chore(deps): update dependency vapor/vapor to from: "4.92.5"

[renovate]

This PR contains the following updates:

Package	Update	Change
vapor/vapor	minor	from: "4.78.2" -> from: "4.92.5"

---

Release Notes

vapor/vapor (vapor/vapor)

v4.92.5: - Fix some Sendable warnings on 5.10

Compare Source

What's Changed

Fix some Sendable warnings on 5.10 by @​sidepelican in #​3158

Fix a number of warnings in Swift 5.10 like below.

Fix simple issues that can be addressed by simply adding Sendable.

New Contributor

• @​sidepelican made their first contribution in #​3158 🎉

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.92.4...4.92.5

v4.92.4: - Allow HTTPServer's configuration to be dynamically updatable

Compare Source

What's Changed

Allow HTTPServer's configuration to be dynamically updatable by @​dimitribouniol in #​3132

This allows many aspects of the HTTP server configuration to be changed after the server starts without needing to stop and restart it, or drop existing connections in the process.

Some things that can now be re-configured include request/response configuration options, HTTP version support, HTTP pipelining, TLS configuration (ie. enabling/disabling, rotating certificates, etc…), server name, metrics reporting, the logger, and the shutdown timer.

Fixes #​3130.

New Contributor

• @​dimitribouniol made their first contribution in #​3132 🎉

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.92.3...4.92.4

v4.92.3: - Fix issue when client disconnects midway through a stream

Compare Source

What's Changed

Fix issue when client disconnects midway through a stream by @​0xTim in #​3102

Fixes an issue when a client disconnects mid way through streaming a request in a Swift concurrency context. In certain cases this would trigger a de-init off the event loop, leading to a crash.

This fixes the issue by using a lock instead of a loop bound wrapper

Reviewers

Thanks to the reviewers for their help:

• @​MahdiBM

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.92.2...4.92.3

v4.92.2: - Fix handling of "flag" URL query params

Compare Source

What's Changed

Fix handling of "flag" URL query params by @​gwynne in #​3151

Flag query parameters (e.g. /foo?bar&baz) were broken by 4.75.0, and apparently no one noticed for quite awhile. They now work again. Many thanks to @​daveanderson for reporting this!

Fixes #​3150.

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.92.1...4.92.2

v4.92.1: - Fix URI handling with multiple slashes and variable components.

Compare Source

What's Changed

Fix URI handling with multiple slashes and variable components. by @​gwynne in #​3143

Resolves some more subtle remaining issues in how URI is handled with respect to HTTP requests.

Fixes #​3142.

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.92.0...4.92.1

v4.92.0: - Fix broken URI behaviors

Compare Source

What's Changed

Fix broken URI behaviors by @​gwynne in #​3140

Numerous issues have arisen with the changes made to URI as a result of the fix for GHSA-r6r4-5pr8-gjcp. This update fixes all known issues and restores several changed URI behaviors (although, quite deliberately, not all of them), including new tests. Fixes #​3133, #​3135, #​3137, and #​3138.

Also addresses Sendable warnings in ContentEncoder, ContentDecoder, ContentContainer, PlaintextDecoder, PlaintextEncoder, URLQueryDecoder, URLQueryEncoder, URLQueryContainer, URLEncodedFormDecoder, and URLEncodedFormEncoder.

Shoutout to @​weissi, @​grahamburgsma, and @​finestructure for their help tracking down the various problems, thank you all!

Reviewers

Thanks to the reviewers for their help:

• @​MahdiBM

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.91.1...4.92.0

v4.91.1: - Update routing-kit version

Compare Source

What's Changed

Update routing-kit version by @​marius-se in #​3131

Update routing-kit version to get Equatable conformance for PathComponents

Related to https://github.com/vapor/routing-kit/pull/129
anhttps://github.com/swift-server/swift-openapi-vapor/pull/13#issuecomment-187975282929

New Contributor

• @​marius-se made their first contribution in #​3131 🎉

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.91.0...4.91.1

v4.91.0: - Use singleton EventLoopGroup

Compare Source

What's Changed

Use singleton EventLoopGroup by @​MahdiBM in #​3128

Use the new singleton EventLoopGroup for more convenient and sometimes more performant APIs.

Reviewers

Thanks to the reviewers for their help:

• @​dimitribouniol

This patch was released by @​MahdiBM

Full Changelog: vapor/vapor@4.90.0...4.91.0

v4.90.0

Compare Source

⚠️ Security Update ⚠️

This release fixes a long standing issue in Vapor's URI parsing if users attempt to parse untrusted input that could lead to potential host spoofing. This was caused by using a C implementation with a uint16_t index with no bounds checking. For more details see the security advisory GHSA-qvxg-wjxc-r4gg.

This vulnerability has been designated as CVE-2024-21631. Thank you to baarde for reporting!

v4.89.3: - Fix setting public folder for FileMiddleware when using bundles

Compare Source

What's Changed

Fix setting public folder for FileMiddleware when using bundles by @​grantjbutler in #​3113

This PR fixes an issue where, if you provided a subfolder within a bundle’s resources, the wrong path would be provided to the FileMiddleware, causing the resources to not be loaded.

For example, given a bundle with the following structure:

App.app/
└── Contents/
    ├── MacOS/
    │   └── App
    └── Resources/
        └── web-app/
            └── Public
                └── index.html

If you tried to create an instance of FileMiddleware that tried to use web-app/Public/ as the folder to serve files from, FileMiddleware would incorrectly use the resource path of the bundle (App.app/Resources/) instead of the full path to the specified folder (App.app/Resources/web-app/Public/).

New Contributor

• @​grantjbutler made their first contribution in #​3113 🎉

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.89.2...4.89.3

v4.89.2: - Consistently use the value from X-Request-Id as the request's ID when present

Compare Source

What's Changed

Consistently use the value from X-Request-Id as the request's ID when present by @​baarde in #​3117

Changes

This PR ensures that the Request’s id and the value of the logger’s request-id value are the same.

Motivation

The Request’s id property was added in #​2964 to expose the request-id identifier used for logging.

#​3072 changed this behavior. The request-id identifier is now set:

• to the value from the X-Request-Id header, when the header is present,
• to a random identifier, when the header is absent.

Having two different identifiers is confusing. So, this PR reconciles the two values.

History

The first version of this PR allowed the two identifiers to differ when the X-Request-Id header is present, in order to maintain the original semantics of the id property.

New Contributor

• @​baarde made their first contribution in #​3117 🎉

Reviewers

Thanks to the reviewers for their help:

• @​MahdiBM

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.89.1...4.89.2

v4.89.1: - Fix encoding and decoding of HTTPHeaders

Compare Source

What's Changed

Fix encoding and decoding of HTTPHeaders by @​gwynne in #​3116

The Codable conformance Vapor adds to the HTTPHeaders type now correctly handles cases where more than one header with the same name (such as Set-Cookie) is present, for both encoding and decoding.

The previous encoding format is still recognized for decoding, so that existing serialized data can be safely read.

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.89.0...4.89.1

v4.89.0: - Add fully async entrypoints

Compare Source

What's Changed

Add fully async entrypoints by @​gwynne in #​3114

Pretty much what it says on the tin. Use the new execute() API instead of run(), and/or startup() instead of start().

Reviewers

Thanks to the reviewers for their help:

• @​Joannis

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.88.0...4.89.0

v4.88.0: - Bring back AsyncCommands

Compare Source

What's Changed

Bring back AsyncCommands by @​marius-se in #​3109

Brings async commands back by adding a new property asyncCommands to Application.

New Contributor

• @​marius-se made their first contribution in #​3109 🎉

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.87.1...4.88.0

v4.87.1: - General warnings and tests cleanup

Compare Source

What's Changed

General warnings and tests cleanup by @​gwynne in #​3107

These changes fix almost all of the extant warnings in Vapor, and clean up some issues in the tests, which can now run fully parallelized. There are no functional changes.

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.87.0...4.87.1

v4.87.0: - Add public initializer for XCTHTTPRequest

Compare Source

What's Changed

Add public initializer for XCTHTTPRequest by @​hsharghi in #​3106

Add public initializer for XCTHTTPRequest
This PR will fihttps://github.com/vapor/vapor/issues/310505

Add public initializer for XCTHTTPRequest

New Contributor

• @​hsharghi made their first contribution in #​3106 🎉

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.86.2...4.87.0

v4.86.2: - Make Async Request Body actually work

Compare Source

What's Changed

Make Async Request Body actually work by @​0xTim in #​3096

The existing implementation of adding an AsyncSequence to Request.Body had two issues:

• it didn’t ensure code was being called from the correct event loop which broke Sendable guarantees and was unsafe
• it would hit a precondition failure in the implementation if backpressure was triggered because the initial state was not accounted for

This fixes that

Reviewers

Thanks to the reviewers for their help:

• @​MahdiBM

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.86.1...4.86.2

v4.86.1: - Create a thread pool of System.coreCount rather than 64 when initializing an Application

Compare Source

What's Changed

Create a thread pool of System.coreCount rather than 64 when initializing an Application by @​dfed in #​3092

Following this recommendation, this PR simply changes the default number of cores when initializing an Application from 64 to the current number of cores.

This means that initializing an Application with default arguments now spins up 2x the number of threads as cores on device. We’ll create System.coreCount threads when instantiating the threadPool, and another System.coreCount threads when we instantiate the eventLoopGroup.

2x System.coreCount is still way better than System.coreCount + 64 on older devices, so while this PR does not directly address #​3003, it does reduce total thread usage on init.

New Contributor

• @​dfed made their first contribution in #​3092 🎉

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.86.0...4.86.1

v4.86.0: - Make Request Sendable

Compare Source

What's Changed

Make Request Sendable by @​0xTim in #​3093

Final stage of Vapor’s Sendable journey as Request is now Sendable.

There should be no more Sendable warnings in Vapor, even with complete concurrency checking turned on.

Reviewers

Thanks to the reviewers for their help:

• @​MahdiBM

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.85.1...4.86.0

v4.85.1: - Remove Sendable requirements on Authenticatable

Compare Source

What's Changed

Remove Sendable requirements on Authenticatable by @​0xTim in #​3095

Removes the requirement for Authenticatable types to be Sendable which was causing issues with Fluent models (and any reference types) and wasn’t solvable in a non-breaking way.

This uses an unsafe box to wrap the Authenticatable types which removes compiler checking on usage of the box but should not be an issue due to the way Vapor’s auth is implemented

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.85.0...4.85.1

v4.85.0: - Sendable Response

Compare Source

What's Changed

Sendable Response by @​0xTim in #​3082

Make Response Sendable

Reviewers

Thanks to the reviewers for their help:

• @​MahdiBM

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.84.6...4.85.0

v4.84.6: - Handle query parameters in FileMiddleware redirects

Compare Source

What's Changed

Handle query parameters in FileMiddleware redirects by @​Captain-Kirkie in #​3077

Correctly handle query parameters when using the redirect functionality in FileMiddleware.

New Contributor

• @​Captain-Kirkie made their first contribution in #​3077 🎉

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.84.5...4.84.6

v4.84.5: - Update SwiftNIO HTTP/2 for CVE-2023-44487

Compare Source

What's Changed

Update SwiftNIO HTTP/2 for CVE-2023-44487 by @​0xTim in #​3083

See the forum post for more details

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.84.4...4.84.5

v4.84.4: - Fix NIOLoopBound issues

Compare Source

What's Changed

Fix NIOLoopBound issues by @​0xTim in #​3081

Fixes a number of issues where NIOLoopBound and NIOLoopBoundBox were used without ensuring we were on the correct event loop before accessing them. This could lead to precondition crashes

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.84.3...4.84.4

v4.84.3: - Fix AHC Dependency Mismatch

Compare Source

What's Changed

Fix AHC Dependency Mismatch by @​0xTim in #​3075

4.84.1 migrated the use of AHC to the new singletons API but didn’t bump the version required leading to build errors for some users. This fixes that

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.84.2...4.84.3

v4.84.2: - [SECURITY] Incorrect request error handling triggers server crash

Compare Source

⚠️ Security Update ⚠️

This release fixes an issue introduced in 4.83.2 Vapor incorrectly handles errors encountered during parsing of HTTP 1.x requests, making it vulnerable to a Denial of Service attack. For more details see the security advisory GHSA-qvxg-wjxc-r4gg.

This vulnerability has been designated as CVE-2023-44386. Thank you to t0rchwood for reporting!

v4.84.1: - Add numerous missing @​preconcurrency attributes

Compare Source

What's Changed

Add numerous missing @preconcurrency attributes by @​gwynne in #​3074

It has become standard practice to add @Sendable to @escaping closures passed as method parameters to improve Concurrency correctness. However, when this is done for pre-existing public methods that are not async, the result is source incompatibility for some users, as mutable values captured by such closures will cause unexpected build errors. The correct way to suppress this behavior is to mark such methods with the @preconcurrency attribute, signaling to the compiler that users may not yet expect the additional restrictions of @Sendable to apply without sacrificing correctness for Concurrency-ready code. Unfortunately, Vapor recently added @Sendable annotations to many of its APIs without also adding the @preconcurrency annotation; this update addresses that oversight.

