chore(deps): update dependency aiohttp to v3.10.11 [security] #610
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/pypi-aiohttp-vulnerability
branch
from
990fc83
to
f18d845
Compare
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==3.9.4->==3.10.11GitHub Vulnerability Alerts
CVE-2024-42367
Summary
Static routes which contain files with compressed variants (
.gzor.brextension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.Details
The server protects static routes from path traversal outside the root directory when
follow_symlinks=False(default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in theFileResponseclass, and symbolic links are then automatically followed when performingPath.stat()andPath.open()to send the file.Impact
Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.
Patch: https://github.com/aio-libs/aiohttp/pull/8653/files
CVE-2024-52304
Summary
The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.
Impact
If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or
AIOHTTP_NO_EXTENSIONSis enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.Patch: aio-libs/aiohttp@259edc3
Release Notes
aio-libs/aiohttp (aiohttp)
v3.10.11Compare Source
====================
Bug fixes
Authentication provided by a redirect now takes precedence over provided
authwhen making requests with the client -- by :user:PLPeeters.Related issues and pull requests on GitHub:
:issue:
9436.Fixed :py:meth:
WebSocketResponse.close() <aiohttp.web.WebSocketResponse.close>to discard non-close messages within its timeout window after sending close -- by :user:lenard-mosys.Related issues and pull requests on GitHub:
:issue:
9506.Fixed a deadlock that could occur while attempting to get a new connection slot after a timeout -- by :user:
bdraco.The connector was not cancellation-safe.
Related issues and pull requests on GitHub:
:issue:
9670, :issue:9671.Fixed the WebSocket flow control calculation undercounting with multi-byte data -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9686.Fixed incorrect parsing of chunk extensions with the pure Python parser -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9851.Fixed system routes polluting the middleware cache -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9852.Removals and backward incompatible breaking changes
Improved performance of the connector when a connection can be reused -- by :user:
bdraco.If
BaseConnector.connecthas been subclassed and replaced with custom logic, theceil_timeoutmust be added.Related issues and pull requests on GitHub:
:issue:
9600.Miscellaneous internal changes
Improved performance of the client request lifecycle when there are no cookies -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9470.Improved performance of sending client requests when the writer can finish synchronously -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9485.Improved performance of serializing HTTP headers -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9603.Passing
enable_cleanup_closedto :py:class:aiohttp.TCPConnectoris now ignored on Python 3.12.7+ and 3.13.1+ since the underlying bug that caused asyncio to leak SSL connections has been fixed upstream -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9726, :issue:9736.v3.10.10Compare Source
====================
Bug fixes
Fixed error messages from :py:class:
~aiohttp.resolver.AsyncResolverbeing swallowed -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9451, :issue:9455.Features
Added :exc:
aiohttp.ClientConnectorDNSErrorfor differentiating DNS resolution errors from other connector errors -- by :user:mstojcevich.Related issues and pull requests on GitHub:
:issue:
8455.Miscellaneous internal changes
Simplified DNS resolution throttling code to reduce chance of race conditions -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9454.v3.10.9Compare Source
===================
Bug fixes
Fixed proxy headers being used in the
ConnectionKeyhash when a proxy was not being used -- by :user:bdraco.If default headers are used, they are also used for proxy headers. This could have led to creating connections that were not needed when one was already available.
Related issues and pull requests on GitHub:
:issue:
9368.Widened the type of the
trace_request_ctxparameter of:meth:
ClientSession.request() <aiohttp.ClientSession.request>and friends-- by :user:
layday.Related issues and pull requests on GitHub:
:issue:
9397.Removals and backward incompatible breaking changes
Fixed failure to try next host after single-host connection timeout -- by :user:
brettdh.The default client :class:
aiohttp.ClientTimeoutparams has changed to include asock_connecttimeout of 30 seconds so that this correct behavior happens by default.Related issues and pull requests on GitHub:
:issue:
7342.Miscellaneous internal changes
Improved performance of resolving hosts with Python 3.12+ -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9342.Reduced memory required for timer objects created during the client request lifecycle -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9406.v3.10.8Compare Source
===================
Bug fixes
Fixed cancellation leaking upwards on timeout -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9326.v3.10.7Compare Source
===================
Bug fixes
Fixed assembling the :class:
~yarl.URLfor web requests when the host contains a non-default port or IPv6 address -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9309.Miscellaneous internal changes
Improved performance of determining if a URL is absolute -- by :user:
bdraco.The property :attr:
~yarl.URL.absoluteis more performant than the methodURL.is_absolute()and preferred when newer versions of yarl are used.Related issues and pull requests on GitHub:
:issue:
9171.Replaced code that can now be handled by
yarl-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9301.v3.10.6Compare Source
===================
Bug fixes
Added :exc:
aiohttp.ClientConnectionResetError. Client code that previously threw :exc:ConnectionResetErrorwill now throw this -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9137.Fixed an unclosed transport
ResourceWarningon web handlers -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8875.Fixed resolve_host() 'Task was destroyed but is pending' errors -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8967.Fixed handling of some file-like objects (e.g.
tarfile.extractfile()) which raiseAttributeErrorinstead ofOSErrorwhenfilenofails for streaming payload data -- by :user:ReallyReivax.Related issues and pull requests on GitHub:
:issue:
6732.Fixed web router not matching pre-encoded URLs (requires yarl 1.9.6+) -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8898, :issue:9267.Fixed an error when trying to add a route for multiple methods with a path containing a regex pattern -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8998.Fixed
Response.textwhen body is aPayload-- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
6485.Fixed compressed requests failing when no body was provided -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9108.Fixed client incorrectly reusing a connection when the previous message had not been fully sent -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8992.Fixed race condition that could cause server to close connection incorrectly at keepalive timeout -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9140.Fixed Python parser chunked handling with multiple Transfer-Encoding values -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8823.Fixed error handling after 100-continue so server sends 500 response instead of disconnecting -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8876.Stopped adding a default Content-Type header when response has no content -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8858.Added support for URL credentials with empty (zero-length) username, e.g.
https://:password@host-- by :user:shuckcRelated issues and pull requests on GitHub:
:issue:
6494.Stopped logging exceptions from
web.run_app()that would be raised regardless -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
6807.Implemented binding to IPv6 addresses in the pytest server fixture.
Related issues and pull requests on GitHub:
:issue:
4650.Fixed the incorrect use of flags for
getnameinfo()in the Resolver --by :user:GitNMLeeLink-Local IPv6 addresses can now be handled by the Resolver correctly.
Related issues and pull requests on GitHub:
:issue:
9032.Fixed StreamResponse.prepared to return True after EOF is sent -- by :user:
arthurdarcet.Related issues and pull requests on GitHub:
:issue:
5343.Changed
make_mocked_request()to use empty payload by default -- by :user:rahulnht.Related issues and pull requests on GitHub:
:issue:
7167.Used more precise type for
ClientResponseError.headers, fixing some type errors when using them -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8768.Changed behavior when returning an invalid response to send a 500 response -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8845.Fixed response reading from closed session to throw an error immediately instead of timing out -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8878.Fixed
CancelledErrorfrom one cleanup context stopping other contexts from completing -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8908.Fixed changing scheme/host in
Response.clone()for absolute URLs -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8990.Fixed
Site.namewhen host is an empty string -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8929.Updated Python parser to reject messages after a close message, matching C parser behaviour -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9018.Fixed creation of
SSLContextinside of :py:class:aiohttp.TCPConnectorwith multiple event loops in different threads -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9029.Fixed (on Python 3.11+) some edge cases where a task cancellation may get incorrectly suppressed -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9030.Fixed exception information getting lost on
HttpProcessingError-- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9052.Fixed
If-None-Matchnot using weak comparison -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9063.Fixed badly encoded charset crashing when getting response text instead of falling back to charset detector.
Related issues and pull requests on GitHub:
:issue:
9160.Rejected
\ninreasonvalues to avoid sending broken HTTP messages -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9167.Changed :py:meth:
ClientResponse.raise_for_status() <aiohttp.ClientResponse.raise_for_status>to only release the connection when invoked outside anasync withcontext -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9239.Features
Improved type on
paramsto match the underlying type allowed byyarl-- by :user:lpetre.Related issues and pull requests on GitHub:
:issue:
8564.Declared Python 3.13 supported -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8748.Removals and backward incompatible breaking changes
Improved middleware performance -- by :user:
bdraco.The
set_current_appmethod was removed fromUrlMappingMatchInfobecause it is no longer used, and it was unlikely external caller would ever use it.Related issues and pull requests on GitHub:
:issue:
9200.Increased minimum yarl version to 1.12.0 -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9267.Improved documentation
Clarified that
GracefulExitneeds to be handled inAppRunnerandServerRunnerwhen usinghandle_signals=True. -- by :user:Daste745Related issues and pull requests on GitHub:
:issue:
4414.Clarified that auth parameter in ClientSession will persist and be included with any request to any origin, even during redirects to different origins. -- by :user:
MaximZemskov.Related issues and pull requests on GitHub:
:issue:
6764.Clarified which timeout exceptions happen on which timeouts -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8968.Updated
ClientSessionparameters to match current code -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8991.Packaging updates and notes for downstreams
Fixed
test_client_session_timeout_zeroto not require internet access -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9004.Miscellaneous internal changes
Improved performance of making requests when there are no auto headers to skip -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8847.Exported
aiohttp.TraceRequestHeadersSentParams-- by :user:Hadock-is-ok.Related issues and pull requests on GitHub:
:issue:
8947.Avoided tracing overhead in the http writer when there are no active traces -- by user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9031.Improved performance of reify Cython implementation -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9054.Use :meth:
URL.extend_query() <yarl.URL.extend_query>to extend query params (requires yarl 1.11.0+) -- by :user:bdraco.If yarl is older than 1.11.0, the previous slower hand rolled version will be used.
Related issues and pull requests on GitHub:
:issue:
9068.Improved performance of checking if a host is an IP Address -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9095.Significantly improved performance of middlewares -- by :user:
bdraco.The construction of the middleware wrappers is now cached and is built once per handler instead of on every request.
Related issues and pull requests on GitHub:
:issue:
9158, :issue:9170.Improved performance of web requests -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9168, :issue:9169, :issue:9172, :issue:9174, :issue:9175, :issue:9241.Improved performance of starting web requests when there is no response prepare hook -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9173.Significantly improved performance of expiring cookies -- by :user:
bdraco.Expiring cookies has been redesigned to use :mod:
heapqinstead of a linear search, to better scale.Related issues and pull requests on GitHub:
:issue:
9203.Significantly sped up filtering cookies -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9204.v3.10.5Compare Source
=========================
Bug fixes
Fixed :meth:
aiohttp.ClientResponse.json()not settingstatuswhen :exc:aiohttp.ContentTypeErroris raised -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
8742.Miscellaneous internal changes
Improved performance of the WebSocket reader -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8736, :issue:8747.v3.10.4Compare Source
v3.10.3Compare Source
========================
Bug fixes
Fixed multipart reading when stream buffer splits the boundary over several read() calls -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8653.Fixed :py:class:
aiohttp.TCPConnectordoing blocking I/O in the event loop to create theSSLContext-- by :user:bdraco.The blocking I/O would only happen once per verify mode. However, it could cause the event loop to block for a long time if the
SSLContextcreation is slow, which is more likely during startup when the disk cache is not yet present.Related issues and pull requests on GitHub:
:issue:
8672.Miscellaneous internal changes
Improved performance of :py:meth:
~aiohttp.ClientWebSocketResponse.receiveand :py:meth:~aiohttp.web.WebSocketResponse.receivewhen there is no timeout. -- by :user:bdraco.The timeout context manager is now avoided when there is no timeout as it accounted for up to 50% of the time spent in the :py:meth:
~aiohttp.ClientWebSocketResponse.receiveand :py:meth:~aiohttp.web.WebSocketResponse.receivemethods.Related issues and pull requests on GitHub:
:issue:
8660.Improved performance of starting request handlers with Python 3.12+ -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8661.Improved performance of HTTP keep-alive checks -- by :user:
bdraco.Previously, when processing a request for a keep-alive connection, the keep-alive check would happen every second; the check is now rescheduled if it fires too early instead.
Related issues and pull requests on GitHub:
:issue:
8662.Improved performance of generating random WebSocket mask -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8667.v3.10.2Compare Source
===================
Bug fixes
Fixed server checks for circular symbolic links to be compatible with Python 3.13 -- by :user:
steverep.Related issues and pull requests on GitHub:
:issue:
8565.Fixed request body not being read when ignoring an Upgrade request -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8597.Fixed an edge case where shutdown would wait for timeout when the handler was already completed -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8611.Fixed connecting to
npipe://,tcp://, andunix://urls -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
8632.Fixed WebSocket ping tasks being prematurely garbage collected -- by :user:
bdraco.There was a small risk that WebSocket ping tasks would be prematurely garbage collected because the event loop only holds a weak reference to the task. The garbage collection risk has been fixed by holding a strong reference to the task. Additionally, the task is now scheduled eagerly with Python 3.12+ to increase the chance it can be completed immediately and avoid having to hold any references to the task.
Related issues and pull requests on GitHub:
:issue:
8641.Fixed incorrectly following symlinks for compressed file variants -- by :user:
steverep.Related issues and pull requests on GitHub:
:issue:
8652.Removals and backward incompatible breaking changes
Removed
Request.wait_for_disconnection(), which was mistakenly added briefly in 3.10.0 -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8636.Contributor-facing changes
Fixed monkey patches for
Path.stat()andPath.is_dir()for Python 3.13 compatibility -- by :user:steverep.Related issues and pull requests on GitHub:
:issue:
8551.Miscellaneous internal changes
Improved WebSocket performance when messages are sent or received frequently -- by :user:
bdraco.The WebSocket heartbeat scheduling algorithm was improved to reduce the
asyncioscheduling overhead by decreasing the number ofasyncio.TimerHandlecreations and cancellations.Related issues and pull requests on GitHub:
:issue:
8608.Minor improvements to various type annotations -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8634.v3.10.1Compare Source
v3.10.0Compare Source
v3.9.5Compare Source
==================
Bug fixes
Fixed "Unclosed client session" when initialization of
:py:class:
~aiohttp.ClientSessionfails -- by :user:NewGlad.Related issues and pull requests on GitHub:
:issue:
8253.Fixed regression (from :pr:
8280) with addingContent-Dispositionto theform-datapart after appending to writer -- by :user:
Dreamsorcerer/:user:Olegt0rr.Related issues and pull requests on GitHub:
:issue:
8332.Added default
Content-Dispositioninmultipart/form-dataresponses to avoid brokenform-data responses -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8335.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.