waitress/CHANGES.txt at main · Pylons/waitress · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
Unreleased
----------

Bugfix
~~~~~~

- Renamed the HTTP header "Trailers" to "Trailer" to fix a typo and comply with
  the correct header name as specified in RFC 7230.

- Waitress will now drop a request if the Transer-Encoding is set twice in the
  request, previously it would decode the chunks and pass it along to the WSGI
  application with an appropriate content length. See
  https://github.com/Pylons/waitress/issues/465 and
  https://github.com/Pylons/waitress/pull/474

- When encountering a request that has both Content-Length set and
  Transfer-Encoding of chunked we now close the connection after it is
  completed to comply with the requirements of RFC9112. See
  https://github.com/Pylons/waitress/pull/475 and
  https://github.com/Pylons/waitress/issues/464

3.0.2 (2024-11-16)
------------------

Security
~~~~~~~~

- When using Waitress to process trusted proxy headers, Waitress will now
  update the headers to drop any untrusted values, thereby making sure that
  WSGI apps only get trusted and validated values that Waitress itself used to
  update the environ. See https://github.com/Pylons/waitress/pull/452 and
  https://github.com/Pylons/waitress/issues/451


3.0.1 (2024-10-28)
------------------

Backward Incompatibilities
~~~~~~~~~~~~~~~~~~~~~~~~~~

- Python 3.8 is no longer supported.
  See https://github.com/Pylons/waitress/pull/445.

Features
~~~~~~~~

- Added support for Python 3.13.
  See https://github.com/Pylons/waitress/pull/445.

Security
~~~~~~~~

- Fix a bug that would lead to Waitress busy looping on select() on a half-open
  socket due to a race condition that existed when creating a new HTTPChannel.
  See https://github.com/Pylons/waitress/pull/435,
  https://github.com/Pylons/waitress/issues/418 and
  https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6

  With thanks to Dylan Jay and Dieter Maurer for their extensive debugging and
  helping track this down.

- No longer strip the header values before passing them to the WSGI environ.
  See https://github.com/Pylons/waitress/pull/434 and
  https://github.com/Pylons/waitress/issues/432

- Fix a race condition in Waitress when `channel_request_lookahead` is enabled
  that could lead to HTTP request smuggling.

  See https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj

3.0.0 (2024-02-04)
------------------

- Rename "master" git branch to "main"

- Fix a bug that would appear on macOS whereby if we accept() a socket that is
  already gone, setting socket options would fail and take down the server. See
  https://github.com/Pylons/waitress/pull/399

- Fixed testing of vendored asyncore code to not rely on particular naming for
  errno's. See https://github.com/Pylons/waitress/pull/397

- HTTP Request methods and versions are now validated to meet the HTTP
  standards thereby dropping invalid requests on the floor. See
  https://github.com/Pylons/waitress/pull/423

- No longer close the connection when sending a HEAD request response. See
  https://github.com/Pylons/waitress/pull/428

- Always attempt to send the Connection: close response header when we are
  going to close the connection to let the remote know in more instances.
  https://github.com/Pylons/waitress/pull/429

- Python 3.7 is no longer supported. Add support for Python 3.11, 3.12 and
  PyPy 3.9, 3.10. See https://github.com/Pylons/waitress/pull/412

- Document that trusted_proxy may be set to a wildcard value to trust all
  proxies. See https://github.com/Pylons/waitress/pull/431

Updated Defaults
~~~~~~~~~~~~~~~~

- clear_untrusted_proxy_headers is set to True by default. See
  https://github.com/Pylons/waitress/pull/370