Repository navigation
Conversation
The buildpack configures env vars for: - pre/post-compile hooks - Django collectstatic - subsequent buildpacks (via the `export` file) - app run-time (via `profile.d/` scripts) The tests for all of these have been improved, by backporting some of the new test matrix strategies from the Python CNB. In particular, we now test the run-time and hooks env var values with all four supported package managers (and not just when using pip). In addition, we now test that Poetry and uv aren't installed at run-time. GUS-W-19591873.
* Bump uv from 0.8.13 to 0.8.15 Bumps [uv](https://github.com/astral-sh/uv) from 0.8.13 to 0.8.15. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.8.13...0.8.15) --- updated-dependencies: - dependency-name: uv dependency-version: 0.8.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Add changelog entry --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <501702+edmorley@users.noreply.github.com>
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
Currently if an app has only a `setup.py` file and no Python package
manager files (such as `requirements.txt`, `Pipfile.lock`, `Poetry.lock`
or `uv.lock`), the buildpack will install the project using
`pip install --editable .`
However, there is nothing pip-specific about `setup.py` - the file is
not a package manager dependency file but instead a setuptools package
file, and could easily be installed by any package manager. In addition,
some projects may want to install this file in standard rather than
editable mode.
As such, it's best that the buildpack doesn't guess which package
manager and mode to use, and instead we require explicit configuration
from the user.
For example in the form of a `requirements.txt` file that references the
package definition, via this single line in the requirements file:
```
--editable .
```
That said, in general we recommend people don't use `setup.py` to declare
their dependencies, since:
(a) the file is deprecated in favour of `pyproject.toml`
(b) it's intended more for libraries rather than applications, and it's
much less common (and practical) to list all transitive dependencies
in a `setup.py`, meaning apps using the file typically have unpinned
dependencies, which is a production reliability risk. (Apps should
either be using a package manager that supports lockfiles, or else
using one of the pip requirements files substitutes like pip-tools
or `pip freeze` etc).
The existing metrics for this fallback show usage to be very low, so
we'll likely not wait long before converting this warning to an error
(particularly since fixing the error is a case of adding a single
line requirements file, so fairly simple).
GUS-W-19275438.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
* Bump uv from 0.8.15 to 0.8.17 Bumps [uv](https://github.com/astral-sh/uv) from 0.8.15 to 0.8.17. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.8.15...0.8.17) --- updated-dependencies: - dependency-name: uv dependency-version: 0.8.17 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Add changelog entry --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <501702+edmorley@users.noreply.github.com>
* Bump poetry from 2.1.4 to 2.2.0 Bumps [poetry](https://github.com/python-poetry/poetry) from 2.1.4 to 2.2.0. - [Release notes](https://github.com/python-poetry/poetry/releases) - [Changelog](https://github.com/python-poetry/poetry/blob/main/CHANGELOG.md) - [Commits](python-poetry/poetry@2.1.4...2.2.0) --- updated-dependencies: - dependency-name: poetry dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Add changelog entry * Convert some Poetry test fixtures to PEP 735 syntax Poetry 2.2.0 added support for PEP 735. In order to test this, some of the Poetry test fixtures now use dependency groups syntax to specify optional dependencies rather than Poetry's previous proprietary syntax. See: https://github.com/python-poetry/poetry/releases/tag/2.2.0 https://peps.python.org/pep-0735/ --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <501702+edmorley@users.noreply.github.com>
* Bump uv from 0.8.17 to 0.8.18 Bumps [uv](https://github.com/astral-sh/uv) from 0.8.17 to 0.8.18. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.8.17...0.8.18) --- updated-dependencies: - dependency-name: uv dependency-version: 0.8.18 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Update changelog entry --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <501702+edmorley@users.noreply.github.com>
