Path to this page:
Subject: CVS commit: pkgsrc/net/py-twisted
From: Greg Troxel
Date: 2024-08-10 15:50:13
Message id: 20240810135013.55564FC74@cvs.NetBSD.org
Log Message:
net/py-twisted: Update to 24.7.0
This release carries a significant security fix.
Upstream NEWS:
Twisted 24.7.0 (2024-08-08)
===========================
24.7.0.rc2 fixed an unreleased regression caused by PR 12109. (#12279)
No other changes since 24.7.0.rc2
Security Advisories
-------------------
- twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback \
response body it returns (GHSA-cf56-g6w6-pqq2, CVE-2024-41810). (#9839)
- The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined \
HTTP requests out-of-order, possibly resulting in information disclosure \
(CVE-2024-41671/GHSA-c8m8-j448-xjx7) (#12248)
Features
--------
- twisted.protocols.ftp now supports the IPv6 extensions defined in RFC 2428. (#9645)
- twisted.internet.defer.inlineCallbacks can now yield a coroutine. (#9972)
- twisted.python._shellcomp.ZshArgumentsGenerator was updated for Python 3.13. \
(#12065)
- twisted.web.wsgi request environment now contains the peer port number as \
`REMOTE_PORT`. (#12096)
- twisted.internet.defer.Deferred.callback() and \
twisted.internet.defer.Deferred.addCallbacks() no longer use `assert` to check \
the type of the arguments. You should now use type checking to validate your \
code. These changes were done to reduce the CPU usage. (#12122)
- Added two new methods, twisted.logger.Logger.failuresHandled and \
twisted.logger.Logger.failureHandler, which allow for more concise and \
convenient handling of exceptions when dispatching out to application code. The \
former can arbitrarily customize failure handling at the call site, and the \
latter can be used for performance-sensitive cases where no additional \
information needs to be logged. (#12188)
- twisted.internet.defer.Deferred.addCallback now runs about 10% faster. (#12223)
- twisted.internet.defer.Deferred error handling is now faster, taking 40% less \
time to run. (#12227)
Deprecations and Removals
-------------------------
- twisted.internet.defer.returnValue has been deprecated. You can replace it \
with the standard `return` statement. (#9930)
- The `twisted-iocpsupport` is no longer a hard dependency on Windows.
The IOCP support is now installed together with the other Windows soft
dependencies via `twisted[windows-platform]`. (#11893)
- twisted.python.deprecate helper function will now always strip whitespaces \
from the docstrings.
This is done to have the same behaviour as with Python 3.13. (#12063)
- twisted.conch.manhole.ManholeInterpreter.write, \
twisted.conch.manhole.ManholeInterpreter.addOutput, \
twisted.mail.imap4.IMAP4Server.sendUntaggedResponse `async` argument, deprecated \
since 18.9.0, has been removed. (#12130)
- twisted.web.soap was removed.
The SOAP support was already broken, for at least the last 4 years.
The SOAP support in Twisted has no active maintainer. (#12146)
Web
---
Features
~~~~~~~~
- twisted.web.agent.Agent now allows duplicate Content-Length headers having the \
same value, per RFC 9110 section 8.6. It is otherwise more strict when parsing \
Content-Length header values. (#9064)
- twisted.web.client.HTTPConnectionPool used by HTTP clients now runs faster by \
using a little less CPU. (#12108)
- twisted.web.http_headers now uses less CPU, making a small HTTP client request \
10% faster or so. (#12116)
- twisted.web's HTTP/1.1 server now runs a little faster, with about 10% lower \
CPU overhead. (#12133)
- twisted.web's HTTP 1.1 server is an additional 5% faster. (#12155)
Deprecations and Removals
~~~~~~~~~~~~~~~~~~~~~~~~~
- twisted.web.util.ChildRedirector, which has never worked on Python 3, has been \
removed. (#9591)
- ``twisted.web.http.Request.setResponseCode()`` no longer validates the types \
of inputs; we encourage you to use a type checker like mypy to catch these sort \
of errors. The long-deprecated ``twisted.web.server.string_date_time()`` and \
``twisted.web.server.date_time_string()`` APIs were removed altogether. (#12133)
- twisted.web.http.HTTPClient is now deprecated in favor of \
twisted.web.client.Agent (#12158)
Files: