mirror of
https://github.com/google/brotli.git
synced 2026-09-22 06:35:52 +00:00
Release 1.2.0 #549
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @eustas on GitHub (Sep 10, 2025).
This is what needs to be finished for for release:
Extra release steps:
Feel free to write in comments what you think is missing in that list.
@celestinoxp commented on GitHub (Sep 10, 2025):
Point 1 - I think this will take a while... can you give an estimate?
Point 2 - It's just a question, but in an idea tone: Does it make sense to release a new version now while version 1.2 isn't finished and released...? For example, 1.1.1... maybe this would help to get more feedback in preparation for version 1.2.
Any ideias @osokin @rbri @AndreasA @eustas ?
@eustas commented on GitHub (Sep 10, 2025):
Lets try to release before October. As for intermediate release, that would be RC. I will try to roll that out till next Wednesday.
@eustas commented on GitHub (Sep 17, 2025):
Sorry, did not cut rc1 today. Hopefully, tomorrow.
@osokin commented on GitHub (Oct 1, 2025):
Still no
rc1.@eustas commented on GitHub (Oct 1, 2025):
True. Waiting for review for multi-phase-initialization #1334 (first checkbox). Sorry.
@eustas commented on GitHub (Oct 2, 2025):
There are more things I'd like to see in release, but we are ready to cut rc1 🍰
@eustas commented on GitHub (Oct 6, 2025):
rc1 is cut!
@alexprengere commented on GitHub (Oct 8, 2025):
Now that Python3.14 is officially released, would it be possible to generate the corresponding wheels?
@eustas commented on GitHub (Oct 9, 2025):
Sure, nice timing. @anthrotype what do we need to do for that?
@anthrotype commented on GitHub (Oct 11, 2025):
I think cibuildwheel gives that to us for free. I simply need to update the submodule in https://github.com/google/brotli-wheels to point to the new v1.2.0rc1 tag and let the CI rebuild the wheels. I'll try this now and report back here.
We may have to drop support for very old python 3.6 and 3.7 at least, they reached EOL years ago and AFAIU aren't supported any longer by the official PyPA manylinux docker images used by cibuildwheel.
@anthrotype commented on GitHub (Oct 11, 2025):
@eustas for added security we should also change the authentication method on google/brotli-wheels to use the new "Trusted Publishing" standard (currently che CI is set up to use your encrypted PyPI password I think):
See https://docs.pypi.org/trusted-publishers/
I'm not an admin on the brotli PyPI page, only a collaborator, so I can't change its settings, but you can.
I can set up the github CI to use Trusted Publishing but you will have to add this GitHub workflow as a Trusted Publisher on PyPI brotli-wheels settings page, here's how:
Once configured, the next release will publish automatically without needing the PYPI_PASSWORD secret.
@radarhere commented on GitHub (Oct 11, 2025):
Be aware that the current version of cibuildwheel only has 3.14.0rc3. Based on past experience, I expect another release supporting Python 3.14 final will be made available soon.
@anthrotype commented on GitHub (Oct 11, 2025):
@radarhere thanks for pointing that out. I think the wheels built with 3.14rc3 should still work with the stable interpreter's release from last week, but i'll keep an eye on any cibuildwheel updates.
@eustas I can confirm the brotli-wheels CI can successfully build brotli from the latest v1.2.0rc1 tag, this is the last run:
https://github.com/google/brotli-wheels/actions/runs/18428734411
If you'd like to use the Trusted Publishing method for uploads to PyPI before final release, we need to do the manual setup outlined above and merge https://github.com/google/brotli-wheels/pull/22
Bear in mind that we only have one shot at uploading to PyPI the wheels for the 1.2.0 release. I see that the version string of the python module is sourced from the main
c/common/version.hand not from, say, the git tag. Therefore the wheel names have already the final names for the future stable release, without the 'rc1' suffix (e.g. "brotli-1.2.0-cp314-cp314-macosx_10_13_x86_64.whl", and not "brotli-1.2.0rc1-cp314-cp314-macosx_10_13_x86_64.whl").Once a wheel with a given version is uploaded, PyPI doesn't let you delete and upload it again (for security reasons); a version bump would be required to upload an updated wheel.
@radarhere commented on GitHub (Oct 12, 2025):
Specifying a build tag will allow you to submit additional wheels - https://packaging.python.org/en/latest/specifications/binary-distribution-format/#file-name-convention. You can see an example of this at https://pypi.org/project/pillow/9.3.0/#files, where
Pillow-9.3.0-cp37-cp37m-win_amd64.whl was uploaded initially, and later
Pillow-9.3.0-1-cp37-cp37m-win_amd64.whl was added.
@alexprengere commented on GitHub (Oct 13, 2025):
Latest cibuildwheel release now supports Python 3.14 final.
@eustas commented on GitHub (Oct 21, 2025):
(seen a message in email, but can't see it here; still here is an update:) debugging release workflow; once it works, will roll out rc2 and finally release very soon.
@eustas commented on GitHub (Oct 21, 2025):
RC2 is out. If no hot issues arrive, will release 1.2.0 on Monday.
@kmike commented on GitHub (Oct 22, 2025):
Thanks @eustas!
What's the status of Python bindings release - is the idea to do it at the same time as 1.2.0 library release?
It seems there was no RC release on pypi.
@anthrotype commented on GitHub (Oct 22, 2025):
I just sync'ed the brotli submodule to v1.2.0rc2 tag in
b8ade5cd28and the CI is building the wheels.However, the version of the brotli Python module is the same as the main
c/common/version.hused by Brotli itself and the latter doesn't containrc2suffixes, only the git tag does. As I said earlier, we can only publish a given release version once on PyPI, so I was just waiting for the final v1.2.0 to be pushed by @eustas to actually publish on PyPI.@eustas commented on GitHub (Oct 23, 2025):
I hope we will have 1.2.1 this year with support for Py < 3.6 dropped and >=3.14 (thread-free) added.
(alongside with other improvements, but intact API)
@anthrotype commented on GitHub (Oct 23, 2025):
@eustas note that currently on brotli-wheels repo, I am only building wheels for python 3.8 and above, because I believe recent cibuildwheel versions have dropped support for python 2.7 and 3.{6,7}. Are we ok having people with ancient pythons build brotli from the tarball source included in the PyPI distribution?
@alexprengere commented on GitHub (Oct 23, 2025):
I understand Python3.14 free-threaded wheels might require changes in the C extension, but I hope we can have regular Python3.14 non-free-threaded wheels as part of 1.2.0? That would be really great!
@anthrotype commented on GitHub (Oct 23, 2025):
yes of course, we will
@anthrotype commented on GitHub (Oct 23, 2025):
I was able to set up the brotli-wheels CI to also build wheels for ancient python 2.7, 3.6 and 3.7 (in addition to the default ones from 3.8 to 3.14) for all the three main platforms...
@radarhere commented on GitHub (Oct 27, 2025):
Thanks for the release.
@bastimeyer commented on GitHub (Oct 28, 2025):
Since 1.2.0 has been tagged and published now, is there anything left that needs to be done on the side of the Python-wheel build-repo apart from https://github.com/google/brotli-wheels/pull/22 ?
That PR is waiting for @eustas to configure the PyPI project accordingly, which is just a few clicks and keystrokes.
https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/
Apologies for this comment. My intention is not to pressure the maintainers. It's just that I am waiting for a pre-built brotli wheel on PyPI for cp314, so I can continue with my own work.
Thanks.
@Cycloctane commented on GitHub (Oct 31, 2025):
@eustas @anthrotype Please upload v1.2.0 wheels to pypi.
@eustas commented on GitHub (Oct 31, 2025):
Will do soon. Sorry for the delay.
@danjac commented on GitHub (Oct 31, 2025):
This advisory is requesting upgrade to Brotli 1.2.0, but currently unable to as 1.1.0 is still the only available version on PyPi.
@benglewis commented on GitHub (Nov 2, 2025):
In case anyone else needs to also fix the vulnerability urgently, I found that installing the release directly from GitHub with the git tag seems to work
@AndreasA commented on GitHub (Nov 3, 2025):
Just wondering, but the 1.2.0 is still not available for Java? Or was it "just" not pushed to the maven repository (as the versions there are still 0.1.2)?
@eustas commented on GitHub (Nov 3, 2025):
Hi. Java package will be published soon, no worries. And Py package as well. Thanks for your patience.
@eustas commented on GitHub (Nov 3, 2025):
(still waiting for PyPi to verify my email, sorry...)
@anthrotype commented on GitHub (Nov 4, 2025):
apologies for the slow response on my part, I was away on holiday last week. The brotli-wheels CI is ready to compile the wheels for 1.2.0 (you can see the wheels built on https://github.com/google/brotli-wheels/actions/runs/18903110633). The only missing bit is merging https://github.com/google/brotli-wheels/pull/22 and setting up PyPI for Trusted Publishing. Then we can draft a new Github Release at https://github.com/google/brotli-wheels/releases/new for the v1.2.0 tag and the CI should upload the wheels automatically to PyPI.
@eustas do let me know if you need anything from me to get this released.
@danjac commented on GitHub (Nov 4, 2025):
@eustas if you have issues getting PyPi to verify your email this might be helpful: https://github.com/pypi/support
@vprivat-ads commented on GitHub (Nov 5, 2025):
There is already a stalled support request: https://github.com/pypi/support/issues/8057
@anthrotype can you please complete the deployment if you're the only person able to do it quickly?
@alexprengere commented on GitHub (Nov 5, 2025):
https://github.com/google/brotli-wheels/pull/22 should not be a blocker to upload wheels on PyPI.
It sure is better and more secure, but not a blocker 😉
@anthrotype commented on GitHub (Nov 5, 2025):
that's true.. ok, fingers crossed:
https://github.com/google/brotli-wheels/releases/tag/v1.2.0
https://github.com/google/brotli-wheels/actions/runs/19103665553
@danjac commented on GitHub (Nov 5, 2025):
Looks like the PyPi upload failed due to misnamed project: https://github.com/google/brotli-wheels/actions/runs/19103665553/job/54585007131
@anthrotype commented on GitHub (Nov 5, 2025):
oh.. It looks like the wheels for 2.7, 3.6 and 3.7 use the title-case "Brotli" as the wheel filename whereas the more recent ones use the normalized "brotli" name all lowercase. They must be using older tooling which didn't respect PEP 625. Apparently PyPI now requires that all uploads comply to that...
Would it be sufficient if I rename those wheels? Or is there some other piece of metadata that needs changing inside?
@danjac commented on GitHub (Nov 5, 2025):
2.7, 3.6 and 3.7? Why are those wheels still needed for these Python versions?
@anthrotype commented on GitHub (Nov 5, 2025):
eustas (the core maintainer) said earlier in this thread:
so I went to great length trying to convince CI to keep building those despite being EOL
@anthrotype commented on GitHub (Nov 5, 2025):
I pushed this
666c96a947and recreated the v1.2.0 github release. Hopefully this time it will work. You can follow along at:https://github.com/google/brotli-wheels/actions/runs/19105887608
@anthrotype commented on GitHub (Nov 5, 2025):
Simply renaming the wheel file isn't enough... I might also need to fix the internal structure of the wheel. Inside the wheel archive, there's a Brotli-1.2.0.dist-info/ directory that needs to match the wheel filename..
https://github.com/google/brotli-wheels/actions/runs/19105887608/job/54593449986#step:4:298
I think (tomorrow) I can try to somethinge else, maybe patch the setup.py to use normalized package name instead of "Brotli".
@bastimeyer commented on GitHub (Nov 5, 2025):
@anthrotype Have a look at the PyPI test index until you've managed to fix this, so you don't have to test/debug this on the main package index:
https://packaging.python.org/en/latest/guides/using-testpypi/
@anthrotype commented on GitHub (Nov 5, 2025):
Finally it worked!
https://pypi.org/project/brotli/1.2.0/#files
Tomorrow I'll send a PR to upstream google/brotli to normalize the package name in the setup.py so the patch is no longer needed the next time we will make a release.
@alexprengere commented on GitHub (Nov 6, 2025):
To further facilitate next releases, I would humbly suggest to drop anything older than Python3.9 (at least). In the Python world, I believe brotli is mostly used by webservers and CDN. Looking at major Python frameworks:
Even Python3.9 is now completely EOL, not even receiving security fixes: https://endoflife.date/python
@schmidtd commented on GitHub (Dec 10, 2025):
Just to mention - 1.2.0 is out (might be useful to close this issue):
https://github.com/google/brotli/releases/tag/v1.2.0
@Sineaggi commented on GitHub (Dec 10, 2025):
Is it in maven-central? Newest seems to be 0.1.2 https://central.sonatype.com/artifact/org.brotli/dec