pyproject-api 1.12.1__tar.gz → 1.12.3__tar.gz

pyproject_api-1.12.3/.github/SECURITY.md

@@ -0,0 +1,51 @@
+# Security policy
+
+pyproject-api is a Python library that drives a project's PEP 517 build backend from a separate process. This policy
+says how to report a security problem and how we decide whether a report is one.
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.** Use
+[GitHub's private vulnerability reporting](https://github.com/tox-dev/pyproject-api/security/advisories/new). If neither
+works for you, email [gaborjbernat@gmail.com](mailto:gaborjbernat@gmail.com).
+
+Include what the attacker controls and what they gain, the steps or a proof of concept, and the versions and platform
+you tested. Write the report yourself; unreviewed tool or model output takes longer to triage.
+
+## What to expect
+
+Volunteers maintain pyproject-api, with no on-call rotation. We aim to acknowledge a report within **5 working days**
+and assess it within **15 working days**. Fixes are developed in a private fork attached to the draft advisory, ship in
+a new release, and the advisory, with a CVE requested through GitHub, goes out with that release. The default embargo is
+**90 days** from the report; we agree any change with the reporter. We credit reporters in the advisory under the name
+they choose, or not at all. There is no bug bounty.
+
+## Supported versions
+
+Only the latest release receives fixes. Confirm the problem reproduces on it before reporting.
+
+## Vulnerability or bug
+
+A report is a vulnerability when an attacker who controls only an input that the [threat model](THREAT_MODEL.md) lists
+as untrusted breaks a guarantee pyproject-api makes. A report that first needs control of something the threat model
+trusts, such as the project being built and its build backend, is a bug: we fix it in the open and publish no advisory.
+Classify by who supplies the dangerous input, not by how bad the outcome sounds.
+
+**In scope**
+
+- A `build-system.backend-path` entry that resolves outside the project being accepted as an import location.
+- A frontend call writing a result or artifact outside the directory the caller named, including while extracting
+  `.dist-info` from a built wheel.
+- Clearing a metadata directory deleting the project root, one of its ancestors, or anything reached through a symlink
+  inside it.
+- A hook result naming a path outside its output directory, returned to the caller as the artifact or metadata path.
+- Results of one backend call being read as another call's, for example through a predictable result file.
+
+**Out of scope**
+
+- Code a build backend runs: building a project runs its backend, so building untrusted source runs untrusted code, as
+  PEP 517 intends.
+- What the backend writes into the artifacts it returns.
+- The interpreter, environment and `requires` the caller provisions for the backend.
+
+If you cannot tell which side a finding falls on, report it privately and we will decide.

