Security

• Pickle.decode now refuses to unpickle data unless the process opts in, because
  unpickling can execute arbitrary code and the pickle codec can be selected by
  untrusted array metadata. Decoding raises numcodecs.errors.UnsafeDecodeError by
  default. To read trusted pickle-encoded data, set
  numcodecs.pickles.ALLOW_UNSAFE_PICKLE_DECODE = True, or set the environment variable
  NUMCODECS_ALLOW_UNSAFE_PICKLE_DECODE=1 (or "yes" / "true") before importing
  numcodecs. These settings only affect decoding. Encoding with the pickle codec remains
  allowed by default.
  See GHSA-jqc8-qjfv-5m6r.

Maintenance

• Allow building against a system Zlib. Note, this is only required if blosc is still
  vendored, and a vendored Zlib is no longer built if blosc is not.
  By @QuLogic, #860

Full Changelog: v0.17.0...v0.17.1

Security

• Pickle.decode now refuses to unpickle data unless the process opts in, because
  unpickling can execute arbitrary code and the pickle codec can be selected by
  untrusted array metadata. Decoding raises numcodecs.errors.UnsafeDecodeError by
  default. To read trusted pickle-encoded data, set
  numcodecs.pickles.ALLOW_UNSAFE_PICKLE_DECODE = True, or set the environment variable
  NUMCODECS_ALLOW_UNSAFE_PICKLE_DECODE=1 (or "yes" / "true") before importing
  numcodecs. These settings only affect decoding. Encoding with the pickle codec remains
  allowed by default.
  See GHSA-jqc8-qjfv-5m6r.

Maintenance

• Repaired CI on the 0.16.x maintenance branch so this release could be built and tested
  (#868). No functional changes.

This is a security update for the 0.16 line; the same fix is in 0.15.2 and 0.17.1.

Full Changelog: v0.16.5...v0.16.6

Security

• Pickle.decode now refuses to unpickle data unless the process opts in, because
  unpickling can execute arbitrary code and the pickle codec can be selected by
  untrusted array metadata. Decoding raises numcodecs.errors.UnsafeDecodeError by
  default. To read trusted pickle-encoded data, set
  numcodecs.pickles.ALLOW_UNSAFE_PICKLE_DECODE = True, or set the environment variable
  NUMCODECS_ALLOW_UNSAFE_PICKLE_DECODE=1 (or "yes" / "true") before importing
  numcodecs. These settings only affect decoding. Encoding with the pickle codec remains
  allowed by default.
  See GHSA-jqc8-qjfv-5m6r.

Maintenance

• Repaired CI on the 0.15.x maintenance branch so this release could be built and tested
  (#869). No functional changes.

This is a security update for the 0.15 line; the same fix is in 0.16.6 and 0.17.1.

Full Changelog: v0.15.1...v0.15.2

What's Changed

• Don't report coverage on test directory by @maxrjones in #803
• Bump ruff and update pre-commit legacy alias by @DimitriPapadopoulos in #791
• update macos intel runner by @ianhi in #819
• Exclude tests dir from code coverage by @maxrjones in #823
• Suppress NumPy 2.4 VisibleDeprecationWarning for align=0 in test by @maxrjones in #822
• Move tests out of installable distribution by @maxrjones in #829
• Update README to markdown with working badges by @maxrjones in #827
• Convert RST docs to markdown by @maxrjones in #830
• Migrate build system from setuptools to meson-python by @maxrjones in #826
• Drop Python 3.11 and NumPy <2.0 per SPEC-0 by @maxrjones in #834
• Bump readthedocs build image by @maxrjones in #833
• Fix typos by @DimitriPapadopoulos in #832
• CI: Fix Meson mixup between Conda and system Python headers by @DimitriPapadopoulos in #839
• zarr-python does not depend on crc32c anymore by @DimitriPapadopoulos in #840
• chore: pin pytest and dedupe dependency groups by @d-v-b in #844
• Skip test_pyzstd when pyzstd cannot be imported by @d-v-b in #845
• update pcodec by @mwlon in #817
• Add pytest-cov to dev dependency group by @d-v-b in #846
• Bump GitHub actions by @DimitriPapadopoulos in #838
• Add free-threaded CPython (3.14t) support by @kumaraditya303 in #858
• CI: set an explicit python-version for test-crc32c and test-zarr by @glaziermag in #856

New Contributors

• @kumaraditya303 made their first contribution in #858
• @glaziermag made their first contribution in #856

Full Changelog: v0.16.5...v0.17.0

What's Changed

• Revert dependency group changes by @d-v-b in #802
• Release notes for v0.16.5 by @maxrjones in #804

