Merge branch 'main' into override-with-annotated

.github/workflows/main.yml

@@ -19,13 +19,15 @@ jobs:
 
     steps:
       - uses: "actions/checkout@v4"
+        with:
+          persist-credentials: false
 
       - uses: "pdm-project/setup-pdm@v4"
         with:
           python-version: "${{ matrix.python-version }}"
           allow-python-prereleases: true
           cache: true
-          version: "2.19.2"
+          version: "2.21.0"
 
       - name: "Run Tox"
         run: |
@@ -48,6 +50,8 @@ jobs:
 
     steps:
       - uses: "actions/checkout@v4"
+        with:
+          persist-credentials: false
 
       - uses: "actions/setup-python@v5"
         with:
@@ -75,7 +79,7 @@ jobs:
           echo "total=$TOTAL" >> $GITHUB_ENV
 
           # Report again and fail if under the threshold.
-          python -Im coverage report --fail-under=99
+          python -Im coverage report --fail-under=100
 
       - name: "Upload HTML report."
         uses: "actions/upload-artifact@v4"
@@ -104,10 +108,12 @@ jobs:
 
     steps:
       - uses: "actions/checkout@v4"
+        with:
+          persist-credentials: false
       - uses: "pdm-project/setup-pdm@v4"
         with:
           python-version: "3.12"
-          version: "2.19.2"
+          version: "2.21.0"
 
       - name: "Install check-wheel-content and twine"
         run: "python -m pip install twine check-wheel-contents"

.github/workflows/pypi-package.yml

@@ -10,10 +10,6 @@ on:
       - published
   workflow_dispatch:
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   build-package:
     name: Build & verify package
@@ -23,8 +19,9 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - uses: hynek/build-and-inspect-python-package@v1
+      - uses: hynek/build-and-inspect-python-package@v2
 
   # Upload to Test PyPI on every commit on main.
   release-test-pypi:
@@ -33,10 +30,12 @@ jobs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     needs: build-package
+    permissions:
+      id-token: write
 
     steps:
       - name: Download packages built by build-and-inspect-python-package
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: Packages
           path: dist
@@ -53,10 +52,12 @@ jobs:
     if: github.event.action == 'published'
     runs-on: ubuntu-latest
     needs: build-package
+    permissions:
+      id-token: write
 
     steps:
       - name: Download packages built by build-and-inspect-python-package
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: Packages
           path: dist

.github/workflows/zizmor.yml

@@ -0,0 +1,39 @@
+name: Zizmor
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["*"]
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: Zizmor latest via uv
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+      - name: Run zizmor 🌈
+        run: uvx zizmor --format sarif . > results.sarif
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          # Path to SARIF file relative to the root of the repository
+          sarif_file: results.sarif
+          # Optional category for the results
+          # Used to differentiate multiple results for one commit
+          category: zizmor

HISTORY.md

@@ -10,7 +10,7 @@ The third number is for emergencies when we need to start branches for older rel
 Our backwards-compatibility policy can be found [here](https://github.com/python-attrs/cattrs/blob/main/.github/SECURITY.md).
 
 
-## 24.2.0 (UNRELEASED)
+## 25.1.0 (UNRELEASED)
 
 - **Potentially breaking**: The converters raise {class}`StructureHandlerNotFoundError` more eagerly (on hook creation, instead of on hook use).
   This helps surfacing problems with missing hooks sooner.
@@ -20,16 +20,20 @@ Our backwards-compatibility policy can be found [here](https://github.com/python
   ([#577](https://github.com/python-attrs/cattrs/pull/577))
 - Expose {func}`cattrs.cols.mapping_unstructure_factory` through {mod}`cattrs.cols`.
 - Some `defaultdicts` are now [supported by default](https://catt.rs/en/latest/defaulthooks.html#defaultdicts), and
-  {func}`cattrs.cols.is_defaultdict`{func} and `cattrs.cols.defaultdict_structure_factory` are exposed through {mod}`cattrs.cols`.
+  {func}`cattrs.cols.is_defaultdict` and {func}`cattrs.cols.defaultdict_structure_factory` are exposed through {mod}`cattrs.cols`.
   ([#519](https://github.com/python-attrs/cattrs/issues/519) [#588](https://github.com/python-attrs/cattrs/pull/588))
+- Generic PEP 695 type aliases are now supported.
+  ([#611](https://github.com/python-attrs/cattrs/issues/611) [#618](https://github.com/python-attrs/cattrs/pull/618))
 - Many preconf converters (_bson_, stdlib JSON, _cbor2_, _msgpack_, _msgspec_, _orjson_, _ujson_) skip unstructuring `int` and `str` enums,
   leaving them to the underlying libraries to handle with greater efficiency.
   ([#598](https://github.com/python-attrs/cattrs/pull/598))
 - Literals containing enums are now unstructured properly, and their unstructuring is greatly optimized in the _bson_, stdlib JSON, _cbor2_, _msgpack_, _msgspec_, _orjson_ and _ujson_ preconf converters.
   ([#598](https://github.com/python-attrs/cattrs/pull/598))
 - Preconf converters now handle dictionaries with literal keys properly.
   ([#599](https://github.com/python-attrs/cattrs/pull/599))
-- Replace `cattrs.gen.MappingStructureFn` with `cattrs.SimpleStructureHook[In, T]`.
+- Structuring TypedDicts from invalid inputs now properly raises a {class}`ClassValidationError`.
+  ([#615](https://github.com/python-attrs/cattrs/issues/615) [#616](https://github.com/python-attrs/cattrs/pull/616))
+- Replace `cattrs.gen.MappingStructureFn` with {class}`cattrs.SimpleStructureHook`.
 - Python 3.13 is now supported.
   ([#543](https://github.com/python-attrs/cattrs/pull/543) [#547](https://github.com/python-attrs/cattrs/issues/547))
 - Python 3.8 is no longer supported, as it is end-of-life. Use previous versions on this Python version.

Makefile

@@ -48,7 +48,7 @@ clean-test: ## remove test and coverage artifacts
 	rm -fr htmlcov/
 
 lint: ## check style with ruff and black
-	pdm run ruff src/ tests bench
+	pdm run ruff check src/ tests bench
 	pdm run black --check src tests docs/conf.py
 
 test: ## run tests quickly with the default Python

docs/defaulthooks.md

@@ -333,7 +333,12 @@ Generic TypedDicts work on Python 3.11 and later, since that is the first Python
 
 [`typing.Required` and `typing.NotRequired`](https://peps.python.org/pep-0655/) are supported.
 
-[Similar to _attrs_ classes](customizing.md#using-cattrsgen-generators), un/structuring can be customized using {meth}`cattrs.gen.typeddicts.make_dict_structure_fn` and {meth}`cattrs.gen.typeddicts.make_dict_unstructure_fn`.
+:::{caution}
+If `from __future__ import annotations` is used or if annotations are given as strings, `Required` and `NotRequired` are ignored by cattrs.
+See [note in the Python documentation](https://docs.python.org/3/library/typing.html#typing.TypedDict.__optional_keys__).
+:::
+
+[Similar to _attrs_ classes](customizing.md#using-cattrsgen-hook-factories), un/structuring can be customized using {meth}`cattrs.gen.typeddicts.make_dict_structure_fn` and {meth}`cattrs.gen.typeddicts.make_dict_unstructure_fn`.
 
 ```{doctest}
 >>> from typing import TypedDict