pyproject_api-1.12.3/.github/THREAT_MODEL.md

@@ -0,0 +1,101 @@
+# Threat model
+
+This model says what pyproject-api trusts, where untrusted input enters, and which guarantees hold at each boundary, so
+a report can be classified as a vulnerability or a bug. [SECURITY.md](SECURITY.md) covers reporting; if the two
+disagree, SECURITY.md wins and we fix this file.
+
+## How pyproject-api works
+
+A frontend such as tox points pyproject-api at a project folder. pyproject-api reads `[build-system]` from
+`pyproject.toml`, checks that every `backend-path` entry stays inside the project, and starts the backend in a
+subprocess of the interpreter the caller chose: `SubprocessFrontend` starts a fresh one per call, while other frontends,
+such as tox's, can keep one alive across calls (`reuse_backend`). Each hook call (`build_wheel`,
+`prepare_metadata_for_build_wheel` and so on) goes to the backend's stdin as JSON, and the backend writes its answer to
+a temporary JSON file that the frontend reads back. Without a metadata hook, pyproject-api builds a wheel and extracts
+its `.dist-info` into the caller's metadata directory.
+
+```mermaid
+flowchart LR
+    fe["Frontend, e.g. tox<br/>(trusted)"] -->|project dir, python| api["pyproject-api"]
+    api -->|"reads [build-system]"| proj[("Project source")]
+    api -->|"spawn, JSON over stdin"| be["Backend subprocess<br/>runs project-chosen code"]
+    be -->|"result JSON in temp file,<br/>artifacts in output dir"| api
+    classDef trusted fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
+    classDef boundary fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
+    class fe,api trusted;
+    class proj,be boundary;
+```
+
+## Compared with similar tools
+
+We drew the boundary where comparable projects in other ecosystems draw theirs. The shared rule, stated by the
+[Node.js threat model](https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model), is that a report
+which first needs a trusted element compromised is out of scope; the first triage question, as
+[DOMPurify](https://github.com/cure53/DOMPurify/blob/main/SECURITY.md#what-we-consider-a-vulnerability) puts it, is what
+the attacker controls.
+
+| Project                                                                             | Language   | Where it draws the line                                                                                                                                                  |
+| ----------------------------------------------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| [Cargo build scripts](https://doc.rust-lang.org/cargo/reference/build-scripts.html) | Rust       | A package's `build.rs` runs with full rights during a build; building a crate means trusting it.                                                                         |
+| [Hatch](https://github.com/pypa/hatch/security/policy)                              | Python     | Assumes the user has full control over the build environment.                                                                                                            |
+| [pnpm](https://github.com/pnpm/pnpm/security/policy)                                | JavaScript | Draws its boundary at filesystem permissions: the store, project, lockfile and configuration are trusted, and running it in a repository means trusting that repository. |
+
+## Trusted
+
+An attacker who controls any of these already has what pyproject-api could give them:
+
+- The frontend and the project folder, interpreter, environment and output directories it passes.
+- The project's build backend and its `requires`; the backend runs with the user's rights.
+- The filesystem and temporary directory.
+
+## Untrusted inputs
+
+| Input                                        | Comes from                          | What pyproject-api guarantees                                                                                                       |
+| -------------------------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| `build-system.backend-path`                  | The project's `pyproject.toml`      | Each entry must be relative and resolve inside the project; otherwise the call fails.                                               |
+| Backend stdout and stderr                    | The backend and anything it imports | Captured and returned to the caller as text; hook results come only from the result file.                                           |
+| Malformed `[build-system]`                   | The project's `pyproject.toml`      | Wrong types raise a `ValueError` naming the key; a missing table falls back to the legacy setuptools backend, as PEP 517 specifies. |
+| Members of a built wheel                     | The backend                         | Only members under a top-level `.dist-info` directory are extracted, through `zipfile`'s path sanitizing.                           |
+| Entries inside a metadata directory to clear | Earlier builds, or the backend      | Refused when it is the project root or one of its ancestors; symlinks inside it are unlinked, never followed.                       |
+
+## Threats and controls
+
+| STRIDE                 | Threat                                                                  | Control                                                            |
+| ---------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------ |
+| Tampering              | `backend-path = ["../other"]` loads a backend from outside the project. | Entries outside the project are rejected.                          |
+| Spoofing               | Backend output printed to stdout is taken as a hook's result.           | Results travel through a per-call temporary JSON file, not stdout. |
+| Elevation of privilege | A backend runs code during a build.                                     | Accepted by design; PEP 517 builds run the project's code.         |
+
+## Release chain
+
+Releases run on the shared [tox-dev/github-workflows](https://github.com/tox-dev/github-workflows) pipeline. A release
+App, not a person, pushes the release commit and tag; the build installs its tools from a hash-checked `pylock.toml`
+resolved with a seven-day upload cooldown by default; PyPI receives the files through
+[trusted publishing](https://docs.pypi.org/trusted-publishers/) with attestations, and the GitHub Release is immutable.
+Every workflow pins third-party actions to a commit SHA.
+
+## Vulnerability or bug
+
+| Report                                                               | Verdict                                              | Why                                                          |
+| -------------------------------------------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------ |
+| `backend-path` with `../` imports a module from the parent directory | Vulnerability                                        | The in-tree guarantee of PEP 517 is broken.                  |
+| Building a malicious sdist runs its `setup.py`                       | Not a vulnerability                                  | The backend is trusted; build untrusted source in a sandbox. |
+| A backend that prints JSON confuses `get_requires_for_build_wheel`   | Bug, or vulnerability if the result file is bypassed | Results must come only from the result file.                 |
+
+## Severity
+
+- **High:** a frontend call deletes or writes outside the directory the caller named, or clearing a metadata directory
+  removes the project or follows a symlink inside it.
+- **Medium:** a `backend-path` outside the project is accepted, a hook's returned path escapes its directory, or one
+  call's result is read as another's.
+- **Low:** a malformed backend response crashes or hangs the frontend instead of failing with an error.
+
+## Accepted risks
+
+- Every hook call runs project code; isolation from the host is the caller's job.
+- The backend subprocess inherits the environment the caller passes, secrets included.
+
+## Keeping this current
+
+Revisit this model when pyproject-api gains a new input source, network access, a new way to run code, or a new place it
+writes to, and whenever an advisory is published.

pyproject_api-1.12.3/.github/dependabot.yaml

@@ -0,0 +1,30 @@
+version: 2
+multi-ecosystem-groups:
+  dependencies:
+    schedule:
+      interval: weekly
+      day: tuesday
+    labels:
+      - dependencies
+      - skip news
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    patterns:
+      - '*'
+    multi-ecosystem-group: dependencies
+    labels:
+      - dependencies
+      - skip news
+    cooldown:
+      default-days: 7
+  - package-ecosystem: pre-commit
+    directory: /
+    patterns:
+      - '*'
+    multi-ecosystem-group: dependencies
+    labels:
+      - dependencies
+      - skip news
+    cooldown:
+      default-days: 7

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/.github/workflows/news.yaml

