Sourced from flask's releases.

3.0.3

This is a fix release for the 3.0.x feature branch.

PyPI: https://pypi.org/project/Flask/3.0.3/ Changes: https://flask.palletsprojects.com/en/3.0.x/changes/#version-3-0-3 Milestone: https://github.com/pallets/flask/milestone/35?closed=1

• The default hashlib.sha1 may not be available in FIPS builds. Don't access it at import time so the developer has time to change the default. #5448
• Don't initialize the cli attribute in the sansio scaffold, but rather in the Flask concrete class. #5270

3.0.2

This is a fix release for the 3.0.x feature release branch. It fixes bugs but does not otherwise change behavior and should not result in breaking changes.

• Changes: https://flask.palletsprojects.com/en/3.0.x/changes/#version-3.0.2
• Milestone: https://github.com/pallets/flask/milestone/34?closed=1
• PyPI: https://pypi.org/project/Flask/3.0.2/

3.0.1

This is a fix release for the 3.0.x feature release branch.

Fixes an issue where using other JSON providers, such as flask-orjson, previously caused loaded session data to have an incorrect format in some cases.

• Changes: https://flask.palletsprojects.com/en/3.0.x/changes/#version-3-0-1
• Milestone: https://github.com/pallets/flask/milestone/32?closed=1
• PyPI: https://pypi.org/project/Flask/3.0.1/

Sourced from flask's changelog.

Version 3.0.3

Released 2024年04月07日

• The default hashlib.sha1 may not be available in FIPS builds. Don't access it at import time so the developer has time to change the default. :issue:5448
• Don't initialize the cli attribute in the sansio scaffold, but rather in the Flask concrete class. :pr:5270

Version 3.0.2

Released 2024年02月03日

• Correct type for jinja_loader property. :issue:5388
• Fix error with --extra-files and --exclude-patterns CLI options. :issue:5391

Version 3.0.1

Released 2024年01月18日

• Correct type for path argument to send_file. :issue:5230
• Fix a typo in an error message for the flask run --key option. :pr:5344
• Session data is untagged without relying on the built-in json.loads object_hook. This allows other JSON providers that don't implement that. :issue:5381
• Address more type findings when using mypy strict mode. :pr:5383

• c12a5d8 release version 3.0.3
• 5e22cc9 Don't set the cli attribute in the sansio scaffold (#5270)
• 5fdce4c Don't set the cli attribute in the sansio scaffold
• adb7dd9 don't access app.logger when configuring app.logger
• b739390 support FIPS builds without SHA-1 (#5460)
• db46111 access sha1 lazily
• 7320e31 start version 3.0.3
• 87d5f5b update project files (#5457)
• d5e321b release version 3.0.2 (#5403)
• d203059 release version 3.0.2
• Additional commits viewable in compare view

Sourced from flask-httpauth's releases.

Release 4.8.0

See CHANGE.LOG for release notes.

Sourced from flask-httpauth's changelog.

Flask-HTTPAuth change log

Release 4.8.0 - 2023年04月27日

• Changes to handle breaking changes in Flask/Werkzeug 2.3 #160 (commit)
• Remove Python 3.6 and 3.7 from builds, add Python 3.11 (commit)
• Replace itsdangerous with pyjwt in examples #157 (commit)
• Better documentation for the get_user_roles callback argument #152 (commit) (thanks Taranjeet Singh!)

Release 4.7.0 - 2022年05月29日

• Fallback to latin-1 encoding for credentials when utf-8 fails #151 (commit)
• Documentation updates (commit)

Release 4.6.0 - 2022年04月21日

• Add MD5-Sess algorithm for Digest auth (commit)
• Add qop=auth option for Digest auth (commit) (thanks Edward!)
• Add Python 3.10 and PyPy 3.8 to build (commit)

Release 4.5.0 - 2021年10月25日

• Support for Flask 2 async views (commit)
• Do not read the request body #138 (commit)
• Remove unused flask.g import in token authentication example #137 (commit) (thanks Jonas Sandström!)
• Fixed documentation typo #127 (commit) (thanks Reggie V!)

Release 4.4.0 - 2021年05月13日

• Replace safe_str_cmp with hmac.compare_digest to avoid a deprecation warning from Werkzeug #126 (commit) (thanks Federico Martinez!)
• Drop Python 2 support (commit)

Release 4.3.0 - 2021年05月01日

• Support token auth with custom header in MultiAuth class #125 (commit)
• Catch UnicodeDecodeError when passing malformed data in authorization header #122 (commit) (thanks Bastian Raschke!)
• Fixes typo #116 (commit) (thanks Renato Oliveira!)
• Move builds to GitHub actions (commit)

Release 4.2.0 - 2020年11月16日

• Allow error response to return a 200 status code #114 (commit)
• Add optional argument to MultiAuth class #115 (commit) (thanks pryankster and Michael Wright!)
• Remove python 3.5 and add python 3.9 to build (commit)

