The minimum version supported was already 4.8.0 because of the use
of multi_valued_attributes [1].
Test support for < 4.8.1 is the only code that needs removing [2].
[1] 3ff3d724 ("Use BeautifulSoup element attrs directly", 2020-04-03)
[2] 607328d5 ("Support Beautiful Soup line numbers", 2019-10-05)
bs4 is a dummy package managed by the developer of Beautiful Soup to prevent
name squatting. The official name of PyPI’s Beautiful Soup Python package is
beautifulsoup4. The bs4 package ensures that if you type pip install bs4 by
mistake you will end up with Beautiful Soup.
However, for requirements, it's cleaner to use the proper name.
For downstream packaging in Fedora, this avoids the need of packaging
the dummy package.
UrlBase has been modified as follows:
- the "data" variable now holds bytes
- decoded content is stored in a new variable "text"
- functionality from get_content() has been split out into
get_raw_content() which returns "data" and download_content() which
calls read_content() and sets the download related variables.
This allows for subclasses to do their own decoding and parsers to
use bytes.
PR #196 bumped this to 2.20 to fix a security warning about requests
in our repository, but I believe that warning can be fixed by removing
only the upper bound. This should make backporting linkchecker to
older systems easier, where requests presumably has the 2.20 fix
backported.
Requests versions <= 2.19.1 are vulnerable to CVE-2018-18074:
> The Requests package through 2.19.1 before 2018-09-14 for Python sends
> an HTTP Authorization header to an http URI upon receiving a
> same-hostname https-to-http redirect, which makes it easier for remote
> attackers to discover credentials by sniffing the network.
Thank you, GitHub security alerts, for bringing this to my attention.
