chore(deps): bump the major group across 1 directory with 2 updates

[dependabot]

Bumps the major group with 2 updates in the /memberportal directory: autobahn and cron-descriptor.

Updates autobahn from 25.12.2 to 26.7.1

Release notes

Sourced from autobahn's releases.

Release v26_7_1

Official release v26_7_1

Included Platforms

• Linux: x86_64, ARM64 (manylinux_2_34 wheels with NVX)
• macOS: Apple Silicon ARM64 (binary wheels with NVX)
• Windows: x86_64 (binary wheels with NVX)

Python Versions

• CPython: 3.11, 3.12, 3.13, 3.14
• PyPy: 3.11

Installation

pip install autobahn[all]==v26_7_1

Or download wheels directly from this release.

Build Information

• Release Date: 2026-07-15 18:49:18 UTC
• Total Wheels: 28
• Source Distributions: 3

Features

Autobahn|Python provides:

• WebSocket client and server implementations (RFC 6455)
• WAMP client library for both Twisted and asyncio
• NVX acceleration for high-performance networking (binary wheels)
• Pure Python fallback wheels for maximum compatibility

Documentation

• Read the Docs
• GitHub Repository
• WAMP Protocol

Development Build fork-ec23ef44-oberstet_autobahn_python-fix_1930-202607151609

Development build from pull request

Build Information

... (truncated)

Changelog

Sourced from autobahn's changelog.

26.7.1

Security

• Fix WebSocket maxMessagePayloadSize being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past maxMessagePayloadSize is now rejected where it previously passed; uncompressed traffic and the per-frame maxFramePayloadSize wire guard are unaffected (#1909)
• Fix the permessage-deflate max_message_size receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded decompress(…, max_length) left the remaining input in unconsumed_tail undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises PayloadExceededError as soon as the uncompressed size would exceed the cap (#1908)
• Make bounded decompression backend-agnostic: decompress_message_data() gains an optional max_output_len argument (documented on the PerMessageCompress base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by maxFramePayloadSize) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining maxMessagePayloadSize budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check (#1909) remains as a backstop. Previously only deflate had any decompressed-output cap, so a snappy/bzip2/brotli frame could inflate fully into memory first (#1910)
• Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio WampRawSocketFactory now exposes setProtocolOptions(maxMessagePayloadSize=...) / resetProtocolOptions() (bounds [512, 2**24], default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead max_size=None branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket max_message_size had no effect on the asyncio path (#1911)

FlatBuffers

• Fix check_zlmdb_flatbuffers_version_in_sync() comparing the build-time version() (which is (0, 0, 0, None, None) on installed wheels, where the vendored FlatBuffers __git_version__ is unstamped) — it now compares the reliably-stamped __version__ and returns a version string. Added regression tests (#1891)
• Make autobahn.flatbuffers.version() reliable on installed wheels: when the build-time __git_version__ is a bare commit hash or "unknown" (shallow clone / submodule absent from the sdist), version() now falls back to parsing the static vendored __version__ and returns (major, minor, patch, None, None) instead of (0, 0, 0, None, None); rich git describe detail is still returned on genuine dev/git builds. Also hardened hatch_build.py so it never stamps a non-parseable __git_version__. Return shape is unchanged (5-tuple); no API break (#1891)

Build & CI/CD

• Add CalVer / PEP 440 version-management just recipes (file-version, bump-dev, bump-next, prep-release) mirroring Crossbar.io, and document the versioning policy in CONTRIBUTING.md (#1894)
• Add ruff check --select ANN,UP,TCH (annotation presence, pyupgrade modern syntax, TYPE_CHECKING imports) to the just check-typing recipe so annotation/style regressions are caught in the quality-checks CI job. The existing gaps in src/autobahn/ are ratcheted via an explicit --ignore allowlist to be removed module-by-module (#1839); all other UP/TC rules are enforced immediately, and generated code is excluded. The annotation rules are scoped to this recipe via the command line rather than the global [tool.ruff.lint] select, so the repo-wide check-format gate is unaffected (#1840)
• Fix the aarch64 CPython 3.14 wheel shipping the free-threaded ABI (cp314t) in the GIL cp314 slot (26.6.x). Root cause: manylinux images pre-install both the GIL and free-threaded 3.14 under /opt/python and prepend them to PATH, and uv resolved cpython-3.14 to the free-threaded interpreter (first on PATH). The create recipe now drops free-threaded …t/bin dirs from PATH for GIL envs so uv selects the GIL build. As defence-in-depth, just build also asserts (via _check-venv-abi) that the interpreter's GIL/free-threaded status matches the env and aborts on mismatch, so a wrong-ABI wheel can never be published. A reserved cpy314t env spec (cpython-3.14t) is added for a future free-threaded wheel variant (#1875)
• Bump the .cicd (wamp-cicd) submodule to include exact CPython ABI-tag matching in the shared check-release-fileset release-gate action, so a wrong-ABI wheel (e.g. cp314t in the cp314 slot) is also rejected at release-fileset validation, not only by the build-time guard above (wamp-cicd #11, completes #1875)
• Publish musllinux_1_2 (musl libc / Alpine Linux) binary wheels with NVX acceleration for CPython 3.11–3.14 on both x86_64 and aarch64. Previously pip install autobahn on Alpine fell back to a source build that failed (the clang-built python-build-standalone interpreter's sysconfig carries a --rtlib=compiler-rt flag that Alpine's gcc rejects), so Alpine users could not install autobahn at all; the prebuilt wheels make it "just work". Built inside the official PyPA musllinux_1_2 images (gcc toolchain), tagged automatically by auditwheel, and gated by the check-release-fileset targets. PyPy-on-musl is a tracked follow-up (no official PyPA musllinux PyPy image) (#1877)

26.6.2

WAMP Cryptosign

• Fix import autobahn.wamp.cryptosign raising TypeError: unsupported operand type(s) for |: 'str' and 'NoneType' on CPython 3.11/3.12/3.13 when crypto support (nacl) is installed. A ruff UP007 autofix in 26.6.1 (#1843) had rewritten Optional["ISecurityModule"] to "ISecurityModule" | None in a module that lacks from __future__ import annotations, so the string forward-reference union was evaluated eagerly at class-definition time (CPython 3.14 was unaffected because PEP 649 defers annotation evaluation). The regression broke WAMP-cryptosign and any importer with crypto dependencies present (e.g. xbr, Crossbar.io) on CPython < 3.14. Added from __future__ import annotations to cryptosign.py to defer annotation evaluation (#1878)

Build & CI/CD

• Add an import smoke test that imports every public autobahn submodule with the crypto extras installed, so eager-evaluation annotation regressions like #1878 are caught in CI on all supported Python versions (#1878)

26.6.1

WAMP RawSocket

• Fix the Twisted WampRawSocketProtocol raising TransportLost out of dataReceived when the opening handshake fails before a WAMP session is attached (e.g. an invalid magic byte from a port scanner). abort() now tears down the transport whenever a transport is present - rather than only when a session is open - so a failed handshake closes the connection cleanly with a single warning instead of an "Unhandled Error" stack trace, and handshake processing stops instead of continuing past the abort. The asyncio backend already behaved correctly; cross-backend regression tests were added for both. Thanks to @​karel-un for the report (#1850)

WAMP Serialization

• py-ubjson (unmaintained, sdist-only) is no longer an unconditional dependency. A base pip install autobahn — and the wheels-only / cross-arch case from #1849 (pip download --only-binary :all: --platform ...) — now resolves entirely from binary wheels (#1849)
• The WAMP ubjson serializer is now backed by the maintained bjdata (Binary JData) package, provided as the OPTIONAL autobahn[serialization] extra (it also pulls in numpy), keeping both out of a minimal install (#1849)
• bjdata is published sdist-only (no PyPI wheels) and is currently CPython-only: on PyPy its sdist build pulls an unbuildable numpy (upstream NeuroJSON/pybj#6), so the ubjson serializer is unavailable on PyPy - use cbor/msgpack there. On CPython without a compiler, set PYBJDATA_NO_EXTENSION=1 for a pure-Python build. For wheels-only or cross-arch deployments, also prefer cbor/msgpack (#1849)
• ⚠️ Wire-level change to watch out for: bjdata's octet-level encoding is NOT identical to the previous py-ubjson/UBJSON bytes (different integer markers, little-endian). The WAMP serializer id remains ubjson for transport negotiation. The wamp-proto UBJSON test vectors will be regenerated in a follow-up PR after this release; until then the ubjson serializer is excluded from the byte-vector conformance suite (round-trip and cross-serializer coverage retained) (#1849)

FlatBuffers

... (truncated)

Commits

• 22055b5 Fix 1930 (#1931)
• 7d9baba Fix 1911 (#1922)
• 583b534 Fix 1910 (#1921)
• 77d323a Fix 1909 (#1916)
• cd2dffd Fix 1908 (#1912)
• e9eebbe Fix 1877 (#1905)
• c103d73 Fix 1875 (#1902)
• 36aa406 Fix 1840 (#1895)
• 20821ab Fix 1891 (#1894)
• a66e246 Remove duplicate run call for ApplicationRunner (#1887)
• Additional commits viewable in compare view

Updates cron-descriptor from 1.4.5 to 2.1.0

Release notes

Sourced from cron-descriptor's releases.

