Update twisted requirement from >=25.5.0 to >=26.4.0rc2

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Updates the requirements on twisted to permit the latest version.

Release notes

Sourced from twisted's releases.

Twisted 26.4.0rc2 (2026-04-29)

This is the last release with support for Python 3.9.

Security

• twisted.names was fix for Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. Reported and fixed by Tomas Illuminati Balbin CVE-2026-42304 (#12626)

Features

• twisted.internet.ssl.CertificateOptions has a new constructor argument, contextForServerName, which takes a callback that will get invoked when a client sends a server name indication, with the sent servername, and returns a new OpenSSL.SSL.Context that the connection will switch to. (#4887)
• twisted.internet.endpoints.serverFromString now supports the tls endpoint type, which allows you to do twist web --listen=tls:.../certbot-dir/config/live pointed at a certbot live configuration directory and have your certbot certificates automatically discovered and served appropriately. (#9885)
• twisted.internet.reactor now has type annotations and will appear to be an object of an appropriate type, allowing for idiomatic common usages with correct type information. (#9909)
• twisted.conch.ssh.SSHUserAuthServer now supports the security key ssh types "sk-ecdsa-sha2-nistp256@openssh.com" and "sk-ssh-ed25519@openssh.com" and extracting the application property from these new key types. (#12212)

Bugfixes

• twisted.internet.mail will now return a meaningful Failure when TLS validation fails. (#10210)
• TLS version range constraints passed to twisted.internet.ssl.CertificateOptions are now properly respected rather than excluding the version being passed as the desired constraint. (#10232)
• A potential reference cycle that might cause intermittent memory spikes while using twisted.internet.defer.inlineCallbacks was removed. (#12120)
• Trial no longer emits the error RuntimeWarning: TestResult has no addDuration method when running PyUnit tests. (#12229)
• twisted.python.rebuild.rebuild() now handles changes to sys.modules gracefully. Prior to the change, it could possibly raise a "dictionary changed size during iteration" error if the module list changed. (#12458)
• twisted.internet.protocol.ReconnectingClientFactory: Don't multiply by factor for initial delay, but use initialDelay directly. (#12478)
• twisted.internet.ssl and twisted.protocols.tls no longer mutate the pyOpenSSL context after creating pyOpenSSL connections, maintaining compatibility with an upcoming version of pyOpenSSL and increasing reliability (possibly even fixing a very rare segfault) (#12500)
• twisted.internet.testing.MemoryReactor.callWhenRunning now invokes the callback immediately, if already started. (#12514)
• Twisted now correctly detects EOF on OpenSSL 4. (#12632)

Improved Documentation

• The example code from the documentation describing how to create a custom DNS server was updated to Python3. (#12480)
• Type annotations now use modern PEP 585 built-in generics and PEP 604 union syntax throughout the project. (#12556)

Deprecations and Removals

... (truncated)

Changelog

Sourced from twisted's changelog.

This file contains the release notes for Twisted.

It only contains high-level changes that are of interest to Twisted library users. Users of Twisted should check the notes before planning an upgrade.

Ticket numbers in this file can be looked up by visiting https://twisted.org/trac/ticket/

.. towncrier release notes start

Twisted 25.5.0 (2025-06-07)

This is the last release with support for Python 3.8. No changes since 25.5.0.rc1.

Bugfixes

• twisted.internet.runner.procmon.ProcessMonitor: startProcess() catches exceptions raised by reactor.spawnProcess() and attempts to restart the failed process. (#12421)

Deprecations and Removals

• twisted.trial.unittest.TestCase.deferSetUp, twisted.trial.unittest.TestCase.deferTestMethod, twisted.trial.unittest.TestCase.deferTearDown, and twisted.trial.unittest.TestCase.deferRunCleanups were removed and converted to private methods. These functions expose so much of the internal structure of TestCase that it makes the code hard to change. (#12388)
• twisted.internet.defer.waitForDeferred twisted.internet.defer.deferredGenerator have been removed. They have been deprecated since Twisted 15.0.0 (#12404)
• twisted.internet.defer.Deferred.callbacks attribute has been deprecated. (#12407)

Misc

• #12375, #12383, #12384, #12392, #12419, #12434, #12440, #12441

Conch

Bugfixes

- twisted.conch.client.direct.SSHClientTransport.verifyHostKey no longer crashes with an encoding error while attempting to verify the peer's IP address. This means that the `conch` command-line tool will no longer fail host key verification with 'bad host key' when using a known hosts file containing only plaintext, rather than hashed, hostnames. ([#12414](https://github.com/twisted/twisted/issues/12414))
Web
</tr></table>

... (truncated)

Commits

• b69a0c7 Update version.
• b32c661 Fix tag check.
• 819185e Fix mypy.
• 290cbf5 [pre-commit.ci] auto fixes from pre-commit.com hooks
• cb9783c Manual updates for release notes.
• ac504cc Prepare the rellease.
• 2d19612 Merge commit from fork
• 44c11c7 Merge branch 'trunk' into advisory-fix-1
• 9ca319e Update src/twisted/names/newsfragments/12626.bugfix
• 46f0e5c #12566 Revert the removal of assertEquals and assertNotEquals. (#12628)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Code Review: Dependabot Twisted Dependency Update

Overview

This PR bumps the minimum required version of Twisted from >=25.5.0 to >=26.4.0rc2 across all three requirements files (base.txt, local.txt, production.txt). The primary motivation is a security fix (CVE-2026-42304) for a DoS vulnerability in twisted.names.

---

Security Assessment ✅

The security fix is the main reason to accept this. Twisted 26.4.0rc2 patches:

CVE-2026-42304 — Denial of Service (DoS) via resource exhaustion during DNS name decompression in twisted.names.

Since the project uses Twisted indirectly (pinned by Snyk to avoid vulnerabilities), updating to include this patch is appropriate and consistent with the repo's stated purpose for these pins.

Other relevant improvements included in this release that affect OpenContracts' usage:

• Removal of a reference cycle in inlineCallbacks that could cause intermittent memory spikes — relevant given the async Celery/Channels workloads.
• Improved TLS reliability, including a rare segfault fix — relevant since base.txt pulls in Twisted[tls,http2].

---

Concerns

1. Release Candidate in Production (rc2) ⚠️

This is the primary concern. The version pinned is 26.4.0rc2, a pre-release. All three files — including production.txt — are updated to require this RC version.

Pinning >=26.4.0rc2 in production requirements means:

• If 26.4.0 final ships soon, pip will automatically resolve to the stable release (fine).
• If there are issues with rc2 that are fixed in the final release, any deployment that resolves rc2 will carry those bugs.

Recommendation: If there is urgency due to the CVE, accept this PR but plan to follow up with a bump to >=26.4.0 (stable) once it's released. If there is no immediate urgency, wait for the stable release before merging.

2. Pre-existing Inconsistency in Requirements Files (not introduced here)

The base.txt pins Twisted[tls,http2] (with extras) while local.txt and production.txt pin plain twisted (no extras). This inconsistency predates this PR, but it means the TLS/HTTP2 extras are not explicitly requested in local or production environments — they would only be pulled transitively if another package requests them. Worth tracking but out of scope for this PR.

3. Python 3.9 End-of-Life Notice

The 26.4.0 release notes explicitly state:

"This is the last release with support for Python 3.9."

If the project supports Python 3.9, a future Twisted upgrade after this one will drop that support. Worth noting in planning.

---

Verdict

Accept with awareness of the RC status. The CVE fix justifies accepting this update. The RC-in-production concern is real but low-risk given that rc2 is typically very close to the final release, and pip will auto-upgrade to stable once 26.4.0 is published. If auto-merge is set up, this is a reasonable candidate for it.

No code changes are required — this is a minimal, targeted dependency bump consistent with the project's Snyk-pinning pattern.