Bump uvloop to 0.22.1 so the arm64 image build finds a wheel - #139
Merged
Conversation
Re-enabling CodeQL surfaced 39 open py/url-redirection alerts with no shared redirect-target validation behind them. Logs that as a Medium security issue with the reasoning for why suppressing the rule is the wrong fix, since redirect targets here cross tenant and service-provider boundaries. Also archives the pygments DEPS entry, resolved in 1.11.0 when pymdown-extensions 11.0.1 unblocked the 2.20.0 bump, and corrects the dependency-audit note that still claimed the pin was in place.
The v1.11.0 publish run stalled compiling uvloop from source. uvloop 0.21.0 ships no cp314 wheel for any architecture, so the Python 3.14 upgrade forced pip to build it (and libuv) from the sdist. On the linux/arm64 leg of the multi-arch build that happens under QEMU emulation, where it ran for 400+ seconds with no end in sight, against a 9-minute baseline for the whole job at 1.10.0. uvloop 0.22.1 publishes cp314 manylinux aarch64 wheels. Verified by installing both versions in a linux/arm64 python:3.14-slim container: 0.21.0 pulls uvloop-0.21.0.tar.gz, 0.22.1 pulls a prebuilt .whl. A sweep of all 73 pinned production dependencies confirms uvloop was the only one missing a cp314-compatible aarch64 wheel.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v1.11.0 publish run stalled compiling uvloop from source and had to be cancelled. Nothing was published (no GHCR image, no GitHub release).
Cause: uvloop 0.21.0 ships no
cp314wheel for any architecture, so the Python 3.14 upgrade in this release forces pip to build it (and libuv) from the sdist. On thelinux/arm64leg of the multi-arch build that runs under QEMU emulation, where it sat at 400+ seconds with no end in sight — against a 9-minute baseline for the entire job at 1.10.0.Fix: uvloop 0.22.1 publishes
cp314manylinux aarch64 wheels.Verified by installing both versions in a
linux/arm64python:3.14-slimcontainer:uvloop==0.21.0→ downloadsuvloop-0.21.0.tar.gz(source, must compile)uvloop==0.22.1→ downloadsuvloop-0.22.1-cp314-cp314-...aarch64.whl(prebuilt)A sweep of all 73 pinned production dependencies confirms uvloop was the only one missing a cp314-compatible aarch64 wheel, so this should be the single blocker.
Full suite green (6817 passed). Changelog line updated to record the uvloop bump and why.