From 6464ffb8ed2ca9c3b283822f1e7b7547d14f7997 Mon Sep 17 00:00:00 2001
From: Chris Hill-Scott <me@quis.cc>
Date: Wed, 22 Dec 2021 11:43:09 +0000
Subject: [PATCH] Force lxml to latest version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Lower versions have a security vulnerability, see
https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8

The `pyexcel-*` packages which require `lxml` don’t pin a version.

`pip-compile` will respect what’s in `requirements.txt` as long as the
dependencies are fulfilled[1] so we don’t need to add it to
`requirements.in`

---

1. https://github.com/jazzband/pip-tools#updating-requirements
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index ec518b228..9047d5653 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -111,7 +111,7 @@ lml==0.1.0
     # via
     #   pyexcel
     #   pyexcel-io
-lxml==4.6.3
+lxml==4.6.5
     # via
     #   pyexcel-ezodf
     #   pyexcel-ods3