darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-08 18:03:12 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
773a51dec19c78902ec3ed27081a07c80093c290
notifications-admin/requirements.in

40 lines
1.1 KiB
Plaintext
Raw Normal View History

Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
# Run `make freeze-requirements` to update requirements.txt
# with package version changes made in requirements-app.txt
ago==0.0.93
govuk-bank-holidays==0.8
Update humanize from 3.3.0 to 3.4.0
2021-04-12 14:55:03 +01:00
humanize==3.4.0
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
Flask==1.1.2
Flask-WTF==0.14.3
Flask-Login==0.5.0
blinker==1.4
pyexcel==0.6.6
pyexcel-io==0.6.4
pyexcel-xls==0.6.2
pyexcel-xlsx==0.6.0
pyexcel-ods3==0.6.0
Revert "Revert "Scheduled weekly dependency update for week 07"" This reverts commit e23daa205cb9dd07693408bfb2d745f344075970.
2021-02-16 16:16:17 +00:00
pytz==2021.1
Update gunicorn from 20.0.4 to 20.1.0
2021-04-05 14:55:03 +01:00
gunicorn==20.1.0
Stop pyup complaining The apps won’t start with Eventlet 0.31.0 But Pyup complains when we try to downgrade
2021-05-10 17:04:46 +01:00
eventlet==0.30.2 # pyup: ignore
Revert "Revert "Scheduled weekly dependency update for week 07"" This reverts commit e23daa205cb9dd07693408bfb2d745f344075970.
2021-02-16 16:16:17 +00:00
notifications-python-client==6.0.2
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
Shapely==1.7.1
Use pure Python Rtree library The Python rtree library we are using to build RTrees has a dependency on the C package libspatialindex. This package is not installed on PaaS, so it’s hard for us to use it. This commit changes the code to use a library called rtreelib instead. rtreelib doesn’t have a built in way to serialise the index it builds, so I’ve had to implement that using pickle.
2021-04-13 12:43:28 +01:00
rtreelib==0.2.0
Support registering a new authenticator This adds Yubico's FIDO2 library and two APIs for working with the "navigator.credentials.create()" function in JavaScript. The GET API uses the library to generate options for the "create()" function, and the POST API decodes and verifies the resulting credential. While the options and response are dict-like, CBOR is necessary to encode some of the byte-level values, which can't be represented in JSON. Much of the code here is based on the Yubico library example [1][2]. Implementation notes: - There are definitely better ways to alert the user about failure, but window.alert() will do for the time being. Using location.reload() is also a bit jarring if the page scrolls, but not a major issue. - Ideally we would use window.fetch() to do AJAX calls, but we don't have a polyfill for this, and we use $.ajax() elsewhere [3]. We need to do a few weird tricks [6] to stop jQuery trashing the data. - The FIDO2 server doesn't serve web requests; it's just a "server" in the sense of WebAuthn terminology. It lives in its own module, since it needs to be initialised with the app / config. - $.ajax returns a promise-like object. Although we've used ".fail()" elsewhere [3], I couldn't find a stub object that supports it, so I've gone for ".catch()", and used a Promise stub object in tests. - WebAuthn only works over HTTPS, but there's an exception for "localhost" [4]. However, the library is a bit too strict [5], so we have to disable origin verification to avoid needing HTTPS for dev work. [1]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/server.py [2]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/static/register.html [3]: https://github.com/alphagov/notifications-admin/blob/91453d36395b7a0cf2998dfb8a5f52cc9e96640f/app/assets/javascripts/updateContent.js#L33 [4]: https://stackoverflow.com/questions/55971593/navigator-credentials-is-null-on-local-server [5]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/fido2/rpid.py#L69 [6]: https://stackoverflow.com/questions/12394622/does-jquery-ajax-or-load-allow-for-responsetype-arraybuffer
2021-05-07 18:10:07 +01:00
fido2==0.9.1
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
# PaaS
awscli-cwlogs>=1.4,<1.5
itsdangerous==1.1.0
Estimate number of phones in an arbitrary polygon We want to know how many phones are in a user-supplied polygon, so we can show the impact of a broadcast, in the same way that we do when users pick areas from our library. We already know how many phones are in each electoral ward. But there are challenges with an arbitrary polygon: - where it does overlap a ward, the overlap could be partial - it could overlap more than one ward - finding out which wards it overlaps by brute force (looping through all the wards and seeing which ones intersect with our polygon) would be way to slow to do in real time Instead we can use a data structure called an R-tree[1] to build an index which provides a much, much faster way of looking up which polygons overlap another. We can build this tree in advance and save it somewhere, which means there’s a lot of computation we don’t need to do in real time. The R-tree returns a set of objects (ward IDs) which we can go and look up in our library of electoral wards. These wards will be the ones that might have some overlap with our custom polygon. Once we have this small set of wards which might overlap our ward, we can look at the size of the area of overlap (relative to the size of the whole ward) and multiply that by the known count of phones in that ward to get an approximation of the count of phones in the overlap area. Summing these approximations give an estimate for the whole area of the custom polygon. 1. https://en.wikipedia.org/wiki/R-tree
2021-03-18 23:02:32 +00:00
git+https://github.com/alphagov/notifications-utils.git@44.2.0#egg=notifications-utils==44.2.0
Update requirements - install patch for jinja2 vulnerability
2021-02-02 17:13:18 +00:00
git+https://github.com/alphagov/govuk-frontend-jinja.git@v0.5.8-alpha#egg=govuk-frontend-jinja==0.5.8-alpha
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
Support registering a new authenticator This adds Yubico's FIDO2 library and two APIs for working with the "navigator.credentials.create()" function in JavaScript. The GET API uses the library to generate options for the "create()" function, and the POST API decodes and verifies the resulting credential. While the options and response are dict-like, CBOR is necessary to encode some of the byte-level values, which can't be represented in JSON. Much of the code here is based on the Yubico library example [1][2]. Implementation notes: - There are definitely better ways to alert the user about failure, but window.alert() will do for the time being. Using location.reload() is also a bit jarring if the page scrolls, but not a major issue. - Ideally we would use window.fetch() to do AJAX calls, but we don't have a polyfill for this, and we use $.ajax() elsewhere [3]. We need to do a few weird tricks [6] to stop jQuery trashing the data. - The FIDO2 server doesn't serve web requests; it's just a "server" in the sense of WebAuthn terminology. It lives in its own module, since it needs to be initialised with the app / config. - $.ajax returns a promise-like object. Although we've used ".fail()" elsewhere [3], I couldn't find a stub object that supports it, so I've gone for ".catch()", and used a Promise stub object in tests. - WebAuthn only works over HTTPS, but there's an exception for "localhost" [4]. However, the library is a bit too strict [5], so we have to disable origin verification to avoid needing HTTPS for dev work. [1]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/server.py [2]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/static/register.html [3]: https://github.com/alphagov/notifications-admin/blob/91453d36395b7a0cf2998dfb8a5f52cc9e96640f/app/assets/javascripts/updateContent.js#L33 [4]: https://stackoverflow.com/questions/55971593/navigator-credentials-is-null-on-local-server [5]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/fido2/rpid.py#L69 [6]: https://stackoverflow.com/questions/12394622/does-jquery-ajax-or-load-allow-for-responsetype-arraybuffer
2021-05-07 18:10:07 +01:00
# cryptography 3.4+ incorporates Rust code, which isn't supported on PaaS
# e.g. https://github.com/alphagov/notifications-api/pull/3126
cryptography<3.4
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
# gds-metrics requires prometheseus 0.2.0, override that requirement as later versions bring significant performance gains
skip prometheus-client 0.10.0 we saw exceptions on prod that I think might have caused a worker that is being terminated to die ungracefully. While I'm not sure if this is an actual problem that changed behaviour (app instances crashing and restarting), at the very least it definitely polluted the logs and obscured any actual issues we were having. https://github.com/prometheus/client_python/releases/tag/v0.10.0 see the pending fix for this problem here: https://github.com/prometheus/client_python/pull/644
2021-04-08 11:09:45 +01:00
# version 0.10.0 introduced exceptions when workers crashed due to deprecating lower case `prometheus_multiproc_dir`.
prometheus-client>=0.9.0,!=0.10.0
Copy requirements files to .in We’re going to move to using pip-tools for freezing requirements. pip-tools uses `.in` files for the un-frozen list of requirements, and then generates `.txt` equivalents. This commit just copies our existing `.txt` files, keeping the same name but giving them a `.in` extension ready for pip-tools to use.
2020-12-29 13:07:22 +00:00
gds-metrics==0.2.4
Reference in New Issue Copy Permalink