daniel156161/quart-session
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
5dc4a8f6cb12c7b3b9cd731a2be3bb979b9e57e7
quart-session/CHANGELOG.md
T
daniel156161 5dc4a8f6cb
Build & Publish Package / publish (push) Successful in 46s
Details
feat!: require Python 3.15 and fix unsigned session cookies 
BREAKING CHANGE: the minimum supported Python version is now 3.15.

Python 3.15:

- Raise requires-python from >=3.13 to >=3.15.
- Replace the 3.13 trove classifier with 3.15.
- Pin the toolchain via a .python-version file.
- Pin setup-uv to Python 3.15 in the publish workflow.
- Correct the stale "Python 3.7.0 or higher" claim in the README.
- Verified against CPython 3.15.0; all extras resolve to 3.15 wheels.

Session cookie fixes:

- Fix save_session() crashing with AttributeError on every request.
- The str sid was decoded as bytes when SESSION_USE_SIGNER is off.
- That is the default, so it broke the stock configuration.
- Only decode in the signer branch, where sign() actually returns bytes.
- Handle a missing secret_key instead of calling sign() on None.
- A missing signer now warns and skips the cookie, like open_session().
- Both bugs predate this release and affect all Python 3 versions.

Tests:

- Add a pytest suite; the project previously had no tests at all.
- Cover the cookie round-trip for both signed and unsigned sessions.
- Cover session state surviving a follow-up request.
- Cover the missing secret_key path.
- Three of the five tests fail without the save_session() fix.
- Add pytest and pytest-asyncio to the dev dependency group.
- Enable asyncio_mode = "auto" so tests need no per-test markers.

Version:

- Bump the package version to 4.0.0.
- Derive __version__ from installed package metadata.
- It was hardcoded and had drifted to 3.0.0 while the release was 3.0.2.
- pyproject.toml is now the single source of truth for the version.
- Commit uv.lock to pin the development environment.
2026-10-21 16:40:59 +02:00

1.9 KiB
Raw Blame History

4.0.0

  • Breaking: require Python 3.15 or newer (requires-python = ">=3.15", classifier, .python-version).
  • Fix AttributeError: 'str' object has no attribute 'decode' in save_session() when SESSION_USE_SIGNER is disabled (the default), which made every request fail with a 500.
  • save_session() no longer crashes when no secret_key is set while SESSION_USE_SIGNER is enabled; it now logs a warning and skips the cookie, like open_session() does.
  • Add a pytest suite covering the session cookie round-trip.
  • quart_session.__version__ is now read from the installed package metadata instead of a hardcoded string (it had drifted to 3.0.0 while the release was 3.0.2).

3.0.2

  • Add package metadata for Gitea PyPI registry publishing.
  • Add Gitea workflow for tagged package releases.
  • Add explicit redis-trio extra for the bundled Trio Redis client.

2.1.0

  • session_cookie_name fix

2.0.0

  • Move from aioredis to redis

1.0.7

  • Updated memcached support (removed asyncio.loop, removed coroutine decorator)

1.0.6

  • MongoDB support
  • Transfer copyright to Kroket Ltd.

1.0.3 2021-08-31

1.0.0 2020-01-15

  • Added support for arbitrary usage of caching backends.
    • Exposed get, set, delete on the session interface for direct usage.
  • Renamed SESSION_HIJACK_REVERSE_PROXY to SESSION_REVERSE_PROXY.
  • Renamed SESSION_HIJACK_PROTECTION to SESSION_PROTECTION.
  • Removed fallback when X-Forwarded-For is not present whilst USING SESSION_REVERSE_PROXY, emit error instead.
  • Fixed a bug where session timeouts would default to 600 seconds.
  • Deprecated/disabled the dirty() method.

0.0.1 2020-01-04

  • Released initial pre alpha version.
Reference in New Issue View Git Blame Copy Permalink