Fixing release

What's Changed

• Port the day-of-week description fixes from cron-expression-descriptor 2.48.0 by @​StormPooper in Salamek/cron-descriptor#102

New Contributors

• @​StormPooper made their first contribution in Salamek/cron-descriptor#102

Full Changelog: Salamek/cron-descriptor@2.0.8...2.1.0

Fixing release

Full Changelog: Salamek/cron-descriptor@2.0.7...2.0.8

What's Changed

• chore(deps): bump actions/checkout from 4 to 5 in the github-actions group by @​dependabot[bot] in Salamek/cron-descriptor#96
• chore(deps): bump actions/setup-python from 5 to 6 in the github-actions group by @​dependabot[bot] in Salamek/cron-descriptor#98
• pyproject.toml: Add Programming Language :: Python :: 3.14 by @​cclauss in Salamek/cron-descriptor#99
• Fix comma combined with step expressions (#21) by @​gghez in Salamek/cron-descriptor#101
• chore(deps): bump actions/checkout from 5 to 6 in the github-actions group by @​dependabot[bot] in Salamek/cron-descriptor#100

New Contributors

• @​dependabot[bot] made their first contribution in Salamek/cron-descriptor#96
• @​gghez made their first contribution in Salamek/cron-descriptor#101

Full Changelog: Salamek/cron-descriptor@2.0.5...2.0.8

Fixing release

What's Changed

• README.md: Use f-string by @​cclauss in Salamek/cron-descriptor#93
• Keep GitHub Actions up to date with GitHub's Dependabot by @​cclauss in Salamek/cron-descriptor#91
• Add Python 3.14rc2 to workflow matrix by @​cclauss in Salamek/cron-descriptor#92
• Add a PEP723 header to examples/crontabReader.py by @​cclauss in Salamek/cron-descriptor#94
• Add Python 3.9 and 3.10 support by @​Salamek in Salamek/cron-descriptor#95

Full Changelog: Salamek/cron-descriptor@2.0.4...2.0.5

New release

What is new

• Options now allow setting parameters in constructor Options(verbose=True, ...) this is potential BC, since behavior changed a bit since Options now allow to setting locale_code that overrides auto-detection from system locale and also use_24hour_time_format now overrides auto-detected 24h time format from provided or auto-detected locale. When these are not set auto-detection is used ~as before.
• custom exceptions used by library are renamed from *Exception to *Error, *Exception names are kept for BC
• Support for python 3.13
• Replaced setup.py with pyproject.toml (except stdeb build)
• Fully typed and linted code
• Added missing localization
• Optional experimental expression validator ExpressionValidator.py ExpressionValidator().validate('* * * * *'), this validator has to be explicitly called and it is not hooked anywhere since it is experimental...

Full Changelog: Salamek/cron-descriptor@2.0.2...2.0.3

Commits

• 9e89331 New version 2.1.0
• ac9f78c Merge pull request #102 from StormPooper/port/dotnet-2.48.0-fixes
• ff98d81 fix: describe a day-of-week step on specific days as a weekly interval
• 3f3ad0b fix: use ', or on' when day-of-month and day-of-week are both set
• ae10f5a fix(i18n): recompile stale .mo catalogs so the 'fourth' ordinal renders
• fd14ba6 New version 2.0.8
• b100228 chore(CI): Use fixed IP
• ee6b163 New version 2.0.7
• b234661 Merge pull request #100 from Salamek/dependabot/github_actions/github-actions...
• 73120a2 fix(mypy): Ignore missing types on pytest decorator
• Additional commits viewable in compare view

[github-actions]

Created image with name ghcr.io/pawprintprototyping/membermatters:untrusted-pr-image-PawprintPrototyping-dependabot-uv-memberportal-major-b09289632d. WARNING: run this image at your own risk - it was created from a potentially untrusted PR.

[github-actions]

Created image with name ghcr.io/pawprintprototyping/membermatters:untrusted-pr-image-PawprintPrototyping-dependabot-uv-memberportal-major-b09289632d. WARNING: run this image at your own risk - it was created from a potentially untrusted PR.