Skip to content

Bump werkzeug from 0.15.5 to 2.2.3 in /extra/libcbor/doc/source - #6

Closed
dependabot[bot] wants to merge 1 commit into
8.0from
dependabot/pip/extra/libcbor/doc/source/werkzeug-2.2.3
Closed

Bump werkzeug from 0.15.5 to 2.2.3 in /extra/libcbor/doc/source#6
dependabot[bot] wants to merge 1 commit into
8.0from
dependabot/pip/extra/libcbor/doc/source/werkzeug-2.2.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2023

Copy link
Copy Markdown

Bumps werkzeug from 0.15.5 to 2.2.3.

Release notes

Sourced from werkzeug's releases.

2.2.3

This is a fix release for the 2.2.x release branch.

This release contains security fixes for:

2.2.2

This is a fix release for the 2.2.0 feature release.

2.2.1

This is a fix release for the 2.2.0 feature release.

2.2.0

This is a feature release, which includes new features and removes previously deprecated features. The 2.2.x branch is now the supported bugfix branch, the 2.1.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades.

2.1.2

This is a fix release for the 2.1.0 feature release.

2.1.1

This is a fix release for the 2.1.0 feature release.

2.1.0

This is a feature release, which includes new features and removes previously deprecated features. The 2.1.x branch is now the supported bugfix branch, the 2.0.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades.

2.0.3

... (truncated)

Changelog

Sourced from werkzeug's changelog.

Version 2.2.3

Released 2023-02-14

  • Ensure that URL rules using path converters will redirect with strict slashes when the trailing slash is missing. :issue:2533
  • Type signature for get_json specifies that return type is not optional when silent=False. :issue:2508
  • parse_content_range_header returns None for a value like bytes */-1 where the length is invalid, instead of raising an AssertionError. :issue:2531
  • Address remaining ResourceWarning related to the socket used by run_simple. Remove prepare_socket, which now happens when creating the server. :issue:2421
  • Update pre-existing headers for multipart/form-data requests with the test client. :issue:2549
  • Fix handling of header extended parameters such that they are no longer quoted. :issue:2529
  • LimitedStream.read works correctly when wrapping a stream that may not return the requested size in one read call. :issue:2558
  • A cookie header that starts with = is treated as an empty key and discarded, rather than stripping the leading ==.
  • Specify a maximum number of multipart parts, default 1000, after which a RequestEntityTooLarge exception is raised on parsing. This mitigates a DoS attack where a larger number of form/file parts would result in disproportionate resource use.

Version 2.2.2

Released 2022-08-08

  • Fix router to restore the 2.1 strict_slashes == False behaviour whereby leaf-requests match branch rules and vice versa. :pr:2489
  • Fix router to identify invalid rules rather than hang parsing them, and to correctly parse / within converter arguments. :pr:2489
  • Update subpackage imports in :mod:werkzeug.routing to use the import as syntax for explicitly re-exporting public attributes. :pr:2493
  • Parsing of some invalid header characters is more robust. :pr:2494
  • When starting the development server, a warning not to use it in a production deployment is always shown. :issue:2480
  • LocalProxy.__wrapped__ is always set to the wrapped object when the proxy is unbound, fixing an issue in doctest that would cause it to fail. :issue:2485
  • Address one ResourceWarning related to the socket used by run_simple. :issue:2421

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump werkzeug from 0.15.5 to 2.2.3 in /extra/libcbor/doc/source
31adbcd 
Bumps [werkzeug](https://github.com/pallets/werkzeug) from 0.15.5 to 2.2.3.
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@0.15.5...2.2.3)

---
updated-dependencies:
- dependency-name: werkzeug
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 21, 2023
@dependabot @github

dependabot Bot commented on behalf of github May 6, 2024

Copy link
Copy Markdown
Author

Superseded by #14.

@dependabot dependabot Bot closed this May 6, 2024
@dependabot
dependabot Bot deleted the dependabot/pip/extra/libcbor/doc/source/werkzeug-2.2.3 branch May 6, 2024 15:15
ben-thul pushed a commit that referenced this pull request Aug 19, 2026
@inikep @lukin-oleksiy
PS-11242 [8.4]: Fix InnoDB rw_trx_list ordering for preallocated trx ids
e8743f9 
https://perconadev.atlassian.net/browse/PS-11242

percona.clone_consistent_snapshot crashed in a debug build with:

  [InnoDB] Assertion failure: trx0sys.cc:821:
           prev_trx == nullptr || prev_trx->id > trx->id
   #5 trx_sys_validate_trx_list  trx0sys.cc:821
   #6 trx_erase_lists            trx0trx.cc:1838
   #8 trx_commit_in_memory       trx0trx.cc:2009
   ...
  #21 Clone_persist_gtid::write_to_table  clone0repl.cc:475
  #24 clone_gtid_thread                   clone0repl.cc:723

trx_sys->rw_trx_list is required to be ordered by descending trx->id,
and trx_sys_validate_trx_list() (UNIV_DEBUG only) enforces it on every
erase.

The consistent snapshot clone-view feature preallocates a transaction
id for a donor read-only transaction (ReadView::clone() in read0read.cc).
When that donor is later promoted to read-write via trx_set_rw_mode() ->
trx_assign_id_for_rw(), it reuses the preallocated id, which - as the
existing comment notes - "might not be received in ascending order" and
can therefore be smaller than ids handed out to other transactions in
the meantime.

trx_assign_id_for_rw() already accounts for this when maintaining the
sorted rw_trx_ids vector (the std::upper_bound insert), but
trx_add_to_rw_trx_list() always did UT_LIST_ADD_FIRST, which assumes the
new id is the greatest. Prepending an out-of-order preallocated id breaks
the descending-id ordering of rw_trx_list. The corruption goes unnoticed
at insertion time because trx_set_rw_mode() (unlike trx_start_low()) has
no post-insert validation, and is only caught later when an unrelated
transaction - here the clone GTID persister thread - commits and runs the
validation during trx_erase_lists().

Fix trx_add_to_rw_trx_list() to insert a transaction carrying a
preallocated_id at the position that preserves descending-id order,
mirroring the rw_trx_ids handling. The common case (a freshly allocated
id, which is always the greatest) keeps the O(1) prepend, so there is no
hot-path regression.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants