Commit graph

2319 commits

Author SHA1 Message Date
Joey Orlando
4ebc7231c9
Properly address Organization.DoesNotExist resulting in HTTP 500 on Slack interactive_api_endpoint (#2040)
# Which issue(s) this PR fixes

Closes https://github.com/grafana/oncall-private/issues/1836

## TODO:
- [ ] add unit tests for this scenario

## Checklist

- [ ] Unit, integration, and e2e (if applicable) tests updated
- [ ] Documentation added (or `pr:no public docs` PR label added if not
required) (N/A)
- [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)
2023-05-29 17:06:19 +00:00
Dieter Plaetinck
29ecfc5df9
Mobile app docs updates (#2026)
# What this PR does

This is the first of many mobile app doc tweaks.

Note that right now the docs are very much out of date.
To make this a smooth process, I recommend to merge if it looks "good
enough", don't sweat details at this time. We can make further
refinements later.
If @imtoori approves, this PR may be merged as is, and i'll make new
ones in the future, or i will just keep pushing more and more tweaks
over the next few business days

## Which issue(s) this PR fixes

## Checklist

- [ ] Unit, integration, and e2e (if applicable) tests updated
- [x] Documentation added (or `pr:no public docs` PR label added if not
required)
- [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)

---------

Co-authored-by: Salvatore Giordano <salvatoregiordanoo@gmail.com>
Co-authored-by: Matvey Kukuy <Matvey-Kuk@users.noreply.github.com>
Co-authored-by: Matvey Kukuy <motakuk@gmail.com>
2023-05-29 14:52:42 +00:00
Matvey Kukuy
94b9d5773b
Answering customer's questions by updating docs. (#2042)
Answering customer's questions by updating docs.
2023-05-29 17:47:35 +03:00
Matias Bordese
e8c9d08301
Enable selecting active days for every shift freq (#2037)
Make it possible to select "by day" active periods for every shift
frequency (ie. enable it for hourly and monthly recurrent rotations).
2023-05-29 13:33:45 +00:00
Joey Orlando
28c4cbd19d
update slack interactive_api_endpoint logging
from debug to info
2023-05-26 14:17:00 -04:00
Alexander Cherepanov
9e65f6bf14
Fix bugs in helm chart with external postgresql configuration (#2036)
# What this PR does

Fixing some bugs with external Postgresql configuration.

Also I added some unit tests for helm chart using
[helm-unittest](https://github.com/helm-unittest/helm-unittest). If it's
not an appropriate tool, please suggest another, or I can remove that
test. I added
[this](https://github.com/marketplace/actions/helm-unit-tests) Github
Action to run helm unit tests.


## Which issue(s) this PR fixes
closes #1727 
closes #1923
closes #1245
closes #845 

## Checklist

- [x] Unit, integration, and e2e (if applicable) tests updated
- [ ] Documentation added (or `pr:no public docs` PR label added if not
required)
- [ ] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)

---------

Co-authored-by: Joey Orlando <joey.orlando@grafana.com>
Co-authored-by: Joey Orlando <joseph.t.orlando@gmail.com>
2023-05-26 13:50:24 +00:00
Salvatore Giordano
20a1964936
changed notification title and subtitle; removed body (#2027)
# What this PR does

## Which issue(s) this PR fixes

## Checklist

- [ ] Unit, integration, and e2e (if applicable) tests updated
- [ ] Documentation added (or `pr:no public docs` PR label added if not
required)
- [ ] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)

---------

Co-authored-by: Joey Orlando <joey.orlando@grafana.com>
2023-05-26 12:52:09 +00:00
Vadim Stepanov
c473d5d513
Update CHANGELOG.md 2023-05-26 11:28:13 +01:00
Innokentii Konstantinov
056b0ddc7e
Add ratelimit for AmazonSNS (#2032)
Adds a ratelimit for AmazonSNS. 
AlertChannelDefining mixin is now injecting alert_receive_channel only
in request, not in kwargs to not to break AmazonSNS.
2023-05-26 09:57:26 +00:00
Yulia Shanyrova
d953315dfc
bug fixes (#2020)
bug fixes

https://github.com/grafana/oncall-private/issues/1824
2023-05-26 07:46:05 +00:00
Michael Derynck
ae7561a84f
Map country code to different Twilio resources (#1976)
Many countries are introducing different requirements for SMS senders to
register and/or use alpha numeric ids, short codes or regional numbers
or face being blocked. The changes in this PR will give us more
flexibility by allowing us to map to different resources in Twilio based
on the phone number we are trying to reach. For this first
implementation the selection is made based on country code of the
recipient. Verification and phone calls were given the same treatment
although the immediate need is for SMS. Senders with no country code set
can be used as catch-all defaults. This also falls back to the
configured live settings/environment variables if not configured.

Possible future additions:
- Move through list of trying multiple senders before failing
notification
- Easily expanded to allow per-organization or per-user resources to let
users and tenants configure their own Twilio
- Add UI + replace live settings so users can configure their own
settings
- More selection criteria if needed

TODO:

- [x] Add+Fix Tests
- [x] Verify changes are compatible with #1713
2023-05-25 21:56:44 +00:00
Joey Orlando
7f9717fe9e
update logging for slack interactive_api_endpoint (#2022)
# What this PR does

In trying to solve
https://github.com/grafana/oncall-private/issues/1836, it is very
difficult to understand the root cause without seeing the event payload.
This PR will log this out.

## Checklist

- [ ] Unit, integration, and e2e (if applicable) tests updated (N/A)
- [ ] Documentation added (or `pr:no public docs` PR label added if not
required) (N/A)
- [ ] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required) (N/A)
2023-05-25 15:17:42 -04:00
Yulya Artyukhina
15ef692009
OnCall prometheus metrics exporter (#1605)
# What this PR does
Add OnCall prometheus metrics exporter

## Which issue(s) this PR fixes

## Checklist

- [x] Tests updated
- [ ] Documentation added
- [ ] `CHANGELOG.md` updated

---------

Co-authored-by: Joey Orlando <joey.orlando@grafana.com>
Co-authored-by: Matias Bordese <mbordese@gmail.com>
2023-05-25 18:26:13 +00:00
Matias Bordese
64521e721d
Handle date values coming from ical in final schedule caching (#2025) 2023-05-25 18:17:09 +00:00
Michael Derynck
6540454e58
Remove spammy log message for device not setup 2 (#2028)
This log should line should have been removed as part of #2006
2023-05-25 17:30:19 +00:00
Matias Bordese
79432bc3bc
Handle slack payload metadata limit in paging command (#2007)
Fixes https://github.com/grafana/oncall-private/issues/1838
2023-05-25 13:42:59 +00:00
Matias Bordese
a536af95f4
Refresh final schedule after cached icals are dropped (#2004)
Make sure the final schedule is refreshed after dropping the cached ical
representations (sometimes the refresh final task was completed before
the cached ical files were refreshed).
2023-05-25 12:01:52 +00:00
Joey Orlando
e69062cd73
update engine log format + log out device type when sending push notifications (#2021)
# What this PR does

- update engine log format to include `org_slug` + `user_agent`
```bash
2023-05-25 11:28:22 source=engine:app google_trace_id=none logger=root inbound latency=0.33164 status=200 method=GET path=/api/internal/v1/alertgroups/stats user_agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 content-length=0 slow=0 user_id=1 org_id=1 org_slug=self_hosted_org
2023-05-25 11:28:23 source=engine:app google_trace_id=none logger=root inbound latency=0.402866 status=200 method=GET path=/api/internal/v1/alertgroups user_agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 content-length=0 slow=0 user_id=1 org_id=1 org_slug=self_hosted_org
```
- log out device type when sending push notifications ([possible values
are `web`, `ios`, or
`android`](https://github.com/xtrinch/fcm-django/blob/master/fcm_django/models.py#L264-L266))

## Checklist

- [ ] Unit, integration, and e2e (if applicable) tests updated (N/A)
- [ ] Documentation added (or `pr:no public docs` PR label added if not
required) (N/A)
- [ ] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required) (N/A)
2023-05-25 07:49:12 -04:00
Vadim Stepanov
12061a2a58
Handle error when updating closed modal window in Slack (#2019)
# What this PR does
Handle HTTP 500 error when attempting to update resolution note modal
window that was already closed by user.

## Which issue(s) this PR fixes
Related to https://github.com/grafana/oncall-private/issues/1834

## Checklist

- [x] Unit, integration, and e2e (if applicable) tests updated
- [x] Documentation added (or `pr:no public docs` PR label added if not
required)
- [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)
2023-05-25 10:48:41 +00:00
Innokentii Konstantinov
1d2ff1e343 Update CHANGELOG.md 2023-05-25 14:30:49 +08:00
Innokentii Konstantinov
f2b59b07b3 Merge remote-tracking branch 'origin/main' into dev 2023-05-25 14:27:32 +08:00
Innokentii Konstantinov
2601d52c29
Fix status callbacks (#2014) 2023-05-25 13:53:58 +08:00
Innokentii Konstantinov
6965aa10ae Merge remote-tracking branch 'origin/dev'
# Conflicts:
#	CHANGELOG.md
#	engine/apps/twilioapp/phone_provider.py
2023-05-25 11:42:02 +08:00
Joey Orlando
2e79c2301d
fix import issue which affected going oncall push notification (#2009)
# Which issue(s) this PR fixes
when running the mobile app (emulator) + OnCall locally and trying to
trigger "You're Going OnCall" push notifications, I was seeing this in
the `celery` logs:
```bash
2023-05-24 21:39:54,032 source=engine:celery worker=ForkPoolWorker-3 task_id=cf9e5b52-a213-430a-8e3c-d6c3bed53318 task_name=apps.mobile_app.tasks.conditionally_send_going_oncall_push_notifications_for_schedule name=celery.app.trace level=INFO Task apps.mobile_app.tasks.conditionally_send_going_oncall_push_notifications_for_schedule[cf9e5b52-a213-430a-8e3c-d6c3bed53318] retry: Retry in 2s: NameError("name 'MobileAppUserSettings' is not defined")
```

This PR patches that by adding the import (inside the relevant function,
to avoid circular imports). After adding this import, I am seeing push
notifications being sent successfully:
```bash
2023-05-24 21:44:08,910 source=engine:celery worker=ForkPoolWorker-3 task_id=71a708b5-9982-4b71-b719-17ed5867dfe1 task_name=apps.mobile_app.tasks.conditionally_send_going_oncall_push_notifications_for_schedule name=apps.mobile_app.tasks level=INFO Evaluating if we should send push notification for schedule 1 for user UWZ6FR5T2KG7U
2023-05-24 21:44:08,912 source=engine:celery worker=ForkPoolWorker-3 task_id=71a708b5-9982-4b71-b719-17ed5867dfe1 task_name=apps.mobile_app.tasks.conditionally_send_going_oncall_push_notifications_for_schedule name=apps.mobile_app.tasks level=INFO timing is right to send going oncall push notification
seconds_until_shift_starts: 476
user_notification_timing_preference: 43200
timing_window_lower: 42780
timing_window_upper: 43620
shift_starts_within_users_notification_timing_preference: False
shift_starts_within_fifteen_minutes: True
2023-05-24 21:44:08,916 source=engine:celery worker=ForkPoolWorker-3 task_id=71a708b5-9982-4b71-b719-17ed5867dfe1 task_name=apps.mobile_app.tasks.conditionally_send_going_oncall_push_notifications_for_schedule name=apps.mobile_app.tasks level=DEBUG Sending push notification with message: {"android": {"priority": "high"}, "apns": {"headers": {"apns-priority": "10"}, "payload": {"aps": {"alert": {"title": "You are going on call in 7 minutes for schedule joey test"}, "interruption-level": "time-sensitive", "sound": {"name": "default_sound.aiff"}, "thread-id": "SZM7GDPI2VI3F:UWZ6FR5T2KG7U:going-oncall"}}}, "data": {"info_notification_sound_name": "default_sound.mp3", "info_notification_volume": "0.8", "info_notification_volume_override": "false", "info_notification_volume_type": "constant", "thread_id": "SZM7GDPI2VI3F:UWZ6FR5T2KG7U:going-oncall", "title": "You are going on call in 7 minutes for schedule joey test", "type": "oncall.info"}, "token": "dqWWqPS8SvOno1TEE_ZBlX:APA91bHW3hB2sXfKHxxrZ6BITyju3gzBfOHyh1drqndc1U8_b-F89JIfPEsaZvXL-uQd0vpJA8LHifEUCZKb_frk-wbTAwbgk92_0a1DvUKdgNcntK-O85MUDRuf6bWhE9NRGIv58tt5"}
```

## Checklist

- [ ] Unit, integration, and e2e (if applicable) tests updated
- [ ] Documentation added (or `pr:no public docs` PR label added if not
required)
- [ ] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)
2023-05-24 17:56:20 -04:00
Michael Derynck
db00528c75
Remove spammy log message for device not setup (#2006)
This message appears very frequently in our logs and does not seem to be
useful. Please comment and close if this message is useful to you.
2023-05-24 20:49:08 +00:00
Innokentii Konstantinov
61741867b4
Insight logs docs (#1716)
# What this PR does
Brings insight logs docs and polish format of insight logs

---------

Co-authored-by: Matvey Kukuy <motakuk@gmail.com>
Co-authored-by: Matvey Kukuy <Matvey-Kuk@users.noreply.github.com>
2023-05-24 13:28:50 +00:00
Alfredo
7f5adb5eab
Docs: Oncall getting started (#1835)
# What this PR does
Adding information around other capabilities of oncall thats not
mentioned.
- Personal notification: add mobile push notification
- Chatops: add mention of other chatops other than slack with link
- Schedule: add mention of web schedule

Since getting started doc would naturally be the place for users to read
first, it would be great if we could let users know other features
available on top of those mentioned in the getting started steps.

---------

Co-authored-by: Matvey Kukuy <Matvey-Kuk@users.noreply.github.com>
Co-authored-by: Matvey Kukuy <motakuk@gmail.com>
2023-05-24 14:54:12 +03:00
Alfredo
216fc8503f
Docs: Update teams setup (#1836)
# What this PR does
Update ms teams setup:
- New UI navigation under 'settings'
- Update wording for adding new channel

Note: This is as per oncall r124-v1.2.15

---------

Co-authored-by: Matvey Kukuy <motakuk@gmail.com>
2023-05-24 14:47:32 +03:00
Alfredo
9d9a8b9609
Docs: update slack setup (#1837)
# What this PR does
Update slack setup:
- New UI navigation under 'settings'
- add instruction on connecting slack user to oncall

Note: This is as per oncall r124-v1.2.15

---------

Co-authored-by: Joey Orlando <joey.orlando@grafana.com>
Co-authored-by: Matvey Kukuy <motakuk@gmail.com>
2023-05-24 14:45:11 +03:00
Alfredo
a8a0f67db8
Docs: Update user notification setting (#1839)
# What this PR does
Add more information on:
- configure ms teams users
- update slack user setting instruction with new UI

Co-authored-by: Matvey Kukuy <motakuk@gmail.com>
2023-05-24 14:28:55 +03:00
Innokentii Konstantinov
6ee845d9e7 Merge remote-tracking branch 'origin/dev' into dev 2023-05-24 19:18:23 +08:00
Innokentii Konstantinov
bb4c817a33 Correct flags of twilio phone provider 2023-05-24 19:18:09 +08:00
Matvey Kukuy
e9ae4cc3e9
Docs restructure (#1703)
Restructured docs.

Based on: https://github.com/grafana/oncall-private/issues/1698
2023-05-24 14:11:21 +03:00
Vadim Stepanov
934c8e7e64
Update CHANGELOG.md 2023-05-24 11:43:13 +01:00
Vadim Stepanov
18390993b8
Update CHANGELOG.md 2023-05-24 11:42:59 +01:00
Vadim Stepanov
533a1f43ca
Merge pull request #2002 from grafana/helm-release/1.2.28
Merge: Release oncall Helm chart 1.2.28
2023-05-24 11:39:01 +01:00
GitHub Actions
aaea3a9384 Release oncall Helm chart 1.2.28 2023-05-24 09:58:49 +00:00
GitHub Actions
3478b05f07 Release oncall Helm chart 1.2.28 2023-05-24 09:09:18 +00:00
Innokentii Konstantinov
cf3d1baf41
v1.2.28 (#2000)
# What this PR does

## Which issue(s) this PR fixes

## Checklist

- [ ] Unit, integration, and e2e (if applicable) tests updated
- [ ] Documentation added (or `pr:no public docs` PR label added if not
required)
- [ ] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Rares Mardare <rares.mardare@grafana.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joey Orlando <joey.orlando@grafana.com>
Co-authored-by: Vadim Stepanov <vadimkerr@gmail.com>
Co-authored-by: Yulia Shanyrova <yulia.shanyrova@grafana.com>
Co-authored-by: Ildar Iskhakov <Ildar.iskhakov@grafana.com>
2023-05-24 17:00:29 +08:00
Ildar Iskhakov
d139fcc7e8
Remove user defined time period from "you're going oncall" mobile push (#2001)
# What this PR does

## Which issue(s) this PR fixes

## Checklist

- [ ] Unit, integration, and e2e (if applicable) tests updated
- [ ] Documentation added (or `pr:no public docs` PR label added if not
required)
- [ ] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)
2023-05-24 16:14:48 +08:00
Innokentii Konstantinov
36f7ec2ddc Update CHANGELOG.md 2023-05-24 15:36:45 +08:00
Innokentii Konstantinov
dca0b1e5df
Improve twilio callback logging (#1998)
# What this PR does

## Which issue(s) this PR fixes

## Checklist

- [ ] Unit, integration, and e2e (if applicable) tests updated
- [ ] Documentation added (or `pr:no public docs` PR label added if not
required)
- [ ] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)
2023-05-24 07:28:14 +00:00
Innokentii Konstantinov
1f786e8d2a
Phone provider refactoring (#1713)
# What this PR does
This PR moves phone notification logic into separate object PhoneBackend
and introduces PhoneProvider interface to hide actual implementation of
external phone services provider. It should allow add new phone
providers just by implementing one class (See SimplePhoneProvider for
example).
# Why 
[Asterisk PR](https://github.com/grafana/oncall/pull/1282) showed that
our phone notification system is not flexible. However this is one of
the most frequent community questions - how to add "X" phone provider.
Also, this refactoring move us one step closer to unifying all
notification backends, since with PhoneBackend all phone notification
logic is collected in one place and independent from concrete
realisation.
# Highligts
1. PhoneBackend object - contains all phone notifications business
logic.
2. PhoneProvider - interface to  external phone services provider.
3. TwilioPhoneProvider and SimplePhoneProvider - two examples of
PhoneProvider implementation.
4. PhoneCallRecord and SMSRecord models. I introduced these models to
keep phone notification limits logic decoupled from external providers.
Existing TwilioPhoneCall and TwilioSMS objects will be migrated to the
new table to not to reset limits counter. To be able to receive status
callbacks and gather from Twilio TwilioPhoneCall and TwilioSMS still
exists, but they are linked to PhoneCallRecord and SMSRecord via fk, to
not to leat twilio logic into core code.

---------

Co-authored-by: Yulia Shanyrova <yulia.shanyrova@grafana.com>
2023-05-24 06:27:48 +00:00
Joey Orlando
eefe7be56a
e2e tests on CI - actually await k8s resources to be ready before starting tests (#1997)
Occasionally, the Playwright global setup step (which authenticates w/
the Grafana API + configures the plugin) would fail, leading to the CI
job to instantly fail (playwright doesn't retry global setup if it
fails).

My current hypothesis as to why this is happening is because the
`oncall-engine` and `oncall-celery` pods aren't _actually_ ready in
these cases based on the way the `jupyterhub/action-k8s-await-workloads`
action await k8s workloads:

<img width="1076" alt="Screenshot 2023-05-23 at 18 24 36"
src="https://github.com/grafana/oncall/assets/9406895/68d8d2d9-4274-4749-8788-e0a9a3dbad83">


By using the `kubectl rollout status deployment/<deployment-name>
--timeout=300s` instead, we can be sure that these pods are _actually_
ready to receive traffic before we start the tests.
```bash
❯ kubectl rollout status --help
Show the status of the rollout.

 By default 'rollout status' will watch the status of the latest rollout until it's done. If you don't want to wait for
the rollout to finish then you can use --watch=false. Note that if a new rollout starts in-between, then 'rollout
status' will continue watching the latest revision. If you want to pin to a specific revision and abort if it is rolled
over by another revision, use --revision=N where N is the revision you need to watch for.
```

Lastly, even despite this, sometimes the `POST
/api/internal/v1/plugin/sync` endpoint will return HTTP 500 ([example
logs](https://github.com/grafana/oncall/actions/runs/5062712137/jobs/9088529416#step:19:2536)
from failed CI job). In this case, let's setup the Playwright global
setup to retry 3 times.
2023-05-23 20:20:46 -04:00
Joey Orlando
c793e550c6
re-enable e2e UI tests on CI (#1961)
#1692 is still open. This PR is not an ideal approach, but it's a quick
win while we wait for that issue to be resolved.

By retrying failing tests up to 3 times, we _should_ be fine to
re-enable these on CI. If a test is failing > 3 times, there's likely a
legitimate issue occuring.
2023-05-23 17:26:12 -04:00
Vadim Stepanov
06bd0454f6
Fix MultipleObjectsReturned error on webhook endpoints (#1996)
# What this PR does
Sometimes `CustomButtonView` returns HTTP 500 with the following error:

```
apps.alerts.models.custom_button.CustomButton.MultipleObjectsReturned: get() returned more than one CustomButton -- it returned 3!
```

This PR fixes it by adding `.distinct()` to the `CustomButton` queryset
when retrieving an instance + does the same for `WebhooksView`.

## Which issue(s) this PR fixes
Related to https://github.com/grafana/oncall-private/issues/1828

## Checklist

- [x] Unit, integration, and e2e (if applicable) tests updated
- [x] Documentation added (or `pr:no public docs` PR label added if not
required)
- [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)
2023-05-23 16:23:06 +00:00
Vadim Stepanov
c921674471
Improve plugin authentication (#1995)
# What this PR does
Handle different failing authentication scenarios (e.g. when token is
invalid or instance context is not a valid JSON) so endpoints return
appropriate response code (401 instead of 500).

## Which issue(s) this PR fixes
Related to https://github.com/grafana/oncall-private/issues/1633

## Checklist

- [x] Unit, integration, and e2e (if applicable) tests updated
- [x] Documentation added (or `pr:no public docs` PR label added if not
required)
- [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)
2023-05-23 16:13:25 +00:00
Rares Mardare
98be80c200
Make payload be readonly within Templates drawer (#1994)
# What this PR does

Make payload be readonly within Templates drawer
2023-05-23 13:44:19 +00:00
Rares Mardare
3c54d1bd30
Fix autosuggestions in monaco editor (#1953)
# What this PR does

Bugfix for Monaco Editor on showing suggestions
2023-05-23 13:17:46 +00:00
dependabot[bot]
5e97a2d500
Bump requests from 2.27.1 to 2.31.0 in /tools/pagerduty-migrator (#1985)
Bumps [requests](https://github.com/psf/requests) from 2.27.1 to 2.31.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.31.0</h2>
<h2>2.31.0 (2023-05-22)</h2>
<p><strong>Security</strong></p>
<ul>
<li>
<p>Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to
potential
forwarding of <code>Proxy-Authorization</code> headers to destination
servers when
following HTTPS redirects.</p>
<p>When proxies are defined with user info (<a
href="https://user:pass@proxy:8080">https://user:pass@proxy:8080</a>),
Requests
will construct a <code>Proxy-Authorization</code> header that is
attached to the request to
authenticate with the proxy.</p>
<p>In cases where Requests receives a redirect response, it previously
reattached
the <code>Proxy-Authorization</code> header incorrectly, resulting in
the value being
sent through the tunneled connection to the destination server. Users
who rely on
defining their proxy credentials in the URL are <em>strongly</em>
encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their
proxy
credentials once the change has been fully deployed.</p>
<p>Users who do not use a proxy or do not supply their proxy credentials
through
the user information portion of their proxy URL are not subject to this
vulnerability.</p>
<p>Full details can be read in our <a
href="https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q">Github
Security Advisory</a>
and <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-32681">CVE-2023-32681</a>.</p>
</li>
</ul>
<h2>v2.30.0</h2>
<h2>2.30.0 (2023-05-03)</h2>
<p><strong>Dependencies</strong></p>
<ul>
<li>
<p>⚠️ Added support for urllib3 2.0. ⚠️</p>
<p>This may contain minor breaking changes so we advise careful testing
and
reviewing <a
href="https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html">https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html</a>
prior to upgrading.</p>
<p>Users who wish to stay on urllib3 1.x can pin to
<code>urllib3&lt;2</code>.</p>
</li>
</ul>
<h2>v2.29.0</h2>
<h2>2.29.0 (2023-04-26)</h2>
<p><strong>Improvements</strong></p>
<ul>
<li>Requests now defers chunked requests to the urllib3 implementation
to improve
standardization. (<a
href="https://redirect.github.com/psf/requests/issues/6226">#6226</a>)</li>
<li>Requests relaxes header component requirements to support bytes/str
subclasses. (<a
href="https://redirect.github.com/psf/requests/issues/6356">#6356</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's
changelog</a>.</em></p>
<blockquote>
<h2>2.31.0 (2023-05-22)</h2>
<p><strong>Security</strong></p>
<ul>
<li>
<p>Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to
potential
forwarding of <code>Proxy-Authorization</code> headers to destination
servers when
following HTTPS redirects.</p>
<p>When proxies are defined with user info (<a
href="https://user:pass@proxy:8080">https://user:pass@proxy:8080</a>),
Requests
will construct a <code>Proxy-Authorization</code> header that is
attached to the request to
authenticate with the proxy.</p>
<p>In cases where Requests receives a redirect response, it previously
reattached
the <code>Proxy-Authorization</code> header incorrectly, resulting in
the value being
sent through the tunneled connection to the destination server. Users
who rely on
defining their proxy credentials in the URL are <em>strongly</em>
encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their
proxy
credentials once the change has been fully deployed.</p>
<p>Users who do not use a proxy or do not supply their proxy credentials
through
the user information portion of their proxy URL are not subject to this
vulnerability.</p>
<p>Full details can be read in our <a
href="https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q">Github
Security Advisory</a>
and <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-32681">CVE-2023-32681</a>.</p>
</li>
</ul>
<h2>2.30.0 (2023-05-03)</h2>
<p><strong>Dependencies</strong></p>
<ul>
<li>
<p>⚠️ Added support for urllib3 2.0. ⚠️</p>
<p>This may contain minor breaking changes so we advise careful testing
and
reviewing <a
href="https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html">https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html</a>
prior to upgrading.</p>
<p>Users who wish to stay on urllib3 1.x can pin to
<code>urllib3&lt;2</code>.</p>
</li>
</ul>
<h2>2.29.0 (2023-04-26)</h2>
<p><strong>Improvements</strong></p>
<ul>
<li>Requests now defers chunked requests to the urllib3 implementation
to improve
standardization. (<a
href="https://redirect.github.com/psf/requests/issues/6226">#6226</a>)</li>
<li>Requests relaxes header component requirements to support bytes/str
subclasses. (<a
href="https://redirect.github.com/psf/requests/issues/6356">#6356</a>)</li>
</ul>
<h2>2.28.2 (2023-01-12)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="147c8511dd"><code>147c851</code></a>
v2.31.0</li>
<li><a
href="74ea7cf7a6"><code>74ea7cf</code></a>
Merge pull request from GHSA-j8r2-6x86-q33q</li>
<li><a
href="3022253346"><code>3022253</code></a>
test on pypy 3.8 and pypy 3.9 on windows and macos (<a
href="https://redirect.github.com/psf/requests/issues/6424">#6424</a>)</li>
<li><a
href="b639e66c81"><code>b639e66</code></a>
test on py3.12 (<a
href="https://redirect.github.com/psf/requests/issues/6448">#6448</a>)</li>
<li><a
href="d3d504436e"><code>d3d5044</code></a>
Fixed a small typo (<a
href="https://redirect.github.com/psf/requests/issues/6452">#6452</a>)</li>
<li><a
href="2ad18e0e10"><code>2ad18e0</code></a>
v2.30.0</li>
<li><a
href="f2629e9e3c"><code>f2629e9</code></a>
Remove strict parameter (<a
href="https://redirect.github.com/psf/requests/issues/6434">#6434</a>)</li>
<li><a
href="87d63de873"><code>87d63de</code></a>
v2.29.0</li>
<li><a
href="51716c4ef3"><code>51716c4</code></a>
enable the warnings plugin (<a
href="https://redirect.github.com/psf/requests/issues/6416">#6416</a>)</li>
<li><a
href="a7da1ab349"><code>a7da1ab</code></a>
try on ubuntu 22.04 (<a
href="https://redirect.github.com/psf/requests/issues/6418">#6418</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/psf/requests/compare/v2.27.1...v2.31.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=requests&package-manager=pip&previous-version=2.27.1&new-version=2.31.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/grafana/oncall/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joey Orlando <joey.orlando@grafana.com>
2023-05-23 12:41:01 +00:00