Update requests to fix CVEs (security)

CHANGELOG.rst

@@ -24,6 +24,9 @@ Fixed
 
 * Update cryptography 3.4.7 -> 39.0.1, pyOpenSSL 21.0.0 -> 23.1.0, paramiko 2.10.5 -> 2.11.0 (security). #6055
 
+* Bump virtualenv to 20.16.7, importlib-metadata to 4.10.1, requests to 2.31.0, gitpython to 3.1.37, and for Python3.8 only cryptography to 41.0.4, pyopenssl to 23.2.0. #6062
+  Contributed by @jk464
+
 Added
 ~~~~~
 

fixed-requirements.txt

@@ -7,12 +7,12 @@ chardet<3.1.0
 cffi<1.15.0
 # NOTE: 2.0 version breaks pymongo work with hosts
 dnspython>=1.16.0,<2.0.0
-cryptography==39.0.1
+cryptography>=40.0.2,<=41.0.4
 # Note: 0.20.0 removed select.poll() on which some of our code and libraries we
 # depend on rely
 eventlet==0.30.2
 flex==6.14.1
-gitpython==3.1.15
+gitpython>=3.1.18,<=3.1.37
 # Needed by gitpython, old versions used to bundle it
 gitdb==4.0.2
 # Note: greenlet is used by eventlet
@@ -45,22 +45,22 @@ pymongo==3.11.3
 pyparsing<3
 zstandard==0.15.2
 # pyOpenSSL 23.1.0 supports cryptography up to 40.0.x
-pyOpenSSL==23.1.0
+pyOpenSSL<=23.2.0
 python-editor==1.0.4
 python-keyczar==0.716
 pytz==2021.1
 pywinrm==0.4.1
 pyyaml==5.4.1
 redis==4.1.4
-requests[security]==2.25.1
+requests[security]>=2.27.1,<=2.31.0
 retrying==1.3.3
 routes==2.4.1
 semver==2.13.0
 six==1.13.0
 argparse==1.12.2
 argcomplete==1.12.2
 prettytable==2.1.0
-importlib-metadata==3.10.1
+importlib-metadata<=4.10.1
 # importlib-metadata requires typing-extensions but v4.2.0 requires py3.7+
 typing-extensions<4.2
 # NOTE: sseclient has various issues which sometimes hang the connection for a long time, etc.

requirements-pants.txt

@@ -16,7 +16,7 @@ eventlet<0.31
 flex
 # gitpython & gitdb are used for pack management
 gitdb
-gitpython
+gitpython>=3.1.18,<=3.1.37
 # st2common/tests/integration/test_util_green.py requires greenlet (as does eventlet)
 greenlet
 gunicorn

requirements.txt

@@ -14,16 +14,16 @@ bcrypt==3.2.0
 cffi<1.15.0
 chardet<3.1.0
 ciso8601
-cryptography==39.0.1
+cryptography>=40.0.2,<=41.0.4
 decorator==4.4.2
 dnspython>=1.16.0,<2.0.0
 eventlet==0.30.2
 flex==6.14.1
 gitdb==4.0.2
-gitpython==3.1.15
+gitpython>=3.1.18,<=3.1.37
 greenlet==1.0.0
 gunicorn==20.1.0
-importlib-metadata==3.10.1
+importlib-metadata<=4.10.1
 jinja2==2.11.3
 jsonpath-rw==1.4.0
 jsonschema==2.6.0
@@ -45,7 +45,7 @@ passlib==1.7.4
 prettytable==2.1.0
 prompt-toolkit==1.0.15
 psutil==5.8.0
-pyOpenSSL==23.1.0
+pyOpenSSL<=23.2.0
 pyinotify==0.9.6 ; platform_system=="Linux"
 pymongo==3.11.3
 pyparsing<3
@@ -60,7 +60,7 @@ pywinrm==0.4.1
 pyyaml==5.4.1
 redis==4.1.4
 rednose
-requests[security]==2.25.1
+requests[security]>=2.27.1,<=2.31.0
 retrying==1.3.3
 routes==2.4.1
 semver==2.13.0

st2actions/requirements.txt

@@ -9,7 +9,7 @@ MarkupSafe<2.1.0,>=0.23
 apscheduler==3.7.0
 chardet<3.1.0
 eventlet==0.30.2
-gitpython==3.1.15
+gitpython>=3.1.18,<=3.1.37
 jinja2==2.11.3
 kombu==5.0.2
 lockfile==0.12.2
@@ -21,5 +21,5 @@ pyparsing<3
 python-dateutil==2.8.1
 python-json-logger
 pyyaml==5.4.1
-requests[security]==2.25.1
+requests[security]>=2.27.1,<=2.31.0
 six==1.13.0

st2client/requirements.txt

@@ -8,20 +8,20 @@
 argcomplete==1.12.2
 cffi<1.15.0
 chardet<3.1.0
-cryptography==39.0.1
-importlib-metadata==3.10.1
+cryptography>=40.0.2,<=41.0.4
+importlib-metadata<=4.10.1
 jsonpath-rw==1.4.0
 jsonschema==2.6.0
 orjson==3.5.2
 prettytable==2.1.0
 prompt-toolkit==1.0.15
-pyOpenSSL==23.1.0
+pyOpenSSL<=23.2.0
 pysocks
 python-dateutil==2.8.1
 python-editor==1.0.4
 pytz==2021.1
 pyyaml==5.4.1
-requests[security]==2.25.1
+requests[security]>=2.27.1,<=2.31.0
 six==1.13.0
 sseclient-py==1.7
 typing-extensions<4.2

st2common/requirements.txt

@@ -11,13 +11,13 @@ apscheduler==3.7.0
 cffi<1.15.0
 chardet<3.1.0
 ciso8601
-cryptography==39.0.1
+cryptography>=40.0.2,<=41.0.4
 decorator==4.4.2
 dnspython>=1.16.0,<2.0.0
 eventlet==0.30.2
 flex==6.14.1
 gitdb==4.0.2
-gitpython==3.1.15
+gitpython>=3.1.18,<=3.1.37
 greenlet==1.0.0
 jinja2==2.11.3
 jsonpath-rw==1.4.0
@@ -30,13 +30,13 @@ orjson==3.5.2
 orquesta@ git+https://github.com/StackStorm/orquesta.git@v1.5.0
 oslo.config>=1.12.1,<1.13
 paramiko==2.11.0
-pyOpenSSL==23.1.0
+pyOpenSSL<=23.2.0
 pymongo==3.11.3
 python-dateutil==2.8.1
 python-statsd==2.1.0
 pyyaml==5.4.1
 redis==4.1.4
-requests[security]==2.25.1
+requests[security]>=2.27.1,<=2.31.0
 retrying==1.3.3
 routes==2.4.1
 semver==2.13.0

st2common/tests/fixtures/requirements-used-for-tests.txt

@@ -14,7 +14,7 @@ git+https://github.com/StackStorm/st2-auth-backend-flat-file.git@master#egg=st2-
 git+https://github.com/StackStorm/st2.git#egg=python_runner&subdirectory=contrib/runners/python_runner
 hg+https://hg.repo/some_pkg.git#egg=SomePackageHq
 svn+svn://svn.repo/some_pkg/trunk/@ma-branch#egg=SomePackageSvn
-gitpython==2.1.11
+gitpython>=3.1.18,<=3.1.37
 ose-timer==0.7.5
 oslo.config<1.13,>=1.12.1
 requests[security]<2.22.0,>=2.21.0