Sourced from flask's releases.

3.0.3

This is a fix release for the 3.0.x feature branch.

PyPI: https://pypi.org/project/Flask/3.0.3/ Changes: https://flask.palletsprojects.com/en/3.0.x/changes/#version-3-0-3 Milestone: https://github.com/pallets/flask/milestone/35?closed=1

• The default hashlib.sha1 may not be available in FIPS builds. Don't access it at import time so the developer has time to change the default. #5448
• Don't initialize the cli attribute in the sansio scaffold, but rather in the Flask concrete class. #5270

3.0.2

This is a fix release for the 3.0.x feature release branch. It fixes bugs but does not otherwise change behavior and should not result in breaking changes.

• Changes: https://flask.palletsprojects.com/en/3.0.x/changes/#version-3.0.2
• Milestone: https://github.com/pallets/flask/milestone/34?closed=1
• PyPI: https://pypi.org/project/Flask/3.0.2/

3.0.1

This is a fix release for the 3.0.x feature release branch.

Fixes an issue where using other JSON providers, such as flask-orjson, previously caused loaded session data to have an incorrect format in some cases.

• Changes: https://flask.palletsprojects.com/en/3.0.x/changes/#version-3-0-1
• Milestone: https://github.com/pallets/flask/milestone/32?closed=1
• PyPI: https://pypi.org/project/Flask/3.0.1/

Sourced from flask's changelog.

Version 3.0.3

Released 2024年04月07日

• The default hashlib.sha1 may not be available in FIPS builds. Don't access it at import time so the developer has time to change the default. :issue:5448
• Don't initialize the cli attribute in the sansio scaffold, but rather in the Flask concrete class. :pr:5270

Version 3.0.2

Released 2024年02月03日

• Correct type for jinja_loader property. :issue:5388
• Fix error with --extra-files and --exclude-patterns CLI options. :issue:5391

Version 3.0.1

Released 2024年01月18日

• Correct type for path argument to send_file. :issue:5230
• Fix a typo in an error message for the flask run --key option. :pr:5344
• Session data is untagged without relying on the built-in json.loads object_hook. This allows other JSON providers that don't implement that. :issue:5381
• Address more type findings when using mypy strict mode. :pr:5383

• c12a5d8 release version 3.0.3
• 5e22cc9 Don't set the cli attribute in the sansio scaffold (#5270)
• 5fdce4c Don't set the cli attribute in the sansio scaffold
• adb7dd9 don't access app.logger when configuring app.logger
• b739390 support FIPS builds without SHA-1 (#5460)
• db46111 access sha1 lazily
• 7320e31 start version 3.0.3
• 87d5f5b update project files (#5457)
• d5e321b release version 3.0.2 (#5403)
• d203059 release version 3.0.2
• Additional commits viewable in compare view

Sourced from flask-httpauth's releases.

Release 4.8.0

See CHANGE.LOG for release notes.

Sourced from flask-httpauth's changelog.

Flask-HTTPAuth change log

Release 4.8.0 - 2023年04月27日

• Changes to handle breaking changes in Flask/Werkzeug 2.3 #160 (commit)
• Remove Python 3.6 and 3.7 from builds, add Python 3.11 (commit)
• Replace itsdangerous with pyjwt in examples #157 (commit)
• Better documentation for the get_user_roles callback argument #152 (commit) (thanks Taranjeet Singh!)

Release 4.7.0 - 2022年05月29日

• Fallback to latin-1 encoding for credentials when utf-8 fails #151 (commit)
• Documentation updates (commit)

Release 4.6.0 - 2022年04月21日

• Add MD5-Sess algorithm for Digest auth (commit)
• Add qop=auth option for Digest auth (commit) (thanks Edward!)
• Add Python 3.10 and PyPy 3.8 to build (commit)

Release 4.5.0 - 2021年10月25日

• Support for Flask 2 async views (commit)
• Do not read the request body #138 (commit)
• Remove unused flask.g import in token authentication example #137 (commit) (thanks Jonas Sandström!)
• Fixed documentation typo #127 (commit) (thanks Reggie V!)

Release 4.4.0 - 2021年05月13日

• Replace safe_str_cmp with hmac.compare_digest to avoid a deprecation warning from Werkzeug #126 (commit) (thanks Federico Martinez!)
• Drop Python 2 support (commit)

Release 4.3.0 - 2021年05月01日

• Support token auth with custom header in MultiAuth class #125 (commit)
• Catch UnicodeDecodeError when passing malformed data in authorization header #122 (commit) (thanks Bastian Raschke!)
• Fixes typo #116 (commit) (thanks Renato Oliveira!)
• Move builds to GitHub actions (commit)

Release 4.2.0 - 2020年11月16日

• Allow error response to return a 200 status code #114 (commit)
• Add optional argument to MultiAuth class #115 (commit) (thanks pryankster and Michael Wright!)
• Remove python 3.5 and add python 3.9 to build (commit)

Release 4.1.0 - 2020年06月04日

• Basic authentication with custom scheme (commit)

Release 4.0.0 - 2020年04月26日

... (truncated)

• 4d01283 Release 4.8.0
• 7654839 Support for breaking changes in Flask/Werkzeug 2.3 (Fixes #160)
• 15498a3 Upgrade GitHub actions #nolog
• 04399bd Remove Python 3.6 from builds, add Python 3.11
• 60552cc update tox.ini #nolog
• 6f708b0 Replace itsdangerous with pyjwt in examples (Fixes #157)
• 03ff944 Better documentation for the get_user_roles callback argument (#152)
• f2b70b2 Version 4.7.1.dev0
• See full diff in compare view

Sourced from gunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024年04月17日
===================

use utime to notify workers liveness
migrate setup to pyproject.toml
fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
parsing additional requests is no longer attempted past unsupported request framing
on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
Trailer fields are no longer inspected for headers indicating secure scheme
support Python 3.12

** Breaking changes **

minimum version is Python 3.7
the limitations on valid characters in the HTTP method have been bounded to Internet Standards
requests specifying unsupported transfer coding (order) are refused by default (rare)
HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
HTTP methods containing the number sign (#) are no longer accepted by default (rare)
HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)

** SECURITY **
fix CVE-2024-1135

1. Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
2. Packages: https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023年07月19日
===================
fix thread worker: revert change considering connection as idle .
</tr></table> 

... (truncated)

• f63d59e bump to 22.0
• 4ac81e0 Merge pull request #3175 from e-kwsm/typo
• 401cecf Merge pull request #3179 from dhdaines/exclude-eventlet-0360
• 0243ec3 fix(deps): exclude eventlet 0.36.0
• 628a0bc chore: fix typos
• 88fc4a4 Merge pull request #3131 from pajod/patch-py12-rebased
• deae2fc CI: back off the agressive timeout
• f470382 docs: promise 3.12 compat
• 5e30bfa add changelog to project.urls (updated for PEP621)
• 481c3f9 remove setup.cfg - overridden by pyproject.toml
• Additional commits viewable in compare view

Sourced from kubernetes's releases.

Kubernetes Python Client v30.1.0 Stable Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v30.1.0.zip
cd client-python-v30.1.0
python setup.py install

Then follow examples in https://github.com/kubernetes-client/python/tree/release-30.0/examples

Changelog: https://github.com/kubernetes-client/python/blob/release-30.0/CHANGELOG.md

Kubernetes Python Client v30.1.0 Beta 1 Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v30.1.0b1.zip
cd client-python-v30.1.0b1
python setup.py install

Then follow examples in https://github.com/kubernetes-client/python/tree/release-30.0/examples

Changelog: https://github.com/kubernetes-client/python/blob/release-30.0/CHANGELOG.md

Kubernetes Python Client v30.1.0 Alpha 1 Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v30.1.0a1.zip
cd client-python-v30.1.0a1
</tr></table> 

... (truncated)

Sourced from kubernetes's changelog.

v30.1.0b1

Kubernetes API Version: v1.30.1

v30.1.0a1

Kubernetes API Version: v1.30.1

API Change

• Fixes a 1.30.0 regression in openapi descriptions of imagePullSecrets and hostAliases fields to mark the fields used as keys in those lists as either defaulted or required. (kubernetes/kubernetes#124553, @​pmalek) [SIG API Machinery]

• Fixes a 1.30.0 regression in openapi descriptions of imagePullSecrets and hostAliases fields to mark the fields used as keys in those lists as either defaulted or required. (kubernetes/kubernetes#124694, @​pmalek) [SIG API Machinery]

• Added (alpha) support for the managedBy field on Jobs. Jobs with a custom value of this field - any value other than kubernetes.io/job-controller - were skipped by the job controller, and their reconciliation was delegated to an external controller, indicated by the value of the field. Jobs that didn't have this field at all, or where the field value was the reserved string kubernetes.io/job-controller, were reconciled by the built-in job controller. (kubernetes/kubernetes#123273, @​mimowo)

• Added alpha-level support for the SuccessPolicy in Jobs. (kubernetes/kubernetes#123412, @​tenzen-y)

• Added the CEL library for IP Addresses and CIDRs. This was made available for use starting from version 1.31. (kubernetes/kubernetes#121912, @​JoelSpeed)

• Allowed container runtimes to fix an image garbage collection bug by adding an image_id field to the CRI Container message. (kubernetes/kubernetes#123508, @​saschagrunert)

• Dynamic Resource Allocation: DRA drivers can now use "structured parameters" to let the scheduler handle claim allocation. (kubernetes/kubernetes#123516, @​pohly)

• Fixed accidental enablement of the new alpha optionalOldSelf API field in CustomResourceDefinition validation rules, which should only have been allowed to be set when the CRDValidationRatcheting feature gate is enabled. (kubernetes/kubernetes#122329, @​jpbetz)

• Implemented the prescore extension point for the volumeBinding plugin. It now returns skip if it doesn't do anything in Score. (kubernetes/kubernetes#115768, @​AxeZhan)

• Kubelet would fail if NodeSwap was used with LimitedSwap and cgroupv1 node. (kubernetes/kubernetes#123738, @​kannon92)

• Promoted AdmissionWebhookMatchConditions to GA. The feature is now stable, and the feature gate is now locked to default. (kubernetes/kubernetes#123560, @​ivelichkovich)

• Structured Authentication Configuration now supports DiscoveryURL. If specified, discoveryURL overrides the URL used to fetch discovery information. This is for scenarios where the well-known and jwks endpoints are hosted at a different location than the issuer (such as locally in the cluster). (kubernetes/kubernetes#123527, @​aramase)

• The StorageVersionMigration API, previously available as a Custom Resource Definition (CRD), is now a built-in API in Kubernetes. (kubernetes/kubernetes#123344, @​nilekhc)

• When configuring a JWT authenticator:

  If username.expression used 'claims.email', then 'claims.email_verified' must have been used in username.expression or extra[*].valueExpression or claimValidationRules[*].expression. An example claim validation rule expression that matches the validation automatically applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true)'. (kubernetes/kubernetes#123737, @​enj)

• readOnly volumes now support recursive read-only mounts for kernel versions >= 5.12." (kubernetes/kubernetes#123180, @​AkihiroSuda)

• cri-api: Implemented KEP-3857: Recursive Read-only (RRO) mounts. (kubernetes/kubernetes#123272, @​AkihiroSuda)

• kube-apiserver: the AuthenticationConfiguration type accepted in --authentication-config files has been promoted to apiserver.config.k8s.io/v1beta1. (kubernetes/kubernetes#123696, @​aramase)

• kubelet allowed specifying a custom root directory for pod logs (instead of the default /var/log/pods) using the podLogsDir key in kubelet configuration. (kubernetes/kubernetes#112957, @​mxpv)

• resource.k8s.io/ResourceClaim (alpha API): The strategic merge patch strategy for the status.reservedFor array was changed so that a strategic-merge-patch can now add individual entries. This change may break clients using strategic merge patch to update status, which rely on the previous behavior (replacing the entire array). (kubernetes/kubernetes#122276, @​pohly)

• Added a CBOR implementation of runtime.Serializer. Until CBOR graduates to Alpha, API servers will refuse to start if configured with CBOR support. (kubernetes/kubernetes#122881, @​benluddy)

• Added a alpha feature, behind the RelaxedEnvironmentVariableValidation feature gate.

... (truncated)

• See full diff in compare view

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Wheel package bundled with PostgreSQL 16 libpq in order to add support for recent features, such as sslcertmode.

What's new in psycopg 2.9.7 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix propagation of exceptions raised during module initialization (:ticket:[#1598](https://github.com/psycopg/psycopg2/issues/1598)).
• Fix building when pg_config returns an empty string (:ticket:[#1599](https://github.com/psycopg/psycopg2/issues/1599)).
• Wheel package bundled with OpenSSL 1.1.1v.

What's new in psycopg 2.9.6 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Package manylinux 2014 for aarch64 and ppc64le platforms, in order to include libpq 15 in the binary package (:ticket:[#1396](https://github.com/psycopg/psycopg2/issues/1396)).
• Wheel package bundled with OpenSSL 1.1.1t.

What's new in psycopg 2.9.5 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.11.
• Add support for rowcount in MERGE statements in binary packages (:ticket:[#1497](https://github.com/psycopg/psycopg2/issues/1497)).
• Wheel package bundled with OpenSSL 1.1.1r and PostgreSQL 15 libpq.

What's new in psycopg 2.9.4 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix ~psycopg2.extras.register_composite(), ~psycopg2.extras.register_range() with customized :sql:search_path (:ticket:[#1487](https://github.com/psycopg/psycopg2/issues/1487)).
• Handle correctly composite types with names or in schemas requiring escape.

... (truncated)

• ad5bee7 chore: bump version number to 2.9.9
• 37d1de1 chore: add support for Python 3.12
• abf2723 chore: drop support for Python 3.6
• 2da65a7 chore: drop leftover Python 2.7 import aliases from setup.py
• 3fa60fd chore: bump doc requirement complained by dependabot
• 1c1484e ci: better interaction with scaleway build server
• c81cec6 chore: bump to next dev release
• 7fe8cb7 chore: bump docs requirements dependabot complains about
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions