From eac696d7fe04e162b17e82391b3cc57a4ed23b5f Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Fri, 16 Aug 2024 10:46:40 +0000 Subject: [PATCH] fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-3164749 - https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-5805047 - https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-7430173 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-1066259 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-1279042 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-1290072 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-1298665 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2312875 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2329158 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2329159 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2329160 - https://snyk.io/vuln/SNYK-PYTHON-REDIS-5291195 --- requirements.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/requirements.txt b/requirements.txt index b71d306f..be2f7046 100644 --- a/requirements.txt +++ b/requirements.txt @@ -26,3 +26,5 @@ kf_lib_data_ingest @ git+https://git@github.com/kids-first/kf-lib-data-ingest.gi graphene_django @ git+https://git@github.com/graphql-python/graphene-django.git@d52b18a700d2c1cec4b2de1f673bff14e2d18071 marshmallow==3.12.1 XlsxWriter==1.4.4 +certifi>=2024.7.4 # not directly required, pinned by Snyk to avoid a vulnerability +redis>=4.3.6 # not directly required, pinned by Snyk to avoid a vulnerability