Twisted 22.2.0 Release

On behalf of the Twisted contributors I announce the final release of
Twisted 22.2.0

This is a bugfix release.

The main bug is:

- CVE-2022-21716 twisted.conch.ssh.transport.SSHTransportBase now
disconnects the remote peer if the
SSH version string is not sent in the first 4096 bytes.

No new features were introduced in this release.

Release documentation is available at

  https://docs.twistedmatrix.com/en/twisted-22.2.0/

Wheels for the release candidate are available on PyPI

   https://pypi.org/project/Twisted/22.2.0/

   python -m pip install Twisted==22.2.0

Please use it and report any issues.

Many thanks to everyone who had a part in Twisted development,
the supporters of the Twisted Software Foundation,
the developers, and all the people testing and building great things
with Twisted!

Slava Ukraini!

Twisted 22.1.0 Final Release Announcement

Hi

On behalf of the Twisted contributors I announce the final release of Twisted 22.1.0

This is mainly a bugfix release.

The main bug is:

• CVE-2022-21712 / GHSA-92x2-jw7w-xvvx twisted.web.client.RedirectAgent and twisted.web.client.BrowserLikeRedirectAgent now properly remove sensitive headers when redirecting to a different origin. (#10294)

The only new feature is:

• twisted.conch.ssh now supports SSH extension negotiation (RFC 8308). (#10266)

The release and NEWS file is available for review at

  https://github.com/twisted/twisted/pull/1686/files

Release documentation is available at

 https://docs.twistedmatrix.com/en/twisted-22.1.0/

Wheels for the release candidate are available on PyPI

  https://pypi.org/project/Twisted/22.1.0/

  python -m pip install Twisted==22.1.0

Please use it and report any issues.

Many thanks to everyone who had a part in Twisted development, the supporters of the Twisted Software Foundation, the developers, and all the people testing and building great things with Twisted!

— Adi Roiban

Twisted 21.7.0 Released

 On behalf of the Twisted contributors I announce the final release of Twisted 21.7.0

This is mostly a bugfix release.

Python 3.5 is no longer a supported platform.

The minimum supported platform is Python 3.6.7.

The notable features are:

• Python 3.10 beta is now a supported platform and should be ready for the final 3.10 release.
• twisted.web.template.renderElement() now accepts any IRequest implementer instead of only twisted.web.server.Request. Add type hints to twisted.web.template. (#10184)
• Type hinting was added to twisted.internet.defer, making this the first release  of Twisted where you might reasonably be able to use mypy without your own custom stub files. (#10017)

The full release notes are available at

    https://github.com/twisted/twisted/releases/tag/twisted-21.7.0

Documentation is available at

    https://docs.twistedmatrix.com/en/stable/

Wheels for the release candidate are available on PyPI

    https://pypi.org/project/Twisted/21.7.0/

    python -m pip install Twisted==21.7.0

Many thanks to everyone who had a part in Twisted - the supporters of the Twisted Software Foundation, the developers, and all the people testing and building great things with Twisted!

Enjoy the release

-Adi Roiban

Twisted Drops Python 2.7 Support

With the open-source Python community at large dropping Python 2.7 support in their projects, Twisted has decided to do the same. Twisted 20.3.0, the most recently released version, is the final release to offer Python 2.7 support.

Despite the break, the compatibility policy still applies. This means that if your code works with Twisted 20.3 on Python 2.7 and 3.5+, that updating your Twisted on Python 3 up to a theoretical 21.3 would not require changes that would make Python 2.7 + Twisted 20.3 stop working, despite a theoretical Twisted 21.3 not supporting 2.7. (This is, of course, in an ideal situation -- regressions and changes that are excepted from the policy such as security fixes do occur. Testing your applications on Twisted prereleases can help catch places where this happens, so, please do!)

- Amber (HawkOwl)

Twisted 20.3.0 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 20.3! The highlights of this release are:

• curve25519-sha256 key exchange algorithm support in Conch.
• "openssh-key-v1" key format support in Conch.
• Security fixes to twisted.web, including preventing request smuggling attacks and rejecting malformed headers. CVE-2020-10108 and CVE-2020-10109 were assigned for these issues, see the NEWS file for full details.
• twist dns --secondary now works on Python 3.
• The deprecation of twisted.news.
• ...and various other fixes, with 28 tickets closed in total. 

