From edd608a39494e115563a44488400a9fe1cb870a2 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Sat, 24 Aug 2024 03:02:32 +0000 Subject: [PATCH] fix: deploy_requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-7430173 - https://snyk.io/vuln/SNYK-PYTHON-GUNICORN-6615672 - https://snyk.io/vuln/SNYK-PYTHON-IDNA-6597975 - https://snyk.io/vuln/SNYK-PYTHON-JINJA2-6809379 - https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-6928867 - https://snyk.io/vuln/SNYK-PYTHON-SETUPTOOLS-7448482 --- deploy_requirements.txt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/deploy_requirements.txt b/deploy_requirements.txt index 8c2e6ceb..02e1ed28 100644 --- a/deploy_requirements.txt +++ b/deploy_requirements.txt @@ -3,7 +3,7 @@ Babel==2.9.1 docutils==0.17.1 gevent==21.1.2 greenlet==1.1.0 -gunicorn==19.8.1 +gunicorn==22.0.0 imagesize==1.2.0 packaging==20.9 Pygments==2.5.2 @@ -14,3 +14,8 @@ sphinxcontrib-websupport==1.1.2 typing==3.10.0.0 zope.event==4.5.0 zope.interface==5.4.0 +certifi>=2024.7.4 # not directly required, pinned by Snyk to avoid a vulnerability +idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability +jinja2>=3.1.4 # not directly required, pinned by Snyk to avoid a vulnerability +requests>=2.32.2 # not directly required, pinned by Snyk to avoid a vulnerability +setuptools>=70.0.0 # not directly required, pinned by Snyk to avoid a vulnerability