[dependabot]

Bumps pypa/cibuildwheel from 4.2.1 to 4.3.4.

Release notes

Sourced from pypa/cibuildwheel's releases.

v4.3.4

• 🔐 Warns when a uv build frontend is selected and the host uv is older than 0.13.4, which still trusts the compromised eMudhra CA roots (#3021)
• 🔐 Uses cibuildwheel's CA bundle for pip on Python 3.9, where pip uses its bundled certifi, which still trusts the compromised eMudhra roots (#3017)
• 🔐 Uses cibuildwheel's CA bundle for pip on GraalPy, where truststore is not supported (#3019)
• 🔐 Uses cibuildwheel's CA bundle in Android, iOS, and Pyodide cross venvs, where pip uses the host's OpenSSL CA file (#3020)
• 🐛 Seeds build's isolated environment with the pinned pip on macOS and Windows, fixing GraalPy 25.0 builds (#3018)
• 💼 Stops Azure cache growth from restoreKeys (#3022)

v4.3.3

• 🔐 Updates manylinux images and pip to fix vulnerability to eMudhra.

v4.3.2

• 🔐 Updates our dependency pins to certifi==2026.10.19, following the eMudhra Intermediate CA Compromise. Linux builds may still be vulnerable through manylinux images - a patch release will soon follow if so.

v4.3.1

• 🛠 Updates CPython 3.15 to the final 3.15.0 release (#3009)

v4.3.0

• ✨ Extends option inheritance to every configuration layer, so global and platform-specific settings can append or prepend to existing values, including cibuildwheel's defaults. Environment variables can also extend earlier settings using CIBW_INHERIT. (#2928)
• ✨ Adds PyPy 3.12 support and updates PyPy 3.11 to v8.0.0, available with the pypy enable flag (#2998)
• ✨ Adds GraalPy 3.13 (v25.3) support on Linux, Windows, and macOS arm64, available with the graalpy enable flag (#2982)
• ✨ Adds log-fold-mode to override CI log folding, including CIBW_LOG_FOLD_MODE=disabled to keep build steps expanded (#2972)
• ✨ Adds a python-path input to the GitHub Action to choose the Python interpreter used to run cibuildwheel, and falls back to system python3 on runner architectures unsupported by setup-python, such as native riscv64 (#2990)
• 🐛 Fixes Windows command execution when paths or arguments contain shell metacharacters, including dependency specifiers containing < or > (#2978)
• 🛠 Improves readability of logged commands whose arguments contain quotes (#2993)
• 🛠 Updates Pyodide to 0.27.8, 0.29.5, and 314.0.7, and updates its build tooling, including auditwheel-emscripten 0.3.0 (#2996)
• 🛠 Updates dependencies and container pins, including CPython 3.15.0rc3 (#2986, #3003)
• 📚 Corrects references to --archs in CLI help, error messages, and documentation (#2992)

Changelog

Sourced from pypa/cibuildwheel's changelog.

v4.3.4

22 October 2026

• 🔐 Warns when a uv build frontend is selected and the host uv is older than 0.13.4, which still trusts the compromised eMudhra CA roots (#3021)
• 🔐 Uses cibuildwheel's CA bundle for pip on Python 3.9, where pip uses its bundled certifi, which still trusts the compromised eMudhra roots (#3017)
• 🔐 Uses cibuildwheel's CA bundle for pip on GraalPy, where truststore is not supported (#3019)
• 🔐 Uses cibuildwheel's CA bundle in Android, iOS, and Pyodide cross venvs, where pip uses the host's OpenSSL CA file (#3020)
• 🐛 Seeds build's isolated environment with the pinned pip on macOS and Windows, fixing GraalPy 25.0 builds (#3018)
• 💼 Stops Azure cache growth from restoreKeys (#3022)

v4.3.3

21 October 2026

• 🔐 Updates manylinux images and pip to fix vulnerability to eMudhra.

v4.3.2

20 October 2026

• 🔐 Updates our dependency pins to certifi==2026.10.19, following the eMudhra Intermediate CA Compromise. Linux builds may still be vulnerable through manylinux images - a patch release will soon follow if so.

v4.3.1

10 October 2026

• 🛠 Updates CPython 3.15 to the final 3.15.0 release (#3009)

v4.3.0

5 October 2026

• ✨ Extends option inheritance to every configuration layer, so global and platform-specific settings can append or prepend to existing values, including cibuildwheel's defaults. Environment variables can also extend earlier settings using CIBW_INHERIT. (#2928)
• ✨ Adds PyPy 3.12 support and updates PyPy 3.11 to v8.0.0, available with the pypy enable flag (#2998)
• ✨ Adds GraalPy 3.13 (v25.3) support on Linux, Windows, and macOS arm64, available with the graalpy enable flag (#2982)
• ✨ Adds log-fold-mode to override CI log folding, including CIBW_LOG_FOLD_MODE=disabled to keep build steps expanded (#2972)
• ✨ Adds a python-path input to the GitHub Action to choose the Python interpreter used to run cibuildwheel, and falls back to system python3 on runner architectures unsupported by setup-python, such as native riscv64 (#2990)
• 🐛 Fixes Windows command execution when paths or arguments contain shell metacharacters, including dependency specifiers containing < or > (#2978)
• 🛠 Improves readability of logged commands whose arguments contain quotes (#2993)
• 🛠 Updates Pyodide to 0.27.8, 0.29.5, and 314.0.7, and updates its build tooling, including auditwheel-emscripten 0.3.0 (#2996)
• 🛠 Updates dependencies and container pins, including CPython 3.15.0rc3 (#2986, #3003)
• 📚 Corrects references to --archs in CLI help, error messages, and documentation (#2992)

