Bump waitress from 2.1.0 to 2.1.1

[dependabot]

Bumps waitress from 2.1.0 to 2.1.1.

Changelog

Sourced from waitress's changelog.

2.1.1

Security Bugfix

- Waitress now validates that chunked encoding extensions are valid, and don't
  contain invalid characters that are not allowed. They are still skipped/not
  processed, but if they contain invalid data we no longer continue in and
  return a 400 Bad Request. This stops potential HTTP desync/HTTP request
  smuggling. Thanks to Zhang Zeyu for reporting this issue. See
  https://github.com/Pylons/waitress/security/advisories/GHSA-4f7p-27jc-3c36


Waitress now validates that the chunk length is only valid hex digits when
parsing chunked encoding, and values such as 0x01 and +01 are no
longer supported. This stops potential HTTP desync/HTTP request smuggling.
Thanks to Zhang Zeyu for reporting this issue. See
GHSA-4f7p-27jc-3c36


Waitress now validates that the Content-Length sent by a remote contains only
digits in accordance with RFC7230 and will return a 400 Bad Request when the
Content-Length header contains invalid data, such as +10 which would
previously get parsed as 10 and accepted. This stops potential HTTP
desync/HTTP request smuggling Thanks to Zhang Zeyu for reporting this issue. See
GHSA-4f7p-27jc-3c36

Commits

• 9e0b8c8 Merge pull request from GHSA-4f7p-27jc-3c36
• b28c9e8 Prep for 2.1.1
• bd22869 Remove extraneous calls to .strip() in Chunked Encoding
• d9bdfa0 Validate chunk size in Chunked Encoding are HEXDIG
• d032a66 Error when receiving back Chunk Extension
• 884bed1 Update tests to remove invalid chunked encoding chunk-size
• 1f6059f Be more strict in parsing Content-Length
• e75b0d9 Add new regular expressions for Chunked Encoding
• 22c0394 Merge pull request #367 from Pylons/fixup/collect-wasyncore-tests
• dc15d9f Make sure to collect all wasyncore tests
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)