Enforce DNS-length cap on individual labels early in check_label,
short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.
Tidy core helpers: hoist bidi category sets to module-level
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
Use raise ... from err for proper exception chaining and
switch internal string formatting to f-strings.
Allow flit_core 4.x in the build backend.
Expand the ruff lint set (flake8-bugbear, flake8-simplify,
pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.
Add Dependabot configuration for GitHub Actions.
Convert README and HISTORY from reStructuredText to Markdown.
Reference CVE-2026-45409 for the 3.14 advisory in place of the
initial GHSA identifier.
Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.
Removed opportunity to process long inputs into quadratic
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]
Thanks to Stan Ulbrych for reporting the issue.
Configuration
📅Schedule: (in timezone America/Edmonton)
Branch creation
At any time (no schedule defined)
Automerge
At any time (no schedule defined)
🚦Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕Ignore: Close this PR and you won't be reminded about this update again.
If you want to rebase/retry this PR, check this box
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [idna](https://github.com/kjd/idna) ([changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)) | minor | `==3.13` → `==3.15` |
---
### Release Notes
<details>
<summary>kjd/idna (idna)</summary>
### [`v3.15`](https://github.com/kjd/idna/blob/HEAD/HISTORY.md#315-2026-05-12)
[Compare Source](https://github.com/kjd/idna/compare/v3.14...v3.15)
- Enforce DNS-length cap on individual labels early in `check_label`,
short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.
- Tidy core helpers: hoist bidi category sets to module-level
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared `_unicode_dots_re` from
`idna.core` in the codec module.
- Use `raise ... from err` for proper exception chaining and
switch internal string formatting to f-strings.
- Allow `flit_core` 4.x in the build backend.
- Expand the ruff lint set (flake8-bugbear, flake8-simplify,
pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.
- Add Dependabot configuration for GitHub Actions.
- Convert README and HISTORY from reStructuredText to Markdown.
- Reference CVE-2026-45409 for the 3.14 advisory in place of the
initial GHSA identifier.
Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.
### [`v3.14`](https://github.com/kjd/idna/blob/HEAD/HISTORY.md#314-2026-05-10)
[Compare Source](https://github.com/kjd/idna/compare/v3.13...v3.14)
- Removed opportunity to process long inputs into quadratic
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. \[CVE-2026-45409]
Thanks to Stan Ulbrych for reporting the issue.
</details>
---
### Configuration
📅 **Schedule**: (in timezone America/Edmonton)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
renovate-bot
changed title from Update dependency idna to v3.14 to Update dependency idna to v3.152026-05-12 17:00:18 -06:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
==3.13→==3.15Release Notes
kjd/idna (idna)
v3.15Compare Source
check_label,short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared
_unicode_dots_refromidna.corein the codec module.raise ... from errfor proper exception chaining andswitch internal string formatting to f-strings.
flit_core4.x in the build backend.pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.
initial GHSA identifier.
Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.
v3.14Compare Source
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]
Thanks to Stan Ulbrych for reporting the issue.
Configuration
📅 Schedule: (in timezone America/Edmonton)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
Update dependency idna to v3.14to Update dependency idna to v3.15d2a4e4245cto4fe267b951