@@ -7,6 +7,7 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+  pull-requests: read
 jobs:
   changelog:
     name: 📝 News fragment
@@ -24,9 +25,9 @@ jobs:
           python-version: "3.15"
           enable-cache: false
       - name: 📦 Install locked release tools
-        uses: tox-dev/github-workflows/install-locked-tools@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+        uses: tox-dev/github-workflows/install-locked-tools@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
         with:
           groups: release-news
           venv: ${{ runner.temp }}/release-tools
       - name: 🔍 Validate news fragments
-        uses: tox-dev/github-workflows/validate-news@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+        uses: tox-dev/github-workflows/validate-news@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/.github/workflows/prepare-release.yaml

@@ -16,7 +16,7 @@ permissions: {}
 jobs:
   prepare:
     name: 🏷️ Prepare Towncrier release
-    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
     permissions:
       contents: read
       pull-requests: read

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/.github/workflows/release.yaml

@@ -10,7 +10,7 @@ concurrency:
 jobs:
   build:
     name: 🏗️ Build
-    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
     permissions:
       contents: read
   github-notes:
@@ -33,17 +33,17 @@ jobs:
           python-version: "3.15"
           enable-cache: false
       - name: 📦 Install locked release tools
-        uses: tox-dev/github-workflows/install-locked-tools@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+        uses: tox-dev/github-workflows/install-locked-tools@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
         with:
           groups: release-notes
           venv: ${{ runner.temp }}/release-tools
       - name: 🏷️ Select previous tag
         id: previous
-        uses: tox-dev/github-workflows/select-previous-tag@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+        uses: tox-dev/github-workflows/select-previous-tag@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
         with:
           tag: ${{ github.ref_name }}
       - name: 📝 Render release notes
-        uses: tox-dev/github-workflows/render-release-notes@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+        uses: tox-dev/github-workflows/render-release-notes@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
         with:
           tag: ${{ github.ref_name }}
           previous: ${{ steps.previous.outputs.previous }}
@@ -73,7 +73,7 @@ jobs:
           artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }}
           path: dist/
       - name: 🚀 Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           packages-dir: dist
           attestations: true
@@ -102,13 +102,13 @@ jobs:
           artifact-ids: ${{ needs.github-notes.outputs.artifact-id }}
           path: ${{ runner.temp }}
       - name: 🔍 Verify PyPI artifacts
-        uses: tox-dev/github-workflows/reconcile-pypi-artifacts@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+        uses: tox-dev/github-workflows/reconcile-pypi-artifacts@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
         with:
           project: pyproject-api
           version: ${{ github.ref_name }}
           dist: dist
       - name: 🚀 Publish GitHub release
-        uses: tox-dev/github-workflows/publish-github-release@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+        uses: tox-dev/github-workflows/publish-github-release@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
         with:
           tag: ${{ github.ref_name }}
           commit: ${{ github.sha }}

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/.github/workflows/upgrade-release-tools.yaml

@@ -10,7 +10,7 @@ concurrency:
 jobs:
   upgrade:
     name: 🔀 Upgrade release tools
-    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@259a3d3fb578d00517ffb73341fdd463259b0b2f # 6.0.1
+    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
     permissions:
       contents: read
     secrets:

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/.pre-commit-config.yaml

@@ -44,7 +44,7 @@ repos:
           ^docs/changelog[.]rst$  # Only the generated release history.
         args: ["-l", "120", "--preserve-adornments"]
         additional_dependencies:
-          - "sphinx==9.1.0"
+          - "sphinx==9.1.1"
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
     rev: c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f # frozen: v1.31.1
     hooks:

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyproject-api
-Version: 1.12.1
+Version: 1.12.3
 Import-Name: pyproject_api
 Summary: API to interact with the python pyproject.toml based projects
 Project-URL: Changelog, https://github.com/tox-dev/pyproject-api/blob/main/docs/changelog.rst

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/docs/changelog.rst

@@ -5,6 +5,40 @@ Release History
 
 .. towncrier release notes start
 
+.. _release-1-12-3:
+
+v1.12.3 (2026-11-02)
+--------------------
+
+.. _release-1-12-3-fixed:
+
+Fixed
+^^^^^
+
+- Clear stale files from reused ``.dist-info`` directories when building wheel or editable metadata (:pr:`345`) by
+  :user:`subotac` and :user:`gaborbernat`.
+
+.. _release-1-12-2:
+
+v1.12.2 (2026-10-28)
+--------------------
+
+.. _release-1-12-2-fixed:
+
+Fixed
+^^^^^
+
+- Drop the backend proxy stub declarations for its private commands; one named a method the proxy does not have
+  (:pr:`331`) by :user:`tridev-tej` and :user:`gaborbernat`.
+- Keep a trailing space in the last backend path when putting it on ``PYTHONPATH`` (:pr:`329`) by :user:`jdotc1` and
+  :user:`gaborbernat`.
+- Preserve ``BackendFailed`` details when copying or pickling an exception, including when a build runs in a process
+  pool (:pr:`337`) by :user:`jdotc1`.
+- Stop the backend from crashing when it prints a path its standard output encoding cannot represent (:pr:`330`) by
+  :user:`nk-batman21` and :user:`gaborbernat`.
+- Stop the backend process and join its output collection thread when a frontend call is interrupted (:pr:`332`) by
+  :user:`zfz2005` and :user:`gaborbernat`.
+
 .. _release-1-12-1:
 
 v1.12.1 (2026-10-27)

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/pylock.toml

@@ -180,28 +180,28 @@ sha256 = "d6f88de62e1d4e38ecb1077eb9724cd0eff29d2a08ca16a401e9b9e93f117cf9"
 
 [[packages]]
 name = "certifi"
-version = "2026.10.18"
+version = "2026.10.19"
 marker = "\"dev\" in dependency_groups or \"docs\" in dependency_groups or \"pkg-meta\" in dependency_groups or \"type\" in dependency_groups"
 requires-python = ">=3.7"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
-name = "certifi-2026.10.18.tar.gz"
-upload-time = 2026-10-18 16:21:07.655710+00:00
-url = "https://files.pythonhosted.org/packages/7e/eb/a2aa1ac3ea30dd3f30ca57f40232138b6b0040719316ecb85daf61167771/certifi-2026.10.18.tar.gz"
-size = 135227
+name = "certifi-2026.10.19.tar.gz"
+upload-time = 2026-10-20 02:24:16.604828+00:00
+url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz"
+size = 137598
 
 [packages.sdist.hashes]
-sha256 = "b9995d97b64d0431a5af837d8ca8cd6238104d1f319f04bd93ea43124d6c861e"
+sha256 = "035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae"
 
 [[packages.wheels]]
-name = "certifi-2026.10.18-py3-none-any.whl"
-upload-time = 2026-10-18 16:21:06.276884+00:00
-url = "https://files.pythonhosted.org/packages/08/ba/95dd616042484f7c83a06974388b37b837732740ee70bc5dc715b5fcd55a/certifi-2026.10.18-py3-none-any.whl"
-size = 134093
+name = "certifi-2026.10.19-py3-none-any.whl"
+upload-time = 2026-10-20 02:24:15.072385+00:00
+url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl"
+size = 136464
 
 [packages.wheels.hashes]
-sha256 = "73191c47aaa79da394e8fee2dbc2ec827432cab56311122c9e47abf79e390f62"
+sha256 = "42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b"
 
 [[packages]]
 name = "cffi"
@@ -1942,28 +1942,28 @@ sha256 = "0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137"
 
 [[packages]]
 name = "setuptools"
-version = "84.0.0"
+version = "84.2.0"
 marker = "\"build\" in dependency_groups or \"dev\" in dependency_groups or \"test\" in dependency_groups or \"type\" in dependency_groups"
 requires-python = ">=3.10"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
-name = "setuptools-84.0.0.tar.gz"
-upload-time = 2026-08-08 18:27:58.365696+00:00
-url = "https://files.pythonhosted.org/packages/6d/44/f5da03a8ef95d369145c5bb53050e7877c9f3d312e128605fd9504829143/setuptools-84.0.0.tar.gz"
-size = 1168449
+name = "setuptools-84.2.0.tar.gz"
+upload-time = 2026-10-19 20:38:03.407523+00:00
+url = "https://files.pythonhosted.org/packages/63/40/e2c41d00a4bfea5548c31420a74c6cf149cc0e7c36b45c4c82202ce867aa/setuptools-84.2.0.tar.gz"
+size = 1227656
 
 [packages.sdist.hashes]
-sha256 = "f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73"
+sha256 = "6f445ca2ce864605f81e223f262b4c94ffcb9a4a63473bae0ed7be5aab0291da"
 
 [[packages.wheels]]
-name = "setuptools-84.0.0-py3-none-any.whl"
-upload-time = 2026-08-08 18:27:56.719708+00:00
-url = "https://files.pythonhosted.org/packages/95/9c/c510029fc6ef33a6275cd2c5d3cecd6613dfd6aa401d57c54f1c18852ccf/setuptools-84.0.0-py3-none-any.whl"
-size = 818216
+name = "setuptools-84.2.0-py3-none-any.whl"
+upload-time = 2026-10-19 20:38:01.629093+00:00
+url = "https://files.pythonhosted.org/packages/dd/a2/2e1af99d56c8145aa69496026c7e5fd7b6ec759b500c3ad697e2062832dc/setuptools-84.2.0-py3-none-any.whl"
+size = 875816
 
 [packages.wheels.hashes]
-sha256 = "51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670"
+sha256 = "8cc107ac7a403105dc8d6477664171f36135fab26adf8b5e0edaebc313f39b21"
 
 [[packages]]
 name = "setuptools-scm"
@@ -2047,7 +2047,7 @@ sha256 = "fa30e3ba4809cb81ce1f3209f2fbe3e779fc445f0439bc147a0d7c4601743f21"
 
 [[packages]]
 name = "sphinx"
-version = "9.1.0"
+version = "9.1.1"
 marker = "\"dev\" in dependency_groups or \"docs\" in dependency_groups or \"type\" in dependency_groups"
 requires-python = ">=3.12"
 dependencies = [
@@ -2071,22 +2071,22 @@ dependencies = [
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
-name = "sphinx-9.1.0.tar.gz"
-upload-time = 2025-12-31 15:09:27.646696+00:00
-url = "https://files.pythonhosted.org/packages/cd/bd/f08eb0f4eed5c83f1ba2a3bd18f7745a2b1525fad70660a1c00224ec468a/sphinx-9.1.0.tar.gz"
-size = 8718324
+name = "sphinx-9.1.1.tar.gz"
+upload-time = 2026-10-20 00:41:13.960930+00:00
+url = "https://files.pythonhosted.org/packages/fc/73/567727fc8c8d85bc3adc88a246e12937cfda8d565cf1d80e85bceaa61fe5/sphinx-9.1.1.tar.gz"
+size = 8725638
 
 [packages.sdist.hashes]
-sha256 = "7741722357dd75f8190766926071fed3bdc211c74dd2d7d4df5404da95930ddb"
+sha256 = "48b627f02908f22c601b3ba9c7b17265b4f315dd05c8bc64cd4da41183f44fbc"
 
 [[packages.wheels]]
-name = "sphinx-9.1.0-py3-none-any.whl"
-upload-time = 2025-12-31 15:09:25.561651+00:00
-url = "https://files.pythonhosted.org/packages/73/f7/b1884cb3188ab181fc81fa00c266699dab600f927a964df02ec3d5d1916a/sphinx-9.1.0-py3-none-any.whl"
-size = 3921742
+name = "sphinx-9.1.1-py3-none-any.whl"
+upload-time = 2026-10-20 00:41:11.288695+00:00
+url = "https://files.pythonhosted.org/packages/47/18/3c66ea76da7de47e716b181c35bdbfafbd5e9af0bb247b14578e9de348e9/sphinx-9.1.1-py3-none-any.whl"
+size = 3923559
 
 [packages.wheels.hashes]
-sha256 = "c84fdd4e782504495fe4f2c0b3413d6c2bf388589bb352d439b2a3bb99991978"
+sha256 = "f8b60013ce25017be41a509e5c2d265bc1918410061315c36b809c7f335646c0"
 
 [[packages]]
 name = "sphinx-autodoc-typehints"
@@ -2627,28 +2627,28 @@ sha256 = "0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3"
 
 [[packages]]
 name = "uv"
-version = "0.13.1"
+version = "0.13.3"
 marker = "\"dev\" in dependency_groups or \"lint\" in dependency_groups or \"pkg-meta\" in dependency_groups"
 requires-python = ">=3.8"
 index = "https://pypi.org/simple/"
 
 [packages.sdist]
-name = "uv-0.13.1.tar.gz"
-upload-time = 2026-10-14 05:13:35.353145+00:00
-url = "https://files.pythonhosted.org/packages/ef/10/81f499de381ac81e09961e1c19255c5cf49563ac418464def4190b6c7400/uv-0.13.1.tar.gz"
-size = 7434239
+name = "uv-0.13.3.tar.gz"
+upload-time = 2026-10-20 01:13:40.241842+00:00
+url = "https://files.pythonhosted.org/packages/b2/0d/0cf59876b94f537055fdcc6a32126fd9abb841620b6589ae3fcbf6e21f69/uv-0.13.3.tar.gz"
+size = 7477898
 
 [packages.sdist.hashes]
-sha256 = "6df50a86b09be66a413f8f1b16258d585d4dd1cbff591077ae1e6f65c26de2eb"
+sha256 = "fe8587cb414b324753eb2c1b2a54d2f93b2aed7e9cf02e9c1efa3776547a3aae"
 
 [[packages.wheels]]
-name = "uv-0.13.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
-upload-time = 2026-10-14 05:13:13.069021+00:00
-url = "https://files.pythonhosted.org/packages/14/0b/6602a613533602e7a083e908c4375f9b0e78a94ba2e21c29b21c41a0a611/uv-0.13.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
-size = 17279385
+name = "uv-0.13.3-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+upload-time = 2026-10-20 01:13:11.825804+00:00
+url = "https://files.pythonhosted.org/packages/7e/fa/45e1751beda39226d5472e6bb068747115a06f19c2559a8810aac9b881b7/uv-0.13.3-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+size = 17301030
 
 [packages.wheels.hashes]
-sha256 = "696dcf6d807d85da978f4db8472da81dccc1254b18b52cbd1367c4d923c421e0"
+sha256 = "8d9ba65db55f3701908b09394cb7d3248be28496aab6bd9a96e8e870261ad372"
 
 [[packages]]
 name = "vcs-versioning"
@@ -2771,7 +2771,7 @@ sha256 = "3fa599046443d4ca830d06e3d180cd0a675d5871af0a68daa5623318bb4d17e3"
 
 [tool.nab]
 nab-version = "0.0.22"
-created-at = 2026-10-26 20:06:51.656389+00:00
+created-at = 2026-10-27 13:49:49.388379+00:00
 command-line = [
     "nab",
     "lock",
@@ -2779,9 +2779,6 @@ command-line = [
     "--all-extras",
     "--no-cache",
     "--upgrade",
-    "pyproject.toml",
-    "--output",
-    "pylock.toml",
 ]
 input-path = "pyproject.toml"
 mode = "universal"

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/src/pyproject_api/_backend.py

@@ -150,4 +150,6 @@ def read_line(fd=0):
 
 
 if __name__ == "__main__":
+    # printed paths may hold characters the stdout encoding cannot represent
+    sys.stdout.reconfigure(errors="backslashreplace")  # type: ignore[unresolved-attribute]  # stub says TextIO
     sys.exit(run(sys.argv[1:]))

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/src/pyproject_api/_backend.pyi

@@ -10,8 +10,6 @@ class BackendProxy:
 
     def __init__(self, backend_module: str, backend_obj: str | None) -> None: ...
     def __call__(self, name: str, *args: Any, **kwargs: Any) -> Any: ...
-    def _exit(self) -> None: ...
-    def _optional_commands(self) -> dict[str, bool]: ...
 
 def run(argv: Sequence[str]) -> int: ...
 def read_line(fd: int = 0) -> bytearray: ...

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/src/pyproject_api/_frontend.py

@@ -152,6 +152,10 @@ class BackendFailed(RuntimeError):  # ruff:ignore[error-suffix-on-exception-name
         #: the string representation of the exception thrown
         self.exc_msg: str = result.get("exc_msg", "missing Exception message")
 
+    def __reduce__(self) -> tuple[type[BackendFailed], tuple[dict[str, Any], str, str], dict[str, Any]]:
+        result = {"code": self.code, "exc_type": self.exc_type, "exc_msg": self.exc_msg}
+        return self.__class__, (result, self.out, self.err), self.__dict__
+
     def __str__(self) -> str:
         return (
             f"packaging backend failed{'' if self.code is None else f' (code={self.code})'}, "
@@ -495,9 +499,15 @@ class Frontend(ABC):
             with ZipFile(str(wheel), "r") as zip_file:
                 for name in zip_file.namelist():  # pragma: no branch
                     root = Path(name).parts[0]
-                    if root.endswith(".dist-info"):
-                        basename = root
-                        zip_file.extract(name, extract_to)
+                    if not root.endswith(".dist-info"):
+                        continue
+                    if basename is None:
+                        destination: Final[Path] = metadata_directory / root
+                        if destination.is_symlink():  # pragma: win32 no cover
+                            destination.unlink()
+                        ensure_empty_dir(destination)
+                    basename = root
+                    zip_file.extract(name, extract_to)
         if basename is None:  # pragma: no branch
             msg = f"no .dist-info found inside generated wheel {wheel}"
             raise RuntimeError(msg)

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/src/pyproject_api/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.12.1'
-__version_tuple__ = version_tuple = (1, 12, 1)
+__version__ = version = '1.12.3'
+__version_tuple__ = version_tuple = (1, 12, 3)
 
 __commit_id__ = commit_id = None

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/src/pyproject_api/_via_fresh_subprocess.py

@@ -5,7 +5,7 @@ import sys
 from contextlib import contextmanager
 from subprocess import PIPE, Popen  # ruff:ignore[suspicious-subprocess-import]
 from threading import Thread
-from typing import TYPE_CHECKING, Any, cast
+from typing import TYPE_CHECKING, Any, Final, cast
 
 from ._frontend import CmdStatus, Frontend
 
@@ -64,7 +64,7 @@ class SubprocessFrontend(Frontend):
     @contextmanager
     def _send_msg(self, cmd: str, result_file: Path, msg: str) -> Generator[SubprocessCmdStatus, None, None]:  # ruff:ignore[unused-method-argument]
         env = os.environ.copy()
-        backend = os.pathsep.join(str(i) for i in self._backend_paths).strip()
+        backend = os.pathsep.join(str(i) for i in self._backend_paths)
         if backend:
             env["PYTHONPATH"] = backend
         process = Popen(  # ruff:ignore[subprocess-without-shell-equals-true]  # fixed argv, no shell
@@ -77,7 +77,12 @@ class SubprocessFrontend(Frontend):
             cwd=self._root,
             env=env,
         )
-        yield SubprocessCmdStatus(process, f"{os.linesep}{msg}{os.linesep}")
+        status: Final = SubprocessCmdStatus(process, f"{os.linesep}{msg}{os.linesep}")
+        try:
+            yield status
+        finally:
+            process.kill()
+            status.join()
 
     def send_cmd(self, cmd: str, **kwargs: Any) -> tuple[Any, str, str]:
         """

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/tests/test_backend.py

@@ -5,11 +5,11 @@ import os
 import subprocess  # ruff:ignore[suspicious-subprocess-import]
 import sys
 from textwrap import dedent
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Final
 
 import pytest
 
-from pyproject_api import _backend
+from pyproject_api import SubprocessFrontend, _backend
 from pyproject_api._backend import BackendProxy, read_line, run
 
 if TYPE_CHECKING:
@@ -222,3 +222,14 @@ def test_read_line_eof_at_the_beginning() -> None:
             read_line(fd=r)
     finally:
         os.close(r)
+
+
+def test_backend_output_with_unencodable_path(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("PYTHONIOENCODING", "ascii")  # like a Windows ANSI code page that lacks a path character
+    root: Final[Path] = tmp_path / "pröject"
+    root.mkdir()
+    (root / "build_tester.py").write_text("def build_sdist(sdist_directory, config_settings=None): return 'out.tar.gz'")
+
+    result: Final = SubprocessFrontend(root, (root,), "build_tester", None, ()).build_sdist(root / "dist")
+
+    assert (result.sdist, "pr\\xf6ject" in result.out) == (root / "dist" / "out.tar.gz", True)

{pyproject_api-1.12.1 → pyproject_api-1.12.3}/tests/test_frontend.py

@@ -1,15 +1,19 @@
 from __future__ import annotations
 
+import pickle  # ruff:ignore[suspicious-pickle-import]
 import re
 import subprocess  # ruff:ignore[suspicious-subprocess-import]
 import sys
+from concurrent.futures import ProcessPoolExecutor
+from multiprocessing import get_context
 from pathlib import Path
 from textwrap import dedent
-from typing import TYPE_CHECKING, Final, Literal
+from typing import TYPE_CHECKING, Any, Final, Literal
 
 import pytest
 from packaging.requirements import Requirement
 
+from pyproject_api import _via_fresh_subprocess
 from pyproject_api._frontend import BackendFailed
 from pyproject_api._via_fresh_subprocess import SubprocessFrontend
 
@@ -55,6 +59,18 @@ def test_relative_project_folder(local_builder: Callable[[str], Path], monkeypat
     assert frontend.get_requires_for_build_wheel().requires == (Requirement("wheel"),)
 
 
+@pytest.mark.skipif(sys.platform == "win32", reason="Windows drops trailing spaces from names")
+def test_backend_path_with_trailing_space(tmp_path: Path) -> None:  # pragma: win32 no cover
+    backend: Final = tmp_path / "backend "
+    backend.mkdir()
+    (backend / "build_tester.py").write_text(
+        "def get_requires_for_build_wheel(config_settings=None):\n    return ['wheel']\n"
+    )
+    frontend: Final = SubprocessFrontend(tmp_path, (backend,), "build_tester", None, ())
+
+    assert frontend.get_requires_for_build_wheel().requires == (Requirement("wheel"),)
+
+
 @pytest.mark.parametrize(
     "hook",
     [
@@ -161,6 +177,39 @@ def test_large_command_with_failed_backend(local_builder: Callable[[str], Path])
     assert "RuntimeError: backend import failed" in context.value.err
 
 
+@pytest.mark.parametrize(
+    "error_type",
+    [
+        pytest.param(KeyboardInterrupt, id="keyboard-interrupt"),
+        pytest.param(SystemExit, id="system-exit"),
+        pytest.param(RuntimeError, id="runtime-error"),
+    ],
+)
+def test_interrupted_frontend_cleans_up_backend(
+    error_type: type[BaseException], local_builder: Callable[[str], Path], mocker: pytest_mock.MockerFixture
+) -> None:
+    root: Final = local_builder("""
+        import time
+
+        def build_wheel(wheel_directory, config_settings=None, metadata_directory=None):
+            time.sleep(60)
+            return "demo-1.0-py3-none-any.whl"
+        """)
+    status_factory: Final = mocker.spy(_via_fresh_subprocess, "SubprocessCmdStatus")
+    mocker.patch("pyproject_api._frontend.sleep", side_effect=error_type("build interrupted"))
+
+    try:
+        with pytest.raises(error_type):
+            SubprocessFrontend(*SubprocessFrontend.create_args_from_folder(root)[:-1]).build_wheel(root / "dist")
+
+        assert not status_factory.spy_return.is_alive()
+    finally:
+        # Keep a regression from leaving the backend and its non-daemon thread running.
+        status: Final = status_factory.spy_return
+        status.process.kill()
+        status.join(timeout=10)
+
+
 @pytest.mark.parametrize("cmd", ["build_wheel", "build_sdist"])
 def test_missing_required_cmd(cmd: str, local_builder: Callable[[str], Path]) -> None:
     tmp_path = local_builder("")
@@ -561,6 +610,43 @@ def test_metadata_from_built_wheel(
     assert not err
 
