Update dependency waitress to v3.0.2 #6

Merged

cswimr merged 1 commit from renovate/waitress-3.x into master

2024-12-28 10:11:23 -05:00

Renovate commented

2024-12-27 23:21:11 -05:00

Member

This PR contains the following updates:

Package	Update	Change
waitress (changelog)	patch	`==3.0.0` -> `==3.0.2`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

Pylons/waitress (waitress)

`v3.0.2`

Compare Source

Security


- When using Waitress to process trusted proxy headers, Waitress will now
  update the headers to drop any untrusted values, thereby making sure that
  WSGI apps only get trusted and validated values that Waitress itself used to
  update the environ. See https://github.com/Pylons/waitress/pull/452 and
  https://github.com/Pylons/waitress/issues/451

`v3.0.1`

Compare Source

Backward Incompatibilities


- Python 3.8 is no longer supported.
  See https://github.com/Pylons/waitress/pull/445.

Features
~~~~~~~~

- Added support for Python 3.13.
  See https://github.com/Pylons/waitress/pull/445.

Security
~~~~~~~~

- Fix a bug that would lead to Waitress busy looping on select() on a half-open
  socket due to a race condition that existed when creating a new HTTPChannel.
  See https://github.com/Pylons/waitress/pull/435,
  https://github.com/Pylons/waitress/issues/418 and
  https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6

  With thanks to Dylan Jay and Dieter Maurer for their extensive debugging and
  helping track this down.

- No longer strip the header values before passing them to the WSGI environ.
  See https://github.com/Pylons/waitress/pull/434 and
  https://github.com/Pylons/waitress/issues/432

- Fix a race condition in Waitress when `channel_request_lookahead` is enabled
  that could lead to HTTP request smuggling.

  See https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [waitress](https://github.com/Pylons/waitress) ([changelog](https://docs.pylonsproject.org/projects/waitress/en/latest/index.html#change-history)) | patch | `==3.0.0` -> `==3.0.2` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>Pylons/waitress (waitress)</summary> ### [`v3.0.2`](https://github.com/Pylons/waitress/blob/HEAD/CHANGES.txt#302-2024-11-16) [Compare Source](https://github.com/Pylons/waitress/compare/v3.0.1...v3.0.2) Security ``` - When using Waitress to process trusted proxy headers, Waitress will now update the headers to drop any untrusted values, thereby making sure that WSGI apps only get trusted and validated values that Waitress itself used to update the environ. See https://github.com/Pylons/waitress/pull/452 and https://github.com/Pylons/waitress/issues/451 ``` ### [`v3.0.1`](https://github.com/Pylons/waitress/blob/HEAD/CHANGES.txt#301-2024-10-28) [Compare Source](https://github.com/Pylons/waitress/compare/v3.0.0...v3.0.1) Backward Incompatibilities ``` - Python 3.8 is no longer supported. See https://github.com/Pylons/waitress/pull/445. Features ~~~~~~~~ - Added support for Python 3.13. See https://github.com/Pylons/waitress/pull/445. Security ~~~~~~~~ - Fix a bug that would lead to Waitress busy looping on select() on a half-open socket due to a race condition that existed when creating a new HTTPChannel. See https://github.com/Pylons/waitress/pull/435, https://github.com/Pylons/waitress/issues/418 and https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6 With thanks to Dylan Jay and Dieter Maurer for their extensive debugging and helping track this down. - No longer strip the header values before passing them to the WSGI environ. See https://github.com/Pylons/waitress/pull/434 and https://github.com/Pylons/waitress/issues/432 - Fix a race condition in Waitress when `channel_request_lookahead` is enabled that could lead to HTTP request smuggling. See https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj ``` </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Renovate added 1 commit 2024-12-27 23:21:12 -05:00