Bump autobahn from 26.6.2 to 26.7.1

[dependabot]

Bumps autobahn from 26.6.2 to 26.7.1.

Release notes

Sourced from autobahn's releases.

Development Build fork-cb27a48a-ndabas_autobahn_python-master-202609221820

Development build from pull request

Build Information

• Commit: b77f5ae5
• Build Date: 2026-09-22 18:26:27 UTC
• Release Type: development

Included Platforms

• Linux: x86_64, ARM64 (manylinux wheels + pure Python fallbacks)
• macOS: Apple Silicon ARM64
• Windows: x86_64

Python Versions

• CPython: 3.11, 3.12, 3.13, 3.14
• PyPy: 3.11

Installation

Download the appropriate wheel for your platform:

pip install <downloaded-wheel-file>

Artifact Inventory

• Total Wheels: 28
• Source Distributions: 3

Development Build fork-b77f5ae5-oberstet_autobahn_python-fix_1943-202609220013

Development build from pull request

Build Information

• Commit: 2367d146
• Build Date: 2026-09-22 00:17:09 UTC
• Release Type: development

Included Platforms

• Linux: x86_64, ARM64 (manylinux wheels + pure Python fallbacks)
• macOS: Apple Silicon ARM64
• Windows: x86_64

... (truncated)

Changelog

Sourced from autobahn's changelog.

26.7.1

Security

• Fix WebSocket maxMessagePayloadSize being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past maxMessagePayloadSize is now rejected where it previously passed; uncompressed traffic and the per-frame maxFramePayloadSize wire guard are unaffected (#1909)
• Fix the permessage-deflate max_message_size receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded decompress(…, max_length) left the remaining input in unconsumed_tail undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises PayloadExceededError as soon as the uncompressed size would exceed the cap (#1908)
• Make bounded decompression backend-agnostic: decompress_message_data() gains an optional max_output_len argument (documented on the PerMessageCompress base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by maxFramePayloadSize) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining maxMessagePayloadSize budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check (#1909) remains as a backstop. Previously only deflate had any decompressed-output cap, so a snappy/bzip2/brotli frame could inflate fully into memory first (#1910)
• Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio WampRawSocketFactory now exposes setProtocolOptions(maxMessagePayloadSize=...) / resetProtocolOptions() (bounds [512, 2**24], default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead max_size=None branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket max_message_size had no effect on the asyncio path (#1911)

FlatBuffers

• Fix check_zlmdb_flatbuffers_version_in_sync() comparing the build-time version() (which is (0, 0, 0, None, None) on installed wheels, where the vendored FlatBuffers __git_version__ is unstamped) — it now compares the reliably-stamped __version__ and returns a version string. Added regression tests (#1891)
• Make autobahn.flatbuffers.version() reliable on installed wheels: when the build-time __git_version__ is a bare commit hash or "unknown" (shallow clone / submodule absent from the sdist), version() now falls back to parsing the static vendored __version__ and returns (major, minor, patch, None, None) instead of (0, 0, 0, None, None); rich git describe detail is still returned on genuine dev/git builds. Also hardened hatch_build.py so it never stamps a non-parseable __git_version__. Return shape is unchanged (5-tuple); no API break (#1891)

Build & CI/CD

• Add CalVer / PEP 440 version-management just recipes (file-version, bump-dev, bump-next, prep-release) mirroring Crossbar.io, and document the versioning policy in CONTRIBUTING.md (#1894)
• Add ruff check --select ANN,UP,TCH (annotation presence, pyupgrade modern syntax, TYPE_CHECKING imports) to the just check-typing recipe so annotation/style regressions are caught in the quality-checks CI job. The existing gaps in src/autobahn/ are ratcheted via an explicit --ignore allowlist to be removed module-by-module (#1839); all other UP/TC rules are enforced immediately, and generated code is excluded. The annotation rules are scoped to this recipe via the command line rather than the global [tool.ruff.lint] select, so the repo-wide check-format gate is unaffected (#1840)
• Fix the aarch64 CPython 3.14 wheel shipping the free-threaded ABI (cp314t) in the GIL cp314 slot (26.6.x). Root cause: manylinux images pre-install both the GIL and free-threaded 3.14 under /opt/python and prepend them to PATH, and uv resolved cpython-3.14 to the free-threaded interpreter (first on PATH). The create recipe now drops free-threaded …t/bin dirs from PATH for GIL envs so uv selects the GIL build. As defence-in-depth, just build also asserts (via _check-venv-abi) that the interpreter's GIL/free-threaded status matches the env and aborts on mismatch, so a wrong-ABI wheel can never be published. A reserved cpy314t env spec (cpython-3.14t) is added for a future free-threaded wheel variant (#1875)
• Bump the .cicd (wamp-cicd) submodule to include exact CPython ABI-tag matching in the shared check-release-fileset release-gate action, so a wrong-ABI wheel (e.g. cp314t in the cp314 slot) is also rejected at release-fileset validation, not only by the build-time guard above (wamp-cicd #11, completes #1875)
• Publish musllinux_1_2 (musl libc / Alpine Linux) binary wheels with NVX acceleration for CPython 3.11–3.14 on both x86_64 and aarch64. Previously pip install autobahn on Alpine fell back to a source build that failed (the clang-built python-build-standalone interpreter's sysconfig carries a --rtlib=compiler-rt flag that Alpine's gcc rejects), so Alpine users could not install autobahn at all; the prebuilt wheels make it "just work". Built inside the official PyPA musllinux_1_2 images (gcc toolchain), tagged automatically by auditwheel, and gated by the check-release-fileset targets. PyPy-on-musl is a tracked follow-up (no official PyPA musllinux PyPy image) (#1877)

Commits

• 22055b5 Fix 1930 (#1931)
• 7d9baba Fix 1911 (#1922)
• 583b534 Fix 1910 (#1921)
• 77d323a Fix 1909 (#1916)
• cd2dffd Fix 1908 (#1912)
• e9eebbe Fix 1877 (#1905)
• c103d73 Fix 1875 (#1902)
• 36aa406 Fix 1840 (#1895)
• 20821ab Fix 1891 (#1894)
• a66e246 Remove duplicate run call for ApplicationRunner (#1887)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.