Gevent

Latest version: v24.2.1

Safety actively analyzes 630094 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 2 of 4

1.1rc3

Not secure
- Support the new PEP 466 ssl interfaces on any Python 2 version that supplies them, not just on the versions it officially shipped with. Some Linux distributions, including RedHat/CentOS and Amazon have backported the changes to older versions. Reported in issue 702.
- PyPy: An interaction between Cython compiled code and the garbage collector caused PyPy to crash when a previously-allocated Semaphore was used in a **del** method, something done in the popular libraries requests and urllib3. Due to this and other Cython related issues, the Semaphore class is no longer compiled by Cython. This means that it is now traceable and not exactly as atomic as the Cython version, though the overall semantics should remain the same. Reported in issue 704 by Shaun Crampton.
- PyPy: Optimize the CFFI backend to use less memory (two pointers per watcher).
- Python 3: The WSGI PATH_INFO entry is decoded from URL escapes using latin-1, not UTF-8. This improves compliance with PEP 333 and compatibility with some frameworks like Django. Fixed in pull request 712 by Ruben De Visscher.

1.1rc2

Not secure
- Exceptions raised by gevent’s SSL sockets are more consistent with the standard library (e.g., gevent’s Python 3 SSL sockets raise socket.timeout instead of ssl.SSLError, a change introduced in Python 3.2).
- Python 2: gevent’s socket’s sendall method could completely ignore timeouts in some cases. The timeout now refers to the total time taken by sendall.
- gevent’s SSL socket’s sendall method should no longer raise SSL3_WRITE_PENDING in rare cases when sending large buffers. Reported in issue 317.
- gevent.signal now allows resetting (SIG_DFL) and ignoring (SIG_IGN) the SIGCHLD signal at the process level (although this may allow race conditions with libev child watchers). Reported in issue 696 by Adam Ning.
- gevent.spawn_raw() now accepts keyword arguments, as previously (incorrectly) documented. Reported in issue 680 by Ron Rothman.
- PyPy: PyPy 2.6.1 or later is now required (4.0.1 or later is recommended).
- The CFFI backend is now built and usable on CPython implementations (except on Windows) if cffi is installed before gevent is installed. To use the CFFI backend, set the environment variable GEVENT_CORE_CFFI_ONLY before starting Python. This can aid debugging in some cases and helps ensure parity across all combinations of supported platforms.
- The CFFI backend now calls the callback of a watcher whose args attribute is set to None, just like the Cython backend does. It also only allows args to be a tuple or None, again matching the Cython backend.
- PyPy/CFFI: Fix a potential crash when using stat watchers.
- PyPy/CFFI: Encode unicode paths for stat watchers using sys.getfilesystemencoding() like the Cython backend.
- The internal implementation modules gevent._fileobject2, gevent._fileobject3, and gevent._util were removed. These haven’t been used or tested since 1.1b1.

1.1rc1

Not secure
- Windows/Python 3: Finish porting the gevent.subprocess module, fixing a large number of failing tests. Examples of failures are in issue 668 and issue 669 reported by srossross.
- Python 3: The SSLSocket class should return an empty bytes object on an EOF instead of a str. Fixed in pull request 674 by Dahoon Kim.
- Python 2: Workaround a buffering bug in the stdlib io module that caused FileObjectPosix to be slower than necessary in some cases. Reported in issue 675 by WGH-.
- PyPy: Fix a crash. Reported in issue 676 by Jay Oster.
Caution There are some remaining, relatively rare, PyPy crashes, but their ultimate cause is unknown (gevent, CFFI, greenlet, the PyPy GC?). PyPy users can contribute to issue 677 to help track them down.
PyPy: Exceptions raised while handling an error raised by a loop callback function behave like the CPython implementation: the exception is printed, and the rest of the callbacks continue processing.
- If a Hub object with active watchers was destroyed and then another one created for the same thread, which itself was then destroyed with destroy_loop=True, the process could crash. Documented in issue 237 and fix based on pull request 238, both by Jan-Philip Gehrcke.
- Python 3: Initializing gevent’s hub for the first time in a native background thread created during import could fail with AttributeError and ImportError. Reported in issue 687 by Gregory Petukhov.

1.1b6

Not secure
- PyPy: Fix a memory leak for code that allocated and disposed of many
:class:`gevent.lock.Semaphore` subclasses. If monkey-patched, this could
also apply to :class:`threading.Semaphore` objects. Reported in
:issue:`660` by Jay Oster.
- PyPy: Cython version 0.23.4 or later must be used to avoid a memory
leak (`details`_). Thanks to Jay Oster.
- Allow subclasses of :class:`~.WSGIHandler` to handle invalid HTTP client
requests. Reported by not-bob.
- :class:`~.WSGIServer` more robustly supports :class:`~logging.Logger`-like parameters for
`log` and `error_log` (as introduced in 1.1b1, this could cause
integration issues with gunicorn). Reported in :issue:`663` by Jay
Oster.
- :class:`~gevent.threading._DummyThread` objects, created in a
monkey-patched system when :func:`threading.current_thread` is
called in a new greenlet (which often happens implicitly, such as
when logging) are much lighter weight. For example, they no longer
allocate and then delete a :class:`~gevent.lock.Semaphore`, which is
especially important for PyPy.
- Request logging by :mod:`gevent.pywsgi` formats the status code
correctly on Python 3. Reported in :issue:`664` by Kevin Chen.
- Restore the ability to take a weak reference to instances of exactly
:class:`gevent.lock.Semaphore`, which was unintentionally removed
as part of making `Semaphore` atomic on PyPy on 1.1b1. Reported in
:issue:`666` by Ivan-Zhu.
- Build Windows wheels for Python 3.5. Reported in :pr:`665` by Hexchain Tong.

1.1b5

Not secure
- gevent.subprocess works under Python 3.5. In general, Python 3.5 has preliminary support. Reported in issue 653 by Squeaky.
- gevent.subprocess.Popen.communicate honors a timeout argument even if there is no way to communicate with the child process (none of stdin, stdout and stderr were set to PIPE). Noticed as part of the Python 3.5 test suite for the new function subprocess.run but impacts all versions (timeout is an official argument under Python 3 and a gevent extension with slightly different semantics under Python 2).
- Fix a possible ValueError from gevent.queue.Queue:peek. Reported in issue 647 by Kevin Chen.
- Restore backwards compatibility for using gevent.signal as a callable, which, depending on the order of imports, could be broken after the addition of the gevent.signal module. Reported in issue 648 by Sylvain Zimmer.
- gevent blocking operations performed at the top-level of a module after the system was monkey-patched under Python 2 could result in raising a LoopExit instead of completing the expected blocking operation. Note that performing gevent blocking operations in the top-level of a module is typically not recommended, but this situation can arise when monkey-patching existing scripts. Reported in issue 651 and issue 652 by Mike Kaplinskiy.
- SIGCHLD and waitpid now work for the pids returned by the (monkey-patched) os.forkpty and pty.fork functions in the same way they do for the os.fork function. Reported in issue 650 by Erich Heine.
- gevent.pywsgi.WSGIServer (WSGIHandler) does a better job detecting and reporting potential encoding errors for headers and the status line during start_response as recommended by the WSGI specification. In addition, under Python 2, unnecessary encodings and decodings (often a trip through the ASCII encoding) are avoided for conforming applications. This is an enhancement of an already documented and partially enforced constraint: beginning in 1.1a1, under Python 2, u'abc' would typically previously have been allowed, but u'\u1f4a3' would not; now, neither will be allowed, more closely matching the specification, improving debugability and performance and allowing for better error handling both by the application and by gevent (previously, certain encoding errors could result in gevent writing invalid/malformed HTTP responses). Reported by Greg Higgins and Carlos Sanchez.
- Code coverage by tests is now reported on coveralls.io.

1.1b4

Not secure
- Detect and raise an error for several important types of
programming errors even if Python interpreter optimizations are
enabled with `-O` or `PYTHONOPTIMIZE`. Previously these would go
undetected if optimizations were enabled, potentially leading to
erratic, difficult to debug behaviour.
- Fix an `AttributeError` from `gevent.queue.Queue` when `peek`
was called on an empty `Queue`. Reported in 643 by michaelvol.
- Make `SIGCHLD` handlers specified to `signal.signal` work with
the child watchers that are used by default. Also make
`os.waitpid` work with a first argument of -1. Noted by users of gunicorn.
- Under Python 2, any timeout set on a socket would be ignored when
using the results of `socket.makefile`. Reported in 644
by Karan Lyons.

Page 2 of 4

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.