build(deps): bump aiosmtplib from 1.1.6 to 2.0.1

[dependabot]

Bumps aiosmtplib from 1.1.6 to 2.0.1.

Release notes

Sourced from aiosmtplib's releases.

2.0.1

Changes

• Bugfix: "tests" and "docs" in the sdist should be includes, not packages, so that they do not get put in site-packages.

v2.0.0

• BREAKING: Drop Python 3.5 and 3.6 support.

• BREAKING: On connect, if the server supports STARTTLS, automatically try to upgrade the connection. STARTTLS after connect can be turned on or off explicitly by passing start_tls=True or start_tls=False respectively.

• BREAKING: Remove deprecated loop keyword argument for the SMTP class.

• Change: The source_address argument now takes a (addr, port) tuple that is passed as the local_addr param to asyncio.create_connection, allowing for binding to a specific IP. The new local_hostname argument that takes the value to be sent to the server with the EHLO/HELO message. This behaviour more closely matches smtplib.

  In order to not break existing usage, passing a string instead of a tuple to source_address will give a DeprecationWarning, and use the value as it if had been passed for local_hostname.

  Thanks @​rafaelrds and @​davidmcnabnz for raising and contributing work on this issue.

• Bugfix: the mail_options and rcpt_options arguments to the send coroutine no longer cause errors

• Cleanup: Refactored SMTP parent classes to remove complex inheritance structure.

• Cleanup: Switched to asyncio.run for sync client methods.

• Cleanup: Don't use private email.message.Message policy attribute (instead, set an appropriate policy based on message class)

v2.0.0b1

• BREAKING: Drop Python 3.5 and 3.6 support.

• BREAKING: On connect, if the server supports STARTTLS, automatically try to upgrade the connection. STARTTLS after connect can be turned on or off explicitly by passing start_tls=True or start_tls=False respectively.

• BREAKING: Remove deprecated loop keyword argument for the SMTP class.

• Change: The source_address argument now takes a (addr, port) tuple that is passed as the local_addr param to asyncio.create_connection, allowing for binding to a specific IP. The new local_hostname argument that takes the value to be sent to the server with the EHLO/HELO message. This behaviour more closely matches smtplib.

  In order to not break existing usage, passing a string instead of a tuple to source_address will give a DeprecationWarning, and use the value as it if had been passed for local_hostname.

... (truncated)

Changelog

Sourced from aiosmtplib's changelog.

2.0.1

• Bugfix: "tests" and "docs" in the sdist should be includes, not packages, so that they do not get put in site-packages.

2.0.0

• BREAKING: Drop Python 3.5 and 3.6 support.

• BREAKING: On connect, if the server supports STARTTLS, automatically try to upgrade the connection. STARTTLS after connect can be turned on or off explicitly by passing start_tls=True or start_tls=False respectively.

• BREAKING: Remove deprecated loop keyword argument for the SMTP class.

• Change: The source_address argument now takes a (addr, port) tuple that is passed as the local_addr param to asyncio.create_connection, allowing for binding to a specific IP. The new local_hostname argument that takes the value to be sent to the server with the EHLO/HELO message. This behaviour more closely matches smtplib.

  In order to not break existing usage, passing a string instead of a tuple to source_address will give a DeprecationWarning, and use the value as it if had been passed for local_hostname.

  Thanks @​rafaelrds and @​davidmcnabnz for raising and contributing work on this issue.

• Bugfix: the mail_options and rcpt_options arguments to the send coroutine no longer cause errors

• Cleanup: Refactored SMTP parent classes to remove complex inheritance structure.

• Cleanup: Switched to asyncio.run for sync client methods.

• Cleanup: Don't use private email.message.Message policy attribute (instead, set an appropriate policy based on message class)

1.1.7

• Security: Fix a possible injection vulnerability (a variant of https://consensys.net/diligence/vulnerabilities/python-smtplib-multiple-crlf-injection/)

  Note that in order to exploit this vulnerability in aiosmtplib, the attacker would need control of the hostname or source_address parameters. Thanks Sam Sanoop @ Snyk for bringing this to my attention.

• Bugfix: include CHANGLOG in sdist release

• Type hints: fix type hints for async context exit (credit @​JelleZijlstra)

Commits

• 94f43c0 v2.0.1
• b1e741b chore(ci): fix typecheck
• 43d5fa9 chore(ci): remove job/command confusion
• 79988a7 chore(ci): simlify with matrices
• 8671f97 chore(ci): remove pypy3.7
• 0e92a2f chore(ci): fix poetry install crash via --no-ansi
• cdc6f45 chore(ci): debug install logs
• b13d076 chore(ci): turn off parallel installs
• 9fa0645 chore(ci): bump poetry cache key, don't restore general cache
• af32b69 chore(ci): add poetry debug
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)