chore(deps)(deps): bump aiosmtplib from 3.0.2 to 5.1.2 in /backend

[dependabot]

Bumps aiosmtplib from 3.0.2 to 5.1.2.

Release notes

Sourced from aiosmtplib's releases.

v5.1.2

What's Changed

• Security: Discard any buffered server data before the STARTTLS handshake, preventing a response-injection attack where a man-in-the-middle pre-stages plaintext that would otherwise be read as part of the encrypted session. More details: GHSA-vxj7-4xrp-5vr4
• Bugfix: Corrected SMTPResponse __repr__ result
• Bugfix: Calling connect() on an already-connected client now raises SMTPException instead of deadlocking on the connection lock
• Feature: Poe command runner for dev tasks
• Bugfix: Timeout ignored during CRAM-MD5 verification
• Bugfix: Only parse EHLO response after validating success
• Bugfix: return None from extract_sender when address list is empty
• Bugfix: Enforce a maximum total response size, preventing unbounded memory use if a server streams data with no line ending or endless multiline continuation lines
• Bugfix: Use the invalid_response status code (-1) instead of 500 when a server response line exceeds the maximum length
• Bugfix: A read timeout now closes the connection instead of leaving it in a desynced state, where a late server response could be mispaired with a subsequent command
• Bugfix: Correctly parse old-style AUTH= extension advertisements; all advertised methods are now kept (e.g. both PLAIN and LOGIN from AUTH=PLAIN LOGIN)
• Bugfix: ESMTP extension lines with leading whitespace are no longer ignored

Full Changelog: cole/aiosmtplib@v5.1.1...v5.1.2

5.1.1

What's Changed

• Security: Reject control characters (the C0 range 0x00-0x1F and DEL 0x7F, including CR, LF, and NUL) in SMTP command arguments, preventing command injection via input passed to mail(), rcpt(), vrfy(), expn() or sendmail(). Such input now raises ValueError before anything is written to the connection. More details: GHSA-v3q9-hj7j-63hq Thanks to @​tonghuaroot for the report.
• Bugfix: SMTP.quit() no longer hangs until the read timeout when the peer drops the transport with an exception after QUIT is sent but before the 221 reply is parsed (e.g. AWS SES closing TLS without close_notify). Contributed by @​yamaaaaaa31

New Contributors

• @​yamaaaaaa31 made their first contribution in cole/aiosmtplib#346

Full Changelog: cole/aiosmtplib@v5.1.0...v5.1.1

v5.1.0

What's Changed

• Feature: Add XOAUTH2 authentication support

Full Changelog: cole/aiosmtplib@v5.0.0...v5.1.0

v5.0.0

What's Changed

• BREAKING: Drop Python 3.9 support
• Various testing config improvements

New Contributors

• @​cjwatson made their first contribution in cole/aiosmtplib#328

... (truncated)

Changelog

Sourced from aiosmtplib's changelog.

5.1.2

• Security: Discard any buffered server data before the STARTTLS handshake, preventing a response-injection attack where a man-in-the-middle pre-stages plaintext that would otherwise be read as part of the encrypted session. More details: GHSA-vxj7-4xrp-5vr4
• Bugfix: Corrected SMTPResponse __repr__ result
• Bugfix: Calling connect() on an already-connected client now raises SMTPException instead of deadlocking on the connection lock
• Feature: Poe command runner for dev tasks
• Bugfix: Timeout ignored during CRAM-MD5 verification
• Bugfix: Only parse EHLO response after validating success
• Bugfix: return None from extract_sender when address list is empty
• Bugfix: Enforce a maximum total response size, preventing unbounded memory use if a server streams data with no line ending or endless multiline continuation lines
• Bugfix: Use the invalid_response status code (-1) instead of 500 when a server response line exceeds the maximum length
• Bugfix: A read timeout now closes the connection instead of leaving it in a desynced state, where a late server response could be mispaired with a subsequent command
• Bugfix: Correctly parse old-style AUTH= extension advertisements; all advertised methods are now kept (e.g. both PLAIN and LOGIN from AUTH=PLAIN LOGIN)
• Bugfix: ESMTP extension lines with leading whitespace are no longer ignored

5.1.1

• Security: Reject control characters (the C0 range 0x00-0x1F and DEL 0x7F, including CR, LF, and NUL) in SMTP command arguments, preventing command injection via input passed to mail(), rcpt(), vrfy(), expn() or sendmail(). Such input now raises ValueError before anything is written to the connection. More details: GHSA-v3q9-hj7j-63hq Thanks to @​tonghuaroot for the report.
• Bugfix: SMTP.quit() no longer hangs until the read timeout when the peer drops the transport with an exception after QUIT is sent but before the 221 reply is parsed (e.g. AWS SES closing TLS without close_notify).

5.1.0

• Feature: Add XOAUTH2 authentication support

... (truncated)

Commits

• bffc6d1 release: v5.1.2
• 9fab7ba fix(security): STARTTLS injection
• 382b3c9 ci: try codecov 6.0
• f0087db ci: pre-commit autoupdate
• c0be341 fix: buildcheck via poe
• 889c24c lint: auto fixes from pre-commit hooks
• 3e25ac4 fix: mixed old/new style auth parsing
• 5cd299f fix: explicit close on read timeout
• e1521d7 fix: error (don't hang) on double connect
• e899551 fix: SMTPResponse repr
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.