Bump twisted from 19.2.0rc1 to 22.4.0rc1

[dependabot]

Bumps twisted from 19.2.0rc1 to 22.4.0rc1.

Release notes

Sourced from twisted's releases.

Release 22.4.0rc1

Twisted 22.4.0.rc1 (2022-04-04)

Features

• twisted.python.failure.Failure tracebacks now capture module information, improving compatibility with the Raven Sentry client. (#7796)
• twisted.python.failure.Failure objects are now compatible with dis.distb, improving compatibility with post-mortem debuggers. (#9599)

Bugfixes

• Correct type annotations for IReactorSSL.listenSSL. (#10274)
• twisted.internet.test.test_glibbase.GlibReactorBaseTests now passes. (#10317)

Conch

Features

- twisted.conch.ssh now supports using RSA keys with SHA-2 signatures (RFC 8332) when acting as a server.  The rsa-sha2-512 and rsa-sha2-256 public key signature algorithms are automatically preferred over ssh-rsa if the client advertises support for them; the actual public keys do not need to change. ([#9765](https://github.com/twisted/twisted/issues/9765))
- twisted.conch.ssh now has an alternative Ed25519 implementation using PyNaCl, in order to support platforms that lack OpenSSL >= 1.1.1b.  The new "conch_nacl" extra has the necessary dependency. ([#10208](https://github.com/twisted/twisted/issues/10208))
Bugfixes

• twisted.conch.ssh.session.SSHSession now cleans up both the client transport and the ISession adapter if both are set. Previously, a subsystem's connectionLost method was not called if a environment variable passing request was also sent on the same channel. (#10308)
• (#10313)

Web

Features

- Twisted is now compatible with h2 4.x.x. ([#10182](https://github.com/twisted/twisted/issues/10182))
Bugfixes

• twisted.web.http had several several defects in HTTP request parsing that could permit HTTP request smuggling. It now disallows signed Content-Length headers, forbids illegal characters in chunked extensions, forbids 0x prefix to chunk lengths, and only strips spaces and horizontal tab characters from header values. These changes address CVE-2022-24801 and GHSA-c2jg-hw38-jrqq. (#10323)

... (truncated)

Changelog

Sourced from twisted's changelog.

Ticket numbers in this file can be looked up by visiting http://twistedmatrix.com/trac/ticket/

.. towncrier release notes start

Twisted 22.2.0 (2022-03-01)

Bugfixes

• twisted.internet.gireactor.PortableGIReactor.simulate and twisted.internet.gtk2reactor.PortableGtkReactor.simulate no longer raises TypeError when there are no delayed called. This was a regression introduced with the migration to Python 3 in which the builtin min function no longer accepts None as an argument. (#9660)
• twisted.conch.ssh.transport.SSHTransportBase now disconnects the remote peer if the SSH version string is not sent in the first 4096 bytes. (#10284, CVE-2022-21716, GHSA-rv6r-3f5q-9rgx)

Improved Documentation

• Add type annotations for twisted.web.http.Request.getHeader. (#10270)

Deprecations and Removals

• Support for Python 3.6, which is EoL as of 2021-09-04, has been deprecated. (#10303)

Misc

• #10216, #10299, #10300

Conch

Misc

- [#10298](https://github.com/twisted/twisted/issues/10298)
Web
No significant changes.
</tr></table>

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #14.