Supervisor

------------------

- Fixed an issue where ``supervisord`` could hang when responding to HTTP
requests (including ``supervisorctl`` commands) if the system time was set
back after ``supervisord`` was started.

- Zope ``trackrefs``, a debugging tool that was included in the ``tests``
directory but hadn't been used for years, has been removed.

------------------

- ``supervisord`` will now use ``kqueue``, ``poll``, or ``select`` to monitor
its file descriptors, in that order, depending on what is available on the
system. Previous versions used ``select`` only and would crash with the error
``ValueError: filedescriptor out of range in select()`` when running a large
number of subprocesses (whatever number resulted in enough file descriptors
to exceed the fixed-size file descriptor table used by ``select``, which is
typically 1024). Patch by Igor Sobreira.

- ``/etc/supervisor/supervisord.conf`` has been added to the config file search
paths. Many versions of Supervisor packaged for Debian and Ubuntu have
included a patch that added this path. This difference was reported in a
number of tickets as a source of confusion and upgrade difficulties, so the
path has been added. Patch by Kelvin Wong.

- Glob patterns in the ``[include]`` section now support the
``host_node_name`` expansion. Patch by Paul Lockaby.

- Files included via the ``[include]`` section are now logged at the ``INFO``
level instead of ``WARN``. Patch by Daniel Hahler.

------------------

- Backported from Supervisor 3.3.3: Fixed CVE-2017-11610. A vulnerability
was found where an authenticated client can send a malicious XML-RPC request
to ``supervisord`` that will run arbitrary shell commands on the server.
The commands will be run as the same user as ``supervisord``. Depending on
how ``supervisord`` has been configured, this may be root. See
https://github.com/Supervisor/supervisor/issues/964 for details.

------------------

- 400 Bad Request is now returned if an XML-RPC request is received with
invalid body data. In previous versions, 500 Internal Server Error
was returned.

------------------

- Parsing the config file will now fail with an error message if an
``inet_http_server`` or ``unix_http_server`` section contains a ``username=``
but no ``password=``. In previous versions, ``supervisord`` would start with
this invalid configuration but the HTTP server would always return a 500
Internal Server Error. Thanks to Chris Ergatides for reporting this issue.

------------------

- Fixed a server exception ``OverflowError: int exceeds XML-RPC limits`` that
made ``supervisorctl status`` unusable if the system time was far into the
future. The XML-RPC API returns timestamps as XML-RPC integers, but
timestamps will exceed the maximum value of an XML-RPC integer in January
2038 ("Year 2038 Problem"). For now, timestamps exceeding the maximum
integer will be capped at the maximum to avoid the exception and retain
compatibility with existing API clients. In a future version of the API,
the return type for timestamps will be changed.