textproc/py-jsonrpclib-pelix 1.2.0 NetBSD

1.2.0 Security Class translation (jsonclass) no longer imports arbitrary classes by default. A __jsonclass__ payload could previously make a server or client instantiate any importable class with attacker-controlled arguments, when use_jsonclass was enabled (the default) and no class registry was set. Dynamic import is now opt-in through the new Config.allow_dynamic_classes flag (default False); unregistered classes are refused with a TranslationError. Restrict what may be instantiated with Config.classes, and only enable class translation between endpoints you trust. This changes the default behaviour: classes must now be declared with config.classes.add() on both ends, including the enumerations and the Pydantic models which used to be rebuilt implicitly. Only decimal.Decimal …

1.1 - Fixed access to error message in results - Allow the request query ID to be set to 0 or empty string - Allow the definition of a classes registry to restrict dynamic imports - Allow the definition of a maximum content length to reject large requests - Overall code review - Disable `cjson` and `simplejson` tests on Python 3.15