Repository navigation
Fix dependencies for blosc extension - #860
Merged
Merged
Conversation
The blosc extension only depends on `blosc.h`, not any of the other libraries' headers. And if we're using internal blosc, then the other libraries are handled by `blosc_lib`.
Also, don't build vendored Zlib internally if not using vendored blosc, as it isn't necessary.
Contributor
|
thanks, this looks good. I requested review from @mkitti who knows this stuff better than me. if that takes too long I will ask an llm. |
Contributor
|
This also looks good to me. I think this is scoped to meson though. Is that the only build method we support? I would just add a note that this only affects thr meson build path. |
mkitti
approved these changes
Sep 18, 2026
mkitti
left a comment
mkitti
left a comment
Contributor
There was a problem hiding this comment.
Nevermind. The build system was switched to meson.
d-v-b
added a commit
that referenced
this pull request
Oct 20, 2026
* fix(pickles): refuse to unpickle in Pickle.decode unless the process opts in Pickle.decode called pickle.loads on its input, and the "pickle" codec id can be selected by array metadata, so reading an untrusted array could execute arbitrary code. Decoding now raises UnsafeDecodeError unless numcodecs.pickles.ALLOW_UNSAFE_PICKLE_DECODE is True, which is initialised from the NUMCODECS_ALLOW_UNSAFE_PICKLE_DECODE environment variable. The switch is process-wide rather than a codec parameter because codec parameters come from the same untrusted metadata. Encoding is unchanged. Refs: GHSA-jqc8-qjfv-5m6r Assisted-by: ClaudeCode:claude-opus-5-5 * Update docs/release.md Co-authored-by: Max Jones <[email protected]> * docs(release): fix typo in the Pickle.decode security note Assisted-by: ClaudeCode:claude-fable-5.1 * Update docs/other/pickles.md Co-authored-by: Chris Holden <[email protected]> * Update docs/release.md Co-authored-by: Chris Holden <[email protected]> * docs(release): add the 0.17.1 release notes heading Move the unreleased entries under a 0.17.1 heading. The entry for #860 had no section and sat above the 0.17.0 label; it is now listed under Maintenance for 0.17.1. Assisted-by: ClaudeCode:claude-fable-5.1 Co-Authored-By: Claude Fable 5.1 <[email protected]> * Apply suggestion from @maxrjones Co-authored-by: Max Jones <[email protected]> * Apply suggestion from @maxrjones Co-authored-by: Max Jones <[email protected]> * Update tests/test_pickles.py Co-authored-by: Max Jones <[email protected]> * test(pickles): test the environment variable parsing through a helper The rewritten test set the environment variable after import and expected decode to honor it, but the variable is read once at import time, so the truthy cases failed. Move the parsing into _read_opt_in_from_env(), call it once at import as before, and test the helper directly with monkeypatch. No subprocess is needed and the import-once behavior is unchanged. Assisted-by: ClaudeCode:claude-fable-5.1 Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: Max Jones <[email protected]> Co-authored-by: Chris Holden <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The blosc extension only depends on
blosc.h, not any of the other libraries' headers. And if we're using internal blosc, then the other libraries are handled byblosc_lib.Additionally, Zlib is only required if building blosc internally, but also add an option to allow using a system copy of it if desired.