dependabot[bot] opened a new pull request, #1604: URL: https://github.com/apache/tooling-trusted-releases/pull/1604
Bumps [aiosmtplib](https://github.com/cole/aiosmtplib) from 5.1.2 to 5.1.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cole/aiosmtplib/releases";>aiosmtplib's releases</a>.</em></p> <blockquote> <h2>v5.1.3</h2> <h2>What's Changed</h2> <ul> <li>Security: reject addresses containing whitespace or angle brackets outside of a quoted local part in <code>mail</code>, <code>rcpt</code>, <code>vrfy</code>, <code>expn</code> and <code>sendmail</code>. Previously, a caller supplied address such as <code>[email protected]> AUTH=<[email protected]</code> could smuggle additional ESMTP parameters onto the command line. This is a follow up to the fix in 5.1.1 for CVE-2026-53533 (GHSA-v3q9-hj7j-63hq), which only rejected control characters. <code>sendmail</code> now validates all addresses before sending any commands.</li> <li>Bugfix: reject <code>local_hostname</code> values (and the <code>hostname</code> argument to <code>helo</code>/<code>ehlo</code>) containing whitespace or control characters, so a hostname such as <code>me.example.com XCLIENT ADDR=1.2.3.4</code> can no longer smuggle extra parameters onto the EHLO/HELO command line. Surrounding whitespace is stripped.</li> <li>Bugfix: raise <code>SMTPAuthenticationError</code> instead of <code>binascii.Error</code> when the server sends a malformed (non-base64) CRAM-MD5 challenge, so <code>login</code> can fall back to the next auth method</li> <li>Bugfix: prevent SMTP command/response desync from unsolicited server data (thanks <a href="https://github.com/Charisn";><code>@Charisn</code></a> for contributing)</li> <li>Bugfix: handle protocol connection lost callback arriving after reconnect</li> <li>Bugfix: close connection on async context manager exit in cases of a server error response</li> <li>Bugfix: release connection lock on connect timeout</li> <li>Bugfix: re-derive the default port on each <code>connect()</code> so changing <code>use_tls</code>/<code>start_tls</code> between connects no longer reuses a stale default. Defaulted <code>port</code>/<code>hostname</code> are now resolved per-connect rather than written back onto the instance, so they read back as <code>None</code> when unset</li> <li>Bugfix: typeerror in latest ty</li> <li>Bugfix: mark response waiter exceptions as retrieved when they are set, so <code>Future exception was never retrieved</code> is no longer logged on free-threaded builds where the previous <code>__del__</code> based cleanup ran too late</li> <li>CI: test on free-threaded 3.14 and on 3.15 (standard and free-threaded)</li> <li>Bugfix: the <code>SIZE</code> parameter sent with <code>MAIL FROM</code> now reports the number of octets as the message will be transmitted (with CRLF line endings), rather than the raw length of the message argument</li> <li>Bugfix: data arriving on the transport after the connection is lost is now dropped instead of raising <code>RuntimeError</code> from the protocol callback</li> <li>Bugfix: <code>SMTPProtocol</code> now records that it is using TLS after a successful <code>start_tls</code>, so a second upgrade attempt on the protocol is rejected</li> <li>Bugfix: <code>starttls</code> now validates its TLS options before sending EHLO, so invalid options raise <code>ValueError</code> without touching the connection</li> <li>Bugfix: <code>helo</code> no longer records a failed response as <code>last_helo_response</code>, so a rejected HELO does not leave the session looking as if a greeting succeeded</li> <li>Bugfix: <code>bytearray</code> and <code>memoryview</code> values are no longer silently passed through the auth encoding helpers; only <code>str</code> and <code>bytes</code> are accepted, as the type annotations already stated</li> <li>Bugfix: TLS context setup now run in thread (thanks <a href="https://github.com/tr4nt0r";><code>@tr4nt0r</code></a>)</li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/cole/aiosmtplib/blob/main/CHANGELOG.rst";>aiosmtplib's changelog</a>.</em></p> <blockquote> <h2>5.1.3</h2> <ul> <li>Security: reject addresses containing whitespace or angle brackets outside of a quoted local part in <code>mail</code>, <code>rcpt</code>, <code>vrfy</code>, <code>expn</code> and <code>sendmail</code>. Previously, a caller supplied address such as <code>[email protected]> AUTH=<[email protected]</code> could smuggle additional ESMTP parameters onto the command line. This is a follow up to the fix in 5.1.1 for CVE-2026-53533 (GHSA-v3q9-hj7j-63hq), which only rejected control characters. <code>sendmail</code> now validates all addresses before sending any commands.</li> <li>Bugfix: reject <code>local_hostname</code> values (and the <code>hostname</code> argument to <code>helo</code>/<code>ehlo</code>) containing whitespace or control characters, so a hostname such as <code>me.example.com XCLIENT ADDR=1.2.3.4</code> can no longer smuggle extra parameters onto the EHLO/HELO command line. Surrounding whitespace is stripped.</li> <li>Bugfix: raise <code>SMTPAuthenticationError</code> instead of <code>binascii.Error</code> when the server sends a malformed (non-base64) CRAM-MD5 challenge, so <code>login</code> can fall back to the next auth method</li> <li>Bugfix: prevent SMTP command/response desync from unsolicited server data (thanks <a href="https://github.com/Charisn";><code>@Charisn</code></a> for contributing)</li> <li>Bugfix: handle protocol connection lost callback arriving after reconnect</li> <li>Bugfix: close connection on async context manager exit in cases of a server error response</li> <li>Bugfix: release connection lock on connect timeout</li> <li>Bugfix: re-derive the default port on each <code>connect()</code> so changing <code>use_tls</code>/<code>start_tls</code> between connects no longer reuses a stale default. Defaulted <code>port</code>/<code>hostname</code> are now resolved per-connect rather than written back onto the instance, so they read back as <code>None</code> when unset</li> <li>Bugfix: typeerror in latest ty</li> <li>Bugfix: mark response waiter exceptions as retrieved when they are set, so <code>Future exception was never retrieved</code> is no longer logged on free-threaded builds where the previous <code>__del__</code> based cleanup ran too late</li> <li>CI: test on free-threaded 3.14 and on 3.15 (standard and free-threaded)</li> <li>Bugfix: the <code>SIZE</code> parameter sent with <code>MAIL FROM</code> now reports the number of octets as the message will be transmitted (with CRLF line endings), rather than the raw length of the message argument</li> <li>Bugfix: data arriving on the transport after the connection is lost is now dropped instead of raising <code>RuntimeError</code> from the protocol callback</li> <li>Bugfix: <code>SMTPProtocol</code> now records that it is using TLS after a successful <code>start_tls</code>, so a second upgrade attempt on the protocol is rejected</li> <li>Bugfix: <code>starttls</code> now validates its TLS options before sending EHLO, so invalid options raise <code>ValueError</code> without touching the connection</li> <li>Bugfix: <code>helo</code> no longer records a failed response as <code>last_helo_response</code>, so a rejected HELO does not leave the session looking as if a greeting succeeded</li> <li>Bugfix: <code>bytearray</code> and <code>memoryview</code> values are no longer silently passed through the auth encoding helpers; only <code>str</code> and <code>bytes</code> are accepted, as the type annotations already stated</li> <li>Bugfix: TLS context setup now run in thread (thanks <a href="https://github.com/tr4nt0r";><code>@tr4nt0r</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cole/aiosmtplib/commit/9cc425460026ee54392507f0593ecd4052cd6aa4";><code>9cc4254</code></a> ci: only twine-check wheel and sdist in buildcheck</li> <li><a href="https://github.com/cole/aiosmtplib/commit/e4ee41a88d61a0b7916c4d0c3b02b8aff8f22cce";><code>e4ee41a</code></a> release: v5.1.3</li> <li><a href="https://github.com/cole/aiosmtplib/commit/8ee1047e0772e9617e8842d009ecb25cc6ed8380";><code>8ee1047</code></a> test: replace event_loop_policy override with pytest_asyncio_loop_factories hook</li> <li><a href="https://github.com/cole/aiosmtplib/commit/ddf47a7dd45503bbca059b58b764d8d4fb8b76c8";><code>ddf47a7</code></a> ci: test on free-threaded 3.14 and on 3.15 (standard and free-threaded)</li> <li><a href="https://github.com/cole/aiosmtplib/commit/ced720d39fbc906b7bd2569b7053f884c73115d9";><code>ced720d</code></a> test: expect HeaderWriteError for non-ASCII address on Python 3.15+</li> <li><a href="https://github.com/cole/aiosmtplib/commit/4d22898f1ef21f1ffe3684fd70b2ccdb50ed440b";><code>4d22898</code></a> fix: mark response waiter exceptions as retrieved when set</li> <li><a href="https://github.com/cole/aiosmtplib/commit/7b8e3de72cd8fe8bec110ecc854b2ea0e6486d7d";><code>7b8e3de</code></a> fix: report SIZE as transmitted octets, not raw message length</li> <li><a href="https://github.com/cole/aiosmtplib/commit/aa0d536058620d12d5c2884f3cb0fa4599d698b7";><code>aa0d536</code></a> fix: drop data received after connection loss instead of raising</li> <li><a href="https://github.com/cole/aiosmtplib/commit/bdc17f564bd76ec62594437ac5969ffdfaf8509e";><code>bdc17f5</code></a> fix: mark SMTPProtocol as over SSL after a successful start_tls</li> <li><a href="https://github.com/cole/aiosmtplib/commit/1d84d5714412028e737f402d901e05ab4e70d1a0";><code>1d84d57</code></a> fix: validate starttls options before sending EHLO</li> <li>Additional commits viewable in <a href="https://github.com/cole/aiosmtplib/compare/v5.1.2...v5.1.3";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
