Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-aiohttp for openSUSE:Factory checked in at 2026-08-06 16:18:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-aiohttp (Old) and /work/SRC/openSUSE:Factory/.python-aiohttp.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-aiohttp" Thu Aug 6 16:18:25 2026 rev:70 rq:1369672 version:3.14.3 Changes: -------- --- /work/SRC/openSUSE:Factory/python-aiohttp/python-aiohttp.changes 2026-06-22 18:05:07.920597304 +0200 +++ /work/SRC/openSUSE:Factory/.python-aiohttp.new.16738/python-aiohttp.changes 2026-08-06 16:18:43.249157856 +0200 @@ -1,0 +2,70 @@ +Wed Aug 5 06:46:50 UTC 2026 - Daniel Garcia <[email protected]> + +Fixes: + - CVE-2026-59881, bsc#1273125 + - CVE-2026-69244, bsc#1273552 + - CVE-2026-69243, bsc#1273553 + +- Update to 3.14.3 + # Bug fixes + - Fixed the client dropping only the first Authorization, Cookie and + Proxy-Authorization header when a redirect crossed an origin + - Fixed error message construction in the C HTTP parser +- 3.14.2 + # Bug fixes + - Fixed :py:attr:`~aiohttp.web.StreamResponse.last_modified` + rounding a :class:`datetime.datetime` with a fractional second + down. + - Fixed resolving localhost on Windows to fall back without + AI_ADDRCONFIG when the first lookup fails, so localhost still + works without an active network. + - Rejected multipart body parts whose Content-Length header is not a + plain sequence of digits (e.g. +5, -1, 1_0), matching the + strictness of the main request parser per RFC 9110 + - Fixed GunicornWebWorker endlessly reloading when app fails during + startup + - Fixed some inconsistent case sensitivity on request methods + - Fixed IndexError: string index out of range in + parse_content_disposition when a header parameter has an empty + value (e.g. filename=). + - Fixed the sock_read timeout being re-armed on a keep-alive + connection after it had been returned to the pool. An idle pooled + connection could be left with a pending read timeout that fired + and poisoned it, so the next request reusing the connection failed + immediately with :exc:`aiohttp.SocketTimeoutError`. The read + timeout is now only rescheduled when resuming a transport that was + actually paused + - Fixed the client decompressing frames when permessage-deflate was + not negotiated + - Fixed DigestAuthMiddleware raising an IndexError on empty domain + - Fixed :class:`~aiohttp.DigestAuthMiddleware` corrupting the Digest + challenge when a WWW-Authenticate response offered more than one + authentication scheme + - Fixed client not closing cleanly after an exception + - Fixed control frames breaking fragmented WebSocket messages + - Fixed parse_content_disposition rejecting otherwise-valid + Content-Disposition header values that contain optional whitespace + (OWS) around the disposition type (e.g. "form-data ; + name=\"field\""). The disposition type is now stripped before + token validation, consistent with how parameter keys are already + handled + - Fixed an :exc:`IndexError` in the pure-Python HTTP parser + - Fixed parsing optional whitespace in Content-Disposition + - Fixed request body not being read on rejected WebSocket upgrades + - Fixed :exc:`LookupError` (and an unguarded + :exc:`UnicodeDecodeError`) escaping Content-Disposition parsing + when a multipart part supplies an extended parameter with an + unknown charset + - Fixed escape_quotes in the Digest authentication middleware not + escaping backslashes, so a WWW-Authenticate challenge value + containing a backslash could break out of its quoted-string in the + generated Authorization header + - Fixed Python parser not rejecting a bare LF in the request line + - Fixed the C HTTP parser folding the fragment into the query string + for an origin-form request target with an empty query (e.g. + /path?#frag), which diverged from the pure-Python parser + - Fixed the C parser reporting newer HTTP methods such as QUERY as + <unknown>; the method table is now derived from the vendored + llhttp instead of a hand-maintained count + +------------------------------------------------------------------- Old: ---- aiohttp-3.14.1.tar.gz New: ---- aiohttp-3.14.3.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-aiohttp.spec ++++++ --- /var/tmp/diff_new_pack.NXARAy/_old 2026-08-06 16:18:44.433199292 +0200 +++ /var/tmp/diff_new_pack.NXARAy/_new 2026-08-06 16:18:44.437199432 +0200 @@ -19,7 +19,7 @@ %bcond_with docs %{?sle15_python_module_pythons} Name: python-aiohttp -Version: 3.14.1 +Version: 3.14.3 Release: 0 Summary: Asynchronous HTTP client/server framework License: Apache-2.0 @@ -130,7 +130,6 @@ %pyproject_install %{python_expand %fdupes %{buildroot}%{$python_sitearch} find %{buildroot}%{$python_sitearch} -name '*.[ch]' -delete -rm -r %{buildroot}%{$python_sitearch}/aiohttp/.hash } %check ++++++ aiohttp-3.14.1.tar.gz -> aiohttp-3.14.3.tar.gz ++++++ /work/SRC/openSUSE:Factory/python-aiohttp/aiohttp-3.14.1.tar.gz /work/SRC/openSUSE:Factory/.python-aiohttp.new.16738/aiohttp-3.14.3.tar.gz differ: char 5, line 1 ++++++ vendor-llhttp.tar.gz ++++++ /work/SRC/openSUSE:Factory/python-aiohttp/vendor-llhttp.tar.gz /work/SRC/openSUSE:Factory/.python-aiohttp.new.16738/vendor-llhttp.tar.gz differ: char 15, line 1
