#25669 build(deps): bump dnspython from 2.9.0 to 2.9.2 in /samples/server/petstore/python-fastapi

Sourced from dnspython's releases.

dnspython 2.9.2

A malicious WKS record in text format can consume excessive memory and CPU when parsed, possibly causing the process to exit due to memory exhaustion. Thanks to Jace (GitHub @​manus-use) for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

dnspython 2.9.1

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

Sourced from dnspython's changelog.

2.9.2

• A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion. Thanks to Jace (GitHub @​manus-use) for discovering and reporting this issue.

2.9.1

• LOC text parsing now converts the altitude, size, horizontal precision, and vertical precision fields to centimeters exactly, and requires them to be decimal numbers of meters with at most two fractional digits, as RFC 1876 section 3 specifies. They were converted with float(), so 9.29m became 928 cm rather than 929 cm and the text and wire forms of the record disagreed, forms such as 1e3m, 1_000m, +10m, nanm, and infm were accepted, extra fractional digits were silently dropped, and an altitude outside the representable range was accepted and then failed in to_wire() with a non-DNS exception. dns.exception.SyntaxError is now raised for all of these.

• The resolver now assigns a new random query id to every query.

• For transports that require a 0 query id, set it in a way that does not break TSIG.

• dns.message.QueryMessage.resolve_chaining() now caps the minimum TTL of a negative response with no SOA record at 300 seconds (dns.message.NEGATIVE_TTL_WITHOUT_SOA). Previously the TTL was left at its initial value of 2^32 - 1, so a single NXDOMAIN or NODATA response with no SOA, e.g. a spoofed one, stayed in the resolver cache for the life of the process.

• DNSSEC validation now rejects an RRSIG whose type covered or class does not match the RRset, as RFC 4035 section 5.3.1 requires. This was not checked, so a revoked DNSKEY, which may only validate the DNSKEY RRset, still validated any RRset signed with its private key if the RRSIG claimed to cover DNSKEY.

• dns.tokenizer.Tokenizer now ends a line at a carriage return, or at a carriage return followed by a line feed, unless the carriage return is in a quoted string. The carriage return of CRLF line ends used to stay in the last token of each line and in the text of a comment, so e.g. dns.zone.from_text() rejected a zone with CRLF line ends.

• DNSSEC validation no longer uses a DNSKEY with the REVOKE flag set to validate anything other than the DNSKEY RRset. RFC 5011 section 2.1 says a revoked key must not be used for any other purpose, but it was a candidate key like any other, so as long as the revoked key was still published, data signed with its private key, e.g. by whoever compromised it, validated.

... (truncated)

• 854bedd bump README.md version
• 388db14 Constrain WKS bitmap size.
• 7e1832f version bump
• dddd69c black lint
• 185cc38 release prep
• cf22838 Randomize the id of every message the resolver sends. (#1395)
• e0fce7f use a short negative TTL for a negative answer with no SOA in resolve_chainin...
• ad0803c check the RRSIG type covered and class against the RRset (#1388)
• 8c38a04 Strictly apply RFC 3597 compression rules when decompressing. (#1383)
• ab5ade8 end a line at a carriage return in the tokenizer (#1387)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.