Changelog:
============
- SECURITY FIX CVE-2025-14550
- Fixed a regression in 3.11.0 in "sync_to_async" when wrapping a callable
with an attribute named "context".
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 4.7.1:
- Add controls for verify_sub option in PyJWT
From release 4.7.0:
- Drop support for python 3.7 and 3.8, add 3.13
- Fix documentation around identity needing to be a string
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 3.0.1:
- Fix link rendering in readme
- Fix handling of _version.py file
From release 3.0.0:
- Support Flask 3.0+ and PyMongo 4.0+.
- Support Python 3.9-3.13.
- Support MongoDB 4.4+.
- Add support for ~flask.json.jsonify().
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 6.0.2:
- Update license pyproject.toml
From 6.0.1:
- Invert regex sorting to make it correctly match the intent
(sorting by specificity descending)
- Fix README file extension in pyproject.toml
From 6.0.0:
- [CVE-2024-6839] Sort Paths by Regex Specificity
- [CVE-2024-6844] Replace use of (urllib) unquote_plus with unquote
- [CVE-2024-6866] Case Sensitive Request Path Matching
License-Update: Use line 6 from PKG-INFO
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 1.4.0:
- Add missing commas in error message for validate.FileType
- Support Python 3.10-3.14
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 3.1.3:
- The session is marked as accessed for operations that only access
the keys but not the values, such as in and len.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 4.1.0:
- Accept arguments such as --directory in environment variables
- Fix minor typos in documentation
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 0.10.0:
- Drop support for Python < 3.8.
- Use pyproject.toml for packaging metadata.
- Use flit_core as build backend.
- Apply code formatting and linting tools.
- Add static type annotations.
- Deprecate the __version__ attribute. Use feature detection or
importlib.metadata.version("flask-mail") instead.
- Indicate that the deprecated is_bad_headers will be removed in
the next version.
- Fix the email_dispatched signal to pass the current app as the
sender and message as an argument, rather than the other way around.
- Attachment.data may not be None.
- Attachment.content_type will be detected based on filename and
data and will not be None.
License-Update: Use LICENSE.txt
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Contains fix for CVE-2026-27199
Changelog: safe_join on Windows does not allow special devices names in multi-segment paths
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 25.1.0:
- Control Interface (gunicornc): Add interactive control interface
for managing running Gunicorn instances, similar to birdc for
BIRD routing daemon
- Unix socket-based communication with JSON protocol
- Interactive mode with readline support and command history
- Commands: show all/workers/dirty/config/stats/listeners
- Worker management: worker add/remove/kill, dirty add/remove
- Server control: reload, reopen, shutdown
- New settings: --control-socket, --control-socket-mode,
--no-control-socket
- New CLI tool: gunicornc for connecting to control socket
- Dirty Stash: Add global shared state between workers via dirty.stash
- In-memory key-value store accessible by all workers
- Supports get, set, delete, clear, keys, and has operations
- Useful for sharing state like feature flags, rate limits, or
cached data
- Dirty Binary Protocol: Implement efficient binary protocol for
dirty arbiter IPC using TLV (Type-Length-Value) encoding
- More efficient than JSON for binary data
- Supports all Python types: str, bytes, int, float, bool, None,
list, dict
- Better performance for large payloads
- Dirty TTIN/TTOU Signals: Add dynamic worker scaling for dirty
arbiters
- Send SIGTTIN to increase dirty workers
- Send SIGTTOU to decrease dirty workers
- Respects minimum worker constraints from app configurations
- ASGI Worker: Promoted from beta to stable
- Dirty Arbiters: Now marked as beta feature
License-Update: Update years
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 8.0.0:
- Update CHANGELOG for version 8.0.0
- Fix edge case of __future__ import
- Fix the Plone profile to be compatible with black
- Remove the setuptools plugin
- Turn some warnings into errors in test suite
- chore: replace black with ruff in clean.sh
- feat!: remove old finders flag and legacy finder logic
- Fix whitespace insensitive check triggering on tabs
- Fix line separator detection not considering form feed as white space
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 1.4.0:
- Support underscores as digit separators per PEP 515
- Add rationals converter for mpf's
- Rewrite bernpoly/eulerpoly to avoid dependency on bernoulli(1)
convention
- Support base kwarg for from_str()