At the end of the build, the Python installation including the site-packages directory (which contains the app's dependencies) has to be copied from the build directory to the cache directory, so that it's cached for the next build. For apps with very large dependencies this can take a considerable amount of time (Honeycomb reports `python.cache_save_duration` as having a P99.9 of 28 seconds). I'd previously benchmarked using `cp --reflink=auto` in the hopes of improving this in a way that would be compatible with all configurations (including Heroku CI and `build-in-app-dir`), but found it made performance worse for standard builds with the current production build system's filesystems and mount configurations. This leaves `cp --link` (which uses hardlinks) as the last way we can improve performance - but using this means: 1. We need to check whether the cache and build directory are on the same filesystem mounts (since otherwise the copy will fail with a `Invalid cross-device link` error). 2. Any modifications made to the files in one location affects the other. (eg by later buildpacks) However, given the Honeycomb data shows the time spent saving the cache really is significant for some apps, it's clear that using `--link` is worth the complexity/mutability trade-offs. In addition, Python package managers typically fully uninstall a package before reinstalling it at a different version - so if any apps perform `pip install` type operations in later buildpacks (which isn't something we officially support anyway), the cache should still be left in a valid state. Note: We use `df` to determine whether both locations are on the same filesystem mount since `stat`'s device number reports the same value for separate filesystems that happen to be mounted on the same backing device. See: - https://manpages.ubuntu.com/manpages/noble/en/man1/cp.1.html - https://manpages.ubuntu.com/manpages/noble/en/man1/df.1.html GUS-W-19603153.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
Record the names of files similar to .python-version in the root of the app, to determine how often that file is misspelled, as a temporary first step before deciding whether to add a new warning/error (and if so, which for which misspelled filenames it should check). GUS-W-19271516.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
For parity with what already exists for Python archive downloads: https://github.com/heroku/heroku-buildpack-python/blob/4d20ad3e50f23e635c46120c1b013df4c1c44f8d/lib/python.sh#L120-L121 Example failure this would now track: ``` -----> Installing uv 0.8.18 curl: (56) Recv failure: Connection reset by peer gzip: stdin: unexpected end of file tar: Unexpected EOF in archive tar: Unexpected EOF in archive tar: Error is not recoverable: exiting now ``` GUS-W-19702437.
When copying files, `cp` can either follow (dereference) symlinks or preserve them. If no explicit `--dereference` or `--no-dereference` option is passed, the default behaviour is currently unspecified by the POSIX specification, and in practice arbitrarily varies based on other options that are passed. Specifically, when using `--link`, cp now defaults to following symlinks, which: (a) means the files aren't copied/linked verbatim (b) means the copy will fail if any of the symlinks are broken For the files owned by the buildpack there are no broken symlinks, however, Python packages in the wild can contain broken symlinks, which causes the build to fail with errors like: ``` -----> Saving cache cp: cannot stat '/tmp/build_123/.heroku/python/src/django-admin-autocomplete-list-filter/.pylintrc': No such file or directory ``` Now, `--no-dereference` is passed, to explicitly disable dereferencing, so we're not dependant on the unspecified defaults. GUS-W-19714036.
* Bump uv from 0.8.18 to 0.8.20 Bumps [uv](https://github.com/astral-sh/uv) from 0.8.18 to 0.8.20. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.8.18...0.8.20) --- updated-dependencies: - dependency-name: uv dependency-version: 0.8.20 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Add changelog entry --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <501702+edmorley@users.noreply.github.com>
* Bump poetry from 2.2.0 to 2.2.1 Bumps [poetry](https://github.com/python-poetry/poetry) from 2.2.0 to 2.2.1. - [Release notes](https://github.com/python-poetry/poetry/releases) - [Changelog](https://github.com/python-poetry/poetry/blob/main/CHANGELOG.md) - [Commits](python-poetry/poetry@2.2.0...2.2.1) --- updated-dependencies: - dependency-name: poetry dependency-version: 2.2.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Add changelog entry --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <501702+edmorley@users.noreply.github.com>
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
Since it was a leftover from when this tar command also passed the uv binary name to only extract the single file from the archive.
Since all of the other checks use `checks::*`.
Similar to #1729, this adds more files to the buildpack's detection list - based on files commonly seen for apps that fail detection due to eg misspelled files. GUS-W-19769721.
) So that any invalid global pip config set by earlier buildpacks (either via `PIP_*` env vars or global pip config files in the HOME directory) don't affect/break the bootstrapping of the package managers. (Such config is still loaded during the later `pip install` used to install the app's own dependencies; this change only affects the internal buildpack bootstrapping stage.) This will help resolve issues seen via Honeycomb such as the bootstrapping step attempting to use custom package index URLs configured via third-party buildpacks like: https://github.com/meetalbert/albert-public-codeartifact-buildpack (which succeeds eventually, but only after delays from timeouts/retries) See: - https://pip.pypa.io/en/stable/cli/pip/#cmdoption-isolated - https://pip.pypa.io/en/stable/topics/configuration/ GUS-W-19770470.
To ensure any stderr is intended too. (All other call sites currently use `|&`) See: https://www.gnu.org/software/bash/manual/html_node/Pipelines.html
Since: - The previously removed output may be useful for debugging. - Ideally output shouldn't differ from what users see locally. - Newer versions of Django are less verbose anyway. GUS-W-19780921.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the ruby-dependencies group with 2 updates: [rubocop](https://github.com/rubocop/rubocop) and [rubocop-rspec](https://github.com/rubocop/rubocop-rspec). Updates `rubocop` from 1.79.2 to 1.81.1 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.79.2...v1.81.1) Updates `rubocop-rspec` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/rubocop/rubocop-rspec/releases) - [Changelog](https://github.com/rubocop/rubocop-rspec/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop-rspec@v3.6.0...v3.7.0) --- updated-dependencies: - dependency-name: rubocop dependency-version: 1.81.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: rubocop-rspec dependency-version: 3.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: ruby-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump uv from 0.8.20 to 0.8.22 Bumps [uv](https://github.com/astral-sh/uv) from 0.8.20 to 0.8.22. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.8.20...0.8.22) --- updated-dependencies: - dependency-name: uv dependency-version: 0.8.22 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Add changelog entry --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <501702+edmorley@users.noreply.github.com>
* Bump uv from 0.8.22 to 0.8.23 Bumps [uv](https://github.com/astral-sh/uv) from 0.8.22 to 0.8.23. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.8.22...0.8.23) --- updated-dependencies: - dependency-name: uv dependency-version: 0.8.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Update changelog entry --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <501702+edmorley@users.noreply.github.com>
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
The build scripts that download and compile the Python source archives (for upload to S3, where they are then consumed by the buildpack during customer builds) currently use GPG to verify the Python source archive downloads. However, use of PGP signatures for Python artifact verification was deprecated previously in PEP 761, in favour of Sigstore: https://peps.python.org/pep-0761/ https://www.python.org/downloads/metadata/sigstore/ Until now the PGP signatures have still been available for all stable releases, however, as of Python 3.14 (due to be released this week), Sigstore will be the only supported verification mechanism: https://docs.python.org/3.14/whatsnew/3.14.html#whatsnew314-no-more-pgp As such, we must now switch over to Sigstore. We use the `cosign` CLI for verification since it's a standalone binary available via a Docker image, rather than the Python `sigstore` CLI which requires a Python environment (and so would need pip, venv etc, and more setup to ensure it stays isolated from the Python we're trying to build). See: - https://www.python.org/downloads/metadata/sigstore/ - https://docs.sigstore.dev/cosign/system_config/installation/#container-images - https://docs.sigstore.dev/cosign/verifying/verify/ - https://github.com/sigstore/cosign/blob/main/doc/cosign_verify-blob.md GUS-W-18244071.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
This prepares the scripts used to compile the Python runtime binaries for Python 3.15. It does not add Python 3.15 support to the buildpack itself, which will follow in a later PR once Python 3.15.0 has been released (expected 2026-10-09) and its binaries built and uploaded. Python 3.15 no longer falls back to the bundled `libmpdec` when the system library is missing, which would otherwise cause the `_decimal` module to silently not be built: https://docs.python.org/3.15/whatsnew/3.15.html#build-changes We can't use the system package yet, since Ubuntu 24.04 doesn't currently ship `libmpdec-dev`. We've requested that it be re-added (https://bugs.launchpad.net/ubuntu/+source/mpdecimal/+bug/2167730), but even once it is, it must first be rolled out to all base images. So for now we explicitly opt in to the bundled copy using `--without-system-libmpdec`, with a TODO to switch later. The runtime test script now imports `_decimal` and `_hashlib` directly, since `decimal` and `hashlib` fall back to other implementations if their C modules weren't built, which would hide a broken build. It also imports `curses.panel`, since `curses` doesn't import `_curses_panel`, and now runs the `compression.zstd` check for all versions that have it rather than only 3.14. Tested by compiling Python 3.15.0rc3 for arm64 on Heroku-24 and running the runtime test script against the result. (This used a modified copy of the build script, since release candidates are published under a different URL to final releases, and we intentionally don't support them in the buildpack itself.) GUS-W-20591263.
Merges the compiled VCS dependency tests into the editable tests, so that each package manager needs one app deploy instead of two, which speeds up the integration tests. The fixtures are renamed and restructured to match the CNB's `*_editable_git_compiled` fixtures: each now installs the root project in editable mode (using the package manager's default build backend and layout where it has one), plus a compiled VCS dependency (`extension.dist`) instead of a pure Python one. The pip fixture is the most comprehensive, since pip has no build backend of its own, so users end up picking from the variety of alternatives. It also covers a flat layout package that only has a `setup.py`, and hatchling in its default and `dev-mode-exact` modes. The latter isn't supported yet, since `bin/compile` doesn't rewrite the paths in its hook module, so the fixture, spec and `bin/compile` have `TODO`s for it to be fixed in a later PR. GUS-W-24373194.
Documents how to set up the repository, lint, run the buildpack locally using `make run`, and run the Hatchet integration tests (both locally and in CI). The `README.md` now links to it, and to the Cloud Native Buildpack for anyone looking for that instead. GUS-W-24469587.
The upstream Pipenv bug that caused this test to be skipped has been fixed, so the test no longer needs to be skipped: pypa/pipenv#6514 Pipenv now prints a `DeployException` traceback when aborting the deploy rather than its usage message, so the expected output has been updated to match. Also removes the "Pipfile.lock `python_version` and `.python-version`" test and its fixture, since the re-enabled test covers the same case. GUS-W-24469687.
…2158) Heroku builds occur at a different path to the one the app runs at, so the absolute paths in the files that build backends create for editable installs have to be rewritten for them to work after relocation (see the code comment in `bin/compile` for more details). This worked for the most common build backends and configurations, which create `*.pth` or `__editable___*_finder.py` files. However, some less common build backends and configurations (hatchling's `dev-mode-exact` mode, pdm-backend's `editables` mode and scikit-build-core) also create a hook module (imported by an `import` line in a `.pth` file), whose paths weren't rewritten, so those editable installs broke at runtime. The `find` now matches `*.pth` and `*editable*.py`, which covers all of the hook module names. `*.egg-link` has been dropped, since no supported package manager creates them any more. The `dev-mode-exact` fixture and spec workarounds have been removed. GUS-W-24469383.
Add support for Python 3.15, and release 3.15.0. The default Python version remains unchanged (at 3.14) for now. Release announcement: https://blog.python.org/2026/10/python-3150-final-is-here/ https://www.python.org/downloads/release/python-3150/ Details on what's new in Python 3.15: https://docs.python.org/3.15/whatsnew/3.15.html Binary builds: https://github.com/heroku/heroku-buildpack-python/actions/runs/37947202278 Python 3.15 readiness status of the top 360 packages on PyPI: https://pyreadiness.org/3.15/ Free-threaded variants (`3.15t`) remain unsupported for now: there have been no requests for them yet, and third-party package support is still inconsistent (see https://py-free-threading.github.io/tracking/ and https://hugovk.github.io/free-threaded-wheels/). Closes #2159. GUS-W-20591279.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
…2163) * Bump the python-dependencies group across 1 directory with 2 updates Bumps the python-dependencies group with 2 updates in the / directory: [pipenv](https://github.com/pypa/pipenv) and [uv](https://github.com/astral-sh/uv). Updates `pipenv` from 2026.8.0 to 2026.9.1 - [Release notes](https://github.com/pypa/pipenv/releases) - [Changelog](https://github.com/pypa/pipenv/blob/main/CHANGELOG.md) - [Commits](pypa/pipenv@v2026.8.0...v2026.9.1) Updates `uv` from 0.12.21 to 0.13.1 - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.12.21...0.13.1) --- updated-dependencies: - dependency-name: pipenv dependency-version: 2026.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: uv dependency-version: 0.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Add changelog entry --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <emorley@salesforce.com>
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
* Bump the python-dependencies group with 3 updates Bumps the python-dependencies group with 3 updates: [pipenv](https://github.com/pypa/pipenv), [pip](https://github.com/pypa/pip) and [uv](https://github.com/astral-sh/uv). Updates `pipenv` from 2026.9.1 to 2026.10.2 - [Release notes](https://github.com/pypa/pipenv/releases) - [Changelog](https://github.com/pypa/pipenv/blob/main/CHANGELOG.md) - [Commits](pypa/pipenv@v2026.9.1...v2026.10.2) Updates `pip` from 26.2.1 to 26.2.2 - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](pypa/pip@26.2.1...26.2.2) Updates `uv` from 0.13.1 to 0.13.4 - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.13.1...0.13.4) --- updated-dependencies: - dependency-name: pipenv dependency-version: 2026.10.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: pip dependency-version: 26.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: uv dependency-version: 0.13.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Add changelog entry --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <emorley@salesforce.com>
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
From the Certs "4"pocalpyse (https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/) Excon had a vendored set of certs that included the affected/compromised ones. Excon 1.8.0 removed the compromised certs https://github.com/excon/excon/blob/87b0940aabb43877066244adb0ac10bdcde4b7ed/changelog.txt. This PR upgrades Excon to remove those compromised certs.
Release announcement: https://blog.python.org/2026/10/python-3151-3149-31317/ Changelogs: https://docs.python.org/release/3.15.1/whatsnew/changelog.html#python-3-15-1-final https://docs.python.org/release/3.14.9/whatsnew/changelog.html#python-3-14-9-final https://docs.python.org/release/3.13.17/whatsnew/changelog.html#python-3-13-17-final Binary builds: https://github.com/heroku/heroku-buildpack-python/actions/runs/39661750901 https://github.com/heroku/heroku-buildpack-python/actions/runs/39661758784 https://github.com/heroku/heroku-buildpack-python/actions/runs/39661765349 GUS-W-24613086. GUS-W-24613089. GUS-W-24613092.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
Bumps [sigstore/cosign/cosign](https://github.com/sigstore/cosign) from v3.1.3 to v3.1.4. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](sigstore/cosign@v3.1.3...v3.1.4) --- updated-dependencies: - dependency-name: sigstore/cosign/cosign dependency-version: v3.1.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump the ruby-dependencies group with 4 updates Bumps the ruby-dependencies group with 4 updates: [rubocop](https://github.com/rubocop/rubocop), [json](https://github.com/ruby/json), [parallel](https://github.com/grosser/parallel) and [parser](https://github.com/whitequark/parser). Updates `rubocop` from 1.91.0 to 1.92.0 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.91.0...v1.92.0) Updates `json` from 3.0.2 to 3.1.0 - [Release notes](https://github.com/ruby/json/releases) - [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md) - [Commits](ruby/json@v3.0.2...v3.1.0) Updates `parallel` from 2.2.0 to 2.3.0 - [Changelog](https://github.com/grosser/parallel/blob/master/CHANGELOG.md) - [Commits](grosser/parallel@v2.2.0...v2.3.0) Updates `parser` from 3.3.12.0 to 3.3.13.0 - [Changelog](https://github.com/whitequark/parser/blob/master/CHANGELOG.md) - [Commits](whitequark/parser@v3.3.12.0...v3.3.13.0) --- updated-dependencies: - dependency-name: rubocop dependency-version: 1.92.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: json dependency-version: 3.1.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: parallel dependency-version: 2.3.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: parser dependency-version: 3.3.13.0 dependency-type: indirect update-type: version-update:semver-patch dependency-group: ruby-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Update Ruby from 4.0.5 to 4.0.9 For the repo's development/testing tooling. * Raise minimum Ruby version to 3.4 For the repo's development/testing tooling. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <emorley@salesforce.com>
…2173) Release announcement: https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/ Changelogs: https://docs.python.org/release/3.15.2/whatsnew/changelog.html#python-3-15-2-final https://docs.python.org/release/3.14.10/whatsnew/changelog.html#python-3-14-10-final https://docs.python.org/release/3.13.18/whatsnew/changelog.html#python-3-13-18-final https://docs.python.org/release/3.12.16/whatsnew/changelog.html#python-3-12-16-final https://docs.python.org/release/3.11.18/whatsnew/changelog.html#python-3-11-18-final Binary builds: https://github.com/heroku/heroku-buildpack-python/actions/runs/40300834348 https://github.com/heroku/heroku-buildpack-python/actions/runs/40300839896 https://github.com/heroku/heroku-buildpack-python/actions/runs/40300845480 https://github.com/heroku/heroku-buildpack-python/actions/runs/40300852115 https://github.com/heroku/heroku-buildpack-python/actions/runs/40300859237 GUS-W-24660707.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
) Python 3.10 reached its upstream end-of-life on 1st October 2026: https://devguide.python.org/versions/#supported-versions As such, the Python 3.10 deprecation warning has been updated to use the past tense to refer to the upstream EOL date, and to say that it no longer receives security updates. Builds of Python 3.10 apps will continue to work until support is removed from the buildpack on 6th January 2027, as previously announced: https://devcenter.heroku.com/changelog-items/3490 GUS-W-24662755.
Since Python 3.11 reaches upstream EOL in October 2027: https://devguide.python.org/versions/#supported-versions The Python version support policy is that supported versions follow the upstream EOL lifecycle: https://devcenter.heroku.com/articles/python-support#python-version-support-policy To raise awareness of this, a deprecation warning is now shown, announcing that support will be removed on 5th January 2028. This is similar to the warning added for Python 3.10 in: #1972 GUS-W-20591321.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
Minor typo fixes and wording/clarity improvements in code comments, documentation and user-facing messages. Found and fixed by an LLM.
* Bump the ruby-dependencies group with 2 updates Bumps the ruby-dependencies group with 2 updates: [rubocop](https://github.com/rubocop/rubocop) and [excon](https://github.com/excon/excon). Updates `rubocop` from 1.92.0 to 1.92.2 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.92.0...v1.92.2) Updates `excon` from 1.8.0 to 1.10.0 - [Changelog](https://github.com/excon/excon/blob/master/changelog.txt) - [Commits](excon/excon@v1.8.0...v1.10.0) --- updated-dependencies: - dependency-name: rubocop dependency-version: 1.92.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: ruby-dependencies - dependency-name: excon dependency-version: 1.10.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: ruby-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Add missing `logger` dependency of Hatchet `excon` 1.9.0+ no longer depends on `logger`, and Hatchet's `threaded` dependency requires it without declaring it. On Ruby 4.0 `logger` is a bundled gem, so `hatchet` fails to load without it in the `Gemfile`. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <emorley@salesforce.com>
…2179) * Bump the python-dependencies group across 1 directory with 2 updates Bumps the python-dependencies group with 2 updates in the / directory: [pipenv](https://github.com/pypa/pipenv) and [uv](https://github.com/astral-sh/uv). Updates `pipenv` from 2026.10.2 to 2026.10.5 - [Release notes](https://github.com/pypa/pipenv/releases) - [Changelog](https://github.com/pypa/pipenv/blob/main/CHANGELOG.md) - [Commits](pypa/pipenv@v2026.10.2...v2026.10.5) Updates `uv` from 0.13.4 to 0.13.6 - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.13.4...0.13.6) --- updated-dependencies: - dependency-name: pipenv dependency-version: 2026.10.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: uv dependency-version: 0.13.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Add changelog entry * Use Pipenv 2026.10.4 instead of 2026.10.5 Pipenv 2026.10.5 dropped support for Python 3.10, which the buildpack still supports. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Morley <emorley@salesforce.com>
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
Previously if a new app did not specify a Python version (e.g. via a `.python-version` file), then the buildpack would default to the latest Python 3.14 release. Now the buildpack will use the latest Python 3.15 release. This does not affect: * apps that specify an explicit Python version * existing apps that have already had a build using the previous default version (since that version is remembered from one build to the next, via the "version pinning" / "sticky versions" feature). Use-cases involving new apps that aren't compatible with Python 3.15 will now need to specify Python 3.14 explicitly: https://devcenter.heroku.com/articles/python-support#specify-a-python-version However most apps should be compatible, since Python 3.15 was released a month ago (2026-10-09), Python 3.15.1 has since been released (2026-10-21), and Python 3.15 has been used by the python-getting-started project since 2026-10-09. See: https://docs.python.org/3.15/whatsnew/3.15.html Test changes: * Fixtures that use the default Python version (including `python_version_outdated`, now pinned to 3.15.0) now use Python 3.15, with their lockfiles re-generated using the latest uv, Poetry and Pipenv. * Other test fixture dependencies (such as `typing-extensions` and `pytest`) have been updated, and the remaining lockfiles re-generated. * The Hatchet "versions have changed since the last build" tests now use buildpack `v355` (the first release that supports Python 3.15) instead of `v313`, since `v313` can't build Python 3.15 apps. `v355` also supports Heroku-26, so these tests are now enabled on all stacks. GUS-W-20591337.
Pipenv now supports `pipenv sync --clean` (via pypa/pipenv#6726), however, it can't be used with `--system`, so the buildpack's cache invalidation workaround is still needed for now. The comment has been updated to mention this, and that the workaround can be replaced by `--clean` if we move to installing into a venv in the future.
Ports the test output labelling from the CNB (heroku/buildpacks-python#659), so that the asserted output is easier to understand. This covers the inline buildpack output in the `*_basic` fixtures, the basic tests' `app.run` env var checks, and the paths printed by the editable fixtures' `test-editable-installs.sh`. The editable fixture and test comments have also been updated to match the CNB's wording. GUS-W-24469384.
Co-authored-by: heroku-linguist[bot] <136119646+heroku-linguist[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.