dependabot[bot]
commented
4 years ago OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.
If you change your mind, just re-open this PR and I'll resolve any conflicts on it.
Bumps waitress from 0.8.8 to 1.4.3.
Release notes
*Sourced from [waitress's releases](https://github.com/Pylons/waitress/releases).* > ## v1.4.3 > No release notes provided. > > ## v1.4.2 > No release notes provided. > > ## v1.4.1 > No release notes provided. > > ## v1.4.0 > No release notes provided. > > ## v1.3.1 > No release notes provided. > > ## v1.3.0 > No release notes provided. > > ## v1.3.0b0 > No release notes provided. > > ## v1.2.1 > No release notes provided. > > ## v1.2.0 > No release notes provided. > > ## v1.1.0 > https://pypi.org/project/waitress/1.1.0/ > > ## v1.0.2 > No release notes provided. > > ## v1.0.1 > No release notes provided. > > ## v1.0.0 > No release notes provided. > > ## v1.0a2 > No release notes provided. > > ## v1.0a1 > No release notes provided. > > ## v0.9.0 > No release notes provided. > > ## v0.9.0b1 > No release notes provided. > ... (truncated)Changelog
*Sourced from [waitress's changelog](https://github.com/Pylons/waitress/blob/master/CHANGES.txt).* > 1.4.3 (2020-02-02) > ------------------ > > Security Fixes > ~~~~~~~~~~~~~~ > > - In Waitress version 1.4.2 a new regular expression was added to validate the > headers that Waitress receives to make sure that it matches RFC7230. > Unfortunately the regular expression was written in a way that with invalid > input it leads to catastrophic backtracking which allows for a Denial of > Service and CPU usage going to a 100%. > > This was reported by Fil Zembowicz to the Pylons Project. Please see > https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc > for more information. > > 1.4.2 (2020-01-02) > ------------------ > > Security Fixes > ~~~~~~~~~~~~~~ > > - This is a follow-up to the fix introduced in 1.4.1 to tighten up the way > Waitress strips whitespace from header values. This makes sure Waitress won't > accidentally treat non-printable characters as whitespace and lead to a > potental HTTP request smuggling/splitting security issue. > > Thanks to ZeddYu Lu for the extra test cases. > > Please see the security advisory for more information: > https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 > > CVE-ID: CVE-2019-16789 > > Bugfixes > ~~~~~~~~ > > - Updated the regex used to validate header-field content to match the errata > that was published for RFC7230. > > See: https://www.rfc-editor.org/errata_search.php?rfc=7230&eid=4189 > > > 1.4.1 (2019-12-24) > ------------------ > > Security Fixes > ~~~~~~~~~~~~~~ > > - Waitress did not properly validate that the HTTP headers it received were > ... (truncated)Commits
- [`cbc89bf`](https://github.com/Pylons/waitress/commit/cbc89bf742ef7cbca17671ec9acd3898491c378f) Prep v1.4.3 - [`6e46f9e`](https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1f) Merge pull request from GHSA-73m2-3pwg-5fgc - [`51b9bd4`](https://github.com/Pylons/waitress/commit/51b9bd429a97ac1cadfe4e37938ff7fac84ee642) Remove accidental backslash - [`f87abb7`](https://github.com/Pylons/waitress/commit/f87abb7320d9acfa2c321481b70974363966bfe5) Add bad header that caused catastrophic backtracking - [`2fe8e54`](https://github.com/Pylons/waitress/commit/2fe8e54695ed038dadbb90e03140a1ab395d6629) Add header parsing tests with short headers - [`ac0ca05`](https://github.com/Pylons/waitress/commit/ac0ca050046f1538346f3975487062186195f4ca) Remove catastrophic backtracking in regex - [`8af9adb`](https://github.com/Pylons/waitress/commit/8af9adb8e9078bfdbc3adf9153b04e2d4471222d) Prep for 1.4.2 - [`634d991`](https://github.com/Pylons/waitress/commit/634d991ff4e0f7fd5f30c0cbedec29133071a455) Merge pull request [#277](https://github-redirect.dependabot.com/Pylons/waitress/issues/277) from Pylons/invalid-whitespace-cont - [`3a54e29`](https://github.com/Pylons/waitress/commit/3a54e2993db7182feaea4602aac7c1fa8f2ca08b) Add CHANGES and bump version to 1.4.2 - [`0bf98da`](https://github.com/Pylons/waitress/commit/0bf98dadd8cae23830cb365cc6cb9cedd7f98db0) Update RFC7230 regex with errata for header field-content - Additional commits viewable in [compare view](https://github.com/Pylons/waitress/compare/0.8.8...v1.4.3)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/UCSB-VRL/bisqueUCSB/network/alerts).