- Support randmatrix() for mp.iv and mp contexts
- Added rank() function for matrices
- Add plus flag to select the B_1 sign convention for
bernoulli/bernfrac
- Add mpf.as_integer_ratio() method, support construction of mpf
from Decimal objects
- Expose lower/upper_gamma functions
- Support mpc initialization from string
- Support asinh/acosh/atanh in the fp context
- Support binary/octal/hexadecimal string output
- Support pickling for matrices and mpi
- Support matrix.__array__() dunder method
- Support more number syntaxes
- Run mpmath as a module for interactive work
- Add signed option to to_man_exp()
- Add fp.hypot
- Support inf/nan's in ctx.almosteq()
- Implement mpf.__format__()
- Support conversion from scalar ndarray's
- Support rounding modes in mpf.__format__
- Support '%' presentation type for mpf
- Support gmpy2-like rounding modes in to_str()
- Implement 'a'/'A' formating types for mpf.__format__
- Add mpc.__format__()
- Now mpf.__round__() returns mpf
- Support 'b' (binary) format type for mpf/mpc
- Implement mpf.__floordiv__() and mpf.__divmod__()
- Add parameters for MPContext constructor
- Add MPFR-compatible aliases for rounding modes
- Support negative indexes in matrix
- Better introspection support for decorated functions
- Add moving sofa demo
- Support spherical Bessel functions (jn/yn)
- Add pretty_dps context property to control number of printed digits
- Support thousands separators for formatting of fractional part
- Use PyREPL, as fallback (no IPython)
- Add exp2() and log2()
- Support rounding property for the mp context
- Add Fox H-function with rational A/B parameters (foxh())
- Provide experimental support for free-threading builds
License-Update: Update years
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 1.9.3:
- Drop support for Python 3.8 and raise setuptools version to 77.0
- Use an SPDX license
- Fix memory leaks
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 5.7.0:
- Add typing classifier
- Enable logging related ruff checks to extend the enforced format
rules related to logging.
- Delay string interpolations at logging calls
- Remove reference to tag framework because the framework was
removed.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 5.6.0:
- Use Flask test client's own environ dict if it is available
- Add Python 3.13, 3.14 and pypy-3.11 to CI builds, drop 3.8 and 3.9
- Documentation: Added an example using the init_app() method
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 4.13.1:
- Document that a process can have only one custom JSON module
- Switch to Furo documentation template
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 4.1.0:
- Add support for equality constraints (``==``, ``!=``) in inference.
- Ensure ``ast.JoinedStr`` nodes are ``Uninferable`` when the
``ast.FormattedValue`` is ``Uninferable``. This prevents
``unexpected-keyword-arg`` messages in Pylint where the
``Uninferable`` string appeared in function arguments that were
constructed dynamically.
- Add support for type constraints (`isinstance(x, y)`) in inference.
- Make `type.__new__()` raise clear errors instead of returning `None`.
- Move object dunder methods from ``FunctionModel`` to ``ObjectModel``
to make them available on all object types, not just functions.
- ``lineno`` and ``end_lineno`` are now available on ``Arguments``.
- Add helper to iterate over all annotations nodes of function
arguments, ``Arguments.get_annotations()``.
- Skip direct parent when determining the ``Decorator`` frame.
- Add simple command line interface for astroid to output generated
AST. Use with ``python -m astroid``.
- Fix incorrect type inference for ``super().method()`` calls that
return ``Self``. Previously, astroid would infer the parent class
type instead of the child class type, causing pylint E1101 false
positives in method chaining scenarios.
- Add missing ``dtype`` and ``casting`` parameters to
``numpy.concatenate`` brain.
- Fix ``random.sample`` inference crash when sequence contains
uninferable elements.
- Fix ``random.sample`` crash when cloning ``ClassDef`` or
``FunctionDef`` nodes.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 8.22.1:
- Fix float16 pack/unpack on big-endian systems
- Compile wheels for Inten macOS and Windows ARM
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 2.6.0:
- new: TLS support (TELNETS). open_connection() accepts an ssl
parameter (True, or an ssl.SSLContext). create_server() accepts
an ssl parameter (ssl.SSLContext). New CLI options: --ssl,
--ssl-cafile, --ssl-no-verify for telnetlib3-client;
--ssl-certfile, --ssl-keyfile and --tls-auto for telnetlib3-server
- new: the default server shell now displays Ready (secure: TLSv1.3)
for TLS connections (the protocol version shown is negotiated
dynamically).
