From d57efb05f5073071ceb2d3b35d72d9d0bc4512a2 Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Tue, 19 May 2026 00:35:01 +0100 Subject: [PATCH 1/4] Drop cookies on redirect (#12550) --- CHANGES/12540.bugfix.rst | 1 + aiohttp/client.py | 1 + tests/test_client_functional.py | 2 +- 3 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 CHANGES/12540.bugfix.rst diff --git a/CHANGES/12540.bugfix.rst b/CHANGES/12540.bugfix.rst new file mode 100644 index 00000000000..dfd98129e4b --- /dev/null +++ b/CHANGES/12540.bugfix.rst @@ -0,0 +1 @@ +Fixed per-request ``cookies`` not being dropped on cross-origin redirects -- by :user:`Dreamsorcerer`. diff --git a/aiohttp/client.py b/aiohttp/client.py index 7c2535fc8ee..4852b5b706b 100644 --- a/aiohttp/client.py +++ b/aiohttp/client.py @@ -857,6 +857,7 @@ async def _connect_and_send_request( ) from origin_val_err if url.origin() != redirect_origin: + cookies = None headers.pop(hdrs.AUTHORIZATION, None) headers.pop(hdrs.COOKIE, None) headers.pop(hdrs.PROXY_AUTHORIZATION, None) diff --git a/tests/test_client_functional.py b/tests/test_client_functional.py index 6f554250805..4be1fb29308 100644 --- a/tests/test_client_functional.py +++ b/tests/test_client_functional.py @@ -3481,8 +3481,8 @@ async def close(self) -> None: headers={ "Authorization": "Basic dXNlcjpwYXNz", "Proxy-Authorization": "Basic dXNlcjpwYXNz", - "Cookie": "a=b", }, + cookies={"a": "b"}, ) as resp: assert resp.status == 200 From 8ea87a1359fd065d7db38f51d4f2aa990fe85b16 Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Tue, 19 May 2026 00:50:15 +0100 Subject: [PATCH 2/4] Simplify the skill frontmatter (#12630) --- .claude/skills/backport-failed/SKILL.md | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/.claude/skills/backport-failed/SKILL.md b/.claude/skills/backport-failed/SKILL.md index 414293b6736..37fcfa4fd85 100644 --- a/.claude/skills/backport-failed/SKILL.md +++ b/.claude/skills/backport-failed/SKILL.md @@ -1,13 +1,6 @@ --- name: backport-failed -description: Recover from a patchback auto-backport failure. Given a merged PR number, parse the patchback comments to find which target branches failed, cherry-pick the merge commit onto each failed branch, resolve conflicts, push to the user's fork, and open backport PRs that exactly match patchback's title and body shape so they look indistinguishable from successful auto-backports. -user-invocable: true -allowed-tools: - - Bash - - Read - - Edit - - Write - - AskUserQuestion +description: Create a manual backport to recover from a Patchback auto-backport failure. --- # /backport-failed — Manual recovery for failed patchback backports From 1aef5d7021e138fa2297f5cc12e2f370c3614c96 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Mon, 18 May 2026 19:16:58 -0700 Subject: [PATCH 3/4] Make pip command configurable via PIP variable in Makefile (#12641) --- CHANGES/12641.contrib.rst | 5 +++++ Makefile | 11 ++++++----- 2 files changed, 11 insertions(+), 5 deletions(-) create mode 100644 CHANGES/12641.contrib.rst diff --git a/CHANGES/12641.contrib.rst b/CHANGES/12641.contrib.rst new file mode 100644 index 00000000000..626500a41b3 --- /dev/null +++ b/CHANGES/12641.contrib.rst @@ -0,0 +1,5 @@ +Made the ``pip`` command used by the ``Makefile`` configurable via a +``PIP`` variable; downstream consumers can now run, for example, +``make .develop PIP="uv pip"`` to install via ``uv`` without us +maintaining a parallel target +-- by :user:`bdraco`. diff --git a/Makefile b/Makefile index f0003454b0c..8f74b0740d6 100644 --- a/Makefile +++ b/Makefile @@ -4,6 +4,7 @@ to-hash-one = $(dir $1).hash/$(addsuffix .hash,$(notdir $1)) to-hash = $(foreach fname,$1,$(call to-hash-one,$(fname))) CYTHON_EXTRA ?