---
- branch: MAIN
date: Tue Nov 9 22:52:17 UTC 2021
files:
- new: '1.46'
old: '1.45'
path: pkgsrc/devel/py-pip/Makefile
pathrev: pkgsrc/devel/py-pip/Makefile@1.46
type: modified
- new: '1.30'
old: '1.29'
path: pkgsrc/devel/py-pip/PLIST
pathrev: pkgsrc/devel/py-pip/PLIST@1.30
type: modified
- new: '1.41'
old: '1.40'
path: pkgsrc/devel/py-pip/distinfo
pathrev: pkgsrc/devel/py-pip/distinfo@1.41
type: modified
id: 20211109T225217Z.b7066406552212dd6e05c0a01fd6b6ae7901f31f
log: "py-pip: update to 21.3.1.\n\n21.3.1 (2021-10-22)\n===================\n\nBug
Fixes\n---------\n\n- Always refuse installing or building projects that have
no ``pyproject.toml`` nor\n ``setup.py``.\n- Tweak running-as-root detection,
to check ``os.getuid`` if it exists, on Unix-y and non-Linux/non-MacOS machines.\n-
When installing projects with a ``pyproject.toml`` in editable mode, and the build\n
\ backend does not support :pep:`660`, prepare metadata using\n ``prepare_metadata_for_build_wheel``
instead of ``setup.py egg_info``. Also, refuse\n installing projects that only
have a ``setup.cfg`` and no ``setup.py`` nor\n ``pyproject.toml``. These restore
the pre-21.3 behaviour.\n- Restore compatibility of where configuration files
are loaded from on MacOS (back to ``Library/Application Support/pip``, instead
of ``Preferences/pip``).\n\nVendored Libraries\n------------------\n\n- Upgrade
pep517 to 0.12.0\n\n21.3 (2021-10-11)\n=================\n\nDeprecations and Removals\n-------------------------\n\n-
Improve deprecation warning regarding the copying of source trees when installing
from a local directory.\n- Suppress location mismatch warnings when pip is invoked
from a Python source\n tree, so ``ensurepip`` does not emit warnings on CPython
``make install``.\n- On Python 3.10 or later, the installation scheme backend
has been changed to use\n ``sysconfig``. This is to anticipate the deprecation
of ``distutils`` in Python\n 3.10, and its scheduled removal in 3.12. For compatibility
considerations, pip\n installations running on Python 3.9 or lower will continue
to use ``distutils``.\n- Remove the ``--build-dir`` option and aliases, one last
time.\n- In-tree builds are now the default. ``--use-feature=in-tree-build`` is
now\n ignored. ``--use-deprecated=out-of-tree-build`` may be used temporarily
to ease\n the transition.\n- Un-deprecate source distribution re-installation
behaviour.\n\nFeatures\n--------\n\n- Replace vendored appdirs with platformdirs.\n-
Support `PEP 610 `_ to detect\n editable
installs in ``pip freeze`` and ``pip list``. The ``pip list`` column output\n
\ has a new ``Editable project location`` column, and the JSON output has a new\n
\ ``editable_project_location`` field.\n- ``pip freeze`` will now always fallback
to reporting the editable project\n location when it encounters a VCS error while
analyzing an editable\n requirement. Before, it sometimes reported the requirement
as non-editable.\n- ``pip show`` now sorts ``Requires`` and ``Required-By`` alphabetically.\n-
Do not raise error when there are no files to remove with ``pip cache purge/remove``.\n
\ Instead log a warning and continue (to log that we removed 0 files).\n- When
backtracking during dependency resolution, prefer the dependencies which are involved
in the most recent conflict. This can significantly reduce the amount of backtracking
required.\n- Cache requirement objects, to improve performance reducing reparses
of requirement strings.\n- Support editable installs for projects that have a
``pyproject.toml`` and use a\n build backend that supports :pep:`660`.\n- When
a revision is specified in a Git URL, use git's partial clone feature to speed
up source retrieval.\n- Add a ``--debug`` flag, to enable a mode that doesn't
log errors and propagates them to the top level instead. This is primarily to
aid with debugging pip's crashes.\n- If a host is explicitly specified as trusted
