Bump aiosmtplib from 5.1.1 to 5.1.2 in /server in the pip group across 1 directory

[dependabot]

Bumps the pip group with 1 update in the /server directory: aiosmtplib.

Updates aiosmtplib from 5.1.1 to 5.1.2

Release notes

Sourced from aiosmtplib's releases.

v5.1.2

What's Changed

• Security: Discard any buffered server data before the STARTTLS handshake, preventing a response-injection attack where a man-in-the-middle pre-stages plaintext that would otherwise be read as part of the encrypted session. More details: GHSA-vxj7-4xrp-5vr4
• Bugfix: Corrected SMTPResponse __repr__ result
• Bugfix: Calling connect() on an already-connected client now raises SMTPException instead of deadlocking on the connection lock
• Feature: Poe command runner for dev tasks
• Bugfix: Timeout ignored during CRAM-MD5 verification
• Bugfix: Only parse EHLO response after validating success
• Bugfix: return None from extract_sender when address list is empty
• Bugfix: Enforce a maximum total response size, preventing unbounded memory use if a server streams data with no line ending or endless multiline continuation lines
• Bugfix: Use the invalid_response status code (-1) instead of 500 when a server response line exceeds the maximum length
• Bugfix: A read timeout now closes the connection instead of leaving it in a desynced state, where a late server response could be mispaired with a subsequent command
• Bugfix: Correctly parse old-style AUTH= extension advertisements; all advertised methods are now kept (e.g. both PLAIN and LOGIN from AUTH=PLAIN LOGIN)
• Bugfix: ESMTP extension lines with leading whitespace are no longer ignored

Full Changelog: cole/aiosmtplib@v5.1.1...v5.1.2

Changelog

Sourced from aiosmtplib's changelog.

5.1.2

• Security: Discard any buffered server data before the STARTTLS handshake, preventing a response-injection attack where a man-in-the-middle pre-stages plaintext that would otherwise be read as part of the encrypted session. More details: GHSA-vxj7-4xrp-5vr4
• Bugfix: Corrected SMTPResponse __repr__ result
• Bugfix: Calling connect() on an already-connected client now raises SMTPException instead of deadlocking on the connection lock
• Feature: Poe command runner for dev tasks
• Bugfix: Timeout ignored during CRAM-MD5 verification
• Bugfix: Only parse EHLO response after validating success
• Bugfix: return None from extract_sender when address list is empty
• Bugfix: Enforce a maximum total response size, preventing unbounded memory use if a server streams data with no line ending or endless multiline continuation lines
• Bugfix: Use the invalid_response status code (-1) instead of 500 when a server response line exceeds the maximum length
• Bugfix: A read timeout now closes the connection instead of leaving it in a desynced state, where a late server response could be mispaired with a subsequent command
• Bugfix: Correctly parse old-style AUTH= extension advertisements; all advertised methods are now kept (e.g. both PLAIN and LOGIN from AUTH=PLAIN LOGIN)
• Bugfix: ESMTP extension lines with leading whitespace are no longer ignored

Commits

• bffc6d1 release: v5.1.2
• 9fab7ba fix(security): STARTTLS injection
• 382b3c9 ci: try codecov 6.0
• f0087db ci: pre-commit autoupdate
• c0be341 fix: buildcheck via poe
• 889c24c lint: auto fixes from pre-commit hooks
• 3e25ac4 fix: mixed old/new style auth parsing
• 5cd299f fix: explicit close on read timeout
• e1521d7 fix: error (don't hang) on double connect
• e899551 fix: SMTPResponse repr
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.