v1.5.0a3

[github-actions[bot]]

📝 Release notes

📦 PyPI page: https://pypi.org/project/ansible-pylibssh/1.5.0a3

🚧 v1.5.0a3 is marked as a pre-release.

🔗 This release has been produced by the following workflow run: https://github.com/ansible/pylibssh/actions/runs/39343739334

v1.5.0a3

(2026-10-19)

Bug fixes

• Removed non-mandatory EOF check after the SCP download procedure,
  which was causing race conditions with some Cisco devices -- by
  @timway.

  Related issues and pull requests on GitHub: Unexpected request: b'End of file while reading string' Against Cisco IOS-XE Devices During SCP File Retrieval #785, Remove EOF Check #786.

• The version detection fallback, used when the build-time generated
  version module is missing, now relies on importlib.metadata instead
  of pkg_resources that is unavailable with recent setuptools
  releases -- by @webknjaz.

  Related issues and pull requests on GitHub: 🐛 Use importlib.metadata for version fallback #900.

Features

• Formalized the SFTP.get() and SFTP.put() API to accept
  os.PathLike type in addition to str type for local paths -- by
  @Jakuje.

  Related issues and pull requests on GitHub: sftp: Restrict remote path arguments of get()/put() to str #885.

Removals and backward incompatible breaking changes

• Changed the Channel.write() API to accept only bytes type.
  Previously, this API used to accept anything that could have been
  converted to a pointer using PyBytes_AS_STRING and that would
  implement ~object.__len__() interface, which could result in
  unexpected behavior even for UTF8 strings. Anything else than bytes
  now raises TypeError -- by @Jakuje.

  Related issues and pull requests on GitHub: Remove use of CPython internal PyBytes_AS_STRING API #875.

• Changed the SFTP.get() and SFTP.put() API to accept only str
  type for remote paths.

  Previously, this API used to accept also raw bytes type, which
  required something on the way to guess the real encoding. Anything
  other than str now raises TypeError -- by @Jakuje.

  Related issues and pull requests on GitHub: sftp: Restrict remote path arguments of get()/put() to str #885.

Improved documentation

• Added docstrings for SFTP.get() and SFTP.put() methods -- by
  @Jakuje.

  Related issues and pull requests on GitHub: Improve SFTP doc strings #870.

Packaging updates and notes for downstreams

• The macOS wheels are now universal2, running natively on both Intel
  and Apple Silicon. They bundle libssh 0.12.2 with a statically
  linked OpenSSL, built by the project's own CI as in 🧪 Add pre-built openssl+libssh GHA artifact wf #884, instead of
  the Homebrew ones, which also lowers their minimum macOS version from
  15.0 to 10.12, or what the Python version requires -- by @webknjaz.

  Related issues and pull requests on GitHub: [TODO] Build libssh under macOS instead of using brew #73, Publish a platform-specific wheel for Apple M1 (macOS ARM64) on PyPI #207, 📦 Ship universal2 macOS wheels with a pre-built libssh #917.

• The source distribution now ships a minimal generated setup.cfg with
  the core packaging metadata, so that downstreams can still build it
  with setuptools older than 61, which cannot read 621 metadata --
  by @webknjaz.

  Related issues and pull requests on GitHub: 📦 Migrate core packaging metadata to use PEP 621 / 639 #812.

• The RPM spec now relaxes the setuptools requirement and the 639
  license metadata on RHEL 10 and older, whose setuptools releases
  predate their support -- by @webknjaz.

  Related issues and pull requests on GitHub: 📦 Migrate core packaging metadata to use PEP 621 / 639 #812.

• The core packaging metadata is now declared in the 621 [project]
  table of pyproject.toml instead of setup.cfg, with the license
  expressed per 639, which requires setuptools 77.0.1 or newer -- by
  @webknjaz.

  Related issues and pull requests on GitHub: 📦 Migrate core packaging metadata to use PEP 621 / 639 #812.

• Removed the expandvars build dependency while preserving existing
  compiler and linker flags -- by @f321x.

  Related issues and pull requests on GitHub: replace expandvars with the Python standard library functionality #888.

• Fixed the Linux wheels being compiled without optimization. The
  cibuildwheel configuration set CFLAGS to point at the bundled
  libssh headers, and the build backend set it to add the Cython line
  tracing macro for coverage builds; setuptools replaces the
  interpreter's own compiler flags with a CFLAGS environment variable
  instead of extending them, so -O3 was dropped. Both now go through
  CPPFLAGS, which setuptools appends to the interpreter's flags --
  by @bdraco.