This is the final Twisted release to support Python 2.7.

You can find the downloads at <https://pypi.org/project/Twisted> (or alternatively <https://twistedmatrix.com/trac/wiki/Downloads>). The NEWS file is also available at <https://github.com/twisted/twisted/blob/twisted-20.3.0/NEWS.rst>.
Many thanks to everyone who had a part in this release — the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!
- hawkowl

Twisted 19.10.0 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 19.10! The highlights of this release are:

• Security fixes for HTTP/2 -- CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood).  Thanks to Jonathan Looney and Piotr Sikora.
• HTTP/2 fixes regarding timeouts.
• trial's assertResultOf, failureResultOf, and successResultOf, now accept Deferred-awaiting coroutines.
• Various other bug fixes for POP3, conch.ssh.keys, and twisted.web.client.FileBodyProducer.

You can find the downloads at <https://pypi.python.org/pypi/Twisted> (or alternatively <http://twistedmatrix.com/trac/wiki/Downloads>). The NEWS file is also available at <https://github.com/twisted/twisted/blob/twisted-19.10.0/NEWS.rst>.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

- hawkowl

Twisted 19.7.0 Released

On behalf of Twisted Matrix Laboratories and our long-suffering release manager Amber Brown, I am honored to announce¹ the release of Twisted 19.7.0!

The highlights of this release include:

• A full description on the PyPI page!  Check it out here: https://pypi.org/project/Twisted/19.7.0/ (and compare to the slightly sad previous version, here: https://pypi.org/project/Twisted/19.2.1/)
• twisted.test.proto_helpers has been renamed to "twisted.internet.testing"
• This removes the gross special-case carve-out where it was the only "public" API in a test module, and now the rule is that all test modules are private once again.
• Conch's SSH server now supports hmac-sha2-512.
• The XMPP server in Twisted Words will now validate certificates!
• This is a very important security fix for any twisted.words / XMPP users. (See https://twistedmatrix.com/trac/ticket/9561)
• A nasty data-corruption bug in the IOCP reactor was fixed. If you're doing high-volume I/O on Windows you'll want to upgrade!
• Twisted Web no longer gives clients a traceback by default, both when you instantiate Site and when you use twist web on the command line.  You can turn this behavior back on for local development with twist web --display-tracebacks.
• Several bugfixes and documentation fixes resolving bytes/unicode type confusion in twisted.web.
• Python 3.4 is no longer supported.

pip install -U twisted[tls] and enjoy all these enhancements today!

Thanks for using Twisted,

-glyph

¹: somewhat belatedly: it came out 10 days ago.  Oops!

Twisted 19.2.1 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 19.2.1!

This is a security release, and contains the following changes:

• All HTTP clients in twisted.web.client now raise a ValueError when called with a method and/or URL that contain invalid characters. This mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this vulnerability.

It is recommended you update to this release as soon as is practical.

Additional mitigation may be required if Twisted is not your only HTTP client library:

• This bug is present in all current versions of urllib2 in CPython. More information can be found on the Python bug tracker: https://bugs.python.org/issue30458
• This bug was present in urllib3 up until version 1.24.3. More information can be found on the urllib3 bug tracker: https://github.com/urllib3/urllib3/issues/1553
  

You can find the downloads at <https://pypi.python.org/pypi/Twisted> (or alternatively <http://twistedmatrix.com/trac/wiki/Downloads>). The NEWS file is also available at <https://github.com/twisted/twisted/blob/twisted-19.2.1/NEWS.rst>.

