------------------------------------------------------------------- Wed Feb 4 13:24:48 UTC 2026 - Daniel Garcia - migrate to libalternatives - Update to version 6.18.0 - Store all available hashes of files. - Validate hashes of all files during devpi-import, not only releases. ## Bug Fixes - Apply argparse transformations on values read from config file or environment. - Restore Python and platform info in user agent string after switch to httpx. - Remove all database entries on project deletion instead of only emptying them. - Fix error at end of replica streaming caused by changed behavior from switch to httpx. - Fix #1102: The data stream was cut off after 64k when proxying from replica to primary after switching to httpx. - Fix #1107: retry file downloads if there has been an error during download. # Other Changes - The filenames of some exported doczip files change due to normalization of the project name caused by changing the internals during export to allow ``--hard-links`` to work. - 6.17.0 (2025-08-27) ## Deprecations and Removals - Dropped support for migrating old password hashes that were replaced in devpi-server 4.2.0. - Removed support for basic authorization in primary URL. The connection is already secured by a bearer token header. - Removed the experimental ``--replica-cert`` option. The replica is already using a token via a shared secret, so this is redundant. - Removed ``--replica-max-retries`` option. It wasn't implemented for async_httpget and didn't work correctly when streaming data. ## Features - Use httpx for all data fetching for mirrors and fetch projects list asynchronously to allow update in background even after a timeout. - Use httpx instead of requests when proxying from replicas to primary. - Use httpx for all requests from replicas to primary. - Use httpx when pushing releases to external index. - Added ``mirror_ignore_serial_header`` mirror index option, which allows switching from PyPI to a mirror without serials header when set to ``True``, otherwise only stale links will be served and no updates be stored. - The HTTP cache information for mirrored projects is persisted and re-used on server restarts. - Added ``--file-replication-skip-indexes`` option to skip file replication for ``all``, by index type (i.e. ``mirror``) or index name (i.e. ``root/pypi``). ## Bug Fixes - Correctly handle lists for ``Provides-Extra`` and ``License-File`` metadata in database. - Fix traceback by returning 401 error code when using wrong password with a user that was created using an authentication plugin like devpi-ldap which passes authentication through in that case. - Fix #1053: allow users to update their passwords when ``--restrict-modify`` is used. - Fix #1097: return 404 when trying to POST to +simple. ## Other Changes - Changed User-Agent when fetching data for mirrors from just "server" to "devpi-server". - 6.16.0 (2025-06-25) ## Deprecations and Removals - Dropped support for Python 3.7 and 3.8. ## Features - Update stored package metadata fields to version 2.4 for license expressions (PEP 639). ## Bug Fixes - Preserve hash when importing mirror data to prevent unnecessary updates later on. - Keep original metadata_version in database. - 6.15.0 (2025-05-18) ## Features - Add ``--connection-limit`` option to devpi-server passed on to waitress. - 6.14.0 (2024-10-16) ## Features - Allow pushing of versions which only have documentation and no releases. - Allow pushing of release files only with no documentation. Requires devpi-client 7.2.0. - Allow pushing of documentation only with no release files. Requires devpi-client 7.2.0. ## Bug Fixes - No longer automatically "register" a project when pushing releases to PyPI. The reply changed from HTTP status 410 to 400 breaking the upload. With devpi-client 7.2.0 there is a ``--register-project`` option if it is still required for some other package registry. - 6.13.0 (2024-09-19) ## Deprecations and Removals - Remove/Deprecate "master" related terminology in favor of "primary". Usage related changes are the switch to ``--primary-url`` instead of ``--master-url`` and ``--role=primary`` instead of ``--role=master``. Using the old terms will now output warnings. The ``+status`` API has additional fields and the ``role`` field content will change with 7.0.0. ## Features - Enable logging command line options for all commands. - Added support uv pip as an installer. ## Bug Fixes - Don't report on lagging event processing while replicating. - Report primary serial correctly with streaming replication. - Don't store file data in memory when fetching a release while pushing from a mirror. - Only warn about replica not being in sync instead of fatal status while still replicating. - 6.12.1 (2024-07-24) ## Bug Fixes - Support Python 3.13 by depending on legacy-cgi. - Preserve query string when proxying requests from replica to primary. This fixes force removal on non-volatile indexes and probably other bugs. - Fix #1044: Correctly update cache expiry time when mirrored server returns 304 Not Modified. - 6.12.0 (2024-06-25) ## Features - Added ``devpiserver_on_toxresult_store`` hook to allow blocking or skipping a toxresult upload on more specific conditions as ``acl_toxresult_upload`` would allow. - Added ``devpiserver_on_toxresult_upload_forbidden`` hook to allow returning a custom message and result (403 or 200). ## Bug Fixes - Return json data if toxresult upload is forbidden. ------------------------------------------------------------------- Thu Sep 25 04:39:49 UTC 2025 - Steve Kowalik - Add missing BuildRequires on