[Security] Bump webargs from 4.1.2 to 5.3.0

[dependabot-preview[bot]]

Bumps webargs from 4.1.2 to 5.3.0. This update includes security fixes.

Vulnerabilities fixed

*Sourced from The GitHub Security Advisory Database.* > **High severity vulnerability that affects webargs** > An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests. > > Affected versions: < 5.1.3

Changelog

*Sourced from [webargs's changelog](https://github.com/marshmallow-code/webargs/blob/dev/CHANGELOG.rst).* > 5.3.0 (2019-04-08) > ================== > > Features: > > - Add "path" location to `AIOHTTPParser`, `FlaskParser`, and `PyramidParser` (379). Thanks zhenhua32 for the PR. > - Add `webargs.__version_info__`. > > 5.2.0 (2019-03-16) > ================== > > Features: > > - Make the schema class used when generating a schema from a dict overridable (375). Thanks ThiefMaster. > > 5.1.3 (2019-03-11) > ================== > > Bug fixes: > > - CVE-2019-9710: Fix race condition between parallel requests when the cache is used (371). Thanks ThiefMaster for reporting and fixing. > > 5.1.2 (2019-02-03) > ================== > > Bug fixes: > > - Remove lingering usages of `ValidationError.status_code` (365). Thanks decaz for reporting. > - Avoid `AttributeError` on Python<3.5.4 (366). > - Fix incorrect type annotations for `error_headers`. > - Fix outdated docs (367). Thanks alexandersoto for reporting. > > 5.1.1.post0 (2019-01-30) > ======================== > > - Include LICENSE in sdist (364). > > 5.1.1 (2019-01-28) > ================== > > Bug fixes: > > - Fix installing `simplejson` on Python 2 by distributing a Python 2-only wheel (363). > > 5.1.0 (2019-01-11) > ================== > > Features: > > - Error handlers for AsyncParser classes may be coroutine functions. > ... (truncated)

Commits

- [`40cc2d2`](https://github.com/marshmallow-code/webargs/commit/40cc2d25421d15d9630b1a819f1dcefbbf01ed95) Bump version and update changelog - [`cbebc4d`](https://github.com/marshmallow-code/webargs/commit/cbebc4d5e4b03e9a351334ddace8c6333103622f) Add __version_info__ - [`b13a93d`](https://github.com/marshmallow-code/webargs/commit/b13a93df20ab1071ac680d49e580b9eaff115db8) Add "path" location to FlaskParser and PyramidParser for consistency - [`7dfd1e6`](https://github.com/marshmallow-code/webargs/commit/7dfd1e6469fe9f4579256378ffc165c8a94f8ad7) Merge pull request [#379](https://github-redirect.dependabot.com/marshmallow-code/webargs/issues/379) from zhenhua32/dev - [`fa80073`](https://github.com/marshmallow-code/webargs/commit/fa800737a8591d38b95d0b4fefc2d524a1886e1b) add aiohttp path location - [`d815e42`](https://github.com/marshmallow-code/webargs/commit/d815e4289cb62b22b34abb06d6131f8893ba877b) pre-commit autoupdate - [`98e3d57`](https://github.com/marshmallow-code/webargs/commit/98e3d573afadb8fbe65007a9482c780b2effd861) Remove unnecessary pytest mark - [`1fb3493`](https://github.com/marshmallow-code/webargs/commit/1fb3493158e82d3f1314b77be5af926286793f3d) Bump version and update changelog - [`c60472b`](https://github.com/marshmallow-code/webargs/commit/c60472b05a8e5a258656cfaab2dd51eaf2795cf5) Merge pull request [#376](https://github-redirect.dependabot.com/marshmallow-code/webargs/issues/376) from ThiefMaster/customizable-schema - [`06e7b5c`](https://github.com/marshmallow-code/webargs/commit/06e7b5cc2209d00386e5fcc8547c887d82de2529) Rename "schema_cls" -> "schema_class" - Additional commits viewable in [compare view](https://github.com/marshmallow-code/webargs/compare/4.1.2...5.3.0)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

If all status checks pass Dependabot will automatically merge this pull request.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.