django/django-project
django/django-project
Template
1
0
Fork 0
Code Issues Pull requests 10 Releases Wiki Activity Actions

Update dependency daphne to v4.2.3 #6

Open
bot.renovate wants to merge 1 commit from renovate/daphne-4.x into main
pull from: renovate/daphne-4.x
merge into: django:main
Conversation 0 Commits 1 Files changed 2 +2 -2
bot.renovate commented 2026-07-25 19:41:07 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Update Change
daphne (changelog) patch ==4.2.1 → ==4.2.3

Release Notes

django/daphne (daphne)

v4.2.3

Compare Source

  • Added --websocket-max-message-size and --websocket-max-frame-size CLI
    flags to the runserver management command for use in development.

v4.2.2

Compare Source

  • Fixed a denial of service vulnerability via unbounded WebSocket message sizes.
    Daphne previously passed no message or frame size limits to autobahn,
    whose defaults are unbounded. This allowed an unauthenticated client
    to exhaust server memory by sending a very large WebSocket
    messages/frames (CVE-2026-44545).

    Both limits now default to 1 MiB and can be configured via the new
    --websocket-max-message-size and --websocket-max-frame-size CLI
    flags (or the matching Server constructor arguments). Pass 0 to
    restore the previous unlimited behaviour.

    Thanks to ParkHyunWoo for the report.

  • Fixed a header injection vulnerability on the WebSocket upgrade path
    (CVE-2026-44546).

    Header values containing \x0b, \x0c, \x1c, \x1d, \x1e,
    or \x85 were parsed as a single header by Twisted but split into
    multiple headers by autobahn during the WebSocket handshake. An attacker
    could exploit this parser differential to smuggle additional headers
    (e.g. authentication tokens, X-Forwarded-For, Origin,
    Daphne-Root-Path) into the ASGI scope passed to the application.

    Daphne now rejects requests carrying these bytes in any header value with
    a 400 Bad Request response, as required by RFC 9110 §5.5.

    Thanks to Rene Henningsen for the report.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [daphne](https://github.com/django/daphne) ([changelog](https://github.com/django/daphne/blob/main/CHANGELOG.txt)) | patch | `==4.2.1` → `==4.2.3` | --- ### Release Notes <details> <summary>django/daphne (daphne)</summary> ### [`v4.2.3`](https://github.com/django/daphne/blob/HEAD/CHANGELOG.txt#423-2026-07-21) [Compare Source](https://github.com/django/daphne/compare/4.2.2...4.2.3) - Added `--websocket-max-message-size` and `--websocket-max-frame-size` CLI flags to the `runserver` management command for use in development. ### [`v4.2.2`](https://github.com/django/daphne/blob/HEAD/CHANGELOG.txt#422-2026-06-03) [Compare Source](https://github.com/django/daphne/compare/4.2.1...4.2.2) - Fixed a denial of service vulnerability via unbounded WebSocket message sizes. Daphne previously passed no message or frame size limits to autobahn, whose defaults are unbounded. This allowed an unauthenticated client to exhaust server memory by sending a very large WebSocket messages/frames (CVE-2026-44545). Both limits now default to 1 MiB and can be configured via the new `--websocket-max-message-size` and `--websocket-max-frame-size` CLI flags (or the matching `Server` constructor arguments). Pass `0` to restore the previous unlimited behaviour. Thanks to ParkHyunWoo for the report. - Fixed a header injection vulnerability on the WebSocket upgrade path (CVE-2026-44546). Header values containing `\x0b`, `\x0c`, `\x1c`, `\x1d`, `\x1e`, or `\x85` were parsed as a single header by Twisted but split into multiple headers by autobahn during the WebSocket handshake. An attacker could exploit this parser differential to smuggle additional headers (e.g. authentication tokens, `X-Forwarded-For`, `Origin`, `Daphne-Root-Path`) into the ASGI scope passed to the application. Daphne now rejects requests carrying these bytes in any header value with a 400 Bad Request response, as required by RFC 9110 §5.5. Thanks to Rene Henningsen for the report. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjEuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI2MS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/daphne-4.x:renovate/daphne-4.x
git switch renovate/daphne-4.x

Merge

Merge the changes and update on Forgejo.
git switch main
git merge --no-ff renovate/daphne-4.x
git switch renovate/daphne-4.x
git rebase main
git switch main
git merge --ff-only renovate/daphne-4.x
git switch renovate/daphne-4.x
git rebase main
git switch main
git merge --no-ff renovate/daphne-4.x
git switch main
git merge --squash renovate/daphne-4.x
git switch main
git merge --ff-only renovate/daphne-4.x
git switch main
git merge renovate/daphne-4.x
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
django/django-project!6
No description provided.