Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-tornado6 for openSUSE:Factory checked in at 2023-06-03 00:06:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-tornado6 (Old) and /work/SRC/openSUSE:Factory/.python-tornado6.new.15902 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-tornado6" Sat Jun 3 00:06:34 2023 rev:12 rq:1090058 version:6.3.2 Changes: -------- --- /work/SRC/openSUSE:Factory/python-tornado6/python-tornado6.changes 2023-04-22 21:59:05.168723466 +0200 +++ /work/SRC/openSUSE:Factory/.python-tornado6.new.15902/python-tornado6.changes 2023-06-03 00:06:41.393799818 +0200 @@ -1,0 +2,205 @@ +Tue May 30 08:04:10 UTC 2023 - Dan Äermák <dcer...@suse.com> + +- New upstream release 6.3.2 + - Security improvements + - Fixed an open redirect vulnerability in StaticFileHandler + under certain configurations. + - ``tornado.web`` + - `.RequestHandler.set_cookie` once again accepts capitalized + keyword arguments for backwards compatibility. This is + deprecated and in Tornado 7.0 only lowercase arguments will + be accepted. + - What's new in Tornado 6.3.0 + - The new `.Application` setting ``xsrf_cookie_name`` + can now be used to take advantage of the ``__Host`` + cookie prefix for improved security. To use it, add + ``{"xsrf_cookie_name": "__Host-xsrf", "xsrf_cookie_kwargs": + {"secure": True}}`` to your `.Application` settings. Note + that this feature currently only works when HTTPS is used. + - `.WSGIContainer` now supports running the application in + a ``ThreadPoolExecutor`` so the event loop is no longer + blocked. + - `.AsyncTestCase` and `.AsyncHTTPTestCase`, which were + deprecated in Tornado 6.2, are no longer deprecated. + - WebSockets are now much faster at receiving large messages + split into many fragments. + - General changes + - Python 3.7 is no longer supported; the minimum supported . + Python version is 3.8 Python 3.12 is now supported . + - To avoid spurious deprecation warnings, users of Python + 3.10 should upgrade to at least version 3.10.9, and users + of Python 3.11 should upgrade to at least version 3.11.1. + - Tornado submodules are now imported automatically on + demand. This means it is now possible to use a single + ``import tornado`` statement and refer to objects in + submodules such as `tornado.web.RequestHandler`. + - Deprecation notices + - In Tornado 7.0, `tornado.testing.ExpectLog` will match + ``WARNING`` and above regardless of the current logging + configuration, unless the ``level`` argument is used. + - `.RequestHandler.get_secure_cookie` is now a deprecated + alias for `.RequestHandler.get_signed_cookie`. + `.RequestHandler.set_secure_cookie` is now a deprecated + alias for `.RequestHandler.set_signed_cookie`. + - `.RequestHandler.clear_all_cookies` is + deprecated. No direct replacement is provided; + `.RequestHandler.clear_cookie` should be used on individual + cookies. + - Calling the `.IOLoop` constructor without a + ``make_current`` argument, which was deprecated in Tornado + 6.2, is no longer deprecated. + - `.AsyncTestCase` and `.AsyncHTTPTestCase`, which were + deprecated in Tornado 6.2, are no longer deprecated. + - `.AsyncTestCase.get_new_ioloop` is deprecated. + - ``tornado.auth`` + - New method `.GoogleOAuth2Mixin.get_google_oauth_settings` + can now be overridden to get credentials from a source + other than the `.Application` settings. + - ``tornado.gen`` + - `contextvars` now work properly when a ``@gen.coroutine`` + calls a native coroutine. + - ``tornado.options`` + - `~.OptionParser.parse_config_file` now recognizes single + comma-separated strings (in addition to lists of strings) + for options with ``multiple=True``. + - ``tornado.web`` + - New `.Application` setting ``xsrf_cookie_name`` can be used + to change the name of the XSRF cookie. This is most useful + to take advantage of the ``__Host-`` cookie prefix. + - `.RequestHandler.get_secure_cookie` and + `.RequestHandler.set_secure_cookie` (and related + methods and attributes) have been renamed + to `~.RequestHandler.get_signed_cookie` and + `~.RequestHandler.set_signed_cookie`. This makes it + more explicit what kind of security is provided, and + avoids confusion with the ``Secure`` cookie attribute + and ``__Secure-`` cookie prefix. The old names remain + supported as deprecated aliases. + - `.RequestHandler.clear_cookie` now accepts all keyword + arguments accepted by `~.RequestHandler.set_cookie`. In + some cases clearing a cookie requires certain arguments to + be passed the same way in which it was set. + - `.RequestHandler.clear_all_cookies` now accepts + additional keyword arguments for the same reason as + ``clear_cookie``. However, since the requirements for + additional arguments mean that it cannot reliably clear all + cookies, this method is now deprecated. + - ``tornado.websocket`` + - It is now much faster (no longer quadratic) to receive + large messages that have been split into many fragments. + - `.websocket_connect` now accepts a ``resolver`` parameter. + - ``tornado.wsgi`` + - `.WSGIContainer` now accepts an ``executor`` parameter + which can be used to run the WSGI application on a thread + pool. + - What's new in Tornado 6.2.0 + - Deprecation notice + - Python 3.10 has begun the process of significant changes + to the APIs for managing the event loop. Calls to + methods such as `asyncio.get_event_loop` may now raise + `DeprecationWarning` if no event loop is running. This + has significant impact on the patterns for initializing + applications, and in particular invalidates patterns that + have long been the norm in Tornado's documentation and + actual usage. In the future (with some as-yet-unspecified + future version of Python), the old APIs will be + removed. The new recommended pattern is to start the event + loop with `asyncio.run`. More detailed migration guides + will be coming in the future. + - The `.IOLoop` constructor is deprecated unless + the ``make_current=False`` argument is used. Use + `.IOLoop.current` when the loop is already running + instead. + - `.AsyncTestCase` (and `.AsyncHTTPTestCase`) are + deprecated. Use `unittest.IsolatedAsyncioTestCase` + instead. + - Multi-process `.TCPServer.bind`/`.TCPServer.start` + is deprecated. See `.TCPServer` docs for supported + alternatives. + - `.AnyThreadEventLoopPolicy` is deprecated. This class + controls the creation of the "current" event loop so it + will be removed when that concept is no longer supported. + - `.IOLoop.make_current` and `.IOLoop.clear_current` are + deprecated. In the future the concept of a "current" + event loop as distinct from one that is currently running + will be removed. + - ``TwistedResolver`` and ``CaresResolver`` are deprecated + and will be removed in Tornado 7.0. + - General changes + - The minimum supported Python version is now 3.7. + - Wheels are now published with the Python stable ABI + (``abi3``) for compatibility across versions of Python. + - SSL certificate verfication and hostname checks are now + enabled by default in more places (primarily in client-side + usage of `.SSLIOStream`). + - Various improvements to type hints throughout the package. + - CI has moved from Travis and Appveyor to Github Actions. + - `tornado.gen` + - Fixed a bug in which ``WaitIterator.current_index`` could + be incorrect. + - ``tornado.gen.TimeoutError``` is now an alias for + `asyncio.TimeoutError`. + - `tornado.http1connection` + - ``max_body_size`` may now be set to zero to disallow a + non-empty body. + - ``Content-Encoding: gzip`` is now recognized + case-insensitively. + - `tornado.httpclient` + - ``curl_httpclient`` now supports non-ASCII (ISO-8859-1) + header values, same as ``simple_httpclient``. + - `tornado.ioloop` + - `.PeriodicCallback` now understands coroutines and will not + start multiple copies if a previous