chore(deps): update dependency aiohttp to v3 [security] - abandoned #1582
+1
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
trusted-contributions-gcf
bot
added
kokoro:force-run
gcf-owl-bot
bot
removed
the
owlbot:run
yoshi-kokoro
removed
the
kokoro:force-run
trusted-contributions-gcf
bot
added
kokoro:force-run
gcf-owl-bot
bot
removed
the
owlbot:run
yoshi-kokoro
removed
the
kokoro:force-run
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
renovate-bot
changed the title
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
< 3.10.0-><3.10.3GitHub Vulnerability Alerts
CVE-2024-42367
Summary
Static routes which contain files with compressed variants (
.gzor.brextension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.Details
The server protects static routes from path traversal outside the root directory when
follow_symlinks=False(default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in theFileResponseclass, and symbolic links are then automatically followed when performingPath.stat()andPath.open()to send the file.Impact
Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.
Patch: https://github.com/aio-libs/aiohttp/pull/8653/files
Release Notes
aio-libs/aiohttp (aiohttp)
v3.10.2: 3.10.2Compare Source
Bug fixes
Fixed server checks for circular symbolic links to be compatible with Python 3.13 -- by :user:
steverep.Related issues and pull requests on GitHub:
#8565.
Fixed request body not being read when ignoring an Upgrade request -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
#8597.
Fixed an edge case where shutdown would wait for timeout when the handler was already completed -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
#8611.
Fixed connecting to
npipe://,tcp://, andunix://urls -- by :user:bdraco.Related issues and pull requests on GitHub:
#8632.
Fixed WebSocket ping tasks being prematurely garbage collected -- by :user:
bdraco.There was a small risk that WebSocket ping tasks would be prematurely garbage collected because the event loop only holds a weak reference to the task. The garbage collection risk has been fixed by holding a strong reference to the task. Additionally, the task is now scheduled eagerly with Python 3.12+ to increase the chance it can be completed immediately and avoid having to hold any references to the task.
Related issues and pull requests on GitHub:
#8641.
Fixed incorrectly following symlinks for compressed file variants -- by :user:
steverep.Related issues and pull requests on GitHub:
#8652.
Removals and backward incompatible breaking changes
Removed
Request.wait_for_disconnection(), which was mistakenly added briefly in 3.10.0 -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
#8636.
Contributor-facing changes
Fixed monkey patches for
Path.stat()andPath.is_dir()for Python 3.13 compatibility -- by :user:steverep.Related issues and pull requests on GitHub:
#8551.
Miscellaneous internal changes
Improved WebSocket performance when messages are sent or received frequently -- by :user:
bdraco.The WebSocket heartbeat scheduling algorithm was improved to reduce the
asyncioscheduling overhead by decreasing the number ofasyncio.TimerHandlecreations and cancellations.Related issues and pull requests on GitHub:
#8608.
Minor improvements to various type annotations -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
#8634.
v3.10.1Compare Source
v3.10.0Compare Source
v3.9.5Compare Source
==================
Bug fixes
Fixed "Unclosed client session" when initialization of
:py:class:
~aiohttp.ClientSessionfails -- by :user:NewGlad.Related issues and pull requests on GitHub:
:issue:
8253.Fixed regression (from :pr:
8280) with addingContent-Dispositionto theform-datapart after appending to writer -- by :user:
Dreamsorcerer/:user:Olegt0rr.Related issues and pull requests on GitHub:
:issue:
8332.Added default
Content-Dispositioninmultipart/form-dataresponses to avoid brokenform-data responses -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8335.v3.9.4Compare Source
==================
Bug fixes
The asynchronous internals now set the underlying causes
when assigning exceptions to the future objects
-- by :user:
webknjaz.Related issues and pull requests on GitHub:
:issue:
8089.Treated values of
Accept-Encodingheader as case-insensitive when checkingfor gzip files -- by :user:
steverep.Related issues and pull requests on GitHub:
:issue:
8104.Improved the DNS resolution performance on cache hit -- by :user:
bdraco.This is achieved by avoiding an :mod:
asynciotask creation in this case.Related issues and pull requests on GitHub:
:issue:
8163.Changed the type annotations to allow
dicton :meth:aiohttp.MultipartWriter.append,:meth:
aiohttp.MultipartWriter.append_jsonand:meth:
aiohttp.MultipartWriter.append_form-- by :user:cakemannyRelated issues and pull requests on GitHub:
:issue:
7741.Ensure websocket transport is closed when client does not close it
-- by :user:
bdraco.The transport could remain open if the client did not close it. This
change ensures the transport is closed when the client does not close
it.
Related issues and pull requests on GitHub:
:issue:
8200.Leave websocket transport open if receive times out or is cancelled
-- by :user:
bdraco.This restores the behavior prior to the change in #7978.
Related issues and pull requests on GitHub:
:issue:
8251.Fixed content not being read when an upgrade request was not supported with the pure Python implementation.
-- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8252.Fixed a race condition with incoming connections during server shutdown -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8271.Fixed
multipart/form-datacompliance with :rfc:7578-- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8280.Fixed blocking I/O in the event loop while processing files in a POST request
-- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8283.Escaped filenames in static view -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8317.Fixed the pure python parser to mark a connection as closing when a
response has no length -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8320.Features
Upgraded llhttp to 9.2.1, and started rejecting obsolete line folding
in Python parser to match -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8146, :issue:8292.Deprecations (removal in next major release)
Deprecated
content_transfer_encodingparameter in :py:meth:FormData.add_field() <aiohttp.FormData.add_field>-- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8280.Improved documentation
Added a note about canceling tasks to avoid delaying server shutdown -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8267.Contributor-facing changes
The pull request template is now asking the contributors to
answer a question about the long-term maintenance challenges
they envision as a result of merging their patches
-- by :user:
webknjaz.Related issues and pull requests on GitHub:
:issue:
8099.Updated CI and documentation to use NPM clean install and upgrade
node to version 18 -- by :user:
steverep.Related issues and pull requests on GitHub:
:issue:
8116.A pytest fixture
hello_txtwas introduced to aidstatic file serving tests in
:file:
test_web_sendfile_functional.py. It dynamicallyprovisions
hello.txtfile variants shared across thetests in the module.
-- by :user:
steverepRelated issues and pull requests on GitHub:
:issue:
8136.Packaging updates and notes for downstreams
Added an
internalpytest marker for tests which should be skippedby packagers (use
-m 'not internal'to disable them) -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8299.v3.9.3Compare Source
==================
Bug fixes
Fixed backwards compatibility breakage (in 3.9.2) of
sslparameter when set outsideof
ClientSession(e.g. directly inTCPConnector) -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8097, :issue:8098.Miscellaneous internal changes
Improved test suite handling of paths and temp files to consistently use pathlib and pytest fixtures.
Related issues and pull requests on GitHub:
:issue:
3957.v3.9.2Compare Source
==================
Bug fixes
Fixed server-side websocket connection leak.
Related issues and pull requests on GitHub:
:issue:
7978.Fixed
web.FileResponsedoing blocking I/O in the event loop.Related issues and pull requests on GitHub:
:issue:
8012.Fixed double compress when compression enabled and compressed file exists in server file responses.
Related issues and pull requests on GitHub:
:issue:
8014.Added runtime type check for
ClientSessiontimeoutparameter.Related issues and pull requests on GitHub:
:issue:
8021.Fixed an unhandled exception in the Python HTTP parser on header lines starting with a colon -- by :user:
pajod.Invalid request lines with anything but a dot between the HTTP major and minor version are now rejected.
Invalid header field names containing question mark or slash are now rejected.
Such requests are incompatible with :rfc:
9110#section-5.6.2and are not known to be of any legitimate use.Related issues and pull requests on GitHub:
:issue:
8074.Improved validation of paths for static resources requests to the server -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8079.Features
Added support for passing :py:data:
Truetosslparameter inClientSessionwhiledeprecating :py:data:
None-- by :user:xiangyan99.Related issues and pull requests on GitHub:
:issue:
7698.Breaking changes
Fixed an unhandled exception in the Python HTTP parser on header lines starting with a colon -- by :user:
pajod.Invalid request lines with anything but a dot between the HTTP major and minor version are now rejected.
Invalid header field names containing question mark or slash are now rejected.
Such requests are incompatible with :rfc:
9110#section-5.6.2and are not known to be of any legitimate use.Related issues and pull requests on GitHub:
:issue:
8074.Improved documentation
Fixed examples of
fallback_charset_resolverfunction in the :doc:client_advanceddocument. -- by :user:henry0312.Related issues and pull requests on GitHub:
:issue:
7995.The Sphinx setup was updated to avoid showing the empty
changelog draft section in the tagged release documentation
builds on Read The Docs -- by :user:
webknjaz.Related issues and pull requests on GitHub:
:issue:
8067.Packaging updates and notes for downstreams
The changelog categorization was made clearer. The
contributors can now mark their fragment files more
accurately -- by :user:
webknjaz.The new category tags are:
Related issues and pull requests on GitHub:
:issue:
8066.Contributor-facing changes
Updated :ref:
contributing/Tests coverage <aiohttp-contributing>section to show how we usecodecov-- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
7916.The changelog categorization was made clearer. The
contributors can now mark their fragment files more
accurately -- by :user:
webknjaz.The new category tags are:
Related issues and pull requests on GitHub:
:issue:
8066.Miscellaneous internal changes
Replaced all
tmpdirfixtures withtmp_pathin test suite.Related issues and pull requests on GitHub:
:issue:
3551.v3.9.1Compare Source
==================
Bugfixes
Fixed importing aiohttp under PyPy on Windows.
#​7848 <https://github.com/aio-libs/aiohttp/issues/7848>_Fixed async concurrency safety in websocket compressor.
#​7865 <https://github.com/aio-libs/aiohttp/issues/7865>_Fixed
ClientResponse.close()releasing the connection instead of closing.#​7869 <https://github.com/aio-libs/aiohttp/issues/7869>_Fixed a regression where connection may get closed during upgrade. -- by :user:
Dreamsorcerer#​7879 <https://github.com/aio-libs/aiohttp/issues/7879>_Fixed messages being reported as upgraded without an Upgrade header in Python parser. -- by :user:
Dreamsorcerer#​7895 <https://github.com/aio-libs/aiohttp/issues/7895>_v3.9.0Compare Source
==================
Features
Introduced
AppKeyfor static typing support ofApplicationstorage.See https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config
#​5864 <https://github.com/aio-libs/aiohttp/issues/5864>_Added a graceful shutdown period which allows pending tasks to complete before the application's cleanup is called.
The period can be adjusted with the
shutdown_timeoutparameter. -- by :user:Dreamsorcerer.See https://docs.aiohttp.org/en/latest/web_advanced.html#graceful-shutdown
#​7188 <https://github.com/aio-libs/aiohttp/issues/7188>_Added
handler_cancellation <https://docs.aiohttp.org/en/stable/web_advanced.html#web-handler-cancellation>_ parameter to cancel web handler on client disconnection. -- by :user:mosquitoThis (optionally) reintroduces a feature removed in a previous release.
Recommended for those looking for an extra level of protection against denial-of-service attacks.
#​7056 <https://github.com/aio-libs/aiohttp/issues/7056>_Added support for setting response header parameters
max_line_sizeandmax_field_size.#​2304 <https://github.com/aio-libs/aiohttp/issues/2304>_Added
auto_decompressparameter toClientSession.requestto overrideClientSession._auto_decompress. -- by :user:Daste745#​3751 <https://github.com/aio-libs/aiohttp/issues/3751>_Changed
raise_for_statusto allow a coroutine.#​3892 <https://github.com/aio-libs/aiohttp/issues/3892>_Added client brotli compression support (optional with runtime check).
#​5219 <https://github.com/aio-libs/aiohttp/issues/5219>_Added
client_max_sizetoBaseRequest.clone()to allow overriding the request body size. -- :user:anesabml.#​5704 <https://github.com/aio-libs/aiohttp/issues/5704>_Added a middleware type alias
aiohttp.typedefs.Middleware.#​5898 <https://github.com/aio-libs/aiohttp/issues/5898>_Exported
HTTPMovewhich can be used to catch any redirection requestthat has a location -- :user:
dreamsorcerer.#​6594 <https://github.com/aio-libs/aiohttp/issues/6594>_Changed the
pathparameter inweb.run_app()to accept apathlib.Pathobject.#​6839 <https://github.com/aio-libs/aiohttp/issues/6839>_Performance: Skipped filtering
CookieJarwhen the jar is empty or all cookies have expired.#​7819 <https://github.com/aio-libs/aiohttp/issues/7819>_Performance: Only check origin if insecure scheme and there are origins to treat as secure, in
CookieJar.filter_cookies().#​7821 <https://github.com/aio-libs/aiohttp/issues/7821>_Performance: Used timestamp instead of
datetimeto achieve faster cookie expiration inCookieJar.#​7824 <https://github.com/aio-libs/aiohttp/issues/7824>_Added support for passing a custom server name parameter to HTTPS connection.
#​7114 <https://github.com/aio-libs/aiohttp/issues/7114>_Added support for using Basic Auth credentials from :file:
.netrcfile when making HTTP requests with the:py:class:
~aiohttp.ClientSessiontrust_envargument is set toTrue. -- by :user:yuvipanda.#​7131 <https://github.com/aio-libs/aiohttp/issues/7131>_Turned access log into no-op when the logger is disabled.
#​7240 <https://github.com/aio-libs/aiohttp/issues/7240>_Added typing information to
RawResponseMessage. -- by :user:Gobot1234#​7365 <https://github.com/aio-libs/aiohttp/issues/7365>_Removed
async-timeoutfor Python 3.11+ (replaced withasyncio.timeout()on newer releases).#​7502 <https://github.com/aio-libs/aiohttp/issues/7502>_Added support for
brotlicffias an alternative tobrotli(fixing Brotli support on PyPy).#​7611 <https://github.com/aio-libs/aiohttp/issues/7611>_Added
WebSocketResponse.get_extra_info()to access a protocol transport's extra info.#​7078 <https://github.com/aio-libs/aiohttp/issues/7078>_Allow
linkargument to be set to None/empty in HTTP 451 exception.#​7689 <https://github.com/aio-libs/aiohttp/issues/7689>_Bugfixes
Implemented stripping the trailing dots from fully-qualified domain names in
Hostheaders and TLS context when acting as an HTTP client.This allows the client to connect to URLs with FQDN host name like
https://example.com./.-- by :user:
martin-sucha.#​3636 <https://github.com/aio-libs/aiohttp/issues/3636>_Fixed client timeout not working when incoming data is always available without waiting. -- by :user:
Dreamsorcerer.#​5854 <https://github.com/aio-libs/aiohttp/issues/5854>_Fixed
readuntilto work with a delimiter of more than one character.#​6701 <https://github.com/aio-libs/aiohttp/issues/6701>_Added
__repr__toEmptyStreamReaderto avoidAttributeError.#​6916 <https://github.com/aio-libs/aiohttp/issues/6916>_Fixed bug when using
TCPConnectorwithttl_dns_cache=0.#​7014 <https://github.com/aio-libs/aiohttp/issues/7014>_Fixed response returned from expect handler being thrown away. -- by :user:
Dreamsorcerer#​7025 <https://github.com/aio-libs/aiohttp/issues/7025>_Avoided raising
UnicodeDecodeErrorin multipart and in HTTP headers parsing.#​7044 <https://github.com/aio-libs/aiohttp/issues/7044>_Changed
sock_readtimeout to start after writing has finished, avoiding read timeouts caused by an unfinished write. -- by :user:dtrifiro#​7149 <https://github.com/aio-libs/aiohttp/issues/7149>_Fixed missing query in tracing method URLs when using
yarl1.9+.#​7259 <https://github.com/aio-libs/aiohttp/issues/7259>_Changed max 32-bit timestamp to an aware datetime object, for consistency with the non-32-bit one, and to avoid a
DeprecationWarningon Python 3.12.#​7302 <https://github.com/aio-libs/aiohttp/issues/7302>_Fixed
EmptyStreamReader.iter_chunks()never ending. -- by :user:mind1m#​7616 <https://github.com/aio-libs/aiohttp/issues/7616>_Fixed a rare
RuntimeError: await wasn't used with futureexception. -- by :user:stalkerg#​7785 <https://github.com/aio-libs/aiohttp/issues/7785>_Fixed issue with insufficient HTTP method and version validation.
#​7700 <https://github.com/aio-libs/aiohttp/issues/7700>_Added check to validate that absolute URIs have schemes.
#​7712 <https://github.com/aio-libs/aiohttp/issues/7712>_Fixed unhandled exception when Python HTTP parser encounters unpaired Unicode surrogates.
