Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Bump the pip group across 9 directories with 12 updates#195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
dependabot wants to merge1 commit intomain
base:main
Choose a base branch
Loading
fromdependabot/pip/2017/quals/2017-misc-mindreader/app/pip-b14dfc3e68

Conversation

@dependabot
Copy link
Contributor

@dependabotdependabotbot commented on behalf ofgithubDec 23, 2024

Bumps the pip group with 2 updates in the /2017/quals/2017-misc-mindreader/app directory:gunicorn andflask.
Bumps the pip group with 1 update in the /2018/finals/web-mitigator/app directory:flask.
Bumps the pip group with 2 updates in the /2019/finals/misc-stuffed-finals/app directory:gunicorn andflask.
Bumps the pip group with 3 updates in the /2019/finals/web-gphotos-finals/app directory:gunicorn,django andsqlparse.
Bumps the pip group with 2 updates in the /2020/quals/web-littlethings-fixed/exploit directory:flask andrequests.
Bumps the pip group with 2 updates in the /2020/quals/web-littlethings/exploit directory:flask andrequests.
Bumps the pip group with 2 updates in the /2022/hackceler8/game directory:pillow andprotobuf.
Bumps the pip group with 2 updates in the /2022/quals/web-log4j/server directory:gunicorn andflask.
Bumps the pip group with 8 updates in the /2023/quals/web-under-construction/challenge/flask directory:

PackageFromTo
gunicorn20.1.022.0.0
flask2.2.32.2.5
gevent22.10.223.9.0
requests2.29.02.32.2
jinja23.1.23.1.5
werkzeug2.2.33.0.6
pymysql1.0.31.1.1
cryptography41.0.444.0.0

Updatesgunicorn from 19.7.1 to 22.0.0

Release notes

Sourced fromgunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17===================
  • useutime to notify workers liveness
  • migrate setup to pyproject.toml
  • fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
  • parsing additional requests is no longer attempted past unsupported request framing
  • on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
  • requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
  • Trailer fields are no longer inspected for headers indicating secure scheme
  • support Python 3.12

** Breaking changes **

  • minimum version is Python 3.7
  • the limitations on valid characters in the HTTP method have been bounded to Internet Standards
  • requests specifying unsupported transfer coding (order) are refused by default (rare)
  • HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
  • HTTP methods containing the number sign (#) are no longer accepted by default (rare)
  • HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
  • HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
  • HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
  • HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
  • requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
  • empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)

** SECURITY **

  • fix CVE-2024-1135
  1. Documentation is available there:https://docs.gunicorn.org/en/stable/news.html
  2. Packages:https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023-07-19===================fix thread worker: revert change considering connection as idle .</tr></table>

... (truncated)

Commits
  • f63d59e bump to 22.0
  • 4ac81e0 Merge pull request#3175 from e-kwsm/typo
  • 401cecf Merge pull request#3179 from dhdaines/exclude-eventlet-0360
  • 0243ec3 fix(deps): exclude eventlet 0.36.0
  • 628a0bc chore: fix typos
  • 88fc4a4 Merge pull request#3131 from pajod/patch-py12-rebased
  • deae2fc CI: back off the agressive timeout
  • f470382 docs: promise 3.12 compat
  • 5e30bfa add changelog to project.urls (updated for PEP621)
  • 481c3f9 remove setup.cfg - overridden by pyproject.toml
  • Additional commits viewable incompare view

Updatesflask from 2.2.5 to 3.1.0

Release notes

Sourced fromflask's releases.

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such aspip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI:https://pypi.org/project/Flask/3.1.0/Changes:https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0Milestone:https://github.com/pallets/flask/milestone/33?closed=1

  • Drop support for Python 3.8.#5623
  • Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9.#5624,#5633
  • Provide a configuration option to control automatic option responses.#5496
  • Flask.open_resource/open_instance_resource andBlueprint.open_resource take anencoding parameter to use when opening in text mode. It defaults toutf-8.#5504
  • Request.max_content_length can be customized per-request instead of only through theMAX_CONTENT_LENGTH config. AddedMAX_FORM_MEMORY_SIZE andMAX_FORM_PARTS config. Added documentation about resource limits to the security page.#5625
  • Add support for thePartitioned cookie attribute (CHIPS), with theSESSION_COOKIE_PARTITIONED config.#5472
  • -e path takes precedence over default.env and.flaskenv files.load_dotenv loads default files in addition to a path unlessload_defaults=False is passed.#5628
  • Support key rotation with theSECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support.#5621
  • Fix how settinghost_matching=True orsubdomain_matching=False interacts withSERVER_NAME. SettingSERVER_NAME no longer restricts requests to only that domain.#5553
  • Request.trusted_hosts is checked during routing, and can be set through theTRUSTED_HOSTS config.#5636

3.0.3

This is a fix release for the 3.0.x feature branch.

PyPI:https://pypi.org/project/Flask/3.0.3/Changes:https://flask.palletsprojects.com/en/3.0.x/changes/#version-3-0-3Milestone:https://github.com/pallets/flask/milestone/35?closed=1

  • The defaulthashlib.sha1 may not be available in FIPS builds. Don't access it at import time so the developer has time to change the default.#5448
  • Don't initialize thecli attribute in the sansio scaffold, but rather in theFlask concrete class.#5270

3.0.2

This is a fix release for the 3.0.x feature release branch. It fixes bugs but does not otherwise change behavior and should not result in breaking changes.

3.0.1

This is a fix release for the 3.0.x feature release branch.

Fixes an issue where using other JSON providers, such asflask-orjson, previously caused loaded session data to have an incorrect format in some cases.

3.0.0

This is a feature release, which includes new features, removes previously deprecated code, and adds new deprecations. The 3.0.x branch is now the supported fix branch, the 2.3.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such aspip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

... (truncated)

Changelog

Sourced fromflask's changelog.

Version 3.1.0

Released 2024-11-13

  • Drop support for Python 3.8. :pr:5623
  • Update minimum dependency versions to latest feature releases.Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633
  • Provide a configuration option to control automatic optionresponses. :pr:5496
  • Flask.open_resource/open_instance_resource andBlueprint.open_resource take anencoding parameter to use whenopening in text mode. It defaults toutf-8. :issue:5504
  • Request.max_content_length can be customized per-request instead of onlythrough theMAX_CONTENT_LENGTH config. AddedMAX_FORM_MEMORY_SIZE andMAX_FORM_PARTS config. Added documentationabout resource limits to the security page. :issue:5625
  • Add support for thePartitioned cookie attribute (CHIPS), with theSESSION_COOKIE_PARTITIONED config. :issue:5472
  • -e path takes precedence over default.env and.flaskenv files.load_dotenv loads default files in addition to a path unlessload_defaults=False is passed. :issue:5628
  • Support key rotation with theSECRET_KEY_FALLBACKS config, a list of oldsecret keys that can still be used for unsigning. Extensions will need toadd support. :issue:5621
  • Fix how settinghost_matching=True orsubdomain_matching=Falseinteracts withSERVER_NAME. SettingSERVER_NAME no longer restrictsrequests to only that domain. :issue:5553
  • Request.trusted_hosts is checked during routing, and can be set throughtheTRUSTED_HOSTS config. :issue:5636

Version 3.0.3

Released 2024-04-07

  • The defaulthashlib.sha1 may not be available in FIPS builds. Don'taccess it at import time so the developer has time to change the default.:issue:5448
  • Don't initialize thecli attribute in the sansio scaffold, but rather intheFlask concrete class. :pr:5270

Version 3.0.2

Released 2024-02-03

  • Correct type forjinja_loader property. :issue:5388

... (truncated)

Commits
  • ab81496 release version 3.1.0
  • 70602a1 remove test pypi
  • 6748a09 update dev dependencies
  • 22c48a7 Merge remote-tracking branch 'origin/stable'
  • 2eab96a use generic bases for session (#5638)
  • f49dbfd use generic bases for session
  • 7b21d43 configure and checkrequest.trusted_hosts (#5637)
  • 4f7156f configure and check trusted_hosts
  • 10bdf61 settingSERVER_NAME does not restrict routing for bothsubdomain_matching...
  • 4995a77 fix subdomain_matching=False behavior
  • Additional commits viewable incompare view

Updatesflask from 1.0.2 to 2.2.5

Release notes

Sourced fromflask's releases.

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such aspip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI:https://pypi.org/project/Flask/3.1.0/Changes:https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0Milestone:https://github.com/pallets/flask/milestone/33?closed=1

  • Drop support for Python 3.8.#5623
  • Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9.#5624,#5633
  • Provide a configuration option to control automatic option responses.#5496
  • Flask.open_resource/open_instance_resource andBlueprint.open_resource take anencoding parameter to use when opening in text mode. It defaults toutf-8.#5504
  • Request.max_content_length can be customized per-request instead of only through theMAX_CONTENT_LENGTH config. AddedMAX_FORM_MEMORY_SIZE andMAX_FORM_PARTS config. Added documentation about resource limits to the security page.#5625
  • Add support for thePartitioned cookie attribute (CHIPS), with theSESSION_COOKIE_PARTITIONED config.#5472
  • -e path takes precedence over default.env and.flaskenv files.load_dotenv loads default files in addition to a path unlessload_defaults=False is passed.#5628
  • Support key rotation with theSECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support.#5621
  • Fix how settinghost_matching=True orsubdomain_matching=False interacts withSERVER_NAME. SettingSERVER_NAME no longer restricts requests to only that domain.#5553
  • Request.trusted_hosts is checked during routing, and can be set through theTRUSTED_HOSTS config.#5636

3.0.3

This is a fix release for the 3.0.x feature branch.

PyPI:https://pypi.org/project/Flask/3.0.3/Changes:https://flask.palletsprojects.com/en/3.0.x/changes/#version-3-0-3Milestone:https://github.com/pallets/flask/milestone/35?closed=1

  • The defaulthashlib.sha1 may not be available in FIPS builds. Don't access it at import time so the developer has time to change the default.#5448
  • Don't initialize thecli attribute in the sansio scaffold, but rather in theFlask concrete class.#5270

3.0.2

This is a fix release for the 3.0.x feature release branch. It fixes bugs but does not otherwise change behavior and should not result in breaking changes.

3.0.1

This is a fix release for the 3.0.x feature release branch.

Fixes an issue where using other JSON providers, such asflask-orjson, previously caused loaded session data to have an incorrect format in some cases.

3.0.0

This is a feature release, which includes new features, removes previously deprecated code, and adds new deprecations. The 3.0.x branch is now the supported fix branch, the 2.3.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such aspip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

... (truncated)

Changelog

Sourced fromflask's changelog.

Version 3.1.0

Released 2024-11-13

  • Drop support for Python 3.8. :pr:5623
  • Update minimum dependency versions to latest feature releases.Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633
  • Provide a configuration option to control automatic optionresponses. :pr:5496
  • Flask.open_resource/open_instance_resource andBlueprint.open_resource take anencoding parameter to use whenopening in text mode. It defaults toutf-8. :issue:5504
  • Request.max_content_length can be customized per-request instead of onlythrough theMAX_CONTENT_LENGTH config. AddedMAX_FORM_MEMORY_SIZE andMAX_FORM_PARTS config. Added documentationabout resource limits to the security page. :issue:5625
  • Add support for thePartitioned cookie attribute (CHIPS), with theSESSION_COOKIE_PARTITIONED config. :issue:5472
  • -e path takes precedence over default.env and.flaskenv files.load_dotenv loads default files in addition to a path unlessload_defaults=False is passed. :issue:5628
  • Support key rotation with theSECRET_KEY_FALLBACKS config, a list of oldsecret keys that can still be used for unsigning. Extensions will need toadd support. :issue:5621
  • Fix how settinghost_matching=True orsubdomain_matching=Falseinteracts withSERVER_NAME. SettingSERVER_NAME no longer restrictsrequests to only that domain. :issue:5553
  • Request.trusted_hosts is checked during routing, and can be set throughtheTRUSTED_HOSTS config. :issue:5636

Version 3.0.3

Released 2024-04-07

  • The defaulthashlib.sha1 may not be available in FIPS builds. Don'taccess it at import time so the developer has time to change the default.:issue:5448
  • Don't initialize thecli attribute in the sansio scaffold, but rather intheFlask concrete class. :pr:5270

Version 3.0.2

Released 2024-02-03

  • Correct type forjinja_loader property. :issue:5388

... (truncated)

Commits
  • ab81496 release version 3.1.0
  • 70602a1 remove test pypi
  • 6748a09 update dev dependencies
  • 22c48a7 Merge remote-tracking branch 'origin/stable'
  • 2eab96a use generic bases for session (#5638)
  • f49dbfd use generic bases for session
  • 7b21d43 configure and checkrequest.trusted_hosts (#5637)
  • 4f7156f configure and check trusted_hosts
  • 10bdf61 settingSERVER_NAME does not restrict routing for bothsubdomain_matching...
  • 4995a77 fix subdomain_matching=False behavior
  • Additional commits viewable incompare view

Updatesgunicorn from 19.9.0 to 22.0.0

Release notes

Sourced fromgunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17===================
  • useutime to notify workers liveness
  • migrate setup to pyproject.toml
  • fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
  • parsing additional requests is no longer attempted past unsupported request framing
  • on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
  • requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
  • Trailer fields are no longer inspected for headers indicating secure scheme
  • support Python 3.12

** Breaking changes **

  • minimum version is Python 3.7
  • the limitations on valid characters in the HTTP method have been bounded to Internet Standards
  • requests specifying unsupported transfer coding (order) are refused by default (rare)
  • HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
  • HTTP methods containing the number sign (#) are no longer accepted by default (rare)
  • HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
  • HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
  • HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
  • HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
  • requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
  • empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)

** SECURITY **

  • fix CVE-2024-1135
  1. Documentation is available there:https://docs.gunicorn.org/en/stable/news.html
  2. Packages:https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023-07-19===================fix thread worker: revert change considering connection as idle .</tr></table>

... (truncated)

Commits
  • f63d59e bump to 22.0
  • 4ac81e0 Merge pull request#3175 from e-kwsm/typo
  • 401cecf Merge pull request#3179 from dhdaines/exclude-eventlet-0360
  • 0243ec3 fix(deps): exclude eventlet 0.36.0
  • 628a0bc chore: fix typos
  • 88fc4a4 Merge pull request#3131 from pajod/patch-py12-rebased
  • deae2fc CI: back off the agressive timeout
  • f470382 docs: promise 3.12 compat
  • 5e30bfa add changelog to project.urls (updated for PEP621)
  • 481c3f9 remove setup.cfg - overridden by pyproject.toml
  • Additional commits viewable incompare view

Updatesflask from 1.0.2 to 2.2.5

Release notes

Sourced fromflask's releases.

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such aspip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI:https://pypi.org/project/Flask/3.1.0/Changes:https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0Milestone:https://github.com/pallets/flask/milestone/33?closed=1

  • Drop support for Python 3.8.#5623
  • Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9.#5624,#5633
  • Provide a configuration option to control automatic option responses.#5496
  • Flask.open_resource/open_instance_resource andBlueprint.open_resource take anencoding parameter to use when opening in text mode. It defaults toutf-8.#5504
  • Request.max_content_length can be customized per-request instead of only through theMAX_CONTENT_LENGTH config. AddedMAX_FORM_MEMORY_SIZE andMAX_FORM_PARTS config. Added documentation about resource limits to the security page.#5625
  • Add support for thePartitioned cookie attribute (CHIPS), with theSESSION_COOKIE_PARTITIONED config.#5472
  • -e path takes precedence over default.env and.flaskenv files.load_dotenv loads default files in addition to a path unlessload_defaults=False is passed.#5628
  • Support key rotation with theSECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support.#5621
  • Fix how settinghost_matching=True orsubdomain_matching=False interacts withSERVER_NAME. SettingSERVER_NAME no longer restricts requests to only that domain.#5553
  • Request.trusted_hosts is checked during routing, and can be set through theTRUSTED_HOSTS config.#5636

3.0.3

This is a fix release for the 3.0.x feature branch.

PyPI:https://pypi.org/project/Flask/3.0.3/Changes:https://flask.palletsprojects.com/en/3.0.x/changes/#version-3-0-3Milestone:https://github.com/pallets/flask/milestone/35?closed=1

  • The defaulthashlib.sha1 may not be available in FIPS builds. Don't access it at import time so the developer has time to change the default.#5448
  • Don't initialize thecli attribute in the sansio scaffold, but rather in theFlask concrete class.#5270

3.0.2

This is a fix release for the 3.0.x feature release branch. It fixes bugs but does not otherwise change behavior and should not result in breaking changes.

3.0.1

This is a fix release for the 3.0.x feature release branch.

Fixes an issue where using other JSON providers, such asflask-orjson, previously caused loaded session data to have an incorrect format in some cases.

3.0.0

This is a feature release, which includes new features, removes previously deprecated code, and adds new deprecations. The 3.0.x branch is now the supported fix branch, the 2.3.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such aspip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

... (truncated)

Changelog

Sourced fromflask's changelog.

Version 3.1.0

Released 2024-11-13

  • Drop support for Python 3.8. :pr:5623
  • Update minimum dependency versions to latest feature releases.Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633
  • Provide a configuration option to control automatic optionresponses. :pr:5496
  • Flask.open_resource/open_instance_resource andBlueprint.open_resource take anencoding parameter to use whenopening in text mode. It defaults toutf-8. :issue:5504
  • Request.max_content_length can be customized per-request instead of onlythrough theMAX_CONTENT_LENGTH config. AddedMAX_FORM_MEMORY_SIZE andMAX_FORM_PARTS config. Added documentationabout resource limits to the security page. :issue:5625
  • Add support for thePartitioned cookie attribute (CHIPS), with theSESSION_COOKIE_PARTITIONED config. :issue:5472
  • -e path takes precedence over default.env and.flaskenv files.load_dotenv loads default files in addition to a path unlessload_defaults=False is passed. :issue:5628
  • Support key rotation with theSECRET_KEY_FALLBACKS config, a list of oldsecret keys that can still be used for unsigning. Extensions will need toadd support. :issue:5621
  • Fix how settinghost_matching=True orsubdomain_matching=Falseinteracts withSERVER_NAME. SettingSERVER_NAME no longer restrictsrequests to only that domain. :issue:5553
  • Request.trusted_hosts is checked during routing, and can be set throughtheTRUSTED_HOSTS config. :issue:5636

Version 3.0.3

Released 2024-04-07

  • The defaulthashlib.sha1 may not be available in FIPS builds. Don'taccess it at import time so the developer has time to change the default.:issue:5448
  • Don't initialize thecli attribute in the sansio scaffold, but rather intheFlask concrete class. :pr:5270

Version 3.0.2

Released 2024-02-03

  • Correct type forjinja_loader property. :issue:5388

... (truncated)

Commits
  • ab81496 release version 3.1.0
  • 70602a1 remove test pypi
  • 6748a09 update dev dependencies
  • 22c48a7 Merge remote-tracking branch 'origin/stable'
  • 2eab96a use generic bases for session (#5638)
  • f49dbfd use generic bases for session
  • 7b21d43 configure and checkrequest.trusted_hosts (#5637)
  • 4f7156f configure and check trusted_hosts
  • 10bdf61 settingSERVER_NAME does not restrict routing for bothsubdomain_matching...
  • 4995a77 fix subdomain_matching=False behavior
  • Additional commits viewable incompare view

Updatesgunicorn from 19.9.0 to 22.0.0

Release notes

Sourced fromgunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17===================
  • useutime to notify workers liveness
  • migrate setup to pyproject.toml
  • fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
  • parsing additional requests is no longer attempted past unsupported request framing
  • on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
  • requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
  • Trailer fields are no longer inspected for headers indicating secure scheme
  • support Python 3.12

** Breaking changes **

  • minimum version is Python 3.7
  • the limitations on valid characters in the HTTP method have been bounded to Internet Standards
  • requests specifying unsupported transfer coding (order) are refused by default (rare)
  • HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
  • HTTP methods containing the number sign (#) are no longer accepted by default (rare)
  • HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
  • HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
  • HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
  • HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
  • requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
  • empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)

** SECURITY **

  • fix CVE-2024-1135
  1. Documentation is available there:https://docs.gunicorn.org/en/stable/news.html
  2. Packages:https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023-07-19===================fix thread worker: revert change considering connection as idle .</tr></table>

... (truncated)

Commits
  • f63d59e bump to 22.0
  • 4ac81e0 Merge pull request#3175 from e-kwsm/typo
  • 401cecf Merge pull request#3179 from dhdaines/exclude-eventlet-0360
  • 0243ec3 fix(deps): exclude eventlet 0.36.0
  • 628a0bc chore: fix typos
  • 88fc4a4 Merge pull request#3131 from pajod/patch-py12-rebased
  • deae2fc CI: back off the agressive timeout
  • f470382 docs: promise 3.12 compat
  • 5e30bfa add changelog to project.urls (updated for PEP621)
  • 481c3f9 remove setup.cfg - overridden by pyproject.toml
  • Additional commits viewable incompare view

Updatesdjango from 2.2.5 to 4.2.17

Commits

Updatessqlparse from 0.3.0 to 0.5.0

Changelog

Sourced fromsqlparse's changelog.

Release 0.5.0 (Apr 13, 2024)

Notable Changes

  • Drop support for Python 3.5, 3.6, and 3.7.
  • Python 3.12 is now supported (pr725, by hugovk).
  • IMPORTANT: Fixes a potential denial of service attack (DOS) due to recursionerror for deeply nested statements. Instead of recursion error a genericSQLParseError is raised. See the security advisory for details:GHSA-2m57-hf25-phggThe vulnerability was discovered by@​uriyay-jfrog. Thanks for reporting!

Enhancements

  • Splitting statements now allows to remove the semicolon at the end.Some database backends love statements without semicolon (issue742).
  • Support TypedLiterals in get_parameters (pr749, by Khrol).
  • Improve splitting of Transact SQL when using GO keyword (issue762).
  • Support for some JSON operators (issue682).
  • Improve formatting of statements containing JSON operators (issue542).
  • Support for BigQuery and Snowflake keywords (pr699, by griffatrasgo).
  • Support parsing of OVER clause (issue701, pr768 by r33s3n6).

Bug Fixes

  • Ignore dunder attributes when creating Tokens (issue672).
  • Allow operators to precede dollar-quoted strings (issue763).
  • Fix parsing of nested order clauses (issue745, pr746 by john-bodley).
  • Thread-safe initialization of Lexer class (issue730).
  • Classify TRUNCATE as DDL and GRANT/REVOKE as DCL keywords (based on pr719by josuc1, thanks for bringing this up!).
  • Fix parsing of PRIMARY KEY (issue740).

Other

  • Optimize performance of matching function (pr799, by admachainz).

Release 0.4.4 (Apr 18, 2023)

Notable Changes

  • IMPORTANT: This release fixes a security vulnerability in theparser where a regular expression vulnerable to ReDOS (RegularExpression Denial of Service) was used. See the security advisoryfor details:GHSA-rrm6-wvj7-cwh2The vulnerability was discovered by@​erik-krogh from GitHubSecurity Lab (GHSL). Thanks for reporting!

... (truncated)

Commits
  • ddbd0ec Bump version.
  • 29f2e0a Raise recursion limit for tests.
  • b4a39d9 Raise SQLParseError instead of RecursionError.
  • f1bcf2f Update AUHTORS and Changelog.
  • e03b74e Fix Function.get_parameters(), add Funtion.get_window()
  • 617b8f6 Add OVER clause, and group it into Function (fixes#701)
  • d8f8147 Update AUHTORS and Changelog.
  • 012c9f1 Optimize sqlparse.utils.imt().
  • 46971e5 Fix parsing of PRIMARY KEY (fixes#740).
  • fc4b0be Code cleanup.
  • Additional commits viewable incompare view

Updatesflask from 1.1.2 to 2.2.5

Release notes

Sourced fromflask's releases.

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such aspip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI:https://pypi.org/project/Flask/3.1.0/Changes:https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0Milestone:https://github.com/pallets/flask/milestone/33?closed=1

  • Drop support for Python 3.8.#5623
  • Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9.#5624,#5633
  • Provide a configuration option to control automatic option responses.#5496
  • Flask.open_resource/open_instance_resource andBlueprint.open_resource take anencoding parameter to use when opening in text mode. It defaults toutf-8.#5504
  • Request.max_content_length can be customized per-request instead of only through theMAX_CONTENT_LENGTH config. AddedMAX_FORM_MEMORY_SIZE andMAX_FORM_PARTS config. Added documentation about resource limits to the security page.#5625
  • Add support for thePartitioned cookie attribute (CHIPS), with theSESSION_COOKIE_PARTITIONED config.#5472
  • -e path takes precedence over default.env and.flaskenv files.load_dotenv loads default files in addition to a path unlessload_defaults=False is passed.#5628
  • Support key rotation with theSECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support.#5621
  • Fix how settinghost_matching=True orsubdomain_matching=False interacts withSERVER_NAME. SettingSERVER_NAME no longer restricts requests to only that domain.#5553
  • Request.trusted_hosts is checked during routing, and can be set through theTRUSTED_HOSTS config.#5636

3.0.3

This is a fix release for the 3.0.x feature branch.

PyPI:https://pypi.org/project/Flask/3.0.3/Changes:https://flask.palletsprojects.com/en/3.0.x/changes/#version-3-0-3Milestone:https://github.com/pallets/flask/milestone/35?closed=1

  • The defaulthashlib.sha1 may not be available in FIPS builds. Don't access it at import time so the developer has time to change the default.#5448
  • Don't initialize thecli attribute in the sansio scaffold, but rather in theFlask concrete class.#5270

3.0.2

This is a fix release for the 3.0.x feature release branch. It fixes bugs but does not otherwise change behavior and should not result in breaking changes.

3.0.1

This is a fix release for the 3.0.x feature release branch.

Fixes an issue where using other JSON providers, such asflask-orjson, previously caused loaded session data to have an incorrect format in some cases.

