From 85a82ecb3cad8b89f26648706b1dade7600d0217 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Aug 2024 17:05:23 +0000 Subject: [PATCH 1/3] Bump certifi from 2024.2.2 to 2024.7.4 Bumps [certifi](https://github.com/certifi/python-certifi) from 2024.2.2 to 2024.7.4. - [Commits](https://github.com/certifi/python-certifi/compare/2024.02.02...2024.07.04) --- updated-dependencies: - dependency-name: certifi dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- poetry.lock | 10 +++++----- pyproject.toml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/poetry.lock b/poetry.lock index 4fefc57a6b2..70204f736b8 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1,4 +1,4 @@ -# This file is automatically @generated by Poetry 1.8.0 and should not be changed by hand. +# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand. [[package]] name = "aiohttp" @@ -499,13 +499,13 @@ zstd = ["zstandard (==0.22.0)"] [[package]] name = "certifi" -version = "2024.2.2" +version = "2024.7.4" description = "Python package for providing Mozilla's CA Bundle." optional = false python-versions = ">=3.6" files = [ - {file = "certifi-2024.2.2-py3-none-any.whl", hash = "sha256:dc383c07b76109f368f6106eee2b593b04a011ea4d55f652c6ca24a754d1cdd1"}, - {file = "certifi-2024.2.2.tar.gz", hash = "sha256:0569859f95fc761b18b45ef421b1290a0f65f147e92a1e5eb3e635f9a5e4e66f"}, + {file = "certifi-2024.7.4-py3-none-any.whl", hash = "sha256:c198e21b1289c2ab85ee4e67bb4b4ef3ead0892059901a8d5b622f24a1101e90"}, + {file = "certifi-2024.7.4.tar.gz", hash = "sha256:5a1e7645bc0ec61a09e26c36f6106dd4cf40c6db3a1fb6352b0244e7fb057c7b"}, ] [[package]] @@ -5013,4 +5013,4 @@ testing = ["coverage (>=5.0.3)", "zope.event", "zope.testing"] [metadata] lock-version = "2.0" python-versions = "^3.12" -content-hash = "78f529cdfdc2cbc64c62d3acb53e096f6a7090ade7e3ee70a232b059061ec13d" +content-hash = "94dbd37ea3b7d8a581f6d7af6679cc4cf5a0f02550f0a7806fbe49ffd8045fe4" diff --git a/pyproject.toml b/pyproject.toml index b78ec011364..39e03d98ab2 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -47,7 +47,7 @@ tqdm = "4.66.2" email-validator = "2.1.1" #" Python markdown extensions for comment emails markdown-del-ins = "1.0.0" -certifi = "2024.2.2" +certifi = "2024.7.4" sendgrid = "6.11.0" requests = "2.31.0" urllib3 = "1.26.18" # still <2.0 because elasticseach2 lib doesn't supprort urllib3>=2.0 From 586e8d8b1d546f874d71030bf62e9bf2582ec511 Mon Sep 17 00:00:00 2001 From: John Tordoff <> Date: Thu, 1 Aug 2024 13:08:28 -0400 Subject: [PATCH 2/3] security fixes --- requirements.txt | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/requirements.txt b/requirements.txt index 7fb762e01b0..759e40b3c66 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,7 +6,7 @@ # To install release requirements: inv requirements --release wheel==0.42.0 invoke==2.2.0 -Werkzeug==3.0.1 +Werkzeug==3.0.3 Flask==3.0.2 Mako==1.3.2 Markdown==3.5.2 @@ -22,7 +22,7 @@ python-dateutil==2.9.0 pytz==2024.1 bleach==6.1.0 bleach[css]==6.1.0 -pillow==10.2.0 +pillow==10.3.0 Markupsafe==2.1.5 blinker==1.7.0 furl==2.1.3 @@ -38,24 +38,24 @@ boto3==1.34.60 django-waffle==4.1.0 pymongo[ocsp]==3.13.0 # install to get bson module PyYAML==6.0.1 -tqdm==4.66.2 +tqdm==4.66.3 email-validator==2.1.1 # Python markdown extensions for comment emails markdown-del-ins==1.0.0 -certifi==2024.2.2 +certifi==2024.07.04 sendgrid==6.11.0 -requests==2.31.0 -urllib3==1.26.18 # still <2.0 because elasticseach2 lib doesn't supprort urllib3>=2.0 +requests==2.32.0 +urllib3==1.26.19 # still <2.0 because elasticseach2 lib doesn't supprort urllib3>=2.0 oauthlib==3.2.2 requests-oauthlib==1.3.1 -sentry-sdk[django, flask, celery]==2.2.0 +sentry-sdk[django, flask, celery]==2.8.0 django-redis==5.4.0 # API requirements -Django==4.2.13 -djangorestframework==3.15.1 +Django==4.2.14 +djangorestframework==3.15.2 django-cors-headers==4.3.1 djangorestframework-bulk==0.2.1 django-bulk-update==2.2.0 From 53f042f9555020736c10cf2f715d0fca0c16294f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 29 Oct 2024 15:11:10 +0000 Subject: [PATCH 3/3] Bump waitress from 3.0.0 to 3.0.1 Bumps [waitress](https://github.com/Pylons/waitress) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/Pylons/waitress/releases) - [Changelog](https://github.com/Pylons/waitress/blob/main/CHANGES.txt) - [Commits](https://github.com/Pylons/waitress/compare/v3.0.0...v3.0.1) --- updated-dependencies: - dependency-name: waitress dependency-type: indirect ... Signed-off-by: dependabot[bot] --- poetry.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/poetry.lock b/poetry.lock index 70204f736b8..e46088d07c8 100644 --- a/poetry.lock +++ b/poetry.lock @@ -4704,13 +4704,13 @@ test = ["covdefaults (>=2.3)", "coverage (>=7.2.7)", "coverage-enable-subprocess [[package]] name = "waitress" -version = "3.0.0" +version = "3.0.1" description = "Waitress WSGI server" optional = false -python-versions = ">=3.8.0" +python-versions = ">=3.9.0" files = [ - {file = "waitress-3.0.0-py3-none-any.whl", hash = "sha256:2a06f242f4ba0cc563444ca3d1998959447477363a2d7e9b8b4d75d35cfd1669"}, - {file = "waitress-3.0.0.tar.gz", hash = "sha256:005da479b04134cdd9dd602d1ee7c49d79de0537610d653674cc6cbde222b8a1"}, + {file = "waitress-3.0.1-py3-none-any.whl", hash = "sha256:26cdbc593093a15119351690752c99adc13cbc6786d75f7b6341d1234a3730ac"}, + {file = "waitress-3.0.1.tar.gz", hash = "sha256:ef0c1f020d9f12a515c4ec65c07920a702613afcad1dbfdc3bcec256b6c072b3"}, ] [package.extras]