Subject: CVS commit: pkgsrc/net/py-twisted
From: Greg Troxel
Date: 2024-08-10 15:50:13
Message id: 20240810135013.55564FC74@cvs.NetBSD.org

Log Message:
net/py-twisted: Update to 24.7.0

This release carries a significant security fix.

Upstream NEWS:

Twisted 24.7.0 (2024-08-08)
===========================

24.7.0.rc2 fixed an unreleased regression caused by PR 12109. (#12279)
No other changes since 24.7.0.rc2

Security Advisories
-------------------

- twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback \ 
response body it returns (GHSA-cf56-g6w6-pqq2, CVE-2024-41810). (#9839)
- The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined \ 
HTTP requests out-of-order, possibly resulting in information disclosure \ 
(CVE-2024-41671/GHSA-c8m8-j448-xjx7) (#12248)

Features
--------

- twisted.protocols.ftp now supports the IPv6 extensions defined in RFC 2428. (#9645)
- twisted.internet.defer.inlineCallbacks can now yield a coroutine. (#9972)
- twisted.python._shellcomp.ZshArgumentsGenerator was updated for Python 3.13. \ 
(#12065)
- twisted.web.wsgi request environment now contains the peer port number as \ 
`REMOTE_PORT`. (#12096)
- twisted.internet.defer.Deferred.callback() and \ 
twisted.internet.defer.Deferred.addCallbacks() no longer use `assert` to check \ 
the type of the arguments. You should now use type checking to validate your \ 
code. These changes were done to reduce the CPU usage. (#12122)
- Added two new methods, twisted.logger.Logger.failuresHandled and \ 
twisted.logger.Logger.failureHandler, which allow for more concise and \ 
convenient handling of exceptions when dispatching out to application code.  The \ 
former can arbitrarily customize failure handling at the call site, and the \ 
latter can be used for performance-sensitive cases where no additional \ 
information needs to be logged. (#12188)
- twisted.internet.defer.Deferred.addCallback now runs about 10% faster. (#12223)
- twisted.internet.defer.Deferred error handling is now faster, taking 40% less \ 
time to run. (#12227)

Deprecations and Removals
-------------------------

- twisted.internet.defer.returnValue has been deprecated. You can replace it \ 
with the standard `return` statement. (#9930)
- The `twisted-iocpsupport` is no longer a hard dependency on Windows.
  The IOCP support is now installed together with the other Windows soft
  dependencies via `twisted[windows-platform]`. (#11893)
- twisted.python.deprecate helper function will now always strip whitespaces \ 
from the docstrings.
  This is done to have the same behaviour as with Python 3.13. (#12063)
- twisted.conch.manhole.ManholeInterpreter.write, \ 
twisted.conch.manhole.ManholeInterpreter.addOutput, \ 
twisted.mail.imap4.IMAP4Server.sendUntaggedResponse `async` argument, deprecated \ 
since 18.9.0, has been removed. (#12130)
- twisted.web.soap was removed.
  The SOAP support was already broken, for at least the last 4 years.
  The SOAP support in Twisted has no active maintainer. (#12146)

Web
---

Features
~~~~~~~~

- twisted.web.agent.Agent now allows duplicate Content-Length headers having the \ 
same value, per RFC 9110 section 8.6. It is otherwise more strict when parsing \ 
Content-Length header values. (#9064)
- twisted.web.client.HTTPConnectionPool used by HTTP clients now runs faster by \ 
using a little less CPU. (#12108)
- twisted.web.http_headers now uses less CPU, making a small HTTP client request \ 
10% faster or so. (#12116)
- twisted.web's HTTP/1.1 server now runs a little faster, with about 10% lower \ 
CPU overhead. (#12133)
- twisted.web's HTTP 1.1 server is an additional 5% faster. (#12155)

Deprecations and Removals
~~~~~~~~~~~~~~~~~~~~~~~~~

- twisted.web.util.ChildRedirector, which has never worked on Python 3, has been \ 
removed. (#9591)
- ``twisted.web.http.Request.setResponseCode()`` no longer validates the types \ 
of inputs; we encourage you to use a type checker like mypy to catch these sort \ 
of errors. The long-deprecated ``twisted.web.server.string_date_time()`` and \ 
``twisted.web.server.date_time_string()`` APIs were removed altogether. (#12133)
- twisted.web.http.HTTPClient is now deprecated in favor of \ 
twisted.web.client.Agent (#12158)

Files:
RevisionActionfile
1.52modifypkgsrc/net/py-twisted/Makefile.common
1.39modifypkgsrc/net/py-twisted/PLIST
1.48modifypkgsrc/net/py-twisted/distinfo