Bump python-snap7 from 3.1.0 to 3.1.2

[dependabot]

Bumps python-snap7 from 3.1.0 to 3.1.2.

Release notes

Sourced from python-snap7's releases.

3.1.2

python-snap7 3.1.2

Corrective bug-fix and robustness release superseding the yanked 3.1.1 release.

Server and protocol robustness

• Bound the emulation server to 64 simultaneous clients by default and add a configurable max_clients limit.
• Validate block-download targets and declared sizes, cap accumulated data at the registered memory area's capacity, and discard abandoned transfer state.
• Correct block-download parsing so registered DB numbers other than DB1 work.
• Bound COTP request reassembly to 1 MiB and apply one absolute receive deadline across all request fragments.
• Apply COTP TPDU-size validation consistently to synchronous and asynchronous clients.

The bundled server is intended for PLC emulation, development, and testing. It is not presented as a production-hardened network service, but robustness and security improvements remain welcome.

Correction to 3.1.1

Version 3.1.1 was yanked because its release notes included vulnerability and CWE characterizations that were not supported by the affected code paths, while some input hardening was incomplete. Use 3.1.2 instead.

Install or upgrade with:

pip install --upgrade python-snap7==3.1.2

Please report bugs and hardening opportunities on the issue tracker.

Changelog

Sourced from python-snap7's changelog.

3.1.2

Corrective bug fix and robustness release replacing the yanked 3.1.1 release.

Corrections

• Withdraw the vulnerability and CWE characterizations published with 3.1.1. Independent review found that those descriptions overstated or incorrectly described the affected code paths.

Robustness fixes

• Bound the server to 64 simultaneous clients by default, enforce the existing MaxClients parameter, and allow max_clients configuration.
• Validate block-download targets and declared sizes before allocating transfer state, cap accumulated data at the declared size and registered area's capacity, and clean up abandoned upload/download state on disconnect.
• Correct block-download address parsing so the requested DB number is used instead of silently falling back to DB1.
• Bound COTP request reassembly to 1 MiB and apply one absolute deadline across all fragments of a request.
• Apply COTP TPDU-size validation consistently to sync and async clients.
• Add regression tests for invalid PDU negotiation, TPDU-size validation, connection limits, request reassembly, and block-download limits.

3.1.1 (yanked)

This release was yanked because its security descriptions were inaccurate and some of its input-hardening changes were incomplete. Use 3.1.2 instead.

Robustness changes

• Validate COTP TPDU-size encodings in the synchronous client.
• Normalize implausibly small negotiated PDU lengths and ensure read/write chunk sizes remain positive.
• Stop finalizing downloads into unregistered server memory areas. This did not bound the download accumulator and was completed in 3.1.2.

Bug fixes

• Fix connection_type not applied in TSAP composition during connect() (#766)
• Fix auto-reconnect not triggered on multi-block read path (#787)
• Support multi-byte string encodings (GBK, UTF-8) in get_string, set_string, get_fstring, set_fstring (#788)
• Thread encoding parameter through read_tag / write_tag / read_tags (#786)
• Server: reassemble COTP-fragmented requests; include TPDU size

... (truncated)

Commits

• af741f2 fix(server): bound resource usage for 3.1.2 (#811)
• 99d2304 chore(ci): suppress empty workdir warning in publish smoke tests
• 8d83caa chore(ci): fix deprecation warnings and update OS matrix
• 2baa969 fix(server): reassemble COTP fragments and fix INT/DINT byte count (#804)
• 2681004 chore: prepare v3.1.1 release
• 3f57118 fix(security): validate PDU sizes, prevent infinite loops, restrict server do...
• a19657c fix: thread encoding parameter through read_tag/write_tag/read_tags (#786)
• ceaec78 fix: support multi-byte string encodings in get/set_fstring and get/set_strin...
• aa4cdc2 fix: auto-reconnect not triggered on multi-block read path (#787)
• 2706ee9 fix: use connection_type in TSAP composition during connect (#766)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.