Release 4.1.0 - 2020年06月04日

• Basic authentication with custom scheme (commit)

Release 4.0.0 - 2020年04月26日

... (truncated)

• 4d01283 Release 4.8.0
• 7654839 Support for breaking changes in Flask/Werkzeug 2.3 (Fixes #160)
• 15498a3 Upgrade GitHub actions #nolog
• 04399bd Remove Python 3.6 from builds, add Python 3.11
• 60552cc update tox.ini #nolog
• 6f708b0 Replace itsdangerous with pyjwt in examples (Fixes #157)
• 03ff944 Better documentation for the get_user_roles callback argument (#152)
• f2b70b2 Version 4.7.1.dev0
• See full diff in compare view

Sourced from gunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024年04月17日
===================

use utime to notify workers liveness
migrate setup to pyproject.toml
fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
parsing additional requests is no longer attempted past unsupported request framing
on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
Trailer fields are no longer inspected for headers indicating secure scheme
support Python 3.12

** Breaking changes **

minimum version is Python 3.7
the limitations on valid characters in the HTTP method have been bounded to Internet Standards
requests specifying unsupported transfer coding (order) are refused by default (rare)
HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
HTTP methods containing the number sign (#) are no longer accepted by default (rare)
HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)

** SECURITY **
fix CVE-2024-1135

1. Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
2. Packages: https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023年07月19日
===================
fix thread worker: revert change considering connection as idle .
</tr></table> 

... (truncated)

• f63d59e bump to 22.0
• 4ac81e0 Merge pull request #3175 from e-kwsm/typo
• 401cecf Merge pull request #3179 from dhdaines/exclude-eventlet-0360
• 0243ec3 fix(deps): exclude eventlet 0.36.0
• 628a0bc chore: fix typos
• 88fc4a4 Merge pull request #3131 from pajod/patch-py12-rebased
• deae2fc CI: back off the agressive timeout
• f470382 docs: promise 3.12 compat
• 5e30bfa add changelog to project.urls (updated for PEP621)
• 481c3f9 remove setup.cfg - overridden by pyproject.toml
• Additional commits viewable in compare view

Sourced from kubernetes's releases.

Kubernetes Python Client v29.0.0 Stable Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v29.0.0.zip
cd client-python-v29.0.0
python setup.py install

Then follow examples in https://github.com/kubernetes-client/python/tree/release-29.0/examples

Changelog: https://github.com/kubernetes-client/python/blob/release-29.0/CHANGELOG.md

Kubernetes Python Client v29.0.0 Beta 1 Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v29.0.0b1.zip
cd client-python-v29.0.0b1
python setup.py install

Then follow examples in https://github.com/kubernetes-client/python/tree/release-29.0/examples

Changelog: https://github.com/kubernetes-client/python/blob/release-29.0/CHANGELOG.md

Kubernetes Python Client v29.0.0 Alpha 1 Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v29.0.0a1.zip
cd client-python-v29.0.0a1
</tr></table> 

... (truncated)

Sourced from kubernetes's changelog.

v29.0.0

Kubernetes API Version: v1.29.0

Bug or Regression

• Fix UTF-8 failures in Watch (#2100, @​davidopic)
• Fix upper version boundary of urllib3, since other dependencies don't support urllib3 in version 2 (#2105, @​jsaalfeld)

v29.0.0b1

Kubernetes API Version: v1.29.0

Bug or Regression

• Fix UTF-8 failures in Watch (#2100, @​davidopic)
• Fix upper version boundary of urllib3, since other dependencies don't support urllib3 in version 2 (#2105, @​jsaalfeld)

