Merge pull request #12911 from RasaHQ/merge-3.6.x-main-c70507e

Merge 3.6.x into main

CHANGELOG.mdx

@@ -16,6 +16,14 @@ https://github.com/RasaHQ/rasa/tree/main/changelog/ . -->
 
 <!-- TOWNCRIER -->
 
+## [3.6.12] - 2023-10-10
+
+Rasa 3.6.12 (2023-10-10)                         
+### Bugfixes
+- [#12904](https://github.com/rasahq/rasa/issues/12904): Refresh headers used in requests (e.g. action server requests) made by `EndpointConfig` using its `headers` attribute.
+- [#12906](https://github.com/rasahq/rasa/issues/12906): Upgrade `pillow` to `10.0.1` to address security vulnerability CVE-2023-4863 found in `10.0.0` version.
+
+
 ## [3.6.11] - 2023-10-05
 
 Rasa 3.6.11 (2023-10-05)                         

rasa/plugin.py

@@ -6,15 +6,15 @@
 import pluggy
 
 from rasa.cli import SubParsersAction
-from rasa.engine.storage.storage import ModelMetadata
-from rasa.shared.core.trackers import DialogueStateTracker
-from rasa.shared.nlu.training_data.message import Message
 
 if TYPE_CHECKING:
     from rasa.core.brokers.broker import EventBroker
     from rasa.core.tracker_store import TrackerStore
     from rasa.engine.graph import SchemaNode
+    from rasa.engine.storage.storage import ModelMetadata
     from rasa.shared.core.domain import Domain
+    from rasa.shared.core.trackers import DialogueStateTracker
+    from rasa.shared.nlu.training_data.message import Message
     from rasa.utils.endpoints import EndpointConfig
 
 
@@ -95,8 +95,8 @@ def init_telemetry(endpoints_file: Optional[Text]) -> None:
 
 @hookspec  # type: ignore[misc]
 def mock_tracker_for_evaluation(
-    example: Message, model_metadata: Optional[ModelMetadata]
-) -> Optional[DialogueStateTracker]:
+    example: "Message", model_metadata: Optional["ModelMetadata"]
+) -> Optional["DialogueStateTracker"]:
     """Generate a mocked tracker for NLU evaluation."""
 
 

rasa/utils/endpoints.py

@@ -149,6 +149,9 @@ async def request(
             headers.update(kwargs["headers"])
             del kwargs["headers"]
 
+        if self.headers:
+            headers.update(self.headers)
+
         url = concat_url(self.url, subpath)
 
         sslcontext = None