[dependabot]

Bumps dnspython from 2.8.0 to 2.9.0.

Release notes

Sourced from dnspython's releases.

dnspython 2.9.0

This release fixes a potential excessive CPU consumption issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

Changelog

Sourced from dnspython's changelog.

2.9.0

• Decompression chain length is limited to 16. Prior to this change, a maliciously crafted DNS message could cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications which processed untrusted DNS wire form messages with dnspython could be degraded or DoS'd by the extra CPU use required.

  Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos for finding and reporting this issue.

  See GHSA-45c3-73f7-pv4m

• Httpx2 has replaced httpx for HTTPS TCP connections.

• The minimum supported Python version is now 3.11.

• DNSSEC now supports ML-DSA-44, a post-quantum signature algorithm.

• The NSEC3 Next Hashed Owner Name in presentation format is now decoded as base32hex (RFC 5155 Section 1.3, RFC 4648 Extended Hex Alphabet). The letters W, X, Y, and Z are not in that alphabet; they used to be accepted and silently decoded to a different owner name, so to_text of the result did not match the input. They are now rejected.

• The NID and L64 node/locator ids in presentation format are now rejected when a group contains anything other than hex digits. A sign or underscore, which int() silently accepts, produced a record whose text form did not parse back the same way (RFC 6742).

• Rdata of a known type in the generic \# syntax, such as an NS record in a zone file, no longer fails to parse when it contains a name under the origin. Its names are relativized as in the type's own text form.

• The SVCB and HTTPS ech parameter value must now be an ECHConfigList with a correct length prefix and at least 4 octets of content (RFC 9848, RFC 9849). The individual ECHConfig structures are not checked.

• SVCB and HTTPS SvcParamKeys in presentation format, including those listed in mandatory, must now be spelled as RFC 9460 requires: 1-63 lowercase letters, digits, or hyphens. Uppercase keys such as ALPN and keys with underscores such as no_default_alpn are rejected.

• SVCB and HTTPS presentation format parsing now follows the escaping rules of RFC 9460. SvcParamKeys may not contain escapes (e.g. \097lpn=h2), and in comma-separated values (alpn, docpath) only \, and \\ are valid escapes after character-string decoding (e.g. alpn="h2\\x" is rejected).

... (truncated)

Commits

• e790c8f add missing test file
• b72af67 CI release branch update
• bdd62fe release prep
• bafc963 Merge branch 'decompression-limit'
• c5fecf5 release tidying
• c7686f3 update dependencies
• 3c855c8 more type lint
• 52815c9 type lint
• f563427 lint
• b485e46 Limit decompression to a chain length of at most 16 pointers.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

📋 Review Summary

This automated Dependabot PR bumps dnspython from 2.8.0 to 2.9.0 in /sdks/python/container/py314/base_image_requirements.txt to address a security vulnerability (GHSA-45c3-73f7-pv4m) related to excessive CPU consumption during DNS name decompression.

🔍 General Feedback

• The version bump is clean, compatible with Python 3.14 (dnspython 2.9.0 requires Python >= 3.11) and pymongo==4.17.0, and introduces no breaking issues.

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

[github-actions]

Closing this PR because dependabot updates for container/** are not allowed due to generated files and excluded_paths is disabled due to dependabot/dependabot-core#14408. Once issue is resolved, please remove this step.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.