-
-
Notifications
You must be signed in to change notification settings - Fork 34k
gh-144484: Warn users not to use wsgiref in production #144487
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
LGTM |
vstinner
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
https://docs.python.org/dev/library/http.server.html has a similar banner but it also has a "Security considerations" section.
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14. |
|
Sorry, @sethmlarson, I could not cleanly backport this to |
|
Sorry, @sethmlarson, I could not cleanly backport this to |
|
Aha, it seems like you should backport the change manually to 3.14. |
|
@StanFromIreland I believe it should be handled as a security-related change. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12. |
Follow-up from the precautionary CVE for
wsgiref, where even though the module is documented as a reference implementation (instead of production-ready), there isn't any explicit docs for this like other modules with this property (eg:http.server).📚 Documentation preview 📚: https://cpython-previews--144487.org.readthedocs.build/