Update django-anymail to 2.0

[pyup-bot]

This PR updates django-anymail from 0.6.1 to 2.0.

Changelog

2.0

Important updates
* **Breaking change:** Drop support for deprecated WEBHOOK_AUTHORIZATION setting. If you are using webhooks and still have this Anymail setting, you must rename it to WEBHOOK_SECRET. See the [v1.4 release notes](https://github.com/anymail/django-anymail/releases/tag/v1.4).

New features
* **SendinBlue:** Add new ESP ([docs](http://anymail.readthedocs.io/en/v2.0/esps/sendinblue/)). Thanks to RignonNoel for the implementation.
* Add EmailMessage `envelope_sender` attribute, which can adjust the message's Return-Path if supported by your ESP ([docs](http://anymail.readthedocs.io/en/v2.0/sending/anymail_additions/anymail.message.AnymailMessage.envelope_sender)).
* Add universal wheel to PyPI releases for faster installation.

Other changes
* Handle Reply-To, From, and To in EmailMessage `extra_headers` the same as Django's SMTP EmailBackend if supported by your ESP, otherwise raise an unsupported feature error. Fixes the SparkPost backend to be consistent with other backends if both `headers["Reply-To"]` and `reply_to` are set on the same message. If you are setting a message's `headers["From"]` or `headers["To"]` (neither is common), the new behavior is likely a **breaking change.** See [docs](http://anymail.readthedocs.io/en/v2.0/sending/django_email/additional-headers) and 91.
* Treat EmailMessage `extra_headers` keys as case-*insensitive* in all backends, for consistency with each other (and email specs). If you are specifying duplicate headers whose names differ only in case, this may be a **breaking change.** See [docs](http://anymail.readthedocs.io/en/v2.0/sending/django_email/additional-headers).
* Update setup.py metadata, clean up implementation. (Hadn't really been touched since original Djrill version.)
* Prep for Python 3.7.

1.4

**Security fix** 

This fixes a low severity security issue affecting Anymail v0.2–v1.3. ([CVE-2018-1000089](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000089))

Django error reporting includes the value of your Anymail WEBHOOK_AUTHORIZATION setting. In a properly-configured deployment, this should not be cause for concern. But if you have somehow exposed your Django error reports (e.g., by mis-deploying with DEBUG=True or by sending error reports through insecure channels), anyone who gains access to those reports could discover your webhook shared secret. An attacker could use this to post fabricated or malicious Anymail tracking/inbound events to your app, if you are using those Anymail features.

The fix renames Anymail's webhook shared secret setting so that Django's error reporting mechanism will [sanitize][0] it.

If you are using Anymail's event tracking and/or inbound webhooks, you should upgrade to this release and change "WEBHOOK_AUTHORIZATION" to "WEBHOOK_SECRET" in the ANYMAIL section of your settings.py. You may also want to [rotate the shared secret][1] value, particularly if you have ever exposed your Django error reports to untrusted individuals.

If you are only using Anymail's EmailBackends for sending email and have not set up Anymail's webhooks, this issue does not affect you.

The old WEBHOOK_AUTHORIZATION setting is still allowed in this release, but will issue a system-check warning when running most Django management commands. It will be removed completely in a near-future release, as a breaking change.

Thanks to Charlie DeTar (yourcelf) for responsibly reporting this security issue through private channels. 

[0]: https://docs.djangoproject.com/en/stable/ref/settings/debug
[1]: https://anymail.readthedocs.io/en/stable/tips/securing_webhooks/use-a-shared-authorization-secret

1.3

Security fix

v1.3 includes the v1.2.1 security fix released at the same time. Please review the [v1.2.1 release notes](https://github.com/anymail/django-anymail/releases/tag/v1.2.1), below, if you are using Anymail's tracking webhooks.

New features

* **Inbound handling:** Add normalized inbound message event, signal, and webhooks for all supported ESPs. (See new [*Receiving mail*](http://anymail.readthedocs.io/en/stable/inbound/) docs.) This hasn't been through much real-world testing yet; bug reports and feedback are very welcome.
* **API network timeouts:** For Requests-based backends (all but SparkPost), use a default timeout of 30 seconds for all ESP API calls, to avoid stalling forever on a bad connection. Add a REQUESTS_TIMEOUT Anymail setting to override. (See 80.)
* **Test backend improvements:** Generate unique tracking `message_id` when using the [test backend](https://anymail.readthedocs.io/en/stable/tips/test_backend/); add console backend for use in development. (See 85.)

1.2.1

Security fix

This release fixes a moderate severity security issue affecting Anymail v0.2–v1.2:
Prevent timing attack on WEBHOOK_AUTHORIZATION secret ([CVE-2018-6596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6596))

If you are using Anymail's tracking webhooks, you should upgrade to this release, and you may want to rotate to a new WEBHOOK_AUTHORIZATION shared secret (see [docs](http://anymail.readthedocs.io/en/stable/tips/securing_webhooks/use-a-shared-authorization-secret)). You should definitely change your webhook auth if your logs indicate attempted exploit.

(If you are only sending email using an Anymail EmailBackend, and have not set up Anymail's event tracking webhooks, this issue does not affect you.)

*More information*

Anymail's webhook validation was vulnerable to a timing attack. A remote attacker could use this to obtain your WEBHOOK_AUTHORIZATION shared secret, potentially allowing them to post fabricated or malicious email tracking events to your app.

There have not been any reports of attempted exploit. (The vulnerability was discovered through code review.) Attempts would be visible in HTTP logs as a very large number of 400 responses on Anymail's webhook urls (by default "/anymail/*esp_name*/tracking/"), and in Python error monitoring as a very large number of AnymailWebhookValidationFailure exceptions.

1.2

New features

* **Postmark:** Support new click webhook in normalized tracking events

1.1

Bug fixes

* **Mailgun:** Support metadata in opened/clicked/unsubscribed tracking webhooks, and fix potential problems if metadata keys collided with Mailgun event parameter names. (See 76, 77)

Other changes

* **Internal:** Rework Anymail's ParsedEmail class and rename to EmailAddress to align it with similar  functionality in the Python 3.6 email package, in preparation for future inbound support. ParsedEmail was not documented for use outside Anymail's internals (so this change does not bump the semver major version), but if you were using it in an undocumented way you will need to update your code.

1.0

It's official: Anymail is no longer "pre-1.0." The API has been stable for many months, and there's no reason not to use Anymail in production.

Breaking changes

- There are no *new* breaking changes in the 1.0 release, but a breaking change introduced several months ago in v0.8 is now strictly enforced. If you still have an EMAIL_BACKEND setting that looks like "anymail.backends.*espname*.*EspName*Backend", you'll need to change it to just "anymail.backends.*espname*.EmailBackend". (Earlier versions had issued a DeprecationWarning. See the [v0.8 release notes](https://github.com/anymail/django-anymail/releases/tag/v0.8).)

New features and other changes

- Clean up and document Anymail's [Test EmailBackend](http://anymail.readthedocs.io/en/v1.0/tips/test_backend/)
- Add notes on [handling transient ESP errors](http://anymail.readthedocs.io/en/v1.0/tips/transient_errors/) and improving [batch send performance](http://anymail.readthedocs.io/en/v1.0/tips/performance/)
- **SendGrid:** handle Python 2 `long` integers in metadata and extra headers

1.0.rc0

Breaking changes

- **All backends:** The old *EspName*Backend names that were deprecated in v0.8 have been removed. Attempting to use the old names will now fail, rather than issue a DeprecationWarning. See the [v0.8 release notes](https://github.com/anymail/django-anymail/releases/tag/v0.8).

New features

- Anymail's Test EmailBackend is now [documented](http://anymail.readthedocs.io/en/latest/tips/test_backend/) (and cleaned up)

0.11.1

* **Mailjet:** Correct settings docs.

0.11

New features
* New ESP: **Mailjet**. Thanks to Lekensteyn and calvin. ([Docs](http://anymail.readthedocs.io/en/stable/esps/mailjet/))

Other changes
* In webhook handlers, AnymailTrackingEvent.metadata now defaults to `{}`, and .tags defaults to `[]`, if the ESP does not supply these fields with the event. (See 67.)

0.10

New features

* **Mailgun, SparkPost:** Support multiple from addresses, as a comma-separated `from_email` string. (*Not* a list of strings, like the recipient fields.) RFC-5322 allows multiple from email addresses, and these two ESPs support it. Though as a practical matter, multiple from emails are either ignored or treated as a spam signal by receiving mail handlers. (See 60.)

Other changes

* Fix crash sending forwarded email messages as attachments. (See 59.)
* **Mailgun:** Fix webhook crash on bounces from some receiving mail handlers. (See 62.)
* Improve recipient-parsing error messages and consistency with Django's SMTP backend. In particular, Django (and now Anymail) allows multiple, comma-separated email addresses in a single recipient string.

0.9

Breaking changes
- **Mandrill, Postmark:** Normalize soft-bounce webhook events to event_type 'bounced' (rather than 'deferred').

Other changes
- Officially support released Django 1.11, including under Python 3.6.

0.8

Breaking changes
- **All backends:** Rename all Anymail backends to just `EmailBackend`, matching Django's naming convention. E.g., you should update: 
`EMAIL_BACKEND = "anymail.backends.mailgun.MailgunBackend"   old` 
to:
 `EMAIL_BACKEND = "anymail.backends.mailgun.EmailBackend"   new`

The old names still work, but will issue a DeprecationWarning and will be removed in some future release (Apologies for this change; the old naming was a holdover from Djrill, and I wanted to establish consistency with other Django EmailBackends before Anymail 1.0. See 49.)
- **SendGrid:** Update SendGrid backend to their newer Web API v3. This should be a transparent change for most projects. Exceptions: if you use SendGrid username/password auth, Anymail's `esp_extra` with "x-smtpapi", or multiple Reply-To addresses, please review the [porting notes](http://anymail.readthedocs.io/en/v0.8/esps/sendgrid/sendgrid-v3-upgrade).

The SendGrid v2 EmailBackend [remains available](http://anymail.readthedocs.io/en/v0.8/esps/sendgrid/sendgrid-v2-backend) if you prefer it, but is no longer the default.

Other changes
- **Mandrill:** Fix bug in webhook signature validation when using basic auth via the WEBHOOK_AUTHORIZATION setting. (If you were using the MANDRILL_WEBHOOK_URL setting to work around this problem, you should be able to remove it. See 48.)
- Test on Django 1.11 prerelease, including under Python 3.6.

0.7

New features
- **Postmark:** Support Postmark's new message delivery event in Anymail normalized tracking webhook. (Update your Postmark config to enable the new event. See [docs](http://anymail.readthedocs.io/en/v0.7/esps/postmark/status-tracking-webhooks).)
- Handle virtually all uses of Django lazy translation strings as EmailMessage properties. (In earlier releases, these could sometimes lead to obscure exceptions or unexpected behavior with some ESPs. See 34.)

Other changes
- **[possibly-breaking]** Fix a long-standing bug validating email addresses. If an address has a display name containing a comma or parentheses, RFC-5322 _requires_ double-quotes around the display name (`'"Widgets, Inc." <widgetsexample.com>'`). Anymail now raises a new `AnymailInvalidAddress` error for misquoted display names and other malformed addresses. (Previously, it silently truncated the address, leading to obscure exceptions or unexpected behavior. See 44.) In general, it's safest to always use double-quotes around all display names. 
- **Mandrill:** Simplify and document two-phase process for setting up Mandrill webhooks. ([docs](http://anymail.readthedocs.io/en/v0.7/esps/mandrill/status-tracking-webhooks))

Links

• PyPI: https://pypi.python.org/pypi/django-anymail
• Changelog: https://pyup.io/changelogs/django-anymail/
• Repo: https://github.com/anymail/django-anymail