...
.. note::
**Version 5.0 fixes a security issue introduced in version 4.0.**
websockets 4.0 was vulnerable to denial of service by memory exhaustion
because it didn't enforce ``max_size`` when decompressing compressed
messages.
.. warning::
**Version 5.0 adds a** ``user_info`` **field to the return value of**
:func:`~uri.parse_uri` **and** :class:`~uri.WebSocketURI` **.**
If you're unpacking :class:`~websockets.WebSocketURI` into four variables,
adjust your code to account for that fifth field.
Also:
* :func:`~client.connect()` performs HTTP Basic Auth when the URI contains
credentials.
* Iterating on incoming messages no longer raises an exception when the
connection terminates with code 1001 (going away).
* A plain HTTP request now receives a 426 Upgrade Required response and
doesn't log a stack trace.
* :func:`~server.unix_serve` can be used as an asynchronous context manager on
Python ≥ 3.5.1.
* Added :meth:`~protocol.WebSocketCommonProtocol.closed` property.
* If a :meth:`~protocol.WebSocketCommonProtocol.ping` doesn't receive a pong,
it's cancelled when the connection is closed.
* Reported the cause of :exc:`~exceptions.ConnectionClosed` exceptions.
* Added new examples in the documentation.
* Updated documentation with new features from Python 3.6.
* Improved several other sections of the documentation.
* Fixed missing close code, which caused :exc:`TypeError` on connection close.
* Fixed a race condition in the closing handshake that raised
:exc:`~exceptions.InvalidState`.
* Stopped logging stack traces when the TCP connection dies prematurely.
* Prevented writing to a closing TCP connection during unclean shutdowns.
* Made connection termination more robust to network congestion.
* Prevented processing of incoming frames after failing the connection.