CVS commit: pkgsrc/www/py-asgiref

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Feb  4 12:53:08 UTC 2026

Modified Files:
        pkgsrc/www/py-asgiref: Makefile distinfo

Log Message:
py-asgiref: updated to 3.11.1

3.11.1 (2026-02-03)

* SECURITY FIX CVE-2025-14550: There was a potential DoS vector for users of
  the ``asgiref.wsgi.WsgiToAsgi`` adapter. Malicious requests, including an unreasonably
  large number of values for the same header, could lead to resource exhaustion
  when building the WSGI environment.

  To mitigate this, the algorithm is changed to be more efficient, and
  ``WsgiToAsgi`` gains a new optional ``duplicate_header_limit`` parameter,
  which defaults to 100. This specifies the number of times a single header may
  be repeated before the request is rejected as malformed.

  You may override ``duplicate_header_limit`` when configuring your application::

      application = WsgiToAsgi(wsgi_app, duplicate_header_limit=200)

  Set ``duplicate_header_limit=None`` if you wish to disable this check.

* Fixed a regression in 3.11.0 in ``sync_to_async`` when wrapping a callable
  with an attribute named ``context``.


To generate a diff of this commit:
cvs rdiff -u -r1.40 -r1.41 pkgsrc/www/py-asgiref/Makefile
cvs rdiff -u -r1.37 -r1.38 pkgsrc/www/py-asgiref/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-asgiref/Makefile
diff -u pkgsrc/www/py-asgiref/Makefile:1.40 pkgsrc/www/py-asgiref/Makefile:1.41
--- pkgsrc/www/py-asgiref/Makefile:1.40 Sun Nov 23 06:58:41 2025
+++ pkgsrc/www/py-asgiref/Makefile      Wed Feb  4 12:53:08 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.40 2025/11/23 06:58:41 adam Exp $
+# $NetBSD: Makefile,v 1.41 2026/02/04 12:53:08 adam Exp $
 
-DISTNAME=      asgiref-3.11.0
+DISTNAME=      asgiref-3.11.1
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=a/asgiref/}

Index: pkgsrc/www/py-asgiref/distinfo
diff -u pkgsrc/www/py-asgiref/distinfo:1.37 pkgsrc/www/py-asgiref/distinfo:1.38
--- pkgsrc/www/py-asgiref/distinfo:1.37 Sun Nov 23 06:58:41 2025
+++ pkgsrc/www/py-asgiref/distinfo      Wed Feb  4 12:53:08 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.37 2025/11/23 06:58:41 adam Exp $
+$NetBSD: distinfo,v 1.38 2026/02/04 12:53:08 adam Exp $
 
-BLAKE2s (asgiref-3.11.0.tar.gz) = 6673c6517f9287e0fa90bd1dbc8abe5eea6d4715af70ed448d44048c80b26984
-SHA512 (asgiref-3.11.0.tar.gz) = d78573c73338cc03ea6531017f983bb387a47e67a81252e37d5a2852657c5a3913f7e0b6f69e91bb15963d6683cbce94726911397b1757d4d66cdf4a9b27d957
-Size (asgiref-3.11.0.tar.gz) = 37969 bytes
+BLAKE2s (asgiref-3.11.1.tar.gz) = 302a0bf9e9c91db07796c1505b44af025bf198e13520dfc7090b11f2d3b12939
+SHA512 (asgiref-3.11.1.tar.gz) = f41977ac7a07af7b7c2630b50df30ea4dbbe6b2e6157e9064e3440e342297b5e0c3776648f29e9f8eb95de04d2486872eb2f3e6734b9695073c76f8abaf4053a
+Size (asgiref-3.11.1.tar.gz) = 38550 bytes