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 19.2.0 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 19.2! The highlights of this release are:

• twisted.web.client.HostnameCachingHTTPSPolicy was added as a new contextFactory option. This reduces the performance overhead for making many TLS connections to the same host.
• twisted.conch.ssh.keys can now read private keys in the new "openssh-key-v1" format, introduced in OpenSSH 6.5 and made the default in OpenSSH 7.8.
• The sample code in the "Twisted Web In 60 Seconds" tutorial runs on Python 3.
• DeferredLock and DeferredSemaphore can be used as asynchronous context managers on Python 3.5+.
• twisted.internet.ssl.CertificateOptions now uses 32 random bytes instead of an MD5 hash for the ssl session identifier context.
• twisted.python.failure.Failure.getTracebackObject now returns traceback objects whose frames can be passed into traceback.print_stack for better debugging of where the exception came from.
• Much more! 20+ tickets closed overall.

You can find the downloads at <https://pypi.python.org/pypi/Twisted> (or alternatively <http://twistedmatrix.com/trac/wiki/Downloads>). The NEWS file is also available at <https://github.com/twisted/twisted/blob/twisted-19.2.0/NEWS.rst>.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 18.7.0 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 18.7!

The highlights of this release are:

• better support for async/await coroutines in regards to exception and traceback handling;
• better support for reporting tracebacks in inlineCallbacks, now showing what you would expect in synchronous-like code
• the epoll reactor now no longer hard-locks when running out of file descriptors
• directory rendering in t.web works on Python 2 again
• manhole's colouriser is better at handling Unicode
• setting the groundwork for Python 3.7 support. Note that Python 3.7 is currently not a supported platform on any operating system, and may completely fail to install, especially on Windows.

For more information, check the NEWS file (link provided below).

You can find the downloads at <https://pypi.python.org/pypi/Twisted> (or alternatively <http://twistedmatrix.com/trac/wiki/Downloads>). The NEWS file is also available at <https://github.com/twisted/twisted/blob/twisted-18.7.0/NEWS.rst>.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 18.4.0 Released

On behalf of Twisted Matrix Laboratories, I'm honoured to announce the release of Twisted 18.4.0!

The highlights of the release are:

• The dropping of Python 3.3 support.
• Python 3 fixes (notably to trial -j, asyncioreactor, conch, and mail)
• Python 3 TCP speed improvements (less copying when sending data)
• Better TLS curve selection support for both old and new OpenSSLs
• IPv6 fixes for WSGIResource
• 60+ closed tickets with many fixed bugs!

For more information, check the NEWS file (link provided below).

You can find the downloads at <https://pypi.python.org/pypi/Twisted> (or alternatively <http://twistedmatrix.com/trac/wiki/Downloads>). The NEWS file is also available at <https://github.com/twisted/twisted/blob/twisted-18.4.0/NEWS.rst>.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 17.5.0 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 17.5!

The highlights of this release are:

• twisted.python.url has been spun out into the new 'hyperlink' package; importing twisted.python.url is now a compatibility alias
• Initial support for OpenSSL 1.1.0.
• Fixes around the reactor DNS resolver changes in 17.1, solving all known regressions
• Deferred.asFuture and Deferred.fromFuture, to allow you to map asyncio Futures to Twisted Deferreds and vice versa, for use the with Python 3+ asyncioreactor in Twisted
• Support for TLS 1.3 ciphersuites, in advance of a released OpenSSL to enable the protocol
• Further Python 3 support in twisted.web, initial support in twisted.mail.smtp.

For more information, check the NEWS file (link provided below).

You can find the downloads on PyPI (or alternatively our website). The NEWS file is also available on GitHub.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 17.1.0 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 17.1!

The highlights of this release are:

• twisted.web.client.Agent now supports IPv6! It's also now the primary web client in Twisted, with twisted.web.client.getPage being deprecated in favour of it and Treq.
• twisted.web.server has had many cleanups revolving around timing out inactive clients.
• twisted.internet.ssl.CertificateOptions has had its method argument deprecated, in favour of the new raiseMinimumTo, lowerMaximumSecurityTo, and insecurelyLowerMinimumTo arguments, which take TLSVersion arguments. This allows you to better give a range of versions of TLS you wish to negotiate, rather than forcing yourself to any one version.
• twisted.internet.ssl.CertificateOptions will use OpenSSL's MODE_RELEASE_BUFFERS, which will let it free unused memory that was held by idle TLS connections.
• You can now call the new twist runner with python -m twisted.
• twisted.conch.ssh now has some ECDH key exchange support and supports hmac-sha2-384.
• Better Unicode support in twisted.internet.reactor.spawnProcess, especially on Windows on Python 3.6.
• More Python 3 porting in Conch, and more under-the-hood changes to facilitate a Twisted-wide jump to new-style classes only on Python 2 in 2018/2019. This release has also been tested on Python 3.6 on Linux.
• Lots of deprecated code removals, to make a sleeker, less confusing Twisted.
• 60+ closed tickets.

For more information, check the NEWS file (link provided below).

You can find the downloads on PyPI (or alternatively our website). The NEWS file is also available on GitHub.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 16.6.0 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.6!

The highlights of this release are:

• The ability to use "python -m twisted" to call the new twist runner,
• More reliable tests from a more reliable implementation of some things, like IOCP,
• Fixes for async/await & twisted.internet.defer.ensureDeferred, meaning it's getting closer to prime time!
• ECDSA support in Conch & ckeygen (which has also been ported to Python 3),
• Python 3 support for Words' IRC support and twisted.protocols.sip among some smaller modules,
• Some HTTP/2 server optimisations,
• and a few bugfixes to boot!

For more information, check the NEWS file (link provided below).

You can find the downloads on PyPI (or alternatively our website). The NEWS file is also available on GitHub.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 16.5.0 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.5!

The highlights of this release are:

• Deferred.addTimeout, for timing out your Deferreds! (contributed by cyli, reviews by adiroiban, theisencouple, manishtomar, markrwilliams)
• yield from support for Deferreds, in functions wrapped with twisted.internet.defer.ensureDeferred. This will work in Python 3.4, unlike async/await which is 3.5+ (contributed by hawkowl, reviews by markrwilliams, lukasa).
• The new asyncio interop reactor, which allows Twisted to run on top of the asyncio event loop. This doesn't include any Deferred-Future interop, but stay tuned! (contributed by itamar and hawkowl, reviews by rodrigc, markrwilliams)
• twisted.internet.cfreactor is now supported on Python 2.7 and Python 3.5+! This is useful for writing pyobjc or Toga applications. (contributed by hawkowl, reviews by glyph, markrwilliams)
• twisted.python.constants has been split out into constantly on PyPI, and likewise with twisted.python.versions going into the PyPI package incremental. Twisted now uses these external packages, which will be shared with other projects (like Klein). (contributed by hawkowl, reviews by glyph, markrwilliams)
• Many new Python 3 modules, including twisted.pair, twisted.python.zippath, twisted.spread.pb, and more parts of Conch! (contributed by rodrigc, hawkowl, glyph, berdario, & others, reviews by acabhishek942, rodrigc, & others)
• Many bug fixes and cleanups!
• 260+ closed tickets overall.

For more information, check the NEWS file (link provided below).

You can find the downloads on PyPI (or alternatively our website). The NEWS file is also available on GitHub.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

PS: I wrote a blog post about Twisted's progress in 2016! https://atleastfornow.net/blog/marching-ever-forward/

Twisted 16.4.0 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.4.0.

The highlights of this release are:

• twist, a new command line tool for running Twisted plugins, similar to twistd but with a simpler, cleaner interface.
• A new interface for Protocols, IHandshakeListener, which tells Twisted to tell the Protocol when the TLS handshake has been completed.
• async/await support for Deferreds, allowing you to write Python 3.5+ coroutines using Twisted
• Trial can be invoked with "python -m twisted.trial".
• All Twisted executables (trial, twistd, etc) are now Setuptools console scripts, meaning they will work much better on Windows.
• 35+ more modules ported to Python 3, and many many cleanups on the way to Python 3 on Windows support.
• All the security fixes of Twisted 16.3.1 + 16.3.2 (httpoxy, HTTP session identifier strengthening, HTTP+TLS consuming sockets)
• 240+ closed tickets overall.

For more information, check the NEWS file (link provided below).

You can find the downloads on PyPI (or alternatively our website). The NEWS file is also available on GitHub.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

PS: Twisted 16.4.1 will be coming soon after this with a patch mitigating SWEET32, by updating the acceptable cipher list.

Twisted 16.3.2 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.3.2.

This is a bug fix & security fix release, and is recommended for all users of Twisted. The fixes are:

• A bugfix for a HTTP/2 edge case, (included in 16.3.1)
• Fix for CVE-2008-7317 (generating potentially guessable HTTP session identifiers) (included in 16.3.1)
• Fix for CVE-2008-7318 (sending secure session cookies over insecured connections) (included in 16.3.1)
• Fix for CVE-2016-1000111 (http://httpoxy.org/) (included in 16.3.1)
• Twisted's HTTP server, when operating over TLS, would not cleanly close sockets, causing it to build up CLOSE_WAIT sockets until it would eventually run out of file descriptors.

For more information, check the NEWS file (link provided below).

You can find the downloads on PyPI (or alternatively our website). The NEWS file is also available at on GitHub.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 16.3 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.3.0.

The highlights of this release are:

• The Git migration has happened, so we've updated our development documentation to match. We're now trialling accepting pull requests at github.com/twisted/twisted, so if you've ever wanted an excuse to contribute, now's the chance!
• In our steady shedding of baggage, twisted.spread.ui, twisted.manhole (not to be confused with twisted.conch.manhole!), and a bunch of old and deprecated stuff from twisted.python.reflect and twisted.protocols.sip have been removed.
• twisted.web's HTTP server now handles pipelined requests better -- it used to try and process them in parallel, but this was fraught with problems and now it processes them in series, which is less surprising to code that expects the Request's transport to not be buffered (e.g. WebSockets). There is also a bugfix for HTTP timeouts not working in 16.2.
• Twisted now has HTTP/2 support in its web server! This is currently not available by default -- you will need to install hyper-h2, which is available in the [h2] setuptools extras. If you want to play around with it "pip install twisted[h2]" (on Python 2, a bugfix release will make it available on Python 3) .
• 53 tickets closed overall, including cleanups that move us closer to a total Python 3 port.

For more information, check the NEWS file (link provided below).

You can find the downloads on PyPI (or alternatively our website). The NEWS file is also available on GitHub.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 16.2 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.2!

Just in time for PyCon US, this release brings a few headlining features (like the haproxy endpoint) and the continuation of the modernisation of the codebase. More Python 3, less deprecated code, what's not to like?

• twisted.protocols.haproxy.proxyEndpoint, a wrapper endpoint that gives some extra information to the wrapped protocols passed by haproxy;
• Migration of twistd and other twisted.application.app users to the new logging system (twisted.logger);
• Porting of parts of Twisted Names' server to Python 3;
• The removal of the very old MSN client code and the deprecation of the unmaintained ICQ/OSCAR client code;
• More cleanups in Conch in preparation for a Python 3 port and cleanups in HTTP code in preparation for HTTP/2 support;
• Over thirty tickets overall closed since 16.1.

For more information, check the NEWS file (link provided below).

You can find the downloads on PyPI (or alternatively our website). The NEWS file is also available on GitHub.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)

Twisted 16.1 Released

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.1!

This release is hot off the heels of 16.0 released last month, including some nice little tidbits. The highlights include:

• twisted.application.internet.ClientService, a service that maintains a persistent outgoing endpoint-based connection -- a replacement for ReconnectingClientFactory that uses modern APIs;
• A large (77% on one benchmark) performance improvement when using twisted.web's client on PyPy;
• A few conch modules have been ported to Python 3, in preparation for further porting of the SSH functionality;
• Full support for OpenSSL 1.0.2f and above;
• t.web.http.Request.addCookie now accepts Unicode and bytes keys/values;
• twistd manhole no longer uses a hard-coded SSH host key, and will generate one for you on the fly (this adds a 'appdirs' PyPI dependency, installing with [conch] will add it automatically);
• Over eighteen tickets overall closed since 16.0.

For more information, check the NEWS file (link provided below).

You can find the downloads on PyPI (or alternatively our website). The NEWS file is also available on GitHub.

Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted!

Twisted Regards,
Amber Brown (HawkOwl)