= +PIP ?= python -m pip CYS := $(wildcard aiohttp/*.pyx) $(wildcard aiohttp/*.pyi) $(wildcard aiohttp/*.pxd) $(wildcard aiohttp/_websocket/*.pyx) $(wildcard aiohttp/_websocket/*.pyi) $(wildcard aiohttp/_websocket/*.pxd) PYXS := $(wildcard aiohttp/*.pyx) $(wildcard aiohttp/_websocket/*.pyx) CS := $(wildcard aiohttp/*.c) $(wildcard aiohttp/_websocket/*.c) @@ -48,10 +49,10 @@ endif .SECONDARY: $(call to-hash,$(ALLS)) .update-pip: - @python -m pip install --upgrade pip + @$(PIP) install --upgrade pip .install-cython: .update-pip $(call to-hash,requirements/cython.txt) - @python -m pip install -r requirements/cython.in -c requirements/cython.txt + @$(PIP) install -r requirements/cython.in -c requirements/cython.txt @touch .install-cython aiohttp/_find_header.c: $(call to-hash,aiohttp/hdrs.py ./tools/gen.py) @@ -86,7 +87,7 @@ cythonize: .install-cython $(PYXS:.pyx=.c) aiohttp/_websocket/reader_c.c cythonize-nodeps: $(PYXS:.pyx=.c) aiohttp/_websocket/reader_c.c .install-deps: .install-cython $(PYXS:.pyx=.c) aiohttp/_websocket/reader_c.c $(call to-hash,$(CYS) $(REQS)) - @python -m pip install -r requirements/dev.in -c requirements/dev.txt + @$(PIP) install -r requirements/dev.in -c requirements/dev.txt @touch .install-deps .PHONY: lint @@ -101,7 +102,7 @@ mypy: mypy .develop: .install-deps generate-llhttp $(call to-hash,$(PYS) $(CYS) $(CS)) - python -m pip install -e . -c requirements/runtime-deps.txt + $(PIP) install -e . -c requirements/runtime-deps.txt @touch .develop .PHONY: test @@ -178,7 +179,7 @@ doc-spelling: .PHONY: install install: .update-pip - @python -m pip install -r requirements/dev.in -c requirements/dev.txt + @$(PIP) install -r requirements/dev.in -c requirements/dev.txt .PHONY: install-dev install-dev: .develop From 348f0a1ed2887662822a44ca0f6ec0668aa292da Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Mon, 18 May 2026 19:48:30 -0700 Subject: [PATCH 4/4] Combine build-tool update and dependency install into one CI step per job (#12643) --- .github/workflows/ci-cd.yml | 39 +++++++++---------------------------- CHANGES/12643.contrib.rst | 5 +++++ 2 files changed, 14 insertions(+), 30 deletions(-) create mode 100644 CHANGES/12643.contrib.rst diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index ef40c7aa512..c7664dad86f 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -80,12 +80,9 @@ jobs: path: ~/.cache/pip restore-keys: | pip-lint- - - name: Update pip, wheel, setuptools, build, twine - run: | - python -m pip install -U pip wheel setuptools build twine - name: Install dependencies run: | - python -m pip install -r requirements/lint.in -c requirements/lint.txt + python -m pip install -U pip wheel setuptools build twine -r requirements/lint.in -c requirements/lint.txt - name: Install self run: | python -m pip install . -c requirements/runtime-deps.txt @@ -198,14 +195,11 @@ jobs: python-version: ${{ matrix.pyver }} activate-environment: true enable-cache: true - - name: Update pip, wheel, setuptools, build, twine - run: | - uv pip install -U pip wheel setuptools build twine - name: Install dependencies env: DEPENDENCY_GROUP: test${{ endsWith(matrix.pyver, 't') && '-ft' || '' }} run: | - uv pip install -r requirements/${{ env.DEPENDENCY_GROUP }}.in -c requirements/${{ env.DEPENDENCY_GROUP }}.txt + uv pip install -U pip wheel setuptools build twine -r requirements/${{ env.DEPENDENCY_GROUP }}.in -c requirements/${{ env.DEPENDENCY_GROUP }}.txt - name: Set PYTHON_GIL=0 for free-threading builds if: ${{ endsWith(matrix.pyver, 't') }} run: echo "PYTHON_GIL=0" >> $GITHUB_ENV @@ -303,14 +297,11 @@ jobs: python-version: ${{ matrix.pyver }} activate-environment: true enable-cache: true - - name: Update pip, wheel, setuptools, build, twine - run: | - uv pip install -U pip wheel setuptools build twine - name: Install dependencies env: DEPENDENCY_GROUP: test${{ endsWith(matrix.pyver, 't') && '-ft' || '' }} run: | - uv pip install -r requirements/${{ env.DEPENDENCY_GROUP }}.in -c requirements/${{ env.DEPENDENCY_GROUP }}.txt + uv pip install -U pip wheel setuptools build twine -r requirements/${{ env.DEPENDENCY_GROUP }}.in -c requirements/${{ env.DEPENDENCY_GROUP }}.txt - name: Restore llhttp generated files if: ${{ matrix.no-extensions == '' }} uses: actions/download-artifact@v8 @@ -375,12 +366,9 @@ jobs: python-version: 3.13.2 cache: pip cache-dependency-path: requirements/*.txt - - name: Update pip, wheel, setuptools, build, twine - run: | - python -m pip install -U pip wheel setuptools build twine - name: Install dependencies run: | - python -m pip install -r requirements/test.in -c requirements/test.txt + python -m pip install -U pip wheel setuptools build twine -r requirements/test.in -c requirements/test.txt - name: Restore llhttp generated files uses: actions/download-artifact@v8 with: @@ -419,12 +407,9 @@ jobs: uses: actions/setup-python@v6 with: python-version: '3.12' - - name: Update pip, wheel, setuptools, build, twine - run: | - python -m pip install -U pip wheel setuptools build twine - name: Install dependencies run: | - python -Im pip install -r requirements/test.in -c requirements/test.txt + python -Im pip install -U pip wheel setuptools build twine -r requirements/test.in -c requirements/test.txt - name: Uninstall blocbuster run: python -m pip uninstall blockbuster -y - name: Restore llhttp generated files @@ -508,13 +493,10 @@ jobs: submodules: true - name: Setup Python uses: actions/setup-python@v6 - - name: Update pip, wheel, setuptools, build, twine - run: | - python -m pip install -U pip wheel setuptools build twine - - name: Install cython + - name: Install build tooling and cython run: >- python -m - pip install -r requirements/cython.in -c requirements/cython.txt + pip install -U pip wheel setuptools build twine -r requirements/cython.in -c requirements/cython.txt - name: Restore llhttp generated files uses: actions/download-artifact@v8 with: @@ -601,13 +583,10 @@ jobs: uses: actions/setup-python@v6 with: python-version: 3.x - - name: Update pip, wheel, setuptools, build, twine - run: | - python -m pip install -U pip wheel setuptools build twine - - name: Install cython + - name: Install build tooling and cython run: >- python -m - pip install -r requirements/cython.in -c requirements/cython.txt + pip install -U pip wheel setuptools build twine -r requirements/cython.in -c requirements/cython.txt - name: Restore llhttp generated files uses: actions/download-artifact@v8 with: diff --git a/CHANGES/12643.contrib.rst b/CHANGES/12643.contrib.rst new file mode 100644 index 00000000000..8477457ce16 --- /dev/null +++ b/CHANGES/12643.contrib.rst @@ -0,0 +1,5 @@ +Merged the "Update pip, wheel, setuptools, build, twine" step into +the following ``Install dependencies`` (or ``Install cython``) step +in every job in :file:`.github/workflows/ci-cd.yml`, so each job now +runs a single ``pip``/``uv pip install`` invocation instead of two +-- by :user:`bdraco`.