Update dependency asgiref to v3.11.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
asgiref (changelog)	==3.5.2 → ==3.11.1

---

Release Notes

django/asgiref (asgiref)

v3.11.1

Compare Source

• SECURITY FIX CVE-2025-14550: There was a potential DoS vector for users of
  the asgiref.wsgi.WsgiToAsgi adapter. Malicious requests, including an unreasonably
  large number of values for the same header, could lead to resource exhaustion
  when building the WSGI environment.

  To mitigate this, the algorithm is changed to be more efficient, and
  WsgiToAsgi gains a new optional duplicate_header_limit parameter,
  which defaults to 100. This specifies the number of times a single header may
  be repeated before the request is rejected as malformed.

  You may override duplicate_header_limit when configuring your application::

  application = WsgiToAsgi(wsgi_app, duplicate_header_limit=200)
  

  Set duplicate_header_limit=None if you wish to disable this check.

• Fixed a regression in 3.11.0 in sync_to_async when wrapping a callable
  with an attribute named context. (#​537)

v3.11.0

Compare Source

• sync_to_async gains a context parameter, similar to those for
  asyncio.create_task, TaskGroup &co, that can be used on Python 3.11+ to
  control the context used by the underlying task.

  The parent context is already propagated by default but the additional
  control is useful if multiple sync_to_async calls need to share the same
  context, e.g. when used with asyncio.gather().

v3.10.0

Compare Source

• Added AsyncSingleThreadContext context manager to ensure multiple AsyncToSync
  invocations use the same thread. (#​511)

v3.9.2

Compare Source

• Adds support for Python 3.14.

• Fixes wsgi.errors file descriptor in WsgiToAsgi adapter.

v3.9.1

Compare Source

• Fixed deletion of Local values affecting other contexts. (#​523)

• Skip CPython specific garbage collection test on pypy. (#​521)

v3.9.0

Compare Source

• Adds support for Python 3.13.

• Drops support for (end-of-life) Python 3.8.

• Fixes an error with conflicting kwargs between AsyncToSync and the wrapped
  function. (#​471)

• Fixes Local isolation between asyncio Tasks. (#​478)

• Fixes a reference cycle in Local (#​508)

• Fixes a deadlock in CurrentThreadExecutor with nested async_to_sync →
  sync_to_async → async_to_sync → create_task calls. (#​494)

• The ApplicationCommunicator testing utility will now return the task result
  if it's already completed on send_input and receive_nothing. You may need to
  catch (e.g.) the asyncio.exceptions.CancelledError if sending messages to
  already finished consumers in your tests. (#​505)

v3.8.1

Compare Source

• Fixes a regression in 3.8.0 affecting nested task cancellation inside
  sync_to_async.

v3.8.0

Compare Source

• Adds support for Python 3.12.

• Drops support for (end-of-life) Python 3.7.

• Fixes task cancellation propagation to subtasks when using synchronous Django
  middleware.

• Allows nesting sync_to_async via asyncio.wait_for.

• Corrects WSGI adapter handling of root path.

• Handles case where "client" is None in WsgiToAsgi adapter.

v3.7.2

• The type annotations for SyncToAsync and AsyncToSync have been changed to
  more accurately reflect the kind of callables they return.

v3.7.1

• On Python 3.10 and below, the version of the "typing_extensions" package
  is now constrained to be at least version 4 (as we depend on functionality
  in that version and above)

v3.7.0

Compare Source

• Contextvars are now required for the implementation of sync as Python 3.6
  is now no longer a supported version.

• sync_to_async and async_to_sync now pass-through

• Debug and Lifespan State extensions have resulted in a typing change for some
  request and response types. This change should be backwards-compatible.

• asgiref frames will now be hidden in Django tracebacks by default.

• Raw performance and garbage collection improvements in Local, SyncToAsync,
  and AsyncToSync.

v3.6.0

Compare Source

• Two new functions are added to the asgiref.sync module: iscoroutinefunction()
  and markcoroutinefunction().

  Python 3.12 deprecates asyncio.iscoroutinefunction() as an alias for
  inspect.iscoroutinefunction(), whilst also removing the _is_coroutine marker.
  The latter is replaced with the inspect.markcoroutinefunction decorator.

  The new asgiref.sync functions are compatibility shims for these
  functions that can be used until Python 3.12 is the minimum supported
  version.

  Note that these functions are considered beta, and as such, whilst
  not likely, are subject to change in a point release, until the final release
  of Python 3.12. They are included in asgiref now so that they can be
  adopted by Django 4.2, in preparation for support of Python 3.12.

• The loop argument to asgiref.timeout.timeout is deprecated. As per other
  asyncio based APIs, the running event loop is used by default. Note that
  asyncio provides timeout utilities from Python 3.11, and these should be
  preferred where available.

• Support for the ASGI_THREADS environment variable, used by
  SyncToAsync, is removed. In general, a running event-loop is not
  available to asgiref at import time, and so the default thread pool
  executor cannot be configured. Protocol servers, or applications, should set
  the default executor as required when configuring the event loop at
  application startup.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.