Update idna from 3.11 to 3.15 (GHSA-65pc-fj4g-8rjx / CVE-2026-45409)

Pipfile

@@ -5,6 +5,7 @@ name = "pypi"
 
 [packages]
 requests = "*"
+idna = "<3.16,>=3.15"
 
 [dev-packages]
 

vendor/idna/__init__.py

@@ -1,4 +1,3 @@
-from .package_data import __version__
 from .core import (
     IDNABidiError,
     IDNAError,
@@ -20,8 +19,10 @@
     valid_string_length,
 )
 from .intranges import intranges_contain
+from .package_data import __version__
 
 __all__ = [
+    "__version__",
     "IDNABidiError",
     "IDNAError",
     "InvalidCodepoint",

vendor/idna/codec.py

@@ -1,49 +1,69 @@
-from .core import encode, decode, alabel, ulabel, IDNAError
 import codecs
-import re
-from typing import Tuple, Optional
+from typing import Any, Optional, Tuple
+
+from .core import IDNAError, _unicode_dots_re, alabel, decode, encode, ulabel
 
-_unicode_dots_re = re.compile('[\u002e\u3002\uff0e\uff61]')
 
 class Codec(codecs.Codec):
+    """Stateless IDNA 2008 codec.
+
+    Implements the :class:`codecs.Codec` protocol so that the whole-domain
+    encoder (:func:`idna.encode`) and decoder (:func:`idna.decode`) are
+    accessible through the standard codec machinery as ``"idna2008"``.
+
+    Only the ``"strict"`` error handler is supported; any other handler
+    raises :exc:`~idna.IDNAError`.
+    """
 
-    def encode(self, data: str, errors: str = 'strict') -> Tuple[bytes, int]:
-        if errors != 'strict':
-            raise IDNAError('Unsupported error handling \"{}\"'.format(errors))
+    def encode(self, data: str, errors: str = "strict") -> Tuple[bytes, int]:  # ty: ignore[invalid-method-override]
+        if errors != "strict":
+            raise IDNAError(f'Unsupported error handling "{errors}"')
 
         if not data:
             return b"", 0
 
         return encode(data), len(data)
 
-    def decode(self, data: bytes, errors: str = 'strict') -> Tuple[str, int]:
-        if errors != 'strict':
-            raise IDNAError('Unsupported error handling \"{}\"'.format(errors))
+    def decode(self, data: bytes, errors: str = "strict") -> Tuple[str, int]:  # ty: ignore[invalid-method-override]
+        if errors != "strict":
+            raise IDNAError(f'Unsupported error handling "{errors}"')
 
         if not data:
-            return '', 0
+            return "", 0
 
         return decode(data), len(data)
 
+
 class IncrementalEncoder(codecs.BufferedIncrementalEncoder):
-    def _buffer_encode(self, data: str, errors: str, final: bool) -> Tuple[str, int]:  # type: ignore
-        if errors != 'strict':
-            raise IDNAError('Unsupported error handling \"{}\"'.format(errors))
+    """Incremental IDNA 2008 encoder.
+
+    Buffers a partial trailing label across calls until either the next
+    label separator is seen or ``final=True``, so that streamed input is
+    encoded one whole label at a time. Any of the four Unicode label
+    separators (``U+002E``, ``U+3002``, ``U+FF0E``, ``U+FF61``) ends a
+    label; the result always uses ``U+002E`` as the separator.
+
+    Only the ``"strict"`` error handler is supported.
+    """
+
+    def _buffer_encode(self, data: str, errors: str, final: bool) -> Tuple[bytes, int]:  # ty: ignore[invalid-method-override]
+        if errors != "strict":
+            raise IDNAError(f'Unsupported error handling "{errors}"')
 
         if not data:
-            return "", 0
+            return b"", 0
 
         labels = _unicode_dots_re.split(data)
-        trailing_dot = ''
+        trailing_dot = b""
         if labels:
             if not labels[-1]:
-                trailing_dot = '.'
+                trailing_dot = b"."
                 del labels[-1]
             elif not final:
                 # Keep potentially unfinished label until the next call
                 del labels[-1]
                 if labels:
-                    trailing_dot = '.'
+                    trailing_dot = b"."
 
         result = []
         size = 0
@@ -54,29 +74,42 @@ def _buffer_encode(self, data: str, errors: str, final: bool) -> Tuple[str, int]
             size += len(label)
 
         # Join with U+002E
-        result_str = '.'.join(result) + trailing_dot  # type: ignore
+        result_bytes = b".".join(result) + trailing_dot
         size += len(trailing_dot)
-        return result_str, size
+        return result_bytes, size
+
 
 class IncrementalDecoder(codecs.BufferedIncrementalDecoder):
-    def _buffer_decode(self, data: str, errors: str, final: bool) -> Tuple[str, int]:  # type: ignore
-        if errors != 'strict':
-            raise IDNAError('Unsupported error handling \"{}\"'.format(errors))
+    """Incremental IDNA 2008 decoder.
+
+    Buffers a partial trailing label across calls until either the next
+    label separator is seen or ``final=True``, so that streamed input is
+    decoded one whole label at a time.
+
+    Only the ``"strict"`` error handler is supported.
+    """
+
+    def _buffer_decode(self, data: Any, errors: str, final: bool) -> Tuple[str, int]:  # ty: ignore[invalid-method-override]
+        if errors != "strict":
+            raise IDNAError(f'Unsupported error handling "{errors}"')
 
         if not data:
-            return ('', 0)
+            return ("", 0)
+
+        if not isinstance(data, str):
+            data = str(data, "ascii")
 
         labels = _unicode_dots_re.split(data)
-        trailing_dot = ''
+        trailing_dot = ""
         if labels:
             if not labels[-1]:
-                trailing_dot = '.'
+                trailing_dot = "."
                 del labels[-1]
             elif not final:
                 # Keep potentially unfinished label until the next call
                 del labels[-1]
                 if labels:
-                    trailing_dot = '.'
+                    trailing_dot = "."
 
         result = []
         size = 0
@@ -86,7 +119,7 @@ def _buffer_decode(self, data: str, errors: str, final: bool) -> Tuple[str, int]
                 size += 1
             size += len(label)
 
-        result_str = '.'.join(result) + trailing_dot
+        result_str = ".".join(result) + trailing_dot
         size += len(trailing_dot)
         return (result_str, size)
 
@@ -99,14 +132,28 @@ class StreamReader(Codec, codecs.StreamReader):
     pass
 
 
-def getregentry() -> codecs.CodecInfo:
-    # Compatibility as a search_function for codecs.register()
+def search_function(name: str) -> Optional[codecs.CodecInfo]:
+    """Codec search function registered with :mod:`codecs`.
+
+    Returns a :class:`codecs.CodecInfo` for the ``"idna2008"`` codec name
+    so that ``str.encode("idna2008")`` and ``bytes.decode("idna2008")``
+    invoke the IDNA 2008 codec defined in this module.
+
+    :param name: The codec name being looked up.
+    :returns: A :class:`codecs.CodecInfo` instance if ``name`` is
+        ``"idna2008"``, otherwise ``None``.
+    """
+    if name != "idna2008":
+        return None
     return codecs.CodecInfo(
-        name='idna',
-        encode=Codec().encode,  # type: ignore
+        name=name,
+        encode=Codec().encode,
         decode=Codec().decode,  # type: ignore
         incrementalencoder=IncrementalEncoder,
         incrementaldecoder=IncrementalDecoder,
         streamwriter=StreamWriter,
         streamreader=StreamReader,
     )
+
+
+codecs.register(search_function)

vendor/idna/compat.py

@@ -1,13 +1,41 @@
-from .core import *
-from .codec import *
 from typing import Any, Union
 
+from .core import decode, encode
+
+
 def ToASCII(label: str) -> bytes:
+    """Compatibility shim for :rfc:`3490` ``ToASCII``.
+
+    Delegates to :func:`idna.encode` (IDNA 2008). Provided to ease porting
+    of code written against the legacy :mod:`encodings.idna` API; new code
+    should call :func:`idna.encode` directly.
+
+    :param label: The label or domain to encode.
+    :returns: The encoded form as ASCII :class:`bytes`.
+    """
     return encode(label)
 
+
 def ToUnicode(label: Union[bytes, bytearray]) -> str:
+    """Compatibility shim for :rfc:`3490` ``ToUnicode``.
+
+    Delegates to :func:`idna.decode` (IDNA 2008). Provided to ease porting
+    of code written against the legacy :mod:`encodings.idna` API; new code
+    should call :func:`idna.decode` directly.
+
+    :param label: The label or domain to decode.
+    :returns: The decoded Unicode form.
+    """
     return decode(label)
 
+
 def nameprep(s: Any) -> None:
-    raise NotImplementedError('IDNA 2008 does not utilise nameprep protocol')
+    """Stub for :rfc:`3491` Nameprep, which is not used by IDNA 2008.
+
+    IDNA 2008 (:rfc:`5891`) replaces Nameprep with the per-codepoint
+    validity classes from :rfc:`5892`; this function exists only to
+    return a clear error if legacy code attempts to call it.
 
+    :raises NotImplementedError: Always.
+    """
+    raise NotImplementedError("IDNA 2008 does not utilise nameprep protocol")