v29.0.0a1

Kubernetes API Version: v1.29.0

API Change

• 'kube-apiserver: adds --authentication-config flag for reading AuthenticationConfiguration files. --authentication-config flag is mutually exclusive with the existing --oidc-* flags.' (kubernetes/kubernetes#119142, @​aramase)
• 'kube-scheduler component config (KubeSchedulerConfiguration) kubescheduler.config.k8s.io/v1beta3 is removed in v1.29. Migrated kube-scheduler configuration files to kubescheduler.config.k8s.io/v1.' (kubernetes/kubernetes#119994, @​SataQiu)
• A new sleep action for the PreStop lifecycle hook was added, allowing containers to pause for a specified duration before termination. (kubernetes/kubernetes#119026, @​AxeZhan)
• Added CEL expressions to v1alpha1 AuthenticationConfiguration. (kubernetes/kubernetes#121078, @​aramase)
• Added Windows support for InPlace Pod Vertical Scaling feature. (kubernetes/kubernetes#112599, @​fabi200123) [SIG Autoscaling, Node, Scalability, Scheduling and Windows]
• Added ImageMaximumGCAge field to Kubelet configuration, which allows a user to set the maximum age an image is unused before it's garbage collected. (kubernetes/kubernetes#121275, @​haircommander)
• Added UserNamespacesPodSecurityStandards feature gate to enable user namespace support for Pod Security Standards. Enabling this feature will modify all Pod Security Standard rules to allow setting: spec[.*].securityContext.[runAsNonRoot,runAsUser]. This feature gate should only be enabled if all nodes in the cluster support the user namespace feature and have it enabled. The feature gate will not graduate or be enabled by default in future Kubernetes releases. (kubernetes/kubernetes#118760, @​saschagrunert) [SIG API Machinery, Auth, Node and Release]
• Added optionalOldSelf to x-kubernetes-validations to support ratcheting CRD schema constraints. (kubernetes/kubernetes#121034, @​alexzielenski)
• Added a new ServiceCIDR type that allows to dynamically configure the cluster range used to allocate Service ClusterIPs addresses. (kubernetes/kubernetes#116516, @​aojea)
• Added a new ipMode field to the .status of Services where type is set to LoadBalancer. The new field is behind the LoadBalancerIPMode feature gate. (kubernetes/kubernetes#119937, @​RyanAoh) [SIG API Machinery, Apps, Cloud Provider, Network and Testing]
• Added options for configuring nf_conntrack_udp_timeout, and nf_conntrack_udp_timeout_stream variables of netfilter conntrack subsystem. (kubernetes/kubernetes#120808, @​aroradaman)
• Added support for CEL expressions to v1alpha1 AuthorizationConfiguration webhook matchConditions. (kubernetes/kubernetes#121223, @​ritazh)
• Added support for projecting certificates.k8s.io/v1alpha1 ClusterTrustBundle objects into pods. (kubernetes/kubernetes#113374, @​ahmedtd)
• Added the DisableNodeKubeProxyVersion feature gate. If DisableNodeKubeProxyVersion is enabled, the kubeProxyVersion field is not set. (kubernetes/kubernetes#120954, @​HirazawaUi)
• Fixed a bug where CEL expressions in CRD validation rules would incorrectly compute a high estimated cost for functions that return strings, lists or maps. The incorrect cost was evident when the result of a function was used in subsequent operations. (kubernetes/kubernetes#119800, @​jpbetz) [SIG API Machinery, Auth and Cloud Provider]
• Fixed the API comments for the Job Ready field in status. (kubernetes/kubernetes#121765, @​mimowo)
• Fixed the API comments for the FailIndex Job pod failure policy action. (kubernetes/kubernetes#121764, @​mimowo)
• Go API: the ResourceRequirements struct was replaced with VolumeResourceRequirements for use with volumes. (kubernetes/kubernetes#118653, @​pohly)
• Graduated Job BackoffLimitPerIndex feature to beta. (kubernetes/kubernetes#121356, @​mimowo)
• Marked the onPodConditions field as optional in Job's pod failure policy. (kubernetes/kubernetes#120204, @​mimowo)
• Promoted PodReadyToStartContainers condition to beta. (kubernetes/kubernetes#119659, @​kannon92)

... (truncated)

• See full diff in compare view

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Wheel package bundled with PostgreSQL 16 libpq in order to add support for recent features, such as sslcertmode.

What's new in psycopg 2.9.7 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix propagation of exceptions raised during module initialization (:ticket:[#1598](https://github.com/psycopg/psycopg2/issues/1598)).
• Fix building when pg_config returns an empty string (:ticket:[#1599](https://github.com/psycopg/psycopg2/issues/1599)).
• Wheel package bundled with OpenSSL 1.1.1v.

What's new in psycopg 2.9.6 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Package manylinux 2014 for aarch64 and ppc64le platforms, in order to include libpq 15 in the binary package (:ticket:[#1396](https://github.com/psycopg/psycopg2/issues/1396)).
• Wheel package bundled with OpenSSL 1.1.1t.

What's new in psycopg 2.9.5 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.11.
• Add support for rowcount in MERGE statements in binary packages (:ticket:[#1497](https://github.com/psycopg/psycopg2/issues/1497)).
• Wheel package bundled with OpenSSL 1.1.1r and PostgreSQL 15 libpq.

What's new in psycopg 2.9.4 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix ~psycopg2.extras.register_composite(), ~psycopg2.extras.register_range() with customized :sql:search_path (:ticket:[#1487](https://github.com/psycopg/psycopg2/issues/1487)).
• Handle correctly composite types with names or in schemas requiring escape.

... (truncated)

• ad5bee7 chore: bump version number to 2.9.9
• 37d1de1 chore: add support for Python 3.12
• abf2723 chore: drop support for Python 3.6
• 2da65a7 chore: drop leftover Python 2.7 import aliases from setup.py
• 3fa60fd chore: bump doc requirement complained by dependabot
• 1c1484e ci: better interaction with scaleway build server
• c81cec6 chore: bump to next dev release
• 7fe8cb7 chore: bump docs requirements dependabot complains about
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions