Update dependency daphne to v4.2.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
daphne (changelog)	==4.2.0 → ==4.2.2

---

Release Notes

django/daphne (daphne)

v4.2.2

Compare Source

• Fixed a denial of service vulnerability via unbounded WebSocket message sizes.
  Daphne previously passed no message or frame size limits to autobahn,
  whose defaults are unbounded. This allowed an unauthenticated client
  to exhaust server memory by sending a very large WebSocket
  messages/frames (CVE-2026-44545).

  Both limits now default to 1 MiB and can be configured via the new
  --websocket-max-message-size and --websocket-max-frame-size CLI
  flags (or the matching Server constructor arguments). Pass 0 to
  restore the previous unlimited behaviour.

  Thanks to ParkHyunWoo for the report.

• Fixed a header injection vulnerability on the WebSocket upgrade path
  (CVE-2026-44546).

  Header values containing \x0b, \x0c, \x1c, \x1d, \x1e,
  or \x85 were parsed as a single header by Twisted but split into
  multiple headers by autobahn during the WebSocket handshake. An attacker
  could exploit this parser differential to smuggle additional headers
  (e.g. authentication tokens, X-Forwarded-For, Origin,
  Daphne-Root-Path) into the ASGI scope passed to the application.

  Daphne now rejects requests carrying these bytes in any header value with
  a 400 Bad Request response, as required by RFC 9110 §5.5.

  Thanks to Rene Henningsen for the report.

v4.2.1

Compare Source

• Fixed a packaging error in 4.2.0.

• Removed --nostatic and --insecure args to runserver command when staticfiles
  app is not installed.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.