by the user (via the --trusted-host option), cache HTTP responses from it in addition
to HTTPS ones.\n\nBug Fixes\n---------\n\n- Present a better error message, when
a ``file:`` URL is not found.\n- Fix the auth credential cache to allow for the
case in which\n the index url contains the username, but the password comes\n
\ from an external source, such as keyring.\n- Fix double unescape of HTML ``data-requires-python``
and ``data-yanked`` attributes.\n- New resolver: Fixes depth ordering of packages
during resolution, e.g. a dependency 2 levels deep will be ordered before a dependecy
3 levels deep.\n- Correctly indent metadata preparation messages in pip output.\n\nVendored
Libraries\n------------------\n\n- Remove appdirs as a vendored dependency.\n-
Upgrade distlib to 0.3.3\n- Upgrade distro to 1.6.0\n- Patch pkg_resources to
use platformdirs rather than appdirs.\n- Add platformdirs as a vendored dependency.\n-
Upgrade progress to 1.6\n- Upgrade resolvelib to 0.8.0\n- Upgrade urllib3 to 1.26.7\n\nImproved
Documentation\n----------------------\n\n- Update links of setuptools as setuptools
moved these documents. The Simple Repository link now points to PyPUG as that
is the canonical place of packaging specification, and setuptools's ``easy_install``
is deprecated.\n- Create a \"Build System Interface\" reference section, for documenting
how pip interacts with build systems.\n\n21.2.4 (2021-08-12)\n===================\n\nBug
Fixes\n---------\n\n- Fix 3.6.0 compatibility in link comparison logic.\n\n21.2.3
(2021-08-06)\n===================\n\nBug Fixes\n---------\n\n- Modify the ``sysconfig.get_preferred_scheme``
function check to be\n compatible with CPython 3.10窶å\x86± alphareleases.\n\n21.2.2
(2021-07-31)\n===================\n\nBug Fixes\n---------\n\n- New resolver: When
a package is specified with extras in constraints, and with\n extras in non-constraint
requirements, the resolver now correctly identifies the\n constraint's existence
and avoids backtracking.\n\n21.2.1 (2021-07-25)\n===================\n\nProcess\n-------\n\n-
The source distribution re-installation feature removal has been delayed to 21.3.\n\n21.2
(2021-07-24)\n=================\n\nProcess\n-------\n\n- ``pip freeze``, ``pip
list``, and ``pip show`` no longer normalize underscore\n (``_``) in distribution
names to dash (``-``). This is a side effect of the\n migration to ``importlib.metadata``,
since the underscore-dash normalization\n behavior is non-standard and specific
to setuptools. This should not affect\n other parts of pip (for example, when
feeding the ``pip freeze`` result back\n into ``pip install``) since pip internally
performs standard PEP 503\n normalization independently to setuptools.\n\nDeprecations
and Removals\n-------------------------\n\n- Git version parsing is now done with
regular expression to prepare for the\n pending upstream removal of non-PEP-440
version parsing logic.\n- Re-enable the \"Value for ... does not match\" location
warnings to field a new\n round of feedback for the ``distutils``-``sysconfig``
transition.\n- Remove deprecated ``--find-links`` option in ``pip freeze``\n\nFeatures\n--------\n\n-
New resolver: Loosen URL comparison logic when checking for direct URL reference\n
\ equivalency. The logic includes the following notable characteristics:\n\n *
The authentication part of the URL is explicitly ignored.\n * Most of the fragment
part, including ``egg=``, is explicitly ignored. Only\n ``subdirectory=`` and
hash values (e.g. ``sha256=``) are kept.\n * The query part of the URL is parsed
to allow ordering differences.\n- Support TOML v1.0.0 syntax in ``pyproject.toml``.\n-
Added a warning message for errors caused due to Long Paths being disabled on
Windows.\n- Change the encoding of log file from default text encoding to UTF-8.\n-
Log the resolved commit SHA when installing a package from a Git repository.\n-
Add a warning when passing an invalid requirement to ``pip uninstall``.\n- Add
new subcommand ``pip index`` used to interact with indexes, and implement\n ``pip
index version`` to list available versions of a package.\n- When pip is asked
to uninstall a project without the dist-info/RECORD file\n it will no longer
traceback with FileNotFoundError,\n but it will provide a better error message
instead, such as::\n\n ERROR: Cannot uninstall foobar 0.1, RECORD file not
found. You might be able to recover from this via: 'pip install --force-reinstall
--no-deps foobar==0.1'.\n\n When dist-info/INSTALLER is present and contains
some useful information, the info is included in the error message instead::\n\n
\ ERROR: Cannot uninstall foobar 0.1, RECORD file not found. Hint: The package
was installed by rpm.\n\n- Add an additional level of verbosity. ``--verbose``
(and the shorthand ``-v``) now\n contains significantly less output, and users
that need complete full debug-level output\n should pass it twice (``--verbose
--verbose`` or ``-vv``).\n- New resolver: The order of dependencies resolution
has been tweaked to traverse\n the dependency graph in a more breadth-first approach.\n-
Make \"yes\" the default choice in ``pip uninstall``'s prompt.\n- Add a special
error message when users forget the ``-r`` flag when installing.\n- New resolver:
A distribution's ``Requires-Python`` metadata is now checked\n before its Python
dependencies. This makes the resolver fail quicker when\n there's an interpreter
version conflict.\n- Suppress \"not on PATH\" warning when ``--prefix`` is given.\n-
Include ``rustc`` version in pip's ``User-Agent``, when the system has ``rustc``.\n\nBug
Fixes\n---------\n\n- Update vendored six to 1.16.0 and urllib3 to 1.26.5\n- Correctly
allow PEP 517 projects to be detected without warnings in ``pip freeze``.\n- Strip
leading slash from a ``file://`` URL built from an path with the Windows\n drive
notation. This fixes bugs where the ``file://`` URL cannot be correctly\n used
as requirement, constraint, or index URLs on Windows.\n- New resolver: URL comparison
logic now treats ``file://localhost/`` and\n ``file:///`` as equivalent to conform
to RFC 8089.\n- Prefer credentials from the URL over the previously-obtained credentials
from URLs of the same domain, so it is possible to use different credentials on
the same index server for different ``--extra-index-url`` options.\n- Fix extraction
of files with utf-8 encoded paths from tars.\n- Skip distutils configuration parsing
on encoding errors.\n- New resolver: Detect an unnamed requirement is user-specified
(by building its\n metadata for the project name) so it can be correctly ordered
in the resolver.\n- Fix :ref:`pip freeze` to output packages :ref:`installed from
git `\n in the correct ``git+protocol://git.example.com/MyProject#egg=MyProject``
format\n rather than the old and no longer supported ``git+git@`` format.\n-
Fix warnings about install scheme selection for Python framework builds\n distributed
by Apple's Command Line Tools.\n- Relax interpreter detection to quelch a location
mismatch warning where PyPy\n is deliberately breaking backwards compatibility.\n\nVendored
Libraries\n------------------\n\n- Upgrade certifi to 2021.05.30.\n- Upgrade idna
to 3.2.\n- Upgrade packaging to 21.0\n- Upgrade requests to 2.26.0.\n- Upgrade
resolvelib to 0.7.1.\n- Upgrade urllib3 to 1.26.6.\n\n21.1.3 (2021-06-26)\n===================\n\nBug
Fixes\n---------\n\n- Remove unused optional ``tornado`` import in vendored ``tenacity``
to prevent old versions of Tornado from breaking pip.\n- Require ``setup.cfg``-only
projects to be built via PEP 517, by requiring an explicit dependency on setuptools
declared in pyproject.toml.\n\n21.1.2 (2021-05-23)\n===================\n\nBug
Fixes\n---------\n\n- New resolver: Correctly exclude an already installed package
