Commits on Oct 20, 2026

1. ci: repair CI on the v0.16.x maintenance branch (#868) …

   * test(checksum32): wrap parametrize itertools.product in tuple
   
   pytest 9 raises PytestRemovedIn10Warning for non-Collection iterables passed to parametrize, which becomes an error under filterwarnings=error and aborts test collection. Same change as 15803df on backport-0.15-zstd-fixes.
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   * ci: stop testing the 0.16.x line against zarr-python main
   
   zarr-python main now requires Python >=3.12, while this line supports Python >=3.11. uv resolves all dependency groups together, so the test-zarr-main group made every uv invocation fail with an unsatisfiable resolution (seen in the i386 workflow). A maintenance line does not need to track zarr-python main, so remove the group, its pixi tasks, and its CI matrix entry.
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   * ci: replace the macos-13 runner with macos-15-large
   
   macos-13 runners are no longer available. macos-15-large is still an Intel runner, so x86 coverage is preserved. macOS 15's dyld rejects the duplicate LC_RPATH entries that the conda-forge compilers produce, so add the same deduplication step used on backport-0.15-zstd-fixes (64eade5, 7ae0f4b).
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   * ci(docs): build on ubuntu-24.04 on Read the Docs
   
   Read the Docs removed the ubuntu-20.04 build image.
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   * ci: stop pinning clang below 17 on the Intel macOS runner
   
   The pin downgraded the conda-forge compiler to clang 14, which cannot parse the macOS 15 SDK headers on macos-15-large (math.h: '_Float16 is not supported on this target'), so every extension build failed. Use the clang that the conda-forge c-compiler package installs instead.
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   * ci(i386): install zfpy with uv pip instead of uv add
   
   zfp's pyproject.toml has no [project] table, so 'uv add "zfpy @ ./zfp"' fails with 'No project table found'. Install the locally built zfpy into the environment with 'uv pip install ./zfp', as main does. Because zfpy is no longer recorded in pyproject.toml, keep the same virtual environment for the numcodecs install and run pytest with --no-sync so uv does not re-resolve the environment.
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   * ci(i386): stop installing pcodec in the i386 job
   
   This workflow has no matrix, so the python-version conditional always took the branch that installs pcodec. pcodec has no i386 wheel and its source build produces a wheel tagged linux_x86_64, which uv refuses to install in the i386 Alpine environment. Install without pcodec, as main does; the pcodec tests are skipped when it is missing.
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   * test(pyzstd): skip test_pyzstd when pyzstd cannot be imported
   
   On Python 3.14, pyzstd imports the standard library's compression.zstd, which needs the _zstd extension module. Alpine's i386 Python does not ship it, so importing pyzstd raised ModuleNotFoundError and aborted test collection. Use pytest.importorskip, as main does (#845).
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   * ci(codecov): compare project coverage against the base commit
   
   codecov/project has failed on every recent commit of this line, including the 0.16.5 release, at 98.68% against a 100% target. The uncovered lines are in numcodecs/zarr3.py and the crc32c fallback paths, which the coverage-uploading jobs do not exercise. Set the project target to auto so the check fails only when a change lowers coverage. The patch target stays at 100%.
   
   Assisted-by: ClaudeCode:claude-fable-5.1

   

   d-v-b authored Oct 20, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 883ae82
   • Browse repository at this point

   Copy the full SHA

   883ae82 View commit details

   Browse the repository at this point in the history

2. Merge commit from fork …

   * fix(pickles): refuse to unpickle in Pickle.decode unless the process opts in
   
   Pickle.decode called pickle.loads on its input, and the "pickle" codec id
   can be selected by array metadata, so reading an untrusted array could
   execute arbitrary code. Decoding now raises UnsafeDecodeError unless
   numcodecs.pickles.ALLOW_UNSAFE_PICKLE_DECODE is True, which is initialised
   from the NUMCODECS_ALLOW_UNSAFE_PICKLE_DECODE environment variable. The
   switch is process-wide rather than a codec parameter because codec
   parameters come from the same untrusted metadata. Encoding is unchanged.
   
   Refs: GHSA-jqc8-qjfv-5m6r
   
   Assisted-by: ClaudeCode:claude-opus-5-5
   
   * docs(release): add the 0.16.6 release notes heading
   
   The security entry is the only change in this release.
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   Co-Authored-By: Claude Fable 5.1 <[email protected]>
   
   * docs(pickles): list the accepted opt-in values and test the env parsing through a helper
   
   Mirror the follow-up changes from the main PR: the docs and release note now list "yes" and "true" as accepted values of NUMCODECS_ALLOW_UNSAFE_PICKLE_DECODE, and the environment variable test uses the new _read_opt_in_from_env() helper with monkeypatch instead of a subprocess. The variable is still read once at import.
   
   Assisted-by: ClaudeCode:claude-fable-5.1
   
   Co-Authored-By: Claude Fable 5.1 <[email protected]>
   
   ---------
   
   Co-authored-by: Claude Fable 5.1 <[email protected]>

   

   d-v-b and claude authored Oct 20, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 40c29ef
   • Browse repository at this point

   Copy the full SHA

   40c29ef View commit details

   Browse the repository at this point in the history