leading bytes (a zipapp
+  shebang); it also replaced a symlinked archive with a regular file. Member
+  metadata, the comment, the prefix bytes and the archive's file mode are
+  now kept, and a symlinked archive stays a symlink.
+- **Zip `rename()` onto an existing member created a duplicate name**, and a
+  later rewrite kept the old content. It now replaces the target (POSIX
+  semantics; see `docs/divergences.md`).
+- **Archive listings exposed traversal member names.** Members named with
+  `..`, an absolute path, `\`-separated traversal or a drive prefix are no
+  longer listed, so `iterdir()`/`walk()`/`copy(recursive=True)` cannot write
+  outside a destination through them.
+- **`utils.unpack_archive()` let crafted members escape `dest` on Windows**
+  (`D:evil.txt`, and the same-drive `C:../C:../x`). Such members, and any
+  member with a `..` part (previously extracted with the `..` dropped), are
+  now skipped.
+
+- **`rename()`/`move()` renamed onto the wrong host, bucket or archive.**
+  Every scheme renamed through its own connection or bucket with only the
+  target's path: `SftpPath`/`FtpPath` moves to another server renamed on the
+  source server, `S3Path`/`GsPath` moves to another bucket landed in the
+  source bucket (overwriting an existing object of that name there), a zip
+  member moved to a local path was renamed inside the archive, and
+  `LocalPath.move()` onto a remote path renamed a local file. `rename()` now
+  raises `NotImplementedError` for a target on another endpoint, archive or
+  Azure container, and `move()` copies and deletes instead. `move()` also
+  falls back to copy + delete on a cross-device rename (`EXDEV`), and
+  `SftpPath.copy(recursive=True)` uses its concurrent fan-out only for a
+  target on the same host.
+- **Session credentials and tokens followed a join to another host.**
+  `base / "http://other/x"`, `UriPath(base, url)` and `base.with_source(...)`
+  reused `base`'s backend, so an `HttpPath.with_session(auth=...)` session or
+  a `github://TOKEN@...` token was sent to the other host. A backend is now
+  reused only for the same scheme, userinfo, host and port.
+- **`AzPath.rename()` with a `str` target always raised `TypeError`**, and a
+  pending copy crashed with `KeyError` after starting it. **`GsPath`/`AzPath`/
+  `S3Path.rename()` onto the same key deleted the object.** Both fixed.
+- **`FileUri.rename("b.txt")` resolved against the process cwd** and returned
+  a `LocalPath`. It now renames within the same directory and returns a
+  `FileUri`.
+- **`MemPath.copy("/b.txt")`/`move("/c.txt")` wrote into a new, empty
+  in-memory filesystem**, and `move()` then deleted the source. A `str`
+  destination now stays on the source's backend.
+
+- **`SftpPath.copy()` raised `ModuleNotFoundError` without asyncssh**
+  (paramiko-only `sftp` extra), including every single-file download and
+  `PathSyncer` with an SFTP source.
+- **SFTP connections leaked or went stale.** A first-call asyncssh
+  `rm(recursive=True)` hung for 60 s and deleted nothing; dropped paramiko
+  connections and closed asyncssh SFTP channels were never replaced, so every
+  later call failed and `exists()` returned `False`; evicted connections,
+  failed logins and failed SFTP starts leaked sockets and threads; concurrent
+  first calls opened duplicate connections; a recursive copy held two remote
+  handles open per file in the tree; `SftpPath(url, ssh_config=...)` ignored
+  `ssh_config`; the paramiko backend ignored ssh_config `Include`.
+- **`UriPath("ftps://...")` returned a stub `UriPath` in a fresh process**
+  instead of `FtpPath`.
+- **URL credentials leaked into HTTP errors and redirects.** They are now sent
+  as Basic `auth=` instead of inside the request URL, WebDAV `MOVE`
+  `Destination` no longer carries them, and translated errors no longer chain
+  the `requests` exception (`__cause__` is `None`; the message carries the
+  HTTP status and reason). URL credentials now take priority over a matching
+  `~/.netrc` entry.
+- **`github:`/`gitlab:` tokens leaked through `str()`/`repr()`/errors**, and
+  `user:TOKEN@host` authenticated with the username. The token is now read
+  from the password slot when present, and these schemes redact the whole
+  userinfo.
+
+- **`glob()`/`rglob()` crashed, hung or returned wrong results.**
+  `glob("**")` and `glob("dir/**")` raised `NotADirectoryError` on any tree
+  containing a file; `**` followed directory symlinks, so a symlink loop
+  produced duplicates effectively forever; globbing under a missing directory
+  or a file raised instead of yielding nothing; repeated `**` returned
+  duplicates; a trailing `/` matched files on `MemPath` and URI paths; `?`
+  never matched on a `UriPath` (read as a query); `glob.full_match()` slowed
+  down exponentially with repeated `**`. A trailing `**` now follows the
+  running Python (files too on 3.13+).
+- **`match()` on `MemPath`, `Uri` and every `UriPath` did not follow
+  pathlib.** It anchored at the start and let `*` cross `/`, and a URI's
+  `host:` prefix defeated absolute patterns. It is now pathlib's
+  right-anchored per-segment match; an empty pattern raises `ValueError`.
+  `LocalPath` accepts `match(case_sensitive=)` on 3.9-3.11, and its
+  `full_match()` handles rooted, drive and backslash patterns before 3.13.
+- **`parents`/`parent` of an absolute `MemPath` or `Uri` lost the root.**
+  `MemPath('/a/b').parents` is now `['/a', '/']`; `Uri('http://h/a').parent` is
+  `http://h/`; a top-level `FileUri`'s parent is `/` (or the drive root
+  `C:/` on Windows) instead of resolving to the current directory.
+  `relative_to()`/`is_relative_to()` treat `s3://bucket`/`http://h` as the
+  root, so `relative_to(p.parent)` and `walk_up=True` work.
+- **`with_name()`/`with_stem()`/`with_suffix()` accepted `''`, `.` and
+  separators** on `MemPath` and `Uri`, splicing `x/y` or `../../etc` into a
+  path. They now raise `ValueError` like pathlib.
+- **`MemPath` did not normalize like `PurePosixPath`.** `MemPath('/') / 'a'`
+  was `//a` and unequal to `MemPath('/a')`; a trailing `/` changed equality;
+  an absolute join did not reset. All now match `PurePosixPath`.
+- **`Path.touch()` made new files world-writable and could truncate existing
+  ones.** It chmod'ed every new file to 0o666 ignoring the umask (`file:`,
+  SFTP, FTP) and treated any `stat()` error as "missing". `mode` now defaults
+  to `None` (chmod only when passed), an existing file is never truncated, and
+  `FileUri.touch()` uses pathlib's `touch()`.
+- **`copy()` made local copies read-only.** `preserve_metadata=True` applied
+  the placeholder 0o444/0o555 mode that `MemPath`, HTTP, WebDAV, object stores
+  and archives report, so a copied file could not be overwritten or re-synced.
+  Placeholder modes are no longer applied (`FileStat.mode_known`).
+- **`utils.parsedate()` read GMT dates as local time**, so every HTTP/WebDAV
+  `st_mtime` was off by the host's UTC offset, and it raised `OverflowError`
+  on Windows east of UTC. It now returns UTC epoch seconds and passes numbers
+  through.
+- **`s3://b/dir/` (trailing slash) was treated as the marker object**: not a
+  directory, and `rm(recursive=True)` removed only the marker. S3, GCS and
+  Azure keys now drop one trailing `/`. Azure keys keep interior empty
+  segments (`a//b`) as written.
+- **`GsBackend` rewrote the process-wide `STORAGE_EMULATOR_HOST`** and dropped
+  other `client_options`. Keyword arguments now go to `storage.Client`
+  unchanged; for an emulator also pass `use_auth_w_custom_endpoint=False`.
+
+- **URI queries were corrupted on the wire.** They were percent-decoded at
+  parse time and re-encoded with `&`, `=` and `+` treated as safe, so a signed
+  URL's `sig=ab%2Bcd%3D%3D` reached the server as `ab+cd==` and an escaped `&`
+  split a value; `with_query(dict)` double-encoded. `Uri.query` is now kept as
+  received and sent unchanged (see Changed).
+- **A remote path joined with a relative `pathlib.Path` became a local
+  file.** `UriPath("sftp://h/srv/") / pathlib.Path("etc/x")` produced
+  `file:/srv/etc/x`, so reads and writes hit the local disk. A relative path
+  now joins like a `PurePath` and stays on the remote; only an absolute local
+  path becomes `file:`. `UriPath.joinpath()` picks the class from the scheme.
