Update dependency aiohttp to v3.7.4 #2

dev-mend-for-github-com · 2024-06-16T11:58:35Z

This PR contains the following updates:

Package	Update	Change
aiohttp	minor	`==3.5.3` -> `==3.7.4`

By merging this PR, the issue #5 will be automatically resolved and closed:

Severity	CVSS Score	CVE
Low	3.1	CVE-2021-21330

Release Notes

aio-libs/aiohttp (aiohttp)

`v3.7.4`

Compare Source

========================

Misc

Bumped upper bound of the chardet runtime dependency
to allow their v4.0 version stream.
#5366 <https://github.com/aio-libs/aiohttp/issues/5366>_

`v3.7.3`

Compare Source

==================

Features

Use Brotli instead of brotlipy
#3803 <https://github.com/aio-libs/aiohttp/issues/3803>_
Made exceptions pickleable. Also changed the repr of some exceptions.
#4077 <https://github.com/aio-libs/aiohttp/issues/4077>_

Bugfixes

Raise a ClientResponseError instead of an AssertionError for a blank
HTTP Reason Phrase.
#3532 <https://github.com/aio-libs/aiohttp/issues/3532>_
Fix web_middlewares.normalize_path_middleware behavior for patch without slash.
#3669 <https://github.com/aio-libs/aiohttp/issues/3669>_
Fix overshadowing of overlapped sub-applications prefixes.
#3701 <https://github.com/aio-libs/aiohttp/issues/3701>_
Make BaseConnector.close() a coroutine and wait until the client closes all connections. Drop deprecated "with Connector():" syntax.
#3736 <https://github.com/aio-libs/aiohttp/issues/3736>_
Reset the sock_read timeout each time data is received for a aiohttp.client response.
#3808 <https://github.com/aio-libs/aiohttp/issues/3808>_
Fixed type annotation for add_view method of UrlDispatcher to accept any subclass of View
#3880 <https://github.com/aio-libs/aiohttp/issues/3880>_
Fixed querying the address families from DNS that the current host supports.
#5156 <https://github.com/aio-libs/aiohttp/issues/5156>_
Change return type of MultipartReader.aiter() and BodyPartReader.aiter() to AsyncIterator.
#5163 <https://github.com/aio-libs/aiohttp/issues/5163>_
Provide x86 Windows wheels.
#5230 <https://github.com/aio-libs/aiohttp/issues/5230>_

Improved Documentation

Add documentation for aiohttp.web.FileResponse.
#3958 <https://github.com/aio-libs/aiohttp/issues/3958>_
Removed deprecation warning in tracing example docs
#3964 <https://github.com/aio-libs/aiohttp/issues/3964>_
Fixed wrong "Usage" docstring of aiohttp.client.request.
#4603 <https://github.com/aio-libs/aiohttp/issues/4603>_
Add aiohttp-pydantic to third party libraries
#5228 <https://github.com/aio-libs/aiohttp/issues/5228>_

Misc

#4102 <https://github.com/aio-libs/aiohttp/issues/4102>_

`v3.7.2`

Compare Source

==================

Bugfixes

Fixed static files handling for loops without .sendfile() support
#5149 <https://github.com/aio-libs/aiohttp/issues/5149>_

`v3.7.1`

Compare Source

==================

Bugfixes

Fixed a type error caused by the conditional import of Protocol.
#5111 <https://github.com/aio-libs/aiohttp/issues/5111>_
Server doesn't send Content-Length for 1xx or 204
#4901 <https://github.com/aio-libs/aiohttp/issues/4901>_
Fix run_app typing
#4957 <https://github.com/aio-libs/aiohttp/issues/4957>_
Always require typing_extensions library.
#5107 <https://github.com/aio-libs/aiohttp/issues/5107>_
Fix a variable-shadowing bug causing ThreadedResolver.resolve to
return the resolved IP as the hostname in each record, which prevented
validation of HTTPS connections.
#5110 <https://github.com/aio-libs/aiohttp/issues/5110>_
Added annotations to all public attributes.
#5115 <https://github.com/aio-libs/aiohttp/issues/5115>_
Fix flaky test_when_timeout_smaller_second
#5116 <https://github.com/aio-libs/aiohttp/issues/5116>_
Ensure sending a zero byte file does not throw an exception
#5124 <https://github.com/aio-libs/aiohttp/issues/5124>_
Fix a bug in web.run_app() about Python version checking on Windows
#5127 <https://github.com/aio-libs/aiohttp/issues/5127>_

`v3.7.0`

Compare Source

==================

Features

Response headers are now prepared prior to running on_response_prepare hooks, directly before headers are sent to the client.
#1958 <https://github.com/aio-libs/aiohttp/issues/1958>_
Add a quote_cookie option to CookieJar, a way to skip quotation wrapping of cookies containing special characters.
#2571 <https://github.com/aio-libs/aiohttp/issues/2571>_
Call AccessLogger.log with the current exception available from sys.exc_info().
#3557 <https://github.com/aio-libs/aiohttp/issues/3557>_
web.UrlDispatcher.add_routes and web.Application.add_routes return a list
of registered AbstractRoute instances. AbstractRouteDef.register (and all
subclasses) return a list of registered resources registered resource.
#3866 <https://github.com/aio-libs/aiohttp/issues/3866>_
Added properties of default ClientSession params to ClientSession class so it is available for introspection
#3882 <https://github.com/aio-libs/aiohttp/issues/3882>_
Don't cancel web handler on peer disconnection, raise OSError on reading/writing instead.
#4080 <https://github.com/aio-libs/aiohttp/issues/4080>_
Implement BaseRequest.get_extra_info() to access a protocol transports' extra info.
#4189 <https://github.com/aio-libs/aiohttp/issues/4189>_
Added ClientSession.timeout property.
#4191 <https://github.com/aio-libs/aiohttp/issues/4191>_
allow use of SameSite in cookies.
#4224 <https://github.com/aio-libs/aiohttp/issues/4224>_
Use loop.sendfile() instead of custom implementation if available.
#4269 <https://github.com/aio-libs/aiohttp/issues/4269>_
Apply SO_REUSEADDR to test server's socket.
#4393 <https://github.com/aio-libs/aiohttp/issues/4393>_
Use .raw_host instead of slower .host in client API
#4402 <https://github.com/aio-libs/aiohttp/issues/4402>_
Allow configuring the buffer size of input stream by passing read_bufsize argument.
#4453 <https://github.com/aio-libs/aiohttp/issues/4453>_
Pass tests on Python 3.8 for Windows.
#4513 <https://github.com/aio-libs/aiohttp/issues/4513>_
Add method and url attributes to TraceRequestChunkSentParams and TraceResponseChunkReceivedParams.
#4674 <https://github.com/aio-libs/aiohttp/issues/4674>_
Add ClientResponse.ok property for checking status code under 400.
#4711 <https://github.com/aio-libs/aiohttp/issues/4711>_
Don't ceil timeouts that are smaller than 5 seconds.
#4850 <https://github.com/aio-libs/aiohttp/issues/4850>_
TCPSite now listens by default on all interfaces instead of just IPv4 when None is passed in as the host.
#4894 <https://github.com/aio-libs/aiohttp/issues/4894>_
Bump http_parser to 2.9.4
#5070 <https://github.com/aio-libs/aiohttp/issues/5070>_

Bugfixes

Fix keepalive connections not being closed in time
#3296 <https://github.com/aio-libs/aiohttp/issues/3296>_
Fix failed websocket handshake leaving connection hanging.
#3380 <https://github.com/aio-libs/aiohttp/issues/3380>_
Fix tasks cancellation order on exit. The run_app task needs to be cancelled first for cleanup hooks to run with all tasks intact.
#3805 <https://github.com/aio-libs/aiohttp/issues/3805>_
Don't start heartbeat until writer is set
#4062 <https://github.com/aio-libs/aiohttp/issues/4062>
Fix handling of multipart file uploads without a content type.
#4089 <https://github.com/aio-libs/aiohttp/issues/4089>_
Preserve view handler function attributes across middlewares
#4174 <https://github.com/aio-libs/aiohttp/issues/4174>_
Fix the string representation of ServerDisconnectedError.
#4175 <https://github.com/aio-libs/aiohttp/issues/4175>_
Raising RuntimeError when trying to get encoding from not read body
#4214 <https://github.com/aio-libs/aiohttp/issues/4214>_
Remove warning messages from noop.
#4282 <https://github.com/aio-libs/aiohttp/issues/4282>_
Raise ClientPayloadError if FormData re-processed.
#4345 <https://github.com/aio-libs/aiohttp/issues/4345>_
Fix a warning about unfinished task in web_protocol.py
#4408 <https://github.com/aio-libs/aiohttp/issues/4408>_
Fixed 'deflate' compression. According to RFC 2616 now.
#4506 <https://github.com/aio-libs/aiohttp/issues/4506>_
Fixed OverflowError on platforms with 32-bit time_t
#4515 <https://github.com/aio-libs/aiohttp/issues/4515>_
Fixed request.body_exists returns wrong value for methods without body.
#4528 <https://github.com/aio-libs/aiohttp/issues/4528>_
Fix connecting to link-local IPv6 addresses.
#4554 <https://github.com/aio-libs/aiohttp/issues/4554>_
Fix a problem with connection waiters that are never awaited.
#4562 <https://github.com/aio-libs/aiohttp/issues/4562>_
Always make sure transport is not closing before reuse a connection.

Reuse a protocol based on keepalive in headers is unreliable.
For example, uWSGI will not support keepalive even it serves a
HTTP 1.1 request, except explicitly configure uWSGI with a
--http-keepalive option.

Servers designed like uWSGI could cause aiohttp intermittently
raise a ConnectionResetException when the protocol poll runs
out and some protocol is reused.
#4587 <https://github.com/aio-libs/aiohttp/issues/4587>_
Handle the last CRLF correctly even if it is received via separate TCP segment.
#4630 <https://github.com/aio-libs/aiohttp/issues/4630>_
Fix the register_resource function to validate route name before splitting it so that route name can include python keywords.
#4691 <https://github.com/aio-libs/aiohttp/issues/4691>_
Improve typing annotations for web.Request, aiohttp.ClientResponse and
multipart module.
#4736 <https://github.com/aio-libs/aiohttp/issues/4736>_
Fix resolver task is not awaited when connector is cancelled
#4795 <https://github.com/aio-libs/aiohttp/issues/4795>_
Fix a bug "Aiohttp doesn't return any error on invalid request methods"
#4798 <https://github.com/aio-libs/aiohttp/issues/4798>_
Fix HEAD requests for static content.
#4809 <https://github.com/aio-libs/aiohttp/issues/4809>_
Fix incorrect size calculation for memoryview
#4890 <https://github.com/aio-libs/aiohttp/issues/4890>_
Add HTTPMove to all_.
#4897 <https://github.com/aio-libs/aiohttp/issues/4897>_
Fixed the type annotations in the tracing module.
#4912 <https://github.com/aio-libs/aiohttp/issues/4912>_
Fix typing for multipart __aiter__.
#4931 <https://github.com/aio-libs/aiohttp/issues/4931>_
Fix for race condition on connections in BaseConnector that leads to exceeding the connection limit.
#4936 <https://github.com/aio-libs/aiohttp/issues/4936>_
Add forced UTF-8 encoding for application/rdap+json responses.
#4938 <https://github.com/aio-libs/aiohttp/issues/4938>_
Fix inconsistency between Python and C http request parsers in parsing pct-encoded URL.
#4972 <https://github.com/aio-libs/aiohttp/issues/4972>_
Fix connection closing issue in HEAD request.
#5012 <https://github.com/aio-libs/aiohttp/issues/5012>_
Fix type hint on BaseRunner.addresses (from List[str] to List[Any])
#5086 <https://github.com/aio-libs/aiohttp/issues/5086>_
Make web.run_app() more responsive to Ctrl+C on Windows for Python < 3.8. It slightly
increases CPU load as a side effect.
#5098 <https://github.com/aio-libs/aiohttp/issues/5098>_

