rdmo icon indicating copy to clipboard operation
rdmo copied to clipboard

Published 20 hours ago • verified publisher icon rdmorganiser

build(deps): bump the optional group with 3 updates

Open dependabot[bot] opened this issue 10 months ago • 0 comments

Updates the requirements on django-allauth, coveralls and gunicorn to permit the latest version. Updates django-allauth to 0.62.1

Changelog

Sourced from django-allauth's changelog.

0.62.1 (2024-04-24)

  • The tests package was accidentally packaged, fixed.

0.62.0 (2024-04-22)

Note worthy changes

  • Added a dummy provider, useful for testing purposes: allauth.socialaccount.providers.dummy.

  • Added a new provider, Atlassian

  • Next URL handling been streamlined to be consistently applied. Previously, the password reset, change and email confirmation views only supported the success_url class-level property.

  • Added support for logging in by email using a special code, also known as "Magic Code Login"

  • Email addresses are now always stored as lower case. For rationale, see the note about email case sensitivity in the documentation.

  • You can now alter the state parameter that is typically passed to the provider by overriding the new generate_state_param() adapter method.

  • The URLs were not "hackable". For example, while /accounts/login/ is valid /accounts/ was not. Similarly, /accounts/social/connections/ was valid, but /accounts/social/ resulted in a 404. This has been addressed. Now, /accounts/ redirects to the login or email management page, depending on whether or not the user is authenticated. All /accounts/social/* URLs are now below /accounts/3rdparty/*, where /accounts/social/connections is moved to the top-level /accounts/3rdparty/. The old endpoints still work as redirects are in place.

  • Added a new setting, SOCIALACCOUNT_ONLY, which when set to True, disables all functionality with respect to local accounts.

  • The OAuth2 handshake was not working properly in case of SESSION_COOKIE_SAMESITE = "Strict", fixed.

  • Facebook: the default Graph API version is now v19.0.

Backwards incompatible changes

... (truncated)

Commits
  • 7ab2877 docs(ChangeLog): Add mising note
  • 10ab6b0 chore: Release 0.62.1
  • e561e76 fix(setup): Don't install tests
  • 1a4ee1d fix(ChangeLog): Release date
  • 025e27d chore: Release 0.62.0
  • d2a2086 chore(i18n): Translated using Weblate (Spanish)
  • bc59288 chore(templates): Quotation change
  • 6174acc refactor(account): send_unknown_account_mail()
  • af716e2 feat(core): render_url()
  • e2000b8 refactor(socialaccount): provider.sub_id
  • Additional commits viewable in compare view

Updates coveralls to 4.0.0

Release notes

Sourced from coveralls's releases.

4.0.0 (2024-04-29)

BREAKING CHANGES

When config.ignore_errors is Falsey, failures to parse Pyhton files or look up file sources will now interrupt and early exit collection, which matches default coverage behaviour. Previously, we had manually muted these errors and/or only errored after collecting multiple failures.

Features

Bug Fixes

Internal

Changelog

Sourced from coveralls's changelog.

4.0.0 (2024-04-29)

BREAKING CHANGES

When config.ignore_errors is Falsey, failures to parse Pyhton files or look up file sources will now interrupt and early exit collection, which matches default coverage behaviour. Previously, we had manually muted these errors and/or only errored after collecting multiple failures.

Features

Bug Fixes

Internal

3.3.1 (2021-11-11)

Bug Fixes

Internal

  • exclude a few incompatible coverage versions (#337)

coverage versions v6.0.0 through v6.1.1 exhibited some incompatibilies with coveralls; we've updated our version compatibility ranges to exclude those versions.

3.3.0 (2021-11-04)

Features

... (truncated)

Commits
  • ba25cca chore(release): bump version
  • 44e9563 fix(gha): s/github-actions/github/ (#427)
  • d541af2 chore(deps): update dependency pytest to v8.2.0
  • 677ca22 chore(deps): update dependency pytest to v8.1.2
  • f8fb635 chore(deps): update node.js to v22 (#425)
  • 962e224 feat(deps): support coverage[toml] reports by default
  • 05bb20d docs(tox): update passenv examples for tox3 and tox4 (#371)
  • 2290b04 chore(repo): fixup assignees in issue templates
  • f218ec9 chore(repo): add more specifics to issue template(s)
  • d545d86 refactor(coverage): use more of the coverage public interface (#421)
  • Additional commits viewable in compare view

Updates gunicorn to 22.0.0

Release notes

Sourced from gunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17
===================

    

  • use utime to notify workers liveness
    • 

  • migrate setup to pyproject.toml
    • 

  • fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
    • 

  • parsing additional requests is no longer attempted past unsupported request framing
    • 

  • on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
    • 

  • requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
    • 

  • Trailer fields are no longer inspected for headers indicating secure scheme
    • 

  • support Python 3.12
    • 



** Breaking changes **


    

  • minimum version is Python 3.7
    • 

  • the limitations on valid characters in the HTTP method have been bounded to Internet Standards
    • 

  • requests specifying unsupported transfer coding (order) are refused by default (rare)
    • 

  • HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
    • 

  • HTTP methods containing the number sign (#) are no longer accepted by default (rare)
    • 

  • HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
    • 

  • HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
    • 

  • HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
    • 

  • HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
    • 

  • requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
    • 

  • empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)
    • 



** SECURITY **


    

  • fix CVE-2024-1135
  1. Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
  2. Packages: https://pypi.org/project/gunicorn/
Commits
  • f63d59e bump to 22.0
  • 4ac81e0 Merge pull request #3175 from e-kwsm/typo
  • 401cecf Merge pull request #3179 from dhdaines/exclude-eventlet-0360
  • 0243ec3 fix(deps): exclude eventlet 0.36.0
  • 628a0bc chore: fix typos
  • 88fc4a4 Merge pull request #3131 from pajod/patch-py12-rebased
  • deae2fc CI: back off the agressive timeout
  • f470382 docs: promise 3.12 compat
  • 5e30bfa add changelog to project.urls (updated for PEP621)
  • 481c3f9 remove setup.cfg - overridden by pyproject.toml
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

dependabot[bot] avatar May 01 '24 00:05 dependabot[bot]