build(deps): bump dnspython from 2.6.1 to 2.9.0 in /samples/server/petstore/python-fastapi

Closed
DE
3d ago
+1-1

Bumps dnspython from 2.6.1 to 2.9.0.

Release notes

Sourced from dnspython's releases.

dnspython 2.9.0

This release fixes a potential excessive CPU consumption issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

dnspython 2.8.0

See What's New for details.

The minimum supported version of Python is 3.10.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

dnspython 2.7.0

See What's New for details.

The minimum supported version of Python is 3.9.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.

Changelog

Sourced from dnspython's changelog.

2.9.0

  • Decompression chain length is limited to 16. Prior to this change, a maliciously crafted DNS message could cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications which processed untrusted DNS wire form messages with dnspython could be degraded or DoS'd by the extra CPU use required.

    Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos for finding and reporting this issue.

    See https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m

  • Httpx2 has replaced httpx for HTTPS TCP connections.

  • The minimum supported Python version is now 3.11.

  • DNSSEC now supports ML-DSA-44, a post-quantum signature algorithm.

  • The NSEC3 Next Hashed Owner Name in presentation format is now decoded as base32hex (RFC 5155 Section 1.3, RFC 4648 Extended Hex Alphabet). The letters W, X, Y, and Z are not in that alphabet; they used to be accepted and silently decoded to a different owner name, so to_text of the result did not match the input. They are now rejected.

  • The NID and L64 node/locator ids in presentation format are now rejected when a group contains anything other than hex digits. A sign or underscore, which int() silently accepts, produced a record whose text form did not parse back the same way (RFC 6742).

  • Rdata of a known type in the generic \# syntax, such as an NS record in a zone file, no longer fails to parse when it contains a name under the origin. Its names are relativized as in the type's own text form.

  • The SVCB and HTTPS ech parameter value must now be an ECHConfigList with a correct length prefix and at least 4 octets of content (RFC 9848, RFC 9849). The individual ECHConfig structures are not checked.

  • SVCB and HTTPS SvcParamKeys in presentation format, including those listed in mandatory, must now be spelled as RFC 9460 requires: 1-63 lowercase letters, digits, or hyphens. Uppercase keys such as ALPN and keys with underscores such as no_default_alpn are rejected.

  • SVCB and HTTPS presentation format parsing now follows the escaping rules of RFC 9460. SvcParamKeys may not contain escapes (e.g. \097lpn=h2), and in comma-separated values (alpn, docpath) only \, and \\ are valid escapes after character-string decoding (e.g. alpn="h2\\x" is rejected).

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Updates dnspython to 2.9.0 in the python-fastapi sample requirements, fixing a potential excessive CPU consumption issue in DNS name decompression (GHSA-45c3-73f7-pv4m).

Note that dnspython 2.9.0 requires Python 3.11 or newer.