[dependabot]

Updates the requirements on dnspython to permit the latest version.

Release notes

Sourced from dnspython's releases.

dnspython 2.9.1

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

Changelog

Sourced from dnspython's changelog.

2.9.1 (in development)

• LOC text parsing now converts the altitude, size, horizontal precision, and vertical precision fields to centimeters exactly, and requires them to be decimal numbers of meters with at most two fractional digits, as RFC 1876 section 3 specifies. They were converted with float(), so 9.29m became 928 cm rather than 929 cm and the text and wire forms of the record disagreed, forms such as 1e3m, 1_000m, +10m, nanm, and infm were accepted, extra fractional digits were silently dropped, and an altitude outside the representable range was accepted and then failed in to_wire() with a non-DNS exception. dns.exception.SyntaxError is now raised for all of these.

• The resolver now assigns a new random query id to every query.

• For transports that require a 0 query id, set it in a way that does not break TSIG.

• dns.message.QueryMessage.resolve_chaining() now caps the minimum TTL of a negative response with no SOA record at 300 seconds (dns.message.NEGATIVE_TTL_WITHOUT_SOA). Previously the TTL was left at its initial value of 2^32 - 1, so a single NXDOMAIN or NODATA response with no SOA, e.g. a spoofed one, stayed in the resolver cache for the life of the process.

• DNSSEC validation now rejects an RRSIG whose type covered or class does not match the RRset, as RFC 4035 section 5.3.1 requires. This was not checked, so a revoked DNSKEY, which may only validate the DNSKEY RRset, still validated any RRset signed with its private key if the RRSIG claimed to cover DNSKEY.

• dns.tokenizer.Tokenizer now ends a line at a carriage return, or at a carriage return followed by a line feed, unless the carriage return is in a quoted string. The carriage return of CRLF line ends used to stay in the last token of each line and in the text of a comment, so e.g. dns.zone.from_text() rejected a zone with CRLF line ends.

• DNSSEC validation no longer uses a DNSKEY with the REVOKE flag set to validate anything other than the DNSKEY RRset. RFC 5011 section 2.1 says a revoked key must not be used for any other purpose, but it was a candidate key like any other, so as long as the revoked key was still published, data signed with its private key, e.g. by whoever compromised it, validated.

• dns.ttl.from_text() now rejects a BIND-style TTL that ends in a 0 without a unit, e.g. 1h0, as it already did for other numbers, e.g. 1h5, and as BIND does. The check for a trailing number tested its value instead of whether there was one, so 1h0 was read as one hour.

• dns.dnssec.sign_zone() now adds the apex NSEC record when the origin is

... (truncated)

Commits

• dddd69c black lint
• 185cc38 release prep
• cf22838 Randomize the id of every message the resolver sends. (#1395)
• e0fce7f use a short negative TTL for a negative answer with no SOA in resolve_chainin...
• ad0803c check the RRSIG type covered and class against the RRset (#1388)
• 8c38a04 Strictly apply RFC 3597 compression rules when decompressing. (#1383)
• ab5ade8 end a line at a carriage return in the tokenizer (#1387)
• d9d259d only use a revoked DNSKEY to validate the DNSKEY RRset (#1385)
• 6d436b8 reject BIND-style TTLs that end in a 0 without a unit (#1384)
• d8fcf2d bound $GENERATE width and parse text labels in linear time (#1382)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🎉 Welcome to our project! Your first pull request marks an exciting moment for us. We're eager to review your contribution and collaborate to merge it into our codebase. Thanks for investing your time in improving our project. If you have any questions or need help, don't hesitate to