CVS commit: pkgsrc/textproc/py-jsonrpclib-pelix

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Aug 28 10:53:28 UTC 2026

Modified Files:
        pkgsrc/textproc/py-jsonrpclib-pelix: Makefile PLIST distinfo

Log Message:
py-jsonrpclib-pelix: updated to 1.2.0

1.2.0

Security

Class translation (jsonclass) no longer imports arbitrary classes by
default. A __jsonclass__ payload could previously make a server or client
instantiate any importable class with attacker-controlled arguments, when
use_jsonclass was enabled (the default) and no class registry was set.
Dynamic import is now opt-in through the new Config.allow_dynamic_classes
flag (default False); unregistered classes are refused with a
TranslationError. Restrict what may be instantiated with Config.classes,
and only enable class translation between endpoints you trust.

This changes the default behaviour: classes must now be declared with
config.classes.add() on both ends, including the enumerations and the
Pydantic models which used to be rebuilt implicitly. Only decimal.Decimal
is always accepted, as a value type the library serializes itself. Setting
Config(allow_dynamic_classes=True) restores the previous behaviour.

register_instance() no longer accepts dotted method names by default. The
allow_dotted_names argument of register_instance() was ignored: method
names were always resolved by walking the attributes of the registered
instance, so a client could reach any object it holds a reference to — and
therefore any callable on it. SimpleXMLRPCServer, which this library
mirrors, has always required this to be requested explicitly.

This changes the default behaviour: a server registering an instance now
answers -32601 (method not supported) to a.b.c style names. If you rely
on them, and the registered instance holds nothing a caller should not reach,
ask for them as you would with xmlrpclib:
server.register_instance(obj, allow_dotted_names=True). Attributes whose
name starts with _ remain unreachable either way.

Server-side exceptions are no longer described in the errors sent to the
peer. A failing method used to answer with a fragment of its traceback — the
source file, the line, the function name and the exception message — which
any caller could read. Such an error is now reported as
Server error (ref: <id>), and the same reference is written to the logs
along with the whole traceback, so the details can still be looked up.

The errors describing what the caller sent are unchanged: an unknown
method, invalid parameters or an unparsable request are still explicit, as
they are meant to be acted upon.

Set Config(send_exception_details=True) to get the previous behaviour back
while developing. Do not enable it on a server which is reachable by
untrusted callers.

Fixed

ServerProxy._additional_headers no longer leaks headers when the wrapped
call raises: the additional headers are now always removed from the transport
when leaving the with block.

Requests with a Content-Encoding: gzip body are handled again. The body was
converted to text chunk by chunk before being decompressed, so
gzip_decode() never got the bytes it expects and the server answered an
HTTP 500. The chunks are now joined and decompressed before being read as
text. The client of this library is unaffected: it never compressed the
requests it sends.

The same change fixes a body larger than 10 MiB being rejected when a chunk
boundary fell in the middle of a multi-byte character (Python 3 only).
SimpleJSONRPCRequestHandler.max_chunk_size is now a class attribute, next
to max_request_size.

Interrupting a server with Ctrl-C while it is serving a call no longer
turns the KeyboardInterrupt into a JSON-RPC error. The three handlers which
caught every exception (SimpleJSONRPCDispatcher._dispatch,
SimpleJSONRPCRequestHandler.do_POST and TransportMixIn.single_request)
now let KeyboardInterrupt and SystemExit through, as xmlrpc.client
does, so they reach the server loop. A method raising SystemExit stops the
server instead of answering a -32603 error.

An invalid request is no longer quoted back in full. The errors reporting an
unparsable request (-32700) or one without a version marker (-32600)
embedded the whole request, so a 20 kB body produced a 20 kB answer and a
20 kB log line, both chosen by the caller. Only the first
SimpleJSONRPCServer.MAX_ECHOED_REQUEST_SIZE characters (256 by default) are
quoted now, followed by the total length. What was wrong with the request is
still reported.

Requests are now checked for a usable framing before anything is read from
them. A request without a Content-Length is answered with an HTTP 411
(Length Required) and one with an unusable value with an HTTP 400
(Bad Request), where both used to raise inside the request handler and be
reported as an HTTP 500 describing the server. Oversized requests are still
refused with an HTTP 413 before the body is read.

Note that max_request_size is compared to the Content-Length header: it
bounds what is read from the socket, not what the body expands to once
decoded.

Documentation

Documented that a ServerProxy must not be shared between threads. Its
transport keeps a single connection, and its additional headers live in a
list shared by every caller: a request sent while another thread is inside a
_additional_headers block carries that block's headers, credentials
included. See the "Thread safety" section of the client documentation.

The SSL server snippet no longer uses ssl.wrap_socket(), which was removed
in Python 3.12: it now uses an ssl.SSLContext. The client side of TLS (the
context argument of ServerProxy) is documented as well.

The class translation examples now declare their classes in the registry, as
required since this release.

Fixed the description of the JSON parser lookup order (orjson, ujson,
simplejson, cjson, then the built-in json) and the claim that one of
the third-party parsers had to be installed: the built-in json module is
enough. The supported and tested Python versions (2.7, then 3.6 to 3.15) are
now stated explicitly.

Fixed the source installation instructions: the git:// protocol has been
disabled by GitHub, and pip install . replaces python setup.py install
outside of Python 2.7. Dropped the mentions of nosetests.

The class translation page no longer claims the feature is turned off by
default, which contradicted both the code and the rest of the page.

Project

Distributions are now built as a universal py2.py3-none-any wheel again, so
Python 2.7 users can install from a wheel. The build backend moved to
setuptools and requires-python was corrected to include 2.7.
python setup.py install works again on Python 2.7 (metadata is provided
explicitly there, since its setuptools predates pyproject.toml metadata).
Added a SECURITY.md (supported versions and how to report a vulnerability),
a CONTRIBUTING.md and a Dependabot configuration.
Releases are now built and published by a Publish GitHub Actions workflow,
triggered by a signed tag, using PyPI Trusted Publishing (no stored token),
with a SLSA build provenance attestation, a CycloneDX SBOM and PEP 740
attestations on each artifact. The release notes are generated from this
changelog.
Continuous integration now checks that the version is declared consistently
across the modules and pyproject.toml, and enforces ruff (a Python
2.7-safe rule set) and black.
Added run_tests_containers.sh to run the test suite in containers across
every supported Python version, including 2.7 and 3.6. Continuous integration
now uses it to test the whole supported matrix (2.7 through 3.15), instead of
only the versions the runner can install directly.
Coverage is now computed from every version of the test matrix instead of a
single interpreter: each container exports its coverage data
(COVERAGE_OUTPUT_DIR), and a final job combines them all before reporting to
Coveralls. This covers the version-specific branches, starting with the Python
2.7 half of utils.py. Removed the stale .coveralls.yml, which still
declared Travis CI as the service.


To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.15 pkgsrc/textproc/py-jsonrpclib-pelix/Makefile
cvs rdiff -u -r1.5 -r1.6 pkgsrc/textproc/py-jsonrpclib-pelix/PLIST
cvs rdiff -u -r1.10 -r1.11 pkgsrc/textproc/py-jsonrpclib-pelix/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/py-jsonrpclib-pelix/Makefile
diff -u pkgsrc/textproc/py-jsonrpclib-pelix/Makefile:1.14 pkgsrc/textproc/py-jsonrpclib-pelix/Makefile:1.15
--- pkgsrc/textproc/py-jsonrpclib-pelix/Makefile:1.14   Tue Jul 21 10:59:58 2026
+++ pkgsrc/textproc/py-jsonrpclib-pelix/Makefile        Fri Aug 28 10:53:28 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.14 2026/07/21 10:59:58 adam Exp $
+# $NetBSD: Makefile,v 1.15 2026/08/28 10:53:28 adam Exp $
 
-DISTNAME=      jsonrpclib_pelix-1.1.0
+DISTNAME=      jsonrpclib_pelix-1.2.0
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/_/-/}
 CATEGORIES=    textproc python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=j/jsonrpclib-pelix/}
@@ -10,9 +10,12 @@ HOMEPAGE=    https://github.com/tcalmant/js
 COMMENT=       Implementation of the JSON-RPC v2.0 specification
 LICENSE=       apache-2.0
 
-TOOL_DEPENDS+= ${PYPKGPREFIX}-hatchling-[0-9]*:../../devel/py-hatchling
+TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools>=78:../../devel/py-setuptools
 
 USE_LANGUAGES= # none
 
+do-test:
+       cd ${WRKSRC} && ${SETENV} ${TEST_ENV} ${PYTHONBIN} -m unittest discover -v
+
 .include "../../lang/python/wheel.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/textproc/py-jsonrpclib-pelix/PLIST
diff -u pkgsrc/textproc/py-jsonrpclib-pelix/PLIST:1.5 pkgsrc/textproc/py-jsonrpclib-pelix/PLIST:1.6
--- pkgsrc/textproc/py-jsonrpclib-pelix/PLIST:1.5       Sat Mar 15 20:26:45 2025
+++ pkgsrc/textproc/py-jsonrpclib-pelix/PLIST   Fri Aug 28 10:53:28 2026
@@ -1,8 +1,9 @@
-@comment $NetBSD: PLIST,v 1.5 2025/03/15 20:26:45 adam Exp $
+@comment $NetBSD: PLIST,v 1.6 2026/08/28 10:53:28 adam Exp $
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
 ${PYSITELIB}/${WHEEL_INFODIR}/RECORD
 ${PYSITELIB}/${WHEEL_INFODIR}/WHEEL
 ${PYSITELIB}/${WHEEL_INFODIR}/licenses/LICENSE
+${PYSITELIB}/${WHEEL_INFODIR}/top_level.txt
 ${PYSITELIB}/jsonrpclib/SimpleJSONRPCServer.py
 ${PYSITELIB}/jsonrpclib/SimpleJSONRPCServer.pyc
 ${PYSITELIB}/jsonrpclib/SimpleJSONRPCServer.pyo

Index: pkgsrc/textproc/py-jsonrpclib-pelix/distinfo
diff -u pkgsrc/textproc/py-jsonrpclib-pelix/distinfo:1.10 pkgsrc/textproc/py-jsonrpclib-pelix/distinfo:1.11
--- pkgsrc/textproc/py-jsonrpclib-pelix/distinfo:1.10   Tue Jul 21 10:59:58 2026
+++ pkgsrc/textproc/py-jsonrpclib-pelix/distinfo        Fri Aug 28 10:53:28 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.10 2026/07/21 10:59:58 adam Exp $
+$NetBSD: distinfo,v 1.11 2026/08/28 10:53:28 adam Exp $
 
-BLAKE2s (jsonrpclib_pelix-1.1.0.tar.gz) = 4d2ee66e842064f05727e6a2277b855dd13f3137e3752b10ddab50c08368c1db
-SHA512 (jsonrpclib_pelix-1.1.0.tar.gz) = 13a0ec95c41eb488efc81014ed9409eecf0c1a13169f9a0269b23e4f85a27655d29ca5b8d09ea5b59665857709652f4565fa1e003ff9c72f9387c7ae93a1b990
-Size (jsonrpclib_pelix-1.1.0.tar.gz) = 70500 bytes
+BLAKE2s (jsonrpclib_pelix-1.2.0.tar.gz) = 40aa0aa7772b3f9a336fdf939ec09611323be27cde116d3f6bfab5c32c7b968a
+SHA512 (jsonrpclib_pelix-1.2.0.tar.gz) = af4b51176cdea481a1d53a72d9b0802ebe4f09fa0334b043df4eff6eb4d8502bf20be75c9a4d9e1bf1b77ee6b209454fa1dea69994a448f59909d5b710b9a29a
+Size (jsonrpclib_pelix-1.2.0.tar.gz) = 75763 bytes