{"action":"created","issue":{"url":"https://api.github.com/repos/vmck/acs-interface/issues/141","repository_url":"https://api.github.com/repos/vmck/acs-interface","labels_url":"https://api.github.com/repos/vmck/acs-interface/issues/141/labels{/name}","comments_url":"https://api.github.com/repos/vmck/acs-interface/issues/141/comments","events_url":"https://api.github.com/repos/vmck/acs-interface/issues/141/events","html_url":"https://github.com/vmck/acs-interface/pull/141","id":541255160,"node_id":"MDExOlB1bGxSZXF1ZXN0MzU1OTQ5NzQ1","number":141,"title":"Bump waitress from 1.3.1 to 1.4.0","user":{"login":"dependabot[bot]","id":49699333,"node_id":"MDM6Qm90NDk2OTkzMzM=","avatar_url":"https://avatars0.githubusercontent.com/in/29110?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot%5Bbot%5D","html_url":"https://github.com/apps/dependabot","followers_url":"https://api.github.com/users/dependabot%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":1715485939,"node_id":"MDU6TGFiZWwxNzE1NDg1OTM5","url":"https://api.github.com/repos/vmck/acs-interface/labels/dependencies","name":"dependencies","color":"0366d6","default":false,"description":"Pull requests that update a dependency file"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2019-12-21T00:25:34Z","updated_at":"2020-01-13T09:12:44Z","closed_at":"2020-01-13T09:12:38Z","author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/vmck/acs-interface/pulls/141","html_url":"https://github.com/vmck/acs-interface/pull/141","diff_url":"https://github.com/vmck/acs-interface/pull/141.diff","patch_url":"https://github.com/vmck/acs-interface/pull/141.patch"},"body":"Bumps [waitress](https://github.com/Pylons/waitress) from 1.3.1 to 1.4.0.\n<details>\n<summary>Changelog</summary>\n\n*Sourced from [waitress's changelog](https://github.com/Pylons/waitress/blob/master/CHANGES.txt).*\n\n> 1.4.0 (2019-12-20)\n> ------------------\n> \n> Bugfixes\n> ~~~~~~~~\n> \n> - Waitress used to slam the door shut on HTTP pipelined requests without\n>   setting the ``Connection: close`` header as appropriate in the response. This\n>   is of course not very friendly. Waitress now explicitly sets the header when\n>   responding with an internally generated error such as 400 Bad Request or 500\n>   Internal Server Error to notify the remote client that it will be closing the\n>   connection after the response is sent.\n> \n> - Waitress no longer allows any spaces to exist between the header field-name\n>   and the colon. While waitress did not strip the space and thereby was not\n>   vulnerable to any potential header field-name confusion, it should have sent\n>   back a 400 Bad Request. See [Pylons/waitress#273](https://github-redirect.dependabot.com/Pylons/waitress/issues/273)\n> \n> Security Fixes\n> ~~~~~~~~~~~~~~\n> \n> - Waitress implemented a \"MAY\" part of the RFC7230\n>   (https://tools.ietf.org/html/rfc7230#section-3.5) which states:\n> \n>       Although the line terminator for the start-line and header fields is\n>       the sequence CRLF, a recipient MAY recognize a single LF as a line\n>       terminator and ignore any preceding CR.\n> \n>   Unfortunately if a front-end server does not parse header fields with an LF\n>   the same way as it does those with a CRLF it can lead to the front-end and\n>   the back-end server parsing the same HTTP message in two different ways. This\n>   can lead to a potential for HTTP request smuggling/splitting whereby Waitress\n>   may see two requests while the front-end server only sees a single HTTP\n>   message.\n> \n>   For more information I can highly recommend the blog post by ZeddYu Lu\n>   https://blog.zeddyu.info/2019/12/08/HTTP-Smuggling-en/\n> \n> - Waitress used to treat LF the same as CRLF in ``Transfer-Encoding: chunked``\n>   requests, while the maintainer doesn't believe this could lead to a security\n>   issue, this is no longer supported and all chunks are now validated to be\n>   properly framed with CRLF as required by RFC7230.\n> \n> - Waitress now validates that the ``Transfer-Encoding`` header contains only\n>   transfer codes that it is able to decode. At the moment that includes the\n>   only valid header value being ``chunked``.\n> \n>   That means that if the following header is sent:\n> \n>   ``Transfer-Encoding: gzip, chunked``\n></tr></table> ... (truncated)\n</details>\n<details>\n<summary>Commits</summary>\n\n- [`f11093a`](https://github.com/Pylons/waitress/commit/f11093a6b3240fc26830b6111e826128af7771c3) Merge pull request from GHSA-g2xc-35jw-c63p\n- [`e586be8`](https://github.com/Pylons/waitress/commit/e586be8f43dbb266b9ef28bb285408b3ac3dacd4) Version 1.4.0\n- [`d1f283b`](https://github.com/Pylons/waitress/commit/d1f283b277a664ac03fee62b3f0e9fc930f6ee50) Update CHANGES.txt and HISTORY.txt as appropriate\n- [`60f92b8`](https://github.com/Pylons/waitress/commit/60f92b822538230f279efcfb9561dd2c2524d696) Allow end of chunk parser to be resumeable\n- [`8ecd8dc`](https://github.com/Pylons/waitress/commit/8ecd8dc4be000a0e1be2212dc35ea6a418a8523e) Improve validation of Transfer-Encoding\n- [`575994c`](https://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65) Upon receiving invalid Content-Length bail\n- [`804e313`](https://github.com/Pylons/waitress/commit/804e3133a54088fc879c5e791bbe14bb8eb625f9) Disallow BWS in header field-names\n- [`fb08ecf`](https://github.com/Pylons/waitress/commit/fb08ecf008d314a6c5ba4814efbb41abb0284dbf) Properly enforce max_request_header_size\n- [`8eba394`](https://github.com/Pylons/waitress/commit/8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba) Remove support for non CRLF line endings\n- [`7ff1e6b`](https://github.com/Pylons/waitress/commit/7ff1e6b19d3754669d9473104070798f763b56ec) Make sure all errors have a code/reason\n- Additional commits viewable in [compare view](https://github.com/Pylons/waitress/compare/v1.3.1...v1.4.0)\n</details>\n<br />\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=waitress&package-manager=pip&previous-version=1.3.1&new-version=1.4.0)](https://help.github.com/articles/configuring-automated-security-fixes)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge and block automerging\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language\n- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language\n- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language\n- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language\n\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vmck/acs-interface/network/alerts).\n\n</details>"},"comment":{"url":"https://api.github.com/repos/vmck/acs-interface/issues/comments/573569126","html_url":"https://github.com/vmck/acs-interface/pull/141#issuecomment-573569126","issue_url":"https://api.github.com/repos/vmck/acs-interface/issues/141","id":573569126,"node_id":"MDEyOklzc3VlQ29tbWVudDU3MzU2OTEyNg==","user":{"login":"gmuraru","id":7805588,"node_id":"MDQ6VXNlcjc4MDU1ODg=","avatar_url":"https://avatars3.githubusercontent.com/u/7805588?v=4","gravatar_id":"","url":"https://api.github.com/users/gmuraru","html_url":"https://github.com/gmuraru","followers_url":"https://api.github.com/users/gmuraru/followers","following_url":"https://api.github.com/users/gmuraru/following{/other_user}","gists_url":"https://api.github.com/users/gmuraru/gists{/gist_id}","starred_url":"https://api.github.com/users/gmuraru/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gmuraru/subscriptions","organizations_url":"https://api.github.com/users/gmuraru/orgs","repos_url":"https://api.github.com/users/gmuraru/repos","events_url":"https://api.github.com/users/gmuraru/events{/privacy}","received_events_url":"https://api.github.com/users/gmuraru/received_events","type":"User","site_admin":false},"created_at":"2020-01-13T09:12:44Z","updated_at":"2020-01-13T09:12:44Z","author_association":"COLLABORATOR","body":"Already in"}}
{"actor":{"display_login":"gmuraru"}}