Skip to content

Commit 9e31389

Browse files
authored
Fix: v0.9.2
This is a security patch that bumps AIOHTTP to v3.8.5, which fixes CVE-2023-37276 (https://nvd.nist.gov/vuln/detail/CVE-2023-30589). ~ Noelle
2 parents 8584b75 + 08b7e2b commit 9e31389

File tree

3 files changed

+93
-95
lines changed

3 files changed

+93
-95
lines changed

Requirements/prod.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
aiodns==3.0.0 ; python_version >= "3.8" and python_version < "4.0"
22
aiofiles==0.8.0 ; python_version >= "3.8" and python_version < "4.0"
3-
aiohttp==3.8.4 ; python_version >= "3.8" and python_version < "4.0"
3+
aiohttp==3.8.5 ; python_version >= "3.8" and python_version < "4.0"
44
aiosignal==1.3.1 ; python_version >= "3.8" and python_version < "4.0"
55
aiosqlite==0.17.0 ; python_version >= "3.8" and python_version < "4.0"
66
anyio==3.7.1 ; python_version >= "3.8" and python_version < "4.0"

changelog.md

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
# 🛠️ Kumiko v0.9.1 🛠️
1+
# 🛠️ Kumiko v0.9.2 🛠️
22

3-
Small bug fixes to make sure that Kumiko is working
3+
Security update to fix a vulnerability in AIOHTTP ([CVE-2023-37276](https://nvd.nist.gov/vuln/detail/CVE-2023-37276)) where llhttp v6.0.6 would be vulnerable to [CVE-2023-30589](https://nvd.nist.gov/vuln/detail/CVE-2023-30589)
44

5-
For the full list of changes, please see them here: [`v0.9.0...v0.9.1`](https://github.com/No767/Kumiko/compare/v0.9.0...v0.9.1)
5+
For the full list of changes, please see them here: [`v0.9.1...v0.9.2`](https://github.com/No767/Kumiko/compare/v0.9.1...v0.9.2)
66

77

88
## :boom: Breaking Changes :boom:
@@ -14,9 +14,7 @@ For the full list of changes, please see them here: [`v0.9.0...v0.9.1`](https://
1414

1515
## 🛠️ Changes
1616

17-
- Fix `SIGTERM` not working to close the bot properly
18-
- Use `latest` tag instead of `edge` tag for production `docker-compose.yml` file
19-
- Use `SIGTERM` as the `STOPSIGNAL` for Docker
17+
- Pin AIOHTTP to use v3.8.5 instead (fixes [CVE-2023-37276](https://nvd.nist.gov/vuln/detail/CVE-2023-37276))
2018

2119

2220
## ✨ Additions

0 commit comments

Comments
 (0)