+- **URIs with non-UTF-8 percent-escapes** (`caf%E9.html`) raised
+  `UnicodeDecodeError`; they now construct and round-trip. `data:` payloads
+  are no longer dot-normalized or decoded twice, and binary payloads work.
+- **Windows `file:` URIs**: `file://localhost/C:/...` could not be printed,
+  hashed or compared; a `file://<host>/share` whose host is this machine
+  mapped to the current drive instead of a UNC path.
+- **Scheme registry**: a `UriPath` subclass defined after the first dispatch
+  was never found, and every unknown scheme rescanned entry points.
+- **`open()` modes**: `rt`/`wt` failed on every non-local backend and invalid
+  modes raised `NotImplementedError`; modes are now validated like the
+  built-in `open()` (`ValueError`). `open("r+")` on buffered backends (FTP,
+  S3, GCS, Azure, local zip members) returned a writable buffer whose writes
+  were discarded; writes are now uploaded on close (or `NotImplementedError`
+  where impossible).
+- **`copy()`**: `copy(recursive=True)` into its own subtree recursed without
+  limit; `copy(follow_symlinks=False)` copied the link target's content with
+  the link's 0o777 mode (it now recreates the link, as pathlib 3.14 does);
+  `overwrite=False` was decided by `exists()`, which reads a transient 503 as
+  "missing". Downstream classes mixing a concrete stdlib path with `Path` now
+  also get pathlib_next's `stat`/`chmod`/`glob`/`walk`/`_scandir`.
+- **`MemPath`**: `iterdir()` on a missing path raised `NotADirectoryError`;
+  files always reported `st_mtime=0`, so `PathSyncer` skipped same-size edits.
+- **Archives (`zip:`/`tar:`/`archive:`)**: children of the archive root were
+  named `/name` and matched no member, so `iterdir`/`glob`/recursive `copy`
+  from the root failed; tarballs with `./` members (`tar -C dir .`,
+  `shutil.make_archive`) were unreadable; adding a zip member rewrote the
+  central directory in place (a crash corrupted the archive); a cached handle
+  ignored changes by other writers and kept the file locked on Windows;
+  archive URIs did not round-trip names with `#`, `?` or `%`; concurrent tar
+  reads returned wrong bytes; stored member modes were ignored; `iterdir()` on
+  a file returned `[]`. `utils.make_archive()` now accepts any `Path` source,
+  writes the target only when complete and supports zip64;
+  `utils.unpack_archive()` accepts non-seekable streams and extracts tar links.
+- **HTTP/WebDAV**: gzip-encoded responses were returned compressed (and
+  rewrite-mode append re-uploaded them); a redirect made `stat()` report a
+  directory; listing hints fabricated sizes used as the patch-append offset;
+  mid-body read failures raised urllib3 exceptions; `DavPath` listed a
+  directory with a space in its name as its own child, treated a 207
+  Multi-Status with failed members as success, re-sent a failed PUT at garbage
+  collection and raised raw `requests.HTTPError`s; `with_session(headers=...)`
+  was replaced by internal headers.
+- **GitHub/GitLab**: GitLab listings stopped after 100 entries (and `stat()`
+  called later subdirectories missing); GitHub listings stopped at 1,000;
+  self-hosted API roots dropped the port; GitLab root `stat()` answered from
+  the URI shape without asking the server.
+- **`uripath` CLI**: `sync` compared sizes only, so same-size edits were never
+  copied; `--dry-run` printed nothing; `read`/`cp -` buffered whole objects.
+- **FTP**: every separately built path opened its own connection; an error
+  mid-transfer desynchronized the cached connection for good; a write whose
+  connection timed out while idle lost its data; without MLSD, directories
+  stat'ed as missing; MLSD mtimes were read as local time; permission errors
+  surfaced as `FileNotFoundError` and raw `ftplib` errors escaped.
