Bump waitress from 2.1.2 to 3.0.1

[dependabot]

Bumps waitress from 2.1.2 to 3.0.1.

Release notes

Sourced from waitress's releases.

v3.0.1

3.0.1 (2024-10-28)

Backward Incompatibilities

• Python 3.8 is no longer supported. See Pylons/waitress#445.

Features

• Added support for Python 3.13. See Pylons/waitress#445.

Security

• Fix a bug that would lead to Waitress busy looping on select() on a half-open socket due to a race condition that existed when creating a new HTTPChannel. See Pylons/waitress#435, Pylons/waitress#418 and GHSA-3f84-rpwh-47g6

  With thanks to Dylan Jay and Dieter Maurer for their extensive debugging and helping track this down.

• No longer strip the header values before passing them to the WSGI environ. See Pylons/waitress#434 and Pylons/waitress#432

• Fix a race condition in Waitress when channel_request_lookahead is enabled that could lead to HTTP request smuggling.

  See GHSA-9298-4cf8-g4wj

v3.0.0

3.0.0 (2024-02-04)

• Rename "master" git branch to "main"

• Fix a bug that would appear on macOS whereby if we accept() a socket that is already gone, setting socket options would fail and take down the server. See Pylons/waitress#399

• Fixed testing of vendored asyncore code to not rely on particular naming for errno's. See Pylons/waitress#397

• HTTP Request methods and versions are now validated to meet the HTTP

... (truncated)

Changelog

Sourced from waitress's changelog.

3.0.1 (2024-10-28)

Backward Incompatibilities

- Python 3.8 is no longer supported.
  See https://github.com/Pylons/waitress/pull/445.
Features

- Added support for Python 3.13.
  See https://github.com/Pylons/waitress/pull/445.
Security




Fix a bug that would lead to Waitress busy looping on select() on a half-open

socket due to a race condition that existed when creating a new HTTPChannel.

See Pylons/waitress#435,

Pylons/waitress#418 and

GHSA-3f84-rpwh-47g6
With thanks to Dylan Jay and Dieter Maurer for their extensive debugging and

helping track this down.


No longer strip the header values before passing them to the WSGI environ.

See Pylons/waitress#434 and

Pylons/waitress#432


Fix a race condition in Waitress when channel_request_lookahead is enabled

that could lead to HTTP request smuggling.
See GHSA-9298-4cf8-g4wj


3.0.0 (2024-02-04)


Rename "master" git branch to "main"


Fix a bug that would appear on macOS whereby if we accept() a socket that is

already gone, setting socket options would fail and take down the server. See

Pylons/waitress#399


Fixed testing of vendored asyncore code to not rely on particular naming for

errno's. See Pylons/waitress#397


HTTP Request methods and versions are now validated to meet the HTTP

standards thereby dropping invalid requests on the floor. See

</tr></table>

... (truncated)

Commits

• ae949bb Ready for 3.0.1
• e435901 Merge commit from fork
• 810a435 Add documentation for channel_request_lookahead
• f4ba1c2 Fix a race condition on recv_bytes boundary when request is invalid
• 7e7f11e Add a new test to validate the lookahead race condition
• 6943dcf Make DummySock() look more like an actual socket
• fdd2ecf Merge pull request #445 from Pylons/feature/support-py-3-13
• dcd18e7 Update exclude matrix
• 4633ea6 Drop Python 3.8 and add Python 3.13
• 4584936 Merge pull request #440 from Pylons/fix/ci
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by Sourcery

Bump the Waitress server from version 2.1.2 to 3.0.1, introducing support for Python 3.13 and dropping support for Python 3.8. Address several security vulnerabilities and bugs, including race conditions that could lead to busy looping and HTTP request smuggling. Rename the 'master' branch to 'main'.

New Features:

• Add support for Python 3.13 in the Waitress server.

Bug Fixes:

• Fix a bug causing Waitress to busy loop on select() on a half-open socket due to a race condition.
• Fix a race condition in Waitress when channel_request_lookahead is enabled that could lead to HTTP request smuggling.
• Fix a bug on macOS where accepting a socket that is already gone would fail and take down the server.

Enhancements:

• Rename the 'master' git branch to 'main'.

[sourcery-ai]

Reviewer's Guide by Sourcery

This PR updates the waitress dependency from version 2.1.2 to 3.0.1. The update includes several security fixes, feature additions, and backward compatibility changes. The implementation is straightforward as it only involves updating the version number in the dependency configuration.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change	Details	Files
Update waitress package version with security improvements	Fix race condition in HTTPChannel creation that caused busy looping on select() Fix security vulnerability related to header value handling in WSGI environ Address HTTP request smuggling vulnerability when channel_request_lookahead is enabled	poetry.lock
Update Python version compatibility	Drop support for Python 3.8 Add support for Python 3.13	poetry.lock

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time. You can also use
  this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, dependabot[bot]!). We assume it knows what it's doing!

[codeclimate]

Code Climate has analyzed commit e72ada8 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (75% is the threshold).

This pull request will bring the total coverage in the repository to 91.4% (0.0% change).

View more on Code Climate.