  Related issues and pull requests on GitHub: Pass the extra compiler flags through CPPFLAGS so wheels keep -O3 #890.

• The test suite now optionally depends on proxy.py. The tests needing
  it are skipped when it is not installed, and the RPM spec does not
  pull it in, since it is not packaged downstream yet -- by @webknjaz.

  Related issues and pull requests on GitHub: Withhold sshd replies in the small timeout test via proxy.py #894.

• The core packaging metadata now reflects that we test the project
  under Python 3.15 (with GIL enabled) -- by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Make Python 3.15 supported officially #911.

Contributor-facing changes

• The in-tree guidance for agents on house style, silenced checks, and
  the house rules now keeps project-specific examples apart from the
  rules shared with other projects -- steered by @webknjaz, typed by a
  robot that errs.

  Related commits on GitHub:
  122a1f1f.

• The in-tree guidance for AI agents now asks for commit messages that
  pass gitlint -- by @webknjaz.

  Related commits on GitHub:
  807a23e.

• Claude Code now prompts the human operator before applying edits or
  running commands that look like they silence linters or tests, or that
  change tool configuration -- by @webknjaz.

  Related commits on GitHub:
  083858a9.

• Claude Code now also asks the operator before an agent edits the
  codespell, darglint, isort, nitpick and pylint configs, and
  the .mypy.ini file that it previously missed -- by @webknjaz.

  Related commits on GitHub:
  5ab7c57.

• The in-tree guidance for AI agents now requires an explicit decision
  from the human operator, case by case, before any check gets silenced
  -- whether by adding linter suppressions, relaxing tool configuration,
  or skipping, removing or weakening tests -- and asks for tool
  configuration changes to be kept in standalone commits -- by
  @webknjaz.

  Related commits on GitHub:
  a55c74ff.

• Codespell now has a dedicated settings file in the tree with a few
  currated dictionaries set up and preselected exclusions allowed -- by
  @webknjaz.

  Related commits on GitHub:
  9b135663.

• The in-tree guidance for AI agents now spells out the project's
  structural constraints and its Python, YAML and Markdown style
  conventions, including those not enforced by any linter -- by
  @webknjaz.

  Related commits on GitHub:
  2b149b58.

• Restored coverage collection for the Cython modules in CI, which had
  reported nothing since 🧪 Test pre-built dists via tox's --installpkg #688 -- by @rodrigobnogueira.

  Related commits on GitHub:
  3b3d4d11,
  5919568.

• The in-tree guidance for agents on PRs and change notes now keeps
  project-specific facts apart from the rules shared with other projects
  -- steered by @webknjaz, typed by a robot that errs.

  Related commits on GitHub:
  bbad5215.

• The in-tree guidance for AI agents now covers the commit message
  shape, the use of long tox subcommands without invented flags, and
  flagging generic tooling changes for reuse across the maintainer's
  other projects. It also clarifies that agents are never credited as
  co-authors, with an optional Assisted-by trailer for disclosing AI
  assistance -- by @webknjaz.

  Related commits on GitHub:
  9be75f22.

• The in-tree guidance for AI agents now mentions the Claude Code hook
  that asks the operator before license changes -- by @webknjaz.

  Related commits on GitHub:
  cd8009e.

• The in-tree guidance for AI agents now states that license terms,
  license metadata and license headers only change with the maintainer's
  explicit approval, and that code copied in from elsewhere keeps its
  original license -- by @webknjaz.

  Related commits on GitHub:
  03dec85.

• The in-tree guidance for AI agents now asks for the authors of
  incorporated patches to be credited via Co-Authored-By trailers and
  leaves the change note byline off fully agentic work -- by @webknjaz.

  Related commits on GitHub:
  1227e231.

• The in-tree guidance for AI agents now requires the human operator to
  agree on how to proceed before an agent acts on review comments,
  suggested patches or discussion input from others, and forbids agents
  from force-pushing mid-review -- by @webknjaz.

  Related commits on GitHub:
  5105e647.

• Claude Code now asks the operator before an agent edits license files,
  drops license notices or changes license metadata -- by @webknjaz.

  Related commits on GitHub:
  2e985de.

• The emulated Linux wheel builds stopped rebuilding the aarch64 and
  x86_64 wheels that native runners already produce, which had pushed
  the release job past its time limit.

  Related commits on GitHub:
  364f7f9.

• The Codecov statuses now display separate measurements for Cython and
  Python modules in the library, in addition on the overall number -- by
  @webknjaz.

  Related commits on GitHub:
  5f974f89.