invocation runs too + long. + - `.PeriodicCallback` now accepts `datetime.timedelta` + objects in addition to numbers of milliseconds. + - Avoid logging "Event loop is closed" during + shutdown-related race conditions. + - Tornado no longer calls `logging.basicConfig` when starting + an IOLoop; this has been unnecessary since Python 3.2 added + a logger of last resort. + - The `.IOLoop` constructor now accepts an ``asyncio_loop`` + keyword argument to initialize with a specfied asyncio + event loop. + - It is now possible to construct an `.IOLoop` on one thread + (with ``make_current=False``) and start it on a different + thread. + - `tornado.iostream` + - `.SSLIOStream` now supports reading more than 2GB at a + time. + - ``IOStream.write`` now supports typed `memoryview` objects. + - `tornado.locale` + - `.load_gettext_translations` no longer logs errors when + language directories exist but do not contain the expected + file. + - `tornado.netutil` + - `.is_valid_ip` no longer raises exceptions when the input + is too long. + - The default resolver now uses the same methods (and thread + pool) as `asyncio`. + - `tornado.tcpserver` + - `.TCPServer.listen` now supports more arguments to pass + through to `.netutil.bind_sockets`. + - `tornado.testing` + - `.bind_unused_port` now takes an optional ``address`` + argument. + - Wrapped test methods now include the ``__wrapped__`` + attribute. + - `tornado.web` + - When using a custom `.StaticFileHandler` subclass, the + ``reset()`` method is now called on this subclass instead + of the base class. + - Improved handling of the ``Accept-Language`` header. + - `.Application.listen` now supports more arguments to pass + through to `.netutil.bind_sockets`. + - `tornado.websocket` + - `.WebSocketClientConnection.write_message` now + accepts `dict` arguments for consistency with ++++ 8 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/python-tornado6/python-tornado6.changes ++++ and /work/SRC/openSUSE:Factory/.python-tornado6.new.15902/python-tornado6.changes Old: ---- ignore-py310-deprecation-warnings.patch tornado-6.2.tar.gz New: ---- tornado-6.3.2.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-tornado6.spec ++++++ --- /var/tmp/diff_new_pack.lgmOml/_old 2023-06-03 00:06:42.009803455 +0200 +++ /var/tmp/diff_new_pack.lgmOml/_new 2023-06-03 00:06:42.013803479 +0200 @@ -17,10 +17,9 @@ %{?sle15_python_module_pythons} -%{?!python_module:%define python_module() python-%{**} python3-%{**}} %define skip_python2 1 Name: python-tornado6 -Version: 6.2 +Version: 6.3.2 Release: 0 Summary: Open source version of scalable, non-blocking web server that power FriendFeed License: Apache-2.0 @@ -29,13 +28,12 @@ Source99: python-tornado6-rpmlintrc # PATCH-FIX-OPENSUSE ignore-resourcewarning-doctests.patch -- ignore resource warnings on OBS Patch0: ignore-resourcewarning-doctests.patch -# PATCH-FIX-OPENSUSE ignore-py310-deprecation-warnings.patch -- gh#tornadoweb/tornado#3033 -Patch1: ignore-py310-deprecation-warnings.patch -BuildRequires: %{python_module base >= 3.7} +BuildRequires: %{python_module base >= 3.8} BuildRequires: %{python_module devel} +BuildRequires: %{python_module pip} BuildRequires: %{python_module pycares} BuildRequires: %{python_module pycurl} -BuildRequires: %{python_module setuptools} +BuildRequires: %{python_module wheel} BuildRequires: fdupes BuildRequires: python-rpm-macros Requires: python @@ -78,10 +76,10 @@ fi %build -%python_build +%pyproject_wheel %install -%python_install +%pyproject_install %{python_expand # # do not install tests rm -r %{buildroot}%{$python_sitearch}/tornado/test @@ -106,6 +104,6 @@ %license LICENSE %doc %{_docdir}/%{python_prefix}-tornado6 %{python_sitearch}/tornado -%{python_sitearch}/tornado-%{version}-py*.egg-info +%{python_sitearch}/tornado-%{version}*-info %changelog ++++++ tornado-6.2.tar.gz -> tornado-6.3.2.tar.gz ++++++ ++++ 4488 lines of diff (skipped)