dependabot-preview[bot]
commented
5 years ago Superseded by #369.
Closed dependabot-preview[bot] closed 5 years ago
dependabot-preview[bot]
commented
5 years ago Superseded by #369.
Bumps webargs from 4.1.2 to 5.2.0. This update includes security fixes.
Vulnerabilities fixed
*Sourced from The GitHub Security Advisory Database.* > **High severity vulnerability that affects webargs** > An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests. > > Affected versions: < 5.1.3Changelog
*Sourced from [webargs's changelog](https://github.com/marshmallow-code/webargs/blob/dev/CHANGELOG.rst).* > 5.2.0 (2019-03-16) > ================== > > Features: > > - Make the schema class used when generating a schema from a dict overridable (375). Thanks ThiefMaster. > > 5.1.3 (2019-03-11) > ================== > > Bug fixes: > > - CVE-2019-9710: Fix race condition between parallel requests when the cache is used (371). Thanks ThiefMaster for reporting and fixing. > > 5.1.2 (2019-02-03) > ================== > > Bug fixes: > > - Remove lingering usages of `ValidationError.status_code` (365). Thanks decaz for reporting. > - Avoid `AttributeError` on Python<3.5.4 (366). > - Fix incorrect type annotations for `error_headers`. > - Fix outdated docs (367). Thanks alexandersoto for reporting. > > 5.1.1.post0 (2019-01-30) > ======================== > > - Include LICENSE in sdist (364). > > 5.1.1 (2019-01-28) > ================== > > Bug fixes: > > - Fix installing `simplejson` on Python 2 by distributing a Python 2-only wheel (363). > > 5.1.0 (2019-01-11) > ================== > > Features: > > - Error handlers for AsyncParser classes may be coroutine functions. > - Add type annotations to AsyncParser and AIOHTTPParser. > > Bug fixes: > > - Fix compatibility with Flask<1.0 (355). Thanks hoatle for reporting. > - Address warning on Python 3.7 about importing from `collections.abc`. > > 5.0.0 (2019-01-03) > ... (truncated)Commits
- [`1fb3493`](https://github.com/marshmallow-code/webargs/commit/1fb3493158e82d3f1314b77be5af926286793f3d) Bump version and update changelog - [`c60472b`](https://github.com/marshmallow-code/webargs/commit/c60472b05a8e5a258656cfaab2dd51eaf2795cf5) Merge pull request [#376](https://github-redirect.dependabot.com/marshmallow-code/webargs/issues/376) from ThiefMaster/customizable-schema - [`06e7b5c`](https://github.com/marshmallow-code/webargs/commit/06e7b5cc2209d00386e5fcc8547c887d82de2529) Rename "schema_cls" -> "schema_class" - [`458a3b7`](https://github.com/marshmallow-code/webargs/commit/458a3b72192dccf4a819cfd9f33d9fd002982938) Make Schema class customizable - [`bbc041a`](https://github.com/marshmallow-code/webargs/commit/bbc041a114fa3556e85f00646923f7e94d18126d) Add missing docstring - [`86564f1`](https://github.com/marshmallow-code/webargs/commit/86564f179b660096c2f0a6c578181caaa57b27e3) Use xenial for all builds - [`48a24a1`](https://github.com/marshmallow-code/webargs/commit/48a24a125fddcafcfd2f9d9b64b03e331c249f9c) Add CVE to changelog - [`1c43dca`](https://github.com/marshmallow-code/webargs/commit/1c43dcaf1670cd5c6898c6297b489c2cdf87beb8) Bump version and update changelog - [`716bd8d`](https://github.com/marshmallow-code/webargs/commit/716bd8d1f24c84aaf99170efaa17d1d34206f6c0) Merge pull request [#373](https://github-redirect.dependabot.com/marshmallow-code/webargs/issues/373) from ThiefMaster/race-conditions-are-evil-2 - [`e6fff23`](https://github.com/marshmallow-code/webargs/commit/e6fff23132e20f0c8b96193ea865933e8a694372) Move import to top of file - Additional commits viewable in [compare view](https://github.com/marshmallow-code/webargs/compare/4.1.2...5.2.0)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.If all status checks pass Dependabot will automatically merge this pull request.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.