#​7715 <https://github.com/aio-libs/aiohttp/issues/7715>_Updated parser to disallow invalid characters in header field names and stop accepting LF as a request line separator.
#​7719 <https://github.com/aio-libs/aiohttp/issues/7719>_Fixed Python HTTP parser not treating 204/304/1xx as an empty body.
#​7755 <https://github.com/aio-libs/aiohttp/issues/7755>_Ensure empty body response for 1xx/204/304 per RFC 9112 sec 6.3.
#​7756 <https://github.com/aio-libs/aiohttp/issues/7756>_Fixed an issue when a client request is closed before completing a chunked payload. -- by :user:
Dreamsorcerer#​7764 <https://github.com/aio-libs/aiohttp/issues/7764>_Edge Case Handling for ResponseParser for missing reason value.
#​7776 <https://github.com/aio-libs/aiohttp/issues/7776>_Fixed
ClientWebSocketResponse.close_codebeing erroneously set toNonewhen there are concurrent async tasks receiving data and closing the connection.#​7306 <https://github.com/aio-libs/aiohttp/issues/7306>_Added HTTP method validation.
#​6533 <https://github.com/aio-libs/aiohttp/issues/6533>_Fixed arbitrary sequence types being allowed to inject values via version parameter. -- by :user:
Dreamsorcerer#​7835 <https://github.com/aio-libs/aiohttp/issues/7835>_Performance: Fixed increase in latency with small messages from websocket compression changes.
#​7797 <https://github.com/aio-libs/aiohttp/issues/7797>_Improved Documentation
Fixed the
ClientResponse.release's type in the doc. Changed fromcomethodtomethod.#​5836 <https://github.com/aio-libs/aiohttp/issues/5836>_Added information on behavior of base_url parameter in
ClientSession.#​6647 <https://github.com/aio-libs/aiohttp/issues/6647>_Fixed
ClientResponseErrordocs.#​6700 <https://github.com/aio-libs/aiohttp/issues/6700>_Updated Redis code examples to follow the latest API.
#​6907 <https://github.com/aio-libs/aiohttp/issues/6907>_Added a note about possibly needing to update headers when using
on_response_prepare. -- by :user:Dreamsorcerer#​7283 <https://github.com/aio-libs/aiohttp/issues/7283>_Completed
trust_envparameter description to honorwss_proxy,ws_proxyorno_proxyenv.#​7325 <https://github.com/aio-libs/aiohttp/issues/7325>_Expanded SSL documentation with more examples (e.g. how to use certifi). -- by :user:
Dreamsorcerer#​7334 <https://github.com/aio-libs/aiohttp/issues/7334>_Fix, update, and improve client exceptions documentation.
#​7733 <https://github.com/aio-libs/aiohttp/issues/7733>_Deprecations and Removals
Added
shutdown_timeoutparameter toBaseRunner, whiledeprecating
shutdown_timeoutparameter fromBaseSite. -- by :user:Dreamsorcerer#​7718 <https://github.com/aio-libs/aiohttp/issues/7718>_Dropped Python 3.6 support.
#​6378 <https://github.com/aio-libs/aiohttp/issues/6378>_Dropped Python 3.7 support. -- by :user:
Dreamsorcerer#​7336 <https://github.com/aio-libs/aiohttp/issues/7336>_Removed support for abandoned
tokioevent loop. -- by :user:Dreamsorcerer#​7281 <https://github.com/aio-libs/aiohttp/issues/7281>_Misc
Made
printargument inrun_app()optional.#​3690 <https://github.com/aio-libs/aiohttp/issues/3690>_Improved performance of
ceil_timeoutin some cases.#​6316 <https://github.com/aio-libs/aiohttp/issues/6316>_Changed importing Gunicorn to happen on-demand, decreasing import time by ~53%. -- :user:
Dreamsorcerer#​6591 <https://github.com/aio-libs/aiohttp/issues/6591>_Improved import time by replacing
http.serverwithhttp.HTTPStatus.#​6903 <https://github.com/aio-libs/aiohttp/issues/6903>_Fixed annotation of
sslparameter to disallowTrue. -- by :user:Dreamsorcerer.#​7335 <https://github.com/aio-libs/aiohttp/issues/7335>_v3.8.6Compare Source
==================
Security bugfixes
Upgraded the vendored copy of llhttp_ to v9.1.3 -- by :user:
DreamsorcererThanks to :user:
kenballusfor reporting this, seeGHSA-pjjw-qhg8-p2p9.
.. _llhttp: https://llhttp.org
#​7647 <https://github.com/aio-libs/aiohttp/issues/7647>_Updated Python parser to comply with RFCs 9110/9112 -- by :user:
DreamorcererThanks to :user:
kenballusfor reporting this, seeGHSA-gfw2-4jvh-wgfg.
#​7663 <https://github.com/aio-libs/aiohttp/issues/7663>_Deprecation
Added
fallback_charset_resolverparameter inClientSessionto allow a user-suppliedcharacter set detection function.
Character set detection will no longer be included in 3.9 as a default. If this feature is needed,
please use
fallback_charset_resolver <https://docs.aiohttp.org/en/stable/client_advanced.html#character-set-detection>_.#​7561 <https://github.com/aio-libs/aiohttp/issues/7561>_Features
Enabled lenient response parsing for more flexible parsing in the client
(this should resolve some regressions when dealing with badly formatted HTTP responses). -- by :user:
Dreamsorcerer#​7490 <https://github.com/aio-libs/aiohttp/issues/7490>_Bugfixes
Fixed
PermissionErrorwhen.netrcis unreadable due to permissions.#​7237 <https://github.com/aio-libs/aiohttp/issues/7237>_Fixed output of parsing errors pointing to a
\n. -- by :user:Dreamsorcerer#​7468 <https://github.com/aio-libs/aiohttp/issues/7468>_Fixed
GunicornWebWorkermax_requests_jitter not working.#​7518 <https://github.com/aio-libs/aiohttp/issues/7518>_Fixed sorting in
filter_cookiesto use cookie with longest path. -- by :user:marq24.#​7577 <https://github.com/aio-libs/aiohttp/issues/7577>_Fixed display of
BadStatusLinemessages from llhttp_. -- by :user:Dreamsorcerer#​7651 <https://github.com/aio-libs/aiohttp/issues/7651>_v3.8.5: 3.8.5Compare Source
Security bugfixes
Upgraded the vendored copy of llhttp_ to v8.1.1 -- by :user:
webknjazand :user:
Dreamsorcerer.Thanks to :user:
sethmlarsonfor reporting this and providing us withcomprehensive reproducer, workarounds and fixing details! For more
information, see
GHSA-45c4-8wx5-qw6w.
.. _llhttp: https://llhttp.org
(#7346)
Features
Added information to C parser exceptions to show which character caused the error. -- by :user:
Dreamsorcerer(#7366)
Bugfixes
Fixed a transport is :data:
Noneerror -- by :user:Dreamsorcerer.(#3355)
v3.8.4Compare Source
==================
Bugfixes
#​6638 <https://github.com/aio-libs/aiohttp/issues/6638>_ConnectionResetErrornot being raised after client disconnection in SSL environments.#​7180 <https://github.com/aio-libs/aiohttp/issues/7180>_v3.8.3Compare Source
==================
.. attention::
This is the last :doc:
aiohttp <index>release tested underPython 3.6. The 3.9 stream is dropping it from the CI and the
distribution package metadata.
Bugfixes
Increased the upper boundary of the :doc:
multidict:indexdependencyto allow for the version 6 -- by :user:
hugovk.It used to be limited below version 7 in :doc:
aiohttp <index>v3.8.1 butwas lowered in v3.8.2 via :pr:
6550and never brought back, causingproblems with dependency pins when upgrading. :doc:
aiohttp <index>v3.8.3fixes that by recovering the original boundary of
< 7.#​6950 <https://github.com/aio-libs/aiohttp/issues/6950>_v3.8.2Compare Source
=====================================================
Bugfixes
Support registering OPTIONS HTTP method handlers via RouteTableDef.
#​4663 <https://github.com/aio-libs/aiohttp/issues/4663>_Started supporting
authority-formandabsolute-formURLs on the server-side.#​6227 <https://github.com/aio-libs/aiohttp/issues/6227>_Fix Python 3.11 alpha incompatibilities by using Cython 0.29.25
#​6396 <https://github.com/aio-libs/aiohttp/issues/6396>_Remove a deprecated usage of pytest.warns(None)
#​6663 <https://github.com/aio-libs/aiohttp/issues/6663>_Fix regression where
asyncio.CancelledErroroccurs on client disconnection.#​6719 <https://github.com/aio-libs/aiohttp/issues/6719>_Export :py:class:
~aiohttp.web.PrefixedSubAppResourceunder:py:mod:
aiohttp.web-- by :user:Dreamsorcerer.This fixes a regression introduced by :pr:
3469.#​6889 <https://github.com/aio-libs/aiohttp/issues/6889>_Dropped the :class:
objecttype possibility fromthe :py:attr:
aiohttp.ClientSession.timeoutproperty return type declaration.
#​6917 <https://github.com/aio-libs/aiohttp/issues/6917>,#​6923 <https://github.com/aio-libs/aiohttp/issues/6923>Improved Documentation
#​4137 <https://github.com/aio-libs/aiohttp/issues/4137>_#​6401 <https://github.com/aio-libs/aiohttp/issues/6401>_objecttype possibility fromthe :py:attr:
aiohttp.ClientSession.timeoutproperty return type declaration.
#​6917 <https://github.com/aio-libs/aiohttp/issues/6917>,#​6923 <https://github.com/aio-libs/aiohttp/issues/6923>Deprecations and Removals
#​4046 <https://github.com/aio-libs/aiohttp/issues/4046>_Misc
#​6369 <https://github.com/aio-libs/aiohttp/issues/6369>,#​6399 <https://github.com/aio-libs/aiohttp/issues/6399>,#​6550 <https://github.com/aio-libs/aiohttp/issues/6550>,#​6708 <https://github.com/aio-libs/aiohttp/issues/6708>,#​6757 <https://github.com/aio-libs/aiohttp/issues/6757>,#​6857 <https://github.com/aio-libs/aiohttp/issues/6857>,#​6872 <https://github.com/aio-libs/aiohttp/issues/6872>_v3.8.1Compare Source
==================
Bugfixes
getaddrinfo.getaddrinfowill return an(int, bytes)tuple, if CPython could not handle the address family.It will cause an index out of range error in aiohttp. For example, if user compile CPython with
--disable-ipv6option, but his system enable the ipv6.#​5901 <https://github.com/aio-libs/aiohttp/issues/5901>_#​6189 <https://github.com/aio-libs/aiohttp/issues/6189>_#​6195 <https://github.com/aio-libs/aiohttp/issues/6195>_Signalfrom__all__, replaceaiohttp.Signalwithaiosignal.Signalin docs#​6201 <https://github.com/aio-libs/aiohttp/issues/6201>_#​6305 <https://github.com/aio-libs/aiohttp/issues/6305>_Improved Documentation
#​6240 <https://github.com/aio-libs/aiohttp/issues/6240>_#​6274 <https://github.com/aio-libs/aiohttp/issues/6274>_#​6276 <https://github.com/aio-libs/aiohttp/issues/6276>_Dreamsorcerer.#​6278 <https://github.com/aio-libs/aiohttp/issues/6278>_Misc
#​6205 <https://github.com/aio-libs/aiohttp/issues/6205>_v3.8.0Compare Source
==================
Features
Added a
GunicornWebWorkerfeature for extending the aiohttp server configuration by allowing the 'wsgi' coroutine to returnweb.AppRunnerobject.#​2988 <https://github.com/aio-libs/aiohttp/issues/2988>_Switch from
http-parsertollhttp#​3561 <https://github.com/aio-libs/aiohttp/issues/3561>_Use Brotli instead of brotlipy
#​3803 <https://github.com/aio-libs/aiohttp/issues/3803>_Disable implicit switch-back to pure python mode. The build fails loudly if aiohttp
cannot be compiled with C Accelerators. Use AIOHTTP_NO_EXTENSIONS=1 to explicitly
disable C Extensions complication and switch to Pure-Python mode. Note that Pure-Python
mode is significantly slower than compiled one.
#​3828 <https://github.com/aio-libs/aiohttp/issues/3828>_Make access log use local time with timezone
#​3853 <https://github.com/aio-libs/aiohttp/issues/3853>_Implemented
readuntilinStreamResponse#​4054 <https://github.com/aio-libs/aiohttp/issues/4054>_FileResponse now supports ETag.
#​4594 <https://github.com/aio-libs/aiohttp/issues/4594>_Add a request handler type alias
aiohttp.typedefs.Handler.#​4686 <https://github.com/aio-libs/aiohttp/issues/4686>_AioHTTPTestCaseis more async friendly now.For people who use unittest and are used to use :py:exc:
~unittest.TestCaseit will be easier to write new test cases like the sync version of the :py:exc:
~unittest.TestCaseclass,without using the decorator
@unittest_run_loop, justasync def test_*.The only difference is that for the people using python3.7 and below a new dependency is needed, it is
asynctestcase.#​4700 <https://github.com/aio-libs/aiohttp/issues/4700>_Add validation of HTTP header keys and values to prevent header injection.
#​4818 <https://github.com/aio-libs/aiohttp/issues/4818>_Add predicate to
AbstractCookieJar.clear.Add
AbstractCookieJar.clear_domainto clean all domain and subdomains cookies only.#​4942 <https://github.com/aio-libs/aiohttp/issues/4942>_Add keepalive_timeout parameter to web.run_app.
#​5094 <https://github.com/aio-libs/aiohttp/issues/5094>_Tracing for client sent headers
#​5105 <https://github.com/aio-libs/aiohttp/issues/5105>_Make type hints for http parser stricter
#​5267 <https://github.com/aio-libs/aiohttp/issues/5267>_Add final declarations for constants.
#​5275 <https://github.com/aio-libs/aiohttp/issues/5275>_Switch to external frozenlist and aiosignal libraries.
#​5293 <https://github.com/aio-libs/aiohttp/issues/5293>_Don't send secure cookies by insecure transports.
By default, the transport is secure if https or wss scheme is used.
Use
CookieJar(treat_as_secure_origin="http://127.0.0.1")to override the default security checker.#​5571 <https://github.com/aio-libs/aiohttp/issues/5571>_Always create a new event loop in
aiohttp.web.run_app().This adds better compatibility with
asyncio.run()or if trying to run multiple apps in sequence.#​5572 <https://github.com/aio-libs/aiohttp/issues/5572>_Add
aiohttp.pytest_plugin.AiohttpClientfor static typing of pytest plugin.#​5585 <https://github.com/aio-libs/aiohttp/issues/5585>_Added a
socket_factoryargument toBaseTestServer.#​5844 <https://github.com/aio-libs/aiohttp/issues/5844>_Add compression strategy parameter to enable_compression method.
#​5909 <https://github.com/aio-libs/aiohttp/issues/5909>_Added support for Python 3.10 to Github Actions CI/CD workflows and fix the related deprecation warnings -- :user:
Hanaasagi.#​5927 <https://github.com/aio-libs/aiohttp/issues/5927>_Switched
chardettocharset-normalizerfor guessing the HTTP payload body encoding -- :user:Ousret.#​5930 <https://github.com/aio-libs/aiohttp/issues/5930>_Added optional auto_decompress argument for HttpRequestParser
#​5957 <https://github.com/aio-libs/aiohttp/issues/5957>_Added support for HTTPS proxies to the extent CPython's
:py:mod:
asynciosupports it -- by :user:bmbouter,:user:
jborean93and :user:webknjaz.#​5992 <https://github.com/aio-libs/aiohttp/issues/5992>_Added
base_urlparameter to the initializer of :class:~aiohttp.ClientSession.#​6013 <https://github.com/aio-libs/aiohttp/issues/6013>_Add Trove classifier and create binary wheels for 3.10. -- :user:
hugovk.#​6079 <https://github.com/aio-libs/aiohttp/issues/6079>_Started shipping platform-specific wheels with the
musltag targeting typical Alpine Linux runtimes — :user:asvetlov.#​6139 <https://github.com/aio-libs/aiohttp/issues/6139>_Started shipping platform-specific arm64 wheels for Apple Silicon — :user:
asvetlov.#​6139 <https://github.com/aio-libs/aiohttp/issues/6139>_Bugfixes
await resp.write(...)orws.send_json(...)calls without race-condition.#​2934 <https://github.com/aio-libs/aiohttp/issues/2934>MultiLoopChildWatcherwhen it's available under POSIX while setting up the test I/O loop.#​3450 <https://github.com/aio-libs/aiohttp/issues/3450>_Other parameters are encoded to quoted-string or RFC2231 extended parameter
value.
#​4012 <https://github.com/aio-libs/aiohttp/issues/4012>_no_proxyenvironment variables.#​4431 <https://github.com/aio-libs/aiohttp/issues/4431>_#​4648 <https://github.com/aio-libs/aiohttp/issues/4648>_#​4748 <https://github.com/aio-libs/aiohttp/issues/4748>_#​4799 <https://github.com/aio-libs/aiohttp/issues/4799>_#​4984 <https://github.com/aio-libs/aiohttp/issues/4984>_#​5106 <https://github.com/aio-libs/aiohttp/issues/5106>_#​5107 <https://github.com/aio-libs/aiohttp/issues/5107>_#​5192 <https://github.com/aio-libs/aiohttp/issues/5192>_#​5233 <https://github.com/aio-libs/aiohttp/issues/5233>_routes.static('/foo', '/foo')no longer matches the URL/foobar. Previously, this would attempt to load the file/foo/ar.#​5250 <https://github.com/aio-libs/aiohttp/issues/5250>_#​5259 <https://github.com/aio-libs/aiohttp/issues/5259>_andWSRequestContextManager``#​5329 <https://github.com/aio-libs/aiohttp/issues/5329>#​5380 <https://github.com/aio-libs/aiohttp/issues/5380>_#​5392 <https://github.com/aio-libs/aiohttp/issues/5392>_ClientResponseobject on calls to theokproperty for the failed requests.#​5403 <https://github.com/aio-libs/aiohttp/issues/5403>_paramskeyword argument in tracingURL.#​5432 <https://github.com/aio-libs/aiohttp/issues/5432>_#​5466 <https://github.com/aio-libs/aiohttp/issues/5466>_descriptors for the
tempfile.Temporaryfile-created_io.BufferedRandominstances of files sent within multipart requestbodies via HTTP POST requests -- by :user:
webknjaz.#​5494 <https://github.com/aio-libs/aiohttp/issues/5494>_#​5527 <https://github.com/aio-libs/aiohttp/issues/5527>_#​5554 <https://github.com/aio-libs/aiohttp/issues/5554>tests/autobahn/server.pywith call toweb.run_app; replace deprecatedaiohttp.ws_connectcalls intests/autobahn/client.pywithaiohttp.ClienSession.ws_connect.#​5606 <https://github.com/aio-libs/aiohttp/issues/5606>_HTTPUnauthorizedthat access thetextargument. This is not used in any part of the code, so it's removed now.#​5657 <https://github.com/aio-libs/aiohttp/issues/5657>_#​5727 <https://github.com/aio-libs/aiohttp/issues/5727>_#​5840 <https://github.com/aio-libs/aiohttp/issues/5840>_#​5853 <https://github.com/aio-libs/aiohttp/issues/5853>_paramskeyword argument toClientSession.ws_connect. -- :user:hoh.#​5868 <https://github.com/aio-libs/aiohttp/issues/5868>_~asyncio.ThreadedChildWatcherunder POSIX to allow setting up test loop in non-main thread.#​5877 <https://github.com/aio-libs/aiohttp/issues/5877>_getaddrinfo.getaddrinfowill return an(int, bytes)tuple, if CPython could not handle the address family.It will cause a index out of range error in aiohttp. For example, if user compile CPython with
--disable-ipv6option but his system enable the ipv6.#​5901 <https://github.com/aio-libs/aiohttp/issues/5901>_loopargument from theasyncio.sleep/gathercalls#​5905 <https://github.com/aio-libs/aiohttp/issues/5905>_Nonefromrequest.if_modified_since,request.if_unmodified_since,request.if_rangeandresponse.last_modifiedwhen corresponding http date headers are invalid.#​5925 <https://github.com/aio-libs/aiohttp/issues/5925>_SIGCHLDsignals in Gunicorn aiohttp Worker to fixsubprocessesthat capture output having an incorrectreturncode.#​6130 <https://github.com/aio-libs/aiohttp/issues/6130>_400: Content-Length can't be present with Transfer-Encodingif bothContent-LengthandTransfer-Encodingare sent by peer by both C and Python implementations#​6182 <https://github.com/aio-libs/aiohttp/issues/6182>_Improved Documentation
aio-openapi#​5326 <https://github.com/aio-libs/aiohttp/issues/5326>_read-only dictionary-like object).
#​5725 <https://github.com/aio-libs/aiohttp/issues/5725>_Authorizationheader is removedon redirects to a different host or protocol.
#​5850 <https://github.com/aio-libs/aiohttp/issues/5850>_Misc
#​3927 <https://github.com/aio-libs/aiohttp/issues/3927>,#​4247 <https://github.com/aio-libs/aiohttp/issues/4247>,#​4247 <https://github.com/aio-libs/aiohttp/issues/4247>,#​5389 <https://github.com/aio-libs/aiohttp/issues/5389>,#​5457 <https://github.com/aio-libs/aiohttp/issues/5457>,#​5486 <https://github.com/aio-libs/aiohttp/issues/5486>,#​5494 <https://github.com/aio-libs/aiohttp/issues/5494>,#​5515 <https://github.com/aio-libs/aiohttp/issues/5515>,#​5625 <https://github.com/aio-libs/aiohttp/issues/5625>,#​5635 <https://github.com/aio-libs/aiohttp/issues/5635>,#​5648 <https://github.com/aio-libs/aiohttp/issues/5648>,#​5657 <https://github.com/aio-libs/aiohttp/issues/5657>,#​5890 <https://github.com/aio-libs/aiohttp/issues/5890>,#​5914 <https://github.com/aio-libs/aiohttp/issues/5914>,#​5932 <https://github.com/aio-libs/aiohttp/issues/5932>,#​6002 <https://github.com/aio-libs/aiohttp/issues/6002>,#​6045 <https://github.com/aio-libs/aiohttp/issues/6045>,#​6131 <https://github.com/aio-libs/aiohttp/issues/6131>,#​6156 <https://github.com/aio-libs/aiohttp/issues/6156>,#​6165 <https://github.com/aio-libs/aiohttp/issues/6165>,#​6166 <https://github.com/aio-libs/aiohttp/issues/6166>_v3.7.4.post0Compare Source
========================
Misc
chardetruntime dependencyto allow their v4.0 version stream.
#​5366 <https://github.com/aio-libs/aiohttp/issues/5366>_v3.7.4Compare Source
========================
Misc
chardetruntime dependencyto allow their v4.0 version stream.
#​5366 <https://github.com/aio-libs/aiohttp/issues/5366>_v3.7.3Compare Source
==================
Features
#​3803 <https://github.com/aio-libs/aiohttp/issues/3803>_#​4077 <https://github.com/aio-libs/aiohttp/issues/4077>_Bugfixes
HTTP Reason Phrase.
#​3532 <https://github.com/aio-libs/aiohttp/issues/3532>_web_middlewares.normalize_path_middlewarebehavior for patch without slash.#​3669 <https://github.com/aio-libs/aiohttp/issues/3669>_#​3701 <https://github.com/aio-libs/aiohttp/issues/3701>_BaseConnector.close()a coroutine and wait until the client closes all connections. Drop deprecated "with Connector():" syntax.#​3736 <https://github.com/aio-libs/aiohttp/issues/3736>_sock_readtimeout each time data is received for aaiohttp.clientresponse.#​3808 <https://github.com/aio-libs/aiohttp/issues/3808>_#​3880 <https://github.com/aio-libs/aiohttp/issues/3880>_#​5156 <https://github.com/aio-libs/aiohttp/issues/5156>_#​5163 <https://github.com/aio-libs/aiohttp/issues/5163>_#​5230 <https://github.com/aio-libs/aiohttp/issues/5230>_Improved Documentation
aiohttp.web.FileResponse.#​3958 <https://github.com/aio-libs/aiohttp/issues/3958>_#​3964 <https://github.com/aio-libs/aiohttp/issues/3964>_aiohttp.client.request.#​4603 <https://github.com/aio-libs/aiohttp/issues/4603>_#​5228 <https://github.com/aio-libs/aiohttp/issues/5228>_Misc
#​4102 <https://github.com/aio-libs/aiohttp/issues/4102>_v3.7.2Compare Source
==================
Bugfixes
.sendfile()support#​5149 <https://github.com/aio-libs/aiohttp/issues/5149>_v3.7.1Compare Source
==================
Bugfixes
Protocol.#​5111 <https://github.com/aio-libs/aiohttp/issues/5111>_#​4901 <https://github.com/aio-libs/aiohttp/issues/4901>_#​4957 <https://github.com/aio-libs/aiohttp/issues/4957>_typing_extensionslibrary.#​5107 <https://github.com/aio-libs/aiohttp/issues/5107>_ThreadedResolver.resolvetoreturn the resolved IP as the
hostnamein each record, which preventedvalidation of HTTPS connections.
#​5110 <https://github.com/aio-libs/aiohttp/issues/5110>_#​5115 <https://github.com/aio-libs/aiohttp/issues/5115>_#​5116 <https://github.com/aio-libs/aiohttp/issues/5116>_#​5124 <https://github.com/aio-libs/aiohttp/issues/5124>_web.run_app()about Python version checking on Windows#​5127 <https://github.com/aio-libs/aiohttp/issues/5127>_v3.7.0Compare Source
==================
Features
on_response_preparehooks, directly before headers are sent to the client.#​1958 <https://github.com/aio-libs/aiohttp/issues/1958>_quote_cookieoption toCookieJar, a way to skip quotation wrapping of cookies containing special characters.#​2571 <https://github.com/aio-libs/aiohttp/issues/2571>_AccessLogger.logwith the current exception available fromsys.exc_info().#​3557 <https://github.com/aio-libs/aiohttp/issues/3557>_web.UrlDispatcher.add_routesandweb.Application.add_routesreturn a listof registered
AbstractRouteinstances.AbstractRouteDef.register(and allsubclasses) return a list of registered resources registered resource.
#​3866 <https://github.com/aio-libs/aiohttp/issues/3866>_#​3882 <https://github.com/aio-libs/aiohttp/issues/3882>_OSErroron reading/writing instead.#​4080 <https://github.com/aio-libs/aiohttp/issues/4080>_#​4189 <https://github.com/aio-libs/aiohttp/issues/4189>_ClientSession.timeoutproperty.#​4191 <https://github.com/aio-libs/aiohttp/issues/4191>_#​4224 <https://github.com/aio-libs/aiohttp/issues/4224>_loop.sendfile()instead of custom implementation if available.#​4269 <https://github.com/aio-libs/aiohttp/issues/4269>_#​4393 <https://github.com/aio-libs/aiohttp/issues/4393>_#​4402 <https://github.com/aio-libs/aiohttp/issues/4402>_read_bufsizeargument.#​4453 <https://github.com/aio-libs/aiohttp/issues/4453>_#​4513 <https://github.com/aio-libs/aiohttp/issues/4513>_methodandurlattributes toTraceRequestChunkSentParamsandTraceResponseChunkReceivedParams.#​4674 <https://github.com/aio-libs/aiohttp/issues/4674>_`#4711 <https://github.com/aio-libs/
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.