+- **S3/GCS/Azure**: botocore `ClientError` escaped `exists()`/`walk()` and a
+  403 read as "missing"; GCS/Azure turned every exception (including a missing
+  SDK) into "does not exist", so `copy(overwrite=False)` could overwrite;
+  `iterdir()` on a missing path returned `[]` and `rmdir()`/`unlink()` accepted
+  wrong-type targets; a failed upload was retried at garbage collection over
+  newer data; prefix-directory `move()` failed; S3 objects above 5 GiB could
+  not be written or renamed; `open("x")` was a check-then-put race;
+  `AzPath` without `backend=` ignored the URI's account; Azure recursive `rm()`
+  stopped at the first failing blob in a batch.
+- **`PathSyncer`**: an interrupted copy lost the previous version (it now
+  writes a temporary sibling and renames); preserve mode deleted the target
+  before discovering symlinks were unsupported; dry runs crashed on new
+  subdirectories; `RemovedMissing` events carried the parent directory;
+  `ignore_error` was called once per ancestor with the wrong paths; two
+  unknown (0) mtimes counted as "in sync"; FIFOs and devices replaced the
+  target with an empty directory.
+- **SFTP**: `rename()` onto an existing file failed with a bare
+  `OSError("Failure")`; `unlink(missing_ok=True)` skipped dangling symlinks;
+  a relative `readlink()` result could not be printed; asyncssh file handles
+  made one round trip per byte in `readline()` and an unclosed handle hung
+  interpreter exit for 60 s; the asyncssh recursive copy called a bool
+  `ignore_error` and ignored the own-subtree and symlink rules; paramiko's
+  native checksum probed an extension OpenSSH does not implement, paying extra
+  round trips per file.
+
+- **`rename()` returned `None`** on `dav:`, `s3:`, `gs:`, `az:`, `ftp:` and
+  `sftp:`; it now returns the new path, as pathlib does.
+- **Wrong exception types on `sftp:`, `dav:`, `gitlab:` and `MemPath`.**
+  Listing or `rmdir()` of a file raises `NotADirectoryError`, `rmdir()` of a
+  non-empty directory `OSError(ENOTEMPTY)` (`MemPath` raised
+  `FileExistsError`), opening or unlinking a directory `IsADirectoryError`;
+  `dav:` reading a collection raised nothing and returned its HTML index, and
+  `rmdir()` of a missing path raised `NotADirectoryError`. paramiko
+  `open("x")` returned a file that could not be written.
+- **`Path.rm(recursive=True, ignore_error=callable)`** offered a declined
+  error to the callable again from every enclosing directory.
+- **`uripath` crashed at import without the `uri` extra**, even for local
+  files. Local paths and `-` now work; a URI argument reports the extra to
+  install. Without the extra it also read every colon name as a URI
+  (`uripath read notes:draft` asked for `pathlib-next[uri]` instead of
+  reading the file); the schemes this package registers are now read from
+  its entry points, so a colon name behaves the same in either install.
+- **`match()` disagreed with pathlib on Python 3.12** at the root. 3.12
+  matches the whole path as one string with its separators swapped for
+  newlines, so `"/"` is a single newline that `"**"` matches from either
+  side (`"/".match("**")`, `match("/**")` and `match("**/**")` are all
+  `True` there) while `"*"` never does, and a bracket expression such as
+  `"[!a]"` consumes the separator itself. `MemPath`/`Uri` answered `False`
+  throughout; 3.12 now runs a port of that algorithm instead of the
+  part-by-part comparison every other version uses.
+- **`import pathlib_next` imported `netimps`** (a host-name query at import,
+  slow on Windows), and the first `file:`/`data:` path imported `requests`
+  and `botocore`; both now load on first use. `GsPath`/`AzPath` are exported
+  from `pathlib_next.uri.schemes`.
+- **`*.local.*` files shipped in the sdist and wheel.**
+- **The SFTP/FTP/WebDAV examples** built URIs from unencoded credentials (a
+  password containing `/`, `#`, `?` or `@` changed the host) and printed the
+  password.
+- **`benchmarks/bench.py` crashed at import on Python 3.9.**
+- **Docs**: the CI benchmark table had its Ubuntu, Windows and macOS columns
+  rotated; the paramiko single-file write/copy slowdown was on Ubuntu.
+
+- **Core, MemPath and URI edge cases.** `open()` leaked the backend handle
+  when the text wrapper failed; synthesized errors from `rm()`/`touch()` and
+  `MemPath` lacked `errno`/`filename`; `copy(progress=)` never reported a
+  zero-byte file; `samefile(str)` lost the backend or host; `MemPath` handles
+  appended at the seek position, hid unflushed writes and accepted writes on
+  read handles, and exclusive create/`mkdir` could both succeed under
+  concurrency; `FileStat.from_stat()` kept `None` fields; checksums failed on
+  FIPS hosts (`usedforsecurity=False`); `is_dir()`/`is_file()` rejected
+  `follow_symlinks=`; `"prefix" / path` was unsupported; suffix/stem ignored
+  3.14's rules; lazy URI parsing could expose unset components to another
+  thread; `Uri.__eq__` raised against a relative local path; a `//` path with
+  no authority could not be rendered; non-ASCII hosts were sent
+  percent-encoded; `Uri("/a").is_absolute()` was `False`; `data:` accepted
+  `r+` and discarded writes.
+- **Scheme and CLI edge cases.** FTP listed MLSD `cdir`/`pdir` entries named
+  like children; archives nested in archives could not be addressed;
+  GitLab `iterdir()` on a file yielded nothing; GitHub/GitLab 429 and
+  secondary rate limits were not recognised; `git://<ip>` raised
+  `AttributeError`; a custom `BaseRepoBackend` without a cache crashed on
+  GitLab; git-hosting `open("r+")` returned a writable buffer; `uripath cp -`
+  overwrote an existing target without `--overwrite`, a local name with a
+  colon was treated as a URI, and a closed pipe or Ctrl-C printed errors;
+  `HttpPath.iterdir()` on a file downloaded it; HTTP 409 on PUT and 410 were
+  mis-mapped; WebDAV read only the first `<propstat>`; HTTP listings behind a
+  prefix were scoped by the page title; S3/GCS listings disagreed with
+  `stat()` when a key was both an object and a prefix; GCS/Azure roots always
+  reported existing; asyncssh SFTP errors had no `errno`/`filename`.
+- **`PathSyncer` edge cases.** Tolerated errors left no trace; a directory
+  that became a file or symlink in the source deleted the target directory
+  even with `remove_missing=False`; `SyncStart` passed raw paths to the hook
+  and dry runs reported `dry_run=False` for traversal events; preserved
+  directory symlinks were created as file links on Windows; an identical
+  symlink was recreated on every run; `PathAndStat(path)` described a symlink
+  itself instead of following it.
+
+### Changed
+- **`PathSyncer` keeps non-empty target directories on a type change unless
+  `remove_missing=True`** (`IsADirectoryError` through `ignore_error`,
+  `SyncEvent.TypeMismatch`). Every tolerated error is now logged at WARNING
+  on `pathlib_next.sync` and reported to the hook as `SyncEvent.Error`.
+  `PathAndStat` follows symlinks by default. `PathSyncer.hook()` gains a
+  keyword-only `always_run`.
+- **URI comparisons and rendering**: `Uri == <non-URI Pathname>` (e.g. a
+  `LocalPath`) is now `False` (a `Uri` still equals another `Uri` or a URI
+  string); non-ASCII hosts are rendered in IDNA form; an explicit
+  `schemesmap=` is authoritative (an unknown scheme gives a plain `UriPath`);
+  `with_source()` with a scheme-less source returns a plain `UriPath`; `/` no
+  longer hides a `TypeError` raised inside a scheme class.
+- **`data:` URIs** reject `r+`, decode base64 only with `;base64`, and imply
+  `text/plain` for a parameters-only header.
+- **`uripath`** exits 141 on a closed stdout and 130 on Ctrl-C.
+- **Package metadata uses PEP 639** (`License-Expression: MIT`) instead of
+  the `License ::` classifier, and adds `Typing :: Typed`,
+  `Development Status :: 4 - Beta` and Python 3.9-3.14 classifiers. Building
+  from source needs `hatchling>=1.27`.
+- **The `az` extra installs `azure-identity`**, which an `AzPath` without
+  `backend=` needs for its default credential.
+- **`pathlib_next.testing` contracts are stricter**: 48 `PathContract` tests
+  (was 20) covering pathlib error types, glob, walk, rename, open modes and
+  recursive copy. A backend that cannot meet a rule sets a capability
+  attribute to `False` (`supports_listing`, `supports_empty_directories`,
+  `distinguishes_file_types`, `supports_rename`, `supports_append`,
+  `supports_exclusive_create`, `enforces_directory_hierarchy`). The contract
+  root must be a fresh, function-scoped directory populated with
+  `populate_fixture_tree()`. `test_iterdir_lists_children` no longer passes
+  when `iterdir()` is unimplemented.
+- **`Uri.query` is the percent-encoded query as received** and is sent
+  unchanged; `Query(...).decode()`/`to_dict()` decode each name and value
+  once. A `str` passed to `with_query()` is taken as already encoded; a
+  mapping's keys now escape `=`. Code that read `.query` expecting decoded
+  text must decode it.
+- **Archive paths raise pathlib's POSIX exception types** (`iterdir()` on a
+  file, reading or `unlink()`ing a directory, `rmdir()` on a file), and
+  `mkdir()`/new zip members need an existing parent. Zip `rename()` returns the
+  new path. Archive `as_uri()` percent-encodes the member path.
+- **`uripath sync` compares file content by default**; `--size-only` restores
+  the old comparison. `--dry-run` prints planned changes and `-v/--verbose`
+  prints changes made.
+- **`gitlab:` reads a `-` segment at position 3 or later as GitLab's `/-/`
+  separator** (`gitlab://host/group/sub/project/-/path`).
+- **`SftpPath.rename()` replaces an existing target** where the server
+  supports `posix-rename@openssh.com`, else raises `FileExistsError`.
+- **`DavPath` maps request errors to pathlib exceptions** (PUT/MOVE into a
+  missing parent: `FileNotFoundError`; 423: `PermissionError`).
+- **`Path.glob()`/`rglob()`/`LocalPath.glob()` include hidden files and
+  directories by default**, as pathlib does. Pass `include_hidden=False` for
+  the old results. `glob("")` now raises `ValueError` and an absolute pattern
+  raises `glob.NonRelativePatternError`; before, `""` yielded the base and an
+  absolute pattern listed outside it.
+- **SFTP host keys are verified by default on both backends.** Before, any
+  server key was accepted (asyncssh even overrode ssh_config pinning), so a
+  man-in-the-middle received the URI password. Now an unknown or changed key
+  fails before credentials are sent. paramiko uses `~/.ssh/known_hosts`,
+  ssh_config `UserKnownHostsFile` and `RejectPolicy`. **To keep the old
+  behaviour** add the host to `known_hosts`, or opt out explicitly:
+  `SftpBackend(connect_opts, paramiko.AutoAddPolicy(), known_hosts=None)` /
+  `AsyncsshSftpBackend(connect_opts={"known_hosts": None})`.
+- **`ftps:` verifies the server certificate and host name by default.**
+  Before, any certificate was accepted and the password sent to it. For a
+  private CA pass `FtpBackend(ssl_context=ssl.create_default_context(cafile=...))`;
+  `FtpBackend(verify=False)` disables verification. Data connections now reuse
+  the TLS session (vsftpd, FileZilla Server).
+- **Network operations have default timeouts.** HTTP/WebDAV/github/gitlab:
+  `(10, 60)` s connect/read (`with_session(..., timeout=...)`,
+  `RepoBackend(timeout=...)`); FTP: 30 s (`FtpBackend(timeout=...)`); paramiko
+  connect/banner/auth/channel-open: 30 s (`SftpBackend(..., timeout=...)`).
+  `timeout=None` restores the unbounded wait. Before, a stalled server hung
+  the caller forever.
+- **asyncssh timeouts apply to single requests only**
+  (`AsyncsshSftpBackend(timeout=...)`, default 60 s). Recursive
+  `copy()`/`rm()` and `read_bytes()`/`write_bytes()` no longer raise after
+  60 s while the work continued in the background. A timed-out request is
+  cancelled and raises the builtin `TimeoutError` on every Python version (on
+  3.9/3.10 it was `concurrent.futures.TimeoutError`).
+- **paramiko backend: ssh_config `ProxyJump` raises `NotImplementedError`.**
+  Before, it was ignored and the connection went direct. Use asyncssh, a
+  `ProxyCommand`, or `connect_opts["sock"]`.
+- **asyncssh `rm()`/`copy()` error callbacks run in a worker thread**, so they
+  may call ordinary path methods; a sync SFTP call made on the bridge-loop
+  thread raises `RuntimeError` instead of hanging.
