chore(deps): update dependency yarl to v1.24.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
yarl	==1.20.1 → ==1.24.2

---

Release Notes

aio-libs/yarl (yarl)

v1.24.2

Compare Source

=======

(2026-05-19)

Contributor-facing changes

• Switched the aarch64 and armv7l wheel builds to GitHub's native ARM
  runners. The aarch64 wheels now build without QEMU emulation, and
  armv7l runs on aarch64 hosts so its 32-bit ARM execution is far
  cheaper than the previous aarch64-on-x86_64 path
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1724.

• Restored per-runner native arches in the Windows wheel matrix on tag
  releases. The previous CIBW_ARCHS_WINDOWS=AMD64 ARM64 setting made
  both windows-latest and windows-11-arm cross-compile the other
  arch, producing two artifacts with identically-named wheels whose
  bytes differed; the deploy job's download-artifact ... merge-multiple
  step tore those writes together, yielding a wheel that PyPI rejected
  with 400 Invalid distribution file. ZIP archive not accepted: Mis-matched data size during the 1.24.0 and 1.24.1 releases
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1725.

---

v1.24.1

Compare Source

=======

(2026-05-19)

Contributor-facing changes

• Allowed re-running the deploy job after a partial release failure: the
  Make Release step now skips when the GitHub Release already exists,
  and the PyPI publish step uses skip-existing so dists that were
  already uploaded on a prior attempt do not break the retry
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1721.

---

v1.24.0

Compare Source

=======

(2026-05-19)

Bug fixes

• Delayed importing pydantic until it's needed to avoid increased import time -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:1607, :issue:1702.

• Fixed pickling of :class:~yarl.URL on Python 3.15, where SplitResult
  gained a __getstate__ that requires attributes set by __init__.
  __getstate__ now returns the raw 5-tuple instead of a SplitResult
  built via tuple.__new__, so pickling no longer touches SplitResult
  serialization at all. Pickles produced by older yarl releases (which embed
  a SplitResult) continue to load unchanged
  -- by :user:befeleme.

  Related issues and pull requests on GitHub:
  :issue:1632, :issue:1642, :issue:1687.

• Fixed a parsing issue where URLs containing text before an opening bracket
  in the host component (e.g. http://127.0.0.1[aa::ff]) were silently accepted
  instead of being rejected as strictly invalid per RFC 3986
  -- by :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:1654.

• Raise :exc:ValueError when a URL's authority component contains a
  backslash, which is not a valid character per :rfc:3986
  -- by :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:1659.

• Fixed a host-confusion parsing bug where URLs containing multiple bracket
  characters in the host component (e.g. http://[:localhost[]].google:80)
  were silently parsed as an unintended host. Both split_url() and
  split_netloc() now raise :exc:ValueError when more than one [ or
  ] is found in the authority, or when [ does not appear at the start of
  the host subcomponent, in compliance with :rfc:3986 -- by
  :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:1661.

• Fixed a parser/serializer inconsistency where percent-encoded characters in
  the scheme portion of a URL (e.g. ht%74p://...) were decoded by the
  requoter, causing str() and :py:meth:~yarl.URL.human_repr to emit an
  absolute URL with a scheme and host while the parsed properties
  (:attr:~yarl.URL.scheme, :attr:~yarl.URL.host, :attr:~yarl.URL.absolute)
  reported a relative, hostless URL. The fix preserves the percent-encoding of
  the colon (%3A) in relative paths whenever decoding it would materialize a
  URL scheme -- by :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:1669.

• Fixed a parsing issue where URLs containing text after the closing bracket
  of an IP-literal host (e.g. http://[::1]allowed.example:1/) were silently
  accepted and normalized to the bracketed IP address (http://[::1]:1/),
  dropping the trailing suffix and changing the effective host identity.
  Per RFC 3986, after the closing ] only : followed by a port number or
  end-of-authority is valid
  -- by :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:1672.

Features

• Start building and shipping riscv64 wheels
  -- by :user:justeph.

  Related issues and pull requests on GitHub:
  :issue:1626.

Removals and backward incompatible breaking changes

• Dropped support for the experimental free-threaded build of Python 3.13 -- by :user:ngoldbaum.

  Related issues and pull requests on GitHub:
  :issue:1667.

Improved documentation

• Added a note in the :meth:~yarl.URL.with_query documentation explaining
  that types implementing __int__ (e.g. :class:~uuid.UUID) are
  converted to integers, and advising users to cast to :class:str when the
  human-readable representation is needed -- by :user:r266-tech.

  Related issues and pull requests on GitHub:
  :issue:1638, :issue:1645.

Contributor-facing changes

• Resolved a ruff ISC004 violation in the PEP 517 build backend so the
  pre-commit ruff-check hook passes again
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1674.

• Renamed the actions/checkout depth input to fetch-depth in the
  reusable codspeed workflow so the actionlint pre-commit hook passes and the
  intended shallow clone actually takes effect
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1676.

• Bumped the pinned pyupgrade pre-commit hook to v3.21.2 so it stops
  crashing on Python 3.14, which made tokenize.cookie_re bytes-only
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1677.

• The type preciseness coverage report generated by MyPy <https://mypy-lang.org>__ is now uploaded to Coveralls <https://coveralls.io/github/aio-libs/yarl>__ and
  will not be included in the Codecov views <https://app.codecov.io/gh/aio-libs/yarl>__ going forward
  -- by :user:webknjaz.

  Related issues and pull requests on GitHub:
  :issue:1680.

• Raised the per-matrix-cell timeout of the CI Test job from
  5 to 10 minutes to prevent false failures on slower runners
  -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:1683.

• Added an AGENTS.md orientation file at the repository root,
  covering the pull request template, CHANGES/ news fragment
  conventions, draft-PR workflow, and the Cython quoter layout, so
  LLM contributors land changes that match project style
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1685.

• Documented in :file:AGENTS.md that the coverage gate also
  applies to test code, so unreachable defensive raise guards
  and one-sided cleanup branches in tests will fail CI
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1689.

• Shrunk the CI wheel-build matrix on pull requests and non-tag pushes by
  restricting CIBW_ARCHS_MACOS to arm64, CIBW_ARCHS_WINDOWS to
  AMD64, and skipping the windows-11-arm runner -- the test matrix only
  exercises those architectures, so the previously-built x86_64 macOS and
  ARM64 Windows wheels were never installed. Tag releases still build the
  full architecture set
  -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:1692.

• Documented the docs spell check (make doc-spelling) in
  :file:AGENTS.md as a pre-push gate, mirroring
  aio-libs/multidict#1345 <https://github.com/aio-libs/multidict/pull/1345>__. The
  spell checker reads every CHANGES/*.rst fragment as part
  of the docs build, so an unknown technical word in a news
  fragment fails CI before a human sees the PR
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1693.

• Added a CLAUDE.md at the repository root that imports
  :file:AGENTS.md via Claude Code's @-syntax, so the
  project's LLM contributor rules load automatically when
  working in Claude Code
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1696.

• Enforced top-level imports across yarl and tests via the ruff
  PLC0415 rule, wired through a new ruff-check pre-commit hook.
  Function-scoped imports must now opt in with # noqa: PLC0415 plus
  a comment explaining the import-time reason. Dropped the yesqa
  hook, which could not recognize ruff-only codes and stripped the new
  noqa comments as stale; a wider migration off flake8 onto ruff
  will follow separately
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1697.

• Migrated the main tree from standalone black and isort
  pre-commit hooks to ruff format and the ruff I lint rule,
  sharing the existing [tool.ruff] config in pyproject.toml.
  ruff-check now runs with --fix so import-order fixes apply
  on commit, and the orphan [isort] block in setup.cfg was
  removed. The packaging/pep517_backend/ subtree keeps its own
  .ruff.toml and is unaffected
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1698.

• Switched the cibuildwheel build frontend to build[uv] so
  that uv provisions every build and test virtual environment
  in the wheel matrix. Test-dependency installation in particular
  drops from a multi-second pip install per ABI to a roughly
  sub-second uv resolve
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1699.

• Restructured the root :file:CLAUDE.md to import contributor
  context from a shared aio-libs layer
  (~/.claude/aio-libs/context.md), a project-specific layer
  (~/.claude/aio-libs/yarl/context.md), the in-tree
  :file:AGENTS.md, and an optional per-checkout
  :file:CLAUDE.local.md override (added to :file:.gitignore),
  so shared aio-libs guidance can live outside the repository
  while project rules continue to load automatically in Claude
  Code -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:1700, :issue:1701.

• Switched CI/CD to tox-dev/workflow's :file:reusable-tox.yml
  driven by an in-tree :file:tox.ini. The build,
  metadata-validation and lint (pre-commit,
  spellcheck-docs, build-docs) jobs all run through the
  reusable workflow; MyPy coverage uploads to Coveralls from a
  post-tox-job hook
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1711.

• Switched the CI test job from actions/setup-python to
  astral-sh/setup-uv with uv pip install. Pre-release
  interpreters skip the wheel cache so each run resolves freshly
  against the current snapshot
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1715.

• Switched the Aiohttp workflow that runs the aiohttp test
  suite against the in-tree yarl checkout from
  actions/setup-python to astral-sh/setup-uv with uv pip install
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1716.

• Switched the Aiohttp workflow's make .develop step to
  install aiohttp's dev env through uv pip by passing
  PIP="uv pip"
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1717.

---

v1.23.0

Compare Source

======

(2025-12-16)

Features

• Added support for pydantic, the :class:~yarl.URL could be used as a
  field type in pydantic models seamlessly.

  Related issues and pull requests on GitHub:
  :issue:1607.

Packaging updates and notes for downstreams

• The CI has been set up to notify Codecov about upload completion
  -- by :user:webknjaz.

  With this, Codecov no longer needs to guess whether it received all
  the intended coverage reports or not.

  Related issues and pull requests on GitHub:
  :issue:1577.

• The in-tree build backend allows the end-users appending
  CFLAGS and LDFLAGS by setting respective environment
  variables externally.

  It additionally sets up default compiler flags to perform
  building with maximum optimization in release mode. This
  makes the resulting artifacts shipped to PyPI smaller.

  When line tracing is requested, the compiler and linker
  flags are configured to include as much information as
  possible for debugging and coverage tracking. The
  development builds are therefore smaller.

  -- by :user:webknjaz

  Related issues and pull requests on GitHub:
  :issue:1586.

• The :pep:517 build backend now supports a new config
  setting for controlling whether to build the project in-tree
  or in a temporary directory. It only affects wheels and is
  set up to build in a temporary directory by default. It does
  not affect editable wheel builds — they will keep being
  built in-tree regardless.

  -- by :user:webknjaz

  Here's an example of using this setting:

  .. code-block:: console

  $ python -m build
  --config-setting=build-inplace=true

  Related issues and pull requests on GitHub:
  :issue:1590.

• Starting this version, when building the wheels is happening
  in an automatically created temporary directory, the build
  backend makes an effort to normalize the respective file
  system path to a deterministic source checkout directory.

  -- by :user:webknjaz

  It does so by injecting the -ffile-prefix-map compiler
  option into the CFLAGS environment variable as suggested
  by known reproducible build practices <https://reproducible-builds.org/docs/build-path/>__.

  The effect is that downstreams will get more reproducible
  build results.

  Related issues and pull requests on GitHub:
  :issue:1591.

• Dropped Python 3.9 support; Python 3.10 is the minimal supported Python version
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1609.

Contributor-facing changes

• The deprecated license classifier was removed from :file:setup.cfg
  -- by :user:yegorich.

  Related issues and pull requests on GitHub:
  :issue:1550.

• The in-tree build backend allows the end-users appending
  CFLAGS and LDFLAGS by setting respective environment
  variables externally.

  It additionally sets up default compiler flags to perform
  building with maximum optimization in release mode. This
  makes the resulting artifacts shipped to PyPI smaller.

  When line tracing is requested, the compiler and linker
  flags are configured to include as much information as
  possible for debugging and coverage tracking. The
  development builds are therefore smaller.

  -- by :user:webknjaz

  Related issues and pull requests on GitHub:
  :issue:1586.

• The CI has been updated to consistently benchmark optimized
  release builds -- by :user:webknjaz.

  When the release workflow is triggered, the pre-built wheels
  ready to hit PyPI are being tested. Otherwise, the job
  builds the project from source, while the rest of the
  workflow uses debug builds for line tracing and coverage
  collection.

  Related issues and pull requests on GitHub:
  :issue:1587.

---

v1.22.0

Compare Source

======

(2025-10-05)

Features

• Added arm64 Windows wheel builds
  -- by :user:finnagin.

  Related issues and pull requests on GitHub:
  :issue:1516.

---

v1.21.0

Compare Source

======

(2025-10-05)

Contributor-facing changes

• The :file:reusable-cibuildwheel.yml workflow has been refactored to
  be more generic and :file:ci-cd.yml now holds all the configuration
  toggles -- by :user:webknjaz.

  Related issues and pull requests on GitHub:
  :issue:1535.

• When building wheels, the source distribution is now passed directly
  to the cibuildwheel invocation -- by :user:webknjaz.

  Related issues and pull requests on GitHub:
  :issue:1536.

• Added CI for Python 3.14 -- by :user:kumaraditya303.

  Related issues and pull requests on GitHub:
  :issue:1560.

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.