From 85a82ecb3cad8b89f26648706b1dade7600d0217 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Aug 2024 17:05:23 +0000 Subject: [PATCH 1/3] Bump certifi from 2024.2.2 to 2024.7.4 Bumps [certifi](https://github.com/certifi/python-certifi) from 2024.2.2 to 2024.7.4. - [Commits](https://github.com/certifi/python-certifi/compare/2024.02.02...2024.07.04) --- updated-dependencies: - dependency-name: certifi dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- poetry.lock | 10 +++++----- pyproject.toml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/poetry.lock b/poetry.lock index 4fefc57a6b2..70204f736b8 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1,4 +1,4 @@ -# This file is automatically @generated by Poetry 1.8.0 and should not be changed by hand. +# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand. [[package]] name = "aiohttp" @@ -499,13 +499,13 @@ zstd = ["zstandard (==0.22.0)"] [[package]] name = "certifi" -version = "2024.2.2" +version = "2024.7.4" description = "Python package for providing Mozilla's CA Bundle." optional = false python-versions = ">=3.6" files = [ - {file = "certifi-2024.2.2-py3-none-any.whl", hash = "sha256:dc383c07b76109f368f6106eee2b593b04a011ea4d55f652c6ca24a754d1cdd1"}, - {file = "certifi-2024.2.2.tar.gz", hash = "sha256:0569859f95fc761b18b45ef421b1290a0f65f147e92a1e5eb3e635f9a5e4e66f"}, + {file = "certifi-2024.7.4-py3-none-any.whl", hash = "sha256:c198e21b1289c2ab85ee4e67bb4b4ef3ead0892059901a8d5b622f24a1101e90"}, + {file = "certifi-2024.7.4.tar.gz", hash = "sha256:5a1e7645bc0ec61a09e26c36f6106dd4cf40c6db3a1fb6352b0244e7fb057c7b"}, ] [[package]] @@ -5013,4 +5013,4 @@ testing = ["coverage (>=5.0.3)", "zope.event", "zope.testing"] [metadata] lock-version = "2.0" python-versions = "^3.12" -content-hash = "78f529cdfdc2cbc64c62d3acb53e096f6a7090ade7e3ee70a232b059061ec13d" +content-hash = "94dbd37ea3b7d8a581f6d7af6679cc4cf5a0f02550f0a7806fbe49ffd8045fe4" diff --git a/pyproject.toml b/pyproject.toml index b78ec011364..39e03d98ab2 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -47,7 +47,7 @@ tqdm = "4.66.2" email-validator = "2.1.1" #" Python markdown extensions for comment emails markdown-del-ins = "1.0.0" -certifi = "2024.2.2" +certifi = "2024.7.4" sendgrid = "6.11.0" requests = "2.31.0" urllib3 = "1.26.18" # still <2.0 because elasticseach2 lib doesn't supprort urllib3>=2.0 From 586e8d8b1d546f874d71030bf62e9bf2582ec511 Mon Sep 17 00:00:00 2001 From: John Tordoff <> Date: Thu, 1 Aug 2024 13:08:28 -0400 Subject: [PATCH 2/3] security fixes --- requirements.txt | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/requirements.txt b/requirements.txt index 7fb762e01b0..759e40b3c66 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,7 +6,7 @@ # To install release requirements: inv requirements --release wheel==0.42.0 invoke==2.2.0 -Werkzeug==3.0.1 +Werkzeug==3.0.3 Flask==3.0.2 Mako==1.3.2 Markdown==3.5.2 @@ -22,7 +22,7 @@ python-dateutil==2.9.0 pytz==2024.1 bleach==6.1.0 bleach[css]==6.1.0 -pillow==10.2.0 +pillow==10.3.0 Markupsafe==2.1.5 blinker==1.7.0 furl==2.1.3 @@ -38,24 +38,24 @@ boto3==1.34.60 django-waffle==4.1.0 pymongo[ocsp]==3.13.0 # install to get bson module PyYAML==6.0.1 -tqdm==4.66.2 +tqdm==4.66.3 email-validator==2.1.1 # Python markdown extensions for comment emails markdown-del-ins==1.0.0 -certifi==2024.2.2 +certifi==2024.07.04 sendgrid==6.11.0 -requests==2.31.0 -urllib3==1.26.18 # still <2.0 because elasticseach2 lib doesn't supprort urllib3>=2.0 +requests==2.32.0 +urllib3==1.26.19 # still <2.0 because elasticseach2 lib doesn't supprort urllib3>=2.0 oauthlib==3.2.2 requests-oauthlib==1.3.1 -sentry-sdk[django, flask, celery]==2.2.0 +sentry-sdk[django, flask, celery]==2.8.0 django-redis==5.4.0 # API requirements -Django==4.2.13 -djangorestframework==3.15.1 +Django==4.2.14 +djangorestframework==3.15.2 django-cors-headers==4.3.1 djangorestframework-bulk==0.2.1 django-bulk-update==2.2.0 From 2fac2b6cbf538182dc83440c9a5d5e72bd07cd75 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 14 Aug 2024 17:54:41 +0000 Subject: [PATCH 3/3] Bump webob from 1.8.7 to 1.8.8 Bumps [webob](https://github.com/Pylons/webob) from 1.8.7 to 1.8.8. - [Changelog](https://github.com/Pylons/webob/blob/main/CHANGES.txt) - [Commits](https://github.com/Pylons/webob/compare/1.8.7...1.8.8) --- updated-dependencies: - dependency-name: webob dependency-type: indirect ... Signed-off-by: dependabot[bot] --- poetry.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/poetry.lock b/poetry.lock index 70204f736b8..1564e5fddc4 100644 --- a/poetry.lock +++ b/poetry.lock @@ -4741,13 +4741,13 @@ files = [ [[package]] name = "webob" -version = "1.8.7" +version = "1.8.8" description = "WSGI request and response object" optional = false -python-versions = ">=2.7,!=3.0.*,!=3.1.*,!=3.2.*" +python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7" files = [ - {file = "WebOb-1.8.7-py2.py3-none-any.whl", hash = "sha256:73aae30359291c14fa3b956f8b5ca31960e420c28c1bec002547fb04928cf89b"}, - {file = "WebOb-1.8.7.tar.gz", hash = "sha256:b64ef5141be559cfade448f044fa45c2260351edcb6a8ef6b7e00c7dcef0c323"}, + {file = "WebOb-1.8.8-py2.py3-none-any.whl", hash = "sha256:b60ba63f05c0cf61e086a10c3781a41fcfe30027753a8ae6d819c77592ce83ea"}, + {file = "webob-1.8.8.tar.gz", hash = "sha256:2abc1555e118fc251e705fc6dc66c7f5353bb9fbfab6d20e22f1c02b4b71bcee"}, ] [package.extras]