- bugfix: telnetlib3-client now sets terminal mode to the server's
preference via WILL ECHO and WILL SGA negotiation. Use --raw-mode
to restore legacy raw mode for servers that don't negotiate.
- bugfix: telnetlib3-client declines MUD protocol options (GMCP,
MSDP, MSSP, MSP, MXP, ZMP, AARDWOLF, ATCP) by default. Use
--always-do or --always-will to opt in.
- bugfix: log output "staircase text" in raw terminal mode.
- bugfix: graceful EOF handling - connection close no longer prints
a traceback.
Fixes:
WARNING: python3-telnetlib3-2.6.0-r0 do_check_backend: QA Issue:
inherits setuptools3 but has pyproject.toml with hatchling.build,
use the correct class [pep517-backend]
License-Update: Remove garbage characters from ISC license text
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 0.8.6:
- Switch the type checker to Zuban. It's faster and now also checks
untyped code.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Rate limiting for flask applications. Add recipe for release 4.1.1:
- Ensure cli commands fail gracefully when cli dependencies
are not installed.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Rate limiting utilities. Add recipe for release 5.8.0:
- Allow explicit keyword arguments for storage options for
username & password for storages that support it.
- Allow explicitly specifying startup_nodes through keyword
arguments for all redis cluster storages.
- Support IPv6 addresses in cluster locators in storage URI
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 3.24.2:
- docs: restructure using Diataxis framework
- fix(test): resolve flaky write non-starvation test
- fix(rw): close sqlite3 cursors and skip SoftFileLock Windows race
License-Update: Move from Unlicense to MIT
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 0.17.3:
- Fix bug with resources
- Fix VA/RVA confusion in the PE's builder
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 0.33.0:
Bugfixes:
- Start supporting Android's new "android" sys.platform.
Deprecations and removals:
- Both trio.testing.RaisesGroup and trio.testing.Matcher have
been deprecated. Pytest alternatives pytest.RaisesGroup and
pytest.RaisesExc (respectively) are considered correct
replacement.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 13.0.1:
- Check for listener's existence before attempting to remove it
- Update pytest configuration to support pytest 9
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade to release 4.5.0:
- Restored the check_argument_types() and check_return_type()
functions that were dropped in v3.0.0, for users who want more
fine-grained control over run-time type checking
- Added support for extra_items in TypedDict, allowing users to
specify the types for the values of "leftover" keys in a typed
dict (keys that weren't explicitly defined in the TypedDict subclass)
- Fixed NameError when evaluating forward references on Python 3.14
- Fixed protocol check incorrectly rejecting inherited classmethods
and staticmethods
- Fixed missing TypeCheckError when checking TypedDict with
Required[...] annotations
- Fixed type aliases (e.g. type Foo = list[int]) not being resolved
during type checking
- Fixed type-checked assignments to a single tuple target
(e.g. x, = ("foo",)) falsely raising TypeCheckedError
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The resulting pybind11_jsonTargets.cmake in the dev-package adds an
absolute path to python include directories in the target properties:
set_target_properties(pybind11_json PROPERTIES
INTERFACE_INCLUDE_DIRECTORIES "/usr/include/python3.13;${_IMPORT_PREFIX}/include"
)
The patch removes ${PYTHON_INCLUDE_DIRS} which is set by pybind11 from
set_target_properties to remove the poisonous host path.
Signed-off-by: Tafil Avdyli <tafil@tafhub.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Some new tests expect the PWD to be writable, however this is not the case
when running the tests in $PTEST_PATH with a non-root user. This patch
makes it writable.
Ptests passed, however there is a flaky test. Upstream has a bug[1]
about it:
Ran 18651 tests in 144.573s
OK (skipped=1396, expected failures=5)
Changes:
Contains fixes for CVE-2025-13473, CVE-2025-14550, CVE-2026-1207,
CVE-2026-1285, CVE-2026-2187 and CVE-2026-1312
[1]: https://code.djangoproject.com/ticket/36770
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Dropped patch that is included in this release.
Ptests passed:
Ran 18131 tests in 450.882s
OK (skipped=1389, expected failures=5)
Changelog:
5.2.11:
Contains fixes for CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285,
CVE-2026-1287 and CVE-2026-1312
5.2.10:
* Fixed a bug in Django 5.2 where data exceeding max_length was silently
truncated by QuerySet.bulk_create on PostgreSQL.
* Fixed a bug where management command colorized help (introduced in
Python 3.14) ignored the --no-color option and the DJANGO_COLORS setting.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
