Bump daphne from 4.2.1 to 4.2.2

[dependabot]

Bumps daphne from 4.2.1 to 4.2.2.

Changelog

Sourced from daphne's changelog.

4.2.2 (2026-06-03)

• Fixed a denial of service vulnerability via unbounded WebSocket message sizes. Daphne previously passed no message or frame size limits to autobahn, whose defaults are unbounded. This allowed an unauthenticated client to exhaust server memory by sending a very large WebSocket messages/frames (CVE-2026-44545).

  Both limits now default to 1 MiB and can be configured via the new --websocket-max-message-size and --websocket-max-frame-size CLI flags (or the matching Server constructor arguments). Pass 0 to restore the previous unlimited behaviour.

  Thanks to ParkHyunWoo for the report.

• Fixed a header injection vulnerability on the WebSocket upgrade path (CVE-2026-44546).

  Header values containing \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 were parsed as a single header by Twisted but split into multiple headers by autobahn during the WebSocket handshake. An attacker could exploit this parser differential to smuggle additional headers (e.g. authentication tokens, X-Forwarded-For, Origin, Daphne-Root-Path) into the ASGI scope passed to the application.

  Daphne now rejects requests carrying these bytes in any header value with a 400 Bad Request response, as required by RFC 9110 §5.5.

  Thanks to Rene Henningsen for the report.

Commits

• c19f2f4 Bumped version for v4.2.2 release.
• 32f8be0 Fixed CVE-2026-44545: Limit WebSocket sizes in autobahn config.
• 2628b7b Fixed CVE-2026-44546: Prevent header injection on WebSocket upgrade path
• fef65a7 Added .DS_Store files to .gitignore.
• 8b56967 Bump actions/setup-python from 5 to 6 (#569)
• 032c560 Bump actions/checkout from 4 to 5 (#564)
• cb23638 [pre-commit.ci] pre-commit autoupdate (#563)
• See full diff in compare view

[KafetzisThomas]

@dependabot recreate