Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency caldav to v1.4.0 #157

Merged
merged 1 commit into from
Nov 5, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 5, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
caldav ==1.3.9 -> ==1.4.0 age adoption passing confidence

Release Notes

python-caldav/caldav (caldav)

v1.4.0

Compare Source

  • Lots of work lifting the project up to more modern standards and improving code, thanks to Georges Toth (github @​sim0nx), Matthias Urlichs (github @​smurfix) and @​ArtemIsmagilov. While this shouldn't matter for existing users, it will make the library more future-proof.
  • Quite long lists of fixes, improvements and some few changes, nothing big, main focus is on ensuring compatibility with as many server implementations as possible. See below.
Fixed
Changed
Added
Security

The debug information gathering hook has been in the limbo for a long time, due to security concerns:

  • An attacker that has access to alter the environment the application is running under may cause a DoS-attack, filling up available disk space with debug logging.
  • An attacker that has access to alter the environment the application is running under, and access to read files under /tmp (files being 0600 and owned by the uid the application is running under), will be able to read the communication between the server and the client, communication that may be private and confidential.

Thinking it through three times, I'm not too concerned - if someone has access to alter the environment the process is running under and access to read files run by the uid of the application, then this someone should already be trusted and will probably have the possibility to DoS the system or gather this communication through other means.

Credits

Georges Tooth, Крылов Александр, zhwei, Stefan Ollinger, Matthias Urlichs, ArtemIsmagilov, Tobias Brox has contributed directly with commits and pull requests included in this release. Many more has contributed through reporting issues and code snippets.

Test runs

Prior to release (commit 92de2e2), tests have been run successfully towards:

  • radicale (internal tests)
  • xandikos (internal tests)
  • ecloud.global (NextCloud) - with flags compatibility_issues.nextcloud + ['no_delete_calendar', 'unique_calendar_ids', 'rate_limited', 'broken_expand'] and with frequent manual "empty thrashcan"-operations in webui.
  • Zimbra
  • DAViCal
  • Posteo
  • Purelymail

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

github-actions bot commented Nov 5, 2024

Test Results

 2 files  ±0   2 suites  ±0   28m 38s ⏱️ -1s
25 tests ±0  24 ✅ +1  1 💤 ±0  0 ❌ ±0 
50 runs  ±0  43 ✅ +1  7 💤 ±0  0 ❌ ±0 

Results for commit efbfbe9. ± Comparison against base commit 66e0f4a.

@renovate renovate bot merged commit 25668f7 into main Nov 5, 2024
7 checks passed
@renovate renovate bot deleted the renovate/caldav-1.x branch November 5, 2024 16:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants