Bump autobahn from 25.12.2 to 26.6.2

[dependabot]

Bumps autobahn from 25.12.2 to 26.6.2.

Release notes

Sourced from autobahn's releases.

Development Build fork-402c2509-oberstet_autobahn_python-fix_1891-202607011603

Development build from pull request

Build Information

• Commit: a66e2465
• Build Date: 2026-07-01 16:07:55 UTC
• Release Type: development

Included Platforms

• Linux: x86_64, ARM64 (manylinux wheels + pure Python fallbacks)
• macOS: Apple Silicon ARM64
• Windows: x86_64

Python Versions

• CPython: 3.11, 3.12, 3.13, 3.14
• PyPy: 3.11

Installation

Download the appropriate wheel for your platform:

pip install <downloaded-wheel-file>

Artifact Inventory

• Total Wheels: 20
• Source Distributions: 3

Release v26_6_2

Official release v26_6_2

Included Platforms

• Linux: x86_64, ARM64 (manylinux_2_34 wheels with NVX)
• macOS: Apple Silicon ARM64 (binary wheels with NVX)
• Windows: x86_64 (binary wheels with NVX)

Python Versions

• CPython: 3.11, 3.12, 3.13, 3.14
• PyPy: 3.11

Installation

... (truncated)

Changelog

Sourced from autobahn's changelog.

26.6.2

WAMP Cryptosign

• Fix import autobahn.wamp.cryptosign raising TypeError: unsupported operand type(s) for |: 'str' and 'NoneType' on CPython 3.11/3.12/3.13 when crypto support (nacl) is installed. A ruff UP007 autofix in 26.6.1 (#1843) had rewritten Optional["ISecurityModule"] to "ISecurityModule" | None in a module that lacks from __future__ import annotations, so the string forward-reference union was evaluated eagerly at class-definition time (CPython 3.14 was unaffected because PEP 649 defers annotation evaluation). The regression broke WAMP-cryptosign and any importer with crypto dependencies present (e.g. xbr, Crossbar.io) on CPython < 3.14. Added from __future__ import annotations to cryptosign.py to defer annotation evaluation (#1878)

Build & CI/CD

• Add an import smoke test that imports every public autobahn submodule with the crypto extras installed, so eager-evaluation annotation regressions like #1878 are caught in CI on all supported Python versions (#1878)

26.6.1

WAMP RawSocket

• Fix the Twisted WampRawSocketProtocol raising TransportLost out of dataReceived when the opening handshake fails before a WAMP session is attached (e.g. an invalid magic byte from a port scanner). abort() now tears down the transport whenever a transport is present - rather than only when a session is open - so a failed handshake closes the connection cleanly with a single warning instead of an "Unhandled Error" stack trace, and handshake processing stops instead of continuing past the abort. The asyncio backend already behaved correctly; cross-backend regression tests were added for both. Thanks to @​karel-un for the report (#1850)

WAMP Serialization

• py-ubjson (unmaintained, sdist-only) is no longer an unconditional dependency. A base pip install autobahn — and the wheels-only / cross-arch case from #1849 (pip download --only-binary :all: --platform ...) — now resolves entirely from binary wheels (#1849)
• The WAMP ubjson serializer is now backed by the maintained bjdata (Binary JData) package, provided as the OPTIONAL autobahn[serialization] extra (it also pulls in numpy), keeping both out of a minimal install (#1849)
• bjdata is published sdist-only (no PyPI wheels) and is currently CPython-only: on PyPy its sdist build pulls an unbuildable numpy (upstream NeuroJSON/pybj#6), so the ubjson serializer is unavailable on PyPy - use cbor/msgpack there. On CPython without a compiler, set PYBJDATA_NO_EXTENSION=1 for a pure-Python build. For wheels-only or cross-arch deployments, also prefer cbor/msgpack (#1849)
• ⚠️ Wire-level change to watch out for: bjdata's octet-level encoding is NOT identical to the previous py-ubjson/UBJSON bytes (different integer markers, little-endian). The WAMP serializer id remains ubjson for transport negotiation. The wamp-proto UBJSON test vectors will be regenerated in a follow-up PR after this release; until then the ubjson serializer is excluded from the byte-vector conformance suite (round-trip and cross-serializer coverage retained) (#1849)

FlatBuffers

• Bump vendored FlatBuffers from v25.9.23 to v25.12.19, restoring the version-sync with zlmdb 26.6.1 (#1853)
• Commit the binary schemas (reflection.bfbs, wamp.bfbs) to the source tree and ship them as-is; the package build no longer runs flatc, which fixes cross-compilation from the PyPI sdist (e.g. Buildroot/Yocto/aarch64) (#1853)
• Add just generate-reflection to regenerate the committed binary schemas with a version-matched flatc built from deps/flatbuffers (#1853)
• Add just check-flatbuffers-sync and a unit test exercising check_zlmdb_flatbuffers_version_in_sync() (#1853)
• Delete two orphaned generated files, Kdf.py and ChannelBinding.py, left in src/autobahn/wamp/gen/wamp/proto/ after the schema renamed those tables to KDF and TLSChannelBinding. Their case-insensitive collisions with the current KDF.py / TLSChannelBinding.py broke git clone and directory copies on case-insensitive filesystems (APFS/macOS, some Docker setups). They are no longer produced by flatc, and the verification from #1830 now keeps such orphans from recurring. Thanks to @​dcki for the report (#1828)

Build & CI/CD

• Bump shared .ai (wamp-ai) and .cicd (wamp-cicd) submodules to match zlmdb exactly (#1853)
• Fix scripts/update_flatbuffers.sh git-version capture for submodule checkouts (.git is a file, not a directory) (#1853)
• Bump the .cicd (wamp-cicd) submodule to pick up the script/shell-injection fix in the shared identifiers.yml reusable workflow (untrusted GitHub event fields are now passed via env: as quoted data with a fail-closed branch-name allowlist) (#1856)
• Fail wheel builds hard when NVX was requested (AUTOBAHN_USE_NVX) but the CFFI extension did not compile, instead of silently degrading to a pure-Python (py3-none-any) wheel. A transient native-compile crash (e.g. a gcc SIGSEGV under QEMU ARM64 emulation) now aborts the build with a non-zero exit so CI can retry it, rather than uploading a structurally valid but unintended artifact. Building with AUTOBAHN_USE_NVX=0 still produces a pure-Python wheel as before (#1856)
• Fix NVX native-extension builds breaking under cross-compilation (e.g. Buildroot/Yocto for aarch64), where the cross toolchain rejected the host-only -march=native flag (unknown value 'native' for '-march'). The default architecture target is now the portable baseline for all build contexts (wheels, local source installs, and cross-compilation), with -march=native available opt-in via AUTOBAHN_ARCH_TARGET=native. The target architecture is detected via sysconfig.get_platform() so the correct baseline is chosen when cross-compiling. Thanks to @​jameshilliard for the original report and approach (#1834, #1835)
• Fail the just build-all recipe (non-zero exit) when any per-interpreter wheel build fails, naming the interpreter(s). Previously a failed build was silently swallowed, producing a green wheels job with a missing wheel that was only caught downstream by strict release fileset validation (#1859)
• Cap cbor2 < 6 on PyPy/Windows only (via environment markers), keeping cbor2 6.x everywhere else. cbor2 6.x is Rust/pyo3-only with no PyPy/Windows wheel and no pure-Python fallback, so it cannot be installed on PyPy/Windows; the 5.x line ships a pure-Python wheel (and runs at near-native speed on PyPy). This unblocks building and installing autobahn on PyPy/Windows (#1859)
• Build and publish the missing CPython 3.12 and 3.14 manylinux_*_aarch64 (ARM64) wheels. The per-version ARM64 build matrix (added in commit 3d856f5 to deduplicate wheels) only covered cp311 and cp313, so no cp312 aarch64 wheel was ever published (and cp314 was never added) - e.g. pip download autobahn --platform manylinux_2_34_aarch64 for CPython 3.12 found no matching distribution. The strict release fileset manifest shared the same gap and so could not catch it; it now requires the cp312/cp314 aarch64 wheels (fail-closed). Thanks to @​norrisjeremy for the report (#1848)
• Make the release fileset symmetric across all four platforms: every supported interpreter (cp311, cp312, cp313, cp314, pypy311) is now required on macOS/arm64, Linux/x86_64, Linux/aarch64, and Windows/amd64. The macOS job already built all interpreters via just build-all, but the manifest only required cp313/cp314/pypy311, so the cp311/cp312 macOS wheels were built and then dropped as "extra" rather than published; they are now kept and required (#1848)
• Remove orphaned/attic files left over from the pre-justfile/uv CI/CD system: Makefile.orig, Dockerfile.wheels, mypy.ini, test-docker-builds.sh, versions.sh, deploy.sh, .prettierrc.json, .coveragerc, docs/DOCKER_BUILDS.md, docker/README.md and the pyinstaller/ PyInstaller hooks, plus the unused pyinstaller dev dependency. The .coveragerc omit = */test/*.py setting was preserved by migrating it to [tool.coverage.run] in pyproject.toml (so coverage still excludes in-package test modules), and the stale DOCKER_BUILDS.md entry was dropped from the Sphinx exclude_patterns. mypy is unaffected: the typing recipe already passes --config-file pyproject-static-typing.toml explicitly. setuptools was added explicitly to the dev extra: it is required by cffi's ffi.compile() to build the NVX extensions in an editable install on Python >= 3.12 (stdlib distutils was removed in 3.12) and had been pulled in only transitively via the removed pyinstaller (#1831)
• Fix the FlatBuffers generated-code verification so it actually detects drift. The build-fbs recipe now uses the vendored, version-matched flatc bundled in the venv (${VENV_PATH}/bin/flatc) instead of an arbitrary system flatc, and the CI job runs just clean-fbs before just build-fbs so orphaned/stale generated files no longer survive in both the before and after states (previously they matched checksums and went undetected). On drift the job now fails with an actionable, categorized table - content differs (regenerate & commit, e.g. after a vendored-flatc bump), orphan / not generated (delete), new, not committed (commit) - derived from git status of the regenerated tree (#1830)

Commits

• 522e83b Fix 1878 (#1879)
• e5be16a Fix 1830 (#1874)
• f5fb7b6 Fix 1831 (#1865)
• f005049 Fix 1850 (#1862)
• b66b854 Fix 1848 (#1861)
• c2806fb Fix 1859 (#1860)
• 70b4b42 Fix 1834 (#1858)
• c7e7f26 Fix 1856 (#1857)
• 4514e3e Fix 1849 (#1855)
• f1ac1c3 Merge pull request #1854 from oberstet/fix_1853
• Additional commits viewable in compare view

[KafetzisThomas]

@dependabot recreate