Full Changelog: v0.16.4...v0.16.5

What's Changed

• CI: add a nightly wheel upload by @ianhi in #787
• Bump prefix-dev/setup-pixi from 0.8.14 to 0.9.0 by @dependabot[bot] in #783
• fetch tags to version nightly wheels correctly by @ianhi in #790
• chore/hollow out zarr3 by @d-v-b in #780
• chore/wheel 3.14 by @d-v-b in #796
• Bump actions/download-artifact from 4 to 6 by @dependabot[bot] in #794
• Add pcodec to 32-bit CI by @mkitti in #786
• chore(crc32c): replace crc32c with google-crc32c dependency by @jhamman in #792
• Bump jirutka/setup-alpine from 1.2.0 to 1.3.0 by @dependabot[bot] in #789
• Allow Zstandard to decompress multiple concatenated frames by @mkitti in #757
• ensure_bytes on buf for pcodec decode by @slowjazz in #756
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #775
• Bump conda-incubator/setup-miniconda from 3.1.1 to 3.2.0 by @dependabot[bot] in #753
• Bump pypa/cibuildwheel from 2.23.2 to 3.1.3 by @dependabot[bot] in #771
• Use pytest.skipif to properly report skipped CRC32C codec tests by @agriyakhetarpal in #740
• Test against zarr main by @maxrjones in #800
• Add Python 3.14 to test matrix by @maxrjones in #799
• chore/release notes by @d-v-b in #798

New Contributors

• @ianhi made their first contribution in #787
• @jhamman made their first contribution in #792
• @slowjazz made their first contribution in #756
• @maxrjones made their first contribution in #800

Full Changelog: v0.16.3...v0.16.4

What's Changed

• Fix Zstd decompression negative size issue on 32-bit platforms (Fixes #781) by @mkitti in #782
• Test 32-bit support via x86 Alpine Setup Action Linux by @mkitti in #784
• MNT: bump to main branch of c-blosc to fix gcc15 compilation by @tacaswell in #772

Full Changelog: v0.16.2...v0.16.3

What's Changed

• chore: update pre-commit hooks by @pre-commit-ci[bot] in #752
• Add streaming decompression for ZSTD_CONTENTSIZE_UNKNOWN case by @mkitti in #707
• Fix ruff check issues by @mkitti in #764
• Handle zarr 3.1.0 by @d-v-b in #766

New Contributors

• @d-v-b made their first contribution in #766

Full Changelog: v0.16.1...v0.16.2

What's Changed

• Fix const discard warnings in fletcher32 by @jakirkham in #728
• In vlen, define and use const HEADER_LENGTH by @jakirkham in #723
• chore: update pre-commit hooks by @pre-commit-ci in #722
• Update license* metadata and include third-party licenses by @jakirkham in #729
• Bump pypa/cibuildwheel from 2.23.0 to 2.23.2 by @dependabot in #719
• Add #ifndef guard around PyBytes_RESIZE by @jakirkham in #732
• Unskip accidentally skipped tests by @dstansby in #738
• Re-enable VLenBytes round-trip None test by @jakirkham in #736
• Update development practices by @dstansby in #734
• chore: update pre-commit hooks by @pre-commit-ci in #747
• Make all codecs pickleable by @TomNicholas in #745
• (fix): ensure no typesize in the Blosc config by @ilan-gold in #739
• Unnecessary None provided as default by @DimitriPapadopoulos in #708

New Contributors

• @TomNicholas made their first contribution in #745

Full Changelog: v0.16.0...v0.16.1

What's Changed

• Only skip failing test on macOS by @dstansby in #709
• Build for Linux AArch64 and other miscellaneous cleanups by @agriyakhetarpal in #710
• Bump conda-incubator/setup-miniconda from 3.1.0 to 3.1.1 by @dependabot in #695
• chore: update pre-commit hooks by @pre-commit-ci in #715
• Bump pypa/cibuildwheel from 2.22.0 to 2.23.0 by @dependabot in #714
• (feat): typesize declared with constructor for Blosc by @ilan-gold in #713
• Switch Buffers to memoryviews & remove extra copies/allocations by @jakirkham in #656
• For Fletcher32, define a constant FOOTER_LENGTH by @jakirkham in #718
• Make Checksum32 an ABC by @dstansby in #711
• Remove deprecated blosc code by @dstansby in #712
• Update changelog for 0.16 by @dstansby in #720

New Contributors

• @agriyakhetarpal made their first contribution in #710
• @ilan-gold made their first contribution in #713

Full Changelog: v0.15.1...v0.16.0