build(deps): bump aiosmtplib from 1.1.6 to 2.0.0

[dependabot]

Bumps aiosmtplib from 1.1.6 to 2.0.0.

Release notes

Sourced from aiosmtplib's releases.

v2.0.0

• BREAKING: Drop Python 3.5 and 3.6 support.

• BREAKING: On connect, if the server supports STARTTLS, automatically try to upgrade the connection. STARTTLS after connect can be turned on or off explicitly by passing start_tls=True or start_tls=False respectively.

• BREAKING: Remove deprecated loop keyword argument for the SMTP class.

• Change: The source_address argument now takes a (addr, port) tuple that is passed as the local_addr param to asyncio.create_connection, allowing for binding to a specific IP. The new local_hostname argument that takes the value to be sent to the server with the EHLO/HELO message. This behaviour more closely matches smtplib.

  In order to not break existing usage, passing a string instead of a tuple to source_address will give a DeprecationWarning, and use the value as it if had been passed for local_hostname.

  Thanks @​rafaelrds and @​davidmcnabnz for raising and contributing work on this issue.

• Bugfix: the mail_options and rcpt_options arguments to the send coroutine no longer cause errors

• Cleanup: Refactored SMTP parent classes to remove complex inheritance structure.

• Cleanup: Switched to asyncio.run for sync client methods.

• Cleanup: Don't use private email.message.Message policy attribute (instead, set an appropriate policy based on message class)

v2.0.0b1

• BREAKING: Drop Python 3.5 and 3.6 support.

• BREAKING: On connect, if the server supports STARTTLS, automatically try to upgrade the connection. STARTTLS after connect can be turned on or off explicitly by passing start_tls=True or start_tls=False respectively.

• BREAKING: Remove deprecated loop keyword argument for the SMTP class.

• Change: The source_address argument now takes a (addr, port) tuple that is passed as the local_addr param to asyncio.create_connection, allowing for binding to a specific IP. The new local_hostname argument that takes the value to be sent to the server with the EHLO/HELO message. This behaviour more closely matches smtplib.

  In order to not break existing usage, passing a string instead of a tuple to source_address will give a DeprecationWarning, and use the value as it if had been passed for local_hostname.

  Thanks @​rafaelrds and @​davidmcnabnz for raising and contributing work on this issue.

• Bugfix: the mail_options and rcpt_options arguments to the send coroutine no longer cause errors

• Cleanup: Refactored SMTP parent classes to remove complex inheritance

... (truncated)

Changelog

Sourced from aiosmtplib's changelog.

2.0.0

• BREAKING: Drop Python 3.5 and 3.6 support.

• BREAKING: On connect, if the server supports STARTTLS, automatically try to upgrade the connection. STARTTLS after connect can be turned on or off explicitly by passing start_tls=True or start_tls=False respectively.

• BREAKING: Remove deprecated loop keyword argument for the SMTP class.

• Change: The source_address argument now takes a (addr, port) tuple that is passed as the local_addr param to asyncio.create_connection, allowing for binding to a specific IP. The new local_hostname argument that takes the value to be sent to the server with the EHLO/HELO message. This behaviour more closely matches smtplib.

  In order to not break existing usage, passing a string instead of a tuple to source_address will give a DeprecationWarning, and use the value as it if had been passed for local_hostname.

  Thanks @​rafaelrds and @​davidmcnabnz for raising and contributing work on this issue.

• Bugfix: the mail_options and rcpt_options arguments to the send coroutine no longer cause errors

• Cleanup: Refactored SMTP parent classes to remove complex inheritance structure.

• Cleanup: Switched to asyncio.run for sync client methods.

• Cleanup: Don't use private email.message.Message policy attribute (instead, set an appropriate policy based on message class)

1.1.7

• Security: Fix a possible injection vulnerability (a variant of https://consensys.net/diligence/vulnerabilities/python-smtplib-multiple-crlf-injection/)

  Note that in order to exploit this vulnerability in aiosmtplib, the attacker would need control of the hostname or source_address parameters. Thanks Sam Sanoop @ Snyk for bringing this to my attention.

• Bugfix: include CHANGLOG in sdist release

• Type hints: fix type hints for async context exit (credit @​JelleZijlstra)

Commits

• d5111c4 release 2.0.0 🎉
• 8498cc9 chore: beta1
• f89d788 test: cover a few missing cases
• 17aef1b test: add status shim test
• 0e4dae0 cleanup: switch to asyncio.run for sync methods
• 3edeaac fix: TimeoutError handling in 3.11
• a52ff40 ci: add py311
• 9cc109b docs: note refactor in CHANGELOG
• 47d7014 fix: testpypi URL, again 😤
• 35664ea fix: testpypi URL
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #791.