CVS commit: pkgsrc/www/py-aiohttp

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Mar 29 17:37:01 UTC 2026

Modified Files:
        pkgsrc/www/py-aiohttp: Makefile distinfo

Log Message:
py-aiohttp: update to 3.13.4.

3.13.4 (2026-03-28)
===================

Features
--------

- Added ``max_headers`` parameter to limit the number of headers that should be read from a response -- by :user:`Dreamsorcerer`.

- Added a ``dns_cache_max_size`` parameter to ``TCPConnector`` to limit the size of the cache -- by :user:`Dreamsorcerer`.

Bug fixes
---------

- Fixed server hanging indefinitely when chunked transfer encoding chunk-size
  does not match actual data length. The server now raises
  ``TransferEncodingError`` instead of waiting forever for data that will
  never arrive -- by :user:`Fridayai700`.

- Fixed access log timestamps ignoring daylight saving time (DST) changes. The
  previous implementation used :py:data:`time.timezone` which is a constant and
  does not reflect DST transitions -- by :user:`nightcityblade`.

- Fixed ``RuntimeError: An event loop is running`` error when using ``aiohttp.GunicornWebWorker``
  or ``aiohttp.GunicornUVLoopWebWorker`` on Python >=3.14.
  -- by :user:`Tasssadar`.

- Fixed :exc:`ValueError` when creating a TLS connection with ``ClientTimeout(total=0)`` by converting ``0`` to ``None`` before passing to ``ssl_handshake_timeout`` in 
:py:meth:`asyncio.loop.start_tls` -- by :user:`veeceey`.

- Restored :py:meth:`~aiohttp.BodyPartReader.decode` as a synchronous method
  for backward compatibility. The method was inadvertently changed to async
  in 3.13.3 as part of the decompression bomb security fix. A new
  :py:meth:`~aiohttp.BodyPartReader.decode_iter` method is now available
  for non-blocking decompression of large payloads using an async generator.
  Internal aiohttp code uses the async variant to maintain security protections.

  Changed multipart processing chunk sizes from 64 KiB to 256KiB, to better
  match aiohttp internals
  -- by :user:`bdraco` and :user:`Dreamsorcerer`.

- Fixed false-positive :py:class:`DeprecationWarning` for passing ``enable_cleanup_closed=True`` to :py:class:`~aiohttp.TCPConnector` specifically on Python 3.12.7.
  -- by :user:`Robsdedude`.

- Fixed _sendfile_fallback over-reading beyond requested count -- by :user:`bysiber`.

- Fixed digest auth dropping challenge fields with empty string values -- by :user:`bysiber`.

- ``ClientConnectorCertificateError.os_error`` no longer raises :exc:`AttributeError`
  -- by :user:`themylogin`.

- Adjusted pure-Python request header value validation to align with RFC 9110 control-character handling, while preserving lax response parser behavior, and added regression tests for Host/header 
control-character cases.
  -- by :user:`rodrigobnogueira`.

- Rejected duplicate singleton headers (``Host``, ``Content-Type``,
  ``Content-Length``, etc.) in the C extension HTTP parser to match
  the pure Python parser behaviour, preventing potential host-based
  access control bypasses via parser differentials
  -- by :user:`rodrigobnogueira`.

- Aligned the pure-Python HTTP request parser with the C parser by splitting
  comma-separated and repeated ``Connection`` header values for keep-alive,
  close, and upgrade handling -- by :user:`rodrigobnogueira`.

Improved documentation
----------------------

- Documented :exc:`asyncio.TimeoutError` for ``WebSocketResponse.receive()``
  and related methods -- by :user:`veeceey`.

Packaging updates and notes for downstreams
-------------------------------------------

- Upgraded llhttp to 3.9.1 -- by :user:`Dreamsorcerer`.

Miscellaneous internal changes
------------------------------

- Fixed ``test_invalid_idna`` to work with ``idna`` 3.11 by using an invalid character (``\u0080``) that is rejected by ``yarl`` during URL construction -- by :user:`rodrigobnogueira`.

- Fixed race condition in ``test_data_file`` on Python 3.14 free-threaded builds -- by :user:`rodrigobnogueira`.


To generate a diff of this commit:
cvs rdiff -u -r1.103 -r1.104 pkgsrc/www/py-aiohttp/Makefile
cvs rdiff -u -r1.95 -r1.96 pkgsrc/www/py-aiohttp/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-aiohttp/Makefile
diff -u pkgsrc/www/py-aiohttp/Makefile:1.103 pkgsrc/www/py-aiohttp/Makefile:1.104
--- pkgsrc/www/py-aiohttp/Makefile:1.103        Mon Jan  5 01:36:08 2026
+++ pkgsrc/www/py-aiohttp/Makefile      Sun Mar 29 17:37:00 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.103 2026/01/05 01:36:08 wiz Exp $
+# $NetBSD: Makefile,v 1.104 2026/03/29 17:37:00 wiz Exp $
 
-DISTNAME=      aiohttp-3.13.3
+DISTNAME=      aiohttp-3.13.4
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=a/aiohttp/}
@@ -35,8 +35,8 @@ PYTHON_VERSIONS_INCOMPATIBLE= 310
 
 .include "../../lang/python/wheel.mk"
 # need to package: proxy (!?)
-# as of 3.13.3
-# 8 failed, 3632 passed, 77 skipped, 8 xfailed, 42 errors, 2 subtests passed
+# as of 3.13.4
+# 8 failed, 3711 passed, 77 skipped, 8 xfailed, 42 errors, 2 subtests passed
 pre-test:
        cd ${WRKSRC} && ${RM} -f tests/test_proxy_functional.py tests/autobahn/test_autobahn.py
 

Index: pkgsrc/www/py-aiohttp/distinfo
diff -u pkgsrc/www/py-aiohttp/distinfo:1.95 pkgsrc/www/py-aiohttp/distinfo:1.96
--- pkgsrc/www/py-aiohttp/distinfo:1.95 Mon Jan  5 01:36:08 2026
+++ pkgsrc/www/py-aiohttp/distinfo      Sun Mar 29 17:37:00 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.95 2026/01/05 01:36:08 wiz Exp $
+$NetBSD: distinfo,v 1.96 2026/03/29 17:37:00 wiz Exp $
 
-BLAKE2s (aiohttp-3.13.3.tar.gz) = 8bbd967eef3ce75e95aca941804faf7e1a92ab4114a954ff5750065ab60dd6c5
-SHA512 (aiohttp-3.13.3.tar.gz) = a05ff320d63fc54f6b75fa4ecc9f1b97053f14724e580f703b0fe74e5b6f68d4534e6d0bc60cc12bb5a3771f239972fe4887afe3da8548cf7a92f724093f073e
-Size (aiohttp-3.13.3.tar.gz) = 7844556 bytes
+BLAKE2s (aiohttp-3.13.4.tar.gz) = 6c6cef79b5ce6f2258c150366569a261ea6d7665fe13b7fb513322e41f482b49
+SHA512 (aiohttp-3.13.4.tar.gz) = af60220cfd762e200bb15b7ff94302a98340ce85ead3f000da9b0ad8cfdfb8963267f011b0310d9743b66fd75def61898620ee27934ba117151ae19f9d68fb12
+Size (aiohttp-3.13.4.tar.gz) = 7859748 bytes