mirror of
https://github.com/GSA/notifications-api.git
synced 2026-01-08 11:47:47 -05:00
6c0bda0388
This brings in the version 5.2.1 of Kombu, which fixes a security
vulnerability:
> Celery 5.2.0 includes 'kombu' v5.2.1, which includes dependencies
> updates that resolve security issues.
— https://pyup.io/repos/github/alphagov/notifications-api/commits/?page=1#b654c27699a5164cbbe50e042d5d34141f560255
This is the commit from Kombu:
f3b04558fa
I believe the dependency of Kombu which has issues is urllib3, which
has two open advisories for versions less than 1.26.5:
- https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
44 lines
1.3 KiB
Plaintext
44 lines
1.3 KiB
Plaintext
# Run `make freeze-requirements` to update requirements.txt
|
||
# with package version changes made in requirements-app.txt
|
||
|
||
cffi==1.14.5
|
||
celery[sqs]==5.2.0
|
||
docopt==0.6.2
|
||
Flask-Bcrypt==0.7.1
|
||
flask-marshmallow==0.14.0
|
||
Flask-Migrate==2.7.0
|
||
git+https://github.com/mitsuhiko/flask-sqlalchemy.git@500e732dd1b975a56ab06a46bd1a20a21e682262#egg=Flask-SQLAlchemy==2.3.2.dev20190108
|
||
Flask==1.1.2
|
||
click-datetime==0.2
|
||
eventlet==0.30.2 # pyup: ignore # 0.31 breaks Gunicorn
|
||
gunicorn==20.1.0
|
||
iso8601==0.1.14
|
||
itsdangerous==1.1.0
|
||
jsonschema==3.2.0
|
||
marshmallow-sqlalchemy==0.23.1 # pyup: <0.24.0 # marshmallow v3 throws errors
|
||
marshmallow==2.21.0 # pyup: <3 # v3 throws errors
|
||
psycopg2-binary==2.8.6
|
||
PyJWT==2.0.1
|
||
SQLAlchemy==1.4.10
|
||
strict-rfc3339==0.7
|
||
rfc3987==1.3.8
|
||
cachetools==4.2.1
|
||
beautifulsoup4==4.9.3
|
||
lxml==4.6.3
|
||
Werkzeug==2.0.2
|
||
|
||
# higher version causes build to fail on PaaS due to lack of Rust
|
||
# see https://github.com/pyca/cryptography/issues/5810
|
||
cryptography<3.4 # pyup: <3.4
|
||
|
||
notifications-python-client==6.0.2
|
||
|
||
# PaaS
|
||
awscli-cwlogs==1.4.6
|
||
|
||
git+https://github.com/alphagov/notifications-utils.git@48.0.0#egg=notifications-utils==48.0.0
|
||
|
||
# gds-metrics requires prometheseus 0.2.0, override that requirement as 0.7.1 brings significant performance gains
|
||
prometheus-client==0.10.1
|
||
gds-metrics==0.2.4
|