Update dependency aiohttp to v3.12.14 [SECURITY] #90
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==3.10.11->==3.12.14GitHub Vulnerability Alerts
CVE-2025-53643
Summary
The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.
Impact
If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.
Patch: aio-libs/aiohttp@e8d774f
Release Notes
aio-libs/aiohttp (aiohttp)
v3.12.14Compare Source
====================
Bug fixes
Fixed file uploads failing with HTTP 422 errors when encountering 307/308 redirects, and 301/302 redirects for non-POST methods, by preserving the request body when appropriate per :rfc:
9110#section-15.4.3-3.1-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11270.Fixed :py:meth:
ClientSession.close() <aiohttp.ClientSession.close>hanging indefinitely when using HTTPS requests through HTTP proxies -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11273.Bumped minimum version of aiosignal to 1.4+ to resolve typing issues -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11280.Features
Added initial trailer parsing logic to Python HTTP parser -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11269.Improved documentation
Clarified exceptions raised by
WebSocketResponse.send_frameet al.-- by :user:
DoctorJohn.Related issues and pull requests on GitHub:
:issue:
11234.v3.12.13Compare Source
====================
Bug fixes
Fixed auto-created :py:class:
~aiohttp.TCPConnectornot using the session's event loop when :py:class:~aiohttp.ClientSessionis created without an explicit connector -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11147.v3.12.12Compare Source
====================
Bug fixes
Fixed cookie unquoting to properly handle octal escape sequences in cookie values (e.g.,
\012for newline) by vendoring the correct_unquoteimplementation from Python'shttp.cookiesmodule -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11173.Fixed
Cookieheader parsing to treat attribute names as regular cookies per :rfc:6265#section-5.4-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11178.v3.12.11Compare Source
====================
Features
Improved SSL connection handling by changing the default
ssl_shutdown_timeoutfrom
0.1to0seconds. SSL connections now use Python's default gracefulshutdown during normal operation but are aborted immediately when the connector
is closed, providing optimal behavior for both cases. Also added support for
ssl_shutdown_timeout=0on all Python versions. Previously, this value wasrejected on Python 3.11+ and ignored on earlier versions. Non-zero values on
Python < 3.11 now trigger a
RuntimeWarning-- by :user:bdraco.The
ssl_shutdown_timeoutparameter is now deprecated and will be removed inaiohttp 4.0 as there is no clear use case for changing the default.
Related issues and pull requests on GitHub:
:issue:
11148.Deprecations (removal in next major release)
Improved SSL connection handling by changing the default
ssl_shutdown_timeoutfrom
0.1to0seconds. SSL connections now use Python's default gracefulshutdown during normal operation but are aborted immediately when the connector
is closed, providing optimal behavior for both cases. Also added support for
ssl_shutdown_timeout=0on all Python versions. Previously, this value wasrejected on Python 3.11+ and ignored on earlier versions. Non-zero values on
Python < 3.11 now trigger a
RuntimeWarning-- by :user:bdraco.The
ssl_shutdown_timeoutparameter is now deprecated and will be removed inaiohttp 4.0 as there is no clear use case for changing the default.
Related issues and pull requests on GitHub:
:issue:
11148.v3.12.10Compare Source
====================
Bug fixes
Fixed leak of
aiodns.DNSResolverwhen :py:class:~aiohttp.TCPConnectoris closed and no resolver was passed when creating the connector -- by :user:Tasssadar.This was a regression introduced in version 3.12.0 (:pr:
10897).Related issues and pull requests on GitHub:
:issue:
11150.v3.12.9Compare Source
===================
Bug fixes
Fixed
IOBasePayloadandTextIOPayloadreading entire files into memory when streaming large files -- by :user:bdraco.When using file-like objects with the aiohttp client, the entire file would be read into memory if the file size was provided in the
Content-Lengthheader. This could cause out-of-memory errors when uploading large files. The payload classes now correctly read data in chunks ofREAD_SIZE(64KB) regardless of the total content length.Related issues and pull requests on GitHub:
:issue:
11138.v3.12.8Compare Source
===================
Features
Added preemptive digest authentication to :class:
~aiohttp.DigestAuthMiddleware-- by :user:bdraco.The middleware now reuses authentication credentials for subsequent requests to the same
protection space, improving efficiency by avoiding extra authentication round trips.
This behavior matches how web browsers handle digest authentication and follows
:rfc:
7616#section-3.6.Preemptive authentication is enabled by default but can be disabled by passing
preemptive=Falseto the middleware constructor.Related issues and pull requests on GitHub:
:issue:
11128, :issue:11129.v3.12.7Compare Source
===================
.. warning::
This release fixes an issue where the
quote_cookieparameter was not being properlyrespected for shared cookies (domain="", path=""). If your server does not handle quoted
cookies correctly, you may need to disable cookie quoting by setting
quote_cookie=Falsewhen creating your :class:
~aiohttp.ClientSessionor :class:~aiohttp.CookieJar.See :ref:
aiohttp-client-cookie-quoting-routinefor details.Bug fixes
Fixed cookie parsing to be more lenient when handling cookies with special characters
in names or values. Cookies with characters like
{,}, and/in names are nowaccepted instead of causing a :exc:
~http.cookies.CookieErrorand 500 errors. Additionally,cookies with mismatched quotes in values are now parsed correctly, and quoted cookie
values are now handled consistently whether or not they include special attributes
like
Domain. Also fixed :class:~aiohttp.CookieJarto ensure shared cookies (domain="", path="")respect the
quote_cookieparameter, making cookie quoting behavior consistent forall cookies -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
2683, :issue:5397, :issue:7993, :issue:11112.Fixed an issue where cookies with duplicate names but different domains or paths
were lost when updating the cookie jar. The :class:
~aiohttp.ClientSessioncookie jar now correctly stores all cookies even if they have the same name but
different domain or path, following the :rfc:
6265#section-5.3storage model -- by :user:bdraco.Note that :attr:
ClientResponse.cookies <aiohttp.ClientResponse.cookies>returnsa :class:
~http.cookies.SimpleCookiewhich uses the cookie name as a key, soonly the last cookie with each name is accessible via this interface. All cookies
can be accessed via :meth:
ClientResponse.headers.getall('Set-Cookie') <multidict.MultiDictProxy.getall>if needed.Related issues and pull requests on GitHub:
:issue:
4486, :issue:11105, :issue:11106.Miscellaneous internal changes
Avoided creating closed futures in
ResponseHandlerthat will never be awaited -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
11107.Downgraded the logging level for connector close errors from ERROR to DEBUG, as these are expected behavior with TLS 1.3 connections -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
11114.v3.12.6Compare Source
===================
Bug fixes
Fixed spurious "Future exception was never retrieved" warnings for connection lost errors when the connector is not closed -- by :user:
bdraco.When connections are lost, the exception is now marked as retrieved since it is always propagated through other means, preventing unnecessary warnings in logs.
Related issues and pull requests on GitHub:
:issue:
11100.v3.12.4Compare Source
===================
Bug fixes
Fixed connector not waiting for connections to close before returning from :meth:
~aiohttp.BaseConnector.close(partial backport of :pr:3733) -- by :user:atemateand :user:bdraco.Related issues and pull requests on GitHub:
:issue:
1925, :issue:11074.v3.12.3Compare Source
===================
Bug fixes
Fixed memory leak in :py:meth:
~aiohttp.CookieJar.filter_cookiesthat caused unbounded memory growthwhen making requests to different URL paths -- by :user:
bdracoand :user:Cycloctane.Related issues and pull requests on GitHub:
:issue:
11052, :issue:11054.v3.12.2Compare Source
===================
Bug fixes
Fixed
Content-Lengthheader not being set to0for non-GET requests withNonebody -- by :user:bdraco.Non-GET requests (
POST,PUT,PATCH,DELETE) withNoneas the body now correctly set theContent-Lengthheader to0, matching the behavior of requests with empty bytes (b""). This regression was introduced in aiohttp 3.12.1.Related issues and pull requests on GitHub:
:issue:
11035.v3.12.1Compare Source
====================
Bug fixes
Fixed :class:
~aiohttp.DigestAuthMiddlewareto preserve the algorithm case from the server's challenge in the authorization response. This improves compatibility with servers that perform case-sensitive algorithm matching (e.g., servers expectingalgorithm=MD5-sessinstead ofalgorithm=MD5-SESS)-- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
11352.Improved documentation
Remove outdated contents of
aiohttp-devtoolsandaiohttp-swaggerfrom Web_advanced docs.
-- by :user:
CycloctaneRelated issues and pull requests on GitHub:
:issue:
11347.Packaging updates and notes for downstreams
Started including the
llhttp:file:LICENSEfile in wheels by addingvendor/llhttp/LICENSEtolicense-filesin :file:setup.cfg-- by :user:threexc.Related issues and pull requests on GitHub:
:issue:
11226.Contributor-facing changes
Updated a regex in
test_aiohttp_request_coroutinefor Python 3.14.Related issues and pull requests on GitHub:
:issue:
11271.v3.12.0Compare Source
===================
Bug fixes
Fixed :py:attr:
~aiohttp.web.WebSocketResponse.preparedproperty to correctly reflect the prepared state, especially during timeout scenarios -- by :user:bdracoRelated issues and pull requests on GitHub:
:issue:
6009, :issue:10988.Response is now always True, instead of using MutableMapping behaviour (False when map is empty)
Related issues and pull requests on GitHub:
:issue:
10119.Fixed connection reuse for file-like data payloads by ensuring buffer
truncation respects content-length boundaries and preventing premature
connection closure race -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10325, :issue:10915, :issue:10941, :issue:10943.Fixed pytest plugin to not use deprecated :py:mod:
asynciopolicy APIs.Related issues and pull requests on GitHub:
:issue:
10851.Fixed :py:class:
~aiohttp.resolver.AsyncResolvernot using theloopargument in versions 3.x where it should still be supported -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10951.Features
Added a comprehensive HTTP Digest Authentication client middleware (DigestAuthMiddleware)
that implements RFC 7616. The middleware supports all standard hash algorithms
(MD5, SHA, SHA-256, SHA-512) with session variants, handles both 'auth' and
'auth-int' quality of protection options, and automatically manages the
authentication flow by intercepting 401 responses and retrying with proper
credentials -- by :user:
feus4177, :user:TimMenninger, and :user:bdraco.Related issues and pull requests on GitHub:
:issue:
2213, :issue:10725.Added client middleware support -- by :user:
bdracoand :user:Dreamsorcerer.This change allows users to add middleware to the client session and requests, enabling features like
authentication, logging, and request/response modification without modifying the core
request logic. Additionally, the
sessionattribute was added toClientRequest,allowing middleware to access the session for making additional requests.
Related issues and pull requests on GitHub:
:issue:
9732, :issue:10902, :issue:10945, :issue:10952, :issue:10959, :issue:10968.Allow user setting zlib compression backend -- by :user:
TimMenningerThis change allows the user to call :func:
aiohttp.set_zlib_backend()with thezlib compression module of their choice. Default behavior continues to use
the builtin
zliblibrary.Related issues and pull requests on GitHub:
:issue:
9798.Added support for overriding the base URL with an absolute one in client sessions
-- by :user:
vivodi.Related issues and pull requests on GitHub:
:issue:
10074.Added
hostparameter toaiohttp_serverfixture -- by :user:christianwbrock.Related issues and pull requests on GitHub:
:issue:
10120.Detect blocking calls in coroutines using BlockBuster -- by :user:
cbornet.Related issues and pull requests on GitHub:
:issue:
10433.Added
socket_factoryto :py:class:aiohttp.TCPConnectorto allow specifying custom socket options-- by :user:
TimMenninger.Related issues and pull requests on GitHub:
:issue:
10474, :issue:10520, :issue:10961, :issue:10962.Started building armv7l manylinux wheels -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10797.Implemented shared DNS resolver management to fix excessive resolver object creation
when using multiple client sessions. The new
_DNSResolverManagersingleton ensuresonly one
DNSResolverobject is created for default configurations, significantlyreducing resource usage and improving performance for applications using multiple
client sessions simultaneously -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10847, :issue:10923, :issue:10946.Upgraded to LLHTTP 9.3.0 -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
10972.Optimized small HTTP requests/responses by coalescing headers and body into a single TCP packet -- by :user:
bdraco.This change enhances network efficiency by reducing the number of packets sent for small HTTP payloads, improving latency and reducing overhead. Most importantly, this fixes compatibility with memory-constrained IoT devices that can only perform a single read operation and expect HTTP requests in one packet. The optimization uses zero-copy
writelineswhen coalescing data and works with both regular and chunked transfer encoding.When
aiohttpuses client middleware to communicate with anaiohttpserver, connection reuse is more likely to occur since complete responses arrive in a single packet for small payloads.This aligns
aiohttpwith other popular HTTP clients that already coalesce small requests.Related issues and pull requests on GitHub:
:issue:
10991.Improved documentation
Improved documentation for middleware by adding warnings and examples about
request body stream consumption. The documentation now clearly explains that
request body streams can only be read once and provides best practices for
sharing parsed request data between middleware and handlers -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
2914.Packaging updates and notes for downstreams
Removed non SPDX-license description from
setup.cfg-- by :user:devanshu-ziphq.Related issues and pull requests on GitHub:
:issue:
10662.Added support for building against system
llhttplibrary -- by :user:mgorny.This change adds support for :envvar:
AIOHTTP_USE_SYSTEM_DEPSenvironment variable thatcan be used to build aiohttp against the system install of the
llhttplibrary ratherthan the vendored one.
Related issues and pull requests on GitHub:
:issue:
10759.aiodnsis now installed on Windows with speedups extra -- by :user:bdraco.As of
aiodns3.3.0,SelectorEventLoopis no longer required when usingpycares4.7.0 or later.Related issues and pull requests on GitHub:
:issue:
10823.Fixed compatibility issue with Cython 3.1.1 -- by :user:
bdracoRelated issues and pull requests on GitHub:
:issue:
10877.Contributor-facing changes
Sped up tests by disabling
blockbusterfixture fortest_static_file_hugeandtest_static_file_huge_canceltests -- by :user:dikos1337.Related issues and pull requests on GitHub:
:issue:
9705, :issue:10761.Updated tests to avoid using deprecated :py:mod:
asynciopolicy APIs andmake it compatible with Python 3.14.
Related issues and pull requests on GitHub:
:issue:
10851.Added Winloop to test suite to support in the future -- by :user:
Vizonex.Related issues and pull requests on GitHub:
:issue:
10922.Miscellaneous internal changes
Added support for the
partitionedattribute in theset_cookiemethod.Related issues and pull requests on GitHub:
:issue:
9870.Setting :attr:
aiohttp.web.StreamResponse.last_modifiedto an unsupported type will now raise :exc:TypeErrorinstead of silently failing -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10146.v3.11.18Compare Source
====================
Bug fixes
Disabled TLS in TLS warning (when using HTTPS proxies) for uvloop and newer Python versions -- by :user:
lezgomatt.Related issues and pull requests on GitHub:
:issue:
7686.Fixed reading fragmented WebSocket messages when the payload was masked -- by :user:
bdraco.The problem first appeared in 3.11.17
Related issues and pull requests on GitHub:
:issue:
10764.v3.11.17Compare Source
====================
Miscellaneous internal changes
Optimized web server performance when access logging is disabled by reducing time syscalls -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10713.Improved web server performance when connection can be reused -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10714.Improved performance of the WebSocket reader -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10740.Improved performance of the WebSocket reader with large messages -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10744.v3.11.16Compare Source
====================
Bug fixes
Replaced deprecated
asyncio.iscoroutinefunctionwith its counterpart frominspect-- by :user:
layday.Related issues and pull requests on GitHub:
:issue:
10634.Fixed :class:
multidict.CIMultiDictbeing mutated when passed to :class:aiohttp.web.Response-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10672.v3.11.15Compare Source
====================
Bug fixes
Reverted explicitly closing sockets if an exception is raised during
create_connection-- by :user:bdraco.This change originally appeared in aiohttp 3.11.13
Related issues and pull requests on GitHub:
:issue:
10464, :issue:10617, :issue:10656.Miscellaneous internal changes
Improved performance of WebSocket buffer handling -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10601.Improved performance of serializing headers -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10625.v3.11.14Compare Source
v3.11.13Compare Source
====================
Bug fixes
Reverted explicitly closing sockets if an exception is raised during
create_connection-- by :user:bdraco.This change originally appeared in aiohttp 3.11.13
Related issues and pull requests on GitHub:
:issue:
10464, :issue:10617, :issue:10656.Miscellaneous internal changes
Improved performance of WebSocket buffer handling -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10601.Improved performance of serializing headers -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10625.v3.11.12Compare Source
====================
Bug fixes
MultipartForm.decode()now follows RFC1341 7.2.1 with aCRLFafter the boundary-- by :user:
imnotjames.Related issues and pull requests on GitHub:
:issue:
10270.Restored the missing
total_bytesattribute toEmptyStreamReader-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10387.Features
Updated :py:func:
~aiohttp.requestto make it accept_RequestOptionskwargs.-- by :user:
Cycloctane.Related issues and pull requests on GitHub:
:issue:
10300.Improved logging of HTTP protocol errors to include the remote address -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10332.Improved documentation
Added
aiohttp-openmetricsto list of third-party libraries -- by :user:jelmer.Related issues and pull requests on GitHub:
:issue:
10304.Packaging updates and notes for downstreams
Added missing files to the source distribution to fix
Makefiletargets.Added a
cythonize-nodepstarget to run Cython without invoking pip to install dependencies.Related issues and pull requests on GitHub:
:issue:
10366.Started building armv7l musllinux wheels -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10404.Contributor-facing changes
The CI/CD workflow has been updated to use
upload-artifactv4 anddownload-artifactv4 GitHub Actions -- by :user:silamon.Related issues and pull requests on GitHub:
:issue:
10281.Miscellaneous internal changes
Restored support for zero copy writes when using Python 3.12 versions 3.12.9 and later or Python 3.13.2+ -- by :user:
bdraco.Zero copy writes were previously disabled due to :cve:
2024-12254which is resolved in these Python versions.Related issues and pull requests on GitHub:
:issue:
10137.v3.11.11Compare Source
====================
Bug fixes
Updated :py:meth:
~aiohttp.ClientSession.requestto reuse thequote_cookiesetting fromClientSession._cookie_jarwhen processing cookies parameter.-- by :user:
Cycloctane.Related issues and pull requests on GitHub:
:issue:
10093.Fixed type of
SSLContextfor some static type checkers (e.g. pyright).Related issues and pull requests on GitHub:
:issue:
10099.Updated :meth:
aiohttp.web.StreamResponse.writeannotation to also allow :class:bytearrayand :class:memoryviewas inputs -- by :user:cdce8p.Related issues and pull requests on GitHub:
:issue:
10154.Fixed a hang where a connection previously used for a streaming
download could be returned to the pool in a paused state.
-- by :user:
javitonino.Related issues and pull requests on GitHub:
:issue:
10169.Features
Enabled ALPN on default SSL contexts. This improves compatibility with some
proxies which don't work without this extension.
-- by :user:
Cycloctane.Related issues and pull requests on GitHub:
:issue:
10156.Miscellaneous internal changes
Fixed an infinite loop that can occur when using aiohttp in combination
with
async-solipsism_ -- by :user:bmerry... _async-solipsism: https://github.com/bmerry/async-solipsism
Related issues and pull requests on GitHub:
:issue:
10149.v3.11.10Compare Source
====================
Bug fixes
Fixed race condition in :class:
aiohttp.web.FileResponsethat could have resulted in an incorrect response if the file was replaced on the file system duringprepare-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10101, :issue:10113.Replaced deprecated call to :func:
mimetypes.guess_typewith :func:mimetypes.guess_file_typewhen using Python 3.13+ -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10102.Disabled zero copy writes in the
StreamWriter-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10125.v3.11.9Compare Source
===================
Bug fixes
Fixed invalid method logging unexpected being logged at exception level on subsequent connections -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10055, :issue:10076.Miscellaneous internal changes
Improved performance of parsing headers when using the C parser -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10073.v3.11.8Compare Source
===================
Miscellaneous internal changes
Improved performance of creating :class:
aiohttp.ClientResponseobjects when there are no cookies -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10029.Improved performance of creating :class:
aiohttp.ClientResponseobjects -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10030.Improved performances of creating objects during the HTTP request lifecycle -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10037.Improved performance of constructing :class:
aiohttp.web.Responsewith headers -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10043.Improved performance of making requests when there are no auto headers to skip -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10049.Downgraded logging of invalid HTTP method exceptions on the first request to debug level -- by :user:
bdraco.HTTP requests starting with an invalid method are relatively common, especially when connected to the public internet, because browsers or other clients may try to speak SSL to a plain-text server or vice-versa. These exceptions can quickly fill the log with noise when nothing is wrong.
Related issues and pull requests on GitHub:
:issue:
10055.v3.11.7Compare Source
===================
Bug fixes
Fixed the HTTP client not considering the connector's
force_closevalue when setting theConnectionheader -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
10003.Miscellaneous internal changes
Improved performance of serializing HTTP headers -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
10014.v3.11.6Compare Source
===================
Bug fixes
Restored the
force_closemethod to theResponseHandler-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9997.v3.11.5Compare Source
===================
Bug fixes
Fixed the
ANYmethod not appearing in :meth:~aiohttp.web.UrlDispatcher.routes-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9899, :issue:9987.v3.11.4Compare Source
===================
Bug fixes
Fixed
StaticResourcenot allowing theOPTIONSmethod after callingset_options_route-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9972, :issue:9975, :issue:9976.Miscellaneous internal changes
Improved performance of creating web responses when there are no cookies -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9895.v3.11.3Compare Source
===================
Bug fixes
Removed non-existing
__author__fromdir(aiohttp)-- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9918.Restored the
FlowControlDataQueueclass -- by :user:bdraco.This class is no longer used internally, and will be permanently removed in the next major version.
Related issues and pull requests on GitHub:
:issue:
9963.Miscellaneous internal changes
Improved performance of resolving resources when multiple methods are registered for the same route -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9899.v3.11.2Compare Source
===================
Bug fixes
Fixed improperly closed WebSocket connections generating an unhandled exception -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9883.v3.11.1Compare Source
====================
Bug fixes
Disabled TLS in TLS warning (when using HTTPS proxies) for uvloop and newer Python versions -- by :user:
lezgomatt.Related issues and pull requests on GitHub:
:issue:
7686.Fixed reading fragmented WebSocket messages when the payload was masked -- by :user:
bdraco.The problem first appeared in 3.11.17
Related issues and pull requests on GitHub:
:issue:
10764.v3.11.0Compare Source
===================
Bug fixes
Raise :exc:
aiohttp.ServerFingerprintMismatchexception on client-side if request through http proxy with mismatching server fingerprint digest:aiohttp.ClientSession(headers=headers, connector=TCPConnector(ssl=aiohttp.Fingerprint(mismatch_digest), trust_env=True).request(...)-- by :user:gangj.Related issues and pull requests on GitHub:
:issue:
6652.Modified websocket :meth:
aiohttp.ClientWebSocketResponse.receive_str, :py:meth:aiohttp.ClientWebSocketResponse.receive_bytes, :py:meth:aiohttp.web.WebSocketResponse.receive_str& :py:meth:aiohttp.web.WebSocketResponse.receive_bytesmethods to raise new :py:exc:aiohttp.WSMessageTypeErrorexception, instead of generic :py:exc:TypeError, when websocket messages of incorrect types are received -- by :user:ara-25.Related issues and pull requests on GitHub:
:issue:
6800.Made
TestClient.appaGenericso type checkers will know the correct type (avoiding unneededclient.app is not Nonechecks) -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8977.Fixed the keep-alive connection pool to be FIFO instead of LIFO -- by :user:
bdraco.Keep-alive connections are more likely to be reused before they disconnect.
Related issues and pull requests on GitHub:
:issue:
9672.Features
Added
strategyparameter to :meth:aiohttp.web.StreamResponse.enable_compressionThe value of this parameter is passed to the :func:
zlib.compressobjfunction, allowing peopleto use a more sufficient compression algorithm for their data served by :mod:
aiohttp.web-- by :user:
shootkinRelated issues and pull requests on GitHub:
:issue:
6257.Added
server_hostnameparameter tows_connect.Related issues and pull requests on GitHub:
:issue:
7941.Exported :py:class:
~aiohttp.ClientWSTimeoutto top-level namespace -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8612.Added
secure/httponly/samesiteparameters to.del_cookie()-- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8956.Updated :py:class:
~aiohttp.ClientSession's auth logic to include default auth only if the request URL's origin matches _base_url; otherwise, the auth will not be included -- by :user:MaximZemskovRelated issues and pull requests on GitHub:
:issue:
8966, :issue:9466.Added
proxyandproxy_authparameters to :py:class:~aiohttp.ClientSession-- by :user:meshya.Related issues and pull requests on GitHub:
:issue:
9207.Added
default_to_multipartparameter toFormData.Related issues and pull requests on GitHub:
:issue:
9335.Added :py:meth:
~aiohttp.ClientWebSocketResponse.send_frameand :py:meth:~aiohttp.web.WebSocketResponse.send_framefor WebSockets -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9348.Updated :py:class:
~aiohttp.ClientSessionto support paths inbase_urlparameter.base_urlpaths must end with a/-- by :user:Cycloctane.Related issues and pull requests on GitHub:
:issue:
9530.Improved performance of reading WebSocket messages with a Cython implementation -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9543, :issue:9554, :issue:9556, :issue:9558, :issue:9636, :issue:9649, :issue:9781.Added
writer_limitto the :py:class:~aiohttp.web.WebSocketResponseto be able to adjust the limit before the writer forces the buffer to be drained -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9572.Added an :attr:
~aiohttp.abc.AbstractAccessLogger.enabledproperty to :class:aiohttp.abc.AbstractAccessLoggerto dynamically check if logging is enabled -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9822.Deprecations (removal in next major release)
Deprecate obsolete
timeout: floatandreceive_timeout: Optional[float]in :py:meth:~aiohttp.ClientSession.ws_connect. Change default websocket receive timeout fromNoneto10.0.Related issues and pull requests on GitHub:
:issue:
3945.Removals and backward incompatible breaking changes
Dropped support for Python 3.8 -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8797.Increased minimum yarl version to 1.17.0 -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
8909, :issue:9079, :issue:9305, :issue:9574.Removed the
is_ipv6_addressandis_ip4_addresshelpers are they are no longer used -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9344.Changed
ClientRequest.connection_keyto be aNamedTupleto improve client performance -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9365.FlowControlDataQueuehas been replaced with theWebSocketDataQueue-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9685.Changed
ClientRequest.request_infoto be aNamedTupleto improve client performance -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9692.Packaging updates and notes for downstreams
Switched to using the :mod:
propcache <propcache.api>package for property caching-- by :user:
bdraco.The :mod:
propcache <propcache.api>package is derived from the property cachingcode in :mod:
yarland has been broken out to avoid maintaining it for multipleprojects.
Related issues and pull requests on GitHub:
:issue:
9394.Separated
aiohttp.http_websocketinto multiple files to make it easier to maintain -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9542, :issue:9552.Contributor-facing changes
Changed diagram images generator from
blockdiagtoGraphViz.Generating documentation now requires the GraphViz executable to be included in $PATH or sphinx build configuration.
Related issues and pull requests on GitHub:
:issue:
9359.Miscellaneous internal changes
Added flake8 settings to avoid some forms of implicit concatenation. -- by :user:
booniepepper.Related issues and pull requests on GitHub:
:issue:
7731.Enabled keep-alive support on proxies (which was originally disabled several years ago) -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
8920.Changed web entry point to not listen on TCP when only a Unix path is passed -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9033.Disabled automatic retries of failed requests in :class:
aiohttp.test_utils.TestClient's client session(which could potentially hide errors in tests) -- by :user:
ShubhAgarwal-dev.Related issues and pull requests on GitHub:
:issue:
9141.Changed web
keepalive_timeoutdefault to around an hour in order to reduce race conditions on reverse proxies -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
9285.Reduced memory required for stream objects created during the client request lifecycle -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9407.Improved performance of the internal
DataQueue-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9659.Improved performance of calling
receivefor WebSockets for the most common message types -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9679.Replace internal helper methods
method_must_be_empty_bodyandstatus_code_must_be_empty_bodywith simplesetlookups -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9722.Improved performance of :py:class:
aiohttp.BaseConnectorwhen there is nolimit_per_host-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9756.Improved performance of sending HTTP requests when there is no body -- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
9757.Improved performance of the
WebsocketWriterwhen the protocol is not paused -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9796.Implemented zero copy writes for
StreamWriter-- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
9839.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.