Bump the pip group across 1 directory with 11 updates

[dependabot]

Bumps the pip group with 11 updates in the / directory:

Package	From	To
gevent	1.0.2	23.9.0
pyyaml	3.11	5.4
requests	2.20.0	2.32.2
lxml	4.1.0	4.9.1
libtaxii	1.1.107	1.1.118
ujson	1.34	5.4.0
werkzeug	0.12.2	3.0.6
flask	0.12.4	2.2.5
gunicorn	19.5.0	22.0.0
psutil	3.1.1	5.6.6
supervisor	3.1.3	3.1.4

Updates gevent from 1.0.2 to 23.9.0

Release notes

Sourced from gevent's releases.

1.2.2

No release notes provided.

1.1.2

• Python 2: sendall on a non-blocking socket could spuriously fail with a timeout.
• If sys.stderr has been monkey-patched (not recommended), exceptions that the hub reports aren't lost and can still be caught. Reported in :issue:825 by Jelle Smet.
• :class:selectors.SelectSelector is properly monkey-patched regardless of the order of imports. Reported in :issue:835 by Przemysław Węgrzyn.
• Python 2: reload(site) no longer fails with a TypeError if gevent has been imported. Reported in :issue:805 by Jake Hilton.

1.1.1 (Apr 4, 2016)

• Nested callbacks that set and clear an Event no longer cause wait to return prematurely. Reported in :issue:771 by Sergey Vasilyev.
• Fix build on Solaris 10. Reported in :issue:777 by wiggin15.
• The ref parameter to :func:gevent.os.fork_and_watch was being ignored.
• Python 3: :class:gevent.queue.Channel is now correctly iterable, instead of raising a :exc:TypeError.
• Python 3: Add support for :meth:socket.socket.sendmsg, :meth:socket.socket.recvmsg and :meth:socket.socket.recvmsg_into on platforms where they are defined. Initial :pr:773 by Jakub Klama.

1.1.0

• Python 3: A monkey-patched :class:threading.RLock now properly blocks (or deadlocks) in acquire if the default value for timeout of -1 is used (which differs from gevent's default of None). The acquire method also raises the same :exc:ValueError exceptions that the standard library does for invalid parameters. Reported in #750 by Joy Zheng.
• Fix a race condition in :class:~gevent.event.Event that made it return False when the event was set and cleared by the same greenlet before allowing a switch to already waiting greenlets. (Found by the 3.4 and 3.5 standard library test suites; the same as Python bug 13502_. Note that the Python 2 standard library still has this race condition.)
• :class:~gevent.event.Event and :class:~.AsyncResult now wake waiting greenlets in the same (unspecified) order. Previously, AsyncResult tended to use a FIFO order, but this was never guaranteed. Both classes also use less per-instance memory.
• Using a :class:~logging.Logger as a :mod:pywsgi error or request log stream no longer produces extra newlines. Reported in #756 by ael-code.
• Windows: Installing from an sdist (.tar.gz) on PyPI no longer requires having Cython installed first. (Note that the binary installation

... (truncated)

Changelog

Sourced from gevent's changelog.

================= Changes for 1.0

.. currentmodule:: gevent

Commits

• 693181e Preparing release 23.9.0
• 6fc7898 Set the cython version; go back to default wheel tags.
• 666e374 Had the constraint wrong.
• 74ef876 Tweaking the build, and it seems like the greenlet stack issue should be fixed.
• b652e2a Error handling adjustments from running under a debug build.
• 70e7318 Tweaking tests and comments; temporary workarounds for 3.12 to enable builds.
• 495e37a Workaround the 3.12 traceback issue again.
• 2f53c85 gevent.pywsgi: Much improved handling of chunk trailers.
• bb06d2d Test builds with greenlet assertions enabled.
• 6b22af0 pyproject.toml: Bump to latest cython.
• Additional commits viewable in compare view

Updates pyyaml from 3.11 to 5.4

Changelog

Sourced from pyyaml's changelog.

5.4 (2021-01-19)

• yaml/pyyaml#407 -- Build modernization, remove distutils, fix metadata, build wheels, CI to GHA
• yaml/pyyaml#472 -- Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader
• yaml/pyyaml#441 -- Fix memory leak in implicit resolver setup
• yaml/pyyaml#392 -- Fix py2 copy support for timezone objects
• yaml/pyyaml#378 -- Fix compatibility with Jython

5.3.1 (2020-03-18)

• yaml/pyyaml#386 -- Prevents arbitrary code execution during python/object/new constructor

5.3 (2020-01-06)

• yaml/pyyaml#290 -- Use is instead of equality for comparing with None
• yaml/pyyaml#270 -- Fix typos and stylistic nit
• yaml/pyyaml#309 -- Fix up small typo
• yaml/pyyaml#161 -- Fix handling of slots
• yaml/pyyaml#358 -- Allow calling add_multi_constructor with None
• yaml/pyyaml#285 -- Add use of safe_load() function in README
• yaml/pyyaml#351 -- Fix reader for Unicode code points over 0xFFFF
• yaml/pyyaml#360 -- Enable certain unicode tests when maxunicode not > 0xffff
• yaml/pyyaml#359 -- Use full_load in yaml-highlight example
• yaml/pyyaml#244 -- Document that PyYAML is implemented with Cython
• yaml/pyyaml#329 -- Fix for Python 3.10
• yaml/pyyaml#310 -- Increase size of index, line, and column fields
• yaml/pyyaml#260 -- Remove some unused imports
• yaml/pyyaml#163 -- Create timezone-aware datetimes when parsed as such
• yaml/pyyaml#363 -- Add tests for timezone

5.2 (2019-12-02)

• Repair incompatibilities introduced with 5.1. The default Loader was changed, but several methods like add_constructor still used the old default yaml/pyyaml#279 -- A more flexible fix for custom tag constructors yaml/pyyaml#287 -- Change default loader for yaml.add_constructor yaml/pyyaml#305 -- Change default loader for add_implicit_resolver, add_path_resolver
• Make FullLoader safer by removing python/object/apply from the default FullLoader yaml/pyyaml#347 -- Move constructor for object/apply to UnsafeConstructor
• Fix bug introduced in 5.1 where quoting went wrong on systems with sys.maxunicode <= 0xffff yaml/pyyaml#276 -- Fix logic for quoting special characters
• Other PRs: yaml/pyyaml#280 -- Update CHANGES for 5.1

5.1.2 (2019-07-30)

• Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8b2+

... (truncated)

Commits

• 58d0cb7 5.4 release
• a60f7a1 Fix compatibility with Jython
• ee98abd Run CI on PR base branch changes
• ddf2033 constructor.timezone: _copy & deepcopy
• fc914d5 Avoid repeatedly appending to yaml_implicit_resolvers
• a001f27 Fix for CVE-2020-14343
• fe15062 Add 3.9 to appveyor file for completeness sake
• 1e1c7fb Add a newline character to end of pyproject.toml
• 0b6b7d6 Start sentences and phrases for capital letters
• c976915 Shell code improvements
• Additional commits viewable in compare view

Updates requests from 2.20.0 to 2.32.2

Release notes

Sourced from requests's releases.

v2.32.2

2.32.2 (2024-05-21)

Deprecations

• To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

  A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

v2.32.1

2.32.1 (2024-05-20)

Bugfixes

• Add missing test certs to the sdist distributed on PyPI.

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

Security

• Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

• verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)
• Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

Bugfixes

• Fixed bug in length detection where emoji length was incorrectly calculated in the request content-length. (#6589)
• Fixed deserialization bug in JSONDecodeError. (#6629)
• Fixed bug where an extra leading / (path separator) could lead urllib3 to unnecessarily reparse the request URI. (#6644)

... (truncated)

Changelog

Sourced from requests's changelog.

2.32.2 (2024-05-21)

Deprecations

• To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

  A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

2.32.1 (2024-05-20)

Bugfixes

• Add missing test certs to the sdist distributed on PyPI.

2.32.0 (2024-05-20)

Security

• Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

• verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)
• Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

Bugfixes

• Fixed bug in length detection where emoji length was incorrectly calculated in the request content-length. (#6589)
• Fixed deserialization bug in JSONDecodeError. (#6629)
• Fixed bug where an extra leading / (path separator) could lead urllib3 to unnecessarily reparse the request URI. (#6644)

Deprecations

... (truncated)

Commits

• 88dce9d v2.32.2
• c98e4d1 Merge pull request #6710 from nateprewitt/api_rename
• 92075b3 Add deprecation warning
• aa1461b Move _get_connection to get_connection_with_tls_context
• 970e8ce v2.32.1
• d6ebc4a v2.32.0
• 9a40d12 Avoid reloading root certificates to improve concurrent performance (#6667)
• 0c030f7 Merge pull request #6702 from nateprewitt/no_char_detection
• 555b870 Allow character detection dependencies to be optional in post-packaging steps
• d6dded3 Merge pull request #6700 from franekmagiera/update-redirect-to-invalid-uri-test
• Additional commits viewable in compare view

Updates lxml from 4.1.0 to 4.9.1

Changelog

Sourced from lxml's changelog.

4.9.1 (2022-07-01)

Bugs fixed

• A crash was resolved when using iterwalk() (or canonicalize()) after parsing certain incorrect input. Note that iterwalk() can crash on valid input parsed with the same parser after failing to parse the incorrect input.

4.9.0 (2022-06-01)

Bugs fixed

• GH#341: The mixin inheritance order in lxml.html was corrected. Patch by xmo-odoo.

Other changes

• Built with Cython 0.29.30 to adapt to changes in Python 3.11 and 3.12.

• Wheels include zlib 1.2.12, libxml2 2.9.14 and libxslt 1.1.35 (libxml2 2.9.12+ and libxslt 1.1.34 on Windows).

• GH#343: Windows-AArch64 build support in Visual Studio. Patch by Steve Dower.

4.8.0 (2022-02-17)

Features added

• GH#337: Path-like objects are now supported throughout the API instead of just strings. Patch by Henning Janssen.

• The ElementMaker now supports QName values as tags, which always override the default namespace of the factory.

Bugs fixed

• GH#338: In lxml.objectify, the XSI float annotation "nan" and "inf" were spelled in lower case, whereas XML Schema datatypes define them as "NaN" and "INF" respectively.

... (truncated)

Commits

• d01872c Prevent parse failure in new test from leaking into later test runs.
• d65e632 Prepare release of lxml 4.9.1.
• 86368e9 Fix a crash when incorrect parser input occurs together with usages of iterwa...
• 50c2764 Delete unused Travis CI config and reference in docs (GH-345)
• 8f0bf2d Try to speed up the musllinux AArch64 build by splitting the different CPytho...
• b9f7074 Remove debug print from test.
• b224e0f Try to install 'xz' in wheel builds, if available, since it's now needed to e...
• 897ebfa Update macOS deployment target version from 10.14 to 10.15 since 10.14 starts...
• 853c9e9 Prepare release of 4.9.0.
• d3f77e6 Add a test for https://bugs.launchpad.net/lxml/+bug/1965070 leaving out the a...
• Additional commits viewable in compare view

Updates libtaxii from 1.1.107 to 1.1.118

Release notes

Sourced from libtaxii's releases.

Version 1.1.118

This release includes the following changes:

#247 [CVE-2020-27197] Avoid SSRF on parsing XML (@​orsinium)

Version 1.1.117

This release includes the following changes:

• #244 SSL Verify Server not working correctly (@​motok) (@​nschwane)
• #245 Unicode lxml.etree.SerialisationError on lxml 4.5.0+ (@​advptr)

Version 1.1.116

This release includes the following changes:

• #240 PY3 Compatibility changes for HTTP Response Body (@​nschwane)

Version 1.1.115

This release includes the following changes:

• #239 Convert the HTTP response body to a string type (PY3 this will be bytes) (@​sddj)

Version 1.1.114

This release includes the following changes:

• #237 Support converting dicts to content bindings (@​danielsamuels)
• #238 Provide XMLParser copies instead of reusing the cached instance. Prevents future messages to lose namespace

Version 1.1.113

This release includes the following changes:

• #234 Add ability to load a configuration file when executing a script
• #232 Fix TLS handshake failure when a server requires SNI (@​marcelslotema)

Version 1.1.112

This release includes the following changes:

• #227 Fixes to poll_client script (Python3 compatibility)
• #226 Clean-up documentation warnings
• #228 Fix 'HTTPMessage' has no attribute 'getheader' (Python3 compatibility)
• #225 Fix checks that involve xpath (lxml) to prevent FutureWarning message
• #230 Fix parsing status message round-trip (@​danielsamuels)

Version 1.1.111

• Fix #222, #224 - Update clients.py to work with Python 2.6, 3.3, 3.5, and 3.6.
• Fix #221 - Add Python 3.6 support.
• Fix #219 - Handle Unicode- and byte-strings consistently.
• Fix #214 - Add timeout parameter to call_taxii_service2 (@​mbekavac)
• Fix #192 - Add support for STIX 1.2.
• Add user_agent parameter to call_taxii_service2 (@​kralka)

... (truncated)

Changelog

Sourced from libtaxii's changelog.

1.1.118 (2020-10-19)

(diff) <https://github.com/TAXIIProject/libtaxii/compare/1.1.117...1.1.118>__

• #247 [CVE-2020-27197] Avoid SSRF on parsing XML (@​orsinium)

1.1.117 (2020-05-26)

(diff) <https://github.com/TAXIIProject/libtaxii/compare/1.1.116...1.1.117>__

• #244 SSL Verify Server not working correctly (@​motok) (@​nschwane)
• #245 Unicode lxml.etree.SerialisationError on lxml 4.5.0+ (@​advptr)

1.1.116 (2020-02-14)

(diff) <https://github.com/TAXIIProject/libtaxii/compare/1.1.115...1.1.116>__

• #240 PY3 Compatibility changes for HTTP Response Body (@​nschwane)

1.1.115 (2019-11-12)

(diff) <https://github.com/TAXIIProject/libtaxii/compare/1.1.114...1.1.115>__

• #239 Convert the HTTP response body to a string type (PY3 this will be bytes) (@​sddj)

1.1.114 (2019-07-26)

(diff) <https://github.com/TAXIIProject/libtaxii/compare/1.1.113...1.1.114>__

• #237 Support converting dicts to content bindings (@​danielsamuels)
• #238 Provide XMLParser copies instead of reusing the cached instance. Prevents future messages to lose namespace

1.1.113 (2019-04-11)

(diff) <https://github.com/TAXIIProject/libtaxii/compare/1.1.112...1.1.113>__

• #234 Add ability to load a configuration file when executing a script
• #232 Fix TLS handshake failure when a server requires SNI (@​marcelslotema)

1.1.112 (2018-11-27)

(diff) <https://github.com/TAXIIProject/libtaxii/compare/1.1.111...1.1.112>__

• #227 Fixes to poll_client script (Python3 compatibility)

... (truncated)

Commits

• 12367f7 Bump version: 1.1.117 → 1.1.118
• 1b5ee6c update release notes for 1.1.118
• 23c6f7b Merge pull request #247 from orsinium-forks/fix-ssrf
• 587d180 provide a few simple tests
• d207cc2 check if no protocol specified
• 3c980ed use from_string if no URL allowed
• e8918f0 avoid loading files in some cases
• c8e9c9b Bump version: 1.1.116 → 1.1.117
• 22b3491 update release notes for 1.1.117
• c553627 Merge pull request #245 from emmanvg/243-unicode-serialisation
• Additional commits viewable in compare view

Updates ujson from 1.34 to 5.4.0

Release notes

Sourced from ujson's releases.

5.4.0

Added

• Add support for arbitrary size integers (#548) @​JustAnotherArchivist

Fixed

• CVE-2022-31116:
  • Replace wchar_t string decoding implementation with a uint32_t-based one (#555) @​JustAnotherArchivist
  • Fix handling of surrogates on decoding (#550) @​JustAnotherArchivist
• CVE-2022-31117: Potential double free of buffer during string decoding @​JustAnotherArchivist
• Fix memory leak on encoding errors when the buffer was resized (#549) @​JustAnotherArchivist
• Integer parsing: always detect overflows (#544) @​NaN-git
• Fix handling of surrogates on encoding (#530) @​JustAnotherArchivist

5.3.0

Added

• Test Python 3.11 beta (#539) @​hugovk

Changed

• Benchmark refactor - argparse CLI (#533) @​Erotemic

Fixed

• Fix segmentation faults when errors occur while handling unserialisable objects (#531) @​JustAnotherArchivist
• Fix segmentation fault when an exception is raised while converting a dict key to a string (#526) @​JustAnotherArchivist
• Fix memory leak dumping on non-string dict keys (#521) @​JustAnotherArchivist
• Fix ref counting on repeated default function calls (#524) @​JustAnotherArchivist
• Remove redundant wheel dependency from pyproject.toml (#535) @​hugovk

5.2.0

Added

• Support parsing NaN, Infinity and -Infinity (#514) @​Erotemic
• Support dynamically linking against system double-conversion library (#508) @​musicinmybrain
• Add env var to control stripping debug info (#507) @​musicinmybrain
• Add JSONDecodeError (#498) @​JustAnotherArchivist

Fixed

• Fix buffer overflows (CVE-2021-45958) (#519) @​JustAnotherArchivist
• Upgrade Black to fix Click (#515) @​hugovk
• simplify exception handling on integer overflow (#510) @​RouquinBlanc
• Remove dead code that used to handle the separate int type in Python 2 (#509) @​JustAnotherArchivist
• Fix exceptions on encoding list or dict elements and non-overflow errors on int handling getting silenced (#505) @​JustAnotherArchivist

5.1.0

Changed

... (truncated)

Commits

• 9c20de0 Merge pull request from GHSA-fm67-cv37-96ff
• b21da40 Fix double free on string decoding if realloc fails
• 67ec071 Merge pull request #555 from JustAnotherArchivist/fix-decode-surrogates-2
• bc7bdff Replace wchar_t string decoding implementation with a uint32_t-based one
• cc70119 Merge pull request #548 from JustAnotherArchivist/arbitrary-ints
• 4b5cccc Merge pull request #553 from bwoodsend/pypy-ci
• abe26fc Merge pull request #551 from bwoodsend/bye-bye-travis
• 3efb5cc Delete old TravisCI workflow and references.
• 404de1a xfail test_decode_surrogate_characters() on Windows PyPy.
• f7e66dc Switch to musl docker base images.
• Additional commits viewable in compare view

Updates werkzeug from 0.12.2 to 3.0.6

Release notes

Sourced from werkzeug's releases.

3.0.6

This is the Werkzeug 3.0.6 security fix release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Werkzeug/3.0.6/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-0-6

• Fix how max_form_memory_size is applied when parsing large non-file fields. GHSA-q34m-jh98-gwm2
• safe_join catches certain paths on Windows that were not caught by ntpath.isabs on Python < 3.11. GHSA-f9vj-2wh5-fj8j

3.0.5

This is the Werkzeug 3.0.5 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Werkzeug/3.0.5/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-0-5 Milestone: https://github.com/pallets/werkzeug/milestone/37?closed=1

• The Watchdog reloader ignores file closed no write events. #2945
• Logging works with client addresses containing an IPv6 scope. #2952
• Ignore invalid authorization parameters. #2955
• Improve type annotation fore SharedDataMiddleware. #2958
• Compatibility with Python 3.13 when generating debugger pin and the current UID does not have an associated name. #2957

3.0.4

This is the Werkzeug 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Werkzeug/3.0.4/ Changes: https://werkzeug.palletsprojects.com/en/3.0.x/changes/#version-3-0-4 Milestone: https://github.com/pallets/werkzeug/milestone/36?closed=1

• Restore behavior where parsing multipart/x-www-form-urlencoded data with invalid UTF-8 bytes in the body results in no form data parsed rather than a 413 error. #2930
• Improve parse_options_header performance when parsing unterminated quoted string values. #2904
• Debugger pin auth is synchronized across threads/processes when tracking failed entries. #2916
• Dev server handles unexpected SSLEOFError due to issue in Python < 3.13. #2926
• Debugger pin auth works when the URL already contains a query string. #2918

3.0.3

This is the Werkzeug 3.0.3 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Werkzeug/3.0.3/ Changes: https://werkzeug.palletsprojects.com/en/3.0.x/changes/#version-3-0-3 Milestone: https://github.com/pallets/werkzeug/milestone/35?closed=1

• Only allow localhost, .localhost, 127.0.0.1, or the specified hostname when running the dev server, to make debugger requests. Additional hosts can be added by using the debugger middleware directly. The debugger UI makes requests using the full URL rather than only the path. GHSA-2g68-c3qc-8985
• Make reloader more robust when "" is in sys.path. #2823

... (truncated)

Changelog

Sourced from werkzeug's changelog.

Version 3.0.6

Released 2024-10-25

• Fix how max_form_memory_size is applied when parsing large non-file fields. :ghsa:q34m-jh98-gwm2
• safe_join catches certain paths on Windows that were not caught by ntpath.isabs on Python < 3.11. :ghsa:f9vj-2wh5-fj8j

Version 3.0.5

Released 2024-10-24

• The Watchdog reloader ignores file closed no write events. :issue:2945
• Logging works with client addresses containing an IPv6 scope :issue:2952
• Ignore invalid authorization parameters. :issue:2955
• Improve type annotation fore SharedDataMiddleware. :issue:2958
• Compatibility with Python 3.13 when generating debugger pin and the current UID does not have an associated name. :issue:2957

Version 3.0.4

Released 2024-08-21

• Restore behavior where parsing multipart/x-www-form-urlencoded data with invalid UTF-8 bytes in the body results in no form data parsed rather than a 413 error. :issue:2930
• Improve parse_options_header performance when parsing unterminated quoted string values. :issue:2904
• Debugger pin auth is synchronized across threads/processes when tracking failed entries. :issue:2916
• Dev server handles unexpected SSLEOFError due to issue in Python < 3.13. :issue:2926
• Debugger pin auth works when the URL already contains a query string. :issue:2918

Version 3.0.3

Released 2024-05-05

• Only allow localhost, .localhost, 127.0.0.1, or the specified hostname when running the dev server, to make debugger requests. Additional hosts can be added by using the debugger middleware directly. The debugger

... (truncated)

Commits

• 5eaefc3 release version 3.0.6
• 2767bcb Merge commit from fork
• 87cc78a catch special absolute path on Windows Python < 3.11
• 50cfeeb Merge commit from fork
• 8760275 apply max_form_memory_size another level up in the parser
• 8d6a12e start version 3.0.6
• a7b121a release version 3.0.5 (#2961)
• 9caf72a release version 3.0.5
• e28a245 catch OSError from getpass.getuser (#2960)
• e6b4cce catch OSError from getpass.getuser
• Additional commits viewable in compare view

Updates flask from 0.12.4 to 2.2.5

Release notes

Sourced from flask's releases.

2.2.5

This is a security fix release for the 2.2.x release branch. Note that 2.3.x is the currently supported release branch; please upgrade to the latest version if possible.

• Security advisory: GHSA-m2qf-hxjv-5gpq, CVE-2023-30861
• Changes: https://flask.palletsprojects.com/en/2.2.x/changes/#version-2-2-5
• Milestone: https://github.com/pallets/flask/milestone/30?closed=1

2.2.4

This is a fix release for the 2.2.x release branch.

• Changes: https://flask.palletsprojects.com/en/2.2.x/changes/#version-2-2-4
• Milestone: https://github.com/pallets/flask/milestone/27?closed=1

2.2.3

This is a fix release for the 2.2.x release branch.

• Changes: https://flask.palletsprojects.com/en/2.2.x/changes/#version-2-2-3
• Milestone: https://github.com/pallets/flask/milestone/26?closed=1

2.2.2

This is a fix release for the 2.2.0 feature release.

• Changes: https://flask.palletsprojects.com/en/2.2.x/changes/#version-2-2-2
• Milestone: https://github.com/pallets/flask/milestone/25?closed=1

2.2.1

This is a fix release for the 2.2.0 feature release.

• Changes: https://flask.palletsprojects.com/en/2.2.x/changes/#version-2-2-1
• Milestone: https://github.com/pallets/flask/milestone/23?closed=1

2.2.0

This is a feature release, which includes new features and removes previously deprecated code. The 2.2.x branch is now the supported bug fix branch, the 2.1.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades.

• Changes: https://flask.palletsprojects.com/en/2.2.x/changes/#version-2-2-0
• Milestone: https://github.com/pallets/flask/milestone/19?closed=1

2.1.3

• Changes: https://flask.palletsprojects.com/en/2.1.x/changes/#version-2-1-3
• Milestone: https://github.com/pallets/flask/milestone/22?closed=1

2.1.2

This is a fix release for the 2.1.0 feature release.

• Changes: https://flask.palletsprojects.com/en/2.1.x/changes/#version-2-1-2
• Milestone: https://github.com/pallets/flask/milestone/21?closed=1

2.1.1

This is a fix release for the 2.1.0 feature release.

... (truncated)

Changelog

Sourced from flask's changelog.

Version 2.2.5

Released 2023-05-02

• Update for compatibility with Werkzeug 2.3.3.
• Set Vary: Cookie header when the session is accessed, modified, or refreshed.

Version 2.2.4

Released 2023-04-25

• Update for compatibility with Werkzeug 2.3.

Version 2.2.3

Released 2023-02-15

• Autoescape is enabled by default for .svg template files. :issue:4831
• Fix the type of template_folder to accept pathlib.Path. :issue:4892
• Add --debug option to the flask run command. :issue:4777

Version 2.2.2

Released 2022-08-08

• Update Werkzeug dependency to >= 2.2.2. This includes fixes related to the new faster router, header parsing, and the development server. :pr:4754
• Fix the default value for app.env to be "production". This attribute remains deprecated. :issue:4740

Version 2.2.1

Released 2022-08-03

• Setting or accessing json_encoder or json_decoder raises a deprecation warning. :issue:4732

Version 2.2.0

... (truncated)

Commits

• 47af817 release version 2.2.5
• afd63b1 Merge pull request #5109 from pallets/backport-vary-cookie
• 8646edc set Vary: Cookie header consistently for session
• a6367da Merge pull request #5108 from pallets/werkzeug-compat
• 3fbfbad werkzeug 2.3.3 compatibility
• 726d3f4 start version 2.2.5
• ddc7acc Merge pull request #5081 from pallets/release-2.2.4
• 74e0329 release version 2.2.4
• 2d46068 update dev env
• 64bc458 update dev dependencies
• Additional commits viewable in compare view

Updates gunicorn from 19.5.0 to 22.0.0

Release notes

Sourced from gunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17
===================

use utime to notify workers liveness
migrate setup to pyproject.toml
fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
parsing additional requests is no longer attempted past unsupported request framing
on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
Trailer fields are no longer inspected for headers indicating secure scheme
support Python 3.12

** Breaking changes **

minimum version is Python 3.7
the limitations on valid characters in the HTTP method have been bounded to Internet Standards
requests specifying unsupported transfer coding (order) are refused by default (rare)
HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
HTTP methods containing the number sign (#) are no longer accepted by default (rare)
HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)

** SECURITY **

fix CVE-2024-1135

1. Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
2. Packages: https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023-07-19
===================
fix thread worker: revert change considering connection as idle .
</tr></table> 

... (truncated)

Commits

• f63d59e bump to 22.0
• 4ac81e0 Merge pull request #3175 from e-kwsm/typo
• 401cecf Merge pull request #3179 from dhdaines/exclude-eventlet-0360
• 0243ec3 fix(deps): exclude eventlet 0.36.0
• 628a0bc chore: fix typos
• 88fc4a4 Merge pull request #3131 from pajod/patch-py12-rebased
• deae2fc CI: back off the agressive timeout
• f470382 docs: promise 3.12 compat
• 5e30bfa add changelog to project.urls (updated for PEP621)
• 481c3f9 remove setup.cfg - overridden by pyproject.toml
• Additional commits viewable in compare view

Updates psutil from 3.1.1 to 5.6.6

Chan...

Description has been truncated