Skip to content

Commit

Permalink
Fix: v0.9.2
Browse files Browse the repository at this point in the history
This is a security patch that bumps AIOHTTP to v3.8.5, which fixes CVE-2023-37276 (https://nvd.nist.gov/vuln/detail/CVE-2023-30589). ~ Noelle
  • Loading branch information
No767 authored Jul 20, 2023
2 parents 8584b75 + 08b7e2b commit 9e31389
Show file tree
Hide file tree
Showing 3 changed files with 93 additions and 95 deletions.
2 changes: 1 addition & 1 deletion Requirements/prod.txt
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
aiodns==3.0.0 ; python_version >= "3.8" and python_version < "4.0"
aiofiles==0.8.0 ; python_version >= "3.8" and python_version < "4.0"
aiohttp==3.8.4 ; python_version >= "3.8" and python_version < "4.0"
aiohttp==3.8.5 ; python_version >= "3.8" and python_version < "4.0"
aiosignal==1.3.1 ; python_version >= "3.8" and python_version < "4.0"
aiosqlite==0.17.0 ; python_version >= "3.8" and python_version < "4.0"
anyio==3.7.1 ; python_version >= "3.8" and python_version < "4.0"
Expand Down
10 changes: 4 additions & 6 deletions changelog.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# 🛠️ Kumiko v0.9.1 🛠️
# 🛠️ Kumiko v0.9.2 🛠️

Small bug fixes to make sure that Kumiko is working
Security update to fix a vulnerability in AIOHTTP ([CVE-2023-37276](https://nvd.nist.gov/vuln/detail/CVE-2023-37276)) where llhttp v6.0.6 would be vulnerable to [CVE-2023-30589](https://nvd.nist.gov/vuln/detail/CVE-2023-30589)

For the full list of changes, please see them here: [`v0.9.0...v0.9.1`](https://github.com/No767/Kumiko/compare/v0.9.0...v0.9.1)
For the full list of changes, please see them here: [`v0.9.1...v0.9.2`](https://github.com/No767/Kumiko/compare/v0.9.1...v0.9.2)


## :boom: Breaking Changes :boom:
Expand All @@ -14,9 +14,7 @@ For the full list of changes, please see them here: [`v0.9.0...v0.9.1`](https://

## 🛠️ Changes

- Fix `SIGTERM` not working to close the bot properly
- Use `latest` tag instead of `edge` tag for production `docker-compose.yml` file
- Use `SIGTERM` as the `STOPSIGNAL` for Docker
- Pin AIOHTTP to use v3.8.5 instead (fixes [CVE-2023-37276](https://nvd.nist.gov/vuln/detail/CVE-2023-37276))


## ✨ Additions
Expand Down
Loading

0 comments on commit 9e31389

Please sign in to comment.