Skip to content

Chore(deps): Bump aiosmtplib from 5.1.1 to 5.1.2 in /airflow - #5678

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/airflow/aiosmtplib-5.1.2
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/airflow/aiosmtplib-5.1.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 27, 2026 •

Copy link
Copy Markdown
Contributor

Bumps aiosmtplib from 5.1.1 to 5.1.2.

Release notes

Sourced from aiosmtplib's releases.

v5.1.2

What's Changed

  • Security: Discard any buffered server data before the STARTTLS handshake, preventing a response-injection attack where a man-in-the-middle pre-stages plaintext that would otherwise be read as part of the encrypted session. More details: GHSA-vxj7-4xrp-5vr4
  • Bugfix: Corrected SMTPResponse __repr__ result
  • Bugfix: Calling connect() on an already-connected client now raises SMTPException instead of deadlocking on the connection lock
  • Feature: Poe command runner for dev tasks
  • Bugfix: Timeout ignored during CRAM-MD5 verification
  • Bugfix: Only parse EHLO response after validating success
  • Bugfix: return None from extract_sender when address list is empty
  • Bugfix: Enforce a maximum total response size, preventing unbounded memory use if a server streams data with no line ending or endless multiline continuation lines
  • Bugfix: Use the invalid_response status code (-1) instead of 500 when a server response line exceeds the maximum length
  • Bugfix: A read timeout now closes the connection instead of leaving it in a desynced state, where a late server response could be mispaired with a subsequent command
  • Bugfix: Correctly parse old-style AUTH= extension advertisements; all advertised methods are now kept (e.g. both PLAIN and LOGIN from AUTH=PLAIN LOGIN)
  • Bugfix: ESMTP extension lines with leading whitespace are no longer ignored

Full Changelog: cole/aiosmtplib@v5.1.1...v5.1.2

Changelog

Sourced from aiosmtplib's changelog.

5.1.2

  • Security: Discard any buffered server data before the STARTTLS handshake, preventing a response-injection attack where a man-in-the-middle pre-stages plaintext that would otherwise be read as part of the encrypted session. More details: GHSA-vxj7-4xrp-5vr4
  • Bugfix: Corrected SMTPResponse __repr__ result
  • Bugfix: Calling connect() on an already-connected client now raises SMTPException instead of deadlocking on the connection lock
  • Feature: Poe command runner for dev tasks
  • Bugfix: Timeout ignored during CRAM-MD5 verification
  • Bugfix: Only parse EHLO response after validating success
  • Bugfix: return None from extract_sender when address list is empty
  • Bugfix: Enforce a maximum total response size, preventing unbounded memory use if a server streams data with no line ending or endless multiline continuation lines
  • Bugfix: Use the invalid_response status code (-1) instead of 500 when a server response line exceeds the maximum length
  • Bugfix: A read timeout now closes the connection instead of leaving it in a desynced state, where a late server response could be mispaired with a subsequent command
  • Bugfix: Correctly parse old-style AUTH= extension advertisements; all advertised methods are now kept (e.g. both PLAIN and LOGIN from AUTH=PLAIN LOGIN)
  • Bugfix: ESMTP extension lines with leading whitespace are no longer ignored
Commits
  • bffc6d1 release: v5.1.2
  • 9fab7ba fix(security): STARTTLS injection
  • 382b3c9 ci: try codecov 6.0
  • f0087db ci: pre-commit autoupdate
  • c0be341 fix: buildcheck via poe
  • 889c24c lint: auto fixes from pre-commit hooks
  • 3e25ac4 fix: mixed old/new style auth parsing
  • 5cd299f fix: explicit close on read timeout
  • e1521d7 fix: error (don't hang) on double connect
  • e899551 fix: SMTPResponse repr
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 27, 2026
@dependabot
dependabot Bot requested a review from evansiroky as a code owner August 27, 2026 23:38
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 27, 2026
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Aug 27, 2026
@github-actions

github-actions Bot commented Aug 27, 2026 •

Copy link
Copy Markdown

Terraform plan in iac/cal-itp-data-infra-staging/airflow/us

No changes. Your infrastructure matches the configuration.
No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in Plan Terraform for Warehouse and DAG changes #2180

@dependabot
dependabot Bot force-pushed the dependabot/uv/airflow/aiosmtplib-5.1.2 branch from 7ab4a26 to b9fe35a Compare September 21, 2026 21:08
Bumps [aiosmtplib](https://github.com/cole/aiosmtplib) from 5.1.1 to 5.1.2.
- [Release notes](https://github.com/cole/aiosmtplib/releases)
- [Changelog](https://github.com/cole/aiosmtplib/blob/main/CHANGELOG.rst)
- [Commits](cole/aiosmtplib@v5.1.1...v5.1.2)

---
updated-dependencies:
- dependency-name: aiosmtplib
  dependency-version: 5.1.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/airflow/aiosmtplib-5.1.2 branch from b9fe35a to 4a6deb8 Compare September 23, 2026 22:55
@github-actions

Copy link
Copy Markdown

Terraform plan in iac/cal-itp-data-infra/composer/us

Error: Error loading state error
Error: Error loading state error

  with data.terraform_remote_state.gcs,
  on variables.tf line 45, in data "terraform_remote_state" "gcs":
  45:   backend = "gcs"

error loading the remote state: Failed to open state file at
gs://calitp-prod-gcp-components-tfstate/cal-itp-data-infra/gcs/default.tfstate:
Get
"https://storage.googleapis.com/calitp-prod-gcp-components-tfstate/cal-itp-data-infra%2Fgcs%2Fdefault.tfstate":
credentials: status code 503: upstream connect error or disconnect/reset
before headers. reset reason: overflow

Error: Error loading state error

  with data.terraform_remote_state.iam,
  on variables.tf line 63, in data "terraform_remote_state" "iam":
  63:   backend = "gcs"

error loading the remote state: Failed to open state file at
gs://calitp-prod-gcp-components-tfstate/cal-itp-data-infra/iam/default.tfstate:
Get
"https://storage.googleapis.com/calitp-prod-gcp-components-tfstate/cal-itp-data-infra%2Fiam%2Fdefault.tfstate":
credentials: status code 503: upstream connect error or disconnect/reset
before headers. reset reason: overflow

❌ Failed to generate plan in Plan Terraform for Warehouse and DAG changes #2180

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants