Update asgiref requirement from >=3.8.0 to >=3.11.1

[dependabot]

Updates the requirements on asgiref to permit the latest version.

Changelog

Sourced from asgiref's changelog.

3.11.1 (2026-02-03)

• SECURITY FIX CVE-2025-14550: There was a potential DoS vector for users of the asgiref.wsgi.WsgiToAsgi adapter. Malicious requests, including an unreasonably large number of values for the same header, could lead to resource exhaustion when building the WSGI environment.

  To mitigate this, the algorithm is changed to be more efficient, and WsgiToAsgi gains a new optional duplicate_header_limit parameter, which defaults to 100. This specifies the number of times a single header may be repeated before the request is rejected as malformed.

  You may override duplicate_header_limit when configuring your application::

  application = WsgiToAsgi(wsgi_app, duplicate_header_limit=200)
  

  Set duplicate_header_limit=None if you wish to disable this check.

• Fixed a regression in 3.11.0 in sync_to_async when wrapping a callable with an attribute named context. (#537)

3.11.0 (2025-11-19)

• sync_to_async gains a context parameter, similar to those for asyncio.create_task, TaskGroup &co, that can be used on Python 3.11+ to control the context used by the underlying task.

  The parent context is already propagated by default but the additional control is useful if multiple sync_to_async calls need to share the same context, e.g. when used with asyncio.gather().

3.10.0 (2025-10-05)

• Added AsyncSingleThreadContext context manager to ensure multiple AsyncToSync invocations use the same thread. (#511)

3.9.2 (2025-09-23)

• Adds support for Python 3.14.

• Fixes wsgi.errors file descriptor in WsgiToAsgi adapter.

3.9.1 (2025-07-08)

• Fixed deletion of Local values affecting other contexts. (#523)

... (truncated)

Commits

• d97a733 Releasing 3.11.1.
• a50968a CVE-2025-14550: Fixed duplicate header handling in WsgiToAsgi.
• 0fb85a4 Fixed sync_to_async wrapping callables with attribute named context.
• 2b28409 Updated Hypercorn homepage URL (#539)
• b7b15b2 Releasing 3.11.0.
• 901ee4f Added a custom context parameter for the sync_to_async (#536)
• 2138f03 Fixed typo in test file comment.
• f587b12 Releasing 3.10.0.
• b08087c Added AsyncSingleThreadContext (#511)
• 3471a0c Releasing 3.9.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.