tests are failing, because this depends on a new release of zope.security including zopefoundation/zope.security#115

The situation is like this:

• zope.proxy depends on zope.security , but only for the test. With these changes, zope.proxy tests only pass with the next version of zope.security
• zope.security depends on zope.proxy. zope.security with Respect PURE_PYTHON environment variable set to 0 zope.security#115 require these changes, otherwise it does not work when the environment variable PURE_PYTHON is set to 0.

The sequence of actions can be:

1. we merge these changes. For this we need to to pass, so I introduced a new commit to use zope.proxy from git ( a5a03e6 )
2. we make a new release of zope.proxy ( 6.1 ). At this point the tests from Respect PURE_PYTHON environment variable set to 0 zope.security#115 should pass
3. we revert a5a03e6
4. we change zope.security to depend on zope.proxy >= 6.1

Would that make sense ? can I proceed with merging this with the tox.ini change ?

If the choice is "make a release of package X, which is ready for release" and "grab package X from git to make this work" then I would always choose the first solution. Is there any reason not to just make a zope.security release?

If the choice is "make a release of package X, which is ready for release" and "grab package X from git to make this work" then I would always choose the first solution. Is there any reason not to just make a zope.security release?

zope.proxy release I mean? I am getting confused by these circular dependencies.

I would NOT add that git dependency in tox.ini and simply schedule releases of zope.proxy and zope.security at about the same time. No one cares if test fail during that small time window in between. If you need help merging PRs despite failing tests let me know.

Thank you @dataflake I did not consider this option, but it's much easier if we can merge the two pull requests regardless of the test status.

I dropped the tox change, so if we can "force" a merge with the current state, I think it's OK. I don't have the option to merge from github web interface, so if you can help it's highly welcome.

Let me know if you need me to make releases

Can you quickly check if the failures at https://github.com/zopefoundation/zope.proxy/actions/runs/11144585675/job/30972191668 and https://github.com/zopefoundation/zope.security/actions/runs/11144592221/job/30972210975 are expected or if there are other issues?

Thank you @dataflake yes these are the expected failures at this point, there does not seem to be more problems.

If you can make releases for these two packages it would repair the tests.

PS: I'm sorry this needed so much work from you guys, it seemed like a very small change when it started.

Everything looks good now, as the last step I am re-running the failed GHA run for zope.security on tag 7.3 hoping it will then upload the still-missing ARM64 wheels to PyPI. The tests are passing there now.

All wheels are now uploaded.

Thank you @dataflake