Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

temporary pin requests!=2.32 to avoid issue with docker-py #653

Merged
merged 2 commits into from
May 22, 2024
Merged

temporary pin requests!=2.32 to avoid issue with docker-py #653

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a765af2
temporary pin requests!=2.32 to avoid issue with docker-py (relates t…
fmigneault May 22, 2024
61551ac
update changes
fmigneault May 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
8 changes: 7 additions & 1 deletion CHANGES.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,13 @@ Changes:

Fixes:
------
- No change.
- Pin ``requests!=2.32`` to avoid issue with ``docker-py`` custom adapter not (yet) supporting it
(relates to `psf/requests#6710 <https://github.com/psf/requests/pull/6710>`_
and `docker/docker-py#3257 <https://github.com/docker/docker-py/pull/3257>`_).
Pinning ``requests>=2.32.2`` *should* be applied when possible (when ``docker-py`` is released) to address
`CVE-2024-35195 <https://nvd.nist.gov/vuln/detail/CVE-2024-35195>`_. However, the corresponding ``verify=False``
option affected by this CVE is not recommended for use in `Weaver`, and should be avoided entirely anyway.
Could affect *requests options* if the corresponding ``verify: false`` configuration was employed.

.. _changes_5.3.0:

Expand Down
6 changes: 5 additions & 1 deletion requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,11 @@ pytz
pywps==4.6.0
pyyaml>=5.2
rdflib>=5 # pyup: ignore
requests
# FIXME: temporary workaround
# 'requests=2.32' needed for CVE-2024-35195
# (https://github.com/psf/requests/releases/tag/v2.32.0, https://github.com/psf/requests/pull/6710)
# however, https://github.com/docker/docker-py/pull/3257 not yet released, 'docker-py' broken by 'requests=2.32' change
requests!=2.32
requests_file
ruamel.yaml>=0.16
# force use of later mistune (https://github.com/common-workflow-language/schema_salad/pull/619#issuecomment-1346025607)
Expand Down