From c2b3e2fec3348cdb8e2bf2009c132a0e7ac28f62 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Mon, 15 Apr 2024 02:27:23 +0000 Subject: [PATCH] fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-3164749 - https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-5805047 - https://snyk.io/vuln/SNYK-PYTHON-IDNA-6597975 - https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-5595532 - https://snyk.io/vuln/SNYK-PYTHON-SETUPTOOLS-3180412 - https://snyk.io/vuln/SNYK-PYTHON-WAITRESS-2428349 --- requirements.txt | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/requirements.txt b/requirements.txt index 155e5c67669..80264e041b8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1,5 @@ # -*- conf-mode -*- -setuptools>=51.1.0 # Require this first, to prevent later errors +setuptools>=65.5.1 # Require this first, to prevent later errors # argon2-cffi>=21.3.0 # For the Argon2 password hasher option beautifulsoup4>=4.11.1 # Only used in tests @@ -54,7 +54,7 @@ python-magic==0.4.18 # Versions beyond the yanked .19 and .20 introduce form python-memcached>=1.59 # for django.core.cache.backends.memcached python-mimeparse>=1.6 # from TastyPie pytz==2022.2.1 # Pinned as changes need to be vetted for their effect on Meeting fields -requests>=2.27.1 +requests>=2.31.0 requests-mock>=1.9.3 rfc2html>=2.0.3 scout-apm>=2.24.2 @@ -66,3 +66,6 @@ Unidecode>=1.3.4 weasyprint>=52.5,<53 # Datatracker tests past on 54, but xml2rfc tests do not. xml2rfc>=3.12.4 xym>=0.6,<1.0 +certifi>=2023.7.22 # not directly required, pinned by Snyk to avoid a vulnerability +idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability +waitress>=2.1.1 # not directly required, pinned by Snyk to avoid a vulnerability