0 Releases 5 Tags

RSS Feed

• v4.0.0 5dc4a8f6cb

  Compare

  feat!: require Python 3.15 and fix unsigned session cookies

  daniel156161 released this 2026-10-21 16:40:59 +02:00 | 1 commits to master since this release

  BREAKING CHANGE: the minimum supported Python version is now 3.15.

  Python 3.15:

  • Raise requires-python from >=3.13 to >=3.15.
  • Replace the 3.13 trove classifier with 3.15.
  • Pin the toolchain via a .python-version file.
  • Pin setup-uv to Python 3.15 in the publish workflow.
  • Correct the stale "Python 3.7.0 or higher" claim in the README.
  • Verified against CPython 3.15.0; all extras resolve to 3.15 wheels.

  Session cookie fixes:

  • Fix save_session() crashing with AttributeError on every request.
  • The str sid was decoded as bytes when SESSION_USE_SIGNER is off.
  • That is the default, so it broke the stock configuration.
  • Only decode in the signer branch, where sign() actually returns bytes.
  • Handle a missing secret_key instead of calling sign() on None.
  • A missing signer now warns and skips the cookie, like open_session().
  • Both bugs predate this release and affect all Python 3 versions.

  Tests:

  • Add a pytest suite; the project previously had no tests at all.
  • Cover the cookie round-trip for both signed and unsigned sessions.
  • Cover session state surviving a follow-up request.
  • Cover the missing secret_key path.
  • Three of the five tests fail without the save_session() fix.
  • Add pytest and pytest-asyncio to the dev dependency group.
  • Enable asyncio_mode = "auto" so tests need no per-test markers.

  Version:

  • Bump the package version to 4.0.0.
  • Derive version from installed package metadata.
  • It was hardcoded and had drifted to 3.0.0 while the release was 3.0.2.
  • pyproject.toml is now the single source of truth for the version.
  • Commit uv.lock to pin the development environment.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)