• Dropped support for Python 2.7, PyPy 2, and Python 3.5.
• Added support for the Python 3.10 match/case syntax.
• Data collection is now thread-safe. There may have been rare instances of exceptions raised in multi-threaded programs.
• Plugins (like the Django coverage plugin) were generating “Already imported a file that will be measured” warnings about Django itself. These have been fixed, closing issue 1150.
• Warnings generated by coverage.py are now real Python warnings.
• Using --fail-under=100 with coverage near 100% could result in the self-contradictory message total of 100 is less than fail-under=100. This bug (issue 1168) is now fixed.
• The COVERAGE_DEBUG_FILE environment variable now accepts stdout and stderr to write to those destinations.
• TOML parsing now uses the tomli library.
• Some minor changes to usually invisible details of the HTML report:
  • Use a modern hash algorithm when fingerprinting, for high-security environments (issue 1189). When generating the HTML report, we save the hash of the data, to avoid regenerating an unchanged HTML page. We used to use MD5 to generate the hash, and now use SHA-3-256. This was never a security concern, but security scanners would notice the MD5 algorithm and raise a false alarm.
  • Change how report file names are generated, to avoid leading underscores (issue 1167), to avoid rare file name collisions (issue 584), and to avoid file names becoming too long (issue 580).