Commits

• b9e566a Bump version: v4.3.4
• 0d511ac fix: use cibuildwheel's CA bundle in cross venvs (#3020)
• d6c9b11 feat: warn when uv is too old to have the eMudhra CA fix (#3021)
• 4463120 fix: seed build's isolated env with the pinned pip (#3018)
• 6d4911a fix: use cibuildwheel's CA bundle for pip on GraalPy (#3019)
• 54d1a6f ci: stop Azure cache growth from restoreKeys (#3022)
• 5891574 fix: use cibuildwheel's CA bundle for pip on Python 3.9 (#3017)
• 8c2dcd2 Bump version: v4.3.3
• 56459e6 [Bot] Update dependencies (#3012)
• afd09e6 chore(deps): bump the actions group with 4 updates (#3013)
• Additional commits viewable in compare view

[github-actions]

Performance

Gates are checked separately and fail the job. The figures below are advisory: a shared runner cannot hold an absolute nanosecond still, so the column that matters is the ratio to bare emulation measured in the same run.

End to end

workload	bare	+ hooked	+ taint	x bare
bench_dense	10.3 ns	45.7 ns	122.0 ns	11.84x
bench_sparse	9.2 ns	32.9 ns	68.5 ns	7.47x
bench_untainted	7.8 ns	31.7 ns	64.9 ns	8.28x

Throughput

• reusing one process: 27.9 exec/s
• a fresh process each: 2.1 exec/s
• per-execution setup: 434 ms

Per instruction (compiled path)

ISA	p50	p100	fallback p50
AMD64	4.62 ns	120.96 ns	186 us
AMD64_SIMD	2.51 ns	117.11 ns	-
ARM64	3.12 ns	70.48 ns	-
ARM64_SIMD	5.89 ns	19.62 ns	-
MIPS64BE	2.50 ns	44.28 ns	-
PPC32BE	3.21 ns	45.54 ns	-
RISCV64	2.48 ns	4.03 ns	-

Primitives (pure C)

block hook 0.3 ns / code hook 10.16 ns / code hook + 8B mem read 42.04 ns / code hook + N reg reads 36.04 ns / code hook + counter 10.17 ns / no hook 0.24 ns

Against the baseline

No baseline cached yet; this run records one for master.

[toby-bro]

@dependabot rebase

[github-actions]

Performance

Gates are checked separately and fail the job. The figures below are advisory: a shared runner cannot hold an absolute nanosecond still, so the column that matters is the ratio to bare emulation measured in the same run.

End to end

workload	bare	+ hooked	+ taint	x bare
bench_dense	9.8 ns	41.8 ns	114.4 ns	11.70x
bench_sparse	12.5 ns	31.4 ns	63.6 ns	5.09x
bench_untainted	7.9 ns	30.8 ns	60.9 ns	7.69x

Throughput

• reusing one process: 28.0 exec/s
• a fresh process each: 2.1 exec/s
• per-execution setup: 443 ms

Per instruction (compiled path)

ISA	p50	p100	fallback p50
AMD64	4.90 ns	96.44 ns	237 us
AMD64_SIMD	5.23 ns	127.56 ns	-
ARM64	3.45 ns	58.19 ns	-
ARM64_SIMD	6.67 ns	22.02 ns	-
MIPS64BE	2.81 ns	35.98 ns	-
PPC32BE	3.61 ns	35.61 ns	-
RISCV64	2.67 ns	4.72 ns	-

Primitives (pure C)

block hook 0.33 ns / code hook 11.18 ns / code hook + 8B mem read 43.18 ns / code hook + N reg reads 38.39 ns / code hook + counter 11.17 ns / no hook 0.28 ns

Against the baseline

• ⚪ bench_dense end-to-end: 11.10x -> 11.70x (+5.4%)
• 🟢 bench_sparse end-to-end: 7.69x -> 5.09x (-33.8%)
• ⚪ bench_untainted end-to-end: 7.84x -> 7.69x (-1.9%)
• ⚪ AMD64 p50: 4.65 ns -> 4.90 ns (+5.5%)
• 🔴 AMD64_SIMD p50: 2.51 ns -> 5.23 ns (+108.5%)
• 🔴 ARM64 p50: 3.12 ns -> 3.45 ns (+10.6%)
• 🔴 ARM64_SIMD p50: 5.90 ns -> 6.67 ns (+13.0%)
• 🔴 MIPS64BE p50: 2.50 ns -> 2.81 ns (+12.5%)
• 🔴 PPC32BE p50: 3.20 ns -> 3.61 ns (+12.7%)
• ⚪ RISCV64 p50: 2.49 ns -> 2.67 ns (+7.3%)