From f34d1fc9149eb2bb849bfa712b5598953c0ebfb8 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Tue, 9 Dec 2025 05:36:14 +0000 Subject: [PATCH] fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-14157807 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-14157810 - https://snyk.io/vuln/SNYK-PYTHON-SQLPARSE-14157217 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-14192442 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-14192443 --- requirements.txt | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/requirements.txt b/requirements.txt index d8b6e0742f..cc681e82cc 100644 --- a/requirements.txt +++ b/requirements.txt @@ -12,7 +12,7 @@ botocore>=1.35,<1.36 celery>=5.2.6 coverage>=4.5.4,<5.0 # Coverage 5.x moves from a json database to SQLite. Moving to 5.x will require substantial rewrites in ietf.utils.test_runner and ietf.release.views defusedxml>=0.7.1 # for TastyPie when using xml; not a declared dependency -Django>4.2,<5 +Django>4.2.27 django-analytical>=3.1.0 django-bootstrap5>=21.3 django-celery-beat>=2.3.0 @@ -79,7 +79,8 @@ tblib>=1.7.0 # So that the django test runner provides tracebacks tlds>=2022042700 # Used to teach bleach about which TLDs currently exist tqdm>=4.64.0 Unidecode>=1.3.4 -urllib3>=1.26,<2 +urllib3>=2.6.0 weasyprint>=64.1 xml2rfc>=3.23.0 xym>=0.6,<1.0 +sqlparse>=0.5.4 # not directly required, pinned by Snyk to avoid a vulnerability