openstack/zaqar — Week of 2026-09-26

Security fixes. The headline work is a fix for an authentication bypass triggered by an empty URL-Signature header, landed on master and backported across five stable branches, with matching test cases added on each branch to lock the behavior down. That's six code fixes plus five new test cases guarding the same class of empty-header input.

Benchmark and CORS surface. The zaqar-bench tool got meaningful attention: a new job to actually run it in CI, a requirement that server_url be a valid URL, config-file persistence for server_url, dependency maintenance, and a functional-test skip for the tooling change. On the API side, overridden CORS middleware defaults are now exposed, and default SNMP host/port values were added for the notification driver.

Packaging and dependency cleanup. Setup configuration migrated to pyproject.toml (~200 lines shuffled), gevent was replaced and its pre-1.1.0 workaround removed, marktime was dropped, stale oslo.messaging options were deleted, and test installs now use extras for optional dependencies. A type-mismatch fix and a couple of small doc touch-ups round out the week.