Latest Results
Bump multidict from 6.9.0 to 6.9.1 (#13818)
Bumps [multidict](https://github.com/aio-libs/multidict) from 6.9.0 to
6.9.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/multidict/releases">multidict's
releases</a>.</em></p>
<blockquote>
<h2>6.9.1</h2>
<h2>Bug fixes</h2>
<ul>
<li>
<p>Fixed the C extension reading freed memory on free-threaded builds
when a
list handed to :py:meth:<code>~multidict.MultiDict.update</code>,
:py:meth:<code>~multidict.MultiDict.extend</code>,
:py:meth:<code>~multidict.MultiDict.merge</code>
or the :py:class:<code>~multidict.MultiDict</code> and
:py:class:<code>~multidict.CIMultiDict</code>
constructors, a <code>[key, value]</code> item inside any iterable
handed to them, or a
list tested with <code>in</code> against
:py:meth:<code>~multidict.MultiDict.items</code>, is
changed by another thread; a call that catches the list shrinking under
it
now raises :py:exc:<code>RuntimeError</code> -- by
:user:<code>rodrigobnogueira</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
<a
href="https://redirect.github.com/aio-libs/multidict/issues/1437">#1437</a>.</p>
</li>
<li>
<p>Fixed a data race on the free-threaded build where a retired hash
table's
reader count used relaxed atomics, letting a lock-free
<code>get()</code>/<code>getone()</code>/
<code>__getitem__()</code> read race a concurrent free of that table.
The reader-exit
decrement and the drain's free check now use release/acquire ordering
instead -- by :user:<code>asvetlov</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
<a
href="https://redirect.github.com/aio-libs/multidict/issues/1481">#1481</a>.</p>
</li>
<li>
<p>Fixed a free-threaded build bug where two threads calling
<code>update()</code>,
<code>merge()</code>, or <code>__setitem__()</code> on the same key at
the same time could lose
the key entirely instead of just racing on which value wins. A decref of
the
replaced value could transiently suspend the writer's critical section,
letting a second writer for the same key observe the first writer's
in-progress entry as absent and, once both settled, mistake it for a
stale
duplicate and delete it. Every such decref is now deferred until the
writer
has released its critical section, so the window can no longer open.
<code>setdefault()</code> had an unrelated instance of the same blind
spot (it could
insert a duplicate rather than recognizing an in-flight key), fixed
alongside
it -- by :user:<code>asvetlov</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
<a
href="https://redirect.github.com/aio-libs/multidict/issues/1483">#1483</a>.</p>
</li>
<li>
<p>Fixed a free-threaded build bug where <code>getall()</code> and the
<code>items()</code>/
<code>keys()</code>/<code>values()</code> equality path could raise
<code>KeyError</code> or report a
present, never-deleted key as missing. A concurrent
<code>update()</code>/<code>extend()</code>/
<code>__setitem__()</code> call can have its critical section
transiently suspended
(a decref triggering a blocking allocator call) while an entry is marked
as
part of its own bookkeeping; a reader landing in that window used to
treat
the mark as "not found" instead of "still there, in
flight" -- by
:user:<code>asvetlov</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/multidict/blob/master/CHANGES.rst">multidict's
changelog</a>.</em></p>
<blockquote>
<h1>6.9.1</h1>
<p><em>(2026-09-21)</em></p>
<h2>Bug fixes</h2>
<ul>
<li>
<p>Fixed the C extension reading freed memory on free-threaded builds
when a
list handed to :py:meth:<code>~multidict.MultiDict.update</code>,
:py:meth:<code>~multidict.MultiDict.extend</code>,
:py:meth:<code>~multidict.MultiDict.merge</code>
or the :py:class:<code>~multidict.MultiDict</code> and
:py:class:<code>~multidict.CIMultiDict</code>
constructors, a <code>[key, value]</code> item inside any iterable
handed to them, or a
list tested with <code>in</code> against
:py:meth:<code>~multidict.MultiDict.items</code>, is
changed by another thread; a call that catches the list shrinking under
it
now raises :py:exc:<code>RuntimeError</code> -- by
:user:<code>rodrigobnogueira</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>1437</code>.</p>
</li>
<li>
<p>Fixed a data race on the free-threaded build where a retired hash
table's
reader count used relaxed atomics, letting a lock-free
<code>get()</code>/<code>getone()</code>/
<code>__getitem__()</code> read race a concurrent free of that table.
The reader-exit
decrement and the drain's free check now use release/acquire ordering
instead -- by :user:<code>asvetlov</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>1481</code>.</p>
</li>
<li>
<p>Fixed a free-threaded build bug where two threads calling
<code>update()</code>,
<code>merge()</code>, or <code>__setitem__()</code> on the same key at
the same time could lose
the key entirely instead of just racing on which value wins. A decref of
the
replaced value could transiently suspend the writer's critical section,
letting a second writer for the same key observe the first writer's
in-progress entry as absent and, once both settled, mistake it for a
stale
duplicate and delete it. Every such decref is now deferred until the
writer
has released its critical section, so the window can no longer open.
<code>setdefault()</code> had an unrelated instance of the same blind
spot (it could
insert a duplicate rather than recognizing an in-flight key), fixed
alongside
it -- by :user:<code>asvetlov</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>1483</code>.</p>
</li>
<li>
<p>Fixed a free-threaded build bug where <code>getall()</code> and the
<code>items()</code>/
<code>keys()</code>/<code>values()</code> equality path could raise
<code>KeyError</code> or report a
present, never-deleted key as missing. A concurrent
<code>update()</code>/<code>extend()</code>/
<code>__setitem__()</code> call can have its critical section
transiently suspended
(a decref triggering a blocking allocator call) while an entry is marked
as</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aio-libs/multidict/commit/0a1770c7e69845c8ef2000b3707cd7f1917a6944"><code>0a1770c</code></a>
Release 6.9.1 (<a
href="https://redirect.github.com/aio-libs/multidict/issues/1504">#1504</a>)</li>
<li><a
href="https://github.com/aio-libs/multidict/commit/d220522b54b1989c90a96aa50c42bb0264d46210"><code>d220522</code></a>
Upload release assets one at a time to avoid the secondary rate limit
(<a
href="https://redirect.github.com/aio-libs/multidict/issues/1503">#1503</a>)</li>
<li><a
href="https://github.com/aio-libs/multidict/commit/30cd596f945ed7b69f5502c693339224043eb9e9"><code>30cd596</code></a>
Stop a GIL-releasing <strong>del</strong> from segfaulting the standard
C extension build ...</li>
<li><a
href="https://github.com/aio-libs/multidict/commit/d1c331ab2617299a1385fff29ef4da64e50bd071"><code>d1c331a</code></a>
Recheck the reader gate after taking the retired list (<a
href="https://redirect.github.com/aio-libs/multidict/issues/1502">#1502</a>)</li>
<li><a
href="https://github.com/aio-libs/multidict/commit/b37f07c1a16122f95208936f2e58f55ea99cdbaf"><code>b37f07c</code></a>
Allocate deferred decrefs in fixed-size blocks (<a
href="https://redirect.github.com/aio-libs/multidict/issues/1501">#1501</a>)</li>
<li><a
href="https://github.com/aio-libs/multidict/commit/563f667307c376744ca345802ca835f8b84ba947"><code>563f667</code></a>
Run CodSpeed benchmarks on Python 3.14 and loop the smallest ones (<a
href="https://redirect.github.com/aio-libs/multidict/issues/1498">#1498</a>)</li>
<li><a
href="https://github.com/aio-libs/multidict/commit/157c87c6cecbeac0011b085e8f6c2496754c17e6"><code>157c87c</code></a>
Cancel superseded CI runs on pull requests (<a
href="https://redirect.github.com/aio-libs/multidict/issues/1500">#1500</a>)</li>
<li><a
href="https://github.com/aio-libs/multidict/commit/d43adfe27f759a2810a900db73fc85ab3660e75b"><code>d43adfe</code></a>
Drop -I from the ASan test command so PYTHONMALLOC takes effect (<a
href="https://redirect.github.com/aio-libs/multidict/issues/1499">#1499</a>)</li>
<li><a
href="https://github.com/aio-libs/multidict/commit/2a68472db036f199ecb1c1a0c66872eeb03a3135"><code>2a68472</code></a>
Stop items() iteration from reading a freed entry in CIMultiDict (<a
href="https://redirect.github.com/aio-libs/multidict/issues/1496">#1496</a>)</li>
<li><a
href="https://github.com/aio-libs/multidict/commit/cd528d6d82dc1465042459b3cc143dc58c5ce6ab"><code>cd528d6</code></a>
Rename GHSA-54p9-h82j-f925 changelog fragment to the merged commit (<a
href="https://redirect.github.com/aio-libs/multidict/issues/1495">#1495</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/aio-libs/multidict/compare/v6.9.0...v6.9.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Latest Branches
0%
not-ekalabya:fix/correctness-batch-1 0%
0%
ishan-1010:feat/truststore-ssl-verification Ā© 2026 CodSpeed Technology