Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-dnspython for openSUSE:Factory checked in at 2026-10-10 14:58:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-dnspython (Old) and /work/SRC/openSUSE:Factory/.python-dnspython.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-dnspython" Sat Oct 10 14:58:37 2026 rev:43 rq:1383833 version:2.9.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-dnspython/python-dnspython.changes 2026-09-07 11:30:35.581653799 +0200 +++ /work/SRC/openSUSE:Factory/.python-dnspython.new.3698736/python-dnspython.changes 2026-10-10 14:59:17.906775819 +0200 @@ -1,0 +2,262 @@ +Fri Oct 9 10:58:07 UTC 2026 - Martin Hauke <[email protected]> + +- Update to version 2.9.0 + * dnspython dns.name.from_wire_parser() excessive CPU use + A maliciously crafted DNS message may cause + dns.name.from_wire_parser() to use excessive CPU for DNS name + decompression. Applications which process untrusted DNS wire + form messages with dnspython may be degraded or DoS'd by the + extra CPU use required. + * Fix GHSA-45c3-73f7-pv4m + Decompression chain length is limited to 16. Prior to this + change, a maliciously crafted DNS message could cause + dns.name.from_wire_parser() to use excessive CPU for DNS name + decompression. Applications which processed untrusted DNS wire + form messages with dnspython could be degraded or DoS’d by the + extra CPU use required. + * Httpx2 has replaced httpx for HTTPS TCP connections. + * The minimum supported Python version is now 3.11. + * DNSSEC now supports ML-DSA-44, a post-quantum signature + algorithm. + * The NSEC3 Next Hashed Owner Name in presentation format is now + decoded as base32hex (RFC 5155 Section 1.3, RFC 4648 Extended + Hex Alphabet). The letters W, X, Y, and Z are not in that + alphabet; they used to be accepted and silently decoded to a + different owner name, so to_text of the result did not match + the input. They are now rejected. + * The NID and L64 node/locator ids in presentation format are now + rejected when a group contains anything other than hex digits. + A sign or underscore, which int() silently accepts, produced a + record whose text form did not parse back the same way + (RFC 6742). + * Rdata of a known type in the generic \# syntax, such as an NS + record in a zone file, no longer fails to parse when it + contains a name under the origin. Its names are relativized as + in the type’s own text form. + * The SVCB and HTTPS ech parameter value must now be an + ECHConfigList with a correct length prefix and at least 4 + octets of content (RFC 9848, RFC 9849). The individual ECHConfig + structures are not checked. + * SVCB and HTTPS SvcParamKeys in presentation format, including + those listed in mandatory, must now be spelled as RFC 9460 + requires: 1-63 lowercase letters, digits, or hyphens. Uppercase + keys such as ALPN and keys with underscores such as + no_default_alpn are rejected. + * SVCB and HTTPS presentation format parsing now follows the + escaping rules of RFC 9460. SvcParamKeys may not contain + escapes (e.g. \097lpn=h2), and in comma-separated values (alpn, + docpath) only \, and \\ are valid escapes after character-string + decoding (e.g. alpn="h2\\x" is rejected). + * SVCB and HTTPS parameters whose value must not be empty + (mandatory, alpn, port, ipv4hint, ech, ipv6hint) are now + rejected when empty in text form (e.g. alpn="" or key1=""), in + wire form, and in the Python API. Per RFC 9460, an omitted + value is the same as an empty one. This also rejects an empty + ech value, which RFC 9848 does not allow. + * A relative $ORIGIN in a zone file is now relative to the + current origin, as RFC 1035 requires. Previously records after + it were silently dropped. + * dns.zone.Zone.verify_digest() now makes the two RFC 8976 + section 4 checks it was missing: a ZONEMD RR only verifies the + zone if its serial matches the zone’s SOA serial (step 5.1), + and a ZONEMD RR whose scheme and hash algorithm are shared with + another ZONEMD RR in the RRset does not verify the zone at all + (step 4). + * dns.reversename.to_address() now rejects IPv6 reverse-map names + without exactly 32 single-character labels, instead of padding + missing nibbles or accepting multiple nibbles in a label. + * A "transaction setup" callable may be specified when reading a + zone from a file, a string, or an inbound zone transfer. It is + called just after the transaction is created. A Transaction- + Limiter setup is available to limit the size of the zone. + * Name and rdata "to text" is now done with the to_styled_text() + method, allowing much greater control over text output. + Application code that uses to_text() continues to work as + before, but any custom Rdata implementations need to be updated + to support to_styled_text(). + * The socket type parameter to socket.getaddrinfo used to be + called "socktype2 in Python 2, but was renamed to "type" in + Python 3. We applied this change on the python3 branch almost + a decade ago, but it was lost in the "single code base, only + Python 3" update, also quite some time ago. It is now renamed + to "type" (again) so it matches the Python 3 code it is + overriding. + * dns.flags.to_text() and dns.flags.edns_to_text() no longer + silently drop set bits that have no named flag. Such bits are + now rendered as FLAGn, where n is the bit position, and + dns.flags.from_text() / edns_from_text() parse that form back, + so the conversions round-trip. See issue #1264. + * dns.ttl.from_text() now raises dns.ttl.BadTTL, rather than + leaking a bare ValueError, when the text contains a non-decimal + Unicode "digit" (e.g. the superscript \u00b2). Such characters + are accepted by str.isdigit() but rejected by int(), so they + previously escaped the parser’s validation. This also makes + zone files with such a TTL fail with a clean + dns.exception.SyntaxError. + * The zone file reader no longer treats a quoted string as a + directive. A line starting with "$TTL" was processed as if it + were $TTL, because only the token’s value was tested and not + its type; a directive must now be an unquoted identifier. This + also fixes a crash: a line beginning with an empty token (e.g. + an empty quoted string) made the reader raise a bare + IndexError, rather than the dns.exception.SyntaxError any other + malformed zone file gets. + * The to_text() of string-list SVCB parameters (alpn and docpath) + escaped non-printable bytes twice, rendering them as \\ddd + instead of \ddd, so the output did not parse back to the + original value. Such bytes are now escaped once, at the + character-string level. + * The SVCB/HTTPS wire parser now rejects a record whose + SvcParamKeys are not in strictly increasing numeric order, + including one that repeats a key. RFC 9460 section 2.2 requires + such a record to be treated as malformed, and the presentation + parser already did, but the wire parser only checked for a + decreasing key, so a duplicate key was accepted and silently + kept only its last value. The same strictly-increasing check + now also applies to the keys inside a mandatory parameter + (section 8). + * The NSEC, NSEC3, and CSYNC type-bitmap wire parser now rejects + a window whose bitmap ends in a zero octet, including an + all-zero block. RFC 4034 section 4.1.2 requires trailing zero + octets to be omitted and forbids a block with no types present, + so the last octet of a window’s bitmap is always non-zero; + the parser previously accepted these non-canonical encodings. + * The APL wire parser now rejects an item whose address prefix + (AFDPART) ends in a zero octet. RFC 3123 sections 4.1 and 4.2 + require trailing zero octets to be omitted so that DNSSEC has + a single canonical wire encoding. The parser previously + accepted these, and since to_wire() strips the trailing zeros, + from_wire() followed by to_wire() silently rewrote the rdata to + different bytes. + * The EDNS Client Subnet (ECS) option wire parser now rejects a + malformed option instead of silently rewriting it. RFC 7871 + section 6 requires the source and scope prefix lengths to fit + the address family and the address bits beyond the source + prefix length to be zero. A non-zero pad was previously masked + off by the option constructor, so from_wire followed by + to_wire produced different bytes, and an out-of-range prefix + length leaked a low-level error rather than being reported as + malformed. + * ZONEMD rdata now rejects a digest shorter than 12 octets. + RFC 8976 section 2.2.4 requires the digest to be at least 12 + octets regardless of the hash algorithm, but dnspython only + checked the length for the hash algorithms it implements, so + a record using a private-use algorithm could carry a truncated + (or empty) digest. + * Rdata types with free-form string fields (URI, HINFO, X25, + ISDN, NAPTR, and CAA) processed \ddd escapes as Unicode code + points and then UTF-8 encoded them, so escapes greater than + \127 became two octets instead of one. URI also emitted its + target unescaped in to_text(), raising UnicodeDecodeError for + wire-legal non-UTF-8 targets and corrupting backslashes and + quotes on a round trip. These fields now apply escapes directly + to bytes, like TXT-like records, using the new + Tokenizer.get_bytes(), and URI escapes its target on output, so + from_text(to_text()) is the identity for all octet values. + * APL items with an address family other than 1 (IPv4) or 2 + (IPv6) now round trip through text. to_text() rendered their + hex address as a Python bytes literal (3:b'e0'/4), + from_text() rejected every such item, and the wire parser + rejected an address longer than 63 octets although up to 127 + are allowed. + * Mypy type checking has been removed; ty type checking has been + added. + * The zone transfer code’s "raise on serial went backwards" + default behavior can now be disabled with the + raise_on_serial_went_backwards parameter. + * The async zone_from_name() function now behaves the same as + the sync version. + * dns.asyncquery.receive_udp() with ignore_errors set again + discards a datagram that fails to parse and keeps listening + for a valid response, matching dns.query.receive_udp(). It had + been returning the unparsable datagram with its errors recorded + on the message. The unused ignore_errors parameter added to + dns.asyncquery.receive_tcp() at the same time has been removed, + as the sync version has no such parameter. + * Documentation has been augmented and modernized. + * The HHIT and BRID rdata types are now supported, and the + NXNAME metatype is defined. + * \DDD escapes are now only recognized when the three characters + are ASCII digits, as RFC 1035 section 5.1 requires. The escape + parsers tested them with str.isdecimal(), which is also true + for non-ASCII decimal digits such as the Devanagari १ (U+0967), + and int() converts those, so a \123-style escape written with + those digits was read as an octet instead of being rejected. + This affected dns.name.from_unicode(), + dns.tokenizer.Token.unescape(), + dns.tokenizer.Token.unescape_to_bytes(), and the SVCB/HTTPS + alpn and docpath value parser, and it meant a name could be + written two ways, with the all-ASCII dns.name.from_text() path + disagreeing with the non-ASCII one. Such a character is now an + ordinary escaped character, like any other. + * Other text parsers that tested for digits with + str.isdecimal() now also require ASCII digits, so non-ASCII + decimal digits are no longer read as numbers. This affects + dns.ttl.from_text(), dns.grange.from_text(), + dns.e164.from_e164() (which now drops such characters like any + other non-digit), the IPv6 scope id in + dns.inet.low_level_address_tuple(), the FLAGn form in + dns.flags.from_text(), the TYPEn-style generic forms in + enum from_text() methods (e.g. dns.rdatatype.from_text()), + SIG/RRSIG signature times, and the WKS and LOC rdata text + parsers. SIG/RRSIG signature times in the 14-digit + YYYYMMDDHHmmSS form are now also required to be all digits. + * dns.tokenizer.Tokenizer.get_int() and the other integer-reading + tokenizer methods, which underlie most rdata text parsing, now + require the token to consist only of ASCII digits valid in the + requested base. They previously used int() directly, which also + accepts non-ASCII decimal digits, a leading +, underscores + (1_000), and base prefixes such as 0o17 when the base matched. + The base must now be between 2 and 36; base 0 is no longer + accepted. The SVCB/HTTPS port parameter is checked the same way. + * dns.message.from_text() now reads an RR’s TTL as a decimal + integer with the tokenizer. It previously used int(text, 0), + which accepted forms such as 0x10, +10, and non-ASCII digits, + and rejected decimal TTLs with a leading zero such as 010. + * APIs which accept the name of a file to open - + dns.zone.from_file(), dns.zone.Zone.to_file(), + dns.message.from_file(), dns.tsigkeyring.from_file(), + Resolver.read_resolv_conf(), and the resolver constructor’s + filename parameter — now also accept any os.PathLike, e.g. a + pathlib.Path. Previously a path object was mistaken for an open + file. + * The verify parameter of the DoH/DoT/DoQ query functions and + nameserver classes now also accepts an os.PathLike naming the + CA file or directory. Previously a path object was silently + ignored and the default CA roots were used. + * dns.message.from_wire() now raises dns.exception.FormError if + a response to a TSIG-signed request does not have a TSIG, + unless keyring is False or multi is True. Previously such + unsigned responses were accepted. As a result, the query + functions now reject unsigned responses to signed queries, and + with ignore_errors UDP receives discard them and keep waiting. + * An inbound zone transfer made with a TSIG-signed request now + requires the first and the last message of the response to have + a TSIG, as RFC 8945 section 5.3.1 specifies, and + dns.xfr.Inbound.process_message() checks this before committing + the transaction. Previously only the last message was checked, + and only after the transfer had been committed, so + dns.query.inbound_xfr() and dns.asyncquery.inbound_xfr() raised + "missing TSIG" for an unsigned transfer that had already + replaced the zone, and unsigned messages sent ahead of the + first signed one were accepted. + * Zone file reading now follows RFC 2308 section 4 by default, + and no longer treats the SOA MINIMUM field as the default TTL. + In a zone file with no $TTL directive, a record with no TTL of + its own now inherits the most recently stated TTL (RFC 1035 + section 5.1) rather than the SOA MINIMUM; the SOA MINIMUM is + still used as a last resort if no TTL has been stated at all. + An explicit $TTL always takes precedence, as before. The + previous behavior can be requested by passing + rfc2308_ttl=False to dns.zone.from_text(), + dns.zone.from_file(), or dns.zonefile.read_rrsets(). + * Discovery of Designated Resolvers (DDR) now verifies an IPv6 + unencrypted resolver address against the designated resolver’s + certificate correctly. The check compared the address text + with the subjectAltName text produced by ssl, which renders + IPv6 entries uncompressed and in upper case, so the two never + matched and try_ddr() could not upgrade an IPv6 resolver to an + encrypted transport. Addresses are now compared in binary form. +- The minimum supported version of Python is 3.11. + +------------------------------------------------------------------- Old: ---- dnspython-2.8.0.tar.gz New: ---- dnspython-2.9.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-dnspython.spec ++++++ --- /var/tmp/diff_new_pack.g8cf7g/_old 2026-10-10 14:59:18.660807366 +0200 +++ /var/tmp/diff_new_pack.g8cf7g/_new 2026-10-10 14:59:18.662807450 +0200 @@ -27,17 +27,17 @@ %define skip_python2 1 %{?sle15_python_module_pythons} Name: python-dnspython%{psuffix} -Version: 2.8.0 +Version: 2.9.0 Release: 0 Summary: A DNS toolkit for Python License: ISC Group: Development/Languages/Python URL: https://github.com/rthalley/dnspython -Source: https://files.pythonhosted.org/packages/source/d/dnspython/dnspython-%{version}.tar.gz -BuildRequires: %{python_module base >= 3.10} -BuildRequires: %{python_module hatchling} +Source: https://github.com/rthalley/dnspython/archive/refs/tags/v%{version}/dnspython-%{version}.tar.gz +BuildRequires: %{python_module base >= 3.11} +#BuildRequires: %{python_module hatchling} +BuildRequires: %{python_module uv-build >= 0.9.21} BuildRequires: %{python_module pip} -BuildRequires: %{python_module poetry-core} BuildRequires: fdupes BuildRequires: python-rpm-macros # dnssec @@ -55,7 +55,6 @@ %if %{with test} # dnssec BuildRequires: %{python_module cryptography} -# BuildRequires: %%{python_module curio >= 1.2} BuildRequires: %{python_module h2} # doh BuildRequires: %{python_module httpx} @@ -69,7 +68,7 @@ # # curio # BuildRequires: %%{python_module sniffio >= 1.1} # trio -BuildRequires: %{python_module trio >= 0.30.0} +BuildRequires: %{python_module trio >= 0.34.0} BuildRequires: %{python_module typing} BuildRequires: netcfg BuildRequires: (python3-contextvars if python3-base < 3.7) ++++++ dnspython-2.8.0.tar.gz -> dnspython-2.9.0.tar.gz ++++++ ++++ 28583 lines of diff (skipped)
