Skip to content

Update pip to >=26.1 - #46

Open
mdesco-crgl wants to merge 6 commits into
pyinvoke:mainfrom
mdesco-crgl:update-pip
Open

Update pip to >=26.1#46
mdesco-crgl wants to merge 6 commits into
pyinvoke:mainfrom
mdesco-crgl:update-pip

Conversation

@mdesco-crgl

@mdesco-crgl mdesco-crgl commented May 6, 2026

Copy link
Copy Markdown

Resolves #45.

Changes

  • Require pip>=26.1, which fixes the CVEs reported in pip security vulnerability #45.
  • Drop Python 3.9. pip 26.1 requires Python 3.10 or newer.
  • Require sphinx<9. Sphinx 9 retired the class-based Documenter API that invocations.autodoc extends. Registered documenters no longer take part in automodule member dispatch, so tasks stop appearing in the output, and the nitpick docs build fails on an unresolvable DocumenterBridge reference. Sphinx 9 offers no replacement hook: the object type list is a closed Literal and registry.documenters is never read. The cap keeps the extension working until it can be ported.
  • Use https for the intersphinx inventory URLs.

Test plan

  • inv test: 166 passed, 8 skipped, no xfail.
  • inv docs --nitpick: clean.
  • flake8 and black -l 79 --check: clean.
  • Behaviour bisected across Sphinx 8.1.3, 8.2.3, 9.0.0 and 9.1.0. Tasks are documented up to 8.2.3 and dropped from 9.0.0 on.

@mdesco-crgl mdesco-crgl changed the title Update pip to >26.1 Update pip to >=26.1 May 6, 2026
@mdesco-crgl
mdesco-crgl force-pushed the update-pip branch 4 times, most recently from 26ccadf to f49f4fc Compare May 6, 2026 19:32
attempt to fix autodoc

revert autodoc to be at most compatible with python 3.10
mdesco-crgl and others added 3 commits May 6, 2026 20:14
Sphinx 9 retired the class-based Documenter API that invocations.autodoc
extends. Registered documenters no longer take part in automodule member
dispatch, so tasks stop appearing in the output, and the nitpick docs build
fails on an unresolvable DocumenterBridge reference.

Cap the requirement at sphinx<9, then revert the changes that worked around
the breakage: the autodoc.py rewrite, the xfail markers on the autodoc tests,
the ANSI stripping in the release tests, and the docstring churn.

The 6 release colorization tests fail only under bare pytest, which has no
pty. CI runs them through 'inv test', which sets --capture=sys and a pty.
@mdesco-crgl

Copy link
Copy Markdown
Author

@bitprophet

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

pip security vulnerability

1 participant