pytest-asyncio. ------------------------------------------------------------------- Tue May 28 09:33:23 UTC 2024 - John Paul Adrian Glaubitz - Update to version 6.11.0 * The ``devpi-fsck`` script now returns an error code when there have been missing files or checksum errors. * Fix #983: Add plugin hook for mirror authentication header. * Preserve last modified of docs and toxresults during export/import. * Fix #1033: Use ``int`` for ``--mirror-cache-expiry`` to fix value of ``proxy_cache_valid`` in nginx caching config. - from version 6.10.0 * Use ``Authorization`` header instead of adding username/password to URL when fetching from mirror. * Fix #998: Use the pure Python httpx library instead of aiohttp to prevent delays in supporting newest Python releases. * Fix #996: support hashes other than sha256 in application/\ vnd.pypi.simple.v1+json responses. * Only compare hostname instead of full URL prefix when parsing mirror packages to fix mirrors with basic authentication and absolute URLs. See #1006 - Adjust upstream source name in spec file - Remove unrecognized --slow parameter from pytest command line - Update BuildRequires and Requires from setup.py ------------------------------------------------------------------- Thu Oct 19 01:15:47 UTC 2023 - Steve Kowalik - Switch to pyproject macros. - Stop using greedy globs in %files. - Clean up skipping tests, packaging >22 is now required ------------------------------------------------------------------- Thu Aug 10 11:53:00 UTC 2023 - Dominique Leuenberger - Update to version 6.9.2: * Prevent duplicates when adding values to lists in index configuration with ``+=`` operator. - Changes from version 6.9.1: * Prevent error in find_pre_existing_file in case of incomplete metadata. * Remove long deprecated backward compatibility for old pluggy versions to fix error with pluggy 1.1.0. - Changes from version 6.9.0: * Features - Support export directory layout for ``--replica-file-search-path`` option. - Fix #931: Add ``mirror_no_project_list`` setting for mirror indexes that have no full project list like google cloud artifacts or if you want to prevent downloading the full list for huge indexes like PyPI. * Bug Fixes - Keep a reference to async tasks to avoid their removal mid execution. - Support changed default of ``enforce_content_length`` in urllib3 >= 2. - Fix #934: Properly set PATH_INFO when outside URL is used with sub-path. - Fix #945: Adapt FatalError to be usable as an async HTTP response when updating a project on a mirror. - Fix wrong hash metadata introduced in 6.5.0 for toxresults which prevents replication. The metadata can be fixed by an export/import cycle. ------------------------------------------------------------------- Fri Jun 9 07:35:18 UTC 2023 - ecsos - Add %{?sle15_python_module_pythons} ------------------------------------------------------------------- Mon Apr 10 07:28:50 UTC 2023 - Daniel Garcia - Disable broken tests with latest version of python-packaging. gh#devpi/devpi#948 ------------------------------------------------------------------- Tue Dec 13 04:54:49 UTC 2022 - Yogalakshmi Arunachalam - Update to version 6.8.0 * Features - Fix #929: Cache normalized project names per transaction on mirror index instances. * Bug Fixes - Fix #914: add locking to list_projects_perstage of mirror indexes to prevent multiple slow concurrent updates of the full project name list. - Catch exceptions in async_httpget analog to httpget. - Add locking to mirror name cache to prevent race condition on updates. ------------------------------------------------------------------- Fri Oct 21 07:47:48 UTC 2022 - Daniel Garcia - Version update to 6.7.0 6.7.0 (2022-09-28) ================== Features -------- - Add nginx example to devpi-gen-config with caching of simple pages for installers like pip. - Automatically check for +files when using --replica-file-search-path. - Set headers to prevent caching for simple links with stale results. Bug Fixes --------- - Fix #840: Correct url scheme in config if nginx is behind another proxy. 6.6.1 (2022-09-12) ================== Bug Fixes --------- - Fix slowdown introduced in 6.6.0 when simple links for mirrors are requested more than once in the same thread. - Removed preservation of original server uuid during import. Imported state is different from the original server. Replicas could not detect the change and get into an inconsistent state. - Prevent cache trashing when updating simple links on mirrors for projects with huge number of releases. - Preserve toxresult filenames during import to keep them being accessible on the same URLs after the fix for #686 in 5.2.0. 6.6.0 (2022-08-16) ================== Features -------- - Fix #592: return dict from list_projects_perstage of mirrors where the values contain the un-normalized project name. This allows support in devpi-web 4.1.0 to index them correctly. - Check name in project list instead of fetching project page for mirrors. This improves response times and avoids leaking typos of private package names upstream. - Use ETag header if provided by mirror to reduce bandwidth usage and latency. - Prevent concurrent updates of simple links on mirrors with a short lived lock. - Support PEP-691 conformant fetching for mirrors, and requests with JSON result for installers. Proxy servers should add compression support for the application/vnd.pypi.simple.v1+json content type (gzip_types for nginx). Bug Fixes --------- - Fix #743: support PEP427 escaped wheels with local version, where the + is replaced by _. - Fix #895: store and return content of data-yanked. - Fix #908: include basic auth from mirror_url when fetching packages. - Fix #914: switch to write transaction as late as possible when streaming a file from a mirror. ------------------------------------------------------------------- Mon May 2 09:29:09 UTC 2022 - pgajdos@suse.com - version update to 6.5.1 6.5.1 (2022-04-25) ================== Bug Fixes --------- - Fix traceback when trying to delete already deleted release or toxresult. - Preserve index config settings of plugins during import instead of aborting, even if the plugin isn't installed during import. 