darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-11 17:38:50 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
4903e9d60ef2d31f3cd912697dc94b56b2c9f0dd
notifications-admin/requirements.in

40 lines
1.3 KiB
Plaintext
Raw Normal View History

Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
# Run `make freeze-requirements` to update requirements.txt
# with package version changes made in requirements-app.txt
ago==0.0.93
Update govuk-bank-holidays from 0.10 to 0.11
2022-03-02 14:42:02 +00:00
govuk-bank-holidays==0.11
Update humanize from 3.12.0 to 4.0.0 Breaking change is due to dropping support for Python 3.6.
2022-03-02 14:45:18 +00:00
humanize==4.0.0
Pin Flask to less than version 2 Flask 2.0 requires Jinja 3.0 govuk_frontend_jinja is not compatible with Jinja 3.0 yet
2021-06-02 15:24:38 +01:00
Flask==1.1.2 # pyup: <2
Bump WTForms and Flask-WTF to latest versions WTForms versions less than 3.0.0 have a security vulnerability where arbitrary HTML can be inserted into the label of a form, allowing the possibility of a cross-site scripting attack. I don’t know if there’s anywhere we put user-generated content into form labels but it’s possible we are vulnerable somewhere. This require moving some imports because as of https://github.com/wtforms/wtforms/pull/614/files there is no longer a separate module for HTML 5 fields, they are now considered core fields. As of https://github.com/wtforms/wtforms/issues/445/files custom implementations of `pre_validate` or `post_validate` must raise `ValidationError` to trigger a validation message, where we were raising `ValueError` this was no longer being caught. As of https://github.com/wtforms/wtforms/pull/355/files `StringField` returns `None` for empty data, not `''` but our `validate_email_address` function only accepts strings.
2021-11-30 17:17:16 +00:00
Flask-WTF==1.0.0
Update wtforms from 3.0.0 to 3.0.1
2022-03-02 14:51:37 +00:00
wtforms==3.0.1
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
Flask-Login==0.5.0
Bump Werkzeug to version 2.0.2 This is the newest version. Pyup is complaining about vulnerabilities in version 1.0.1, specifically > Werkzeug version 2.0.2 improves the security of the debugger cookies. > "SameSite" attribute is set to "Strict" instead of "None", and the > secure flag is added when on HTTPS. Previously we were using whatever version of Werkzeug that Flask specified this pins it to get rid of the vulnerability without having to upgrade everything at once. This requires a few changes to tests which were relying on importing `session` and `current_user` from Flask. Previously it seemed that importing these in the tests referred to the same object that was being used in the app. This appears to no longer be the case. This commit works around that by: - using a context manager to get the contents of the session, like we already do in most tests - asserting that the mock which logs the user in is being called with the right values, rather than looking at the state of the `current_user` object (which was probably giving false certainty anyway)
2021-10-11 17:41:23 +01:00
werkzeug==2.0.2
Require the newest version of Jinja2 Flask version 2 requires Jinja2 version 3. However rather than bumping both at once it feels safer to do this incrementally, so we can isolate anything which breaks.
2021-10-13 11:42:09 +01:00
jinja2==3.0.2
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
blinker==1.4
Update pyexcel from 0.6.6 to 0.6.7
2021-10-18 14:56:06 +01:00
pyexcel==0.6.7
Update pyexcel-io from 0.6.5 to 0.6.6
2022-03-02 14:56:06 +00:00
pyexcel-io==0.6.6
Update pyexcel-xls from 0.6.2 to 0.7.0
2021-10-18 14:56:08 +01:00
pyexcel-xls==0.7.0
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
pyexcel-xlsx==0.6.0
pyexcel-ods3==0.6.0
Update pytz from 2021.1 to 2021.3
2021-10-18 14:56:08 +01:00
pytz==2021.3
pin gunicorn to support newer version of eventlet this is consistent with notifications api https://github.com/alphagov/notifications-api/pull/3466
2022-03-03 11:16:24 +00:00
# Should be pinned until a new gunicorn release greater than 20.1.0 comes out. (Due to eventlet v0.33 compatibility issues)
git+https://github.com/benoitc/gunicorn.git@1299ea9e967a61ae2edebe191082fd169b864c64#egg=gunicorn[eventlet]==20.1.0
Bump python-client to 6.3.0
2021-10-11 12:26:56 +01:00
notifications-python-client==6.3.0
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
Shapely==1.7.1
Use pure Python Rtree library The Python rtree library we are using to build RTrees has a dependency on the C package libspatialindex. This package is not installed on PaaS, so it’s hard for us to use it. This commit changes the code to use a library called rtreelib instead. rtreelib doesn’t have a built in way to serialise the index it builds, so I’ve had to implement that using pickle.
2021-04-13 12:43:28 +01:00
rtreelib==0.2.0
remove cryptography pin we previously pinned cryptography to versions less than 3.4 since after that point, cryptography started using rust as a dependency. This isn't an issue if you install from wheel, but we found that the version of pip bundled with the python buildpack was too old to support this. However, since upgrading from python 3.6 to python 3.9, the pip version has been bumped and we now no longer need to pin cryptography as it installs correctly.
2022-01-19 18:27:41 +00:00
fido2==0.9.3
Pin importlib-metadata We can’t use the latest version of importlib-metadata because it’s pinned to <4.3 by the newest version of flake8. The conflict is caused by: The user requested importlib-metadata==4.8.1 click 8.0.1 depends on importlib-metadata; python_version < "3.8" pytest 6.2.5 depends on importlib-metadata>=0.12; python_version < "3.8" flake8 4.0.1 depends on importlib-metadata<4.3; python_version < "3.8" Our `make freeze-requirements` task doesn’t catch this because it doesn’t look at dependencies in `requirements-for-test.txt`. Therefore it only freezes the version that `click` is specifying, which is the latest version. Pinning the version in `requirements.in` gets around this.
2021-10-13 15:35:53 +01:00
importlib-metadata==4.2.0
Check that PyProj can be installed on PaaS Previously when trying to bring in https://github.com/alphagov/notifications-utils/pull/889 we had trouble because there were no wheels available for the version of Pip that we were using. Now that we have upgraded to Python 3.9 we are using a newer buildpack which should have the necessary wheels available. This commit is just installing the package and nothing else, to give us more confidence that we can merge https://github.com/alphagov/notifications-utils/pull/915/files without having to subsequently revert it.
2021-11-17 09:54:04 +00:00
pyproj==3.2.1
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
# PaaS
awscli-cwlogs>=1.4,<1.5
Pin Flask to less than version 2 Flask 2.0 requires Jinja 3.0 govuk_frontend_jinja is not compatible with Jinja 3.0 yet
2021-06-02 15:24:38 +01:00
itsdangerous==1.1.0 # pyup: <2
Simplify clearing the template cache This is more consistent and more visible than a direct call to a function. It makes use of the new decorator added in response to [^1]. [^1]: https://github.com/alphagov/notifications-admin/pull/4162#pullrequestreview-896208092
2022-02-22 12:28:23 +00:00
notifications-utils @ git+https://github.com/alphagov/notifications-utils.git@55.1.0
Don’t put version number in requirements twice It’s a pain having to remember to update both of them. Looks like `pip` now supports a different syntax without the `egg` bit which means a git dependency only needs the version number changing in one place.
2021-11-23 11:27:12 +00:00
govuk-frontend-jinja @ git+https://github.com/alphagov/govuk-frontend-jinja.git@v0.5.8-alpha
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
# gds-metrics requires prometheseus 0.2.0, override that requirement as later versions bring significant performance gains
skip prometheus-client 0.10.0 we saw exceptions on prod that I think might have caused a worker that is being terminated to die ungracefully. While I'm not sure if this is an actual problem that changed behaviour (app instances crashing and restarting), at the very least it definitely polluted the logs and obscured any actual issues we were having. https://github.com/prometheus/client_python/releases/tag/v0.10.0 see the pending fix for this problem here: https://github.com/prometheus/client_python/pull/644
2021-04-08 11:09:45 +01:00
# version 0.10.0 introduced exceptions when workers crashed due to deprecating lower case `prometheus_multiproc_dir`.
prometheus-client>=0.9.0,!=0.10.0
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
gds-metrics==0.2.4
Reference in New Issue Copy Permalink