 
+@pytest.mark.parametrize("target", [pytest.param("wheel", id="wheel"), pytest.param("editable", id="editable")])
+def test_metadata_from_built_removes_stale_files(
+    demo_pkg_inline: Path, tmp_path: Path, target: Literal["wheel", "editable"]
+) -> None:
+    metadata: Final[Path] = tmp_path / "demo_pkg_inline-1.0.0.dist-info"
+    metadata.mkdir()
+    (metadata / "entry_points.txt").write_text("obsolete entry points")
+    (tmp_path / "unrelated.txt").write_text("keep")
+
+    metadata_path: Final[Path] = SubprocessFrontend(
+        *SubprocessFrontend.create_args_from_folder(demo_pkg_inline)[:-1]
+    ).metadata_from_built(tmp_path, target)[0]
+
+    assert {entry.name for entry in metadata_path.iterdir()} == {"top_level.txt", "WHEEL", "RECORD", "METADATA"}
+    assert (tmp_path / "unrelated.txt").read_text() == "keep"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="Creating symlinks requires privileges")
+def test_metadata_from_built_replaces_directory_symlink(
+    demo_pkg_inline: Path, tmp_path: Path
+) -> None:  # pragma: win32 no cover
+    external: Final[Path] = tmp_path / "external"
+    external.mkdir()
+    (external / "keep.txt").write_text("keep")
+    output: Final[Path] = tmp_path / "metadata"
+    output.mkdir()
+    (output / "demo_pkg_inline-1.0.0.dist-info").symlink_to(external, target_is_directory=True)
+
+    metadata_path: Final[Path] = SubprocessFrontend(
+        *SubprocessFrontend.create_args_from_folder(demo_pkg_inline)[:-1]
+    ).metadata_from_built(output, "wheel")[0]
+
+    assert not metadata_path.is_symlink()
+    assert (metadata_path / "METADATA").is_file()
+    assert {entry.name: entry.read_text() for entry in external.iterdir()} == {"keep.txt": "keep"}
+
+
 def test_bad_wheel_metadata_from_built_wheel(local_builder: Callable[[str], Path]) -> None:
     txt = """
     import sys
@@ -721,3 +807,46 @@ def test_backend_failed_str_repr() -> None:
 
     exc = BackendFailed({"code": 3, "exc_type": "Error", "exc_msg": "msg"}, "out\n", "err\n")
     assert str(exc) == "packaging backend failed (code=3), with Error: msg\nerr\nout"
+
+
+@pytest.mark.parametrize("protocol", range(pickle.HIGHEST_PROTOCOL + 1))
+@pytest.mark.parametrize("result", [{}, {"code": None}, {"code": 1, "exc_type": "TypeError", "exc_msg": "bad"}])
+def test_backend_failed_pickle(protocol: int, result: dict[str, Any]) -> None:
+    exc = BackendFailed(result, "backend stdout", "backend stderr")
+    exc.add_note("building a wheel")
+    restored = pickle.loads(  # ruff:ignore[suspicious-pickle-usage]
+        pickle.dumps(exc, protocol=protocol)
+    )
+
+    assert type(restored) is BackendFailed
+    assert restored.args == exc.args == ()
+    assert restored.__dict__ == exc.__dict__
+    assert str(restored) == str(exc)
+    assert repr(restored) == repr(exc)
+
+
+def _build_wheel_in_process(root: Path) -> str:
+    frontend = SubprocessFrontend(*SubprocessFrontend.create_args_from_folder(root)[:-1])
+    return str(frontend.build_wheel(root / "dist").wheel)
+
+
+def test_backend_failed_process_pool(local_builder: Callable[[str], Path]) -> None:
+    root = local_builder("""
+        import sys
+
+        def build_wheel(wheel_directory, config_settings=None, metadata_directory=None):
+            print("backend stdout")
+            print("backend stderr", file=sys.stderr)
+            raise RuntimeError("build failed")
+        """)
+    with ProcessPoolExecutor(max_workers=1, mp_context=get_context("spawn")) as executor:
+        future = executor.submit(_build_wheel_in_process, root)
+        with pytest.raises(BackendFailed) as context:
+            future.result(timeout=30)
+    exc = context.value
+    assert exc.args == ()
+    assert exc.code == 1
+    assert exc.exc_type == "RuntimeError"
+    assert exc.exc_msg == "build failed"
+    assert "backend stdout" in exc.out
+    assert "backend stderr" in exc.err

pyproject_api-1.12.1/.github/SECURITY.md

@@ -1,9 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-Only the latest released version is supported with security updates. Older versions will not receive patches.
-
-## Reporting a Vulnerability
-
-Please report security vulnerabilities via [GitHub's private vulnerability reporting](../../security/advisories/new).

pyproject_api-1.12.1/.github/dependabot.yaml

@@ -1,27 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    labels:
-      - dependencies
-      - github_actions
-      - skip news
-    schedule:
-      interval: "weekly"
-      day: "tuesday"
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-    cooldown:
-      default-days: 7
-  - package-ecosystem: "pre-commit"
-    directory: "/"
-    labels:
-      - dependencies
-      - skip news
-    schedule:
-      interval: "weekly"
-      day: "tuesday"
-    cooldown:
-      default-days: 7