python-tornado: Upgrade to 6.5.5-1 to fix CVE-2025-67724, CVE-2025-67725, CVE-2025-67726, CVE-2026-31958, CVE-2026-35536

.github/workflows/build.yml

@@ -0,0 +1,113 @@
+# The "build" workflow produces wheels (and the sdist) for all python
+# versions/platforms. Where possible (i.e. the build is not a cross-compile),
+# the test suite is also run for the wheel (this test covers fewer
+# configurations than the "test" workflow and tox.ini).
+name: Build
+
+on:
+  push:
+    branches:
+      # Run on release branches. This gives us a chance to detect rot in this
+      # configuration before pushing a tag (which we'd rather not have to undo).
+      - "branch[0-9]*"
+    tags:
+      # The main purpose of this workflow is to build wheels for release tags.
+      # It runs automatically on tags matching this pattern and pushes to pypi.
+      - "v*"
+  workflow_dispatch:
+    # Allow this workflow to be run manually (pushing to testpypi instead of pypi)
+
+permissions: {}
+
+env:
+  python-version: '3.9'
+
+jobs:
+  build_sdist:
+    name: Build sdist
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          python-version: ${{ env.python-version }}
+
+      - name: Check metadata
+        run: "python setup.py check"
+      - name: Build sdist
+        run: "python setup.py sdist && ls -l dist"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifacts-sdist
+          path: ./dist/tornado-*.tar.gz
+
+  build_wheels:
+    name: Build wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-22.04-arm, windows-2022, macos-15]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          python-version: ${{ env.python-version }}
+
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v3.4.0
+
+      - name: Audit ABI3 compliance
+        # This may be moved into cibuildwheel itself in the future. See
+        # https://github.com/pypa/cibuildwheel/issues/1342
+        run: "pip install abi3audit && abi3audit --verbose --summary ./wheelhouse/*.whl"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifacts-${{ matrix.os }}
+          path: ./wheelhouse/*.whl
+
+  upload_pypi_test:
+    name: Upload to PyPI (test)
+    needs: [build_wheels, build_sdist]
+    runs-on: ubuntu-22.04
+    if: github.repository == 'tornadoweb/tornado' && github.event_name == 'workflow_dispatch'
+    permissions:
+      # This permission is required for pypi's "trusted publisher" feature
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: dist
+          merge-multiple: true
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  upload_pypi:
+    name: Upload to PyPI (prod)
+    needs: [build_wheels, build_sdist]
+    runs-on: ubuntu-22.04
+    if: github.repository == 'tornadoweb/tornado' && github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
+    permissions:
+      # This permission is required for pypi's "trusted publisher" feature
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: dist
+          merge-multiple: true
+
+      - uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/test.yml

@@ -0,0 +1,152 @@
+# The "test" workflow is run on every PR and runs tests across all
+# supported python versions and a range of configurations
+# specified in tox.ini. Also see the "build" workflow which is only
+# run for release branches and covers platforms other than linux-amd64
+# (Platform-specific issues are rare these days so we don't want to
+# take that time on every build).
+
+name: Test
+
+on: pull_request
+
+permissions: {}
+
+jobs:
+  # Before starting the full build matrix, run one test configuration
+  # and the linter (the `black` linter is especially likely to catch
+  # first-time contributors).
+  test_quick:
+    name: Run quick tests
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          # Lint python version must be synced with tox.ini
+          python-version: '3.11'
+      - name: Install tox
+        run: python -m pip install tox -c requirements.txt
+
+      - name: Run test suite
+        run: python -m tox -e py311,lint
+
+  test_tox:
+    name: Run full tests
+    needs: test_quick
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        include:
+          - python: '3.9'
+            tox_env: py39-full
+          - python: '3.10'
+            tox_env: py310-full
+          - python: '3.10.8'
+            # Early versions of 3.10 and 3.11 had different deprecation
+            # warnings in asyncio. Test with them too to make sure everything
+            # works the same way.
+            tox_env: py310-full
+          - python: '3.11'
+            tox_env: py311-full
+          - python: '3.11.0'
+            tox_env: py311-full
+          - python: '3.12'
+            tox_env: py312-full
+          - python: '3.13'
+            tox_env: py313-full
+          - python: '3.14.0-beta.1 - 3.14'
+            tox_env: py314-full
+          - python: 'pypy-3.10'
+            # Pypy is a lot slower due to jit warmup costs, so don't run the
+            # "full" test config there.
+            tox_env: pypy3
+          - python: '3.11'
+            # Docs python version must be synced with tox.ini
+            tox_env: docs
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          python-version: ${{ matrix.python}}
+      - name: Install apt packages
+        run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev
+      - name: Install tox
+        run: python -m pip install tox -c requirements.txt
+
+      - name: Run test suite
+        run: python -m tox -e ${{ matrix.tox_env }}
+
+  test_win:
+    # Windows tests are fairly slow, so only run one configuration here.
+    # We test on windows but not mac because even though mac is a more
+    # fully-supported platform, it's similar enough to linux that we
+    # don't generally need to test it separately. Windows is different
+    # enough that we'll break it if we don't test it in CI.
+    name: Run windows tests
+    needs: test_quick
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          python-version: '3.11'
+      - name: Run test suite
+        # TODO: figure out what's up with these log messages
+        run: py -m tornado.test --fail-if-logs=false
+
+  zizmor:
+    name: Analyze action configs with zizmor
+    runs-on: ubuntu-22.04
+    needs: test_quick
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v5
+        name: Install uv
+      - name: Run zizmor
+        run: uvx zizmor .github/workflows
+
+  test_cibw:
+    # cibuildwheel is the tool that we use for release builds in build.yml.
+    # Run it in the every-PR workflow because it's slightly different from our
+    # regular build and this gives us easier ways to test freethreading changes.
+    #
+    # Note that test_cibw and test_tox both take about a minute to run, but test_tox runs
+    # more tests; test_cibw spends a lot of its time installing dependencies. Replacing
+    # test_tox with test_cibw would entail either increasing test runtime or reducing
+    # test coverage.
+    name: Test with cibuildwheel
+    runs-on: ubuntu-22.04
+    needs: test_quick
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Run cibuildwheel
+        uses: pypa/cibuildwheel@v2.22
+        env:
+          # For speed, we only build one python version and one arch. We throw away the wheels
+          # built here; the real build is defined in build.yml.
+          CIBW_ARCHS: native
+          CIBW_BUILD: cp313-manylinux*
+
+          # Alternatively, uncomment the following lines (and replace the previous CIBW_BUILD)
+          # to test a freethreading build of python.
+          #CIBW_BUILD: cp313t-manylinux*
+          #CIBW_ENABLE: cpython-freethreading
+          # I don't understand what this does but auditwheel seems to fail in this configuration.
+          # Since we're throwing away the wheels here, just skip it.
+          # TODO: When we no longer need to disable this, we can enable freethreading in
+          # build.yml.
+          #CIBW_REPAIR_WHEEL_COMMAND: ""

.github/zizmor.yml

@@ -0,0 +1,14 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Allow trusted repositories to use ref-pinning instead of hash-pinning.
+        #
+        # Defaults, from 
+        # https://github.com/woodruffw/zizmor/blob/7b4e76e94be2f4d7b455664ba5252b2b4458b91d/src/audit/unpinned_uses.rs#L172-L193
+        actions/*: ref-pin
+        github/*: ref-pin
+        dependabot/*: ref-pin
+        # Additional trusted repositories
+        pypa/*: ref-pin
+        astral-sh/setup-uv: ref-pin

.readthedocs.yaml

@@ -3,7 +3,7 @@ version: 2
 build:
   os: ubuntu-22.04
   tools:
-    python: "3.8"
+    python: "3.11"
 
 sphinx:
   configuration: docs/conf.py

debian/changelog

@@ -1,3 +1,65 @@
+python-tornado (6.5.5-1) unstable; urgency=medium
+
+  * Team upload.
+  * New upstream release.
+    - CVE-2026-31958: Introduces new limits on the size and complexity of
+      multipart bodies, including a default limit of 100 parts per request
+      to mitigate a possible DoS. It is also possible to disable parsing
+      multipart/form-data entirely if not required (closes: #1130507).
+    - The domain, path, and samesite arguments to RequestHandler.set_cookie
+      are now validated for illegal characters, which could be abused to
+      inject other attributes on the cookie.
+    - Carriage return characters are no longer accepted in multipart/form-data
+      headers.
+  * d/python3-tornado.lintian-overrides: Fix matches.
+
+ -- Daniel Leidert <dleidert@debian.org>  Tue, 31 Mar 2026 01:01:46 +0200
+
+python-tornado (6.5.4-1) unstable; urgency=medium
+
+  * Team upload.
+  * debian/patches/Make-tests-compatible-with-curl-8.19.0.patch: new patch.
+    (Closes: #1129145)
+
+ -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Fri, 06 Mar 2026 01:04:28 -0300
+
+python-tornado (6.5.4-0.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * New upstream release.
+    - CVE-2025-67724: Header injection and XSS via reason argument.
+      (Closes: #1122660)
+    - CVE-2025-67725: Quadratic DoS via Repeated Header Coalescing.
+      (Closes: #1122661)
+    - CVE-2025-67726: Quadratic DoS via Crafted Multipart Parameters.
+      (Closes: #1122663)
+
+ -- Adrian Bunk <bunk@debian.org>  Mon, 05 Jan 2026 13:12:01 +0200
+
+python-tornado (6.5.2-3) unstable; urgency=medium
+
+  * Team upload.
+  * Increase timeout to fix ftbfs issue on slow architectures.
+    Thanks to Aurelien Jarno <aurel32@debian.org>. (Closes: #1117144)
+
+ -- Bo YU <vimer@debian.org>  Sat, 04 Oct 2025 18:42:36 +0800
+
+python-tornado (6.5.2-2) unstable; urgency=medium
+
+  * Uploading to unstable.
+
+ -- Thomas Goirand <zigo@debian.org>  Sun, 28 Sep 2025 11:43:57 +0200
+
+python-tornado (6.5.2-1) experimental; urgency=medium
+
+  * Team upload.
+  * New upstream release.
+  * Refreshed some patches.
+  * Removed pythonpath-autoreload-test.patch now useless.
+  * Removed CVE-2025-47287.patch applied upstream.
+
+ -- Thomas Goirand <zigo@debian.org>  Tue, 26 Aug 2025 11:13:28 +0200
+
 python-tornado (6.4.2-3) unstable; urgency=medium
 
   * Team upload.

debian/patches/0006-Use-local-objects.inv-for-intersphinx-mapping.patch

@@ -9,9 +9,11 @@ Forwarded: not-needed
  docs/conf.py | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
+Index: python-tornado/docs/conf.py
+===================================================================
 --- python-tornado.orig/docs/conf.py
 +++ python-tornado/docs/conf.py
-@@ -84,7 +84,7 @@
+@@ -85,7 +85,7 @@ latex_documents = [
      )
  ]
 

debian/patches/0007-Higher-test_gc-timeout.patch

@@ -7,9 +7,11 @@ Forwarded: not-needed
  tornado/test/gen_test.py | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)
 
+Index: python-tornado/tornado/test/gen_test.py
+===================================================================
 --- python-tornado.orig/tornado/test/gen_test.py
 +++ python-tornado/tornado/test/gen_test.py
-@@ -967,7 +967,10 @@
+@@ -961,7 +961,10 @@ class RunnerGCTest(AsyncTestCase):
              self.io_loop.add_callback(callback)
              yield fut