AIOHTTP Files

Bug fixes

• Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

Related issues and pull requests on GitHub: [#5303].

• Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

Related issues and pull requests on GitHub: [#5357].

• Rejected multipart body parts whose Content-Length header is not a plain sequence of digits (e.g. +5, -1, 1_0), matching the strictness of the main request parser per :rfc:9110#section-8.6 -- by :user:dxbjavid.

Related issues and pull requests on GitHub: [#12794].

• Fixed GunicornWebWorker endlessly reloading when app fails during startup -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#12879].

• Fixed some inconsistent case sensitivity on request methods -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#12931].

• Fixed IndexError: string index out of range in parse_content_disposition when a header parameter has an empty value (e.g. filename=). -- by :user:JSap0914.

Related issues and pull requests on GitHub: [#12948].

• Fixed the sock_read timeout being re-armed on a keep-alive connection after it had been returned to the pool. An idle pooled connection could be left with a pending read timeout that fired and poisoned it, so the next request reusing the connection failed immediately with :exc:aiohttp.SocketTimeoutError. The read timeout is now only rescheduled when resuming a transport that was actually paused -- by :user:daragok.

Related issues and pull requests on GitHub: [#12953], [#12954].

• Fixed the client decompressing frames when permessage-deflate was not negotiated -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#12976].

• Fixed DigestAuthMiddleware raising an IndexError on empty domain -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#12983].

• Fixed :class:~aiohttp.DigestAuthMiddleware corrupting the Digest challenge when a WWW-Authenticate response offered more than one authentication scheme -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#12984].

• Fixed client not closing cleanly after an exception -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#12985].

• Fixed control frames breaking fragmented WebSocket messages -- by :user:arshsmith1.

Related issues and pull requests on GitHub: [#12988].

• Fixed parse_content_disposition rejecting otherwise-valid Content-Disposition header values that contain optional whitespace (OWS) around the disposition type (e.g. "form-data ; name=\"field\""). The disposition type is now stripped before token validation, consistent with how parameter keys are already handled -- by :user:JSap0914.

Related issues and pull requests on GitHub: [#12996].

• Fixed an :exc:IndexError in the pure-Python HTTP parser -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#13001].

• Fixed parsing optional whitespace in Content-Disposition -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#13002].

• Fixed request body not being read on rejected WebSocket upgrades -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#13016].

• Fixed :exc:LookupError (and an unguarded :exc:UnicodeDecodeError) escaping Content-Disposition parsing when a multipart part supplies an extended parameter with an unknown charset -- by :user:arshsmith1.

Related issues and pull requests on GitHub: [#13042].

• Fixed escape_quotes in the Digest authentication middleware not escaping backslashes, so a WWW-Authenticate challenge value containing a backslash could break out of its quoted-string in the generated Authorization header -- by :user:dxbjavid.

Related issues and pull requests on GitHub: [#13054].

• Fixed Python parser not rejecting a bare LF in the request line -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#13136].

• Fixed the C HTTP parser folding the fragment into the query string for an origin-form request target with an empty query (e.g. /path?#frag), which diverged from the pure-Python parser -- by :user:GiulioDER.

Related issues and pull requests on GitHub: [#13171].

• Fixed the C parser reporting newer HTTP methods such as QUERY as <unknown>; the method table is now derived from the vendored llhttp instead of a hand-maintained count -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#13174].

Packaging updates and notes for downstreams

• Upgraded llhttp to v9.4.2 -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#12956].

Contributor-facing changes

• Added admin documentation on incident response and on running reproducer code safely, covering security vulnerability handling and supply-chain, account, and CI/infrastructure compromise -- by :user:Dreamsorcerer.

Related issues and pull requests on GitHub: [#12914].

---