Skip to content

Release v2.12.0#423

Merged
jvanderaa merged 66 commits into
mainfrom
release-2.12.0
Jun 15, 2026
Merged

Release v2.12.0#423
jvanderaa merged 66 commits into
mainfrom
release-2.12.0

Conversation

@jvanderaa

Copy link
Copy Markdown
Contributor

Closes #422

Minor release v2.12.0, following docs/dev/release_checklist.md.

Important

Do not squash merge. Use Create a merge commit when merging into main.

What's Changed

Security

  • #415 - Bumped lxml (>=6.1.0), urllib3 (>=2.7.0), requests (>=2.33.0), and pygments (>=2.20.0) to address open Dependabot advisories (XXE in iterparse, sensitive-header forwarding on proxied redirects, decompression-bomb safeguard bypass, insecure temp file reuse, ReDoS).

Added

  • #395 - Added parser for SummitIG.
  • #412 - Added parser for provider RETN.
  • #414 - Added parser for provider Telxius.
  • #416 - Added parser for Vodafone.
  • #417 - Added Cirion parser (Lumen fork).
  • #419 - Added parser for FLAG (fka Globalcloudexchange).

Fixed

  • #378 - Fixed Megaport parser to account for initial and reminder announcements, corrected start and end dates for both, and fixed the "purpose of maintenance" section.
  • #411 - Fixed Equinix parser to match maintenance_id for the alternative email subject line, when the maintenance_id is not matched between square brackets.

Dependencies

  • #415 - Bumped Python dependencies (click, coverage, netconan, pylint, ruff, cffi, pymdown-extensions) and CI action pins (actions/checkout, docker/setup-buildx-action, pypa/gh-action-pypi-publish).
  • #415 - Added Python 3.14 to the supported version range and split numpy by Python version (2.2.x on Python 3.10, >=2.3 on 3.11+) so the same lock resolves cleanly across the full supported range.

Housekeeping

  • #396 - Raised the minimum pytest version to 9.0.3 to address CVE-2025-71176 (insecure /tmp/pytest-of-{user} tmpdir handling on UNIX).
  • Rebaked from the cookie main.

Notes for reviewers

  • changes/396 was reclassified from .security to .housekeeping (pytest is a dev-only dependency; per NTC convention established on Bump pytest minimum to 9.0.3 (CVE-2025-71176) #406).
  • Backfilled docs/admin/release_notes/version_2.11.md so v2.11 follows the per-minor split-file pattern (it previously lived only in the combined docs/release_notes.md).
  • poetry.lock intentionally left untouched; dependency refreshes are handled by the open Renovate PRs.

i3dnet-akoopen and others added 30 commits February 23, 2026 14:22
Megaport fixes for initial maintenance announcement emails
…t Manager Tool

Template:

```
{
    "template": "https://github.com/networktocode-llc/cookiecutter-ntc.git",
    "dir": "python",
    "ref": "main",
    "path": null
}
```

Cookie:

```
{
    "remote": "https://github.com/networktocode/circuit-maintenance-parser.git",
    "path": "/Users/jeffkala/Documents/GitHub/outputs/circuit-maintenance-parser",
    "repository_path": "/Users/jeffkala/Documents/GitHub/outputs/circuit-maintenance-parser",
    "dir": "",
    "branch_prefix": "drift-manager/develop",
    "context": {
        "codeowner_github_usernames": "@chadell @glennmatthews @pke11y @scetron @jvanderaa",
        "full_name": "Network to Code, LLC",
        "email": "info@networktocode.com",
        "github_org": "networktocode",
        "description": "Python library to parse circuit maintenances from network service providers.",
        "project_name": "circuit-maintenance-parser",
        "project_slug": "circuit-maintenance-parser",
        "repo_url": "https://github.com/networktocode/circuit-maintenance-parser",
        "base_url": "circuit-maintenance-parser",
        "project_python_name": "circuit_maintenance_parser",
        "project_python_base_version": "3.10",
        "project_with_config_settings": "no",
        "generate_docs": "yes",
        "version": "2.10.0",
        "original_publish_year": "2021",
        "_template": "https://github.com/networktocode-llc/cookiecutter-ntc.git",
        "_output_dir": "/Users/jeffkala/Documents/GitHub/outputs",
        "_repo_dir": "/Users/jeffkala/.cookiecutters/cookiecutter-ntc/python",
        "_checkout": "main"
    },
    "drift_managed_branch": "develop",
    "remote_name": "origin",
    "pull_request_strategy": "PullRequestStrategy.CREATE",
    "post_actions": [],
    "baked_commit_ref": "",
    "draft": false
}
```

CLI Arguments:

```
{
    "cookie_dir": "",
    "input": true,
    "json_filename": "",
    "output_dir": "../outputs",
    "push": true,
    "template": "https://github.com/networktocode-llc/cookiecutter-ntc.git",
    "template_dir": "python",
    "template_ref": "main",
    "pull_request": null,
    "post_action": [],
    "disable_post_actions": false,
    "draft": null,
    "drift_managed_branch": "develop"
}
```
- Resolve merge conflicts in pyproject.toml and README.md
- Update pyproject.toml for poetry 2.x build system with docs dependencies
- Add project-specific content to placeholder docs (overview, getting started,
  use cases, FAQ, extending guide, release notes)
- Create v2.10 release notes page required by docs build check
- Add mkdocs build output to .gitignore
- Fix ruff formatting and import sorting issues
Restore detailed content from original README into the developer
documentation: full 7-step provider checklist with test examples,
local debugging guide, and local dev requirements with
INVOKE_PARSER_LOCAL note.
The cookiecutter template generated INVOKE_CIRCUIT-MAINTENANCE-PARSER_*
env var names, but hyphens are invalid in shell variable names. This
caused Docker image tags to resolve as ":version" with no image name.
Revert to the original INVOKE_PARSER_* names used by tasks.py.
Rename IDENTIFIER to identifier to conform to snake_case naming.
Resolve poetry.lock conflict after lxml 6.0.2 update (PR #390).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Resolve poetry.lock conflict after lxml version update (#394) merged into develop.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Merge main back to develop after v2.11.0 release
Reduce amount of local variables to make pylint happy
Remove trailing space in summary-field
Add change text for PR 378
Resolves merge conflict in pyproject.toml: keep the cookiecutter-added
[[tool.towncrier.type]] "breaking" section alongside develop's post-v2.11.0
state (towncrier fragments consumed into docs/release_notes.md, version
bumped to 2.11.1b1).

Brings PR #388 current with develop ahead of merging so the drift-managed
ci.yml and release.yml replace the legacy inline publish jobs.
Cookie initially baked targeting develop by NetworkToCode Cookie Drift Manager Tool
…tenance_id

Moving forward, maintenance ID's for Equinix are in the format of CHG[0-9]+
Support old and new maintenance_id format; only fall back on matching for CHG[0-9]+ in case maintenance_id is not matched between brackets
Changelog message
i3dnet-akoopen and others added 25 commits May 6, 2026 16:41
Co-authored-by: Josh VanDeraa <josh@josh-v.com>
Co-authored-by: Josh VanDeraa <josh@josh-v.com>
Add parser for provider/vendor RETN.
Equinix fix matching maintenance_id in alternative email subject line
Bumped click, coverage, mkdocs-redirects, netconan, pylint, and ruff,
along with CI action pins (actions/checkout, docker/setup-buildx-action,
pypa/gh-action-pypi-publish). Added Python 3.14 to the supported version
range, expanded the CI matrices to cover it, and removed an
indentation-flagged trailing comment in release.yml.
Resolved five open Dependabot advisories by adding minimum-version
constraints to pyproject.toml so Poetry resolves transitive deps to
patched releases:

- lxml >=6.1.0 (XXE in iterparse default configuration)
- urllib3 >=2.7.0 (sensitive-header forwarding on proxied redirects;
  decompression-bomb safeguard bypass)
- requests >=2.33.0 (insecure temp file reuse in extract_zipped_paths)
- pygments >=2.20.0 (ReDoS in GUID regex matching)

Regenerated poetry.lock; only the four flagged packages changed.
- Added build-essential to the Dockerfile so transitive deps lacking
  cp3xx wheels can be source-built (relevant for the newest Python).
- Added `numpy` as a direct dependency with Python-version markers
  so 3.11+ pulls numpy >=2.3 (with cp314 wheels) while 3.10 stays on
  the 2.2 line; this lets one lock resolve across the full supported
  range, including Python 3.14.
- Bumped cffi (1.17 -> 2.0) so 3.14 uses the wheel-supported line
  rather than source-compiling.
- Bumped pymdown-extensions (10.21 -> 10.21.2) to fix a None-filename
  regression with pygments 2.20.0 that broke `dev/extending.md`
  during docs build.
- Held mkdocs-redirects at 1.2.2; 1.2.3 introduced a transitive
  dependency on the properdocs fork, which deserves separate
  evaluation before adoption.
- Verified locally: full pytest suite passes on Python 3.14.4 inside
  a fresh image, and `invoke build-and-check-docs` succeeds.
Add in a parser for vendor SummitIG
Add parser for FLAG (fka Global Cloud Xchange)
…6-05

Bump dependencies and add Python 3.14 support
Add Cirion parser (Lumen fork)
Comment thread pyproject.toml
authors = ["Network to Code, LLC <opensource@networktocode.com>"]
license = "Apache-2.0"
homepage = "https://github.com/networktocode/circuit-maintenance-parser"
homepage = "https://circuit-maintenance-parser.readthedocs.io/"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This link is a 404 for me?

@jvanderaa jvanderaa merged commit fbe912f into main Jun 15, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants