Update h11 to 0.16.0

Merge pull request #1656 from GSA/login_gov_cert
refreshing login.gov cert instructions
2026-08-25 00:33:41 -04:00 · 2025-04-24 12:41:21 -06:00 · 2025-04-24 11:53:41 -04:00 · 2025-04-24 09:46:03 -06:00 · 2025-04-24 15:25:37 +00:00 · 2025-04-24 09:23:24 -06:00
3 changed files with 96 additions and 515 deletions
--- a/docs/all.md
+++ b/docs/all.md
@@ -1507,3 +1507,19 @@ Note: better to search on space 'notify-production' rather than specifically for
 #notify-admin-1505 (general login issues)
 #notify-admin-1701 (wrong sender phone number)
 #notify-admin-1859 (job is created with created_at being the wrong time)
+
+### refreshing the login.gov certificate
+
+1. generate certificate:   `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.crt -nodes`
+2. update the github secrets for staging, demo, production (contents of key.pem go in LOGIN_PEM and contents of cert.crt in LOGIN_PUB).
+DO NOT RESTAGE YET.
+3. use the same certificate for staging, demo, and production
+4. login to the login.gov partner app (https://portal.int.identitysandbox.gov)
+5. add the new certificate to the production version of Notify in the partner app (our partner app account has sandbox and production)
+6. Make a Zendesk support request for login.gov to push the new version of Notify (https://zendesk.login.gov)
+7. Do not delete the old certificate, because you need things to keep working until you complete the transition.
+8. When you receive an email from login.gov that the app has been pushed successfully, restage notify on the staging tier
+9. If staging works, you can restage demo and production
+10. Delete the old certificate in the partner app, send another zendesk request to push again.  This is best practice but a lower
+priority, because certificates eventually expire anyway and we have changed the certificate in github secrets, so the old cert is
+no longer relevant.
--- a/poetry.lock
+++ b/poetry.lock
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -29,19 +29,19 @@ expiringdict = "==1.2.2"
 flask = "~=3.0"
 flask-bcrypt = "==1.0.1"
 flask-marshmallow = "==1.2.1"
-flask-migrate = "==4.0.7"
+flask-migrate = "==4.1.0"
 flask-redis = "==0.4.0"
 flask-sqlalchemy = "==3.1.1"
 gunicorn = {version = "==23.0.0", extras = ["eventlet"]}
 iso8601 = "==2.1.0"
 jsonschema = {version = "==4.23.0", extras = ["format"]}
 lxml = "==5.3.1"
-marshmallow = "==4.0.0"
+marshmallow = "==3.26.1"
 marshmallow-sqlalchemy = "==1.0.0"
 newrelic = "*"
 notifications-python-client = "==10.0.0"
 oscrypto = { git = "https://github.com/wbond/oscrypto.git", rev = "1547f53" }
-packaging = "==24.2"
+packaging = "==25.0"
 poetry-dotenv-plugin = "==0.2.0"
 psycopg2-binary = "==2.9.9"
 pyjwt = "==2.10.1"
@@ -55,7 +55,7 @@ geojson = "^3.2.0"
 numpy = "^2.2.5"
 ordered-set = "^4.1.0"
 phonenumbers = "^8.13.42"
-python-json-logger = "^2.0.7"
+python-json-logger = "^3.3.0"
 regex = "^2024.11.6"
 shapely = "^2.0.5"
 smartypants = "^2.0.1"
Author	SHA1	Message	Date
Andrew Shumway	b6aa359957	Update h11 to 0.16.0	2025-04-24 12:41:21 -06:00
Cliff Hill	2fb1e96ba2	Merge pull request #1656 from GSA/login_gov_cert refreshing login.gov cert instructions	2025-04-24 11:53:41 -04:00
Andrew Shumway	9f0b6b0ca1	Merge pull request #1664 from GSA/dependabot/pip/packaging-25.0 Bump packaging from 24.2 to 25.0	2025-04-24 09:46:03 -06:00
dependabot[bot]	7dd1751556	Bump packaging from 24.2 to 25.0 Bumps [packaging](https://github.com/pypa/packaging) from 24.2 to 25.0. - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pypa/packaging/compare/24.2...25.0) --- updated-dependencies: - dependency-name: packaging dependency-version: '25.0' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-04-24 15:25:37 +00:00
Andrew Shumway	3ae7749d0b	Merge pull request #1663 from GSA/dependabot/pip/python-json-logger-3.3.0 Bump python-json-logger from 2.0.7 to 3.3.0	2025-04-24 09:23:24 -06:00
dependabot[bot]	f6cc4afab7	Bump python-json-logger from 2.0.7 to 3.3.0 Bumps [python-json-logger](https://github.com/nhairs/python-json-logger) from 2.0.7 to 3.3.0. - [Release notes](https://github.com/nhairs/python-json-logger/releases) - [Changelog](https://github.com/nhairs/python-json-logger/blob/main/docs/changelog.md) - [Commits](https://github.com/nhairs/python-json-logger/compare/v2.0.7...v3.3.0) --- updated-dependencies: - dependency-name: python-json-logger dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-04-24 15:11:34 +00:00
Andrew Shumway	6325849855	Merge pull request #1662 from GSA/dependabot/pip/flask-migrate-4.1.0 Bump flask-migrate from 4.0.7 to 4.1.0	2025-04-24 09:09:24 -06:00
dependabot[bot]	b564a8800e	Bump flask-migrate from 4.0.7 to 4.1.0 Bumps [flask-migrate](https://github.com/miguelgrinberg/flask-migrate) from 4.0.7 to 4.1.0. - [Release notes](https://github.com/miguelgrinberg/flask-migrate/releases) - [Changelog](https://github.com/miguelgrinberg/Flask-Migrate/blob/main/CHANGES.md) - [Commits](https://github.com/miguelgrinberg/flask-migrate/compare/v4.0.7...v4.1.0) --- updated-dependencies: - dependency-name: flask-migrate dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-04-23 22:08:21 +00:00
Kenneth Kehl	d99661863f	Update docs/all.md Co-authored-by: ccostino <ccostino@users.noreply.github.com>	2025-04-22 07:08:02 -07:00
Kenneth Kehl	0a6bbe035a	refreshing login.gov cert instructions	2025-04-21 10:13:49 -07:00