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.84.0...4.84.1

v4.84.0: - More Sendable Conformances

Compare Source

What's Changed

More Sendable Conformances by @​0xTim in #​3057

This adds more Sendable conformances to Vapor and resolves any Sendable warnings that aren’t related to Request or Response

Reviewers

Thanks to the reviewers for their help:

• @​fabianfett

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.83.2...4.84.0

v4.83.2: - HTTPServerErrorHandler: Improve Error Handling for HTTPParserError

Compare Source

What's Changed

HTTPServerErrorHandler: Improve Error Handling for HTTPParserError by @​fred-sch in #​2922

Invalid HTTP previously just closed the connection, but did not actually handle the errors.

This PR uses an adapted version of https://github.com/apple/swift-nio/blob/main/Sources/NIOHTTP1/HTTPServerProtocolErrorHandler.swift to properly catch exceptions if they occur.

New Contributor

• @​fred-sch made their first contribution in #​2922 🎉

Reviewers

Thanks to the reviewers for their help:

• @​MrSkwiggs
• @​Joannis
• @​FranzBusch
• @​Lukasa

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.83.1...4.83.2

v4.83.1: - Pass X-Request-Id if present

Compare Source

What's Changed

Pass X-Request-Id if present by @​paunik in #​3072

Pass the value from the X-Request-Id to the logger context

• pass the X-Request-Id header value if present, pass generated UUID if the header not present

Mentioned:

• https://github.com/vapor/vapor/issues/2508

Why:

• We needed a way to trace router -> web -> worker on the logger on the heroku and we found this https://devcenter.heroku.com/articles/http-request-id

Inspiration:

• https://api.rubyonrails.org/classes/ActionDispatch/RequestId.html

New Contributor

• @​paunik made their first contribution in #​3072 🎉

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.83.0...4.83.1

v4.83.0: - Support Crypto 3.0.0 in the other package manifest

Compare Source

What's Changed

Support Crypto 3.0.0 in the other package manifest by @​gwynne in #​3073

Fixes an oversight made by both Tim and myself in #​3070. Full credit to @​gregcotten for catching the omission.

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.82.0...4.83.0

v4.82.0: - Add support for Swift Crypto 3.0.0

Compare Source

What's Changed

Add support for Swift Crypto 3.0.0 by @​0xTim in #​3070

See https://forums.swift.org/t/swift-crypto-3-0-0/67387 for more details

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.81.1...4.82.0

v4.81.1: - Logger.report() should handle LocalizedError, DecodingError, and EncodingError identically to other errors

Compare Source

What's Changed

Logger.report() should handle LocalizedError, DecodingError, and EncodingError identically to other errors by @​MahdiBM in #​3068

LocalizedError.localizedDesceiption is useless. We shouldn’t use it.
The special handling of DecodingError and EncodingError also doesn’t do much.

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.81.0...4.81.1

v4.81.0: - The swift-backtrace library is no longer needed in 5.9

Compare Source

What's Changed

The swift-backtrace library is no longer needed in 5.9 by @​gwynne in #​3064

Per https://github.com/swift-server/swift-backtrace/pull/68.

This patch was released by @​gwynne

Full Changelog: vapor/vapor@4.80.0...4.81.0

v4.80.0: - Make Storage Sendable

Compare Source

What's Changed

Make Storage Sendable by @​0xTim in #​3056

Make Vapor’s Storage and Application Sendable. This is a key piece in allowing Request and Response to be Sendable.

Note that types that are stored in Storage should now be Sendable. If you get any warnings, you may need to update your code for this new change.

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.79.0...4.80.0

v4.79.0: - Add Sendable Conformances to underlying types

Compare Source

What's Changed

Add Sendable Conformances to underlying types by @​0xTim in #​3054

This adds Sendable annotations to many of Vapor’s types and APIs, including the request handlers.

APIs are marked @preconcurrency where it makes sense to reduce warnings for anyone using the release. To fix your code and see the warnings, you can enable strict concurrency checking.

Note: this PR does not touch Request, Response or Application as they require fundamental changes that are larger in scope and will be done in a future release.

Reviewers

Thanks to the reviewers for their help:

• @​FranzBusch
• @​Lukasa

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.78.2...4.79.0

---

Configuration

📅 Schedule: Branch creation - "before 12pm every weekday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks