darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-05 15:38:24 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
5ad8f41123c4d99728ce622849f0a53aa33aea6c
notifications-admin/requirements.in

40 lines
1.1 KiB
Plaintext
Raw Normal View History

Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
# Run `make freeze-requirements` to update requirements.txt
# with package version changes made in requirements-app.txt
ago==0.0.93
Bump govuk-bank-holidays to latest version While the package can always fetch new holidays via the GOV.UK API, the latest version of the packages also caches ones for next year, which means we can avoid unnecessary web requests.
2021-12-30 09:29:18 +00:00
govuk-bank-holidays==0.10
Update humanize from 3.6.0 to 3.12.0
2021-10-18 14:56:04 +01:00
humanize==3.12.0
Pin Flask to less than version 2 Flask 2.0 requires Jinja 3.0 govuk_frontend_jinja is not compatible with Jinja 3.0 yet
2021-06-02 15:24:38 +01:00
Flask==1.1.2 # pyup: <2
Bump WTForms and Flask-WTF to latest versions WTForms versions less than 3.0.0 have a security vulnerability where arbitrary HTML can be inserted into the label of a form, allowing the possibility of a cross-site scripting attack. I don’t know if there’s anywhere we put user-generated content into form labels but it’s possible we are vulnerable somewhere. This require moving some imports because as of https://github.com/wtforms/wtforms/pull/614/files there is no longer a separate module for HTML 5 fields, they are now considered core fields. As of https://github.com/wtforms/wtforms/issues/445/files custom implementations of `pre_validate` or `post_validate` must raise `ValidationError` to trigger a validation message, where we were raising `ValueError` this was no longer being caught. As of https://github.com/wtforms/wtforms/pull/355/files `StringField` returns `None` for empty data, not `''` but our `validate_email_address` function only accepts strings.
2021-11-30 17:17:16 +00:00
Flask-WTF==1.0.0
wtforms==3.0.0
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
Flask-Login==0.5.0
Bump Werkzeug to version 2.0.2 This is the newest version. Pyup is complaining about vulnerabilities in version 1.0.1, specifically > Werkzeug version 2.0.2 improves the security of the debugger cookies. > "SameSite" attribute is set to "Strict" instead of "None", and the > secure flag is added when on HTTPS. Previously we were using whatever version of Werkzeug that Flask specified this pins it to get rid of the vulnerability without having to upgrade everything at once. This requires a few changes to tests which were relying on importing `session` and `current_user` from Flask. Previously it seemed that importing these in the tests referred to the same object that was being used in the app. This appears to no longer be the case. This commit works around that by: - using a context manager to get the contents of the session, like we already do in most tests - asserting that the mock which logs the user in is being called with the right values, rather than looking at the state of the `current_user` object (which was probably giving false certainty anyway)
2021-10-11 17:41:23 +01:00
werkzeug==2.0.2
Require the newest version of Jinja2 Flask version 2 requires Jinja2 version 3. However rather than bumping both at once it feels safer to do this incrementally, so we can isolate anything which breaks.
2021-10-13 11:42:09 +01:00
jinja2==3.0.2
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
blinker==1.4
Update pyexcel from 0.6.6 to 0.6.7
2021-10-18 14:56:06 +01:00
pyexcel==0.6.7
Update pyexcel-io from 0.6.4 to 0.6.5
2021-10-18 14:56:07 +01:00
pyexcel-io==0.6.5
Update pyexcel-xls from 0.6.2 to 0.7.0
2021-10-18 14:56:08 +01:00
pyexcel-xls==0.7.0
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
pyexcel-xlsx==0.6.0
pyexcel-ods3==0.6.0
Update pytz from 2021.1 to 2021.3
2021-10-18 14:56:08 +01:00
pytz==2021.3
Update gunicorn from 20.0.4 to 20.1.0
2021-04-05 14:55:03 +01:00
gunicorn==20.1.0
Stop pyup complaining The apps won’t start with Eventlet 0.31.0 But Pyup complains when we try to downgrade
2021-05-10 17:04:46 +01:00
eventlet==0.30.2 # pyup: ignore
Bump python-client to 6.3.0
2021-10-11 12:26:56 +01:00
notifications-python-client==6.3.0
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
Shapely==1.7.1
Use pure Python Rtree library The Python rtree library we are using to build RTrees has a dependency on the C package libspatialindex. This package is not installed on PaaS, so it’s hard for us to use it. This commit changes the code to use a library called rtreelib instead. rtreelib doesn’t have a built in way to serialise the index it builds, so I’ve had to implement that using pickle.
2021-04-13 12:43:28 +01:00
rtreelib==0.2.0
remove cryptography pin we previously pinned cryptography to versions less than 3.4 since after that point, cryptography started using rust as a dependency. This isn't an issue if you install from wheel, but we found that the version of pip bundled with the python buildpack was too old to support this. However, since upgrading from python 3.6 to python 3.9, the pip version has been bumped and we now no longer need to pin cryptography as it installs correctly.
2022-01-19 18:27:41 +00:00
fido2==0.9.3
Pin importlib-metadata We can’t use the latest version of importlib-metadata because it’s pinned to <4.3 by the newest version of flake8. The conflict is caused by: The user requested importlib-metadata==4.8.1 click 8.0.1 depends on importlib-metadata; python_version < "3.8" pytest 6.2.5 depends on importlib-metadata>=0.12; python_version < "3.8" flake8 4.0.1 depends on importlib-metadata<4.3; python_version < "3.8" Our `make freeze-requirements` task doesn’t catch this because it doesn’t look at dependencies in `requirements-for-test.txt`. Therefore it only freezes the version that `click` is specifying, which is the latest version. Pinning the version in `requirements.in` gets around this.
2021-10-13 15:35:53 +01:00
importlib-metadata==4.2.0
Check that PyProj can be installed on PaaS Previously when trying to bring in https://github.com/alphagov/notifications-utils/pull/889 we had trouble because there were no wheels available for the version of Pip that we were using. Now that we have upgraded to Python 3.9 we are using a newer buildpack which should have the necessary wheels available. This commit is just installing the package and nothing else, to give us more confidence that we can merge https://github.com/alphagov/notifications-utils/pull/915/files without having to subsequently revert it.
2021-11-17 09:54:04 +00:00
pyproj==3.2.1
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
# PaaS
awscli-cwlogs>=1.4,<1.5
Pin Flask to less than version 2 Flask 2.0 requires Jinja 3.0 govuk_frontend_jinja is not compatible with Jinja 3.0 yet
2021-06-02 15:24:38 +01:00
itsdangerous==1.1.0 # pyup: <2
Bump utils to 51.2.1 This brings a few performance improvements for RecipientCSV, which we use to preview and process CSVs. One change also renames one of the attributes for the class to "guestlist".
2021-12-10 16:35:40 +00:00
notifications-utils @ git+https://github.com/alphagov/notifications-utils.git@51.2.1
Don’t put version number in requirements twice It’s a pain having to remember to update both of them. Looks like `pip` now supports a different syntax without the `egg` bit which means a git dependency only needs the version number changing in one place.
2021-11-23 11:27:12 +00:00
govuk-frontend-jinja @ git+https://github.com/alphagov/govuk-frontend-jinja.git@v0.5.8-alpha
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
# gds-metrics requires prometheseus 0.2.0, override that requirement as later versions bring significant performance gains
skip prometheus-client 0.10.0 we saw exceptions on prod that I think might have caused a worker that is being terminated to die ungracefully. While I'm not sure if this is an actual problem that changed behaviour (app instances crashing and restarting), at the very least it definitely polluted the logs and obscured any actual issues we were having. https://github.com/prometheus/client_python/releases/tag/v0.10.0 see the pending fix for this problem here: https://github.com/prometheus/client_python/pull/644
2021-04-08 11:09:45 +01:00
# version 0.10.0 introduced exceptions when workers crashed due to deprecating lower case `prometheus_multiproc_dir`.
prometheus-client>=0.9.0,!=0.10.0
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
gds-metrics==0.2.4
Reference in New Issue Copy Permalink