Log message:
py-twisted: updated to 19.10.0
Twisted 19.10.0:
Features
- twisted.trial.successResultOf, twisted.trial.failureResultOf, and
twisted.trial.assertNoResult accept coroutines as well as Deferreds.
Bugfixes
- Fixed circular import in twisted.trial.reporter, introduced in Twisted 16.0.0.
- The POP3 server implemented by twisted.mail.pop3 now accepts passwords that \
contain spaces.
- Incoming HTTP/2 connections will now not time out if they persist for longer \
than one minute.
- The serial extra now requires pywin32 on Windows enabling use of \
twisted.internet.serialport without specifying the windows_platform extra.
Bugfixes
- twisted.conch.ssh.keys now correctly writes the "iqmp" parameter in \
serialized RSA private keys as q^-1 mod p rather than p^-1 mod q.
Features
- twisted.web.server.Request will now use \
twisted.web.server.Site.getContentFile, if it exists, to get a file into which \
to write request content. If getContentFile is not provided by the site, it \
will fall back to the previous behavior of using io.BytesIO for small requests \
and tempfile.TemporaryFile for large ones.
Bugfixes
- twisted.web.client.FileBodyProducer will now stop producing when the Deferred \
returned by FileBodyProducer.startProducing is cancelled.
- The HTTP/2 server implementation now enforces TCP flow control on control \
frame messages and times out clients that send invalid data without reading \
responses. This closes CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), \
and CVE-2019-9515 (Settings Flood). Thanks to Jonathan Looney and Piotr Sikora.
Twisted 19.7.0:
Features
- The callable argument to twisted.internet.task.deferLater() is no longer required.
- Twisted's minimum Cryptography requirement is now 2.5.
- twisted.internet.utils.getProcessOutputAndValue now accepts `stdinBytes` to \
write to the child process's standard input.
- Add new twisted.logger.capturedLogs context manager for capturing observed log \
events in tests.
- twisted.internet.base.PluggableResolverMixin, which implements the pluggable \
resolver interfaces for easier re-use in other reactors, has been factored out \
of ReactorBase.
- The PyPI page for Twisted has been enhanced to include more information and \
useful links.
Bugfixes
- twisted.internet.endpoints is now importable on Windows when pywin32 is not \
installed.
- twisted.conch.ssh now generates correct keys when using hmac-sha2-512 with \
SHA1 based KEX algorithms.
- twisted.internet.iocpreactor.abstract.FileHandle no longer duplicates/looses \
outgoing data when .write() is called in rapid succession with large payloads
- twisted.application.backoffPolicy will not fail on connection attempts > \
1750 with default settings.
- Trial on Python 3 will now properly re-raise ImportErrors that occur during \
the import of a module, rather than saying the module doesn't exist.
- twisted.internet.process does not fail on import when the process has more \
than 1024 file descriptors opened.
- Add the stackLevel keyword argument to \
twisted.logger.STDLibLogObserver._findCaller to fix an incompatibility with \
Python 3.8.
Improved Documentation
- Fix the incorrect docstring for \
twisted.python.components.Componentized.addComponent which stated that the \
function returned a list of interfaces, even though the function doesn't \
actually do so.
Deprecations and Removals
- twisted.test.proto_helpers has moved to twisted.internet.testing. \
twisted.test.proto_helpers has been deprecated.
- twisted.protocols.mice, deprecated since Twisted 16.0, has been removed.
- twisted.conch.insults.client and twisted.conch.insults.colors, deprecated \
since Twisted 10.1, have been removed.
- The __version__ attribute of Twisted submodules that were previously packaged \
separately, deprecated since Twisted 16.0, has been removed.
- Python 3.4 is no longer supported.
- twisted.python.compat.OrderedDict, an alias for collections.OrderedDict and \
deprecated since Twisted 15.5, has been removed.
Bugfixes
- t.c.ssh.connection.SSHConnection now fails channels that are in the process of \
opening when the connection is lost.
Features
- twisted.web.tap, the module that is run by `twist web`, now accepts \
--display-tracebacks to render tracebacks on uncaught exceptions.
Bugfixes
- twisted.web.http.Request.write after the channel is disconnected will no \
longer raise AttributeError.
- twisted.web.client.Agent.request() and twisted.web.client.ProxyAgent.request() \
now produce TypeError when the method argument is not bytes, rather than failing \
to generate the request.
- twisted.web.http.HTTPChannel no longer raises TypeError internally when \
receiving a line-folded HTTP header on Python 3.
- All HTTP clients in twisted.web.client now raise a ValueError when called with \
a method and/or URL that contain invalid characters. This mitigates \
CVE-2019-12387. Thanks to Alex Brasetvik for reporting this vulnerability.
- twisted.web.server.Site's instance variable displayTracebacks is now set to \
False by default.
Improved Documentation
- twisted.web.iweb.IRequest's "prepath" and "postpath" \
attributes, which have existed for a long time, are now documented.
- The documented type of t.w.iweb.IRequest's "method" and \
"uri" attributes on Python 3 has been corrected to match the \
implementation.
- t.w.iweb.IRequest's "args" attribute is now correctly documented to \
be bytes.
- The API documentation of twisted.web.iweb.IRequest and \
twisted.web.http.Request has been updated and extended to match the \
implementation.
Deprecations and Removals
- Passing a path argument to twisted.web.resource.Resource.putChild which is not \
of type bytes is now deprecated. In the future, passing a non-bytes argument to \
putChild will return an error.
- Passing --notracebacks/-n to twisted.web.tap, the module that is run by `twist \
web`, is now deprecated due to traceback rendering being disabled by default.
Features
- twisted.words.protocols.jabber.xmlstream.TLSInitiatingInitializer and \
twisted.words.protocols.jabber.client.XMPPClientFactory now take an optional \
configurationForTLS for customizing certificate options for StartTLS.
Bugfixes
- twisted.words.protocols.jabber.xmlstream.TLSInitiatingInitializer now properly \
verifies the server's certificate against platform CAs and the stream's domain, \
mitigating CVE-2019-12855.
Bugfixes
- twisted.names.client.Resolver will no longer infinite loop if it cannot bind a \
UDP port to use for resolving.
Twisted 19.2.0:
This is the final release that will support Python 3.4.
Features
- twisted.internet.ssl.CertificateOptions now uses 32 random bytes instead of an \
MD5 hash for the ssl session identifier context.
- DeferredLock and DeferredSemaphore can be used as asynchronous context
managers on Python 3.5+.
- t.i.b.BaseConnector has custom __repr__
- twisted.internet.ssl.optionsForClientTLS now supports validating IP addresses \
from the certificate subjectAltName
- Twisted's minimum Cryptography requirement is now 2.5.
Bugfixes
- twisted.web.proxy.ReverseProxyResource fixed documentation and example snippet
- twisted.python.failure.Failure.getTracebackObject now returns traceback \
objects whose frames can be passed into traceback.print_stack for better \
debugging of where the exception came from.
- twisted.internet.ssl.KeyPair.generate: No longer generate 1024-bit RSA keys by \
default. Anyone who generated a key with this method using the default value \
should move to replace it immediately.
- The message of twisted.internet.error.ConnectionAborted is no longer truncated.
- twisted.enterprise.adbapi.ConnectionPool.connect now logs only the dbapiName \
and not the connection arguments, which may contain credentials
- twisted.python.runtime.Platform.supportsINotify no longer considers the result \
of isDocker for its own result.
Improved Documentation
- The documentation for the the twisted.internet.interfaces.IConsumer, \
IProducer, and IPullProducer interfaces is more detailed.
- The errback example in the docstring of twisted.logger.Logger.failure has been \
corrected.
- The sample code in the "Twisted Web In 60 Seconds" tutorial runs on \
Python 3.
Features
- twisted.conch.ssh.keys can now read private keys in the new \
"openssh-key-v1" format, introduced in OpenSSH 6.5 and made the \
default in OpenSSH 7.8.
Bugfixes
- Conch now uses pyca/cryptography for Diffie-Hellman key generation and agreement.
Features
- twisted.web.client.HostnameCachingHTTPSPolicy was added as a new \
contextFactory option. The policy caches a specified number of \
twisted.internet.interfaces.IOpenSSLClientConnectionCreator instances to to \
avoid the cost of instantiating a connection creator for multiple requests to \
the same host.
Bugfixes
- twisted.web.http.Request.cookies, twisted.web.http.HTTPChannel.writeHeaders, \
and twisted.web.http_headers.Headers were all vulnerable to header injection \
attacks. They now replace linear whitespace ('\r', '\n', and '\r\n') with a \
single space. twisted.web.http.Reqeuest.cookies also replaces semicolons (';') \
with a single space.
- twisted.web.client.Request and twisted.web.client.HTTPClient were both \
vulnerable to header injection attacks. They now replace linear whitespace \
('\r', '\n', and '\r\n') with a single space.
Features
- twisted.names.dns now has IRecord implementations for the SSHFP and TSIG \
record types.
|
Log message:
py-twisted: updated to 18.7.0
Twisted 18.7.0:
Features
--------
- Cancelling a Deferred returned by twisted.internet.defer.inlineCallbacks now \
cancels the Deferred it is waiting on.
- twisted.application.internet.ClientService now accepts a function to \
initialize or validate a connection before it is returned by the whenConnected \
method as the prepareConnection argument.
- Traceback generated for twisted.internet.defer.inlineCallbacks now includes \
the full stack of inlineCallbacks generators between catcher and raiser (before \
it only contained raiser's stack).
- Add optional cwd argument to twisted.runner.procmon.ProcMon.addProcess
- twisted.python.failure.Failure tracebacks generated by coroutines scheduled \
with twisted.internet.defer.ensureDeferred - i.e. any Deferred-awaiting \
coroutine - now contain fewer extraneous frames from the trampoline \
implementation, and correctly indicate the source of exceptions raised in other \
call stacks - i.e. the function that raised the exception. In other words: if \
you 'await' a function that raises an exception, you'll be able to see where the \
error came from.
Bugfixes
--------
- On UNIX-like platforms, Twisted attempts to recover from EMFILE when accepting \
connections on TCP and UNIX ports by shedding incoming clients.
- The documentation of IReactorTime.getDelayedCalls() has been corrected to \
indicate that the method returns a list, not a tuple.
- "python -m twisted web --help" now refers to "--listen" \
instead of the non-existing "--http"
- twisted.python.htmlizer.TokenPrinter now explicitly works on bytestrings.
- twisted.enterprise.adbapi.ConnectionPool.runWithConnection and runInteraction \
now use the reactor that is passed to ConnectionPool's constructor.
Improved Documentation
----------------------
- The Twisted Coding Standard now contains examples of how to mark up a feature \
as added in the next Twisted release.
Deprecations and Removals
-------------------------
- Deprecate direct introspection of ProcMon's processes: processes should not be \
directly accessed or pickled.
- twisted.internet.address.IPv4Address._bwHack and \
twisted.internet.address.UNIXAddress._bwHack, as well as the parameters to the \
constructors, deprecated since Twisted 11.0, have been removed.
|