3.0.0

This is a feature release, which includes new features, removes previously deprecated code, and adds new deprecations. The 3.0.x branch is now the supported fix branch, the 2.3.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such aspip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

... (truncated)

DetailsDescription has been truncated

Bumps the pip group with 2 updates in the /2017/quals/2017-misc-mindreader/app directory: [gunicorn](https://github.com/benoitc/gunicorn) and [flask](https://github.com/pallets/flask).Bumps the pip group with 1 update in the /2018/finals/web-mitigator/app directory: [flask](https://github.com/pallets/flask).Bumps the pip group with 2 updates in the /2019/finals/misc-stuffed-finals/app directory: [gunicorn](https://github.com/benoitc/gunicorn) and [flask](https://github.com/pallets/flask).Bumps the pip group with 3 updates in the /2019/finals/web-gphotos-finals/app directory: [gunicorn](https://github.com/benoitc/gunicorn), [django](https://github.com/django/django) and [sqlparse](https://github.com/andialbrecht/sqlparse).Bumps the pip group with 2 updates in the /2020/quals/web-littlethings-fixed/exploit directory: [flask](https://github.com/pallets/flask) and [requests](https://github.com/psf/requests).Bumps the pip group with 2 updates in the /2020/quals/web-littlethings/exploit directory: [flask](https://github.com/pallets/flask) and [requests](https://github.com/psf/requests).Bumps the pip group with 2 updates in the /2022/hackceler8/game directory: [pillow](https://github.com/python-pillow/Pillow) and [protobuf](https://github.com/protocolbuffers/protobuf).Bumps the pip group with 2 updates in the /2022/quals/web-log4j/server directory: [gunicorn](https://github.com/benoitc/gunicorn) and [flask](https://github.com/pallets/flask).Bumps the pip group with 8 updates in the /2023/quals/web-under-construction/challenge/flask directory:| Package | From | To || --- | --- | --- || [gunicorn](https://github.com/benoitc/gunicorn) | `20.1.0` | `22.0.0` || [flask](https://github.com/pallets/flask) | `2.2.3` | `2.2.5` || [gevent](https://github.com/gevent/gevent) | `22.10.2` | `23.9.0` || [requests](https://github.com/psf/requests) | `2.29.0` | `2.32.2` || [jinja2](https://github.com/pallets/jinja) | `3.1.2` | `3.1.5` || [werkzeug](https://github.com/pallets/werkzeug) | `2.2.3` | `3.0.6` || [pymysql](https://github.com/PyMySQL/PyMySQL) | `1.0.3` | `1.1.1` || [cryptography](https://github.com/pyca/cryptography) | `41.0.4` | `44.0.0` |Updates `gunicorn` from 19.7.1 to 22.0.0- [Release notes](https://github.com/benoitc/gunicorn/releases)- [Commits](benoitc/gunicorn@19.7.1...22.0.0)Updates `flask` from 2.2.5 to 3.1.0- [Release notes](https://github.com/pallets/flask/releases)- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)- [Commits](pallets/flask@2.2.5...3.1.0)Updates `flask` from 1.0.2 to 2.2.5- [Release notes](https://github.com/pallets/flask/releases)- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)- [Commits](pallets/flask@2.2.5...3.1.0)Updates `gunicorn` from 19.9.0 to 22.0.0- [Release notes](https://github.com/benoitc/gunicorn/releases)- [Commits](benoitc/gunicorn@19.7.1...22.0.0)Updates `flask` from 1.0.2 to 2.2.5- [Release notes](https://github.com/pallets/flask/releases)- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)- [Commits](pallets/flask@2.2.5...3.1.0)Updates `gunicorn` from 19.9.0 to 22.0.0- [Release notes](https://github.com/benoitc/gunicorn/releases)- [Commits](benoitc/gunicorn@19.7.1...22.0.0)Updates `django` from 2.2.5 to 4.2.17- [Commits](django/django@2.2.5...4.2.17)Updates `sqlparse` from 0.3.0 to 0.5.0- [Release notes](https://github.com/andialbrecht/sqlparse/releases)- [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG)- [Commits](andialbrecht/sqlparse@0.3.0...0.5.0)Updates `flask` from 1.1.2 to 2.2.5- [Release notes](https://github.com/pallets/flask/releases)- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)- [Commits](pallets/flask@2.2.5...3.1.0)Updates `requests` from 2.24.0 to 2.32.2- [Release notes](https://github.com/psf/requests/releases)- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)- [Commits](psf/requests@v2.24.0...v2.32.2)Updates `flask` from 1.1.2 to 2.2.5- [Release notes](https://github.com/pallets/flask/releases)- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)- [Commits](pallets/flask@2.2.5...3.1.0)Updates `requests` from 2.24.0 to 2.32.2- [Release notes](https://github.com/psf/requests/releases)- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)- [Commits](psf/requests@v2.24.0...v2.32.2)Updates `pillow` from 9.1.1 to 10.3.0- [Release notes](https://github.com/python-pillow/Pillow/releases)- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)- [Commits](python-pillow/Pillow@9.1.1...10.3.0)Updates `protobuf` from 3.20.1 to 3.20.2- [Release notes](https://github.com/protocolbuffers/protobuf/releases)- [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl)- [Commits](protocolbuffers/protobuf@v3.20.1...v3.20.2)Updates `gunicorn` from 20.1.0 to 22.0.0- [Release notes](https://github.com/benoitc/gunicorn/releases)- [Commits](benoitc/gunicorn@19.7.1...22.0.0)Updates `flask` from 2.1.2 to 2.2.5- [Release notes](https://github.com/pallets/flask/releases)- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)- [Commits](pallets/flask@2.2.5...3.1.0)Updates `gunicorn` from 20.1.0 to 22.0.0- [Release notes](https://github.com/benoitc/gunicorn/releases)- [Commits](benoitc/gunicorn@19.7.1...22.0.0)Updates `flask` from 2.2.3 to 2.2.5- [Release notes](https://github.com/pallets/flask/releases)- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)- [Commits](pallets/flask@2.2.5...3.1.0)Updates `gevent` from 22.10.2 to 23.9.0- [Release notes](https://github.com/gevent/gevent/releases)- [Changelog](https://github.com/gevent/gevent/blob/master/docs/changelog_pre.rst)- [Commits](gevent/gevent@22.10.2...23.9.0)Updates `requests` from 2.29.0 to 2.32.2- [Release notes](https://github.com/psf/requests/releases)- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)- [Commits](psf/requests@v2.24.0...v2.32.2)Updates `jinja2` from 3.1.2 to 3.1.5- [Release notes](https://github.com/pallets/jinja/releases)- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)- [Commits](pallets/jinja@3.1.2...3.1.5)Updates `werkzeug` from 2.2.3 to 3.0.6- [Release notes](https://github.com/pallets/werkzeug/releases)- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)- [Commits](pallets/werkzeug@2.2.3...3.0.6)Updates `pymysql` from 1.0.3 to 1.1.1- [Release notes](https://github.com/PyMySQL/PyMySQL/releases)- [Changelog](https://github.com/PyMySQL/PyMySQL/blob/main/CHANGELOG.md)- [Commits](PyMySQL/PyMySQL@v1.0.3...v1.1.1)Updates `cryptography` from 41.0.4 to 44.0.0- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)- [Commits](pyca/cryptography@41.0.4...44.0.0)---updated-dependencies:- dependency-name: gunicorn  dependency-type: direct:production  dependency-group: pip- dependency-name: flask  dependency-type: direct:production  dependency-group: pip- dependency-name: flask  dependency-type: direct:production  dependency-group: pip- dependency-name: gunicorn  dependency-type: direct:production  dependency-group: pip- dependency-name: flask  dependency-type: direct:production  dependency-group: pip- dependency-name: gunicorn  dependency-type: direct:production  dependency-group: pip- dependency-name: django  dependency-type: direct:production  dependency-group: pip- dependency-name: sqlparse  dependency-type: direct:production  dependency-group: pip- dependency-name: flask  dependency-type: direct:production  dependency-group: pip- dependency-name: requests  dependency-type: direct:production  dependency-group: pip- dependency-name: flask  dependency-type: direct:production  dependency-group: pip- dependency-name: requests  dependency-type: direct:production  dependency-group: pip- dependency-name: pillow  dependency-type: direct:production  dependency-group: pip- dependency-name: protobuf  dependency-type: direct:production  dependency-group: pip- dependency-name: gunicorn  dependency-type: direct:production  dependency-group: pip- dependency-name: flask  dependency-type: direct:production  dependency-group: pip- dependency-name: gunicorn  dependency-type: direct:production  dependency-group: pip- dependency-name: flask  dependency-type: direct:production  dependency-group: pip- dependency-name: gevent  dependency-type: direct:production  dependency-group: pip- dependency-name: requests  dependency-type: direct:production  dependency-group: pip- dependency-name: jinja2  dependency-type: direct:production  dependency-group: pip- dependency-name: werkzeug  dependency-type: direct:production  dependency-group: pip- dependency-name: pymysql  dependency-type: direct:production  dependency-group: pip- dependency-name: cryptography  dependency-type: direct:production  dependency-group: pip...Signed-off-by: dependabot[bot] <support@github.com>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filepythonPull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants


[8]ページ先頭

©2009-2025 Movatter.jp