Prepare exp-mitmproxy 12.2.3.post2 security dependencies

mitmproxy/proxy/layers/http/_http_h2.py

@@ -1,5 +1,6 @@
 import collections
 import logging
+from collections.abc import Buffer
 from typing import NamedTuple
 
 import h2.config
@@ -119,7 +120,7 @@ def reset_stream(self, stream_id: int, error_code: int = 0) -> None:
         self.stream_buffers.pop(stream_id, None)
         super().reset_stream(stream_id, error_code)
 
-    def receive_data(self, data: bytes):
+    def receive_data(self, data: Buffer):
         events = super().receive_data(data)
         ret = []
         for event in events:

mitmproxy/tools/web/index.html

@@ -5,10 +5,10 @@
         <title>mitmproxy</title>
         <link rel="icon" href="static/favicon.ico" type="image/x-icon" />
         <meta name="viewport" content="width=device-width, initial-scale=1" />
-      <script type="module" crossorigin src="./static/index-Be7e-cwP.js"></script>
-      <link rel="modulepreload" crossorigin href="./static/vendor-BS4xPthR.js">
-      <link rel="stylesheet" crossorigin href="./static/vendor-Cg3S-P9H.css">
-      <link rel="stylesheet" crossorigin href="./static/index-DhPPoJ7G.css">
+      <script type="module" crossorigin src="./static/index-CTA1_E-g.js"></script>
+      <link rel="modulepreload" crossorigin href="./static/vendor-CTu41YHR.js">
+      <link rel="stylesheet" crossorigin href="./static/vendor-CnwSaDiu.css">
+      <link rel="stylesheet" crossorigin href="./static/index-D52D4jV-.css">
     </head>
     <body>
         <div id="mitmproxy"></div>

pyproject.toml

@@ -6,7 +6,7 @@ requires-python = ">=3.12"
 license = {file="LICENSE"}
 authors = [{name = "Aldo Cortesi", email = "aldo@corte.si"}]
 maintainers = [{name = "Experiential Labs"}]
-version = "12.2.3.post1"
+version = "12.2.3.post2"
 
 classifiers = [
     "License :: OSI Approved :: MIT License",
@@ -37,24 +37,28 @@ dependencies = [
     "bcrypt>=5.0.0,<=5.0.0",
     "Brotli>=1.0,<=1.2.0",
     "certifi>=2019.9.11",  # no upper bound here to get latest CA bundle
-    "cryptography>=42.0,<=48.1",  # relaxed upper bound here to get security fixes
-    "flask>=3.0,<=3.1.3",
+    "cryptography>=50.0.1,<=50.0.1",  # includes the current OpenSSL security fixes
+    "flask>=3.1.3,<=3.1.3",
     "h11>=0.16.0,<=0.16.0",
-    "h2>=4.3.0,<=4.3.0",
+    "h2>=4.4.1,<=4.4.1",
+    "hpack>=4.2.0,<5",  # bound malformed HTTP/2 integer decoding
     "hyperframe>=6.0,<=6.1.0",
+    "idna>=3.15,<4",
     "kaitaistruct>=0.10,<=0.11",
     "ldap3>=2.8,<=2.9.1",
+    "pyasn1>=0.6.4,<0.7",  # security floor for ldap3's ASN.1 decoder
     "exp-mitmproxy-rs==0.12.11.post1",
-    "msgpack>=1.0.0,<=1.1.2",
+    "msgpack>=1.2.2,<=1.2.2",
     "pydivert>=2.0.3,<=2.1.0; sys_platform == 'win32'",
     "pyOpenSSL>=24.3,<=27.0.0",
     "pyparsing>=2.4.2,<=3.3.2",
     "pyperclip>=1.9.0,<=1.11.0",
     "ruamel.yaml>=0.18.10,<=0.19.1",
     "sortedcontainers>=2.3,<=2.4.0",
-    "tornado>=6.5.0,<=6.5.5",
+    "tornado>=6.5.10,<=6.5.10",
     "typing-extensions>=4.13.2,<=4.14; python_version < '3.13'",
     "urwid>=2.6.14,<=3.0.5",
+    "werkzeug>=3.1.6,<4",  # reject Windows device names in map-local paths
     "wsproto>=1.0,<=1.3.2",
     "publicsuffix2>=2.20190812,<=2.20191221",
     "zstandard>=0.25,<=0.25.0",
@@ -66,14 +70,17 @@ dev = [
     "hypothesis==6.130.6",
     "maturin==1.12.6",
     "pdoc==16.0.0",
+    "pygments>=2.20.0,<3",
     "pyinstaller==6.19.0",
     "pyinstaller-hooks-contrib==2026.3",
     "pytest-asyncio==1.2.0",
     "pytest-cov==7.0.0",
     "pytest-timeout==2.4.0",
     "pytest-xdist==3.8.0",
     "pytest==8.4.2",
+    "setuptools>=83.0.0",
     "requests==2.32.5",
+    "urllib3>=2.7.0,<3",  # bounded decompression in HTTP clients
     "wheel==0.46.3",
     "build==1.4.2",
     "mypy==1.19.1",
@@ -82,15 +89,18 @@ dev = [
     {include-group = "ruff"},
 ]
 tox = [
+    "uv>=0.11.15,<1",
     "tox==4.50.3",
     "tox-uv==1.33.4",
 ]
 ruff = [
     "ruff==0.15.8",
 ]
 deploy = [
+    "pygments>=2.20.0,<3",
     "awscli==1.44.63",
     "twine==6.2.0",
+    "urllib3>=2.7.0,<3",
 ]
 
 [project.urls]
@@ -108,7 +118,7 @@ mitmweb = "mitmproxy.tools.main:mitmweb"
 hook-dirs = "mitmproxy.utils.pyinstaller:hook_dirs"
 
 [build-system]
-requires = ["setuptools"]
+requires = ["setuptools>=83.0.0"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools.packages.find]

web/jest.config.js

@@ -14,13 +14,13 @@ module.exports = async () => {
         collectCoverageFrom: ["src/js/**/*.{js,jsx,ts,tsx}"],
         transform: {
             "^.+\\.[jt]sx?$": [
-                "esbuild-jest",
+                "babel-jest",
                 {
-                    loaders: {
-                        ".js": "tsx",
-                    },
-                    format: "cjs",
-                    sourcemap: true,
+                    presets: [
+                        ["@babel/preset-env", { targets: { node: "current" } }],
+                        "@babel/preset-react",
+                        "@babel/preset-typescript",
+                    ],
                 },
             ],
         },