Skip to content

Update dependency idna to v3.15#23

Open
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/idna-3.x
Open

Update dependency idna to v3.15#23
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/idna-3.x

Conversation

@mend-for-github-com
Copy link
Copy Markdown

@mend-for-github-com mend-for-github-com Bot commented Jul 8, 2024

This PR contains the following updates:

Package Update Change
idna (changelog) minor ==3.4==3.15

By merging this PR, the issue #22 will be automatically resolved and closed:

Severity CVSS Score Vulnerability
Medium Medium 6.2 CVE-2024-3651
Medium Medium 5.3 CVE-2026-45409

Release Notes

kjd/idna (idna)

v3.15

Compare Source

  • Enforce DNS-length cap on individual labels early in check_label,
    short-circuiting contextual-rule processing for oversized input
    while staying compatible with UTS 46 usage.
  • Tidy core helpers: hoist bidi category sets to module-level
    frozensets (avoiding per-codepoint list construction), simplify
    length checks, and reuse the shared _unicode_dots_re from
    idna.core in the codec module.
  • Use raise ... from err for proper exception chaining and
    switch internal string formatting to f-strings.
  • Allow flit_core 4.x in the build backend.
  • Expand the ruff lint set (flake8-bugbear, flake8-simplify,
    pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
    to Python 3.14.
  • Add Dependabot configuration for GitHub Actions.
  • Convert README and HISTORY from reStructuredText to Markdown.
  • Reference CVE-2026-45409 for the 3.14 advisory in place of the
    initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.

v3.14

Compare Source

  • Removed opportunity to process long inputs into quadratic
    time by rejecting oversize inputs up-front. Closes a bypass
    of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

v3.13

Compare Source

  • Correct classification error for codepoint U+A7F1

v3.12

Compare Source

  • Update to Unicode 17.0.0.
  • Issue a deprecation warning for the transitional argument.
  • Added lazy-loading to provide some performance improvements.
  • Removed vestiges of code related to Python 2 support, including
    segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

v3.11

Compare Source

  • Update to Unicode 16.0.0, including significant changes to UTS46
    processing. As a result of Unicode ending support for it, transitional
    processing no longer has an effect and returns the same result.
  • Add support for Python 3.14, lowest supported version is Python 3.8.
  • Various updates to packaging, including PEP 740 support.

v3.10

Compare Source

  • Reverted to Unicode 15.1.0 data. Unicode 16 has some significant changes
    to UTS46 processing that will require more work to properly implement.

v3.9

Compare Source

  • Update to Unicode 16.0.0
  • Deprecate setup.cfg in favour of pyproject.toml
  • Use ruff for code formatting

Thanks to Waket Zheng for contributions to this release.

v3.8

Compare Source

  • Fix regression where IDNAError exception was not being produced for
    certain inputs.
  • Add support for Python 3.13, drop support for Python 3.5 as it is no
    longer testable.
  • Documentation improvements
  • Updates to package testing using Github actions

Thanks to Hugo van Kemenade for contributions to this release.

v3.7

Compare Source

  • Fix issue where specially crafted inputs to encode() could
    take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

v3.6

Compare Source

  • Fix regression to include tests in source distribution.

v3.5

Compare Source

  • Update to Unicode 15.1.0
  • String codec name is now "idna2008" as overriding the system codec
    "idna" was not working.
  • Fix typing error for codec encoding
  • "setup.cfg" has been added for this release due to some downstream
    lack of adherence to PEP 517. Should be removed in a future release
    so please prepare accordingly.
  • Removed reliance on a symlink for the "idna-data" tool to comport
    with PEP 517 and the Python Packaging User Guide for sdist archives.
  • Added security reporting protocol for project

Thanks Jon Ribbens, Diogo Teles Sant'Anna, Wu Tingfeng for contributions
to this release.


  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com Bot added the security fix Security fix generated by Mend label Jul 8, 2024
@mend-for-github-com mend-for-github-com Bot changed the title Update dependency idna to v3.7 Update dependency idna to v3.15 May 21, 2026
@mend-for-github-com mend-for-github-com Bot force-pushed the whitesource-remediate/idna-3.x branch from bddd60f to 6ea254f Compare May 21, 2026 01:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants