Repository navigation
Fix host-only state on cookie expiration - #13674
Conversation
Confidence Score: 5/5Safe to merge based on direct coverage of the affected cookie-scoping behavior and its client-session integration. No publishable defects were found. The focused check exercised the previously vulnerable expiry flow on the base revision and verified the corrected behavior in this revision, alongside replacement, persistence, and default-path cases. Files Needing Attention: No files need follow-up attention;
What T-Rex did
Reviews (1): Last reviewed commit: "Rename 13672.bugfix.rst to 13674.bugfix...." | Re-trigger Greptile |
Merging this PR will not alter performance
Comparing Footnotes
|
Backport to 3.15: 💔 cherry-picking failed — conflicts found❌ Failed to cleanly apply 9332972 on top of patchback/backports/3.15/9332972cfcb0f5a2b6677e7307819ab8f13b5d09/pr-13674 Backporting merged PR #13674 into master
🤖 @patchback |
Resolves the conflict in aiohttp/cookiejar.py. Upstream aio-libs#13674 widened _host_only_cookies from (domain, name) to (domain, path, name) and moved the host-only block below the path computation, which is where the two sides diverged. The three hunks of this branch were re-applied onto master's ordering rather than merged line by line. The IP scoping block now sits after the leading-dot strip instead of before it, so the lstrip(".") calls are no longer needed and were dropped. Behaviour is unchanged: an IP origin falls through with an empty domain and is picked up by master's host-only branch, which is what this branch wanted in the first place.
Bumps [pip](https://github.com/pypa/pip) from 26.0.1 to 26.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p> <blockquote> <h1>26.1 (2026-04-26)</h1> <h2>Deprecations and Removals</h2> <ul> <li>Drop support for Python 3.9. (<code>[aio-libs#13795](pypa/pip#13795) <https://github.com/pypa/pip/issues/13795></code>_)</li> </ul> <h2>Features</h2> <ul> <li>Add experimental support to read requirements from standardized pylock.toml files (<code>-r pylock.toml</code>). (<code>[aio-libs#13876](pypa/pip#13876) <https://github.com/pypa/pip/issues/13876></code>_)</li> <li>Allow <code>--uploaded-prior-to</code> to accept a duration in days (e.g., <code>P3D</code> for 3 days ago). (<code>[aio-libs#13674](pypa/pip#13674) <https://github.com/pypa/pip/issues/13674></code>_)</li> </ul> <h2>Enhancements</h2> <ul> <li>Speed up dependency resolution when there are complex conflicts. (<code>[aio-libs#13859](pypa/pip#13859) <https://github.com/pypa/pip/issues/13859></code>_)</li> <li>Reduce memory usage when resolving large dependency trees. (<code>[aio-libs#13843](pypa/pip#13843) <https://github.com/pypa/pip/issues/13843></code>_)</li> <li>Emit a deprecation warning when pip imports an unexpected module after installation of a distribution has started. (<code>[aio-libs#13912](pypa/pip#13912) <https://github.com/pypa/pip/issues/13912></code>_)</li> <li>Allow URL constraints to apply to requirements with extras. (<code>[aio-libs#12018](pypa/pip#12018) <https://github.com/pypa/pip/issues/12018></code>_)</li> <li>Allow unpinned requirements to use hashes from constraints. Constraints like <code>{name}=={version} --hash=...</code> feeds into hash verification for a corresponding requirement. (<code>[aio-libs#9243](pypa/pip#9243) <https://github.com/pypa/pip/issues/9243></code>_)</li> <li>Improve conflict reports that involve direct URLs. (<code>[aio-libs#13932](pypa/pip#13932) <https://github.com/pypa/pip/issues/13932></code>_)</li> <li>Show all errors instead of first error for faulty <code>dependency_groups</code> definitions. (<code>[aio-libs#13917](pypa/pip#13917) <https://github.com/pypa/pip/issues/13917></code>_)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Fix recovery hint for missing RECORD file to use <code>--ignore-installed</code> instead of <code>--force-reinstall</code>. (<code>[aio-libs#12645](pypa/pip#12645) <https://github.com/pypa/pip/issues/12645></code>_)</li> <li>Fix misleading error message when a constraint file cannot be opened. (<code>[aio-libs#13226](pypa/pip#13226) <https://github.com/pypa/pip/issues/13226></code>_)</li> <li>Show the filename rather than the full URL when downloading files from non-PyPI indexes in non-verbose mode. (<code>[aio-libs#13494](pypa/pip#13494) <https://github.com/pypa/pip/issues/13494></code>_)</li> <li>Remove the adjacent <code>__pycache__</code> directory when a .py file is removed. (<code>[aio-libs#13725](pypa/pip#13725) <https://github.com/pypa/pip/issues/13725></code>_)</li> <li>Force UTF-8 encoding for :pep:<code>723</code> metadata. (<code>[aio-libs#13861](pypa/pip#13861) <https://github.com/pypa/pip/issues/13861></code>_)</li> <li>Minor performance improvement when filtering candidates during resolution. (<code>[aio-libs#13916](pypa/pip#13916) <https://github.com/pypa/pip/issues/13916></code>_)</li> <li>Fix a hang on Windows when stdout is closed during verbose output. (<code>[aio-libs#13927](pypa/pip#13927) <https://github.com/pypa/pip/issues/13927></code>_)</li> <li>Common path prefixes are determined by path segment, not character by character. (<code>[aio-libs#13847](pypa/pip#13847) <https://github.com/pypa/pip/issues/13847></code>_)</li> <li>Fix installing <code>.tar.gz</code> source distributions that look like a zip file. (<code>[aio-libs#13867](pypa/pip#13867) <https://github.com/pypa/pip/issues/13867></code>_)</li> </ul> <h2>Vendored Libraries</h2> <ul> <li>Upgrade certifi to 2026.2.25</li> <li>Upgrade packaging to 26.2</li> <li>Upgrade requests to 2.33.1</li> <li>Upgrade tomli to 2.3.1</li> <li>Upgrade urllib3 to 2.6.3</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pip/commit/90b2b3e0f7ef75c485155716d904e51654575803"><code>90b2b3e</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/193f289a6201f801b23885297332461ac8a65b6b"><code>193f289</code></a> Update AUTHORS.txt</li> <li><a href="https://github.com/pypa/pip/commit/63c3709071c9596d7f4676502a90a3b06f241772"><code>63c3709</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13876">#13876</a> from sbidoul/install-from-pylock-reqs-sbi</li> <li><a href="https://github.com/pypa/pip/commit/e5fe7023ffe74a5895571eaf57bdd2989018fbf2"><code>e5fe702</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13949">#13949</a> from pypa/revert-13888-resolver-editable-links</li> <li><a href="https://github.com/pypa/pip/commit/122a14a8cd3dae7b3e959641f0b45849d4b21618"><code>122a14a</code></a> Revert "Allow editable installs to satisfy direct-URL dependencies (<a href="https://redirect.github.com/pypa/pip/issues/13888">#13888</a>)"</li> <li><a href="https://github.com/pypa/pip/commit/c3352524aae95ae959d4727dda5b5c65752261b3"><code>c335252</code></a> -r pylock.toml: add pip-wheel -r pylock.toml test</li> <li><a href="https://github.com/pypa/pip/commit/ba2fc12b7f386d89e233bdfd49e7b89d1af57ad1"><code>ba2fc12</code></a> -r pylock.toml: proper error with remote pylock.toml containing directory ent...</li> <li><a href="https://github.com/pypa/pip/commit/747c4ae88837a8bb13946fe9d1b612c162a2e3df"><code>747c4ae</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13948">#13948</a> from ichard26/reword-news</li> <li><a href="https://github.com/pypa/pip/commit/3517841c5e2d92e04dbef52c61a8fa967c059efa"><code>3517841</code></a> -r pylock: refine filename pylock-ness test</li> <li><a href="https://github.com/pypa/pip/commit/2f7ad8caeed4471e63958df6cacba3a66a215588"><code>2f7ad8c</code></a> -r pylock.toml: fix crash with pip wheel and pip lock</li> <li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/26.0.1...26.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pip](https://github.com/pypa/pip) from 26.0.1 to 26.1.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p> <blockquote> <h1>26.1.1 (2026-05-04)</h1> <h2>Bug Fixes</h2> <ul> <li>Fix issue where uninstallation left behind empty directories. Revert the removal of the adjacent <code>__pycache__</code> directory when a .py file is removed. (<code>[aio-libs#13973](pypa/pip#13973) <https://github.com/pypa/pip/issues/13973></code>_)</li> </ul> <h1>26.1 (2026-04-26)</h1> <h2>Deprecations and Removals</h2> <ul> <li>Drop support for Python 3.9. (<code>[aio-libs#13795](pypa/pip#13795) <https://github.com/pypa/pip/issues/13795></code>_)</li> </ul> <h2>Features</h2> <ul> <li>Add experimental support to read requirements from standardized pylock.toml files (<code>-r pylock.toml</code>). (<code>[aio-libs#13876](pypa/pip#13876) <https://github.com/pypa/pip/issues/13876></code>_)</li> <li>Allow <code>--uploaded-prior-to</code> to accept a duration in days (e.g., <code>P3D</code> for 3 days ago). (<code>[aio-libs#13674](pypa/pip#13674) <https://github.com/pypa/pip/issues/13674></code>_)</li> </ul> <h2>Enhancements</h2> <ul> <li>Speed up dependency resolution when there are complex conflicts. (<code>[aio-libs#13859](pypa/pip#13859) <https://github.com/pypa/pip/issues/13859></code>_)</li> <li>Reduce memory usage when resolving large dependency trees. (<code>[aio-libs#13843](pypa/pip#13843) <https://github.com/pypa/pip/issues/13843></code>_)</li> <li>Emit a deprecation warning when pip imports an unexpected module after installation of a distribution has started. (<code>[aio-libs#13912](pypa/pip#13912) <https://github.com/pypa/pip/issues/13912></code>_)</li> <li>Allow URL constraints to apply to requirements with extras. (<code>[aio-libs#12018](pypa/pip#12018) <https://github.com/pypa/pip/issues/12018></code>_)</li> <li>Allow unpinned requirements to use hashes from constraints. Constraints like <code>{name}=={version} --hash=...</code> feeds into hash verification for a corresponding requirement. (<code>[aio-libs#9243](pypa/pip#9243) <https://github.com/pypa/pip/issues/9243></code>_)</li> <li>Improve conflict reports that involve direct URLs. (<code>[aio-libs#13932](pypa/pip#13932) <https://github.com/pypa/pip/issues/13932></code>_)</li> <li>Show all errors instead of first error for faulty <code>dependency_groups</code> definitions. (<code>[aio-libs#13917](pypa/pip#13917) <https://github.com/pypa/pip/issues/13917></code>_)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Fix recovery hint for missing RECORD file to use <code>--ignore-installed</code> instead of <code>--force-reinstall</code>. (<code>[aio-libs#12645](pypa/pip#12645) <https://github.com/pypa/pip/issues/12645></code>_)</li> <li>Fix misleading error message when a constraint file cannot be opened. (<code>[aio-libs#13226](pypa/pip#13226) <https://github.com/pypa/pip/issues/13226></code>_)</li> <li>Show the filename rather than the full URL when downloading files from non-PyPI indexes in non-verbose mode. (<code>[aio-libs#13494](pypa/pip#13494) <https://github.com/pypa/pip/issues/13494></code>_)</li> <li>Remove the adjacent <code>__pycache__</code> directory when a .py file is removed. (<code>[aio-libs#13725](pypa/pip#13725) <https://github.com/pypa/pip/issues/13725></code>_)</li> <li>Force UTF-8 encoding for :pep:<code>723</code> metadata. (<code>[aio-libs#13861](pypa/pip#13861) <https://github.com/pypa/pip/issues/13861></code>_)</li> <li>Minor performance improvement when filtering candidates during resolution. (<code>[aio-libs#13916](pypa/pip#13916) <https://github.com/pypa/pip/issues/13916></code>_)</li> <li>Fix a hang on Windows when stdout is closed during verbose output. (<code>[aio-libs#13927](pypa/pip#13927) <https://github.com/pypa/pip/issues/13927></code>_)</li> <li>Common path prefixes are determined by path segment, not character by character. (<code>[aio-libs#13847](pypa/pip#13847) <https://github.com/pypa/pip/issues/13847></code>_)</li> <li>Fix installing <code>.tar.gz</code> source distributions that look like a zip file. (<code>[aio-libs#13867](pypa/pip#13867) <https://github.com/pypa/pip/issues/13867></code>_)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pip/commit/4432a371c6471e6a93c3eb39b3e9ab2b876b13b9"><code>4432a37</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/4943e17e7dd079b3f58e88009d10308f2c55a3ed"><code>4943e17</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13973">#13973</a> from pypa/revert-13725-vfazio-remove-all-optimizati...</li> <li><a href="https://github.com/pypa/pip/commit/e9e7b90f35bfcd3c9e4ff93e0f0cc1b90f59aa68"><code>e9e7b90</code></a> Add news</li> <li><a href="https://github.com/pypa/pip/commit/0ff696479aa07ea5ca78b08d205ae23854b6e0e8"><code>0ff6964</code></a> Revert "Remove <strong>pycache</strong> when package is removed"</li> <li><a href="https://github.com/pypa/pip/commit/cc6b082d6b9350d96c5a24337b12b7a42846c410"><code>cc6b082</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13951">#13951</a> from sbidoul/release/26.1</li> <li><a href="https://github.com/pypa/pip/commit/b2671f1cb340f33db300f0bffc062402bce3eca0"><code>b2671f1</code></a> Bump for development</li> <li><a href="https://github.com/pypa/pip/commit/90b2b3e0f7ef75c485155716d904e51654575803"><code>90b2b3e</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/193f289a6201f801b23885297332461ac8a65b6b"><code>193f289</code></a> Update AUTHORS.txt</li> <li><a href="https://github.com/pypa/pip/commit/63c3709071c9596d7f4676502a90a3b06f241772"><code>63c3709</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13876">#13876</a> from sbidoul/install-from-pylock-reqs-sbi</li> <li><a href="https://github.com/pypa/pip/commit/e5fe7023ffe74a5895571eaf57bdd2989018fbf2"><code>e5fe702</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13949">#13949</a> from pypa/revert-13888-resolver-editable-links</li> <li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/26.0.1...26.1.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

No description provided.