6.5.0 (2022-03-18) ================== Features -------- - Added ``--no-checksum`` option to ``devpi-fsck`` to skip checksum validation and only check for file existence. - Split keyfs cache into a small changelog cache and a relpath cache, this lowers overall memory usage and prevents cache trashing. - Lower memory usage by avoiding to read release files into memory and instead use existing file objects. - Switch to ``platformdirs`` from ``appdirs``. - Add streaming replica protocol, which is faster and uses less memory, especially when rebuilding a replica. - Better logging and handling if a thread unexpectedly dies. Bug Fixes --------- - Fix #871: authentication info in ``mirror_url`` wasn't passed on to release links anymore. - Open database connection after file was downloaded during replication to avoid conflicts and locking. - Avoid hashing data twice when writing to storage. - Close HTTP responses and sessions when done to free resources as early as possible instead of waiting for garbage collection. 6.4.0 (2022-01-24) ================== Deprecations and Removals ------------------------- - As announced with 6.0.0, support for Python 3.6 has been dropped, because it has reached its end of life. Features -------- - When an installer user agent is detected the full list of projects is returned unsorted and with less info to improve performance and reduce memory usage. Bug Fixes --------- - Use ``__slots__`` for some classes to reduce memory usage. - Fix exceptions related to logging for some edge cases. 6.3.1 (2021-12-07) ================== Bug Fixes --------- - Fix #864: enable settings from ``~/.netrc`` and ``HTTP_PROXY``/``HTTPS_PROXY`` env vars for aiohttp. 6.3.0 (2021-11-19) ================== Features -------- - Use aiohttp (asyncio) for fetching release links from mirrors to return stale links immediately in case of a timeout, but update the database in the background for the next request. Bug Fixes --------- - fix #853: prevent duplicate mirror indexes in sro method when there are multiple inheritance chains to the same mirror - fix #860: don't check for existing files and validate them during mirror links update, the operation is way to expensive and there is a low possibility for errors. - Add missing `lazy` package dependency. Previously this was only a transitive dependency coming from the devpi-common package. ------------------------------------------------------------------- Mon Nov 8 11:58:00 UTC 2021 - Dirk Müller - update to 6.2.0: * Optimized some database access patterns. A new index is added to the database on first startup. For large databases that can take a while. * Improved performance of loads from database. * Optimized memory and cache use for database access. * Use frozenset for project name cache of mirror indexes. This mitigates memory fragmentation on some Linux distributions. ------------------------------------------------------------------- Tue Aug 3 09:11:58 UTC 2021 - Markéta Machová - Update to 6.1.0 * Proxy requests from replica to master are now streamed if possible. * Dropped support for Python 2.7, 3.4 and 3.5. Python 3.x versions will be supported until their EOL. * Remove deprecated command line options which were replaced by separate scripts. * The user creation and modification time is now stored. * add explicit ruamel.yaml dependency declaration after strictyaml vendored it * Allow user and index URLs to work with a trailing slash. ------------------------------------------------------------------- Tue May 26 07:22:39 UTC 2020 - Petr Gajdos - %python3_only -> %python_alternative ------------------------------------------------------------------- Thu Apr 2 11:26:56 UTC 2020 - Marketa Calabkova - Update to 5.4.1 * This is the last feature release with Python 2.7 support! * Import won't abort anymore when a base index was removed. The bases setting will be imported as is. * The ``requires_python`` metadata is now included in version data on mirror indexes. * Downloaded files from mirrors can be included in exports with the ``--include-mirrored-files`` option. * On import files for mirror indexes are now imported when they were included in the dump (see ``--include-mirrored-files``). * Fix ``--no-root-pypi`` option when importing devpi data. * Fix pushing from mirror to an index when the file was removed and ``mirror_use_external_urls`` is active. - Drop Python2 anyway because of pyramid dropping Python2 ------------------------------------------------------------------- Sun Jan 12 00:25:31 CET 2020 - Matej Cepl - Update from 5.1.0 to 5.3.1: see https://devpi.net/docs/devpi/devpi/stable/+d/changelog.html#devpi-server for detailed changelog. Many options to devpi (e.g., devpi --export) were replaced by the dedicated commands (e.g., devpi-export). ------------------------------------------------------------------- Tue Sep 17 11:16:44 UTC 2019 - Jan Engelhardt - Ensure neutrality of descriptions. ------------------------------------------------------------------- Fri Dec 12 19:29:23 UTC 2014 - tbechtold@suse.com - Initial version