v2.4.2

Note

A large collection of maintenance updates and fixes.
Thanks to all who helped improving the repo these times!

Summary:

Core focus:

1. modernising the developer setup
2. important version updates
3. bug fixes in path renderings

What's Changed

• refactor: improve type hints of pypiserver/__main__.py by @waketzheng in #692
• refactor: fix mypy complaints for pypiserver/manage.py by @waketzheng in #693
• refactor: add missing type hints for bin/bumpver.py by @waketzheng in #665
• ci: bump up checkout/python actions to v6 by @waketzheng in #695
• chore: Bump gunicorn from 20.0.4 to 22.0.0 in /docker by @dependabot[bot] in #696
• maint: support uv for development and project configuration management by @dee-me-tree-or-love in #687
• chore: remove eclipse project configs by @dee-me-tree-or-love in #697
• feat: migrate from isort+black to ruff by @waketzheng in #666
• chore: Bump idna from 3.11 to 3.15 by @dependabot[bot] in #700
• chore: Bump urllib3 from 2.6.3 to 2.7.0 by @dependabot[bot] in #701
• chore: Bump pip from 26.0.1 to 26.1 by @dependabot[bot] in #702
• docs: clarify Dockerfile CMD/ENTRYPOINT arg parsing for -P and friends by @mvanhorn in #699
• chore: Bump pytest from 9.0.2 to 9.0.3 by @dependabot[bot] in #709
• chore: Bump requests from 2.32.5 to 2.33.0 by @dependabot[bot] in #708
• chore: Bump pygments from 2.19.2 to 2.20.0 by @dependabot[bot] in #707
• chore: Bump webob from 1.8.9 to 1.8.10 by @dependabot[bot] in #706
• chore: Bump cryptography from 46.0.5 to 46.0.7 by @dependabot[bot] in #710
• fix: harden /RPC2 XML parser against entity-expansion DoS (#685) by @gistrec in #704
• chore: Bump cryptography from 46.0.7 to 48.0.1 by @dependabot[bot] in #712
• chore: Bump cryptography from 48.0.1 to 50.0.0 by @dependabot[bot] in #721
• chore: Bump webob from 1.8.10 to 1.8.11 by @dependabot[bot] in #727
• chore: Bump pip from 26.1 to 26.2 by @dependabot[bot] in #729
• chore: Bump soupsieve from 2.8.3 to 2.9 by @dependabot[bot] in #730
• chore: Bump anyio from 4.12.1 to 4.14.2 by @dependabot[bot] in #731
• fix: preserve proxy prefixes in normalization redirects by @Neallin-917 in #725
• Fix /:project/json download URLs escaping the base URL prefix by @niukanen1 in #732
• chore(auto-release-candidate-2026-09-20) by @github-actions[bot] in #733

New Contributors

• @mvanhorn made their first contribution in #699
• @gistrec made their first contribution in #704
• @Neallin-917 made their first contribution in #725 (a renewed version of #719 by @neallin917)
• @niukanen1 made their first contribution in #732

Full Changelog: v2.4.1...v2.4.2