[dependabot]

Bumps dnspython from 2.8.0 to 2.9.0.

Release notes

Sourced from dnspython's releases.

dnspython 2.9.0

This release fixes a potential excessive CPU consumption issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

Changelog

Sourced from dnspython's changelog.

2.9.0

• Decompression chain length is limited to 16. Prior to this change, a maliciously crafted DNS message could cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications which processed untrusted DNS wire form messages with dnspython could be degraded or DoS'd by the extra CPU use required.

  Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos for finding and reporting this issue.

  See GHSA-45c3-73f7-pv4m

• Httpx2 has replaced httpx for HTTPS TCP connections.

• The minimum supported Python version is now 3.11.

• DNSSEC now supports ML-DSA-44, a post-quantum signature algorithm.

• The NSEC3 Next Hashed Owner Name in presentation format is now decoded as base32hex (RFC 5155 Section 1.3, RFC 4648 Extended Hex Alphabet). The letters W, X, Y, and Z are not in that alphabet; they used to be accepted and silently decoded to a different owner name, so to_text of the result did not match the input. They are now rejected.

• The NID and L64 node/locator ids in presentation format are now rejected when a group contains anything other than hex digits. A sign or underscore, which int() silently accepts, produced a record whose text form did not parse back the same way (RFC 6742).

• Rdata of a known type in the generic \# syntax, such as an NS record in a zone file, no longer fails to parse when it contains a name under the origin. Its names are relativized as in the type's own text form.

• The SVCB and HTTPS ech parameter value must now be an ECHConfigList with a correct length prefix and at least 4 octets of content (RFC 9848, RFC 9849). The individual ECHConfig structures are not checked.

• SVCB and HTTPS SvcParamKeys in presentation format, including those listed in mandatory, must now be spelled as RFC 9460 requires: 1-63 lowercase letters, digits, or hyphens. Uppercase keys such as ALPN and keys with underscores such as no_default_alpn are rejected.

• SVCB and HTTPS presentation format parsing now follows the escaping rules of RFC 9460. SvcParamKeys may not contain escapes (e.g. \097lpn=h2), and in comma-separated values (alpn, docpath) only \, and \\ are valid escapes after character-string decoding (e.g. alpn="h2\\x" is rejected).

... (truncated)

Commits

• e790c8f add missing test file
• b72af67 CI release branch update
• bdd62fe release prep
• bafc963 Merge branch 'decompression-limit'
• c5fecf5 release tidying
• c7686f3 update dependencies
• 3c855c8 more type lint
• 52815c9 type lint
• f563427 lint
• b485e46 Limit decompression to a chain length of at most 16 pointers.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[carloshvp]

Reviewed head 4639b7f140dbc85e05d71b1505191da624c19387 against base 04996416a4963dd5369b5d4ad644aa21822d9dde.

Please preserve the committed cryptography override when updating dnspython. requirements/agt.txt changes cryptography==50.0.1 to 48.0.1 and removes the override provenance, while requirements/agt-overrides.txt still requires cryptography>=50.0. The existing tests/unit/test_dependency_security_floors.py::test_agt_lock_carries_no_cryptography_below_the_floor parses this lock and requires a version of at least 50.0; (48, 0, 1) >= (50, 0) is false. The isolated governance install also consumes this lock with --no-deps, so the downgraded pin is actually installed if that job is reached.

Regenerate using the command already recorded in requirements/agt.in, including --override requirements/agt-overrides.txt --universal --python-version 3.11 --generate-hashes. A bounded correction can restore the base's complete cryptography 50.0.1 hash block and override annotation while retaining dnspython 2.9.0. Then run the dependency-floor test and the required CI matrix.

Validation: compared exact provider blobs and the unchanged override/test; no repository code was executed locally because source preparation failed. Hosted Python 3.11/Linux job 128954098863 reaches the Test step and fails; I could not retrieve its log, so I am not attributing its entire failure output to this assertion. The remaining matrix jobs were cancelled and governance was skipped. This review does not claim passing local tests or full CI.