gh-144484: Warn users not to use wsgiref in production#144487
gh-144484: Warn users not to use wsgiref in production#144487sethmlarson merged 1 commit intopython:mainfrom
Conversation
|
LGTM |
vstinner
left a comment
There was a problem hiding this comment.
LGTM.
https://docs.python.org/dev/library/http.server.html has a similar banner but it also has a "Security considerations" section.
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14. |
|
Sorry, @sethmlarson, I could not cleanly backport this to |
|
Sorry, @sethmlarson, I could not cleanly backport this to |
|
Aha, it seems like you should backport the change manually to 3.14. |
|
@StanFromIreland I believe it should be handled as a security-related change. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11. |
|
Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12. |
Follow-up from the precautionary CVE for
wsgiref, where even though the module is documented as a reference implementation (instead of production-ready), there isn't any explicit docs for this like other modules with this property (eg:http.server).📚 Documentation preview 📚: https://cpython-previews--144487.org.readthedocs.build/