Improved Documentation

Fix example code in client quick-start
#3376 <https://github.com/aio-libs/aiohttp/issues/3376>_
Updated the docs so there is no contradiction in ttl_dns_cache default value
#3512 <https://github.com/aio-libs/aiohttp/issues/3512>_
Add 'Deploy with SSL' to docs.
#4201 <https://github.com/aio-libs/aiohttp/issues/4201>_
Change typing of the secure argument on StreamResponse.set_cookie from Optional[str] to Optional[bool]
#4204 <https://github.com/aio-libs/aiohttp/issues/4204>_
Changes ttl_dns_cache type from int to Optional[int].
#4270 <https://github.com/aio-libs/aiohttp/issues/4270>_
Simplify README hello word example and add a documentation page for people coming from requests.
#4272 <https://github.com/aio-libs/aiohttp/issues/4272>_
Improve some code examples in the documentation involving websockets and starting a simple HTTP site with an AppRunner.
#4285 <https://github.com/aio-libs/aiohttp/issues/4285>_
Fix typo in code example in Multipart docs
#4312 <https://github.com/aio-libs/aiohttp/issues/4312>_
Fix code example in Multipart section.
#4314 <https://github.com/aio-libs/aiohttp/issues/4314>_
Update contributing guide so new contributors read the most recent version of that guide. Update command used to create test coverage reporting.
#4810 <https://github.com/aio-libs/aiohttp/issues/4810>_
Spelling: Change "canonize" to "canonicalize".
#4986 <https://github.com/aio-libs/aiohttp/issues/4986>_
Add aiohttp-sse-client library to third party usage list.
#5084 <https://github.com/aio-libs/aiohttp/issues/5084>_

Misc

#2856 <https://github.com/aio-libs/aiohttp/issues/2856>, #4218 <https://github.com/aio-libs/aiohttp/issues/4218>, #4250 <https://github.com/aio-libs/aiohttp/issues/4250>_

`v3.6.3`

Compare Source

==================

Bugfixes

Pin yarl to <1.6.0 to avoid buggy behavior that will be fixed by the next aiohttp
release.

`v3.6.2`

Compare Source

==================

Features

Made exceptions pickleable. Also changed the repr of some exceptions.
#4077 <https://github.com/aio-libs/aiohttp/issues/4077>_
Use Iterable type hint instead of Sequence for Application middleware
parameter. #4125 <https://github.com/aio-libs/aiohttp/issues/4125>_

Bugfixes

Reset the sock_read timeout each time data is received for a
aiohttp.ClientResponse. #3808 <https://github.com/aio-libs/aiohttp/issues/3808>_
Fix handling of expired cookies so they are not stored in CookieJar.
#4063 <https://github.com/aio-libs/aiohttp/issues/4063>_
Fix misleading message in the string representation of ClientConnectorError;
self.ssl == None means default SSL context, not SSL disabled #4097 <https://github.com/aio-libs/aiohttp/issues/4097>_
Don't clobber HTTP status when using FileResponse.
#4106 <https://github.com/aio-libs/aiohttp/issues/4106>_

Improved Documentation

Added minimal required logging configuration to logging documentation.
#2469 <https://github.com/aio-libs/aiohttp/issues/2469>_
Update docs to reflect proxy support.
#4100 <https://github.com/aio-libs/aiohttp/issues/4100>_
Fix typo in code example in testing docs.
#4108 <https://github.com/aio-libs/aiohttp/issues/4108>_

Misc

#4102 <https://github.com/aio-libs/aiohttp/issues/4102>_

`v3.6.1`

Compare Source

==================

Features

Compatibility with Python 3.8.
#4056 <https://github.com/aio-libs/aiohttp/issues/4056>_

Bugfixes

correct some exception string format
#4068 <https://github.com/aio-libs/aiohttp/issues/4068>_
Emit a warning when ssl.OP_NO_COMPRESSION is
unavailable because the runtime is built against
an outdated OpenSSL.
#4052 <https://github.com/aio-libs/aiohttp/issues/4052>_
Update multidict requirement to >= 4.5
#4057 <https://github.com/aio-libs/aiohttp/issues/4057>_

Improved Documentation

Provide pytest-aiohttp namespace for pytest fixtures in docs.
#3723 <https://github.com/aio-libs/aiohttp/issues/3723>_

`v3.6.0`

Compare Source

==================

Features

Add support for Named Pipes (Site and Connector) under Windows. This feature requires
Proactor event loop to work. #3629 <https://github.com/aio-libs/aiohttp/issues/3629>_
Removed Transfer-Encoding: chunked header from websocket responses to be
compatible with more http proxy servers. #3798 <https://github.com/aio-libs/aiohttp/issues/3798>_
Accept non-GET request for starting websocket handshake on server side.
#3980 <https://github.com/aio-libs/aiohttp/issues/3980>_

Bugfixes

Raise a ClientResponseError instead of an AssertionError for a blank
HTTP Reason Phrase.
#3532 <https://github.com/aio-libs/aiohttp/issues/3532>_
Fix an issue where cookies would sometimes not be set during a redirect.
#3576 <https://github.com/aio-libs/aiohttp/issues/3576>_
Change normalize_path_middleware to use '308 Permanent Redirect' instead of 301.

This behavior should prevent clients from being unable to use PUT/POST
methods on endpoints that are redirected because of a trailing slash.
#3579 <https://github.com/aio-libs/aiohttp/issues/3579>_
Drop the processed task from all_tasks() list early. It prevents logging about a
task with unhandled exception when the server is used in conjunction with
asyncio.run(). #3587 <https://github.com/aio-libs/aiohttp/issues/3587>_
Signal type annotation changed from Signal[Callable[['TraceConfig'], Awaitable[None]]] to Signal[Callable[ClientSession, SimpleNamespace, ...].
#3595 <https://github.com/aio-libs/aiohttp/issues/3595>_
Use sanitized URL as Location header in redirects
#3614 <https://github.com/aio-libs/aiohttp/issues/3614>_
Improve typing annotations for multipart.py along with changes required
by mypy in files that references multipart.py.
#3621 <https://github.com/aio-libs/aiohttp/issues/3621>_
Close session created inside aiohttp.request when unhandled exception occurs
#3628 <https://github.com/aio-libs/aiohttp/issues/3628>_
Cleanup per-chunk data in generic data read. Memory leak fixed.
#3631 <https://github.com/aio-libs/aiohttp/issues/3631>_
Use correct type for add_view and family
#3633 <https://github.com/aio-libs/aiohttp/issues/3633>_
Fix keepalive field in slots of RequestHandler.
#3644 <https://github.com/aio-libs/aiohttp/issues/3644>
Properly handle ConnectionResetError, to silence the "Cannot write to closing
transport" exception when clients disconnect uncleanly.
#3648 <https://github.com/aio-libs/aiohttp/issues/3648>_
Suppress pytest warnings due to test_utils classes
#3660 <https://github.com/aio-libs/aiohttp/issues/3660>_
Fix overshadowing of overlapped sub-application prefixes.
#3701 <https://github.com/aio-libs/aiohttp/issues/3701>_
Fixed return type annotation for WSMessage.json()
#3720 <https://github.com/aio-libs/aiohttp/issues/3720>_
Properly expose TooManyRedirects publicly as documented.
#3818 <https://github.com/aio-libs/aiohttp/issues/3818>_
Fix missing brackets for IPv6 in proxy CONNECT request
#3841 <https://github.com/aio-libs/aiohttp/issues/3841>_
Make the signature of aiohttp.test_utils.TestClient.request match
asyncio.ClientSession.request according to the docs #3852 <https://github.com/aio-libs/aiohttp/issues/3852>_
Use correct style for re-exported imports, makes mypy --strict mode happy.
#3868 <https://github.com/aio-libs/aiohttp/issues/3868>_
Fixed type annotation for add_view method of UrlDispatcher to accept any subclass of
View #3880 <https://github.com/aio-libs/aiohttp/issues/3880>_
Made cython HTTP parser set Reason-Phrase of the response to an empty string if it is
missing. #3906 <https://github.com/aio-libs/aiohttp/issues/3906>_
Add URL to the string representation of ClientResponseError.
#3959 <https://github.com/aio-libs/aiohttp/issues/3959>_
Accept istr keys in LooseHeaders type hints.
#3976 <https://github.com/aio-libs/aiohttp/issues/3976>_
Fixed race conditions in resolve_host caching and throttling when tracing is enabled.
#4013 <https://github.com/aio-libs/aiohttp/issues/4013>
For URLs like "unix://localhost/..." set Host HTTP header to "localhost" instead of
"localhost:None". #4039 <https://github.com/aio-libs/aiohttp/issues/4039>_

Improved Documentation

Modify documentation for Background Tasks to remove deprecated usage of event loop.
#3526 <https://github.com/aio-libs/aiohttp/issues/3526>_
use if __name__ == '__main__': in server examples.
#3775 <https://github.com/aio-libs/aiohttp/issues/3775>_
Update documentation reference to the default access logger.
#3783 <https://github.com/aio-libs/aiohttp/issues/3783>_
Improve documentation for web.BaseRequest.path and web.BaseRequest.raw_path.
#3791 <https://github.com/aio-libs/aiohttp/issues/3791>_
Removed deprecation warning in tracing example docs
#3964 <https://github.com/aio-libs/aiohttp/issues/3964>_

`v3.5.4`

Compare Source

==================

Bugfixes

Fix stream .read() / .readany() / .iter_any() which used to return a
partial content only in case of compressed content
#3525 <https://github.com/aio-libs/aiohttp/issues/3525>_

If you want to rebase/retry this PR, check this box

dev-mend-for-github-com bot added the security fix Security fix generated by Mend label Jun 16, 2024

dev-mend-for-github-com bot force-pushed the whitesource-remediate/aiohttp-3.x branch from 0956248 to b27523f Compare June 19, 2024 09:10

dev-mend-for-github-com bot changed the title ~~Update dependency aiohttp to v3.7.4~~ Update dependency aiohttp to v3.7.4 - autoclosed Sep 10, 2024

dev-mend-for-github-com bot closed this Sep 10, 2024

dev-mend-for-github-com bot deleted the whitesource-remediate/aiohttp-3.x branch September 10, 2024 15:34

dev-mend-for-github-com bot restored the whitesource-remediate/aiohttp-3.x branch September 11, 2024 07:12

dev-mend-for-github-com bot changed the title ~~Update dependency aiohttp to v3.7.4 - autoclosed~~ Update dependency aiohttp to v3.7.4 Sep 11, 2024

dev-mend-for-github-com bot reopened this Sep 11, 2024

Update dependency aiohttp to v3.7.4

a8d96d1

dev-mend-for-github-com bot force-pushed the whitesource-remediate/aiohttp-3.x branch from b27523f to a8d96d1 Compare September 11, 2024 07:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency aiohttp to v3.7.4 #2

Update dependency aiohttp to v3.7.4 #2

dev-mend-for-github-com bot commented Jun 16, 2024 •

edited

Loading

Update dependency aiohttp to v3.7.4 #2

Are you sure you want to change the base?

Update dependency aiohttp to v3.7.4 #2

Conversation

dev-mend-for-github-com bot commented Jun 16, 2024 • edited Loading

Release Notes

Misc

Features

Bugfixes

Improved Documentation

Misc

Bugfixes

Bugfixes

Features

Bugfixes

Improved Documentation

Misc

Bugfixes

Features

Bugfixes

Improved Documentation

Misc

Features

Bugfixes

Improved Documentation

Features

Bugfixes

Improved Documentation

Bugfixes

dev-mend-for-github-com bot commented Jun 16, 2024 •

edited

Loading