if its version is\n known to be incompatible to stop the dependency resolution
process with a clear\n error message.\n- Allow ZIP to archive files with timestamps
earlier than 1980.\n- Emit clearer error message when a project root does not
contain either\n ``pyproject.toml``, ``setup.py`` or ``setup.cfg``.\n- Fix detection
of existing standalone pip instance for PEP 517 builds.\n\n21.1.1 (2021-04-30)\n===================\n\nDeprecations
and Removals\n-------------------------\n\n- Temporarily set the new \"Value for
... does not match\" location warnings level\n to *DEBUG*, to hide them from
casual users. This prepares pip 21.1 for CPython\n inclusion, while pip maintainers
digest the first intake of location mismatch\n issues for the ``distutils``-``sysconfig``
transition.\n\nBug Fixes\n---------\n\n- This change fixes a bug on Python <=3.6.1
with a Typing feature added in 3.6.2\n- Fix compatibility between distutils and
sysconfig when the project name is unknown outside of a virtual environment.\n-
Fix Python 3.6 compatibility when a PEP 517 build requirement itself needs to
be\n built in an isolated environment.\n\n21.1 (2021-04-24)\n=================\n\nProcess\n-------\n\n-
Start installation scheme migration from ``distutils`` to ``sysconfig``. A\n warning
is implemented to detect differences between the two implementations to\n encourage
user reports, so we can avoid breakages before they happen.\n\nFeatures\n--------\n\n-
Add the ability for the new resolver to process URL constraints.\n- Add a feature
``--use-feature=in-tree-build`` to build local projects in-place\n when installing.
This is expected to become the default behavior in pip 21.3;\n see `Installing
from local packages `_\n
\ for more information.\n- Bring back the \"(from versions: ...)\" message, that
was shown on resolution failures.\n- Add support for editable installs for project
with only setup.cfg files.\n- Improve performance when picking the best file from
indexes during ``pip install``.\n- Warn instead of erroring out when doing a PEP
517 build in presence of\n ``--build-option``. Warn when doing a PEP 517 build
in presence of\n ``--global-option``.\n\nBug Fixes\n---------\n\n- Fixed ``--target``
to work with ``--editable`` installs.\n- Add a warning, discouraging the usage
of pip as root, outside a virtual environment.\n- Ignore ``.dist-info`` directories
if the stem is not a valid Python distribution\n name, so they don't show up
in e.g. ``pip freeze``.\n- Only query the keyring for URLs that actually trigger
error 401.\n This prevents an unnecessary keyring unlock prompt on every pip
install\n invocation (even with default index URL which is not password protected).\n-
Prevent packages already-installed alongside with pip to be injected into an\n
\ isolated build environment during build-time dependency population.\n- Fix ``pip
freeze`` permission denied error in order to display an understandable error message
and offer solutions.\n- Correctly uninstall script files (from setuptools' ``scripts``
argument), when installed with ``--user``.\n- New resolver: When a requirement
is requested both via a direct URL\n (``req @ URL``) and via version specifier
with extras (``req[extra]``), the\n resolver will now be able to use the URL
to correctly resolve the requirement\n with extras.\n- New resolver: Show relevant
entries from user-supplied constraint files in the\n error message to improve
debuggability.\n- Avoid parsing version to make the version check more robust
against lousily\n debundled downstream distributions.\n- ``--user`` is no longer
suggested incorrectly when pip fails with a permission\n error in a virtual environment.\n-
Fix incorrect reporting on ``Requires-Python`` conflicts.\n- Make wheel compatibility
tag preferences more important than the build tag\n- Fix pip to work with warnings
converted to errors.\n- **SECURITY**: Stop splitting on unicode separators in
git references,\n which could be maliciously used to install a different revision
on the\n repository.\n\nVendored Libraries\n------------------\n\n- Update urllib3
to 1.26.4 to fix CVE-2021-28363\n- Remove contextlib2.\n- Upgrade idna to 3.1\n-
Upgrade pep517 to 0.10.0\n- Upgrade vendored resolvelib to 0.7.0.\n- Upgrade tenacity
to 7.0.0\n\nImproved Documentation\n----------------------\n\n- Update \"setuptools
extras\" link to match upstream.\n- Improve SSL Certificate Verification docs
and ``--cert`` help text.\n- Add a section in the documentation to suggest solutions
to the ``pip freeze`` permission denied issue.\n- Add warning about ``--extra-index-url``
and dependency confusion\n- Describe ``--upgrade-strategy`` and direct requirements
explicitly; add a brief\n example.\n\n21.0.1 (2021-01-30)\n===================\n\nBug
Fixes\n---------\n\n- commands: debug: Use packaging.version.parse to compare
between versions.\n- New resolver: Download and prepare a distribution only at
the last possible\n moment to avoid unnecessary network access when the same
version is already\n installed locally.\n\nVendored Libraries\n------------------\n\n-
Upgrade packaging to 20.9\n\n21.0 (2021-01-23)\n=================\n\nDeprecations
and Removals\n-------------------------\n\n- Drop support for Python 2.\n- Remove
support for legacy wheel cache entries that were created with pip\n versions
older than 20.0.\n- Remove support for VCS pseudo URLs editable requirements.
It was emitting\n deprecation warning since version 20.0.\n- Modernise the codebase
after Python 2.\n- Drop support for Python 3.5.\n- Remove the VCS export feature
that was used only with editable VCS\n requirements and had correctness issues.\n\nFeatures\n--------\n\n-
Add ``--ignore-requires-python`` support to pip download.\n- New resolver: Error
message shown when a wheel contains inconsistent metadata\n is made more helpful
by including both values from the file name and internal\n metadata.\n\nBug Fixes\n---------\n\n-
Fix a regression that made ``pip wheel`` do a VCS export instead of a VCS clone\n
\ for editable requirements. This broke VCS requirements that need the VCS\n information
to build correctly.\n- Fix ``pip download`` of editable VCS requirements that
need VCS information\n to build correctly.\n\nVendored Libraries\n------------------\n\n-
Upgrade msgpack to 1.0.2.\n- Upgrade requests to 2.25.1.\n\nImproved Documentation\n----------------------\n\n-
Render the unreleased pip version change notes on the news page in docs.\n- Fix
broken email link in docs feedback banners.\n\n20.3.4 (2021-01-23)\n===================\n\nFeatures\n--------\n\n-
``pip wheel`` now verifies the built wheel contains valid metadata, and can be\n
\ installed by a subsequent ``pip install``. This can be disabled with\n ``--no-verify``.\n-
Improve presentation of XMLRPC errors in pip search.\n\nBug Fixes\n---------\n\n-
Fixed hanging VCS subprocess calls when the VCS outputs a large amount of data\n
\ on stderr. Restored logging of VCS errors that was inadvertently removed in
pip\n 20.2.\n- Fix error when an existing incompatibility is unable to be applied
to a backtracked state.\n- New resolver: Discard a faulty distribution, instead
of quitting outright.\n This implementation is taken from 20.2.2, with a fix
that always makes the\n resolver iterate through candidates from indexes lazily,
to avoid downloading\n candidates we do not need.\n- New resolver: Discard a
source distribution if it fails to generate metadata,\n instead of quitting outright.
This implementation is taken from 20.2.2, with a\n fix that always makes the
resolver iterate through candidates from indexes\n lazily, to avoid downloading
candidates we do not need.\n\nVendored Libraries\n------------------\n\n- Upgrade
resolvelib to 0.5.4.\n"
module: pkgsrc
subject: 'CVS commit: pkgsrc/devel/py-pip'
unixtime: '1636498337'
user: wiz