+
+### Added
+- `SyncEvent.Error` and `SyncEvent.TypeMismatch` reporting; `str / path`
+  (`__rtruediv__`) on `Pathname` and `Uri`.
+- `pathlib_next.testing.populate_fixture_tree(root)` and `FIXTURE_TREE`.
+- `benchmarks/bench.py --save` (min/median/max ms per call as JSON under
+  `benchmarks/results/`) and `--samples`.
+- `SyncEvent.Compare` and `SyncEvent.Skipped`; `uripath sync --size-only` and
+  `-v/--verbose`.
+- `glob.parse_pattern()`, `glob.select()`, `glob.NonRelativePatternError`;
+  `recurse_symlinks=False` on `glob()`/`rglob()`; `FileStat.mode_known`.
+- `close()` on `SftpBackend`/`AsyncsshSftpBackend`; `FtpBackend(timeout=,
+  ssl_context=, verify=)`; `RepoBackend(timeout=)`; `utils.LRU(on_evict=...)`
+  and `LRU.discard()`.
+- `utils.is_safe_child_name(name, *, windows=False)` and
+  `utils.is_windows_flavoured(path)`: check that an untrusted name stays a
+  single component inside its parent before joining it onto a destination.
+
 ## [0.9.3] - 2026-08-16
 
 ### Fixed
@@ -30,7 +476,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   Nothing raised. When something already occupied the truncated name the call
   instead failed with a bare `OSError: Failure`, so the symptom was either
   silent misplacement or an unexplained error depending on what happened to
-  be there. Downstream, `pytruenas`'s documented
+  be there. Downstream, a consumer's documented
   `client.path(x).symlink_to(y)` route created a wrong link, and
   `PathSyncer`'s `symlink_mode="preserve"` (which hands `symlink_to()` the
   raw target string `readlink()` returned) mirrored such a link to the wrong
@@ -823,10 +1269,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - Sync error handling.
 - Generic Path Protocol based pathlib implementation for URI paths with file access support for sftp, http, file schemes.
 
-[Unreleased]: https://github.com/jose-pr/pathlib-next/compare/v0.9.3...HEAD
+[Unreleased]: https://github.com/jose-pr/pathlib-next/compare/v0.9.4...HEAD
+[0.9.4]: https://github.com/jose-pr/pathlib-next/compare/v0.9.3...v0.9.4
 [0.9.3]: https://github.com/jose-pr/pathlib-next/compare/v0.9.2...v0.9.3
 [0.9.2]: https://github.com/jose-pr/pathlib-next/compare/v0.9.1...v0.9.2
 [0.9.1]: https://github.com/jose-pr/pathlib-next/compare/v0.9.0...v0.9.1
+[0.9.0]: https://github.com/jose-pr/pathlib-next/compare/v0.8.6...v0.9.0
 [0.8.6]: https://github.com/jose-pr/pathlib-next/compare/v0.8.5...v0.8.6
 [0.8.5]: https://github.com/jose-pr/pathlib-next/compare/v0.8.4...v0.8.5
 [0.8.4]: https://github.com/jose-pr/pathlib-next/compare/v0.8.3...v0.8.4
@@ -837,6 +1285,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 [0.7.0]: https://github.com/jose-pr/pathlib-next/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/jose-pr/pathlib-next/compare/v0.5.0...v0.6.0
 [0.5.0]: https://github.com/jose-pr/pathlib-next/compare/v0.4.1...v0.5.0
-[0.4.1]: https://github.com/jose-pr/pathlib-next/compare/v0.4.0...v0.4.1
-[0.4.0]: https://github.com/jose-pr/pathlib-next/releases/tag/v0.4.0
-[0.3.5]: https://github.com/jose-pr/pathlib-next/releases/tag/v0.3.5
+[0.4.1]: https://github.com/jose-pr/pathlib-next/compare/82caebc61dbd87928474425d7fd784baf6a4aaab...v0.4.1
+[0.4.0]: https://github.com/jose-pr/pathlib-next/compare/22cbb198d6b0c5c187d6f0dcc35990ace8eb2950...82caebc61dbd87928474425d7fd784baf6a4aaab
+[0.3.5]: https://github.com/jose-pr/pathlib-next/tree/22cbb198d6b0c5c187d6f0dcc35990ace8eb2950