• The in-tree guidance for AI agents now gives a reading order for
  getting oriented in the repository and a map of its less obvious
  directories -- by @webknjaz.

  Related commits on GitHub:
  9faac80a.

• The in-tree guidance for agents on testing now keeps project-specific
  facts apart from the rules shared with other projects, and no longer
  claims that darglint checks test docstrings -- steered by @webknjaz,
  typed by a robot that errs.

  Related commits on GitHub:
  f97d68ec.

• The CI now runs testing against ARM Ubuntu VMs that GitHub Actions
  CI/CD provide -- by @webknjaz.

  The dists are now built under native runners instead of QEMU which
  makes the CI resources use efficient.

  Related issues and pull requests on GitHub: [CI] Integrate Linux ARM jobs #674, 🧪 Add Ubuntu on ARM into the CI matrix #761.

• Traced builds of the Cython modules now define
  CYTHON_USE_SYS_MONITORING=0, so that the Cython.Coverage plugin
  receives line events on CPython 3.13 and newer -- by
  @rodrigobnogueira.

  Related issues and pull requests on GitHub: [TODO] Fix coverage collection for Cython modules #781.

• Added Centos 10 Stream image to the CI/CD pipeline -- by @Jakuje.

  Related issues and pull requests on GitHub: Add Centos 10 Stream build #830.

• Added Centos 9 Stream image to the CI/CD pipeline -- by @Jakuje.

  Related issues and pull requests on GitHub: Add CentOS 9 Stream to CI too #831.

• Updated the version of libssh to the latest release v0.12.1 in the
  cached manylinux build environment container images -- by @Jakuje.

  Related issues and pull requests on GitHub: Update libssh to 0.12.1 in cached manylinux images #846.

• Updated the bundled version of libssh to 0.12.2 in platform-specific
  wheels published on PyPI -- by @Jakuje.

  Related issues and pull requests on GitHub: Update vendored libssh in platform-specific wheels to v0.12.2 #847.

• Fixed Packit CI caused by setuptools_scm version mismatch in build
  environment -- by @Jakuje.

  Related issues and pull requests on GitHub: packit: Correctly find generated tarball #848.

• Updated the version of libssh to the latest release v0.12.2 in the
  cached manylinux build environment container images -- by @Jakuje.

  Related issues and pull requests on GitHub: Update libssh to 0.12.2 in cached manylinux images #851.

• Dropped the EOL Fedora 42 from CI targets -- by @Jakuje.

  Related issues and pull requests on GitHub: ci: Drop Fedora 42 #852.

• The repository now has initial infrastructure for pet agents to lurk
  in and understand how to interact with the project in a useful,
  constructive and collaborative manner while being exposed to the same
  quality development tools their humans are -- by @webknjaz.

  Related issues and pull requests on GitHub: 🤖 Bootstrap agent context infrastructure #867.

• Added the UBI 9.8 container image to the CI test matrix -- by @Jakuje.

  Related issues and pull requests on GitHub: ci: Add ubi 9.8 CI target #876.

• Added a scheduled GitHub Actions workflow that builds a prebuilt
  shared libssh library with a statically linked OpenSSL for macOS
  x86_64, arm64 and universal2, storing them as workflow
  artifacts, following the pattern established by
  pyca/infra. This artifact is not yet
  consumed by the wheel build process -- by @webknjaz.

  Related issues and pull requests on GitHub: [infra][task] Reproduce pyca/infra to periodically create a prebuilt GHA-stored macos libssh artifact #883, 🧪 Add pre-built openssl+libssh GHA artifact wf #884.

• The test_open_session_small_timeout test now withholds the sshd
  replies through a TCP relay instead of racing a local sshd, which made
  it flaky with line tracing enabled -- by @webknjaz.

  Related issues and pull requests on GitHub: Withhold sshd replies in the small timeout test via proxy.py #894.

• The test suite gained a home for test doubles of the components that
  end-to-end tests intercept, under tests/_stubs/. Each of them
  exposes its fixtures through a fixtures.py module, which gets loaded
  as a local pytest plugin automatically -- by @webknjaz.

  Related issues and pull requests on GitHub: Withhold sshd replies in the small timeout test via proxy.py #894.

• The test coverage measurement now includes code running in processes
  started via multiprocessing, which pytest-cov 7 stopped measuring
  on its own -- by @webknjaz.

  Related issues and pull requests on GitHub: Measure coverage in multiprocessing children #898.

• The lint tox <tox:index> environment has been renamed to
  pre-commit -- invoke it as tox run -e pre-commit now -- by
  @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Run linters via reusable-tox.yml #899.

• The linting jobs in CI now run through the reusable-tox.yml workflow
  shared with other projects, and cache the pre-commit virtualenvs
  between runs -- by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Run linters via reusable-tox.yml #899.

• The Python code is now type-checked with MyPy in strict mode against
  every supported Python version, as a part of the pre-commit setup --
  by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Type-check the code with MyPy in strict mode #901.

• The test suite now gives up waiting for the ephemeral sshd to become
  ready after a bounded number of connection attempts, instead of
  hanging when it never comes up -- by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Count sshd readiness probe attempts #902.

• Ruff now targets Python 3.9, the oldest Python version supported by
  the project, instead of its own default -- by @webknjaz.

  Related issues and pull requests on GitHub: 🔧 Set Ruff target version to Python 3.9 #903.

• The in-tree 517 build backend has been adjusted to pass strict type
  checking for every supported Python version -- by @webknjaz.

  Related issues and pull requests on GitHub: 🏷️ Make the PEP 517 backend pass strict MyPy #904.

• The test suite now waits for up to 10 seconds for the ephemeral sshd
  to become ready, instead of giving up after a fixed number of
  connection attempts that fast-failing machines could exhaust early --
  by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Bound sshd readiness wait by time, not tries #905.

• The MyPy type coverage reports are now uploaded to Coveralls from CI,
  summarized on the workflow run pages and linked to after local runs --
  by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Send MyPy coverage reports to Coveralls #906.

• Added an expected-to-fail test documenting that
  pylibsshext.channel.Channel.read_bulk_response() keeps returning
  empty bytes after the remote side closes the channel, instead of
  signaling the end of the stream -- by @Ajithkumar2000.

  Related issues and pull requests on GitHub: Channel.read_bulk_response() returns b"" after the remote side closes the channel, which is indistinguishable from "no data yet" #907.

• The RPM builds in UBI 9 and CentOS Stream 9 containers are no longer
  required to pass in CI, since these only provide tox 3 that cannot
  parse the project's tox 4 configuration -- by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Let UBI 9 & CentOS Stream 9 RPM jobs fail in CI #909.

• The CI job building the emulated manylinux wheels now gets up to 3
  hours, since optimized builds take over twice as long under QEMU -- by
  @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Give emulated wheel builds 3 hours to finish #910.

• The CI now tests wheels built for Python 3.15 -- by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Make Python 3.15 supported officially #911.

• The RPM smoke tests in CI now live in a reusable workflow, configured
  through inputs, with the container matrix kept in the main workflow --
  by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Move RPM smoke tests into a reusable workflow #912.

• The CI job building the macOS wheels now gets up to 15 minutes, since
  it occasionally ran out of time right before finishing the last wheels
  -- by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Give macOS wheel builds 15 minutes to finish #913.

• The in-tree guidance for agents now asks them to re-read it as it
  evolves, to verify claims instead of relying on memory, to fill in the
  PR template, to add change notes for every affected audience, to check
  in on how involved the human operator feels before crediting them, and
  to let the operator confirm any force-push command they run -- steered
  by @webknjaz, typed by a robot that errs.

  Related issues and pull requests on GitHub: Refine the agent guidance with lessons from a long session #915.

• The Claude Code guard against silencing checks now also covers edits
  in other Git worktrees of the repository -- steered by @webknjaz,
  typed by a robot that errs.

  Related issues and pull requests on GitHub: Refine the agent guidance with lessons from a long session #915.

• The test jobs now download only the distribution packages instead of
  every workflow artifact -- by @webknjaz.

  Related issues and pull requests on GitHub: 🧪 Download only the dists in the test jobs #918.

• The manylinux container images used for building the wheels no longer
  compile a custom Perl, which was only ever meant for the manylinux1
  images -- by @webknjaz.

  Related issues and pull requests on GitHub: 📦 Stop compiling Perl in image builds #920.

• The in-tree guidance for agents on running the project's tooling now
  keeps project-specific examples apart from the rules shared with other
  projects -- steered by @webknjaz, typed by a robot that errs.

  Related issues and pull requests on GitHub: #31154463.

Miscellaneous internal changes

• Removed the needless use of CPython internal API PyBytes_AS_STRING
  throughout the code to simplify code and improve the compatibility
  with limited Python API -- by @Jakuje.

  Related issues and pull requests on GitHub: Remove use of CPython internal PyBytes_AS_STRING API #875.

---

---

This discussion was created from the release v1.5.0a3.