CVS commit: pkgsrc/www/py-websockets

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Nov  1 22:05:05 UTC 2026

Modified Files:
        pkgsrc/www/py-websockets: Makefile distinfo

Log Message:
py-websockets: update to 17.4.

Security fix

websockets 17.4 fixes a security issue.

:meth:`~asyncio.connection.Connection.recv` now rejects fragmented messages split into more than 4096 frames. You may adjust the limit with the :envvar:`WEBSOCKETS_MAX_FRAGMENTS` environment variable.

Earlier versions were vulnerable to denial of service by memory exhaustion because they didn't enforce such a limit (CVE ID pending). All implementations were affected.

:meth:`~asyncio.connection.Connection.recv_streaming` isn't affected.
Improvements

    Chained consistently to :exc:`~exceptions.ConnectionClosed` exceptions that close the connection.


To generate a diff of this commit:
cvs rdiff -u -r1.40 -r1.41 pkgsrc/www/py-websockets/Makefile
cvs rdiff -u -r1.33 -r1.34 pkgsrc/www/py-websockets/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-websockets/Makefile
diff -u pkgsrc/www/py-websockets/Makefile:1.40 pkgsrc/www/py-websockets/Makefile:1.41
--- pkgsrc/www/py-websockets/Makefile:1.40      Sat Oct 24 09:24:29 2026
+++ pkgsrc/www/py-websockets/Makefile   Sun Nov  1 22:05:05 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.40 2026/10/24 09:24:29 adam Exp $
+# $NetBSD: Makefile,v 1.41 2026/11/01 22:05:05 wiz Exp $
 #
 # https://github.com/python-websockets/websockets/blob/main/docs/project/changelog.rst
 
-DISTNAME=      websockets-17.3
+DISTNAME=      websockets-17.4
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=w/websockets/}

Index: pkgsrc/www/py-websockets/distinfo
diff -u pkgsrc/www/py-websockets/distinfo:1.33 pkgsrc/www/py-websockets/distinfo:1.34
--- pkgsrc/www/py-websockets/distinfo:1.33      Sat Oct 24 09:24:29 2026
+++ pkgsrc/www/py-websockets/distinfo   Sun Nov  1 22:05:05 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.33 2026/10/24 09:24:29 adam Exp $
+$NetBSD: distinfo,v 1.34 2026/11/01 22:05:05 wiz Exp $
 
-BLAKE2s (websockets-17.3.tar.gz) = 76c72f2b548f120944cc46fc4c85e387b00beae507002cf07aeb9ddac940af85
-SHA512 (websockets-17.3.tar.gz) = ae33e37f460c617f65b17470872fb982b9aa3745f3d8a8a736f36ef53f9925b9070a3beee3f18e20c6c1ec1f7370b59a8d603c4663db588c8eab151384d5ae71
-Size (websockets-17.3.tar.gz) = 188878 bytes
+BLAKE2s (websockets-17.4.tar.gz) = b23059eedbcf31054cc708acd49d7d48db45d78a9296f0628b0614c61494c99c
+SHA512 (websockets-17.4.tar.gz) = 51baf2d8673fe07e676b73be1ba2df1f695e1de96d7a6786e43bca81959830daf14c259e5b1bf9b07dde0e46d4b0927b7c255c03895b6115a54c8ae6e0c65912
+Size (websockets-17.4.tar.gz) = 191391 bytes